cgraphx 1.4.1 → 2.0.0

package/scripts/npm-shim.js

@@ -1,246 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-//
-// npm thin-installer launcher for CodeGraph.
-//
-// The heavy artifact (a vendored Node runtime + the app) ships as a per-platform
-// optionalDependency: cgraphx-<platform>-<arch>. npm installs
-// only the one matching the host, via each package's `os`/`cpu` fields (the
-// esbuild pattern). This shim — run by the user's OWN Node — locates that bundle
-// and execs its launcher, so the real work always runs on the bundled Node 24
-// (with node:sqlite), regardless of the user's Node version. The user's Node is
-// only ever a launcher; even an ancient version can run this file.
-//
-// Self-heal (issue #303): some registries — notably the npmmirror/cnpm mirrors,
-// and some corporate proxies — don't reliably mirror the per-platform
-// optionalDependencies. npm treats an unfetchable optional dep as success and
-// silently skips it, so the bundle goes missing and every command fails. When
-// the installed bundle can't be resolved, this shim falls back to downloading
-// the matching bundle straight from GitHub Releases — the very archive
-// install.sh uses — into a cache dir, then runs that. Knobs:
-//   CGRAPHX_NO_DOWNLOAD=1     disable the network fallback (print guidance)
-//   CGRAPHX_INSTALL_DIR=DIR   cache location (default: ~/.cgraphx)
-//   CGRAPHX_DOWNLOAD_BASE=URL release-download base (for mirrors/air-gapped)
-//
-// Wired up at release time as the main package's `bin`:
-//   "bin": { "cgraphx": "npm-shim.js" }
-// with the platform packages listed in `optionalDependencies`.
-
-var childProcess = require('child_process');
-var fs = require('fs');
-var os = require('os');
-var path = require('path');
-
-var target = process.platform + '-' + process.arch; // e.g. darwin-arm64, linux-x64
-var pkg = 'cgraphx-' + target;
-var isWindows = process.platform === 'win32';
-var REPO = 'smdnkB/cgraphx';
-
-main().catch(function (e) {
-  process.stderr.write('cgraphx: ' + (e && e.message ? e.message : String(e)) + '\n');
-  process.exit(1);
-});
-
-async function main() {
-  // Happy path: the npm-installed optional dependency. Fall back to a download
-  // when the registry didn't deliver it.
-  var resolved = resolveInstalledBundle() || (await selfHealBundle());
-  var res = childProcess.spawnSync(resolved.command, resolved.args, { stdio: 'inherit' });
-  if (res.error) {
-    process.stderr.write('cgraphx: ' + res.error.message + '\n');
-    process.exit(1);
-  }
-  process.exit(res.status === null ? 1 : res.status);
-}
-
-// Resolve the launcher from the installed per-platform optionalDependency.
-// Returns {command, args} or null if the package isn't installed.
-function resolveInstalledBundle() {
-  try {
-    if (isWindows) {
-      // Modern Node refuses to spawn the bundle's .cmd directly (EINVAL, the
-      // CVE-2024-27980 hardening on Node 24), so invoke the bundled node.exe
-      // against the app entry point and pass --liftoff-only here.
-      var nodeExe = require.resolve(pkg + '/node.exe');
-      var entry = require.resolve(pkg + '/lib/dist/bin/codegraph.js');
-      return { command: nodeExe, args: liftoff(entry) };
-    }
-    return { command: require.resolve(pkg + '/bin/cgraphx'), args: process.argv.slice(2) };
-  } catch (e) {
-    return null;
-  }
-}
-
-// Locate the launcher inside an extracted GitHub bundle directory (same
-// node/lib/bin layout as the npm platform package). Returns {command, args} or
-// null when the directory doesn't hold a usable bundle yet.
-function launcherIn(dir) {
-  if (isWindows) {
-    var nodeExe = path.join(dir, 'node.exe');
-    var entry = path.join(dir, 'lib', 'dist', 'bin', 'codegraph.js');
-    if (fs.existsSync(nodeExe) && fs.existsSync(entry)) {
-      return { command: nodeExe, args: liftoff(entry) };
-    }
-  } else {
-    var launcher = path.join(dir, 'bin', 'cgraphx');
-    if (fs.existsSync(launcher)) return { command: launcher, args: process.argv.slice(2) };
-  }
-  return null;
-}
-
-// --liftoff-only keeps tree-sitter's WASM grammars off V8's turboshaft tier to
-// avoid the Zone OOM on Node >= 22 (issues #293/#298). The unix bin/cgraphx
-// launcher already passes it; on Windows we invoke node.exe directly so add it.
-function liftoff(entry) {
-  return ['--liftoff-only', entry].concat(process.argv.slice(2));
-}
-
-// Download + cache the platform bundle from GitHub Releases. Returns
-// {command, args}; exits the process with guidance if it can't.
-async function selfHealBundle() {
-  var version = readVersion();
-  var bundlesDir = path.join(process.env.CGRAPHX_INSTALL_DIR || path.join(os.homedir(), '.cgraphx'), 'bundles');
-  var dest = path.join(bundlesDir, target + '-' + version);
-
-  // Already downloaded by a previous run? Use it even when downloads are
-  // disabled — CGRAPHX_NO_DOWNLOAD blocks fetching, not a cached bundle.
-  var cached = launcherIn(dest);
-  if (cached) return cached;
-
-  if (process.env.CGRAPHX_NO_DOWNLOAD) {
-    fail('the network fallback is disabled (CGRAPHX_NO_DOWNLOAD is set).');
-  }
-
-  var asset = 'cgraphx-' + target + (isWindows ? '.zip' : '.tar.gz');
-  var base = process.env.CGRAPHX_DOWNLOAD_BASE || ('https://github.com/' + REPO + '/releases/download');
-  var url = base + '/v' + version + '/' + asset;
-
-  process.stderr.write(
-    'cgraphx: platform bundle missing (registry did not provide ' + pkg + ').\n' +
-    'cgraphx: downloading ' + asset + ' from GitHub Releases (' + version + ')...\n'
-  );
-
-  // Stage inside bundlesDir so the final rename is on the same filesystem (atomic,
-  // no EXDEV across tmpfs). Strip the archive's top-level cgraphx-<target>/ dir.
-  fs.mkdirSync(bundlesDir, { recursive: true });
-  var stage = fs.mkdtempSync(path.join(bundlesDir, '.dl-'));
-  try {
-    var archivePath = path.join(stage, asset);
-    await download(url, archivePath, 6);
-    await verifyChecksum(archivePath, asset, base, version);
-    var extracted = path.join(stage, 'bundle');
-    fs.mkdirSync(extracted);
-    extract(archivePath, extracted);
-
-    var raced = launcherIn(dest); // another process may have finished meanwhile
-    if (raced) { rmrf(stage); return raced; }
-    try {
-      fs.renameSync(extracted, dest);
-    } catch (e) {
-      var other = launcherIn(dest); // lost the race but theirs is valid
-      if (other) { rmrf(stage); return other; }
-      throw e;
-    }
-  } catch (e) {
-    rmrf(stage);
-    fail('download failed (' + e.message + ').\n  URL: ' + url);
-  }
-  rmrf(stage);
-
-  var ready = launcherIn(dest);
-  if (!ready) fail('downloaded bundle is missing its launcher under ' + dest + '.');
-  process.stderr.write('cgraphx: bundle ready.\n');
-  return ready;
-}
-
-function readVersion() {
-  try {
-    return require(path.join(__dirname, 'package.json')).version;
-  } catch (e) {
-    fail('could not read this package\'s version to locate a matching release.');
-  }
-}
-
-// GET with manual redirect following (GitHub release URLs redirect to a CDN).
-function download(url, dest, redirectsLeft) {
-  return new Promise(function (resolve, reject) {
-    var https = require('https');
-    // timeout is an idle/inactivity timeout — it won't kill a slow-but-progressing
-    // download, only a stalled connection (so a blocked mirror fails fast with
-    // guidance instead of hanging the user's command forever).
-    var req = https.get(url, { headers: { 'User-Agent': 'codegraph-npm-shim' }, timeout: 30000 }, function (res) {
-      var status = res.statusCode;
-      if (status >= 300 && status < 400 && res.headers.location) {
-        res.resume();
-        if (redirectsLeft <= 0) { reject(new Error('too many redirects')); return; }
-        download(new URL(res.headers.location, url).toString(), dest, redirectsLeft - 1).then(resolve, reject);
-        return;
-      }
-      if (status !== 200) { res.resume(); reject(new Error('HTTP ' + status)); return; }
-      var file = fs.createWriteStream(dest);
-      res.on('error', reject);
-      res.pipe(file);
-      file.on('error', reject);
-      file.on('finish', function () { file.close(function () { resolve(); }); });
-    });
-    req.on('timeout', function () { req.destroy(new Error('connection timed out')); });
-    req.on('error', reject);
-  });
-}
-
-// Best-effort integrity check. When the release publishes a SHA256SUMS file, the
-// downloaded archive MUST match its listed hash or we abort. When that file is
-// absent (older releases) or simply unreachable, we proceed — the archive still
-// arrived from GitHub over TLS. So tampering/corruption is caught, while a
-// missing checksum never breaks an install.
-async function verifyChecksum(archivePath, asset, base, version) {
-  var sumsPath = archivePath + '.SHA256SUMS';
-  try {
-    await download(base + '/v' + version + '/SHA256SUMS', sumsPath, 6);
-  } catch (e) {
-    return; // not published / unreachable → skip
-  }
-  var expected = null;
-  var lines = fs.readFileSync(sumsPath, 'utf8').split('\n');
-  for (var i = 0; i < lines.length; i++) {
-    var m = lines[i].trim().match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/);
-    if (m && path.basename(m[2].trim()) === asset) { expected = m[1].toLowerCase(); break; }
-  }
-  if (!expected) return; // asset not listed → nothing to check
-  var actual = require('crypto').createHash('sha256').update(fs.readFileSync(archivePath)).digest('hex');
-  if (actual !== expected) {
-    throw new Error('checksum mismatch for ' + asset +
-      ' (expected ' + expected.slice(0, 12) + '…, got ' + actual.slice(0, 12) + '…)');
-  }
-  process.stderr.write('cgraphx: checksum verified.\n');
-}
-
-// Extract via the system tar — present on macOS, Linux, and Windows 10+
-// (bsdtar reads .zip too). No third-party dependency in the shim.
-function extract(archive, destDir) {
-  var args = isWindows
-    ? ['-xf', archive, '-C', destDir, '--strip-components=1']
-    : ['-xzf', archive, '-C', destDir, '--strip-components=1'];
-  var res = childProcess.spawnSync('tar', args, { stdio: 'ignore' });
-  if (res.error) throw new Error('tar unavailable: ' + res.error.message);
-  if (res.status !== 0) throw new Error('tar exited ' + res.status);
-}
-
-function rmrf(p) {
-  try { fs.rmSync(p, { recursive: true, force: true }); } catch (e) { /* best effort */ }
-}
-
-function fail(reason) {
-  process.stderr.write(
-    'cgraphx: no prebuilt bundle for ' + target + '.\n' +
-    (reason ? 'cgraphx: ' + reason + '\n' : '') +
-    'Expected the optional package ' + pkg + ' to be installed.\n' +
-    'A registry mirror (e.g. npmmirror/cnpm) that did not mirror the per-platform\n' +
-    'package is the usual cause. Fixes:\n' +
-    '  - install from the official registry:\n' +
-    '      npm i -g cgraphx --registry=https://registry.npmjs.org\n' +
-    '  - or use the standalone installer (no Node required):\n' +
-    '      curl -fsSL https://raw.githubusercontent.com/' + REPO + '/main/install.sh | sh\n'
-  );
-  process.exit(1);
-}

package/scripts/pack-npm.sh

@@ -1,118 +0,0 @@
-#!/usr/bin/env bash
-#
-# Assemble the npm thin-installer packages from built bundles (esbuild pattern).
-#
-# Produces, under release/npm/:
-#   cgraphx-<target>/   one per built bundle — the vendored Node + app, tagged
-#                       with os/cpu so npm installs only the matching one.
-#   main/               the cgraphx shim package: a tiny bin
-#                       that execs the matching platform bundle, with every
-#                       platform package in optionalDependencies.
-#
-# The release pipeline then `npm publish`es each dir. This does NOT touch the
-# repo's package.json — the dev/from-source path keeps working; the *published*
-# main package's shape is generated here.
-#
-# Prereq: run build-bundle.sh for each target first (release/cgraphx-*.tar.gz).
-# Usage:  scripts/pack-npm.sh [version]    (default: version from package.json)
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-VERSION="${1:-$(node -p "require('$ROOT/package.json').version")}"
-REL="$ROOT/release"
-NPM="$REL/npm"
-
-rm -rf "$NPM"
-mkdir -p "$NPM/main"
-
-shopt -s nullglob
-archives=("$REL"/cgraphx-*.tar.gz "$REL"/cgraphx-*.zip)
-[ ${#archives[@]} -gt 0 ] || { echo "[pack-npm] no bundles in $REL — run build-bundle.sh first" >&2; exit 1; }
-
-targets=()
-for archive in "${archives[@]}"; do
-  fname="$(basename "$archive")"
-  case "$fname" in
-    *.tar.gz) base="${fname%.tar.gz}" ;;   # cgraphx-<target>
-    *.zip)    base="${fname%.zip}" ;;
-  esac
-  target="${base#cgraphx-}"              # <target>, e.g. darwin-arm64 / win32-x64
-  os="${target%-*}"                       # darwin | linux | win32
-  arch="${target##*-}"                    # arm64 | x64
-  pkgdir="$NPM/$base"
-  mkdir -p "$pkgdir"
-  case "$fname" in
-    *.zip)
-      tmpx="$(mktemp -d)"
-      unzip -q "$archive" -d "$tmpx"
-      mv "$tmpx/cgraphx-${target}"/* "$pkgdir"/
-      rm -rf "$tmpx"
-      nodefile="node.exe"
-      ;;
-    *)
-      tar -xzf "$archive" -C "$pkgdir" --strip-components=1
-      nodefile="node"
-      ;;
-  esac
-  VERSION="$VERSION" TARGET="$target" OSV="$os" ARCHV="$arch" NODEFILE="$nodefile" \
-    node -e '
-      const fs=require("fs");
-      fs.writeFileSync(process.argv[1], JSON.stringify({
-        name: `cgraphx-${process.env.TARGET}`,
-        version: process.env.VERSION,
-        description: `CodeGraph self-contained bundle for ${process.env.TARGET}`,
-        os: [process.env.OSV], cpu: [process.env.ARCHV],
-        files: [process.env.NODEFILE, "lib", "bin"],
-        license: "MIT"
-      }, null, 2) + "\n");
-    ' "$pkgdir/package.json"
-  targets+=("$target")
-  echo "[pack-npm] cgraphx-${target}@${VERSION}"
-done
-
-# Main shim package.
-#   npm-shim.js  CLI/MCP launcher (execs the bundled Node) — the `bin`.
-#   npm-sdk.js   programmatic/embedded entry (#354): re-exports the installed
-#                platform bundle's compiled library — the `main`.
-#   dist/        the .d.ts tree only (types). The runtime .js stays in the
-#                per-platform bundle so its deps aren't duplicated here.
-cp "$ROOT/scripts/npm-shim.js" "$NPM/main/npm-shim.js"
-cp "$ROOT/scripts/npm-sdk.js" "$NPM/main/npm-sdk.js"
-[ -f "$ROOT/README.md" ] && cp "$ROOT/README.md" "$NPM/main/README.md"
-
-# Ship the type declarations so `types`/`exports.types` resolve. Built from this
-# same release, so they can't skew from the runtime npm-sdk.js re-exports.
-[ -f "$ROOT/dist/index.d.ts" ] || ( echo "[pack-npm] building dist for .d.ts" >&2 && cd "$ROOT" && npm run build >/dev/null )
-ROOT="$ROOT" DEST="$NPM/main" node -e '
-  const fs=require("fs"), path=require("path");
-  const src=path.join(process.env.ROOT,"dist"), dest=path.join(process.env.DEST,"dist");
-  fs.cpSync(src, dest, { recursive:true, filter(s){
-    try { return fs.statSync(s).isDirectory() || s.endsWith(".d.ts"); } catch (e) { return false; }
-  }});
-'
-
-VERSION="$VERSION" TARGETS="${targets[*]}" \
-  node -e '
-    const fs=require("fs");
-    const opt={};
-    for (const t of process.env.TARGETS.split(/\s+/).filter(Boolean))
-      opt[`cgraphx-${t}`]=process.env.VERSION;
-    fs.writeFileSync(process.argv[1], JSON.stringify({
-      name: `cgraphx`,
-      version: process.env.VERSION,
-      description: "Local-first code intelligence for AI agents (MCP). Self-contained — bundles its own runtime.",
-      bin: { cgraphx: "npm-shim.js" },
-      main: "npm-sdk.js",
-      types: "dist/index.d.ts",
-      exports: {
-        ".": { types: "./dist/index.d.ts", default: "./npm-sdk.js" },
-        "./package.json": "./package.json"
-      },
-      optionalDependencies: opt,
-      files: ["npm-shim.js","npm-sdk.js","dist","README.md"],
-      license: "MIT"
-    }, null, 2) + "\n");
-  ' "$NPM/main/package.json"
-
-echo "[pack-npm] cgraphx@${VERSION} (${#targets[@]} platform packages in optionalDependencies)"
-echo "[pack-npm] output: $NPM"

package/scripts/prepare-release.mjs

@@ -1,270 +0,0 @@
-#!/usr/bin/env node
-/**
- * Promote `## [Unreleased]` content into `## [<version>]` in CHANGELOG.md
- * so the release.yml workflow's `extract-release-notes.mjs <version>` call
- * picks up everything that landed since the last release.
- *
- * **Why this exists:** the release workflow used to do a literal
- * `extract-release-notes.mjs <version>` lookup with an `[Unreleased]`
- * fallback. The fallback only triggers if the `[<version>]` block
- * doesn't exist at all — and in practice maintainers sometimes had a
- * sparse `[<version>]` block pre-populated (e.g. one early fix
- * documented before the rest of the work landed). The workflow then
- * extracted that sparse block, ignoring the much larger `[Unreleased]`
- * section above it — so the published release notes were missing most
- * of what shipped. See v0.9.5 for the canonical post-mortem.
- *
- * **What it does**, idempotently:
- *
- *   Case A — `[<version>]` does not exist yet:
- *     Rename the `[Unreleased]` header to `[<version>] - <YYYY-MM-DD>`
- *     and add a fresh empty `## [Unreleased]` block above it. This is
- *     the common case.
- *
- *   Case B — `[<version>]` exists AND `[Unreleased]` has content:
- *     Merge `[Unreleased]`'s sub-sections (### Added / ### Fixed /
- *     ### Changed / ### Removed / ### Deprecated / ### Security) into
- *     the corresponding sub-sections of `[<version>]`. Unmatched
- *     sub-sections are appended to `[<version>]`. The `[Unreleased]`
- *     block is then emptied.
- *
- *   Case C — `[Unreleased]` has no content:
- *     No-op. Exit 0. Re-runs of the workflow are safe.
- *
- * **Where the date comes from:** for Case A, `<YYYY-MM-DD>` is the
- * UTC date at run time. Matches the existing CHANGELOG convention.
- *
- * **Usage:**
- *
- *   node scripts/prepare-release.mjs                # reads version from package.json
- *   node scripts/prepare-release.mjs 1.2.3          # explicit version
- *
- * **Output:**
- *
- *   Writes CHANGELOG.md in place. Prints a summary line to stdout
- *   like `prepare-release: 0.9.5 — promoted 6 Unreleased entries`.
- *   Exits non-zero on parse failures.
- */
-
-import { readFileSync, writeFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-
-const CHANGELOG_PATH = resolve(process.cwd(), 'CHANGELOG.md');
-
-function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync(resolve(process.cwd(), 'package.json'), 'utf8'));
-  if (!pkg.version) throw new Error('package.json has no "version" field');
-  return pkg.version;
-}
-
-function todayUtcIsoDate() {
-  // YYYY-MM-DD in UTC. Matches the CHANGELOG's existing convention
-  // (the existing dated entries don't disclose a timezone, but UTC is
-  // stable across runners and is what the workflow's runner produces
-  // by default anyway).
-  return new Date().toISOString().slice(0, 10);
-}
-
-/**
- * Split the CHANGELOG into a header preface + an ordered list of
- * version blocks `{ header, body[] }`, preserving line content
- * verbatim so we can re-join without surprises.
- */
-function parseChangelog(text) {
-  const lines = text.split('\n');
-  const versionHeaderRe = /^## \[([^\]]+)\](?:\s+-\s+(.+))?\s*$/;
-  const preface = [];
-  const blocks = []; // { header: string, name: string, body: string[] }
-  let cur = null;
-  for (const line of lines) {
-    const m = line.match(versionHeaderRe);
-    if (m) {
-      if (cur) blocks.push(cur);
-      cur = { header: line, name: m[1], date: m[2] ?? null, body: [] };
-    } else if (cur) {
-      cur.body.push(line);
-    } else {
-      preface.push(line);
-    }
-  }
-  if (cur) blocks.push(cur);
-  return { preface, blocks };
-}
-
-function joinChangelog({ preface, blocks }) {
-  const parts = [preface.join('\n')];
-  for (const b of blocks) {
-    // Reconstruct: header + body. The block body INCLUDES the blank
-    // line after the header (it was captured verbatim).
-    parts.push([b.header, ...b.body].join('\n'));
-  }
-  return parts.join('\n');
-}
-
-/**
- * Split a block body into ordered sub-sections keyed by their
- * `### Heading`. Lines before the first `### Heading` go in
- * `leading`. Preserves the original (line-array) body inside each
- * sub-section so we can splice cleanly when merging.
- */
-function splitSubsections(body) {
-  const subsectionRe = /^### (\w+)\s*$/;
-  const leading = [];
-  const subs = []; // { heading: 'Added' | 'Fixed' | …, headerLine: string, body: string[] }
-  let cur = null;
-  for (const line of body) {
-    const m = line.match(subsectionRe);
-    if (m) {
-      if (cur) subs.push(cur);
-      cur = { heading: m[1], headerLine: line, body: [] };
-    } else if (cur) {
-      cur.body.push(line);
-    } else {
-      leading.push(line);
-    }
-  }
-  if (cur) subs.push(cur);
-  return { leading, subs };
-}
-
-function rebuildBody({ leading, subs }) {
-  const parts = [];
-  if (leading.length) parts.push(leading.join('\n'));
-  for (const s of subs) {
-    parts.push([s.headerLine, ...s.body].join('\n'));
-  }
-  return parts.join('\n').split('\n');
-}
-
-/**
- * Return true when the block has any meaningful entries (a bullet line
- * starting with `-`, `*`, or a digit) — vs. being empty / just
- * whitespace / just sub-section headers with nothing under them.
- */
-function blockHasContent(body) {
-  for (const line of body) {
-    if (/^\s*([-*]|\d+\.)\s+/.test(line)) return true;
-  }
-  return false;
-}
-
-/**
- * Trim trailing blank lines from an array of lines, then return.
- * Keeps the output tidy when merging.
- */
-function trimTrailingBlank(arr) {
-  let i = arr.length;
-  while (i > 0 && /^\s*$/.test(arr[i - 1])) i--;
-  return arr.slice(0, i);
-}
-
-function main() {
-  const versionArg = process.argv[2];
-  const version = versionArg || readPackageVersion();
-
-  const text = readFileSync(CHANGELOG_PATH, 'utf8');
-  const parsed = parseChangelog(text);
-
-  const unrelIdx = parsed.blocks.findIndex((b) => b.name === 'Unreleased');
-  const verIdx = parsed.blocks.findIndex((b) => b.name === version);
-
-  if (unrelIdx === -1) {
-    console.log(`prepare-release: no [Unreleased] block — nothing to do`);
-    return;
-  }
-
-  const unrel = parsed.blocks[unrelIdx];
-  if (!blockHasContent(unrel.body)) {
-    console.log(`prepare-release: [Unreleased] is empty — nothing to do`);
-    return;
-  }
-
-  if (verIdx === -1) {
-    // Case A — promote Unreleased → [version].
-    const today = todayUtcIsoDate();
-    const promoted = {
-      header: `## [${version}] - ${today}`,
-      name: version,
-      date: today,
-      body: trimTrailingBlank(unrel.body).concat(['']), // single trailing blank
-    };
-    const emptied = {
-      header: `## [Unreleased]`,
-      name: 'Unreleased',
-      date: null,
-      body: ['', ''], // two blank lines for the next round of entries
-    };
-    parsed.blocks.splice(unrelIdx, 1, emptied, promoted);
-    const next = joinChangelog(parsed);
-    writeFileSync(CHANGELOG_PATH, appendLinkRef(next, version));
-    console.log(`prepare-release: ${version} — renamed [Unreleased] to [${version}] - ${today}`);
-    return;
-  }
-
-  // Case B — merge Unreleased sub-sections into the existing
-  // [version] sub-sections. New sub-section headings encountered in
-  // Unreleased that don't exist in [version] get appended.
-  const ver = parsed.blocks[verIdx];
-  const unrelSubs = splitSubsections(unrel.body);
-  const verSubs = splitSubsections(ver.body);
-
-  let merged = 0;
-  for (const us of unrelSubs.subs) {
-    const target = verSubs.subs.find((s) => s.heading === us.heading);
-    const usBody = trimTrailingBlank(us.body);
-    if (usBody.length === 0) continue;
-    if (target) {
-      // Append Unreleased's entries to the end of the version's matching
-      // sub-section, keeping their original ordering. Insert a separating
-      // blank line if the existing sub-section doesn't already end in one.
-      const existing = trimTrailingBlank(target.body);
-      const sep = existing.length && !/^\s*$/.test(existing[existing.length - 1]) ? [''] : [];
-      target.body = existing.concat(sep, usBody, ['']);
-    } else {
-      // Append the whole sub-section to the end.
-      verSubs.subs.push({
-        heading: us.heading,
-        headerLine: us.headerLine,
-        body: usBody.concat(['']),
-      });
-    }
-    merged += usBody.filter((l) => /^\s*([-*]|\d+\.)\s+/.test(l)).length;
-  }
-
-  ver.body = rebuildBody(verSubs);
-  // Empty out Unreleased.
-  unrel.body = ['', ''];
-
-  const merged_text = joinChangelog(parsed);
-  writeFileSync(CHANGELOG_PATH, appendLinkRef(merged_text, version));
-  console.log(`prepare-release: ${version} — merged ${merged} Unreleased entries into existing [${version}] block`);
-}
-
-/**
- * Append a `[X.Y.Z]: https://github.com/smdnkB/cgraphx/releases/tag/vX.Y.Z`
- * link reference at the end of the file IF one doesn't already exist. The
- * link ref is what makes `## [X.Y.Z]` heading text auto-link to its tag in
- * GitHub's renderer; without it the heading still renders, just unlinked.
- *
- * Idempotent. The existing CHANGELOG mixes link refs scattered through the
- * file and a sorted block at the bottom — we just append at the very end,
- * which CommonMark accepts regardless.
- */
-function appendLinkRef(text, version) {
-  const refLine = `[${version}]: https://github.com/smdnkB/cgraphx/releases/tag/v${version}`;
-  // Already there? Look for a line that EQUALS this (anywhere in the file)
-  // to keep idempotency robust against the scattered-vs-block layout.
-  const lines = text.split('\n');
-  if (lines.some((l) => l.trim() === refLine)) return text;
-  // Append, separated by a blank line from the prior content. Preserve a
-  // single trailing newline at EOF.
-  const trailingNewline = text.endsWith('\n') ? '' : '\n';
-  return text + trailingNewline + refLine + '\n';
-}
-
-try {
-  main();
-} catch (err) {
-  console.error(`prepare-release: ${err?.message ?? err}`);
-  process.exit(1);
-}