impel-cli 0.20.63-canary.6 → 0.20.63

package/scripts/canary-version.mjs

@@ -1,173 +0,0 @@
-#!/usr/bin/env node
-// Canary version computation and successor gate (canary release cycle, U4).
-//
-// `publish-canary.yml` publishes `<major>.<minor>.<patch + 1>-canary.<N>` on
-// every push to `dev` (R15), where `N` is `GITHUB_RUN_NUMBER` (KTD6): it is
-// monotonic across publishes and unique on a retry without a registry round
-// trip, and a GitHub re-run keeps its number, so the same version comes back
-// and the successor gate below refuses it. The script only reads
-// `package.json`; the publish job applies the version to its working tree
-// with `npm version --no-git-tag-version`, and nothing on `dev` is edited.
-//
-// Usage: node scripts/canary-version.mjs [package.json] [--dist-tags <file>]
-//   Prints the computed version on stdout. With `--dist-tags`, the file is
-//   the registry's dist-tags document and the version must strictly succeed
-//   its `canary` entry; an absent `canary` tag is the bootstrap case. Every
-//   refusal prints nothing on stdout and exits 1, so a caller that captures
-//   stdout can never pick up a half-computed version.
-
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const RELEASE_VERSION = /^(\d+)\.(\d+)\.(\d+)$/u;
-const SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u;
-
-/** `<major>.<minor>.<patch + 1>-canary.<runNumber>` from a bare release version. */
-export function canaryVersion(packageVersion, runNumber) {
-  if (typeof packageVersion !== "string" || packageVersion === "") {
-    throw new Error(`package.json version must be a non-empty string, got ${JSON.stringify(packageVersion)}`);
-  }
-  if (/-/u.test(packageVersion) && SEMVER.test(packageVersion)) {
-    throw new Error(
-      `package.json version ${packageVersion} already carries a prerelease suffix; `
-      + "the canary base must be the bare release version committed on dev",
-    );
-  }
-  const match = RELEASE_VERSION.exec(packageVersion);
-  if (!match) {
-    throw new Error(`package.json version ${JSON.stringify(packageVersion)} is not a bare <major>.<minor>.<patch> release version`);
-  }
-  const text = typeof runNumber === "number" ? String(runNumber) : runNumber;
-  if (typeof text !== "string" || !/^\d+$/u.test(text) || Number(text) < 1 || !Number.isSafeInteger(Number(text))) {
-    throw new Error(`run number must be a positive integer, got ${JSON.stringify(runNumber)}`);
-  }
-  const [major, minor, patch] = match.slice(1).map(Number);
-  return `${major}.${minor}.${patch + 1}-canary.${Number(text)}`;
-}
-
-function parseSemver(text) {
-  const match = SEMVER.exec(text);
-  if (!match) throw new Error(`unparsable semver: ${text}`);
-  return {
-    release: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4] ? match[4].split(".") : [],
-  };
-}
-
-function compareIdentifiers(a, b) {
-  const aNumeric = /^\d+$/u.test(a);
-  const bNumeric = /^\d+$/u.test(b);
-  if (aNumeric && bNumeric) return Math.sign(Number(a) - Number(b));
-  if (aNumeric) return -1; // numeric identifiers sort before alphanumeric
-  if (bNumeric) return 1;
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-
-/** SemVer 2.0.0 precedence, the same ordering `publish-npm.yml`'s successor gate uses. */
-export function compareSemver(leftText, rightText) {
-  const a = parseSemver(leftText);
-  const b = parseSemver(rightText);
-  for (let index = 0; index < 3; index += 1) {
-    if (a.release[index] !== b.release[index]) return Math.sign(a.release[index] - b.release[index]);
-  }
-  if (a.prerelease.length === 0 && b.prerelease.length === 0) return 0;
-  if (a.prerelease.length === 0) return 1; // a release outranks its prereleases
-  if (b.prerelease.length === 0) return -1;
-  const length = Math.max(a.prerelease.length, b.prerelease.length);
-  for (let index = 0; index < length; index += 1) {
-    if (a.prerelease[index] === undefined) return -1; // shorter prerelease sorts first
-    if (b.prerelease[index] === undefined) return 1;
-    const result = compareIdentifiers(a.prerelease[index], b.prerelease[index]);
-    if (result !== 0) return result;
-  }
-  return 0;
-}
-
-/**
- * Require `version` to strictly succeed `distTags.canary`. Only the `canary`
- * tag is the predecessor: `latest` and `next` belong to the stable lane and
- * never stand in for it. Returns a description for the step summary.
- */
-export function assertCanarySuccessor(version, distTags) {
-  const current = distTags?.canary;
-  if (current === undefined) {
-    return {
-      bootstrap: true,
-      current,
-      message: `No existing \`canary\` dist-tag; ${version} is the canary channel bootstrap.`,
-    };
-  }
-  if (compareSemver(version, current) <= 0) {
-    throw new Error(
-      `version ${version} is not a strict semver successor of canary=${current}. `
-      + "A GitHub re-run keeps its run number and is refused by design; push a new commit "
-      + "to dev instead, or merge the released version back into dev if the base has moved.",
-    );
-  }
-  return {
-    bootstrap: false,
-    current,
-    message: `${version} strictly succeeds \`canary\`=${current}. Current tags: ${JSON.stringify(distTags)}`,
-  };
-}
-
-function fail(message) {
-  process.stderr.write(`canary-version: ${message}\n`);
-  process.exit(1);
-}
-
-function main(argv) {
-  let packageJson = "package.json";
-  let distTagsFile = null;
-  for (let index = 0; index < argv.length; index += 1) {
-    const argument = argv[index];
-    if (argument === "--dist-tags") {
-      distTagsFile = argv[index + 1];
-      index += 1;
-      if (!distTagsFile) fail("--dist-tags requires a file path");
-    } else if (argument.startsWith("--")) {
-      fail(`unknown option ${argument}`);
-    } else {
-      packageJson = argument;
-    }
-  }
-
-  let version;
-  try {
-    const manifest = JSON.parse(fs.readFileSync(path.resolve(packageJson), "utf8"));
-    const runNumber = process.env.GITHUB_RUN_NUMBER;
-    if (runNumber === undefined || runNumber === "") fail("GITHUB_RUN_NUMBER is not set; the canary counter is the workflow run number");
-    version = canaryVersion(manifest.version, runNumber);
-  } catch (error) {
-    fail(error?.message || String(error));
-  }
-
-  if (distTagsFile) {
-    let distTags;
-    try {
-      distTags = JSON.parse(fs.readFileSync(path.resolve(distTagsFile), "utf8"));
-    } catch (error) {
-      fail(`cannot read dist-tags from ${distTagsFile}: ${error?.message || error}`);
-    }
-    if (!distTags || typeof distTags !== "object" || Array.isArray(distTags)) {
-      fail(`dist-tags document ${distTagsFile} is not a JSON object`);
-    }
-    let result;
-    try {
-      result = assertCanarySuccessor(version, distTags);
-    } catch (error) {
-      fail(error?.message || String(error));
-    }
-    process.stderr.write(`canary-version: ${result.message}\n`);
-    if (process.env.GITHUB_STEP_SUMMARY) {
-      fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `## Canary gate: dist-tag successor\n\n${result.message}\n`);
-    }
-  }
-
-  process.stdout.write(`${version}\n`);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2));
-}

package/scripts/npm-dist-tags.mjs

@@ -1,134 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
-
-// npm accepts a version and returns success before every registry edge exposes
-// its new dist-tag. The post-publish verifier therefore treats a stale canary
-// tag as propagation, not proof that npm publish failed. Five minutes stays
-// comfortably inside the publish job's 15-minute timeout.
-const CANARY_TAG_VERIFY_ATTEMPTS = 20;
-const CANARY_TAG_VERIFY_DELAY_MS = 15_000;
-
-class CanaryDistTagMismatchError extends Error {}
-
-export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
-  const latest = tags.latest ?? "";
-  const canary = tags.canary ?? "";
-  if (latest !== beforeLatest) {
-    throw new Error(
-      `dist-tags.latest moved during the canary publish: before=${beforeLatest || "<none>"} `
-      + `after=${latest || "<none>"}. The canary lane must never move latest; investigate before the next publish.`,
-    );
-  }
-  if (canary !== expectedCanary) {
-    throw new CanaryDistTagMismatchError(
-      `dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`,
-    );
-  }
-  return { latest, canary };
-}
-
-/**
- * Verify npm's public dist-tags after publish while allowing the canary tag to
- * propagate. A moved `latest` remains an immediate failure: that is a release
- * invariant violation, not ordinary registry propagation.
- */
-export async function verifyCanaryDistTags({
-  beforeLatest,
-  expectedCanary,
-  readTags = readDistTags,
-  attempts = CANARY_TAG_VERIFY_ATTEMPTS,
-  delayMs = CANARY_TAG_VERIFY_DELAY_MS,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-}) {
-  let lastObservedCanary = "";
-  let lastError;
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    const tags = await readTags({ bustCache: true });
-    try {
-      return assertCanaryDistTags({ beforeLatest, expectedCanary, tags });
-    } catch (error) {
-      if (!(error instanceof CanaryDistTagMismatchError)) throw error;
-      lastObservedCanary = tags.canary ?? "";
-      lastError = error;
-      if (attempt < attempts) await sleep(delayMs);
-    }
-  }
-  throw new Error(
-    `npm accepted the canary publish but did not expose it after ${attempts} dist-tag checks: `
-    + `${lastError?.message || `last dist-tags.canary was ${lastObservedCanary || "<none>"}.`} `
-    + "This is registry propagation lag, not an unpublished tarball.",
-  );
-}
-
-async function readDistTags({ allowMissing, bustCache = false } = {}) {
-  const url = bustCache ? `${DIST_TAGS_URL}?t=${Date.now()}` : DIST_TAGS_URL;
-  let lastError;
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
-    try {
-      const response = await fetch(url, { signal: AbortSignal.timeout(30_000) });
-      if (response.status === 404 && allowMissing) return {};
-      if (!response.ok) throw new Error(`npm registry dist-tags lookup failed: HTTP ${response.status}`);
-      const tags = await response.json();
-      if (!tags || typeof tags !== "object" || Array.isArray(tags)) {
-        throw new Error("npm registry returned an invalid dist-tags document");
-      }
-      return tags;
-    } catch (error) {
-      lastError = error;
-      if (attempt < 3) await new Promise((resolve) => setTimeout(resolve, 1_000));
-    }
-  }
-  throw lastError;
-}
-
-function appendEnvironment(name, value) {
-  if (!process.env.GITHUB_ENV) throw new Error("GITHUB_ENV is not set");
-  fs.appendFileSync(process.env.GITHUB_ENV, `${name}=${value}\n`);
-}
-
-function appendSummary(lines) {
-  if (!process.env.GITHUB_STEP_SUMMARY) throw new Error("GITHUB_STEP_SUMMARY is not set");
-  fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${lines.join("\n")}\n`);
-}
-
-async function main([command, ...args]) {
-  if (command === "fetch" && args.length === 1) {
-    const tags = await readDistTags({ allowMissing: true });
-    fs.writeFileSync(path.resolve(args[0]), `${JSON.stringify(tags)}\n`);
-    console.log(Object.keys(tags).length === 0 ? "No npm dist-tags found; using channel bootstrap." : "Fetched npm dist-tags.");
-    return;
-  }
-  if (command === "snapshot-latest" && args.length === 0) {
-    const tags = await readDistTags({ allowMissing: true });
-    const latest = tags.latest ?? "";
-    appendEnvironment("LATEST_BEFORE", latest);
-    console.log(`dist-tags.latest before publish: ${latest || "<none>"}`);
-    return;
-  }
-  if (command === "assert-canary" && args.length === 2) {
-    const [expectedCanary, beforeLatest] = args;
-    const { latest } = await verifyCanaryDistTags({ expectedCanary, beforeLatest });
-    appendSummary([
-      "## Canary published",
-      "",
-      `- \`impel-cli@${expectedCanary}\` is \`canary\``,
-      `- \`latest\` is unchanged at \`${latest || "<none>"}\``,
-    ]);
-    console.log(`Published impel-cli@${expectedCanary} under canary; latest is still ${latest || "<none>"}.`);
-    return;
-  }
-  throw new Error(
-    "usage: node scripts/npm-dist-tags.mjs fetch <file> | snapshot-latest | assert-canary <version> <latest-before>",
-  );
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2)).catch((error) => {
-    console.error(`npm-dist-tags: ${error?.message || error}`);
-    process.exit(1);
-  });
-}

package/scripts/pack-canary.mjs

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import { execFileSync } from "node:child_process";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-function appendEnvironment(name, value) {
-  if (!process.env.GITHUB_ENV) throw new Error("GITHUB_ENV is not set");
-  fs.appendFileSync(process.env.GITHUB_ENV, `${name}=${value}\n`);
-}
-
-function main([version]) {
-  const destination = process.env.RUNNER_TEMP;
-  if (!destination || !version) throw new Error("RUNNER_TEMP and a canary version are required");
-  execFileSync("pnpm", ["pack", "--pack-destination", destination], { stdio: "inherit" });
-  const tarball = path.join(destination, `impel-cli-${version}.tgz`);
-  if (!fs.existsSync(tarball)) throw new Error(`pnpm pack did not create ${tarball}`);
-  const prefix = path.join(destination, "impel-prefix");
-  execFileSync("npm", ["install", "--global", "--prefix", prefix, tarball], { stdio: "inherit" });
-  execFileSync(process.execPath, ["scripts/verify-canary-install.mjs", prefix, version], { stdio: "inherit" });
-  appendEnvironment("CANARY_TARBALL", tarball);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    main(process.argv.slice(2));
-  } catch (error) {
-    console.error(`pack-canary: ${error?.message || error}`);
-    process.exit(1);
-  }
-}

package/scripts/pack-release.mjs

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-
-function main() {
-  const destination = process.env.RUNNER_TEMP;
-  if (!destination) throw new Error("RUNNER_TEMP is required");
-  const { version } = JSON.parse(fs.readFileSync("package.json", "utf8"));
-  execFileSync("pnpm", ["pack", "--pack-destination", destination], { stdio: "inherit" });
-  const tarball = path.join(destination, `impel-cli-${version}.tgz`);
-  if (!fs.existsSync(tarball)) throw new Error(`pnpm pack did not create ${tarball}`);
-  const prefix = path.join(destination, "impel-prefix");
-  execFileSync("npm", ["install", "--global", "--prefix", prefix, tarball], { stdio: "inherit" });
-  const executable = process.platform === "win32" ? path.join(prefix, "impel.cmd") : path.join(prefix, "bin", "impel");
-  const actual = execFileSync(executable, ["--version"], { encoding: "utf8" }).trim();
-  if (actual !== version) throw new Error(`packed CLI reports ${actual}, expected ${version}`);
-  console.log(`Verified packed impel-cli ${version}.`);
-}
-
-try {
-  main();
-} catch (error) {
-  console.error(`pack-release: ${error?.message || error}`);
-  process.exit(1);
-}

package/scripts/prepare-canary.mjs

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const CANARY_VERSION = /^\d+\.\d+\.\d+-canary\.\d+$/u;
-
-function main([version]) {
-  if (!CANARY_VERSION.test(version || "")) {
-    throw new Error(`the gate produced an invalid canary version: ${version || "<empty>"}`);
-  }
-  execFileSync("npm", ["version", version, "--no-git-tag-version"], { stdio: "inherit" });
-  execFileSync(process.execPath, ["scripts/bake-canary-brand.mjs"], { stdio: "inherit" });
-  const actual = JSON.parse(fs.readFileSync("package.json", "utf8")).version;
-  if (actual !== version) throw new Error(`package.json version ${actual} does not match ${version}`);
-  console.log(`Prepared ${version} canary package.`);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    main(process.argv.slice(2));
-  } catch (error) {
-    console.error(`prepare-canary: ${error?.message || error}`);
-    process.exit(1);
-  }
-}

package/scripts/release-gate.mjs

@@ -1,133 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import { execFileSync } from "node:child_process";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { compareSemver } from "./canary-version.mjs";
-import { evaluateCheckRuns } from "./required-checks.mjs";
-
-const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
-
-function appendSummary(text) {
-  if (!process.env.GITHUB_STEP_SUMMARY) throw new Error("GITHUB_STEP_SUMMARY is not set");
-  fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, text.endsWith("\n") ? text : `${text}\n`);
-}
-
-async function fetchJson(url, { token, allowMissing = false } = {}) {
-  const response = await fetch(url, {
-    headers: {
-      Accept: "application/vnd.github+json",
-      ...(token ? { Authorization: `Bearer ${token}` } : {}),
-      "User-Agent": "UseImpel/impel-cli release gate",
-      "X-GitHub-Api-Version": "2022-11-28",
-    },
-    signal: AbortSignal.timeout(30_000),
-  });
-  if (response.status === 404 && allowMissing) return {};
-  if (!response.ok) throw new Error(`request failed: HTTP ${response.status}`);
-  return response.json();
-}
-
-async function checkRunsForCommit(repository, sha, token) {
-  const runs = [];
-  for (let page = 1; ; page += 1) {
-    const body = await fetchJson(
-      `https://api.github.com/repos/${repository}/commits/${sha}/check-runs?per_page=100&page=${page}`,
-      { token },
-    );
-    runs.push(...body.check_runs.map(({ name, status, conclusion }) => ({ name, status, conclusion })));
-    if (body.check_runs.length < 100) return runs;
-  }
-}
-
-function manifest() {
-  return JSON.parse(fs.readFileSync("package.json", "utf8"));
-}
-
-export function verifyTag({ tag, version }) {
-  const expected = `v${version}`;
-  if (tag !== expected) throw new Error(`release tag ${tag} does not match ${expected}`);
-  return expected;
-}
-
-export function verifyMain({ sha, mainRef = "origin/main" }) {
-  try {
-    execFileSync("git", ["merge-base", "--is-ancestor", sha, mainRef], { stdio: "ignore" });
-  } catch {
-    throw new Error(`tagged commit ${sha} is not on ${mainRef}; merge to main before tagging`);
-  }
-}
-
-export async function verifyChecks({ repository, sha, token }) {
-  const result = evaluateCheckRuns(await checkRunsForCommit(repository, sha, token));
-  const summary = result.summary;
-  appendSummary(summary);
-  if (result.state !== "success") {
-    throw new Error(`required checks on ${sha} are not all green: ${result.failures.join("; ") || result.pending.join(", ")}`);
-  }
-  return result;
-}
-
-export async function verifySuccessor({ version, channel = version.includes("-") ? "next" : "latest" }) {
-  const tags = await fetchJson(DIST_TAGS_URL, { allowMissing: true });
-  const current = tags[channel] ?? (channel === "next" ? tags.latest : undefined);
-  const message = current === undefined
-    ? `No existing \`${channel}\` dist-tag; ${version} is the channel bootstrap.`
-    : `${version} strictly succeeds \`${channel}\`=${current}. Current tags: ${JSON.stringify(tags)}`;
-  if (current !== undefined && compareSemver(version, current) <= 0) {
-    throw new Error(`version ${version} is not a strict semver successor of ${channel}=${current}`);
-  }
-  appendSummary(`## Release gate: dist-tag successor\n\n${message}\n`);
-  console.log(message);
-  return { channel, current, tags };
-}
-
-export function selectDistTag(version) {
-  const tag = version.includes("-") ? "next" : "latest";
-  if (!process.env.GITHUB_ENV) throw new Error("GITHUB_ENV is not set");
-  fs.appendFileSync(process.env.GITHUB_ENV, `NPM_DIST_TAG=${tag}\n`);
-  console.log(`Publishing ${version} under npm dist-tag ${tag}.`);
-  return tag;
-}
-
-async function main([command]) {
-  const pkg = manifest();
-  if (command === "verify-tag") {
-    verifyTag({ tag: process.env.RELEASE_TAG, version: pkg.version });
-    return;
-  }
-  if (command === "verify-main") {
-    const sha = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-    verifyMain({ sha });
-    console.log(`Tagged commit ${sha} is on origin/main.`);
-    return;
-  }
-  if (command === "verify-checks") {
-    const sha = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-    await verifyChecks({
-      repository: process.env.GITHUB_REPOSITORY,
-      sha,
-      token: process.env.GH_TOKEN,
-    });
-    console.log(`All required checks are green on ${sha}.`);
-    return;
-  }
-  if (command === "verify-successor") {
-    await verifySuccessor({ version: pkg.version });
-    return;
-  }
-  if (command === "select-dist-tag") {
-    selectDistTag(pkg.version);
-    return;
-  }
-  throw new Error("usage: node scripts/release-gate.mjs verify-tag|verify-main|verify-checks|verify-successor|select-dist-tag");
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2)).catch((error) => {
-    console.error(`release-gate: ${error?.message || error}`);
-    process.exit(1);
-  });
-}

package/scripts/release-metadata.mjs

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import { execFileSync } from "node:child_process";
-
-function main() {
-  if (!process.env.GITHUB_OUTPUT) throw new Error("GITHUB_OUTPUT is not set");
-  const { version } = JSON.parse(fs.readFileSync("package.json", "utf8"));
-  const sourceCommit = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-  fs.appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\nsource_commit=${sourceCommit}\n`);
-}
-
-try {
-  main();
-} catch (error) {
-  console.error(`release-metadata: ${error?.message || error}`);
-  process.exit(1);
-}

package/scripts/required-checks.mjs

@@ -1,126 +0,0 @@
-#!/usr/bin/env node
-// The CI check names a publishable commit must carry (canary release cycle, U4).
-//
-// Both release workflows consume this list through checked-in gate scripts.
-// A renamed CI job that is not renamed here fails the suite, not a release.
-// Every push to `dev` and `main` runs these via `ci.yml`, so they must exist on
-// a publishable SHA; names must match the job names exactly.
-//
-// Usage:
-//   node scripts/required-checks.mjs <check-runs.ndjson>
-//     Evaluate the Checks API output (one `{name, status, conclusion}` JSON
-//     object per line). Prints the markdown summary on stdout and exits 0
-//     when every required check is green, 2 while any is still queued,
-//     running, or not yet reported (the caller polls), and 1 when a required
-//     check, or a present Windows vendor check, has a non-success conclusion.
-//   node scripts/required-checks.mjs --list
-//     Print the required names, one per line.
-
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-export const REQUIRED_CHECKS = Object.freeze([
-  "Node 18 on ubuntu-latest",
-  "Node 18 on macos-latest",
-  "Node 18 on windows-latest",
-  "Node 24 on ubuntu-latest",
-  "Node 24 on macos-latest",
-  "Node 24 on windows-latest",
-  "Pinned macOS CLI installer contract",
-  "Pinned ChatGPT/Codex config contract",
-  "Pinned Claude config contract",
-  "Windows standard-user Codex config contract",
-]);
-
-// The Windows vendor contract workflow is path-filtered, so its jobs may
-// legitimately be absent. Present => must be green. Absent => loud warning
-// telling the operator when a manual dispatch is owed.
-export const CONDITIONAL_CHECKS = Object.freeze([
-  "Pinned Claude MSIX install and replacement",
-  "Pinned ChatGPT/Codex Store install",
-]);
-
-/**
- * Judge one commit's check runs. A name with any completed/success run is
- * green (a re-run supersedes an earlier failure); a name with no run yet, or
- * whose runs are all still queued or in progress, is pending; a name whose
- * runs have all completed without a success has failed. Failure outranks
- * pending so a superseded or broken SHA is refused as soon as it is known.
- */
-export function evaluateCheckRuns(runs, { required = REQUIRED_CHECKS, conditional = CONDITIONAL_CHECKS } = {}) {
-  const byName = new Map();
-  for (const run of runs) {
-    if (!byName.has(run.name)) byName.set(run.name, []);
-    byName.get(run.name).push(run);
-  }
-  const runsFor = (name) => byName.get(name) ?? [];
-  const green = (name) => runsFor(name).some((run) => run.status === "completed" && run.conclusion === "success");
-  const unfinished = (name) => runsFor(name).some((run) => run.status !== "completed");
-  const describe = (name) => {
-    const found = runsFor(name);
-    if (found.length === 0) return "MISSING";
-    return found.map((run) => `${run.status}/${run.conclusion ?? "none"}`).join(", ");
-  };
-
-  const failures = [];
-  const pending = [];
-  const absentConditional = [];
-  for (const name of required) {
-    if (green(name)) continue;
-    if (runsFor(name).length === 0 || unfinished(name)) pending.push(name);
-    else failures.push(`required check "${name}": ${describe(name)}`);
-  }
-  for (const name of conditional) {
-    if (runsFor(name).length === 0) absentConditional.push(name);
-    else if (green(name)) continue;
-    else if (unfinished(name)) pending.push(name);
-    else failures.push(`Windows vendor check "${name}": ${describe(name)}`);
-  }
-
-  const state = failures.length > 0 ? "failure" : pending.length > 0 ? "pending" : "success";
-  const summary = ["## Release gate: checks on the commit", ""];
-  summary.push("| Check | Result |", "| --- | --- |");
-  for (const name of [...required, ...conditional]) summary.push(`| ${name} | ${describe(name)} |`);
-  if (absentConditional.length > 0) {
-    summary.push(
-      "",
-      "> **Warning:** " + absentConditional.map((name) => `\`${name}\``).join(" and ")
-        + " never ran on this commit. If this change touches bundle-affecting files"
-        + " (src/apps.js, src/windowsApps.js, src/desktopTasks.js, src/codesign.js,"
-        + " src/selfInvocation.js, or the Windows contract tests), dispatch the"
-        + " \"Pinned Windows vendor app contract\" workflow against this commit.",
-    );
-  }
-  if (failures.length > 0) summary.push("", "**Gate failed:**", ...failures.map((failure) => `- ${failure}`));
-  if (state === "pending") summary.push("", "**Still waiting on:** " + pending.map((name) => `\`${name}\``).join(", "));
-  summary.push("", `Total check runs found on this commit: ${runs.length}`);
-
-  return { state, failures, pending, absentConditional, summary: summary.join("\n") + "\n" };
-}
-
-function main(argv) {
-  if (argv[0] === "--list") {
-    process.stdout.write(REQUIRED_CHECKS.join("\n") + "\n");
-    return;
-  }
-  if (argv.length !== 1) {
-    process.stderr.write("usage: node scripts/required-checks.mjs <check-runs.ndjson> | --list\n");
-    process.exit(1);
-  }
-  const lines = fs.readFileSync(path.resolve(argv[0]), "utf8").split("\n").filter((line) => line.trim() !== "");
-  const runs = lines.map((line) => JSON.parse(line));
-  const result = evaluateCheckRuns(runs);
-  process.stdout.write(result.summary);
-  for (const failure of result.failures) process.stderr.write(`${failure}\n`);
-  if (result.state === "failure") process.exit(1);
-  if (result.state === "pending") {
-    process.stderr.write(`waiting for ${result.pending.map((name) => `"${name}": ${runs.some((run) => run.name === name) ? "pending" : "MISSING"}`).join(", ")}\n`);
-    process.exit(2);
-  }
-  process.stderr.write("All required checks are green on the pushed commit.\n");
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2));
-}