impel-cli 0.20.63-canary.7 → 0.20.64

package/src/updates.js

@@ -36,22 +36,13 @@ export function updateRegistry() {
   ).replace(/\/+$/u, "");
 }
 
-/** The closed set of npm dist-tags the CLI can follow. */
-export function normalizeUpdateTag(tag) {
-  if (tag === "latest" || tag === "next" || tag === "canary") return tag;
+function normalizeUpdateTag(tag) {
+  if (tag === "latest" || tag === "next") return tag;
   throw new Error(`unsupported npm update tag "${tag}"`);
 }
 
-/**
- * Keep prerelease installs on npm's prerelease channel.
- *
- * A canary build is keyed on the brand channel rather than its version
- * string: `<patch+1>-canary.<N>` is a prerelease, but it must follow the
- * `canary` dist-tag, not `next` — and under the stable brand that same
- * version is only ever a prerelease that follows `next`.
- */
+/** Keep prerelease installs on npm's prerelease channel. */
 export function updateTagForVersion(version) {
-  if (RUNTIME_BRAND.channel === "canary") return "canary";
   const parsed = validVersion(version) ? version.match(VERSION_RE) : null;
   return parsed?.[4] ? "next" : "latest";
 }

package/src/windowsGit.js

@@ -15,7 +15,6 @@ import path from "node:path";
 
 import { nativeCommandInvocation, nativeSpawnInvocation } from "./nativeProcess.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
-import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 /**
  * The exact MinGit release the CLI may install. Never use `latest` or an
@@ -53,7 +52,7 @@ const POWERSHELL_ARGS = [
 
 /** Root of the Impel-managed MinGit install. */
 export function managedGitRoot(homeDir = os.homedir()) {
-  return path.join(homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "tools", "git");
+  return path.join(homeDir, ".config", "impel", "tools", "git");
 }
 
 /** The PATH-safe git.exe inside a MinGit root (MinGit unpacks `cmd/` at top level). */

package/scripts/bake-canary-brand.mjs

@@ -1,92 +0,0 @@
-#!/usr/bin/env node
-// Bake the canary channel into the runtime brand (canary release cycle, KTD7).
-//
-// `publish-canary.yml` runs this in the working tree immediately before
-// `pnpm pack`, after the test suite has run on the unmodified tree. It
-// rewrites the brand DEFAULT in `src/runtimeBrand.js` in place: the channel
-// literal becomes `canary`, the three production `defaultOrigin` literals
-// become the canary row of CHANNEL_ORIGINS (read from the very module being
-// baked so the row has one source of truth), and the CLI config namespace
-// becomes `impel-canary` so stable and canary state never share files.
-//
-// It is a one-shot publish step, not a formatter: every literal it replaces
-// must occur exactly once in its shipped form, a file that is already baked
-// is refused, and the result is re-imported and validated before the script
-// exits 0 — a half-baked or doubly-baked tree can never be packed.
-//
-// Usage: node scripts/bake-canary-brand.mjs [path/to/runtimeBrand.js]
-
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-const DEFAULT_TARGET = fileURLToPath(new URL("../src/runtimeBrand.js", import.meta.url));
-const CANARY_MARKER = 'channel: "canary",';
-
-function fail(message) {
-  process.stderr.write(`bake-canary-brand: ${message}\n`);
-  process.exit(1);
-}
-
-/** Import `target` fresh (never from this process's module cache) with no brand in the environment. */
-async function importBrandModule(target, cacheBuster) {
-  // The module reads IMPEL_CLI_RUNTIME_BRAND at import time; the bake is about
-  // the DEFAULT, so an inherited brand must not stand in for it.
-  delete process.env.IMPEL_CLI_RUNTIME_BRAND;
-  return import(`${pathToFileURL(target).href}?bake=${cacheBuster}`);
-}
-
-function replaceExactlyOnce(source, from, to) {
-  const occurrences = source.split(from).length - 1;
-  if (occurrences !== 1) {
-    fail(`expected exactly one occurrence of ${JSON.stringify(from)} in the brand source, found ${occurrences}`);
-  }
-  return source.replace(from, to);
-}
-
-async function main() {
-  const target = path.resolve(process.argv[2] || DEFAULT_TARGET);
-  const original = fs.readFileSync(target, "utf8");
-  if (original.includes(CANARY_MARKER)) fail(`${target} is already baked for the canary channel`);
-
-  const { CHANNEL_ORIGINS } = await importBrandModule(target, "before");
-  const rows = [
-    ['channel: "stable",', CANARY_MARKER],
-    ['configNamespace: "impel",', 'configNamespace: "impel-canary",'],
-    ...["gateway", "sessions", "controlPlane"].map((column) => [
-      `defaultOrigin: ${JSON.stringify(CHANNEL_ORIGINS.stable[column])}`,
-      `defaultOrigin: ${JSON.stringify(CHANNEL_ORIGINS.canary[column])}`,
-    ]),
-  ];
-  let baked = original;
-  for (const [from, to] of rows) baked = replaceExactlyOnce(baked, from, to);
-
-  // Atomic replace, then prove the result by importing it: the DEFAULT must
-  // now be the canary row and must pass the validator's own channel check.
-  const temporary = `${target}.bake-${process.pid}`;
-  fs.writeFileSync(temporary, baked, { mode: fs.statSync(target).mode & 0o777 });
-  fs.renameSync(temporary, target);
-  try {
-    const { RUNTIME_BRAND, validateRuntimeBrand } = await importBrandModule(target, "after");
-    validateRuntimeBrand(RUNTIME_BRAND);
-    const mismatch = ["gateway", "sessions", "controlPlane"].find((column) => (
-      RUNTIME_BRAND[column].defaultOrigin !== CHANNEL_ORIGINS.canary[column]
-    ));
-    if (RUNTIME_BRAND.channel !== "canary" || mismatch) {
-      throw new Error(`baked DEFAULT is not the canary row (${mismatch || "channel"})`);
-    }
-    if (RUNTIME_BRAND.cli.configNamespace !== "impel-canary") {
-      throw new Error(`baked CLI config namespace is not isolated (${RUNTIME_BRAND.cli.configNamespace})`);
-    }
-    process.stdout.write(
-      `bake-canary-brand: ${target} now carries channel canary `
-      + `(gateway ${RUNTIME_BRAND.gateway.defaultOrigin}, sessions ${RUNTIME_BRAND.sessions.defaultOrigin}, `
-      + `controlPlane ${RUNTIME_BRAND.controlPlane.defaultOrigin}, config ${RUNTIME_BRAND.cli.configNamespace})\n`,
-    );
-  } catch (error) {
-    fs.writeFileSync(target, original);
-    fail(`baked brand failed verification and was restored: ${error?.message || error}`);
-  }
-}
-
-await main();

package/scripts/canary-version.mjs

@@ -1,173 +0,0 @@
-#!/usr/bin/env node
-// Canary version computation and successor gate (canary release cycle, U4).
-//
-// `publish-canary.yml` publishes `<major>.<minor>.<patch + 1>-canary.<N>` on
-// every push to `dev` (R15), where `N` is `GITHUB_RUN_NUMBER` (KTD6): it is
-// monotonic across publishes and unique on a retry without a registry round
-// trip, and a GitHub re-run keeps its number, so the same version comes back
-// and the successor gate below refuses it. The script only reads
-// `package.json`; the publish job applies the version to its working tree
-// with `npm version --no-git-tag-version`, and nothing on `dev` is edited.
-//
-// Usage: node scripts/canary-version.mjs [package.json] [--dist-tags <file>]
-//   Prints the computed version on stdout. With `--dist-tags`, the file is
-//   the registry's dist-tags document and the version must strictly succeed
-//   its `canary` entry; an absent `canary` tag is the bootstrap case. Every
-//   refusal prints nothing on stdout and exits 1, so a caller that captures
-//   stdout can never pick up a half-computed version.
-
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const RELEASE_VERSION = /^(\d+)\.(\d+)\.(\d+)$/u;
-const SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u;
-
-/** `<major>.<minor>.<patch + 1>-canary.<runNumber>` from a bare release version. */
-export function canaryVersion(packageVersion, runNumber) {
-  if (typeof packageVersion !== "string" || packageVersion === "") {
-    throw new Error(`package.json version must be a non-empty string, got ${JSON.stringify(packageVersion)}`);
-  }
-  if (/-/u.test(packageVersion) && SEMVER.test(packageVersion)) {
-    throw new Error(
-      `package.json version ${packageVersion} already carries a prerelease suffix; `
-      + "the canary base must be the bare release version committed on dev",
-    );
-  }
-  const match = RELEASE_VERSION.exec(packageVersion);
-  if (!match) {
-    throw new Error(`package.json version ${JSON.stringify(packageVersion)} is not a bare <major>.<minor>.<patch> release version`);
-  }
-  const text = typeof runNumber === "number" ? String(runNumber) : runNumber;
-  if (typeof text !== "string" || !/^\d+$/u.test(text) || Number(text) < 1 || !Number.isSafeInteger(Number(text))) {
-    throw new Error(`run number must be a positive integer, got ${JSON.stringify(runNumber)}`);
-  }
-  const [major, minor, patch] = match.slice(1).map(Number);
-  return `${major}.${minor}.${patch + 1}-canary.${Number(text)}`;
-}
-
-function parseSemver(text) {
-  const match = SEMVER.exec(text);
-  if (!match) throw new Error(`unparsable semver: ${text}`);
-  return {
-    release: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4] ? match[4].split(".") : [],
-  };
-}
-
-function compareIdentifiers(a, b) {
-  const aNumeric = /^\d+$/u.test(a);
-  const bNumeric = /^\d+$/u.test(b);
-  if (aNumeric && bNumeric) return Math.sign(Number(a) - Number(b));
-  if (aNumeric) return -1; // numeric identifiers sort before alphanumeric
-  if (bNumeric) return 1;
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-
-/** SemVer 2.0.0 precedence, the same ordering `publish-npm.yml`'s successor gate uses. */
-export function compareSemver(leftText, rightText) {
-  const a = parseSemver(leftText);
-  const b = parseSemver(rightText);
-  for (let index = 0; index < 3; index += 1) {
-    if (a.release[index] !== b.release[index]) return Math.sign(a.release[index] - b.release[index]);
-  }
-  if (a.prerelease.length === 0 && b.prerelease.length === 0) return 0;
-  if (a.prerelease.length === 0) return 1; // a release outranks its prereleases
-  if (b.prerelease.length === 0) return -1;
-  const length = Math.max(a.prerelease.length, b.prerelease.length);
-  for (let index = 0; index < length; index += 1) {
-    if (a.prerelease[index] === undefined) return -1; // shorter prerelease sorts first
-    if (b.prerelease[index] === undefined) return 1;
-    const result = compareIdentifiers(a.prerelease[index], b.prerelease[index]);
-    if (result !== 0) return result;
-  }
-  return 0;
-}
-
-/**
- * Require `version` to strictly succeed `distTags.canary`. Only the `canary`
- * tag is the predecessor: `latest` and `next` belong to the stable lane and
- * never stand in for it. Returns a description for the step summary.
- */
-export function assertCanarySuccessor(version, distTags) {
-  const current = distTags?.canary;
-  if (current === undefined) {
-    return {
-      bootstrap: true,
-      current,
-      message: `No existing \`canary\` dist-tag; ${version} is the canary channel bootstrap.`,
-    };
-  }
-  if (compareSemver(version, current) <= 0) {
-    throw new Error(
-      `version ${version} is not a strict semver successor of canary=${current}. `
-      + "A GitHub re-run keeps its run number and is refused by design; push a new commit "
-      + "to dev instead, or merge the released version back into dev if the base has moved.",
-    );
-  }
-  return {
-    bootstrap: false,
-    current,
-    message: `${version} strictly succeeds \`canary\`=${current}. Current tags: ${JSON.stringify(distTags)}`,
-  };
-}
-
-function fail(message) {
-  process.stderr.write(`canary-version: ${message}\n`);
-  process.exit(1);
-}
-
-function main(argv) {
-  let packageJson = "package.json";
-  let distTagsFile = null;
-  for (let index = 0; index < argv.length; index += 1) {
-    const argument = argv[index];
-    if (argument === "--dist-tags") {
-      distTagsFile = argv[index + 1];
-      index += 1;
-      if (!distTagsFile) fail("--dist-tags requires a file path");
-    } else if (argument.startsWith("--")) {
-      fail(`unknown option ${argument}`);
-    } else {
-      packageJson = argument;
-    }
-  }
-
-  let version;
-  try {
-    const manifest = JSON.parse(fs.readFileSync(path.resolve(packageJson), "utf8"));
-    const runNumber = process.env.GITHUB_RUN_NUMBER;
-    if (runNumber === undefined || runNumber === "") fail("GITHUB_RUN_NUMBER is not set; the canary counter is the workflow run number");
-    version = canaryVersion(manifest.version, runNumber);
-  } catch (error) {
-    fail(error?.message || String(error));
-  }
-
-  if (distTagsFile) {
-    let distTags;
-    try {
-      distTags = JSON.parse(fs.readFileSync(path.resolve(distTagsFile), "utf8"));
-    } catch (error) {
-      fail(`cannot read dist-tags from ${distTagsFile}: ${error?.message || error}`);
-    }
-    if (!distTags || typeof distTags !== "object" || Array.isArray(distTags)) {
-      fail(`dist-tags document ${distTagsFile} is not a JSON object`);
-    }
-    let result;
-    try {
-      result = assertCanarySuccessor(version, distTags);
-    } catch (error) {
-      fail(error?.message || String(error));
-    }
-    process.stderr.write(`canary-version: ${result.message}\n`);
-    if (process.env.GITHUB_STEP_SUMMARY) {
-      fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `## Canary gate: dist-tag successor\n\n${result.message}\n`);
-    }
-  }
-
-  process.stdout.write(`${version}\n`);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2));
-}

package/scripts/npm-dist-tags.mjs

@@ -1,134 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
-
-// npm accepts a version and returns success before every registry edge exposes
-// its new dist-tag. The post-publish verifier therefore treats a stale canary
-// tag as propagation, not proof that npm publish failed. Five minutes stays
-// comfortably inside the publish job's 15-minute timeout.
-const CANARY_TAG_VERIFY_ATTEMPTS = 20;
-const CANARY_TAG_VERIFY_DELAY_MS = 15_000;
-
-class CanaryDistTagMismatchError extends Error {}
-
-export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
-  const latest = tags.latest ?? "";
-  const canary = tags.canary ?? "";
-  if (latest !== beforeLatest) {
-    throw new Error(
-      `dist-tags.latest moved during the canary publish: before=${beforeLatest || "<none>"} `
-      + `after=${latest || "<none>"}. The canary lane must never move latest; investigate before the next publish.`,
-    );
-  }
-  if (canary !== expectedCanary) {
-    throw new CanaryDistTagMismatchError(
-      `dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`,
-    );
-  }
-  return { latest, canary };
-}
-
-/**
- * Verify npm's public dist-tags after publish while allowing the canary tag to
- * propagate. A moved `latest` remains an immediate failure: that is a release
- * invariant violation, not ordinary registry propagation.
- */
-export async function verifyCanaryDistTags({
-  beforeLatest,
-  expectedCanary,
-  readTags = readDistTags,
-  attempts = CANARY_TAG_VERIFY_ATTEMPTS,
-  delayMs = CANARY_TAG_VERIFY_DELAY_MS,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-}) {
-  let lastObservedCanary = "";
-  let lastError;
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    const tags = await readTags({ bustCache: true });
-    try {
-      return assertCanaryDistTags({ beforeLatest, expectedCanary, tags });
-    } catch (error) {
-      if (!(error instanceof CanaryDistTagMismatchError)) throw error;
-      lastObservedCanary = tags.canary ?? "";
-      lastError = error;
-      if (attempt < attempts) await sleep(delayMs);
-    }
-  }
-  throw new Error(
-    `npm accepted the canary publish but did not expose it after ${attempts} dist-tag checks: `
-    + `${lastError?.message || `last dist-tags.canary was ${lastObservedCanary || "<none>"}.`} `
-    + "This is registry propagation lag, not an unpublished tarball.",
-  );
-}
-
-async function readDistTags({ allowMissing, bustCache = false } = {}) {
-  const url = bustCache ? `${DIST_TAGS_URL}?t=${Date.now()}` : DIST_TAGS_URL;
-  let lastError;
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
-    try {
-      const response = await fetch(url, { signal: AbortSignal.timeout(30_000) });
-      if (response.status === 404 && allowMissing) return {};
-      if (!response.ok) throw new Error(`npm registry dist-tags lookup failed: HTTP ${response.status}`);
-      const tags = await response.json();
-      if (!tags || typeof tags !== "object" || Array.isArray(tags)) {
-        throw new Error("npm registry returned an invalid dist-tags document");
-      }
-      return tags;
-    } catch (error) {
-      lastError = error;
-      if (attempt < 3) await new Promise((resolve) => setTimeout(resolve, 1_000));
-    }
-  }
-  throw lastError;
-}
-
-function appendEnvironment(name, value) {
-  if (!process.env.GITHUB_ENV) throw new Error("GITHUB_ENV is not set");
-  fs.appendFileSync(process.env.GITHUB_ENV, `${name}=${value}\n`);
-}
-
-function appendSummary(lines) {
-  if (!process.env.GITHUB_STEP_SUMMARY) throw new Error("GITHUB_STEP_SUMMARY is not set");
-  fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${lines.join("\n")}\n`);
-}
-
-async function main([command, ...args]) {
-  if (command === "fetch" && args.length === 1) {
-    const tags = await readDistTags({ allowMissing: true });
-    fs.writeFileSync(path.resolve(args[0]), `${JSON.stringify(tags)}\n`);
-    console.log(Object.keys(tags).length === 0 ? "No npm dist-tags found; using channel bootstrap." : "Fetched npm dist-tags.");
-    return;
-  }
-  if (command === "snapshot-latest" && args.length === 0) {
-    const tags = await readDistTags({ allowMissing: true });
-    const latest = tags.latest ?? "";
-    appendEnvironment("LATEST_BEFORE", latest);
-    console.log(`dist-tags.latest before publish: ${latest || "<none>"}`);
-    return;
-  }
-  if (command === "assert-canary" && args.length === 2) {
-    const [expectedCanary, beforeLatest] = args;
-    const { latest } = await verifyCanaryDistTags({ expectedCanary, beforeLatest });
-    appendSummary([
-      "## Canary published",
-      "",
-      `- \`impel-cli@${expectedCanary}\` is \`canary\``,
-      `- \`latest\` is unchanged at \`${latest || "<none>"}\``,
-    ]);
-    console.log(`Published impel-cli@${expectedCanary} under canary; latest is still ${latest || "<none>"}.`);
-    return;
-  }
-  throw new Error(
-    "usage: node scripts/npm-dist-tags.mjs fetch <file> | snapshot-latest | assert-canary <version> <latest-before>",
-  );
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2)).catch((error) => {
-    console.error(`npm-dist-tags: ${error?.message || error}`);
-    process.exit(1);
-  });
-}

package/scripts/pack-canary.mjs

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import { execFileSync } from "node:child_process";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-function appendEnvironment(name, value) {
-  if (!process.env.GITHUB_ENV) throw new Error("GITHUB_ENV is not set");
-  fs.appendFileSync(process.env.GITHUB_ENV, `${name}=${value}\n`);
-}
-
-function main([version]) {
-  const destination = process.env.RUNNER_TEMP;
-  if (!destination || !version) throw new Error("RUNNER_TEMP and a canary version are required");
-  execFileSync("pnpm", ["pack", "--pack-destination", destination], { stdio: "inherit" });
-  const tarball = path.join(destination, `impel-cli-${version}.tgz`);
-  if (!fs.existsSync(tarball)) throw new Error(`pnpm pack did not create ${tarball}`);
-  const prefix = path.join(destination, "impel-prefix");
-  execFileSync("npm", ["install", "--global", "--prefix", prefix, tarball], { stdio: "inherit" });
-  execFileSync(process.execPath, ["scripts/verify-canary-install.mjs", prefix, version], { stdio: "inherit" });
-  appendEnvironment("CANARY_TARBALL", tarball);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    main(process.argv.slice(2));
-  } catch (error) {
-    console.error(`pack-canary: ${error?.message || error}`);
-    process.exit(1);
-  }
-}

package/scripts/pack-release.mjs

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-
-function main() {
-  const destination = process.env.RUNNER_TEMP;
-  if (!destination) throw new Error("RUNNER_TEMP is required");
-  const { version } = JSON.parse(fs.readFileSync("package.json", "utf8"));
-  execFileSync("pnpm", ["pack", "--pack-destination", destination], { stdio: "inherit" });
-  const tarball = path.join(destination, `impel-cli-${version}.tgz`);
-  if (!fs.existsSync(tarball)) throw new Error(`pnpm pack did not create ${tarball}`);
-  const prefix = path.join(destination, "impel-prefix");
-  execFileSync("npm", ["install", "--global", "--prefix", prefix, tarball], { stdio: "inherit" });
-  const executable = process.platform === "win32" ? path.join(prefix, "impel.cmd") : path.join(prefix, "bin", "impel");
-  const actual = execFileSync(executable, ["--version"], { encoding: "utf8" }).trim();
-  if (actual !== version) throw new Error(`packed CLI reports ${actual}, expected ${version}`);
-  console.log(`Verified packed impel-cli ${version}.`);
-}
-
-try {
-  main();
-} catch (error) {
-  console.error(`pack-release: ${error?.message || error}`);
-  process.exit(1);
-}

package/scripts/prepare-canary.mjs

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const CANARY_VERSION = /^\d+\.\d+\.\d+-canary\.\d+$/u;
-
-function main([version]) {
-  if (!CANARY_VERSION.test(version || "")) {
-    throw new Error(`the gate produced an invalid canary version: ${version || "<empty>"}`);
-  }
-  execFileSync("npm", ["version", version, "--no-git-tag-version"], { stdio: "inherit" });
-  execFileSync(process.execPath, ["scripts/bake-canary-brand.mjs"], { stdio: "inherit" });
-  const actual = JSON.parse(fs.readFileSync("package.json", "utf8")).version;
-  if (actual !== version) throw new Error(`package.json version ${actual} does not match ${version}`);
-  console.log(`Prepared ${version} canary package.`);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    main(process.argv.slice(2));
-  } catch (error) {
-    console.error(`prepare-canary: ${error?.message || error}`);
-    process.exit(1);
-  }
-}

package/scripts/release-gate.mjs

@@ -1,133 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import { execFileSync } from "node:child_process";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { compareSemver } from "./canary-version.mjs";
-import { evaluateCheckRuns } from "./required-checks.mjs";
-
-const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
-
-function appendSummary(text) {
-  if (!process.env.GITHUB_STEP_SUMMARY) throw new Error("GITHUB_STEP_SUMMARY is not set");
-  fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, text.endsWith("\n") ? text : `${text}\n`);
-}
-
-async function fetchJson(url, { token, allowMissing = false } = {}) {
-  const response = await fetch(url, {
-    headers: {
-      Accept: "application/vnd.github+json",
-      ...(token ? { Authorization: `Bearer ${token}` } : {}),
-      "User-Agent": "UseImpel/impel-cli release gate",
-      "X-GitHub-Api-Version": "2022-11-28",
-    },
-    signal: AbortSignal.timeout(30_000),
-  });
-  if (response.status === 404 && allowMissing) return {};
-  if (!response.ok) throw new Error(`request failed: HTTP ${response.status}`);
-  return response.json();
-}
-
-async function checkRunsForCommit(repository, sha, token) {
-  const runs = [];
-  for (let page = 1; ; page += 1) {
-    const body = await fetchJson(
-      `https://api.github.com/repos/${repository}/commits/${sha}/check-runs?per_page=100&page=${page}`,
-      { token },
-    );
-    runs.push(...body.check_runs.map(({ name, status, conclusion }) => ({ name, status, conclusion })));
-    if (body.check_runs.length < 100) return runs;
-  }
-}
-
-function manifest() {
-  return JSON.parse(fs.readFileSync("package.json", "utf8"));
-}
-
-export function verifyTag({ tag, version }) {
-  const expected = `v${version}`;
-  if (tag !== expected) throw new Error(`release tag ${tag} does not match ${expected}`);
-  return expected;
-}
-
-export function verifyMain({ sha, mainRef = "origin/main" }) {
-  try {
-    execFileSync("git", ["merge-base", "--is-ancestor", sha, mainRef], { stdio: "ignore" });
-  } catch {
-    throw new Error(`tagged commit ${sha} is not on ${mainRef}; merge to main before tagging`);
-  }
-}
-
-export async function verifyChecks({ repository, sha, token }) {
-  const result = evaluateCheckRuns(await checkRunsForCommit(repository, sha, token));
-  const summary = result.summary;
-  appendSummary(summary);
-  if (result.state !== "success") {
-    throw new Error(`required checks on ${sha} are not all green: ${result.failures.join("; ") || result.pending.join(", ")}`);
-  }
-  return result;
-}
-
-export async function verifySuccessor({ version, channel = version.includes("-") ? "next" : "latest" }) {
-  const tags = await fetchJson(DIST_TAGS_URL, { allowMissing: true });
-  const current = tags[channel] ?? (channel === "next" ? tags.latest : undefined);
-  const message = current === undefined
-    ? `No existing \`${channel}\` dist-tag; ${version} is the channel bootstrap.`
-    : `${version} strictly succeeds \`${channel}\`=${current}. Current tags: ${JSON.stringify(tags)}`;
-  if (current !== undefined && compareSemver(version, current) <= 0) {
-    throw new Error(`version ${version} is not a strict semver successor of ${channel}=${current}`);
-  }
-  appendSummary(`## Release gate: dist-tag successor\n\n${message}\n`);
-  console.log(message);
-  return { channel, current, tags };
-}
-
-export function selectDistTag(version) {
-  const tag = version.includes("-") ? "next" : "latest";
-  if (!process.env.GITHUB_ENV) throw new Error("GITHUB_ENV is not set");
-  fs.appendFileSync(process.env.GITHUB_ENV, `NPM_DIST_TAG=${tag}\n`);
-  console.log(`Publishing ${version} under npm dist-tag ${tag}.`);
-  return tag;
-}
-
-async function main([command]) {
-  const pkg = manifest();
-  if (command === "verify-tag") {
-    verifyTag({ tag: process.env.RELEASE_TAG, version: pkg.version });
-    return;
-  }
-  if (command === "verify-main") {
-    const sha = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-    verifyMain({ sha });
-    console.log(`Tagged commit ${sha} is on origin/main.`);
-    return;
-  }
-  if (command === "verify-checks") {
-    const sha = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-    await verifyChecks({
-      repository: process.env.GITHUB_REPOSITORY,
-      sha,
-      token: process.env.GH_TOKEN,
-    });
-    console.log(`All required checks are green on ${sha}.`);
-    return;
-  }
-  if (command === "verify-successor") {
-    await verifySuccessor({ version: pkg.version });
-    return;
-  }
-  if (command === "select-dist-tag") {
-    selectDistTag(pkg.version);
-    return;
-  }
-  throw new Error("usage: node scripts/release-gate.mjs verify-tag|verify-main|verify-checks|verify-successor|select-dist-tag");
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2)).catch((error) => {
-    console.error(`release-gate: ${error?.message || error}`);
-    process.exit(1);
-  });
-}