pubm 0.2.1 → 0.2.3

package/bin/cli.js

@@ -453,7 +453,7 @@ __export(base_exports, {
   scrollDown: () => scrollDown,
   scrollUp: () => scrollUp
 });
-import process6 from "node:process";
+import process4 from "node:process";
 var ESC, OSC, BEL, SEP, isTerminalApp, isWindows3, cwdFunction, cursorTo, cursorMove, cursorUp, cursorDown, cursorForward, cursorBackward, cursorLeft, cursorSavePosition, cursorRestorePosition, cursorGetPosition, cursorNextLine, cursorPrevLine, cursorHide, cursorShow, eraseLines, eraseEndLine, eraseStartLine, eraseLine, eraseDown, eraseUp, eraseScreen, scrollUp, scrollDown, clearScreen, clearTerminal, enterAlternativeScreen, exitAlternativeScreen, beep, link, image, iTerm;
 var init_base = __esm({
   "node_modules/.pnpm/ansi-escapes@7.0.0/node_modules/ansi-escapes/base.js"() {
@@ -463,11 +463,11 @@ var init_base = __esm({
     OSC = "\x1B]";
     BEL = "\x07";
     SEP = ";";
-    isTerminalApp = !isBrowser && process6.env.TERM_PROGRAM === "Apple_Terminal";
-    isWindows3 = !isBrowser && process6.platform === "win32";
+    isTerminalApp = !isBrowser && process4.env.TERM_PROGRAM === "Apple_Terminal";
+    isWindows3 = !isBrowser && process4.platform === "win32";
     cwdFunction = isBrowser ? () => {
       throw new Error("`process.cwd()` only works in Node.js, not the browser.");
-    } : process6.cwd;
+    } : process4.cwd;
     cursorTo = (x, y) => {
       if (typeof x !== "number") {
         throw new TypeError("The `x` argument is required");
@@ -708,7 +708,7 @@ var init_signals = __esm({
 });
 
 // node_modules/.pnpm/signal-exit@4.1.0/node_modules/signal-exit/dist/mjs/index.js
-var processOk, kExitEmitter, global, ObjectDefineProperty, Emitter, SignalExitBase, signalExitWrap, SignalExitFallback, _hupSig, _emitter, _process, _originalProcessEmit, _originalProcessReallyExit, _sigListeners, _loaded, _SignalExit_instances, processReallyExit_fn, processEmit_fn, SignalExit, process7, onExit, load, unload;
+var processOk, kExitEmitter, global, ObjectDefineProperty, Emitter, SignalExitBase, signalExitWrap, SignalExitFallback, _hupSig, _emitter, _process, _originalProcessEmit, _originalProcessReallyExit, _sigListeners, _loaded, _SignalExit_instances, processReallyExit_fn, processEmit_fn, SignalExit, process5, onExit, load, unload;
 var init_mjs = __esm({
   "node_modules/.pnpm/signal-exit@4.1.0/node_modules/signal-exit/dist/mjs/index.js"() {
     "use strict";
@@ -801,7 +801,7 @@ var init_mjs = __esm({
         // "SIGHUP" throws an `ENOSYS` error on Windows,
         // so use a supported signal instead
         /* c8 ignore start */
-        __privateAdd(this, _hupSig, process7.platform === "win32" ? "SIGINT" : "SIGHUP");
+        __privateAdd(this, _hupSig, process5.platform === "win32" ? "SIGINT" : "SIGHUP");
         /* c8 ignore stop */
         __privateAdd(this, _emitter, new Emitter());
         __privateAdd(this, _process);
@@ -918,7 +918,7 @@ var init_mjs = __esm({
         return og.call(__privateGet(this, _process), ev, ...args);
       }
     };
-    process7 = globalThis.process;
+    process5 = globalThis.process;
     ({
       onExit: (
         /**
@@ -952,19 +952,19 @@ var init_mjs = __esm({
          */
         unload
       )
-    } = signalExitWrap(processOk(process7) ? new SignalExit(process7) : new SignalExitFallback()));
+    } = signalExitWrap(processOk(process5) ? new SignalExit(process5) : new SignalExitFallback()));
   }
 });
 
 // node_modules/.pnpm/restore-cursor@5.1.0/node_modules/restore-cursor/index.js
-import process8 from "node:process";
+import process6 from "node:process";
 var terminal, restoreCursor, restore_cursor_default;
 var init_restore_cursor = __esm({
   "node_modules/.pnpm/restore-cursor@5.1.0/node_modules/restore-cursor/index.js"() {
     "use strict";
     init_onetime();
     init_mjs();
-    terminal = process8.stderr.isTTY ? process8.stderr : process8.stdout.isTTY ? process8.stdout : void 0;
+    terminal = process6.stderr.isTTY ? process6.stderr : process6.stdout.isTTY ? process6.stdout : void 0;
     restoreCursor = terminal ? onetime_default(() => {
       onExit(() => {
         terminal.write("\x1B[?25h");
@@ -976,7 +976,7 @@ var init_restore_cursor = __esm({
 });
 
 // node_modules/.pnpm/cli-cursor@5.0.0/node_modules/cli-cursor/index.js
-import process9 from "node:process";
+import process7 from "node:process";
 var isHidden, cliCursor, cli_cursor_default;
 var init_cli_cursor = __esm({
   "node_modules/.pnpm/cli-cursor@5.0.0/node_modules/cli-cursor/index.js"() {
@@ -984,14 +984,14 @@ var init_cli_cursor = __esm({
     init_restore_cursor();
     isHidden = false;
     cliCursor = {};
-    cliCursor.show = (writableStream = process9.stderr) => {
+    cliCursor.show = (writableStream = process7.stderr) => {
       if (!writableStream.isTTY) {
         return;
       }
       isHidden = false;
       writableStream.write("\x1B[?25h");
     };
-    cliCursor.hide = (writableStream = process9.stderr) => {
+    cliCursor.hide = (writableStream = process7.stderr) => {
       if (!writableStream.isTTY) {
         return;
       }
@@ -1667,7 +1667,7 @@ __export(log_update_exports, {
   default: () => log_update_default,
   logUpdateStderr: () => logUpdateStderr
 });
-import process10 from "node:process";
+import process8 from "node:process";
 function createLogUpdate(stream, { showCursor = false } = {}) {
   let previousLineCount = 0;
   let previousWidth = getWidth(stream);
@@ -1721,9 +1721,9 @@ var init_log_update = __esm({
       const toRemove = Math.max(0, lines.length - terminalHeight);
       return toRemove ? sliceAnsi(text, stripAnsi(lines.slice(0, toRemove).join("\n")).length + 1) : text;
     };
-    logUpdate = createLogUpdate(process10.stdout);
+    logUpdate = createLogUpdate(process8.stdout);
     log_update_default = logUpdate;
-    logUpdateStderr = createLogUpdate(process10.stderr);
+    logUpdateStderr = createLogUpdate(process8.stderr);
   }
 });
 
@@ -2225,178 +2225,6 @@ function registerPreCommand(cli2) {
   });
 }
 
-// src/commands/snapshot.ts
-function registerSnapshotCommand(cli2) {
-  cli2.command("snapshot [tag]", "Create a snapshot release").action(async (tag) => {
-    console.log(`pubm snapshot ${tag ?? ""} \u2014 coming in next phase`);
-  });
-}
-
-// src/changeset/status.ts
-import process5 from "node:process";
-
-// src/changeset/bump-utils.ts
-var BUMP_ORDER = {
-  patch: 0,
-  minor: 1,
-  major: 2
-};
-function maxBump(a2, b) {
-  return BUMP_ORDER[a2] >= BUMP_ORDER[b] ? a2 : b;
-}
-
-// src/changeset/reader.ts
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "node:fs";
-import path5 from "node:path";
-import process4 from "node:process";
-
-// src/changeset/parser.ts
-import { parse as parseYaml } from "yaml";
-var VALID_BUMP_TYPES = /* @__PURE__ */ new Set(["patch", "minor", "major"]);
-function parseChangeset(content, fileName) {
-  const frontmatterRegex = /^---\n([\s\S]*?)---/;
-  const match = content.match(frontmatterRegex);
-  if (!match) {
-    throw new Error(
-      `Invalid changeset format in "${fileName}": missing frontmatter`
-    );
-  }
-  const yamlContent = match[1];
-  const body = content.slice(match[0].length).trim();
-  const parsed = parseYaml(yamlContent);
-  const releases = [];
-  if (parsed) {
-    for (const [name, type] of Object.entries(parsed)) {
-      if (!VALID_BUMP_TYPES.has(type)) {
-        throw new Error(
-          `Invalid bump type "${type}" for package "${name}" in "${fileName}". Expected: patch, minor, or major.`
-        );
-      }
-      releases.push({ name, type });
-    }
-  }
-  const id = fileName.replace(/\.md$/, "");
-  return {
-    id,
-    summary: body,
-    releases
-  };
-}
-
-// src/changeset/reader.ts
-function readChangesets(cwd = process4.cwd()) {
-  const changesetsDir = path5.join(cwd, ".pubm", "changesets");
-  if (!existsSync4(changesetsDir)) {
-    return [];
-  }
-  const files = readdirSync2(changesetsDir);
-  const changesets = [];
-  for (const file of files) {
-    if (!file.endsWith(".md") || file === "README.md") {
-      continue;
-    }
-    const filePath = path5.join(changesetsDir, file);
-    const content = readFileSync2(filePath, "utf-8");
-    changesets.push(parseChangeset(content, file));
-  }
-  return changesets;
-}
-
-// src/changeset/status.ts
-function getStatus(cwd = process5.cwd()) {
-  const changesets = readChangesets(cwd);
-  const packages = /* @__PURE__ */ new Map();
-  for (const changeset of changesets) {
-    for (const release of changeset.releases) {
-      const existing = packages.get(release.name);
-      if (existing) {
-        existing.bumpType = maxBump(existing.bumpType, release.type);
-        existing.changesetCount += 1;
-        existing.summaries.push(changeset.summary);
-      } else {
-        packages.set(release.name, {
-          bumpType: release.type,
-          changesetCount: 1,
-          summaries: [changeset.summary]
-        });
-      }
-    }
-  }
-  return {
-    packages,
-    changesets,
-    hasChangesets: changesets.length > 0
-  };
-}
-
-// src/commands/status.ts
-function registerStatusCommand(cli2) {
-  cli2.command("status", "Show pending changeset status").option("--verbose", "Show full changeset contents").option("--since <ref>", "Only check changesets since git ref").action(async (options) => {
-    const status = getStatus();
-    if (!status.hasChangesets) {
-      if (options.since) {
-        console.log("No changesets found.");
-        process.exit(1);
-      }
-      console.log("No pending changesets.");
-      return;
-    }
-    console.log("Pending changesets:");
-    for (const [name, info] of status.packages) {
-      console.log(
-        `  ${name}: ${info.bumpType} (${info.changesetCount} changeset${info.changesetCount > 1 ? "s" : ""})`
-      );
-      if (options.verbose) {
-        for (const summary of info.summaries) {
-          console.log(`    - ${summary}`);
-        }
-      }
-    }
-  });
-}
-
-// src/commands/update.ts
-import { UpdateKit } from "update-kit";
-function registerUpdateCommand(cli2) {
-  cli2.command("update", "Update pubm to the latest version").action(async () => {
-    const kit = await UpdateKit.create({
-      sources: [{ type: "npm", packageName: "pubm" }],
-      delegateMode: "execute"
-    });
-    const result = await kit.autoUpdate({
-      onProgress: (p) => {
-        if (p.phase === "downloading" && p.totalBytes) {
-          const pct = Math.round(p.bytesDownloaded / p.totalBytes * 100);
-          process.stderr.write(`\rDownloading... ${pct}%`);
-        } else {
-          console.error(`${p.phase}...`);
-        }
-      }
-    });
-    switch (result.kind) {
-      case "success":
-        console.log(
-          `Updated from ${result.fromVersion} to ${result.toVersion}`
-        );
-        break;
-      case "needs-restart":
-        console.log(result.message);
-        break;
-      case "failed":
-        console.error(`Update failed: ${result.error.message}`);
-        process.exitCode = 1;
-        break;
-    }
-  });
-}
-
-// src/commands/version-cmd.ts
-function registerVersionCommand(cli2) {
-  cli2.command("version", "Consume changesets and bump versions").action(async () => {
-    console.log("pubm version \u2014 coming in next phase");
-  });
-}
-
 // node_modules/.pnpm/eventemitter3@5.0.1/node_modules/eventemitter3/index.mjs
 var import_index = __toESM(require_eventemitter3(), 1);
 var eventemitter3_default = import_index.default;
@@ -4865,56 +4693,435 @@ function consoleError(error) {
 `);
 }
 
-// src/git.ts
-import semver from "semver";
+// src/tasks/preflight.ts
+import { ListrEnquirerPromptAdapter } from "@listr2/prompt-adapter-enquirer";
 import { exec as exec2 } from "tinyexec";
-var GitError = class extends AbstractError {
+
+// src/utils/db.ts
+import { createCipheriv, createDecipheriv, createHash } from "node:crypto";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import path5 from "node:path";
+var a = "aes-256-cbc";
+var n = statSync(import.meta.dirname);
+var k = `${n.rdev}${n.birthtimeMs}${n.nlink}${n.gid}`;
+var l = createHash("md5").update(k).digest();
+function e(e2, f) {
+  const c = createCipheriv(a, createHash("sha-256").update(f).digest(), l);
+  return c.update(e2, "utf8", "hex") + c.final("hex");
+}
+function d(g, h) {
+  const d2 = createDecipheriv(a, createHash("sha-256").update(h).digest(), l);
+  return d2.update(g, "hex", "utf8") + d2.final("utf8");
+}
+var Db = class {
   constructor() {
-    super(...arguments);
-    __publicField(this, "name", "Git Error");
-  }
-};
-var Git = class {
-  async git(args) {
-    const { stdout } = await exec2("git", args, { throwOnError: true });
-    return stdout;
+    __publicField(this, "path", path5.resolve(import.meta.dirname, ".pubm"));
+    try {
+      if (!statSync(this.path).isDirectory()) {
+        mkdirSync5(this.path);
+      }
+    } catch {
+      try {
+        mkdirSync5(this.path);
+      } catch (error) {
+        throw new Error(
+          `Failed to create token storage directory at '${this.path}': ${error instanceof Error ? error.message : error}`
+        );
+      }
+    }
   }
-  async userName() {
+  set(field, value) {
     try {
-      return (await this.git(["config", "--get", "user.name"])).trim();
+      writeFileSync4(
+        path5.resolve(
+          this.path,
+          Buffer.from(e(field, field)).toString("base64")
+        ),
+        Buffer.from(e(`${value}`, field)),
+        { encoding: "binary" }
+      );
     } catch (error) {
-      throw new GitError("Failed to run `git config --get user.name`", {
-        cause: error
-      });
+      throw new Error(
+        `Failed to save token for '${field}': ${error instanceof Error ? error.message : error}`
+      );
     }
   }
-  async latestTag() {
+  get(field) {
+    const filePath = path5.resolve(
+      this.path,
+      Buffer.from(e(field, field)).toString("base64")
+    );
+    let raw;
     try {
-      return (await this.git(["describe", "--tags", "--abbrev=0"])).trim();
+      raw = readFileSync2(filePath);
     } catch {
       return null;
     }
-  }
-  async tags() {
-    try {
-      return (await this.git(["tag", "-l"])).trim().split("\n").sort(semver.compareIdentifiers);
-    } catch (error) {
-      throw new GitError("Failed to run `git tag -l`", {
-        cause: error
-      });
-    }
-  }
-  async previousTag(tag) {
     try {
-      const tags = await this.tags();
-      const strip = (t) => t.replace(/^v/, "");
-      return tags.at(tags.findIndex((t) => strip(t) === strip(tag)) - 1) ?? null;
+      return d(Buffer.from(raw).toString(), field);
     } catch {
+      console.warn(
+        `Stored token for '${field}' appears corrupted. It will be re-requested.`
+      );
       return null;
     }
   }
-  async dryFetch() {
-    try {
+};
+
+// src/utils/token.ts
+var TOKEN_CONFIG = {
+  npm: {
+    envVar: "NODE_AUTH_TOKEN",
+    dbKey: "npm-token",
+    ghSecretName: "NODE_AUTH_TOKEN",
+    promptLabel: "npm access token"
+  },
+  jsr: {
+    envVar: "JSR_TOKEN",
+    dbKey: "jsr-token",
+    ghSecretName: "JSR_TOKEN",
+    promptLabel: "jsr API token"
+  },
+  crates: {
+    envVar: "CARGO_REGISTRY_TOKEN",
+    dbKey: "cargo-token",
+    ghSecretName: "CARGO_REGISTRY_TOKEN",
+    promptLabel: "crates.io API token"
+  }
+};
+function loadTokensFromDb(registries) {
+  const db = new Db();
+  const tokens = {};
+  for (const registry of registries) {
+    const config = TOKEN_CONFIG[registry];
+    if (!config) continue;
+    const token = db.get(config.dbKey);
+    if (token) tokens[registry] = token;
+  }
+  return tokens;
+}
+function injectTokensToEnv(tokens) {
+  const originals = {};
+  for (const [registry, token] of Object.entries(tokens)) {
+    const config = TOKEN_CONFIG[registry];
+    if (!config) continue;
+    originals[config.envVar] = process.env[config.envVar];
+    process.env[config.envVar] = token;
+  }
+  return () => {
+    for (const [envVar, original] of Object.entries(originals)) {
+      if (original === void 0) {
+        delete process.env[envVar];
+      } else {
+        process.env[envVar] = original;
+      }
+    }
+  };
+}
+
+// src/tasks/preflight.ts
+var PreflightError = class extends AbstractError {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "name", "Preflight Error");
+  }
+};
+async function collectTokens(registries, task) {
+  const existing = loadTokensFromDb(registries);
+  const tokens = { ...existing };
+  for (const registry of registries) {
+    const config = TOKEN_CONFIG[registry];
+    if (!config || tokens[registry]) continue;
+    task.output = `Enter ${config.promptLabel}`;
+    const token = await task.prompt(ListrEnquirerPromptAdapter).run({
+      type: "password",
+      message: `Enter ${config.promptLabel}`
+    });
+    tokens[registry] = token;
+    new Db().set(config.dbKey, token);
+  }
+  return tokens;
+}
+async function syncGhSecrets(tokens) {
+  for (const [registry, token] of Object.entries(tokens)) {
+    const config = TOKEN_CONFIG[registry];
+    if (!config) continue;
+    await exec2("gh", ["secret", "set", config.ghSecretName], {
+      throwOnError: true,
+      nodeOptions: { input: token }
+    });
+  }
+}
+async function promptGhSecretsSync(tokens, task) {
+  const shouldSync = await task.prompt(ListrEnquirerPromptAdapter).run({
+    type: "toggle",
+    message: "Sync tokens to GitHub Secrets?",
+    enabled: "Yes",
+    disabled: "No"
+  });
+  if (shouldSync) {
+    task.output = "Syncing tokens to GitHub Secrets...";
+    try {
+      await syncGhSecrets(tokens);
+      task.output = "Tokens synced to GitHub Secrets.";
+    } catch (error) {
+      throw new PreflightError(
+        "Failed to sync tokens to GitHub Secrets. Ensure `gh` CLI is installed and authenticated (`gh auth login`).",
+        { cause: error }
+      );
+    }
+  }
+}
+
+// src/commands/secrets.ts
+function registerSecretsCommand(cli2) {
+  cli2.command("secrets sync", "Sync stored tokens to GitHub Secrets").option("--registry <...registries>", "Filter to specific registries", {
+    // biome-ignore lint/suspicious/noExplicitAny: CAC option type mismatch
+    type: String
+  }).action(async (options) => {
+    try {
+      const registries = options.registry ? options.registry.split(",") : ["npm", "jsr", "crates"];
+      const tokens = loadTokensFromDb(registries);
+      if (Object.keys(tokens).length === 0) {
+        console.log(
+          "No stored tokens found. Run `pubm --preflight` first to save tokens."
+        );
+        return;
+      }
+      console.log(
+        `Syncing ${Object.keys(tokens).length} token(s) to GitHub Secrets...`
+      );
+      await syncGhSecrets(tokens);
+      console.log("Done! Tokens synced to GitHub Secrets.");
+    } catch (e2) {
+      consoleError(e2);
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/snapshot.ts
+function registerSnapshotCommand(cli2) {
+  cli2.command("snapshot [tag]", "Create a snapshot release").action(async (tag) => {
+    console.log(`pubm snapshot ${tag ?? ""} \u2014 coming in next phase`);
+  });
+}
+
+// src/changeset/status.ts
+import process10 from "node:process";
+
+// src/changeset/bump-utils.ts
+var BUMP_ORDER = {
+  patch: 0,
+  minor: 1,
+  major: 2
+};
+function maxBump(a2, b) {
+  return BUMP_ORDER[a2] >= BUMP_ORDER[b] ? a2 : b;
+}
+
+// src/changeset/reader.ts
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "node:fs";
+import path6 from "node:path";
+import process9 from "node:process";
+
+// src/changeset/parser.ts
+import { parse as parseYaml } from "yaml";
+var VALID_BUMP_TYPES = /* @__PURE__ */ new Set(["patch", "minor", "major"]);
+function parseChangeset(content, fileName) {
+  const frontmatterRegex = /^---\n([\s\S]*?)---/;
+  const match = content.match(frontmatterRegex);
+  if (!match) {
+    throw new Error(
+      `Invalid changeset format in "${fileName}": missing frontmatter`
+    );
+  }
+  const yamlContent = match[1];
+  const body = content.slice(match[0].length).trim();
+  const parsed = parseYaml(yamlContent);
+  const releases = [];
+  if (parsed) {
+    for (const [name, type] of Object.entries(parsed)) {
+      if (!VALID_BUMP_TYPES.has(type)) {
+        throw new Error(
+          `Invalid bump type "${type}" for package "${name}" in "${fileName}". Expected: patch, minor, or major.`
+        );
+      }
+      releases.push({ name, type });
+    }
+  }
+  const id = fileName.replace(/\.md$/, "");
+  return {
+    id,
+    summary: body,
+    releases
+  };
+}
+
+// src/changeset/reader.ts
+function readChangesets(cwd = process9.cwd()) {
+  const changesetsDir = path6.join(cwd, ".pubm", "changesets");
+  if (!existsSync4(changesetsDir)) {
+    return [];
+  }
+  const files = readdirSync2(changesetsDir);
+  const changesets = [];
+  for (const file of files) {
+    if (!file.endsWith(".md") || file === "README.md") {
+      continue;
+    }
+    const filePath = path6.join(changesetsDir, file);
+    const content = readFileSync3(filePath, "utf-8");
+    changesets.push(parseChangeset(content, file));
+  }
+  return changesets;
+}
+
+// src/changeset/status.ts
+function getStatus(cwd = process10.cwd()) {
+  const changesets = readChangesets(cwd);
+  const packages = /* @__PURE__ */ new Map();
+  for (const changeset of changesets) {
+    for (const release of changeset.releases) {
+      const existing = packages.get(release.name);
+      if (existing) {
+        existing.bumpType = maxBump(existing.bumpType, release.type);
+        existing.changesetCount += 1;
+        existing.summaries.push(changeset.summary);
+      } else {
+        packages.set(release.name, {
+          bumpType: release.type,
+          changesetCount: 1,
+          summaries: [changeset.summary]
+        });
+      }
+    }
+  }
+  return {
+    packages,
+    changesets,
+    hasChangesets: changesets.length > 0
+  };
+}
+
+// src/commands/status.ts
+function registerStatusCommand(cli2) {
+  cli2.command("status", "Show pending changeset status").option("--verbose", "Show full changeset contents").option("--since <ref>", "Only check changesets since git ref").action(async (options) => {
+    const status = getStatus();
+    if (!status.hasChangesets) {
+      if (options.since) {
+        console.log("No changesets found.");
+        process.exit(1);
+      }
+      console.log("No pending changesets.");
+      return;
+    }
+    console.log("Pending changesets:");
+    for (const [name, info] of status.packages) {
+      console.log(
+        `  ${name}: ${info.bumpType} (${info.changesetCount} changeset${info.changesetCount > 1 ? "s" : ""})`
+      );
+      if (options.verbose) {
+        for (const summary of info.summaries) {
+          console.log(`    - ${summary}`);
+        }
+      }
+    }
+  });
+}
+
+// src/commands/update.ts
+import { UpdateKit } from "update-kit";
+function registerUpdateCommand(cli2) {
+  cli2.command("update", "Update pubm to the latest version").action(async () => {
+    const kit = await UpdateKit.create({
+      sources: [{ type: "npm", packageName: "pubm" }],
+      delegateMode: "execute"
+    });
+    const result = await kit.autoUpdate({
+      onProgress: (p) => {
+        if (p.phase === "downloading" && p.totalBytes) {
+          const pct = Math.round(p.bytesDownloaded / p.totalBytes * 100);
+          process.stderr.write(`\rDownloading... ${pct}%`);
+        } else {
+          console.error(`${p.phase}...`);
+        }
+      }
+    });
+    switch (result.kind) {
+      case "success":
+        console.log(
+          `Updated from ${result.fromVersion} to ${result.toVersion}`
+        );
+        break;
+      case "needs-restart":
+        console.log(result.message);
+        break;
+      case "failed":
+        console.error(`Update failed: ${result.error.message}`);
+        process.exitCode = 1;
+        break;
+    }
+  });
+}
+
+// src/commands/version-cmd.ts
+function registerVersionCommand(cli2) {
+  cli2.command("version", "Consume changesets and bump versions").action(async () => {
+    console.log("pubm version \u2014 coming in next phase");
+  });
+}
+
+// src/git.ts
+import semver from "semver";
+import { exec as exec3 } from "tinyexec";
+var GitError = class extends AbstractError {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "name", "Git Error");
+  }
+};
+var Git = class {
+  async git(args) {
+    const { stdout } = await exec3("git", args, { throwOnError: true });
+    return stdout;
+  }
+  async userName() {
+    try {
+      return (await this.git(["config", "--get", "user.name"])).trim();
+    } catch (error) {
+      throw new GitError("Failed to run `git config --get user.name`", {
+        cause: error
+      });
+    }
+  }
+  async latestTag() {
+    try {
+      return (await this.git(["describe", "--tags", "--abbrev=0"])).trim();
+    } catch {
+      return null;
+    }
+  }
+  async tags() {
+    try {
+      return (await this.git(["tag", "-l"])).trim().split("\n").sort(semver.compareIdentifiers);
+    } catch (error) {
+      throw new GitError("Failed to run `git tag -l`", {
+        cause: error
+      });
+    }
+  }
+  async previousTag(tag) {
+    try {
+      const tags = await this.tags();
+      const strip = (t) => t.replace(/^v/, "");
+      return tags.at(tags.findIndex((t) => strip(t) === strip(tag)) - 1) ?? null;
+    } catch {
+      return null;
+    }
+  }
+  async dryFetch() {
+    try {
       return await this.git(["fetch", "--dry-run"]);
     } catch (error) {
       throw new GitError("Failed to run `git fetch --dry-run`", {
@@ -5130,7 +5337,7 @@ var Git = class {
   async push(options) {
     const args = ["push", options].filter((v) => v);
     try {
-      const { stderr } = await exec2("git", args, { throwOnError: true });
+      const { stderr } = await exec3("git", args, { throwOnError: true });
       if (`${stderr}`.includes("GH006")) {
         return false;
       }
@@ -5190,7 +5397,7 @@ function resolveConfig(config) {
 
 // src/config/loader.ts
 import { stat } from "node:fs/promises";
-import path6 from "node:path";
+import path7 from "node:path";
 var CONFIG_FILES = [
   "pubm.config.ts",
   "pubm.config.mts",
@@ -5201,7 +5408,7 @@ var CONFIG_FILES = [
 ];
 async function findConfigFile(cwd) {
   for (const file of CONFIG_FILES) {
-    const filePath = path6.join(cwd, file);
+    const filePath = path7.join(cwd, file);
     try {
       if ((await stat(filePath)).isFile()) {
         return filePath;
@@ -5241,7 +5448,7 @@ import process14 from "node:process";
 import npmCli3 from "@npmcli/promise-spawn";
 import SemVer from "semver";
 import { isCI as isCI2 } from "std-env";
-import { exec as exec7 } from "tinyexec";
+import { exec as exec8 } from "tinyexec";
 
 // src/utils/cli.ts
 var warningBadge = color.bgYellow(" Warning ");
@@ -5251,7 +5458,7 @@ function link2(text, url) {
 
 // src/ecosystem/rust.ts
 import { readFile, stat as stat2, writeFile } from "node:fs/promises";
-import path7 from "node:path";
+import path8 from "node:path";
 import { parse, stringify } from "smol-toml";
 
 // src/ecosystem/ecosystem.ts
@@ -5265,14 +5472,14 @@ var Ecosystem = class {
 var RustEcosystem = class extends Ecosystem {
   static async detect(packagePath) {
     try {
-      return (await stat2(path7.join(packagePath, "Cargo.toml"))).isFile();
+      return (await stat2(path8.join(packagePath, "Cargo.toml"))).isFile();
     } catch {
       return false;
     }
   }
   async readCargoToml() {
     const raw = await readFile(
-      path7.join(this.packagePath, "Cargo.toml"),
+      path8.join(this.packagePath, "Cargo.toml"),
       "utf-8"
     );
     return parse(raw);
@@ -5288,7 +5495,7 @@ var RustEcosystem = class extends Ecosystem {
     return pkg.version;
   }
   async writeVersion(newVersion) {
-    const filePath = path7.join(this.packagePath, "Cargo.toml");
+    const filePath = path8.join(this.packagePath, "Cargo.toml");
     const raw = await readFile(filePath, "utf-8");
     const cargo = parse(raw);
     const pkg = cargo.package;
@@ -5408,7 +5615,7 @@ function createListr(...args) {
 
 // src/utils/package.ts
 import { readFile as readFile2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
-import path8 from "node:path";
+import path9 from "node:path";
 import process11 from "node:process";
 var cachedPackageJson = {};
 var cachedJsrJson = {};
@@ -5418,16 +5625,16 @@ function patchCachedJsrJson(contents, { cwd = process11.cwd() } = {}) {
 async function findOutFile(file, { cwd = process11.cwd() } = {}) {
   let directory = cwd;
   let filePath = "";
-  const { root } = path8.parse(cwd);
+  const { root } = path9.parse(cwd);
   while (directory) {
-    filePath = path8.join(directory, file);
+    filePath = path9.join(directory, file);
     try {
       if ((await stat3(filePath)).isFile()) {
         break;
       }
     } catch {
     }
-    directory = path8.dirname(directory);
+    directory = path9.dirname(directory);
     if (directory === root) return null;
   }
   return filePath;
@@ -5593,7 +5800,7 @@ async function replaceVersion(version2, packages) {
       return "jsr.json";
     })(),
     ...(packages ?? []).filter((pkg) => pkg.registries.includes("crates")).map(async (pkg) => {
-      const eco = new RustEcosystem(path8.resolve(pkg.path));
+      const eco = new RustEcosystem(path9.resolve(pkg.path));
       try {
         await eco.writeVersion(version2);
       } catch (error) {
@@ -5602,7 +5809,7 @@ async function replaceVersion(version2, packages) {
           { cause: error }
         );
       }
-      return path8.join(pkg.path, "Cargo.toml");
+      return path9.join(pkg.path, "Cargo.toml");
     })
   ]);
   return results.filter((v) => v);
@@ -5643,8 +5850,8 @@ function collectRegistries(ctx) {
 }
 
 // src/registry/crates.ts
-import path9 from "node:path";
-import { exec as exec3, NonZeroExitError } from "tinyexec";
+import path10 from "node:path";
+import { exec as exec4, NonZeroExitError } from "tinyexec";
 
 // src/registry/registry.ts
 var Registry = class {
@@ -5684,7 +5891,7 @@ var CratesRegistry = class extends Registry {
   }
   async isInstalled() {
     try {
-      await exec3("cargo", ["--version"]);
+      await exec4("cargo", ["--version"]);
       return true;
     } catch {
       return false;
@@ -5723,9 +5930,9 @@ var CratesRegistry = class extends Registry {
     try {
       const args = ["publish"];
       if (manifestDir) {
-        args.push("--manifest-path", path9.join(manifestDir, "Cargo.toml"));
+        args.push("--manifest-path", path10.join(manifestDir, "Cargo.toml"));
       }
-      await exec3("cargo", args, { throwOnError: true });
+      await exec4("cargo", args, { throwOnError: true });
       return true;
     } catch (error) {
       const stderr = error instanceof NonZeroExitError ? error.output?.stderr : void 0;
@@ -5738,13 +5945,13 @@ ${stderr}` : "Failed to run `cargo publish`";
     try {
       const args = ["publish", "--dry-run"];
       if (manifestDir) {
-        args.push("--manifest-path", path9.join(manifestDir, "Cargo.toml"));
+        args.push("--manifest-path", path10.join(manifestDir, "Cargo.toml"));
       }
-      await exec3("cargo", args, { throwOnError: true });
+      await exec4("cargo", args, { throwOnError: true });
     } catch (error) {
       const stderr = error instanceof NonZeroExitError ? error.output?.stderr : void 0;
-      const message = stderr ? `Dry-run failed for \`cargo publish\`:
-${stderr}` : "Dry-run failed for `cargo publish`";
+      const message = stderr ? `Failed to run \`cargo publish --dry-run\`:
+${stderr}` : "Failed to run `cargo publish --dry-run`";
       throw new CratesError(message, { cause: error });
     }
   }
@@ -5834,79 +6041,11 @@ function createCratesPublishTask(packagePath) {
 var cratesAvailableCheckTasks = createCratesAvailableCheckTask();
 var cratesPublishTasks = createCratesPublishTask();
 
-// src/registry/jsr.ts
-import { exec as exec4, NonZeroExitError as NonZeroExitError2 } from "tinyexec";
+// src/tasks/dry-run-publish.ts
+import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter2 } from "@listr2/prompt-adapter-enquirer";
 
-// src/utils/db.ts
-import { createCipheriv, createDecipheriv, createHash } from "node:crypto";
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync4 } from "node:fs";
-import path10 from "node:path";
-var a = "aes-256-cbc";
-var n = statSync(import.meta.dirname);
-var k = `${n.rdev}${n.birthtimeMs}${n.nlink}${n.gid}`;
-var l = createHash("md5").update(k).digest();
-function e(e2, f) {
-  const c = createCipheriv(a, createHash("sha-256").update(f).digest(), l);
-  return c.update(e2, "utf8", "hex") + c.final("hex");
-}
-function d(g, h) {
-  const d2 = createDecipheriv(a, createHash("sha-256").update(h).digest(), l);
-  return d2.update(g, "hex", "utf8") + d2.final("utf8");
-}
-var Db = class {
-  constructor() {
-    __publicField(this, "path", path10.resolve(import.meta.dirname, ".pubm"));
-    try {
-      if (!statSync(this.path).isDirectory()) {
-        mkdirSync5(this.path);
-      }
-    } catch {
-      try {
-        mkdirSync5(this.path);
-      } catch (error) {
-        throw new Error(
-          `Failed to create token storage directory at '${this.path}': ${error instanceof Error ? error.message : error}`
-        );
-      }
-    }
-  }
-  set(field, value) {
-    try {
-      writeFileSync4(
-        path10.resolve(
-          this.path,
-          Buffer.from(e(field, field)).toString("base64")
-        ),
-        Buffer.from(e(`${value}`, field)),
-        { encoding: "binary" }
-      );
-    } catch (error) {
-      throw new Error(
-        `Failed to save token for '${field}': ${error instanceof Error ? error.message : error}`
-      );
-    }
-  }
-  get(field) {
-    const filePath = path10.resolve(
-      this.path,
-      Buffer.from(e(field, field)).toString("base64")
-    );
-    let raw;
-    try {
-      raw = readFileSync3(filePath);
-    } catch {
-      return null;
-    }
-    try {
-      return d(Buffer.from(raw).toString(), field);
-    } catch {
-      console.warn(
-        `Stored token for '${field}' appears corrupted. It will be re-requested.`
-      );
-      return null;
-    }
-  }
-};
+// src/registry/jsr.ts
+import { exec as exec5, NonZeroExitError as NonZeroExitError2 } from "tinyexec";
 
 // src/utils/package-name.ts
 import { builtinModules } from "node:module";
@@ -5973,7 +6112,7 @@ var JsrRegisry = class extends Registry {
     this.client = new JsrClient(getApiEndpoint(this.registry));
   }
   async jsr(args) {
-    const { stdout } = await exec4("jsr", args, { throwOnError: true });
+    const { stdout } = await exec5("jsr", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -5989,7 +6128,7 @@ var JsrRegisry = class extends Registry {
   }
   async ping() {
     try {
-      const { stdout } = await exec4(
+      const { stdout } = await exec5(
         "ping",
         [new URL(this.registry).hostname, "-c", "1"],
         { throwOnError: true }
@@ -6004,7 +6143,7 @@ var JsrRegisry = class extends Registry {
   }
   async publish() {
     try {
-      await exec4(
+      await exec5(
         "jsr",
         ["publish", "--allow-dirty", "--token", `${JsrClient.token}`],
         {
@@ -6035,7 +6174,7 @@ ${stderr}` : ""}`,
   }
   async dryRunPublish() {
     try {
-      await exec4(
+      await exec5(
         "jsr",
         [
           "publish",
@@ -6047,12 +6186,9 @@ ${stderr}` : ""}`,
         { throwOnError: true }
       );
     } catch (error) {
-      const stderr = error instanceof NonZeroExitError2 ? error.output?.stderr : void 0;
-      throw new JsrError(
-        `Dry-run failed for \`jsr publish\`${stderr ? `
-${stderr}` : ""}`,
-        { cause: error }
-      );
+      throw new JsrError("Failed to run `jsr publish --dry-run`", {
+        cause: error
+      });
     }
   }
   async version() {
@@ -6296,7 +6432,7 @@ async function jsrRegistry() {
 }
 
 // src/registry/npm.ts
-import { exec as exec5, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
+import { exec as exec6, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
 var NpmError = class extends AbstractError {
   constructor() {
     super(...arguments);
@@ -6309,7 +6445,7 @@ var NpmRegistry = class extends Registry {
     __publicField(this, "registry", "https://registry.npmjs.org");
   }
   async npm(args) {
-    const { stdout } = await exec5("npm", args, { throwOnError: true });
+    const { stdout } = await exec6("npm", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -6420,7 +6556,7 @@ var NpmRegistry = class extends Registry {
   }
   async ping() {
     try {
-      await exec5("npm", ["ping"], { throwOnError: true });
+      await exec6("npm", ["ping"], { throwOnError: true });
       return true;
     } catch (error) {
       throw new NpmError("Failed to run `npm ping`", { cause: error });
@@ -6453,7 +6589,9 @@ var NpmRegistry = class extends Registry {
     try {
       await this.npm(["publish", "--dry-run"]);
     } catch (error) {
-      throw this.classifyPublishError(error);
+      throw new NpmError("Failed to run `npm publish --dry-run`", {
+        cause: error
+      });
     }
   }
   async twoFactorAuthMode() {
@@ -6502,69 +6640,78 @@ async function npmRegistry() {
 }
 
 // src/tasks/dry-run-publish.ts
+var AUTH_ERROR_PATTERNS = [
+  /401/i,
+  /403/i,
+  /unauthorized/i,
+  /forbidden/i,
+  /invalid.token/i,
+  /eotp/i
+];
+function isAuthError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return AUTH_ERROR_PATTERNS.some((pattern) => pattern.test(message));
+}
+async function withTokenRetry(registryKey, task, action) {
+  try {
+    await action();
+  } catch (error) {
+    if (!isAuthError(error)) throw error;
+    const config = TOKEN_CONFIG[registryKey];
+    if (!config) throw error;
+    task.output = `Auth failed. Re-enter ${config.promptLabel}`;
+    const newToken = await task.prompt(ListrEnquirerPromptAdapter2).run({
+      type: "password",
+      message: `Re-enter ${config.promptLabel}`
+    });
+    new Db().set(config.dbKey, newToken);
+    process.env[config.envVar] = newToken;
+    await action();
+  }
+}
 var npmDryRunPublishTask = {
   title: "Dry-run npm publish",
   task: async (_, task) => {
-    const npm = await npmRegistry();
     task.output = "Running npm publish --dry-run...";
-    await npm.dryRunPublish();
+    await withTokenRetry("npm", task, async () => {
+      const npm = await npmRegistry();
+      await npm.dryRunPublish();
+    });
   }
 };
 var jsrDryRunPublishTask = {
   title: "Dry-run jsr publish",
-  skip: () => !JsrClient.token,
   task: async (_, task) => {
-    const jsr = await jsrRegistry();
     task.output = "Running jsr publish --dry-run...";
-    await jsr.dryRunPublish();
+    await withTokenRetry("jsr", task, async () => {
+      const jsr = await jsrRegistry();
+      await jsr.dryRunPublish();
+    });
   }
 };
+async function getCrateName2(packagePath) {
+  const eco = new RustEcosystem(packagePath ?? process.cwd());
+  return await eco.packageName();
+}
 function createCratesDryRunPublishTask(packagePath) {
   const label = packagePath ? ` (${packagePath})` : "";
   return {
-    title: `Dry-run cargo publish${label}`,
+    title: `Dry-run crates.io publish${label}`,
     task: async (_, task) => {
-      const eco = new RustEcosystem(packagePath ?? process.cwd());
-      const packageName = await eco.packageName();
-      const registry = new CratesRegistry(packageName);
       task.output = "Running cargo publish --dry-run...";
-      await registry.dryRunPublish(packagePath);
+      await withTokenRetry("crates", task, async () => {
+        const packageName = await getCrateName2(packagePath);
+        const registry = new CratesRegistry(packageName);
+        await registry.dryRunPublish(packagePath);
+      });
     }
   };
 }
 var cratesDryRunPublishTask = createCratesDryRunPublishTask();
-function registryDryRunTask(registryKey) {
-  switch (registryKey) {
-    case "npm":
-      return npmDryRunPublishTask;
-    case "jsr":
-      return jsrDryRunPublishTask;
-    case "crates":
-      return cratesDryRunPublishTask;
-    default:
-      return npmDryRunPublishTask;
-  }
-}
-var dryRunPublishTask = {
-  title: "Validating publish (dry-run)",
-  task: (ctx, parentTask) => {
-    if (ctx.packages?.length) {
-      const tasks = ctx.packages.flatMap(
-        (pkg) => pkg.registries.map(
-          (registryKey) => registryKey === "crates" ? createCratesDryRunPublishTask(pkg.path) : registryDryRunTask(registryKey)
-        )
-      );
-      return parentTask.newListr(tasks, { concurrent: true });
-    }
-    return parentTask.newListr(collectRegistries(ctx).map(registryDryRunTask), {
-      concurrent: true
-    });
-  }
-};
 
 // src/tasks/jsr.ts
 import process12 from "node:process";
-import { ListrEnquirerPromptAdapter } from "@listr2/prompt-adapter-enquirer";
+import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter3 } from "@listr2/prompt-adapter-enquirer";
 import npmCli from "@npmcli/promise-spawn";
 var { open } = npmCli;
 var JsrAvailableError = class extends AbstractError {
@@ -6593,7 +6740,7 @@ var jsrAvailableCheckTasks = {
       if (ctx.promptEnabled) {
         const maxAttempts = 3;
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-          JsrClient.token = await task.prompt(ListrEnquirerPromptAdapter).run({
+          JsrClient.token = await task.prompt(ListrEnquirerPromptAdapter3).run({
             type: "password",
             message: `Please enter the jsr ${color.bold("API token")}${attempt > 1 ? ` (attempt ${attempt}/${maxAttempts})` : ""}`,
             footer: `
@@ -6643,7 +6790,7 @@ Generate a token from ${color.bold(link2("jsr.io", "https://jsr.io/account/token
           )
         )).filter((v) => v !== null);
         if (searchResults.length > 0) {
-          jsrName = await task.prompt(ListrEnquirerPromptAdapter).run({
+          jsrName = await task.prompt(ListrEnquirerPromptAdapter3).run({
             type: "select",
             message: "Is there a scoped package you want to publish in the already published list?",
             choices: [
@@ -6661,7 +6808,7 @@ Generate a token from ${color.bold(link2("jsr.io", "https://jsr.io/account/token
         }
         const userName = await new Git().userName();
         task.output = "Select the scope of the package to publish";
-        jsrName = await task.prompt(ListrEnquirerPromptAdapter).run({
+        jsrName = await task.prompt(ListrEnquirerPromptAdapter3).run({
           type: "select",
           message: "jsr.json does not exist, and the package name is not scoped. Please select a scope for the 'jsr' package",
           choices: [
@@ -6689,7 +6836,7 @@ Generate a token from ${color.bold(link2("jsr.io", "https://jsr.io/account/token
         });
         if (jsrName === "specify") {
           while (!isScopedPackage(jsrName)) {
-            jsrName = await task.prompt(ListrEnquirerPromptAdapter).run({
+            jsrName = await task.prompt(ListrEnquirerPromptAdapter3).run({
               type: "input",
               message: "Package name"
             });
@@ -6757,7 +6904,7 @@ var jsrPublishTasks = {
 ${urls.map((url) => `  ${color.cyan(url)}`).join("\n")}`;
         open(urls[0]);
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-          await task.prompt(ListrEnquirerPromptAdapter).run({
+          await task.prompt(ListrEnquirerPromptAdapter3).run({
             type: "input",
             message: `Press ${color.bold("enter")} after creating the package on jsr.io${attempt > 1 ? ` (attempt ${attempt}/${maxAttempts})` : ""}`
           });
@@ -6786,7 +6933,7 @@ ${jsr.packageCreationUrls.join("\n")}`
 // src/tasks/npm.ts
 import { spawn } from "node:child_process";
 import process13 from "node:process";
-import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter2 } from "@listr2/prompt-adapter-enquirer";
+import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter4 } from "@listr2/prompt-adapter-enquirer";
 import npmCli2 from "@npmcli/promise-spawn";
 var { open: open2 } = npmCli2;
 var NpmAvailableError = class extends AbstractError {
@@ -6883,7 +7030,7 @@ var npmPublishTasks = {
         const maxAttempts = 3;
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
           result = await npm.publish(
-            await task.prompt(ListrEnquirerPromptAdapter2).run({
+            await task.prompt(ListrEnquirerPromptAdapter4).run({
               type: "password",
               message: `npm OTP code${attempt > 1 ? ` (attempt ${attempt}/${maxAttempts})` : ""}`
             })
@@ -6918,7 +7065,7 @@ var npmPublishTasks = {
 };
 
 // src/tasks/prerequisites-check.ts
-import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter3 } from "@listr2/prompt-adapter-enquirer";
+import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter5 } from "@listr2/prompt-adapter-enquirer";
 var PrerequisitesCheckError = class extends AbstractError {
   constructor(message, { cause } = {}) {
     super(message, { cause });
@@ -6938,7 +7085,7 @@ var prerequisitesCheckTask = (options) => {
         title: "Verifying current branch is a release branch",
         task: async (ctx, task) => {
           if (await git.branch() !== ctx.branch) {
-            const swtichBranch = await task.prompt(ListrEnquirerPromptAdapter3).run({
+            const swtichBranch = await task.prompt(ListrEnquirerPromptAdapter5).run({
               type: "toggle",
               message: `${warningBadge} The current HEAD branch is not the release target branch. Do you want to switch branch to ${ctx.branch}?`,
               enabled: "Yes",
@@ -6960,7 +7107,7 @@ var prerequisitesCheckTask = (options) => {
         task: async (_2, task) => {
           task.output = "Checking for updates with `git fetch`";
           if ((await git.dryFetch()).trim()) {
-            const fetch2 = await task.prompt(ListrEnquirerPromptAdapter3).run({
+            const fetch2 = await task.prompt(ListrEnquirerPromptAdapter5).run({
               type: "toggle",
               message: `${warningBadge} Local history is outdated. Do you want to run \`git fetch\`?`,
               enabled: "Yes",
@@ -6977,7 +7124,7 @@ var prerequisitesCheckTask = (options) => {
           }
           task.output = "Checking for updates with `git pull`";
           if (await git.revisionDiffsCount()) {
-            const pull = await task.prompt(ListrEnquirerPromptAdapter3).run({
+            const pull = await task.prompt(ListrEnquirerPromptAdapter5).run({
               type: "toggle",
               message: `${warningBadge} Local history is outdated. Do you want to run \`git pull\`?`,
               enabled: "Yes",
@@ -6999,7 +7146,7 @@ var prerequisitesCheckTask = (options) => {
         task: async (ctx, task) => {
           if (await git.status()) {
             task.output = "Local working tree is not clean.";
-            if (!await task.prompt(ListrEnquirerPromptAdapter3).run({
+            if (!await task.prompt(ListrEnquirerPromptAdapter5).run({
               type: "toggle",
               message: `${warningBadge} Local working tree is not clean. Do you want to skip?`,
               enabled: "Yes",
@@ -7024,7 +7171,7 @@ var prerequisitesCheckTask = (options) => {
             return void 0;
           }
           if ((await git.commits(latestTag, "HEAD")).length <= 0) {
-            if (!await task.prompt(ListrEnquirerPromptAdapter3).run({
+            if (!await task.prompt(ListrEnquirerPromptAdapter5).run({
               type: "toggle",
               message: `${warningBadge} No commits exist from the latest tag. Do you want to skip?`,
               enabled: "Yes",
@@ -7042,7 +7189,7 @@ var prerequisitesCheckTask = (options) => {
         task: async (ctx, task) => {
           const gitTag = `v${ctx.version}`;
           if (await git.checkTagExist(gitTag)) {
-            const deleteTag = await task.prompt(ListrEnquirerPromptAdapter3).run({
+            const deleteTag = await task.prompt(ListrEnquirerPromptAdapter5).run({
               type: "toggle",
               message: `${warningBadge} The Git tag '${gitTag}' already exists. Do you want to delete tag?`,
               enabled: "Yes",
@@ -7064,13 +7211,13 @@ var prerequisitesCheckTask = (options) => {
 };
 
 // src/tasks/required-conditions-check.ts
-import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter4 } from "@listr2/prompt-adapter-enquirer";
+import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter6 } from "@listr2/prompt-adapter-enquirer";
 
 // src/registry/custom-registry.ts
-import { exec as exec6 } from "tinyexec";
+import { exec as exec7 } from "tinyexec";
 var CustomRegistry = class extends NpmRegistry {
   async npm(args) {
-    const { stdout } = await exec6(
+    const { stdout } = await exec7(
       "npm",
       args.concat("--registry", this.registry),
       { throwOnError: true }
@@ -7172,7 +7319,7 @@ var requiredConditionsCheckTask = (options) => createListr({
               task: async (_3, task) => {
                 const jsr = await jsrRegistry();
                 if (!await jsr.isInstalled()) {
-                  const install = await task.prompt(ListrEnquirerPromptAdapter4).run({
+                  const install = await task.prompt(ListrEnquirerPromptAdapter6).run({
                     type: "toggle",
                     message: `${warningBadge} jsr is not installed. Do you want to install jsr?`,
                     enabled: "Yes",
@@ -7306,14 +7453,66 @@ async function collectPublishTasks(ctx) {
   }
   return collectRegistries(ctx).map(registryTask);
 }
+function dryRunRegistryTask(registry) {
+  switch (registry) {
+    case "npm":
+      return npmDryRunPublishTask;
+    case "jsr":
+      return jsrDryRunPublishTask;
+    case "crates":
+      return cratesDryRunPublishTask;
+    default:
+      return npmDryRunPublishTask;
+  }
+}
+async function collectDryRunPublishTasks(ctx) {
+  if (ctx.packages?.length) {
+    const nonCratesTasks = ctx.packages.flatMap(
+      (pkg) => pkg.registries.filter((reg) => reg !== "crates").map((reg) => dryRunRegistryTask(reg))
+    );
+    const cratesPaths = ctx.packages.filter((pkg) => pkg.registries.includes("crates")).map((pkg) => pkg.path);
+    if (cratesPaths.length === 0) {
+      return nonCratesTasks;
+    }
+    const sortedPaths = await sortCratesByDependencyOrder(cratesPaths);
+    const sequentialCratesTask = {
+      title: "Dry-run crates.io publish (sequential)",
+      task: (_ctx, task) => task.newListr(
+        sortedPaths.map((p) => createCratesDryRunPublishTask(p)),
+        { concurrent: false }
+      )
+    };
+    return [...nonCratesTasks, sequentialCratesTask];
+  }
+  return collectRegistries(ctx).map(dryRunRegistryTask);
+}
 async function run(options) {
   const ctx = {
     ...options,
     promptEnabled: !isCI2 && process14.stdin.isTTY
   };
+  let cleanupEnv;
   try {
     if (options.contents) process14.chdir(options.contents);
-    if (!options.publishOnly) {
+    if (options.preflight) {
+      await createListr({
+        title: "Collecting registry tokens",
+        task: async (ctx2, task) => {
+          const registries2 = collectRegistries(ctx2);
+          const tokens = await collectTokens(registries2, task);
+          await promptGhSecretsSync(tokens, task);
+          cleanupEnv = injectTokensToEnv(tokens);
+          ctx2.promptEnabled = false;
+        }
+      }).run(ctx);
+      await prerequisitesCheckTask({
+        skip: options.skipPrerequisitesCheck
+      }).run(ctx);
+      await requiredConditionsCheckTask({
+        skip: options.skipConditionsCheck
+      }).run(ctx);
+    }
+    if (!options.publishOnly && !options.preflight) {
       await prerequisitesCheckTask({
         skip: options.skipPrerequisitesCheck
       }).run(ctx);
@@ -7327,14 +7526,14 @@ async function run(options) {
         task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
           concurrent: true
         })
-      } : [
+      } : options.preflight ? [
         {
           skip: options.skipTests,
           title: "Running tests",
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await exec7(packageManager, ["run", ctx2.testScript], {
+              await exec8(packageManager, ["run", ctx2.testScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7351,7 +7550,7 @@ async function run(options) {
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await exec7(packageManager, ["run", ctx2.buildScript], {
+              await exec8(packageManager, ["run", ctx2.buildScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7363,8 +7562,45 @@ async function run(options) {
           }
         },
         {
-          ...dryRunPublishTask,
-          skip: (ctx2) => options.skipPublish || !!ctx2.preview
+          title: "Validating publish (dry-run)",
+          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
+            concurrent: true
+          })
+        }
+      ] : [
+        {
+          skip: options.skipTests,
+          title: "Running tests",
+          task: async (ctx2) => {
+            const packageManager = await getPackageManager();
+            try {
+              await exec8(packageManager, ["run", ctx2.testScript], {
+                throwOnError: true
+              });
+            } catch (error) {
+              throw new AbstractError(
+                `Test script '${ctx2.testScript}' failed. Run \`${packageManager} run ${ctx2.testScript}\` locally to see full output.`,
+                { cause: error }
+              );
+            }
+          }
+        },
+        {
+          skip: options.skipBuild,
+          title: "Building the project",
+          task: async (ctx2) => {
+            const packageManager = await getPackageManager();
+            try {
+              await exec8(packageManager, ["run", ctx2.buildScript], {
+                throwOnError: true
+              });
+            } catch (error) {
+              throw new AbstractError(
+                `Build script '${ctx2.buildScript}' failed. Run \`${packageManager} run ${ctx2.buildScript}\` locally to see full output.`,
+                { cause: error }
+              );
+            }
+          }
         },
         {
           title: "Bumping version",
@@ -7480,13 +7716,24 @@ ${repositoryUrl}/compare/${lastRev}...${latestTag}`;
         parts.push(`${color.bold(name)} on ${color.red("crates.io")}`);
       }
     }
-    console.log(
-      `
+    if (options.preflight) {
+      cleanupEnv?.();
+      console.log(
+        `
+
+\u2705 Preflight check passed. CI publish should succeed for ${parts.join(", ")}.
+`
+      );
+    } else {
+      console.log(
+        `
 
 \u{1F680} Successfully published ${parts.join(", ")} ${color.blueBright(`v${ctx.version}`)} \u{1F680}
 `
-    );
+      );
+    }
   } catch (e2) {
+    cleanupEnv?.();
     consoleError(e2);
     await rollback();
     process14.exit(1);
@@ -7535,7 +7782,7 @@ async function pubm(options) {
 }
 
 // src/tasks/required-missing-information.ts
-import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter5 } from "@listr2/prompt-adapter-enquirer";
+import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter7 } from "@listr2/prompt-adapter-enquirer";
 import semver2 from "semver";
 var { RELEASE_TYPES, SemVer: SemVer2, prerelease: prerelease2 } = semver2;
 var requiredMissingInformationTasks = (options) => createListr({
@@ -7547,7 +7794,7 @@ var requiredMissingInformationTasks = (options) => createListr({
       skip: (ctx) => !!ctx.version,
       task: async (ctx, task) => {
         const currentVersion = await version();
-        let nextVersion = await task.prompt(ListrEnquirerPromptAdapter5).run({
+        let nextVersion = await task.prompt(ListrEnquirerPromptAdapter7).run({
           type: "select",
           message: "Select SemVer increment or specify new version",
           choices: RELEASE_TYPES.map((releaseType) => {
@@ -7562,7 +7809,7 @@ var requiredMissingInformationTasks = (options) => createListr({
           name: "version"
         });
         if (nextVersion === "specify") {
-          nextVersion = await task.prompt(ListrEnquirerPromptAdapter5).run({
+          nextVersion = await task.prompt(ListrEnquirerPromptAdapter7).run({
             type: "input",
             message: "Version",
             name: "version"
@@ -7584,7 +7831,7 @@ var requiredMissingInformationTasks = (options) => createListr({
           )
         ].filter((tag2) => tag2 !== defaultOptions.tag);
         if (distTags.length <= 0) distTags.push("next");
-        let tag = await task.prompt(ListrEnquirerPromptAdapter5).run({
+        let tag = await task.prompt(ListrEnquirerPromptAdapter7).run({
           type: "select",
           message: "Select the tag for this pre-release version in npm",
           choices: distTags.map((distTag) => ({
@@ -7596,7 +7843,7 @@ var requiredMissingInformationTasks = (options) => createListr({
           name: "tag"
         });
         if (tag === "specify") {
-          tag = await task.prompt(ListrEnquirerPromptAdapter5).run({
+          tag = await task.prompt(ListrEnquirerPromptAdapter7).run({
             type: "input",
             message: "Tag",
             name: "tag"
@@ -7682,6 +7929,11 @@ var publishOptions = [
     description: "Run only publish task for latest tag",
     options: { type: Boolean }
   },
+  {
+    rawName: "--preflight",
+    description: "Simulate CI publish locally (dry-run with token-based auth)",
+    options: { type: Boolean }
+  },
   {
     rawName: "-t, --tag <name>",
     description: "Publish under a specific dist-tag",
@@ -7712,7 +7964,8 @@ function resolveCliOptions(options) {
     skipBuild: !options.build,
     registries: options.registry?.split(","),
     skipPrerequisitesCheck: !options.preCheck,
-    skipConditionsCheck: !options.conditionCheck
+    skipConditionsCheck: !options.conditionCheck,
+    preflight: options.preflight
   };
 }
 var cli = cac("pubm");
@@ -7724,6 +7977,7 @@ registerSnapshotCommand(cli);
 registerInitCommand(cli);
 registerMigrateCommand(cli);
 registerUpdateCommand(cli);
+registerSecretsCommand(cli);
 var defaultCmd = cli.command("[version]", "Publish packages to registries");
 for (const option of publishOptions) {
   defaultCmd.option(option.rawName, option.description, option.options);
@@ -7739,7 +7993,9 @@ defaultCmd.action(
       tag: options.tag
     };
     try {
-      if (isCI3) {
+      if (options.preflight) {
+        context.version = nextVersion || "0.0.0-preflight";
+      } else if (isCI3) {
         if (options.publishOnly) {
           const git = new Git();
           const latestVersion = (await git.latestTag())?.slice(1);