Announce a release of this codebase as the signed-in account, fetched from `sources`, and say so: where the record is, and which sources don't have the release yet (it's announced anyway; a push sends it).
What signing in for tcm asks to be allowed: writing its records (releases, reviews, advisories, yanks, listed codebases), and nothing else. One sign-in does for announcing, attesting and listing.
List a codebase as the signed-in account: its record written to their repository, at its name. Listed again, it's left as it is when it says the same (but when), and replaced when its URL or description changed.
Write a release's record to the signed-in account's repository. A version is one record: announced again, it's left as it is when it says the same, has its sources replaced when only they differ, and is refused when it names something else.
Where a package's release is announced as fetched from: the `--source` URLs given (kept for next time), else the ones kept, else origin, if it's a server.
The releases an account has announced: its `codes.tcm.release` records, read from the PDS its DID document names. A record that isn't one, or isn't at its own key (`<package>:<version>`), is left out.
An announced release: `what` (`geo@1.2.0`, or `geo` for its highest version) among those `who` (a handle, checked both ways, or a DID) has announced, as their repository signs it (`signedRecord`: what a PDS lists isn't taken on its word).