@_linked/cli 1.40.0 → 1.41.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.41.0
+
+### Minor Changes
+
+- [#218](https://github.com/linked-fw/cli/pull/218) [`b8cdfbd`](https://github.com/linked-fw/cli/commit/b8cdfbd6b3312b81f1c913fbf12d7c7c4e50e1d2) Thanks [@flyon](https://github.com/flyon)! - `linked setup-publish` now writes `require-tests: true` into `pr.yml` when package.json has a `test` script, matching how every linked-cm package repo is set up. A package without one (a fresh `create-package` scaffold) still gets `false`, with a warning to flip it once a suite exists. Previously the stub always said `false`, so a package's tests could disappear without CI noticing.
+
+## 1.40.1
+
+### Patch Changes
+
+- [#216](https://github.com/linked-fw/cli/pull/216) [`2f9a3b5`](https://github.com/linked-fw/cli/commit/2f9a3b5e668e638d94384f6996ba4336d28b60d8) Thanks [@flyon](https://github.com/flyon)! - Remove unused dependencies: express, open, postcss-import, postcss-nested, postcss-preset-env
+
 ## 1.40.0
 
 ### Minor Changes

package/README.md

@@ -439,4 +439,4 @@ Metro iOS bundle. It builds nothing itself, needs network and takes several minu
 
 ## Repository
 
-`linked-cm/cli` on GitHub. License: MPL-2.0.
+`linked-fw/cli` on GitHub. License: MPL-2.0.

package/defaults/app-react-native/apps/mobile/package.json

@@ -11,10 +11,10 @@
     "test:integration": "jest -c jest.integration.config.js --runInBand"
   },
   "dependencies": {
-    "@_linked/core": "2.18.1",
-    "@_linked/react": "1.5.0",
-    "@_linked/schema": "1.1.2",
-    "@_linked/server": "2.3.0",
+    "@_linked/core": "2.26.0",
+    "@_linked/react": "1.6.4",
+    "@_linked/schema": "1.4.0",
+    "@_linked/server": "2.24.0",
     "app-shapes": "*",
     "expo": "57.0.25",
     "expo-constants": "57.0.19",

package/defaults/app-react-native/packages/app-shapes/package.json

@@ -16,9 +16,9 @@
     "build": "linked build"
   },
   "dependencies": {
-    "@_linked/core": "2.18.1"
+    "@_linked/core": "2.26.0"
   },
   "devDependencies": {
-    "@_linked/cli": "1.13.0"
+    "@_linked/cli": "1.40.0"
   }
 }

package/defaults/app-react-native/services/api/package.json

@@ -14,17 +14,17 @@
     "test": "node --experimental-strip-types --no-warnings=ExperimentalWarning --test test/*.test.mjs"
   },
   "dependencies": {
-    "@_linked/core": "2.18.1",
-    "@_linked/fuseki": "3.0.0",
-    "@_linked/s3": "1.1.0",
-    "@_linked/schema": "1.1.2",
-    "@_linked/server": "2.3.0",
-    "@_linked/server-utils": "1.2.0",
+    "@_linked/core": "2.26.0",
+    "@_linked/fuseki": "3.4.0",
+    "@_linked/s3": "1.6.0",
+    "@_linked/schema": "1.4.0",
+    "@_linked/server": "2.24.0",
+    "@_linked/server-utils": "1.12.0",
     "app-shapes": "*",
     "react-dom": "19.2.3"
   },
   "devDependencies": {
-    "@_linked/cli": "1.13.0",
+    "@_linked/cli": "1.40.0",
     "@types/node": "22.20.4",
     "typescript": "6.0.3"
   }

package/defaults/setup-publish/github/workflows/pr.yml

@@ -22,8 +22,9 @@ jobs:
       contents: read
       pull-requests: write
     with:
-      # Left false so a package with no test script passes instead of failing on a missing one.
-      # Set to true — and `test-script` to the unit-only script where `test` is not CI-safe —
-      # once this package has a suite that must exist.
-      require-tests: false
+      # true makes a missing or failing `test` script fail the PR. `linked setup-publish` writes
+      # true when package.json has a `test` script and false when it does not, so a fresh scaffold
+      # still passes. Flip it to true once a suite exists, and set `test-script` to the unit-only
+      # script where `test` is not CI-safe.
+      require-tests: {{REQUIRE_TESTS}}
       run-e2e: false

package/lib/esm/commands/setup-publish.d.ts

@@ -62,6 +62,19 @@ export type SetupPublishOptions = {
  * branch-protection profile on main and enables auto-merge.
  */
 export declare function setupPublish(opts?: SetupPublishOptions): Promise<void>;
+/**
+ * Whether the package has a `test` script for the PR check to run. `require-tests: true` turns a
+ * missing script into a failure, so it is only safe to write once one exists — and a fresh
+ * `create-package` scaffold has none.
+ */
+export declare function hasTestScript(pkgJson: {
+    scripts?: Record<string, unknown>;
+}): boolean;
+export type WorkflowVars = {
+    workflowOrg: string;
+    requireTests: boolean;
+};
+export declare function renderWorkflow(template: string, vars: WorkflowVars): string;
 /** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */
 export declare function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean;
 //# sourceMappingURL=setup-publish.d.ts.map

package/lib/esm/commands/setup-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,oCAAqC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,4BAA4B;;;;;;;;;;;;;;EAkB3C;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFhF;AAwHD,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkD/E"}
+{"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,oCAAqC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,4BAA4B;;;;;;;;;;;;;;EAkB3C;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyFhF;AAwBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAC,GAAG,OAAO,CAGnF;AAED,MAAM,MAAM,YAAY,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAC,CAAC;AAExE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAI3E;AAiGD,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkD/E"}

package/lib/esm/commands/setup-publish.js

@@ -105,7 +105,12 @@ export function setupPublish() {
                 '    not exist. Set the git remote (or package.json repository) and rerun, or fix the\n' +
                 '    `uses:` line in .github/workflows/{pr,publish}.yml by hand.'));
         }
-        yield copyWorkflows(cwd, workflowOrg);
+        const requireTests = hasTestScript(pkgJson);
+        if (!requireTests) {
+            console.warn(chalk.yellow('  ⚠ package.json has no `test` script, so pr.yml is written with require-tests: false.\n' +
+                '    Set it to true in .github/workflows/pr.yml once the package has a test suite.'));
+        }
+        yield copyWorkflows(cwd, { workflowOrg, requireTests });
         // 2. Changesets config + README
         yield copyChangesetConfig(cwd, repoSlug);
         // 3. Initial changeset
@@ -156,14 +161,28 @@ function resolveRepoSlug(cwd, pkgJson) {
         return 'OWNER/REPO';
     });
 }
-function copyWorkflows(cwd, workflowOrg) {
+/**
+ * Whether the package has a `test` script for the PR check to run. `require-tests: true` turns a
+ * missing script into a failure, so it is only safe to write once one exists — and a fresh
+ * `create-package` scaffold has none.
+ */
+export function hasTestScript(pkgJson) {
+    var _a;
+    const test = (_a = pkgJson.scripts) === null || _a === void 0 ? void 0 : _a.test;
+    return typeof test === 'string' && test.trim() !== '';
+}
+export function renderWorkflow(template, vars) {
+    return template
+        .replace(/\{\{WORKFLOW_ORG\}\}/g, vars.workflowOrg)
+        .replace(/\{\{REQUIRE_TESTS\}\}/g, String(vars.requireTests));
+}
+function copyWorkflows(cwd, vars) {
     return __awaiter(this, void 0, void 0, function* () {
         const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');
         const dstDir = path.join(cwd, '.github', 'workflows');
         fs.mkdirpSync(dstDir);
         for (const file of WORKFLOW_FILES) {
-            let content = fs.readFileSync(path.join(srcDir, file), 'utf8');
-            content = content.replace(/\{\{WORKFLOW_ORG\}\}/g, workflowOrg);
+            const content = renderWorkflow(fs.readFileSync(path.join(srcDir, file), 'utf8'), vars);
             fs.writeFileSync(path.join(dstDir, file), content);
             console.log(chalk.green('  ✓') + ` .github/workflows/${file}`);
         }

package/lib/esm/commands/setup-publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-publish.js","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,EAAE,EAAC,OAAO,EAAC,MAAM,MAAM,CAAC;AACnC,OAAO,EAAC,KAAK,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AAE/C,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,WAAW;IAC9B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErD,wEAAwE;AACxE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,0FAA0F;AAC1F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,sBAAsB,EAAE,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAC;QAC5E,4FAA4F;QAC5F,uDAAuD;QACvD,cAAc,EAAE,IAAI;QACpB,8FAA8F;QAC9F,8FAA8F;QAC9F,2FAA2F;QAC3F,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,KAAK;YAC5B,0BAA0B,EAAE,KAAK;SAClC;QACD,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAgB,YAAY;yDAAC,OAA4B,EAAE;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,yFAAyF;QACzF,uFAAuF;QACvF,2FAA2F;QAC3F,+DAA+D;QAC/D,MAAM,aAAa,GAAG,gBAAgB,CAAC;QAEvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,sFAAsF;gBACpF,6DAA6D,CAChE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yGAAyG,CAC1G,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,4FAA4F;QAC5F,qEAAqE;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,4FAA4F;gBAC1F,wFAAwF;gBACxF,iEAAiE,CACpE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAEtC,gCAAgC;QAChC,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,uBAAuB;QACvB,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,gBAAgB;QAChB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAE3B,0BAA0B;QAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,2EAA2E;QAC3E,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAE1B,kDAAkD;QAClD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,yBAAyB;QACzB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW,EAAE,OAAY;;QACtD,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oCAAoC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvG,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,WAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvE,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3E,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yGAAyG,CAAC,CAAC,CAAC;QACtI,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAED,SAAe,aAAa,CAAC,GAAW,EAAE,WAAmB;;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;YAChE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,4FAA4F;QAC5F,mFAAmF;QACnF,0FAA0F;QAC1F,+DAA+D;QAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;CAAA;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,QAAgB;;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAE5D,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC;IAC5D,CAAC;CAAA;AAED,SAAe,qBAAqB,CAAC,GAAW,EAAE,OAAe;;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,OAAO,oEAAoE,CAAC;QAClG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC;IACrE,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW;;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,eAAe;YACf,MAAM;YACN,WAAW;YACX,OAAO;YACP,WAAW;YACX,EAAE;YACF,sDAAsD;YACtD,wEAAwE;YACxE,0BAA0B;YAC1B,iBAAiB;SAClB,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1C,EAAE;YACF,GAAG,OAAO;SACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;IAClD,CAAC;CAAA;AAED,SAAe,gBAAgB,CAC7B,WAAmB,EACnB,OAAY,EACZ,QAAgB;;QAEhB,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oDAAoD,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,QAAgB;;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,gFAAgF;IAChF,EAAE;IACF,yFAAyF;IACzF,4CAA4C;IAC5C,EAAE;IACF,kFAAkF;IAClF,+EAA+E;IAC/E,EAAE;IACF,yFAAyF;IACzF,iDAAiD;IACjD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,0BAA0B,QAAQ,MAAM,CAAC;QACrD,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,0CAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,GAAG,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,aAAa,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAC,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;IACrF,CAAC;IAED,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;QACvD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;QACnE,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAe,cAAc,CAAC,GAAW;;QACvC,6EAA6E;QAC7E,qCAAqC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACnD,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YACjE,MAAM,KAAK,CACT,8DAA8D,QAAQ,EAAE,EACxE,KAAK,EACL,IAAI,EACJ,EAAC,GAAG,EAAE,OAAO,EAAC,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gHAAgH,CAAC,CAAC,CAAC;gBAC7I,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qGAAqG,CAAC,CAAC,CAAC;YAClI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB;;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAExE,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iGAAiG,CAAC,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,GAAG,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,WAAW,CACf,SAAS,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,4BAA4B,QAAQ,qCAAqC,EAChH,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,iCAAiC,QAAQ,OAAO,CAAC,CAAC;YACnF,8FAA8F;YAC9F,+FAA+F;YAC/F,gEAAgE;YAChE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,oDAAoD,QAAQ,WAAW,CAAC,CACpF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,oBAAoB,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,gGAAgG;QAChG,sFAAsF;QACtF,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,WAAW,CACf,0BAA0B,QAAQ,2BAA2B,EAC7D,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,wCAAwC,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB,EAAE,QAAgB;;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,QAAQ,yBAAyB,QAAQ,KAAK,CAAC,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2FAA2F,CAAC,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,QAAQ,kBAAkB,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,WAAW,CACf,uBAAuB,KAAK,UAAU,QAAQ,UAAU,KAAK,IAAI,IAAI,qBAAqB,EAC1F,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,QAAQ,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,QAAQ,kBAAkB,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CAAA;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,aAAqB,EACrB,gBAAqC,EACrC,WAA+B;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,gGAAgG;IAChG,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,2BAA2B,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,mBAAmB,CAAC,CAAC;IAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,2CAA2C,QAAQ,sBAAsB,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import chalk from 'chalk';\nimport fs from 'fs-extra';\nimport path, {dirname} from 'path';\nimport {execp, execPromise} from '../utils.js';\n\nconst dirname__ =\n  typeof __dirname !== 'undefined'\n    ? __dirname\n    : //@ts-ignore\n      dirname(import.meta.url).replace('file:/', '');\n\n// defaults/setup-publish/ lives at packages/cli/defaults/setup-publish/\n// This file compiles to lib/{esm,cjs}/commands/setup-publish.js — go up three\n// levels to reach the package root, then into defaults/setup-publish.\nconst TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'setup-publish');\n\n// Both are callers of the shared reusable workflows. `publish.yml` in particular cannot be\n// renamed: npm's trusted-publisher check validates the calling workflow's filename, and a\n// mismatch only shows up as releases quietly needing manual approval again.\nexport const WORKFLOW_FILES = ['pr.yml', 'publish.yml'] as const;\n\n/**\n * The uniform branch-protection profile every `@_linked` repo runs on `main`.\n *\n * The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked\n * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is\n * `checks`. A repo pinning the bare name waits forever on a check that never reports.\n */\nexport function buildBranchProtectionPayload() {\n  return {\n    required_status_checks: {strict: false, contexts: ['checks / Build & Test']},\n    // Admins included: the point of the gate is that no release skips the build, and the people\n    // most likely to push straight to main are the admins.\n    enforce_admins: true,\n    // Reviews enabled but zero approvals required. The publish workflow direct-merges the version\n    // PR (GitHub's auto-merge queue does not honor review-bypass allowances), so a non-zero count\n    // would stall every release; the block itself still has to exist for the profile to match.\n    required_pull_request_reviews: {\n      required_approving_review_count: 0,\n      dismiss_stale_reviews: false,\n      require_code_owner_reviews: false,\n    },\n    restrictions: null,\n    allow_force_pushes: false,\n    allow_deletions: false,\n  };\n}\n\nexport type SetupPublishOptions = {\n  configureGithub?: boolean;\n  /**\n   * @deprecated The npm secret is `NPM_AUTH_TOKEN` in every org, holding a token for that\n   * org's own npm scope — there is no longer a second name to select between. Kept as an\n   * accepted no-op for the same reason as `dualBranch`: commander aborts the whole command\n   * on an unknown option, so a stale script would fail to set the repo up at all rather\n   * than setting it up correctly.\n   */\n  scope?: string;\n  /**\n   * @deprecated The dual-branch (`main` + `dev`) flow and its `@next` prereleases are retired —\n   * every package repo is `main`-only. Kept as an accepted no-op rather than removed because\n   * commander aborts the whole command on an unknown option, so a stale script or copied\n   * command line would fail to set the repo up at all instead of setting it up correctly.\n   */\n  dualBranch?: boolean;\n  grantTeam?: string; // GitHub team slug to grant push access on the repo\n};\n\n/**\n * Set up the changesets publish pipeline in the current package repo.\n *\n * The workflows are thin callers of the shared reusable workflows in the repo's OWN org\n * `.github` repo (pinned `@v1`, a deliberately moving tag) — one edit there changes every\n * package's pipeline in that org, which is why nothing about the build or publish steps is\n * scaffolded per repo any more. Each org keeps its own copy so that community gates can be\n * stricter than first-party ones without a cross-org `workflow_call`.\n *\n * Installs:\n * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else\n * - .changeset/config.json + README.md\n * - .changeset/initial-release.md\n * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts\n * - package.json: @changesets/cli + @changesets/changelog-github devDeps,\n *   publishConfig: {access: public}\n * - package-lock.json generated via npm install --package-lock-only\n *\n * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform\n * branch-protection profile on main and enables auto-merge.\n */\nexport async function setupPublish(opts: SetupPublishOptions = {}): Promise<void> {\n  const cwd = process.cwd();\n  // One secret NAME across every org. The orgs are separate, so each holds its own value —\n  // a token scoped to that org's npm scope. (There used to be an `NPM_AUTH_TOKEN_CM` for\n  // `@linked.cm`; that dates from before first-party and community repos were split into two\n  // orgs and one org therefore had to hold both tokens at once.)\n  const npmSecretName = 'NPM_AUTH_TOKEN';\n\n  console.log(chalk.magenta('Setting up the publish pipeline (main only)...'));\n  if (opts.scope) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --scope is deprecated and ignored: every org uses NPM_AUTH_TOKEN, holding that\\n' +\n          \"    org's own token. The NPM_AUTH_TOKEN_CM name is retired.\",\n      ),\n    );\n  }\n  if (opts.dualBranch) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --dual-branch is deprecated and ignored: the main + dev flow and its @next prereleases are retired.',\n      ),\n    );\n  }\n  console.log(`  target: ${cwd}`);\n  console.log(`  npm secret: ${npmSecretName}`);\n\n  const pkgJsonPath = path.join(cwd, 'package.json');\n  if (!fs.existsSync(pkgJsonPath)) {\n    console.error(chalk.red('No package.json found in current directory. Run from the repo root.'));\n    process.exit(1);\n  }\n\n  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));\n  const repoSlug = await resolveRepoSlug(cwd, pkgJson);\n\n  console.log(`  repo: ${repoSlug}`);\n  console.log('');\n\n  // 1. Workflow files. The caller stubs point at the shared workflows in this repo's own org,\n  //    so a repo in linked-cm never reaches into linked-fw for its CI.\n  const workflowOrg = repoSlug.split('/')[0];\n  if (workflowOrg === 'OWNER') {\n    console.warn(\n      chalk.yellow(\n        '  ⚠ The repo slug is unknown, so the workflow stubs will call OWNER/.github — which does\\n' +\n          '    not exist. Set the git remote (or package.json repository) and rerun, or fix the\\n' +\n          '    `uses:` line in .github/workflows/{pr,publish}.yml by hand.',\n      ),\n    );\n  }\n  await copyWorkflows(cwd, workflowOrg);\n\n  // 2. Changesets config + README\n  await copyChangesetConfig(cwd, repoSlug);\n\n  // 3. Initial changeset\n  await writeInitialChangeset(cwd, pkgJson.name);\n\n  // 4. .gitignore\n  await updateGitignore(cwd);\n\n  // 5. package.json patches\n  await patchPackageJson(pkgJsonPath, pkgJson, repoSlug);\n\n  // 6. npm install --package-lock-only to generate lockfile (if not present)\n  await ensureLockfile(cwd);\n\n  // 7. Optional: configure GitHub branch protection\n  if (opts.configureGithub) {\n    await configureGithub(repoSlug);\n  }\n\n  // 8. Optional: grant a GitHub team push access\n  if (opts.grantTeam) {\n    await grantTeamAccess(repoSlug, opts.grantTeam);\n  }\n\n  // Summary + manual steps\n  printNextSteps(repoSlug, npmSecretName, opts.configureGithub, opts.grantTeam);\n}\n\nasync function resolveRepoSlug(cwd: string, pkgJson: any): Promise<string> {\n  // Try git remote first\n  try {\n    const remoteUrl = await execPromise('git config --get remote.origin.url', false, false, {cwd});\n    const m = typeof remoteUrl === 'string' ? remoteUrl.match(/[:/]([^/:]+\\/[^/]+?)(?:\\.git)?\\s*$/) : null;\n    if (m) return m[1];\n  } catch {\n    // fall through\n  }\n  // Fallback: parse package.json repository\n  const repoField = pkgJson.repository;\n  if (typeof repoField === 'string') {\n    const m = repoField.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  } else if (repoField?.url) {\n    const m = repoField.url.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  }\n  console.warn(chalk.yellow('Could not determine repo slug. Using placeholder \"OWNER/REPO\" — update .changeset/config.json manually.'));\n  return 'OWNER/REPO';\n}\n\nasync function copyWorkflows(cwd: string, workflowOrg: string): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');\n  const dstDir = path.join(cwd, '.github', 'workflows');\n  fs.mkdirpSync(dstDir);\n\n  for (const file of WORKFLOW_FILES) {\n    let content = fs.readFileSync(path.join(srcDir, file), 'utf8');\n    content = content.replace(/\\{\\{WORKFLOW_ORG\\}\\}/g, workflowOrg);\n    fs.writeFileSync(path.join(dstDir, file), content);\n    console.log(chalk.green('  ✓') + ` .github/workflows/${file}`);\n  }\n\n  // ci.yml and changeset-check.yml became the two jobs of the shared pr.yml. Left behind on a\n  // repo that was set up before the consolidation they keep running, so the old bare\n  // `Build & Test` check reports alongside `checks / Build & Test` and re-setting a repo up\n  // looks like it worked while the duplicate gate quietly stays.\n  for (const stale of ['ci.yml', 'changeset-check.yml']) {\n    const stalePath = path.join(dstDir, stale);\n    if (fs.existsSync(stalePath)) {\n      fs.removeSync(stalePath);\n      console.log(chalk.green('  ✓') + ` removed superseded .github/workflows/${stale}`);\n    }\n  }\n}\n\nasync function copyChangesetConfig(cwd: string, repoSlug: string): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'changeset');\n  const dstDir = path.join(cwd, '.changeset');\n  fs.mkdirpSync(dstDir);\n\n  let configContent = fs.readFileSync(path.join(srcDir, 'config.json'), 'utf8');\n  configContent = configContent.replace(/\\{\\{REPO_SLUG\\}\\}/g, repoSlug);\n  fs.writeFileSync(path.join(dstDir, 'config.json'), configContent);\n  console.log(chalk.green('  ✓') + ' .changeset/config.json');\n\n  fs.copyFileSync(path.join(srcDir, 'README.md'), path.join(dstDir, 'README.md'));\n  console.log(chalk.green('  ✓') + ' .changeset/README.md');\n}\n\nasync function writeInitialChangeset(cwd: string, pkgName: string): Promise<void> {\n  const changelogPath = path.join(cwd, 'CHANGELOG.md');\n  if (fs.existsSync(changelogPath)) {\n    console.log(chalk.gray('  · CHANGELOG.md exists — skipping initial changeset'));\n    return;\n  }\n  const initial = path.join(cwd, '.changeset', 'initial-release.md');\n  const body = `---\\n'${pkgName}': patch\\n---\\n\\nInitial release under the new publishing setup.\\n`;\n  fs.writeFileSync(initial, body);\n  console.log(chalk.green('  ✓') + ' .changeset/initial-release.md');\n}\n\nasync function updateGitignore(cwd: string): Promise<void> {\n  const gitignorePath = path.join(cwd, '.gitignore');\n  const entries = [\n    'node_modules/',\n    'lib/',\n    'yarn.lock',\n    '*.log',\n    '.DS_Store',\n    '',\n    '# tsc sourcemap output — always in lib/, never src/.',\n    '# (.d.ts not ignored — hand-written type declarations like colors.d.ts',\n    '#  are legit src files.)',\n    'src/**/*.js.map',\n  ];\n  const existing = fs.existsSync(gitignorePath)\n    ? fs.readFileSync(gitignorePath, 'utf8').split('\\n')\n    : [];\n  const existingSet = new Set(existing.map((l) => l.trim()));\n  const toAdd = entries.filter((e) => e && !existingSet.has(e.trim()));\n  if (toAdd.length === 0) {\n    console.log(chalk.gray('  · .gitignore already has all entries'));\n    return;\n  }\n  const merged = [\n    ...existing.filter((l) => l.trim() !== ''),\n    '',\n    ...entries,\n  ].join('\\n');\n  fs.writeFileSync(gitignorePath, merged + '\\n');\n  console.log(chalk.green('  ✓') + ' .gitignore');\n}\n\nasync function patchPackageJson(\n  pkgJsonPath: string,\n  pkgJson: any,\n  repoSlug: string,\n): Promise<void> {\n  if (applyPackageJsonPatches(pkgJson, repoSlug)) {\n    fs.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n    console.log(chalk.green('  ✓') + ' package.json (publishConfig + changesets devDeps)');\n  } else {\n    console.log(chalk.gray('  · package.json already configured'));\n  }\n}\n\n/** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */\nexport function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean {\n  let modified = false;\n\n  // `repository.url` must be set, and must match the repo the workflow builds in.\n  //\n  // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose\n  // attestation cannot be matched against it:\n  //\n  //   422 Error verifying sigstore provenance bundle: Failed to validate repository\n  //   information: package.json \"repository.url\" is \"\", expected to match <repo>\n  //\n  // The slug is already resolved from `git remote` above, so there is no reason to leave a\n  // package to discover this at its first release.\n  if (repoSlug !== 'OWNER/REPO') {\n    const url = `git+https://github.com/${repoSlug}.git`;\n    const current =\n      typeof pkgJson.repository === 'string'\n        ? pkgJson.repository\n        : pkgJson.repository?.url;\n    if (!current) {\n      pkgJson.repository = {type: 'git', url};\n      modified = true;\n    }\n  }\n\n  if (!pkgJson.publishConfig) {\n    pkgJson.publishConfig = {access: 'public'};\n    modified = true;\n  } else {\n    if (pkgJson.publishConfig.access !== 'public') {\n      pkgJson.publishConfig.access = 'public';\n      modified = true;\n    }\n    // `provenance` is deliberately left alone. It used to be stripped because publishing went\n    // through NPM_AUTH_TOKEN only; the shared workflow now publishes with OIDC trusted publishing\n    // first (`npm publish --provenance`, id-token: write on both caller and reusable workflow) and\n    // falls back to the staged token release, so provenance is wanted, not a conflict.\n  }\n\n  pkgJson.devDependencies = pkgJson.devDependencies || {};\n  if (!pkgJson.devDependencies['@changesets/cli']) {\n    pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';\n    modified = true;\n  }\n  if (!pkgJson.devDependencies['@changesets/changelog-github']) {\n    pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';\n    modified = true;\n  }\n\n  return modified;\n}\n\nasync function ensureLockfile(cwd: string): Promise<void> {\n  // Always regenerate — package.json has just been patched (new devDeps etc.),\n  // so any existing lockfile is stale.\n  console.log(chalk.magenta('  Running npm install --package-lock-only...'));\n\n  // When running inside a yarn workspace (e.g. CN's packages/* layout), npm\n  // climbs up, detects the parent workspace, and writes the lockfile at the\n  // wrong level. Work around by copying the package to a tmpdir, generating\n  // the lockfile in isolation, and copying it back.\n  const os = await import('os');\n  const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));\n  const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));\n  try {\n    const pkgJsonPath = path.join(cwd, 'package.json');\n    fs.copyFileSync(pkgJsonPath, path.join(tmpBase, 'package.json'));\n    await execp(\n      `npm install --legacy-peer-deps --package-lock-only --cache ${cacheDir}`,\n      false,\n      true,\n      {cwd: tmpBase},\n    );\n    const lockPath = path.join(tmpBase, 'package-lock.json');\n    if (fs.existsSync(lockPath)) {\n      fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));\n      console.log(chalk.green('  ✓') + ' package-lock.json');\n    } else {\n      console.warn(chalk.yellow('  ⚠ npm install did not produce a package-lock.json — likely because a dependency is not yet published on npm.'));\n      console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n    }\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to generate package-lock.json — likely because a dependency is not yet published on npm.'));\n    console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n  } finally {\n    fs.removeSync(tmpBase);\n    fs.removeSync(cacheDir);\n  }\n}\n\nasync function configureGithub(repoSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta('Configuring GitHub (branch protection)...'));\n\n  // Check gh CLI available\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --configure-github,'));\n    console.warn(chalk.yellow('    or set branch protection manually at https://github.com/' + repoSlug + '/settings/branches'));\n    return;\n  }\n\n  // Check gh CLI authenticated\n  try {\n    await execPromise('gh auth status', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI is not authenticated. Run `gh auth login` and retry.'));\n    return;\n  }\n\n  const payload = JSON.stringify(buildBranchProtectionPayload());\n\n  try {\n    // Use --input - to pass the JSON payload via stdin\n    await execPromise(\n      `echo '${payload.replace(/'/g, \"'\\\\''\")}' | gh api -X PUT /repos/${repoSlug}/branches/main/protection --input -`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` branch protection enabled on ${repoSlug}/main`);\n    // A repo can pin a required check in a *ruleset* as well as in classic branch protection, and\n    // the two are stored separately — this call only writes the classic one, so a leftover ruleset\n    // keeps blocking merges on a check name that no longer reports.\n    console.log(\n      chalk.gray(`  · check for a competing ruleset: gh api /repos/${repoSlug}/rulesets`),\n    );\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to set branch protection. Do it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings/branches`));\n  }\n\n  // Enable \"Allow auto-merge\" so a PR can be queued to merge itself once checks pass. The publish\n  // workflow authors the Release PR via the org App token (org secrets RELEASE_APP_ID /\n  // RELEASE_APP_PRIVATE_KEY) so its CI runs without a manual approval gate.\n  try {\n    await execPromise(\n      `gh api -X PATCH /repos/${repoSlug} -F allow_auto_merge=true`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` auto-merge enabled on ${repoSlug}`);\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to enable auto-merge. Enable it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings (General → Allow auto-merge)`));\n  }\n}\n\nasync function grantTeamAccess(repoSlug: string, teamSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta(`Granting '${teamSlug}' team push access to ${repoSlug}...`));\n\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow(\"  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --grant-team,\"));\n    console.warn(chalk.yellow(`    or add the team manually at https://github.com/${repoSlug}/settings/access`));\n    return;\n  }\n\n  const [owner, repo] = repoSlug.split('/');\n  try {\n    await execPromise(\n      `gh api -X PUT /orgs/${owner}/teams/${teamSlug}/repos/${owner}/${repo} -f permission=push`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` team '${teamSlug}' granted push access on ${repoSlug}`);\n  } catch (err: any) {\n    const msg = err?.stderr || err?.stdout || String(err);\n    console.warn(chalk.yellow(`  ⚠ Failed to grant team access: ${msg.slice(0, 200)}`));\n    console.warn(chalk.yellow(`    Team may not exist in org '${owner}', or you may lack admin rights.`));\n    console.warn(chalk.yellow(`    Manual: https://github.com/${repoSlug}/settings/access`));\n  }\n}\n\nfunction printNextSteps(\n  repoSlug: string,\n  npmSecretName: string,\n  configuredGithub: boolean | undefined,\n  grantedTeam: string | undefined,\n): void {\n  console.log('');\n  console.log(chalk.green('Done.'));\n  console.log('');\n  console.log(chalk.bold('Next steps:'));\n  console.log('');\n  const [owner, repo] = repoSlug.split('/');\n\n  console.log(`  1. Review the generated files, adjust as needed.`);\n  console.log(`  2. Commit:`);\n  console.log(chalk.cyan('       git add . && git commit -m \"set up the publish pipeline\"'));\n  console.log(`  3. Push to main — the publish workflow will trigger.`);\n  console.log('');\n  console.log(chalk.bold('Register the trusted publisher on npmjs.com (before the first release):'));\n  console.log('');\n  console.log(`  package → Settings → Trusted Publisher, matching the caller workflow exactly:`);\n  console.log(`    organization: ${chalk.cyan(owner)}   repository: ${chalk.cyan(repo)}`);\n  console.log(`    workflow filename: ${chalk.cyan('publish.yml')}   environment: ${chalk.cyan('(empty)')}`);\n  console.log(`    \"Allow npm publish\": ${chalk.cyan('ticked')}`);\n  console.log('');\n  console.log(chalk.gray(`  Without it the release still ships — the workflow falls back to a staged`));\n  console.log(chalk.gray(`  npm release that a maintainer approves with 2FA. A typo in the organization`));\n  console.log(chalk.gray(`  field looks exactly the same, so check that field first if a package that`));\n  console.log(chalk.gray(`  should publish directly keeps staging instead.`));\n  console.log('');\n  // No per-repo secret grant step: NPM_AUTH_TOKEN, RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are\n  // \"All repositories\" org secrets, which is the whole reason first-party and community packages\n  // live in separate orgs. Only mention what is genuinely still one-time-per-org.\n  console.log(chalk.bold(`One-time org-level setup (already done on linked-fw and linked-cm):`));\n  console.log('');\n  console.log(`  a. Org secrets ${chalk.cyan(npmSecretName)}, ${chalk.cyan('RELEASE_APP_ID')} and ${chalk.cyan('RELEASE_APP_PRIVATE_KEY')},`);\n  console.log(`     visible to ${chalk.cyan('All repositories')} — there is no per-repo grant step.`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/secrets/actions`);\n  console.log('');\n  console.log(`  b. Enable \"Allow GitHub Actions to create and approve pull requests\":`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/actions`);\n\n  if (!configuredGithub) {\n    console.log('');\n    console.log(chalk.bold('Branch protection:'));\n    console.log(`  Rerun with ${chalk.cyan('linked setup-publish --configure-github')} to configure automatically,`);\n    console.log(`  or set manually at https://github.com/${repoSlug}/settings/branches —`);\n    console.log(`  the required check is ${chalk.cyan('checks / Build & Test')}, not ${chalk.cyan('Build & Test')}.`);\n  }\n  console.log('');\n}\n"]}
+{"version":3,"file":"setup-publish.js","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,EAAE,EAAC,OAAO,EAAC,MAAM,MAAM,CAAC;AACnC,OAAO,EAAC,KAAK,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AAE/C,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,WAAW;IAC9B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErD,wEAAwE;AACxE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,0FAA0F;AAC1F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,sBAAsB,EAAE,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAC;QAC5E,4FAA4F;QAC5F,uDAAuD;QACvD,cAAc,EAAE,IAAI;QACpB,8FAA8F;QAC9F,8FAA8F;QAC9F,2FAA2F;QAC3F,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,KAAK;YAC5B,0BAA0B,EAAE,KAAK;SAClC;QACD,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAgB,YAAY;yDAAC,OAA4B,EAAE;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,yFAAyF;QACzF,uFAAuF;QACvF,2FAA2F;QAC3F,+DAA+D;QAC/D,MAAM,aAAa,GAAG,gBAAgB,CAAC;QAEvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,sFAAsF;gBACpF,6DAA6D,CAChE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yGAAyG,CAC1G,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,4FAA4F;QAC5F,qEAAqE;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,4FAA4F;gBAC1F,wFAAwF;gBACxF,iEAAiE,CACpE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,0FAA0F;gBACxF,mFAAmF,CACtF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC,CAAC;QAEtD,gCAAgC;QAChC,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,uBAAuB;QACvB,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,gBAAgB;QAChB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAE3B,0BAA0B;QAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,2EAA2E;QAC3E,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAE1B,kDAAkD;QAClD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,yBAAyB;QACzB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW,EAAE,OAAY;;QACtD,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oCAAoC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvG,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,WAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvE,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3E,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yGAAyG,CAAC,CAAC,CAAC;QACtI,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAA4C;;IACxE,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,CAAC;IACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAID,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAkB;IACjE,OAAO,QAAQ;SACZ,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,WAAW,CAAC;SAClD,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAe,aAAa,CAAC,GAAW,EAAE,IAAkB;;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YACvF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,4FAA4F;QAC5F,mFAAmF;QACnF,0FAA0F;QAC1F,+DAA+D;QAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;CAAA;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,QAAgB;;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAE5D,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC;IAC5D,CAAC;CAAA;AAED,SAAe,qBAAqB,CAAC,GAAW,EAAE,OAAe;;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,OAAO,oEAAoE,CAAC;QAClG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC;IACrE,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW;;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,eAAe;YACf,MAAM;YACN,WAAW;YACX,OAAO;YACP,WAAW;YACX,EAAE;YACF,sDAAsD;YACtD,wEAAwE;YACxE,0BAA0B;YAC1B,iBAAiB;SAClB,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1C,EAAE;YACF,GAAG,OAAO;SACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;IAClD,CAAC;CAAA;AAED,SAAe,gBAAgB,CAC7B,WAAmB,EACnB,OAAY,EACZ,QAAgB;;QAEhB,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oDAAoD,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,QAAgB;;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,gFAAgF;IAChF,EAAE;IACF,yFAAyF;IACzF,4CAA4C;IAC5C,EAAE;IACF,kFAAkF;IAClF,+EAA+E;IAC/E,EAAE;IACF,yFAAyF;IACzF,iDAAiD;IACjD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,0BAA0B,QAAQ,MAAM,CAAC;QACrD,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,0CAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,GAAG,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,aAAa,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAC,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;IACrF,CAAC;IAED,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;QACvD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;QACnE,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAe,cAAc,CAAC,GAAW;;QACvC,6EAA6E;QAC7E,qCAAqC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACnD,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YACjE,MAAM,KAAK,CACT,8DAA8D,QAAQ,EAAE,EACxE,KAAK,EACL,IAAI,EACJ,EAAC,GAAG,EAAE,OAAO,EAAC,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gHAAgH,CAAC,CAAC,CAAC;gBAC7I,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qGAAqG,CAAC,CAAC,CAAC;YAClI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB;;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAExE,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iGAAiG,CAAC,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,GAAG,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,WAAW,CACf,SAAS,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,4BAA4B,QAAQ,qCAAqC,EAChH,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,iCAAiC,QAAQ,OAAO,CAAC,CAAC;YACnF,8FAA8F;YAC9F,+FAA+F;YAC/F,gEAAgE;YAChE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,oDAAoD,QAAQ,WAAW,CAAC,CACpF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,oBAAoB,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,gGAAgG;QAChG,sFAAsF;QACtF,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,WAAW,CACf,0BAA0B,QAAQ,2BAA2B,EAC7D,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,wCAAwC,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB,EAAE,QAAgB;;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,QAAQ,yBAAyB,QAAQ,KAAK,CAAC,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2FAA2F,CAAC,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,QAAQ,kBAAkB,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,WAAW,CACf,uBAAuB,KAAK,UAAU,QAAQ,UAAU,KAAK,IAAI,IAAI,qBAAqB,EAC1F,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,QAAQ,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,QAAQ,kBAAkB,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CAAA;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,aAAqB,EACrB,gBAAqC,EACrC,WAA+B;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,gGAAgG;IAChG,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,2BAA2B,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,mBAAmB,CAAC,CAAC;IAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,2CAA2C,QAAQ,sBAAsB,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import chalk from 'chalk';\nimport fs from 'fs-extra';\nimport path, {dirname} from 'path';\nimport {execp, execPromise} from '../utils.js';\n\nconst dirname__ =\n  typeof __dirname !== 'undefined'\n    ? __dirname\n    : //@ts-ignore\n      dirname(import.meta.url).replace('file:/', '');\n\n// defaults/setup-publish/ lives at packages/cli/defaults/setup-publish/\n// This file compiles to lib/{esm,cjs}/commands/setup-publish.js — go up three\n// levels to reach the package root, then into defaults/setup-publish.\nconst TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'setup-publish');\n\n// Both are callers of the shared reusable workflows. `publish.yml` in particular cannot be\n// renamed: npm's trusted-publisher check validates the calling workflow's filename, and a\n// mismatch only shows up as releases quietly needing manual approval again.\nexport const WORKFLOW_FILES = ['pr.yml', 'publish.yml'] as const;\n\n/**\n * The uniform branch-protection profile every `@_linked` repo runs on `main`.\n *\n * The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked\n * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is\n * `checks`. A repo pinning the bare name waits forever on a check that never reports.\n */\nexport function buildBranchProtectionPayload() {\n  return {\n    required_status_checks: {strict: false, contexts: ['checks / Build & Test']},\n    // Admins included: the point of the gate is that no release skips the build, and the people\n    // most likely to push straight to main are the admins.\n    enforce_admins: true,\n    // Reviews enabled but zero approvals required. The publish workflow direct-merges the version\n    // PR (GitHub's auto-merge queue does not honor review-bypass allowances), so a non-zero count\n    // would stall every release; the block itself still has to exist for the profile to match.\n    required_pull_request_reviews: {\n      required_approving_review_count: 0,\n      dismiss_stale_reviews: false,\n      require_code_owner_reviews: false,\n    },\n    restrictions: null,\n    allow_force_pushes: false,\n    allow_deletions: false,\n  };\n}\n\nexport type SetupPublishOptions = {\n  configureGithub?: boolean;\n  /**\n   * @deprecated The npm secret is `NPM_AUTH_TOKEN` in every org, holding a token for that\n   * org's own npm scope — there is no longer a second name to select between. Kept as an\n   * accepted no-op for the same reason as `dualBranch`: commander aborts the whole command\n   * on an unknown option, so a stale script would fail to set the repo up at all rather\n   * than setting it up correctly.\n   */\n  scope?: string;\n  /**\n   * @deprecated The dual-branch (`main` + `dev`) flow and its `@next` prereleases are retired —\n   * every package repo is `main`-only. Kept as an accepted no-op rather than removed because\n   * commander aborts the whole command on an unknown option, so a stale script or copied\n   * command line would fail to set the repo up at all instead of setting it up correctly.\n   */\n  dualBranch?: boolean;\n  grantTeam?: string; // GitHub team slug to grant push access on the repo\n};\n\n/**\n * Set up the changesets publish pipeline in the current package repo.\n *\n * The workflows are thin callers of the shared reusable workflows in the repo's OWN org\n * `.github` repo (pinned `@v1`, a deliberately moving tag) — one edit there changes every\n * package's pipeline in that org, which is why nothing about the build or publish steps is\n * scaffolded per repo any more. Each org keeps its own copy so that community gates can be\n * stricter than first-party ones without a cross-org `workflow_call`.\n *\n * Installs:\n * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else\n * - .changeset/config.json + README.md\n * - .changeset/initial-release.md\n * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts\n * - package.json: @changesets/cli + @changesets/changelog-github devDeps,\n *   publishConfig: {access: public}\n * - package-lock.json generated via npm install --package-lock-only\n *\n * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform\n * branch-protection profile on main and enables auto-merge.\n */\nexport async function setupPublish(opts: SetupPublishOptions = {}): Promise<void> {\n  const cwd = process.cwd();\n  // One secret NAME across every org. The orgs are separate, so each holds its own value —\n  // a token scoped to that org's npm scope. (There used to be an `NPM_AUTH_TOKEN_CM` for\n  // `@linked.cm`; that dates from before first-party and community repos were split into two\n  // orgs and one org therefore had to hold both tokens at once.)\n  const npmSecretName = 'NPM_AUTH_TOKEN';\n\n  console.log(chalk.magenta('Setting up the publish pipeline (main only)...'));\n  if (opts.scope) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --scope is deprecated and ignored: every org uses NPM_AUTH_TOKEN, holding that\\n' +\n          \"    org's own token. The NPM_AUTH_TOKEN_CM name is retired.\",\n      ),\n    );\n  }\n  if (opts.dualBranch) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --dual-branch is deprecated and ignored: the main + dev flow and its @next prereleases are retired.',\n      ),\n    );\n  }\n  console.log(`  target: ${cwd}`);\n  console.log(`  npm secret: ${npmSecretName}`);\n\n  const pkgJsonPath = path.join(cwd, 'package.json');\n  if (!fs.existsSync(pkgJsonPath)) {\n    console.error(chalk.red('No package.json found in current directory. Run from the repo root.'));\n    process.exit(1);\n  }\n\n  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));\n  const repoSlug = await resolveRepoSlug(cwd, pkgJson);\n\n  console.log(`  repo: ${repoSlug}`);\n  console.log('');\n\n  // 1. Workflow files. The caller stubs point at the shared workflows in this repo's own org,\n  //    so a repo in linked-cm never reaches into linked-fw for its CI.\n  const workflowOrg = repoSlug.split('/')[0];\n  if (workflowOrg === 'OWNER') {\n    console.warn(\n      chalk.yellow(\n        '  ⚠ The repo slug is unknown, so the workflow stubs will call OWNER/.github — which does\\n' +\n          '    not exist. Set the git remote (or package.json repository) and rerun, or fix the\\n' +\n          '    `uses:` line in .github/workflows/{pr,publish}.yml by hand.',\n      ),\n    );\n  }\n  const requireTests = hasTestScript(pkgJson);\n  if (!requireTests) {\n    console.warn(\n      chalk.yellow(\n        '  ⚠ package.json has no `test` script, so pr.yml is written with require-tests: false.\\n' +\n          '    Set it to true in .github/workflows/pr.yml once the package has a test suite.',\n      ),\n    );\n  }\n  await copyWorkflows(cwd, {workflowOrg, requireTests});\n\n  // 2. Changesets config + README\n  await copyChangesetConfig(cwd, repoSlug);\n\n  // 3. Initial changeset\n  await writeInitialChangeset(cwd, pkgJson.name);\n\n  // 4. .gitignore\n  await updateGitignore(cwd);\n\n  // 5. package.json patches\n  await patchPackageJson(pkgJsonPath, pkgJson, repoSlug);\n\n  // 6. npm install --package-lock-only to generate lockfile (if not present)\n  await ensureLockfile(cwd);\n\n  // 7. Optional: configure GitHub branch protection\n  if (opts.configureGithub) {\n    await configureGithub(repoSlug);\n  }\n\n  // 8. Optional: grant a GitHub team push access\n  if (opts.grantTeam) {\n    await grantTeamAccess(repoSlug, opts.grantTeam);\n  }\n\n  // Summary + manual steps\n  printNextSteps(repoSlug, npmSecretName, opts.configureGithub, opts.grantTeam);\n}\n\nasync function resolveRepoSlug(cwd: string, pkgJson: any): Promise<string> {\n  // Try git remote first\n  try {\n    const remoteUrl = await execPromise('git config --get remote.origin.url', false, false, {cwd});\n    const m = typeof remoteUrl === 'string' ? remoteUrl.match(/[:/]([^/:]+\\/[^/]+?)(?:\\.git)?\\s*$/) : null;\n    if (m) return m[1];\n  } catch {\n    // fall through\n  }\n  // Fallback: parse package.json repository\n  const repoField = pkgJson.repository;\n  if (typeof repoField === 'string') {\n    const m = repoField.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  } else if (repoField?.url) {\n    const m = repoField.url.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  }\n  console.warn(chalk.yellow('Could not determine repo slug. Using placeholder \"OWNER/REPO\" — update .changeset/config.json manually.'));\n  return 'OWNER/REPO';\n}\n\n/**\n * Whether the package has a `test` script for the PR check to run. `require-tests: true` turns a\n * missing script into a failure, so it is only safe to write once one exists — and a fresh\n * `create-package` scaffold has none.\n */\nexport function hasTestScript(pkgJson: {scripts?: Record<string, unknown>}): boolean {\n  const test = pkgJson.scripts?.test;\n  return typeof test === 'string' && test.trim() !== '';\n}\n\nexport type WorkflowVars = {workflowOrg: string; requireTests: boolean};\n\nexport function renderWorkflow(template: string, vars: WorkflowVars): string {\n  return template\n    .replace(/\\{\\{WORKFLOW_ORG\\}\\}/g, vars.workflowOrg)\n    .replace(/\\{\\{REQUIRE_TESTS\\}\\}/g, String(vars.requireTests));\n}\n\nasync function copyWorkflows(cwd: string, vars: WorkflowVars): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');\n  const dstDir = path.join(cwd, '.github', 'workflows');\n  fs.mkdirpSync(dstDir);\n\n  for (const file of WORKFLOW_FILES) {\n    const content = renderWorkflow(fs.readFileSync(path.join(srcDir, file), 'utf8'), vars);\n    fs.writeFileSync(path.join(dstDir, file), content);\n    console.log(chalk.green('  ✓') + ` .github/workflows/${file}`);\n  }\n\n  // ci.yml and changeset-check.yml became the two jobs of the shared pr.yml. Left behind on a\n  // repo that was set up before the consolidation they keep running, so the old bare\n  // `Build & Test` check reports alongside `checks / Build & Test` and re-setting a repo up\n  // looks like it worked while the duplicate gate quietly stays.\n  for (const stale of ['ci.yml', 'changeset-check.yml']) {\n    const stalePath = path.join(dstDir, stale);\n    if (fs.existsSync(stalePath)) {\n      fs.removeSync(stalePath);\n      console.log(chalk.green('  ✓') + ` removed superseded .github/workflows/${stale}`);\n    }\n  }\n}\n\nasync function copyChangesetConfig(cwd: string, repoSlug: string): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'changeset');\n  const dstDir = path.join(cwd, '.changeset');\n  fs.mkdirpSync(dstDir);\n\n  let configContent = fs.readFileSync(path.join(srcDir, 'config.json'), 'utf8');\n  configContent = configContent.replace(/\\{\\{REPO_SLUG\\}\\}/g, repoSlug);\n  fs.writeFileSync(path.join(dstDir, 'config.json'), configContent);\n  console.log(chalk.green('  ✓') + ' .changeset/config.json');\n\n  fs.copyFileSync(path.join(srcDir, 'README.md'), path.join(dstDir, 'README.md'));\n  console.log(chalk.green('  ✓') + ' .changeset/README.md');\n}\n\nasync function writeInitialChangeset(cwd: string, pkgName: string): Promise<void> {\n  const changelogPath = path.join(cwd, 'CHANGELOG.md');\n  if (fs.existsSync(changelogPath)) {\n    console.log(chalk.gray('  · CHANGELOG.md exists — skipping initial changeset'));\n    return;\n  }\n  const initial = path.join(cwd, '.changeset', 'initial-release.md');\n  const body = `---\\n'${pkgName}': patch\\n---\\n\\nInitial release under the new publishing setup.\\n`;\n  fs.writeFileSync(initial, body);\n  console.log(chalk.green('  ✓') + ' .changeset/initial-release.md');\n}\n\nasync function updateGitignore(cwd: string): Promise<void> {\n  const gitignorePath = path.join(cwd, '.gitignore');\n  const entries = [\n    'node_modules/',\n    'lib/',\n    'yarn.lock',\n    '*.log',\n    '.DS_Store',\n    '',\n    '# tsc sourcemap output — always in lib/, never src/.',\n    '# (.d.ts not ignored — hand-written type declarations like colors.d.ts',\n    '#  are legit src files.)',\n    'src/**/*.js.map',\n  ];\n  const existing = fs.existsSync(gitignorePath)\n    ? fs.readFileSync(gitignorePath, 'utf8').split('\\n')\n    : [];\n  const existingSet = new Set(existing.map((l) => l.trim()));\n  const toAdd = entries.filter((e) => e && !existingSet.has(e.trim()));\n  if (toAdd.length === 0) {\n    console.log(chalk.gray('  · .gitignore already has all entries'));\n    return;\n  }\n  const merged = [\n    ...existing.filter((l) => l.trim() !== ''),\n    '',\n    ...entries,\n  ].join('\\n');\n  fs.writeFileSync(gitignorePath, merged + '\\n');\n  console.log(chalk.green('  ✓') + ' .gitignore');\n}\n\nasync function patchPackageJson(\n  pkgJsonPath: string,\n  pkgJson: any,\n  repoSlug: string,\n): Promise<void> {\n  if (applyPackageJsonPatches(pkgJson, repoSlug)) {\n    fs.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n    console.log(chalk.green('  ✓') + ' package.json (publishConfig + changesets devDeps)');\n  } else {\n    console.log(chalk.gray('  · package.json already configured'));\n  }\n}\n\n/** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */\nexport function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean {\n  let modified = false;\n\n  // `repository.url` must be set, and must match the repo the workflow builds in.\n  //\n  // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose\n  // attestation cannot be matched against it:\n  //\n  //   422 Error verifying sigstore provenance bundle: Failed to validate repository\n  //   information: package.json \"repository.url\" is \"\", expected to match <repo>\n  //\n  // The slug is already resolved from `git remote` above, so there is no reason to leave a\n  // package to discover this at its first release.\n  if (repoSlug !== 'OWNER/REPO') {\n    const url = `git+https://github.com/${repoSlug}.git`;\n    const current =\n      typeof pkgJson.repository === 'string'\n        ? pkgJson.repository\n        : pkgJson.repository?.url;\n    if (!current) {\n      pkgJson.repository = {type: 'git', url};\n      modified = true;\n    }\n  }\n\n  if (!pkgJson.publishConfig) {\n    pkgJson.publishConfig = {access: 'public'};\n    modified = true;\n  } else {\n    if (pkgJson.publishConfig.access !== 'public') {\n      pkgJson.publishConfig.access = 'public';\n      modified = true;\n    }\n    // `provenance` is deliberately left alone. It used to be stripped because publishing went\n    // through NPM_AUTH_TOKEN only; the shared workflow now publishes with OIDC trusted publishing\n    // first (`npm publish --provenance`, id-token: write on both caller and reusable workflow) and\n    // falls back to the staged token release, so provenance is wanted, not a conflict.\n  }\n\n  pkgJson.devDependencies = pkgJson.devDependencies || {};\n  if (!pkgJson.devDependencies['@changesets/cli']) {\n    pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';\n    modified = true;\n  }\n  if (!pkgJson.devDependencies['@changesets/changelog-github']) {\n    pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';\n    modified = true;\n  }\n\n  return modified;\n}\n\nasync function ensureLockfile(cwd: string): Promise<void> {\n  // Always regenerate — package.json has just been patched (new devDeps etc.),\n  // so any existing lockfile is stale.\n  console.log(chalk.magenta('  Running npm install --package-lock-only...'));\n\n  // When running inside a yarn workspace (e.g. CN's packages/* layout), npm\n  // climbs up, detects the parent workspace, and writes the lockfile at the\n  // wrong level. Work around by copying the package to a tmpdir, generating\n  // the lockfile in isolation, and copying it back.\n  const os = await import('os');\n  const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));\n  const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));\n  try {\n    const pkgJsonPath = path.join(cwd, 'package.json');\n    fs.copyFileSync(pkgJsonPath, path.join(tmpBase, 'package.json'));\n    await execp(\n      `npm install --legacy-peer-deps --package-lock-only --cache ${cacheDir}`,\n      false,\n      true,\n      {cwd: tmpBase},\n    );\n    const lockPath = path.join(tmpBase, 'package-lock.json');\n    if (fs.existsSync(lockPath)) {\n      fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));\n      console.log(chalk.green('  ✓') + ' package-lock.json');\n    } else {\n      console.warn(chalk.yellow('  ⚠ npm install did not produce a package-lock.json — likely because a dependency is not yet published on npm.'));\n      console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n    }\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to generate package-lock.json — likely because a dependency is not yet published on npm.'));\n    console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n  } finally {\n    fs.removeSync(tmpBase);\n    fs.removeSync(cacheDir);\n  }\n}\n\nasync function configureGithub(repoSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta('Configuring GitHub (branch protection)...'));\n\n  // Check gh CLI available\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --configure-github,'));\n    console.warn(chalk.yellow('    or set branch protection manually at https://github.com/' + repoSlug + '/settings/branches'));\n    return;\n  }\n\n  // Check gh CLI authenticated\n  try {\n    await execPromise('gh auth status', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI is not authenticated. Run `gh auth login` and retry.'));\n    return;\n  }\n\n  const payload = JSON.stringify(buildBranchProtectionPayload());\n\n  try {\n    // Use --input - to pass the JSON payload via stdin\n    await execPromise(\n      `echo '${payload.replace(/'/g, \"'\\\\''\")}' | gh api -X PUT /repos/${repoSlug}/branches/main/protection --input -`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` branch protection enabled on ${repoSlug}/main`);\n    // A repo can pin a required check in a *ruleset* as well as in classic branch protection, and\n    // the two are stored separately — this call only writes the classic one, so a leftover ruleset\n    // keeps blocking merges on a check name that no longer reports.\n    console.log(\n      chalk.gray(`  · check for a competing ruleset: gh api /repos/${repoSlug}/rulesets`),\n    );\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to set branch protection. Do it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings/branches`));\n  }\n\n  // Enable \"Allow auto-merge\" so a PR can be queued to merge itself once checks pass. The publish\n  // workflow authors the Release PR via the org App token (org secrets RELEASE_APP_ID /\n  // RELEASE_APP_PRIVATE_KEY) so its CI runs without a manual approval gate.\n  try {\n    await execPromise(\n      `gh api -X PATCH /repos/${repoSlug} -F allow_auto_merge=true`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` auto-merge enabled on ${repoSlug}`);\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to enable auto-merge. Enable it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings (General → Allow auto-merge)`));\n  }\n}\n\nasync function grantTeamAccess(repoSlug: string, teamSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta(`Granting '${teamSlug}' team push access to ${repoSlug}...`));\n\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow(\"  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --grant-team,\"));\n    console.warn(chalk.yellow(`    or add the team manually at https://github.com/${repoSlug}/settings/access`));\n    return;\n  }\n\n  const [owner, repo] = repoSlug.split('/');\n  try {\n    await execPromise(\n      `gh api -X PUT /orgs/${owner}/teams/${teamSlug}/repos/${owner}/${repo} -f permission=push`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` team '${teamSlug}' granted push access on ${repoSlug}`);\n  } catch (err: any) {\n    const msg = err?.stderr || err?.stdout || String(err);\n    console.warn(chalk.yellow(`  ⚠ Failed to grant team access: ${msg.slice(0, 200)}`));\n    console.warn(chalk.yellow(`    Team may not exist in org '${owner}', or you may lack admin rights.`));\n    console.warn(chalk.yellow(`    Manual: https://github.com/${repoSlug}/settings/access`));\n  }\n}\n\nfunction printNextSteps(\n  repoSlug: string,\n  npmSecretName: string,\n  configuredGithub: boolean | undefined,\n  grantedTeam: string | undefined,\n): void {\n  console.log('');\n  console.log(chalk.green('Done.'));\n  console.log('');\n  console.log(chalk.bold('Next steps:'));\n  console.log('');\n  const [owner, repo] = repoSlug.split('/');\n\n  console.log(`  1. Review the generated files, adjust as needed.`);\n  console.log(`  2. Commit:`);\n  console.log(chalk.cyan('       git add . && git commit -m \"set up the publish pipeline\"'));\n  console.log(`  3. Push to main — the publish workflow will trigger.`);\n  console.log('');\n  console.log(chalk.bold('Register the trusted publisher on npmjs.com (before the first release):'));\n  console.log('');\n  console.log(`  package → Settings → Trusted Publisher, matching the caller workflow exactly:`);\n  console.log(`    organization: ${chalk.cyan(owner)}   repository: ${chalk.cyan(repo)}`);\n  console.log(`    workflow filename: ${chalk.cyan('publish.yml')}   environment: ${chalk.cyan('(empty)')}`);\n  console.log(`    \"Allow npm publish\": ${chalk.cyan('ticked')}`);\n  console.log('');\n  console.log(chalk.gray(`  Without it the release still ships — the workflow falls back to a staged`));\n  console.log(chalk.gray(`  npm release that a maintainer approves with 2FA. A typo in the organization`));\n  console.log(chalk.gray(`  field looks exactly the same, so check that field first if a package that`));\n  console.log(chalk.gray(`  should publish directly keeps staging instead.`));\n  console.log('');\n  // No per-repo secret grant step: NPM_AUTH_TOKEN, RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are\n  // \"All repositories\" org secrets, which is the whole reason first-party and community packages\n  // live in separate orgs. Only mention what is genuinely still one-time-per-org.\n  console.log(chalk.bold(`One-time org-level setup (already done on linked-fw and linked-cm):`));\n  console.log('');\n  console.log(`  a. Org secrets ${chalk.cyan(npmSecretName)}, ${chalk.cyan('RELEASE_APP_ID')} and ${chalk.cyan('RELEASE_APP_PRIVATE_KEY')},`);\n  console.log(`     visible to ${chalk.cyan('All repositories')} — there is no per-repo grant step.`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/secrets/actions`);\n  console.log('');\n  console.log(`  b. Enable \"Allow GitHub Actions to create and approve pull requests\":`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/actions`);\n\n  if (!configuredGithub) {\n    console.log('');\n    console.log(chalk.bold('Branch protection:'));\n    console.log(`  Rerun with ${chalk.cyan('linked setup-publish --configure-github')} to configure automatically,`);\n    console.log(`  or set manually at https://github.com/${repoSlug}/settings/branches —`);\n    console.log(`  the required check is ${chalk.cyan('checks / Build & Test')}, not ${chalk.cyan('Build & Test')}.`);\n  }\n  console.log('');\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_linked/cli",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "packageManager": "npm@11.21.0",
   "description": "Command line tools for the @_linked/* packages and apps",
   "main": "lib/esm/index.js",
@@ -87,17 +87,12 @@
     "env-cmd": "^10.1.0",
     "es-module-lexer": "^1.7.0",
     "esbuild": "^0.28.0",
-    "express": "^4.19.2",
     "find-nearest-package-json": "^2.0.1",
     "fs-extra": "^11.2.0",
     "glob": "^10.3.12",
     "minimatch": "^9.0.4",
-    "open": "^8.4.0",
     "ora": "^8.0.1",
     "postcss": "^8.5.3",
-    "postcss-import": "^16.1.0",
-    "postcss-nested": "^7.0.2",
-    "postcss-preset-env": "^10.1.5",
     "postcss-url": "^10.1.3",
     "require-extensions": "^0.0.4",
     "rimraf": "^5.0.7",