npm - @_linked/cli - Versions diffs - 1.42.0 → 1.43.0 - Mend

@_linked/cli 1.42.0 → 1.43.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/CHANGELOG.md +12 -0
package/lib/esm/commands/setup-publish.d.ts +26 -1
package/lib/esm/commands/setup-publish.d.ts.map +1 -1
package/lib/esm/commands/setup-publish.js +107 -9
package/lib/esm/commands/setup-publish.js.map +1 -1
package/package.json +1 -1

package/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,17 @@
 # Changelog
+## 1.43.0
+### Minor Changes
+- [#224](https://github.com/linked-fw/cli/pull/224) [`51d38d1`](https://github.com/linked-fw/cli/commit/51d38d1392afd212e6c5b656d343a8f581cc42bf) Thanks [@flyon](https://github.com/flyon)! - `linked setup-publish` now also sets up what every linked-cm package needed by hand:
+  - an `.npmrc` with `allow-remote=all` (npm 12 otherwise fails `npm install` with EALLOWREMOTE on bundled tarballs), plus `legacy-peer-deps=true` in linked-cm, whose CI installs that way. Keys the repo already sets are kept.
+  - a `renovate.json` stub extending `<org>/renovate-config`, unless the repo already has a Renovate config.
+  - `@changesets/cli` ^3 and `@changesets/changelog-github` ^1, the versions the fleet runs.
+  The lockfile step now keeps the existing lockfile's resolutions and resolves under the repo's `.npmrc`, instead of re-resolving from scratch with `--legacy-peer-deps` everywhere.
 ## 1.42.0
 ### Minor Changes

package/lib/esm/commands/setup-publish.d.ts CHANGED Viewed

@@ -56,7 +56,10 @@ export type SetupPublishOptions = {
  * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts
  * - package.json: @changesets/cli + @changesets/changelog-github devDeps,
  *   publishConfig: {access: public}
- * - package-lock.json generated via npm install --package-lock-only
+ * - .npmrc: allow-remote=all, plus legacy-peer-deps=true in linked-cm (see npmrcSettings);
+ *   keys the repo already sets are left alone
+ * - renovate.json extending <org>/renovate-config, unless the repo has a Renovate config
+ * - package-lock.json refreshed via npm install --package-lock-only, keeping existing resolutions
  *
  * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform
  * branch-protection profile on main and enables auto-merge.
@@ -75,6 +78,28 @@ export type WorkflowVars = {
     requireTests: boolean;
 };
 export declare function renderWorkflow(template: string, vars: WorkflowVars): string;
+/**
+ * The `.npmrc` settings a package repo needs so that a local `npm install` resolves the same tree
+ * as its org's shared workflows and Renovate.
+ *
+ * - `allow-remote=all`: npm 12 defaults `allow-remote` to `none` and then refuses the registry
+ *   tarball of a bundled dependency (`@tailwindcss/oxide-wasm32-wasi` is in most of the fleet),
+ *   failing `npm install` with EALLOWREMOTE. npm 11, which CI runs, accepts the setting.
+ * - `legacy-peer-deps=true`, linked-cm only: its workflows install with
+ *   `npm ci --legacy-peer-deps`. linked-fw's install strictly, and its Renovate policy requires
+ *   locks to be resolved under CI's peer rules — so writing it there would be the mismatch.
+ */
+export declare function npmrcSettings(workflowOrg: string): string[];
+/**
+ * Appends each setting whose key the existing `.npmrc` does not set. A key that is already set
+ * keeps its value: the repo may have a reason, and silently flipping it would change installs.
+ */
+export declare function mergeNpmrc(existing: string, settings: string[]): string;
+/**
+ * The three-line stub every package repo carries: the policy itself lives in the org's
+ * `renovate-config` repo, so one edit there reaches the whole fleet.
+ */
+export declare function renovateStub(workflowOrg: string): string;
 /** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */
 export declare function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean;
 //# sourceMappingURL=setup-publish.d.ts.map

package/lib/esm/commands/setup-publish.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,oCAAqC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,4BAA4B;;;;;;;;;;;;;;EAkB3C;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF~~;;;;;;;;;;;;;;;;;;;;GAoBG~~;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,~~CAyFhF~~;AAwBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAC,GAAG,OAAO,CAGnF;AAED,MAAM,MAAM,YAAY,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAC,CAAC;AAExE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAI3E;~~AAiGD~~,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkD/E"}
1	+ {"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,oCAAqC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,4BAA4B;;;;;;;;;;;;;;EAkB3C;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+FhF;AAwBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAC,GAAG,OAAO,CAGnF;AAED,MAAM,MAAM,YAAY,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAC,CAAC;AAExE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAI3E;AAoFD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAI3D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAavE;AA4BD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWxD;AA6BD,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkD/E"}

package/lib/esm/commands/setup-publish.js CHANGED Viewed

@@ -65,7 +65,10 @@ export function buildBranchProtectionPayload() {
  * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts
  * - package.json: @changesets/cli + @changesets/changelog-github devDeps,
  *   publishConfig: {access: public}
- * - package-lock.json generated via npm install --package-lock-only
+ * - .npmrc: allow-remote=all, plus legacy-peer-deps=true in linked-cm (see npmrcSettings);
+ *   keys the repo already sets are left alone
+ * - renovate.json extending <org>/renovate-config, unless the repo has a Renovate config
+ * - package-lock.json refreshed via npm install --package-lock-only, keeping existing resolutions
  *
  * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform
  * branch-protection profile on main and enables auto-merge.
@@ -119,13 +122,17 @@ export function setupPublish() {
         yield updateGitignore(cwd);
         // 5. package.json patches
         yield patchPackageJson(pkgJsonPath, pkgJson, repoSlug);
-        // 6. npm install --package-lock-only to generate lockfile (if not present)
+        // 6. .npmrc — before the lockfile step, which must resolve under the same settings as CI
+        yield updateNpmrc(cwd, workflowOrg);
+        // 7. renovate.json stub extending the org's shared policy
+        yield writeRenovateConfig(cwd, workflowOrg);
+        // 8. npm install --package-lock-only to generate lockfile (if not present)
         yield ensureLockfile(cwd);
-        // 7. Optional: configure GitHub branch protection
+        // 9. Optional: configure GitHub branch protection
         if (opts.configureGithub) {
             yield configureGithub(repoSlug);
         }
-        // 8. Optional: grant a GitHub team push access
+        // 10. Optional: grant a GitHub team push access
         if (opts.grantTeam) {
             yield grantTeamAccess(repoSlug, opts.grantTeam);
         }
@@ -258,6 +265,91 @@ function updateGitignore(cwd) {
         console.log(chalk.green('  ✓') + ' .gitignore');
     });
 }
+/**
+ * The `.npmrc` settings a package repo needs so that a local `npm install` resolves the same tree
+ * as its org's shared workflows and Renovate.
+ *
+ * - `allow-remote=all`: npm 12 defaults `allow-remote` to `none` and then refuses the registry
+ *   tarball of a bundled dependency (`@tailwindcss/oxide-wasm32-wasi` is in most of the fleet),
+ *   failing `npm install` with EALLOWREMOTE. npm 11, which CI runs, accepts the setting.
+ * - `legacy-peer-deps=true`, linked-cm only: its workflows install with
+ *   `npm ci --legacy-peer-deps`. linked-fw's install strictly, and its Renovate policy requires
+ *   locks to be resolved under CI's peer rules — so writing it there would be the mismatch.
+ */
+export function npmrcSettings(workflowOrg) {
+    const settings = ['allow-remote=all'];
+    if (workflowOrg === 'linked-cm')
+        settings.push('legacy-peer-deps=true');
+    return settings;
+}
+/**
+ * Appends each setting whose key the existing `.npmrc` does not set. A key that is already set
+ * keeps its value: the repo may have a reason, and silently flipping it would change installs.
+ */
+export function mergeNpmrc(existing, settings) {
+    const keyOf = (line) => line.split('=')[0].trim();
+    const present = new Set(existing
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith('#') && !line.startsWith(';'))
+        .map(keyOf));
+    const missing = settings.filter((setting) => !present.has(keyOf(setting)));
+    if (missing.length === 0)
+        return existing;
+    const base = existing === '' || existing.endsWith('\n') ? existing : existing + '\n';
+    return base + missing.join('\n') + '\n';
+}
+function updateNpmrc(cwd, workflowOrg) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const npmrcPath = path.join(cwd, '.npmrc');
+        const existing = fs.existsSync(npmrcPath) ? fs.readFileSync(npmrcPath, 'utf8') : '';
+        const next = mergeNpmrc(existing, npmrcSettings(workflowOrg));
+        if (next === existing) {
+            console.log(chalk.gray('  · .npmrc already has the required settings'));
+            return;
+        }
+        fs.writeFileSync(npmrcPath, next);
+        console.log(chalk.green('  ✓') + ' .npmrc');
+    });
+}
+// Every location Renovate reads a repo config from. If any exists, the repo has a config of its
+// own and setup-publish leaves it alone.
+const RENOVATE_CONFIG_FILES = [
+    'renovate.json',
+    'renovate.json5',
+    '.github/renovate.json',
+    '.github/renovate.json5',
+    '.gitlab/renovate.json',
+    '.gitlab/renovate.json5',
+    '.renovaterc',
+    '.renovaterc.json',
+    '.renovaterc.json5',
+];
+/**
+ * The three-line stub every package repo carries: the policy itself lives in the org's
+ * `renovate-config` repo, so one edit there reaches the whole fleet.
+ */
+export function renovateStub(workflowOrg) {
+    return (JSON.stringify({
+        $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+        extends: [`local>${workflowOrg}/renovate-config`],
+    }, null, 2) + '\n');
+}
+function writeRenovateConfig(cwd, workflowOrg) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (workflowOrg === 'OWNER') {
+            console.warn(chalk.yellow('  ⚠ Skipped renovate.json: the repo org is unknown.'));
+            return;
+        }
+        const existing = RENOVATE_CONFIG_FILES.find((file) => fs.existsSync(path.join(cwd, file)));
+        if (existing) {
+            console.log(chalk.gray(`  · ${existing} exists — left as is`));
+            return;
+        }
+        fs.writeFileSync(path.join(cwd, 'renovate.json'), renovateStub(workflowOrg));
+        console.log(chalk.green('  ✓') + ` renovate.json (extends ${workflowOrg}/renovate-config)`);
+    });
+}
 function patchPackageJson(pkgJsonPath, pkgJson, repoSlug) {
     return __awaiter(this, void 0, void 0, function* () {
         if (applyPackageJsonPatches(pkgJson, repoSlug)) {
@@ -309,11 +401,11 @@ export function applyPackageJsonPatches(pkgJson, repoSlug) {
     }
     pkgJson.devDependencies = pkgJson.devDependencies || {};
     if (!pkgJson.devDependencies['@changesets/cli']) {
-        pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';
+        pkgJson.devDependencies['@changesets/cli'] = '^3.0.0';
         modified = true;
     }
     if (!pkgJson.devDependencies['@changesets/changelog-github']) {
-        pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';
+        pkgJson.devDependencies['@changesets/changelog-github'] = '^1.0.0';
         modified = true;
     }
     return modified;
@@ -331,9 +423,15 @@ function ensureLockfile(cwd) {
         const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));
         const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));
         try {
-            const pkgJsonPath = path.join(cwd, 'package.json');
-            fs.copyFileSync(pkgJsonPath, path.join(tmpBase, 'package.json'));
-            yield execp(`npm install --legacy-peer-deps --package-lock-only --cache ${cacheDir}`, false, true, { cwd: tmpBase });
+            // The existing lockfile comes along so its resolutions are kept (only what package.json just
+            // gained is resolved), and .npmrc so the lock is resolved under the repo's own settings —
+            // allow-remote for npm 12, and legacy-peer-deps exactly where the org's CI installs that way.
+            for (const file of ['package.json', 'package-lock.json', '.npmrc']) {
+                const src = path.join(cwd, file);
+                if (fs.existsSync(src))
+                    fs.copyFileSync(src, path.join(tmpBase, file));
+            }
+            yield execp(`npm install --package-lock-only --ignore-scripts --cache ${cacheDir}`, false, true, { cwd: tmpBase });
             const lockPath = path.join(tmpBase, 'package-lock.json');
             if (fs.existsSync(lockPath)) {
                 fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));

package/lib/esm/commands/setup-publish.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"setup-publish.js","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,EAAE,EAAC,OAAO,EAAC,MAAM,MAAM,CAAC;AACnC,OAAO,EAAC,KAAK,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AAE/C,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,WAAW;IAC9B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErD,wEAAwE;AACxE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,0FAA0F;AAC1F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,sBAAsB,EAAE,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAC;QAC5E,4FAA4F;QAC5F,uDAAuD;QACvD,cAAc,EAAE,IAAI;QACpB,8FAA8F;QAC9F,8FAA8F;QAC9F,2FAA2F;QAC3F,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,KAAK;YAC5B,0BAA0B,EAAE,KAAK;SAClC;QACD,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAgB,YAAY;yDAAC,OAA4B,EAAE;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,yFAAyF;QACzF,uFAAuF;QACvF,2FAA2F;QAC3F,+DAA+D;QAC/D,MAAM,aAAa,GAAG,gBAAgB,CAAC;QAEvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,sFAAsF;gBACpF,6DAA6D,CAChE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yGAAyG,CAC1G,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,4FAA4F;QAC5F,qEAAqE;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,4FAA4F;gBAC1F,wFAAwF;gBACxF,iEAAiE,CACpE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,0FAA0F;gBACxF,mFAAmF,CACtF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC,CAAC;QAEtD,gCAAgC;QAChC,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,uBAAuB;QACvB,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,gBAAgB;QAChB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAE3B,0BAA0B;QAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,2EAA2E;QAC3E,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAE1B,kDAAkD;QAClD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,yBAAyB;QACzB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW,EAAE,OAAY;;QACtD,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oCAAoC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvG,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,WAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvE,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3E,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yGAAyG,CAAC,CAAC,CAAC;QACtI,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAA4C;;IACxE,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,CAAC;IACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAID,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAkB;IACjE,OAAO,QAAQ;SACZ,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,WAAW,CAAC;SAClD,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAe,aAAa,CAAC,GAAW,EAAE,IAAkB;;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YACvF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,4FAA4F;QAC5F,mFAAmF;QACnF,0FAA0F;QAC1F,+DAA+D;QAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;CAAA;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,QAAgB;;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAE5D,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC;IAC5D,CAAC;CAAA;AAED,SAAe,qBAAqB,CAAC,GAAW,EAAE,OAAe;;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,OAAO,oEAAoE,CAAC;QAClG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC;IACrE,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW;;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,eAAe;YACf,MAAM;YACN,WAAW;YACX,OAAO;YACP,WAAW;YACX,EAAE;YACF,sDAAsD;YACtD,wEAAwE;YACxE,0BAA0B;YAC1B,iBAAiB;SAClB,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1C,EAAE;YACF,GAAG,OAAO;SACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;IAClD,CAAC;CAAA;AAED,SAAe,gBAAgB,CAC7B,WAAmB,EACnB,OAAY,EACZ,QAAgB;;QAEhB,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oDAAoD,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,QAAgB;;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,gFAAgF;IAChF,EAAE;IACF,yFAAyF;IACzF,4CAA4C;IAC5C,EAAE;IACF,kFAAkF;IAClF,+EAA+E;IAC/E,EAAE;IACF,yFAAyF;IACzF,iDAAiD;IACjD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,0BAA0B,QAAQ,MAAM,CAAC;QACrD,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,0CAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,GAAG,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,aAAa,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAC,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;IACrF,CAAC;IAED,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;QACvD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;QACnE,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAe,cAAc,CAAC,GAAW;;QACvC,6EAA6E;QAC7E,qCAAqC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACnD,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YACjE,MAAM,KAAK,CACT,8DAA8D,QAAQ,EAAE,EACxE,KAAK,EACL,IAAI,EACJ,EAAC,GAAG,EAAE,OAAO,EAAC,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gHAAgH,CAAC,CAAC,CAAC;gBAC7I,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qGAAqG,CAAC,CAAC,CAAC;YAClI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB;;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAExE,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iGAAiG,CAAC,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,GAAG,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,WAAW,CACf,SAAS,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,4BAA4B,QAAQ,qCAAqC,EAChH,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,iCAAiC,QAAQ,OAAO,CAAC,CAAC;YACnF,8FAA8F;YAC9F,+FAA+F;YAC/F,gEAAgE;YAChE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,oDAAoD,QAAQ,WAAW,CAAC,CACpF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,oBAAoB,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,gGAAgG;QAChG,sFAAsF;QACtF,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,WAAW,CACf,0BAA0B,QAAQ,2BAA2B,EAC7D,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,wCAAwC,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB,EAAE,QAAgB;;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,QAAQ,yBAAyB,QAAQ,KAAK,CAAC,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2FAA2F,CAAC,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,QAAQ,kBAAkB,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,WAAW,CACf,uBAAuB,KAAK,UAAU,QAAQ,UAAU,KAAK,IAAI,IAAI,qBAAqB,EAC1F,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,QAAQ,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,QAAQ,kBAAkB,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CAAA;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,aAAqB,EACrB,gBAAqC,EACrC,WAA+B;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,gGAAgG;IAChG,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,2BAA2B,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,mBAAmB,CAAC,CAAC;IAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,2CAA2C,QAAQ,sBAAsB,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import chalk from 'chalk';\nimport fs from 'fs-extra';\nimport path, {dirname} from 'path';\nimport {execp, execPromise} from '../utils.js';\n\nconst dirname__ =\n typeof __dirname !== 'undefined'\n ? __dirname\n : //@ts-ignore\n dirname(import.meta.url).replace('file:/', '');\n\n// defaults/setup-publish/ lives at packages/cli/defaults/setup-publish/\n// This file compiles to lib/{esm,cjs}/commands/setup-publish.js — go up three\n// levels to reach the package root, then into defaults/setup-publish.\nconst TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'setup-publish');\n\n// Both are callers of the shared reusable workflows. `publish.yml` in particular cannot be\n// renamed: npm's trusted-publisher check validates the calling workflow's filename, and a\n// mismatch only shows up as releases quietly needing manual approval again.\nexport const WORKFLOW_FILES = ['pr.yml', 'publish.yml'] as const;\n\n/*\n The uniform branch-protection profile every `@_linked` repo runs on `main`.\n \n The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked\n * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is\n * `checks`. A repo pinning the bare name waits forever on a check that never reports.\n /\nexport function buildBranchProtectionPayload() {\n return {\n required_status_checks: {strict: false, contexts: ['checks / Build & Test']},\n // Admins included: the point of the gate is that no release skips the build, and the people\n // most likely to push straight to main are the admins.\n enforce_admins: true,\n // Reviews enabled but zero approvals required. The publish workflow direct-merges the version\n // PR (GitHub's auto-merge queue does not honor review-bypass allowances), so a non-zero count\n // would stall every release; the block itself still has to exist for the profile to match.\n required_pull_request_reviews: {\n required_approving_review_count: 0,\n dismiss_stale_reviews: false,\n require_code_owner_reviews: false,\n },\n restrictions: null,\n allow_force_pushes: false,\n allow_deletions: false,\n };\n}\n\nexport type SetupPublishOptions = {\n configureGithub?: boolean;\n /\n @deprecated The npm secret is `NPM_AUTH_TOKEN` in every org, holding a token for that\n * org's own npm scope — there is no longer a second name to select between. Kept as an\n * accepted no-op for the same reason as `dualBranch`: commander aborts the whole command\n * on an unknown option, so a stale script would fail to set the repo up at all rather\n * than setting it up correctly.\n /\n scope?: string;\n /\n @deprecated The dual-branch (`main` + `dev`) flow and its `@next` prereleases are retired —\n * every package repo is `main`-only. Kept as an accepted no-op rather than removed because\n * commander aborts the whole command on an unknown option, so a stale script or copied\n * command line would fail to set the repo up at all instead of setting it up correctly.\n /\n dualBranch?: boolean;\n grantTeam?: string; // GitHub team slug to grant push access on the repo\n};\n\n/\n Set up the changesets publish pipeline in the current package repo.\n \n The workflows are thin callers of the shared reusable workflows in the repo's OWN org\n * `.github` repo (pinned `@v1`, a deliberately moving tag) — one edit there changes every\n * package's pipeline in that org, which is why nothing about the build or publish steps is\n * scaffolded per repo any more. Each org keeps its own copy so that community gates can be\n * stricter than first-party ones without a cross-org `workflow_call`.\n \n Installs:\n * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else\n * - .changeset/config.json + README.md\n * - .changeset/initial-release.md\n * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts\n * - package.json: @changesets/cli + @changesets/changelog-github devDeps,\n * publishConfig: {access: public}\n * - package-lock.json generated via npm install --package-lock-only\n \n With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform\n * branch-protection profile on main and enables auto-merge.\n /\nexport async function setupPublish(opts: SetupPublishOptions = {}): Promise<void> {\n const cwd = process.cwd();\n // One secret NAME across every org. The orgs are separate, so each holds its own value —\n // a token scoped to that org's npm scope. (There used to be an `NPM_AUTH_TOKEN_CM` for\n // `@linked.cm`; that dates from before first-party and community repos were split into two\n // orgs and one org therefore had to hold both tokens at once.)\n const npmSecretName = 'NPM_AUTH_TOKEN';\n\n console.log(chalk.magenta('Setting up the publish pipeline (main only)...'));\n if (opts.scope) {\n console.log(\n chalk.yellow(\n ' ⚠ --scope is deprecated and ignored: every org uses NPM_AUTH_TOKEN, holding that\\n' +\n \" org's own token. The NPM_AUTH_TOKEN_CM name is retired.\",\n ),\n );\n }\n if (opts.dualBranch) {\n console.log(\n chalk.yellow(\n ' ⚠ --dual-branch is deprecated and ignored: the main + dev flow and its @next prereleases are retired.',\n ),\n );\n }\n console.log(` target: ${cwd}`);\n console.log(` npm secret: ${npmSecretName}`);\n\n const pkgJsonPath = path.join(cwd, 'package.json');\n if (!fs.existsSync(pkgJsonPath)) {\n console.error(chalk.red('No package.json found in current directory. Run from the repo root.'));\n process.exit(1);\n }\n\n const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));\n const repoSlug = await resolveRepoSlug(cwd, pkgJson);\n\n console.log(` repo: ${repoSlug}`);\n console.log('');\n\n // 1. Workflow files. The caller stubs point at the shared workflows in this repo's own org,\n // so a repo in linked-cm never reaches into linked-fw for its CI.\n const workflowOrg = repoSlug.split('/')[0];\n if (workflowOrg === 'OWNER') {\n console.warn(\n chalk.yellow(\n ' ⚠ The repo slug is unknown, so the workflow stubs will call OWNER/.github — which does\\n' +\n ' not exist. Set the git remote (or package.json repository) and rerun, or fix the\\n' +\n ' `uses:` line in .github/workflows/{pr,publish}.yml by hand.',\n ),\n );\n }\n const requireTests = hasTestScript(pkgJson);\n if (!requireTests) {\n console.warn(\n chalk.yellow(\n ' ⚠ package.json has no `test` script, so pr.yml is written with require-tests: false.\\n' +\n ' Set it to true in .github/workflows/pr.yml once the package has a test suite.',\n ),\n );\n }\n await copyWorkflows(cwd, {workflowOrg, requireTests});\n\n // 2. Changesets config + README\n await copyChangesetConfig(cwd, repoSlug);\n\n // 3. Initial changeset\n await writeInitialChangeset(cwd, pkgJson.name);\n\n // 4. .gitignore\n await updateGitignore(cwd);\n\n // 5. package.json patches\n await patchPackageJson(pkgJsonPath, pkgJson, repoSlug);\n\n // 6. npm install --package-lock-only to generate lockfile (if not present)\n await ensureLockfile(cwd);\n\n // 7. Optional: configure GitHub branch protection\n if (opts.configureGithub) {\n await configureGithub(repoSlug);\n }\n\n // 8. Optional: grant a GitHub team push access\n if (opts.grantTeam) {\n await grantTeamAccess(repoSlug, opts.grantTeam);\n }\n\n // Summary + manual steps\n printNextSteps(repoSlug, npmSecretName, opts.configureGithub, opts.grantTeam);\n}\n\nasync function resolveRepoSlug(cwd: string, pkgJson: any): Promise<string> {\n // Try git remote first\n try {\n const remoteUrl = await execPromise('git config --get remote.origin.url', false, false, {cwd});\n const m = typeof remoteUrl === 'string' ? remoteUrl.match(/[:/]([^/:]+\\/[^/]+?)(?:\\.git)?\\s$/) : null;\n if (m) return m[1];\n } catch {\n // fall through\n }\n // Fallback: parse package.json repository\n const repoField = pkgJson.repository;\n if (typeof repoField === 'string') {\n const m = repoField.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n if (m) return m[1];\n } else if (repoField?.url) {\n const m = repoField.url.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n if (m) return m[1];\n }\n console.warn(chalk.yellow('Could not determine repo slug. Using placeholder \"OWNER/REPO\" — update .changeset/config.json manually.'));\n return 'OWNER/REPO';\n}\n\n/*\n Whether the package has a `test` script for the PR check to run. `require-tests: true` turns a\n * missing script into a failure, so it is only safe to write once one exists — and a fresh\n * `create-package` scaffold has none.\n /\nexport function hasTestScript(pkgJson: {scripts?: Record<string, unknown>}): boolean {\n const test = pkgJson.scripts?.test;\n return typeof test === 'string' && test.trim() !== '';\n}\n\nexport type WorkflowVars = {workflowOrg: string; requireTests: boolean};\n\nexport function renderWorkflow(template: string, vars: WorkflowVars): string {\n return template\n .replace(/\\{\\{WORKFLOW_ORG\\}\\}/g, vars.workflowOrg)\n .replace(/\\{\\{REQUIRE_TESTS\\}\\}/g, String(vars.requireTests));\n}\n\nasync function copyWorkflows(cwd: string, vars: WorkflowVars): Promise<void> {\n const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');\n const dstDir = path.join(cwd, '.github', 'workflows');\n fs.mkdirpSync(dstDir);\n\n for (const file of WORKFLOW_FILES) {\n const content = renderWorkflow(fs.readFileSync(path.join(srcDir, file), 'utf8'), vars);\n fs.writeFileSync(path.join(dstDir, file), content);\n console.log(chalk.green(' ✓') + ` .github/workflows/${file}`);\n }\n\n // ci.yml and changeset-check.yml became the two jobs of the shared pr.yml. Left behind on a\n // repo that was set up before the consolidation they keep running, so the old bare\n // `Build & Test` check reports alongside `checks / Build & Test` and re-setting a repo up\n // looks like it worked while the duplicate gate quietly stays.\n for (const stale of ['ci.yml', 'changeset-check.yml']) {\n const stalePath = path.join(dstDir, stale);\n if (fs.existsSync(stalePath)) {\n fs.removeSync(stalePath);\n console.log(chalk.green(' ✓') + ` removed superseded .github/workflows/${stale}`);\n }\n }\n}\n\nasync function copyChangesetConfig(cwd: string, repoSlug: string): Promise<void> {\n const srcDir = path.join(TEMPLATE_ROOT, 'changeset');\n const dstDir = path.join(cwd, '.changeset');\n fs.mkdirpSync(dstDir);\n\n let configContent = fs.readFileSync(path.join(srcDir, 'config.json'), 'utf8');\n configContent = configContent.replace(/\\{\\{REPO_SLUG\\}\\}/g, repoSlug);\n fs.writeFileSync(path.join(dstDir, 'config.json'), configContent);\n console.log(chalk.green(' ✓') + ' .changeset/config.json');\n\n fs.copyFileSync(path.join(srcDir, 'README.md'), path.join(dstDir, 'README.md'));\n console.log(chalk.green(' ✓') + ' .changeset/README.md');\n}\n\nasync function writeInitialChangeset(cwd: string, pkgName: string): Promise<void> {\n const changelogPath = path.join(cwd, 'CHANGELOG.md');\n if (fs.existsSync(changelogPath)) {\n console.log(chalk.gray(' · CHANGELOG.md exists — skipping initial changeset'));\n return;\n }\n const initial = path.join(cwd, '.changeset', 'initial-release.md');\n const body = `---\\n'${pkgName}': patch\\n---\\n\\nInitial release under the new publishing setup.\\n`;\n fs.writeFileSync(initial, body);\n console.log(chalk.green(' ✓') + ' .changeset/initial-release.md');\n}\n\nasync function updateGitignore(cwd: string): Promise<void> {\n const gitignorePath = path.join(cwd, '.gitignore');\n const entries = [\n 'node_modules/',\n 'lib/',\n 'yarn.lock',\n '.log',\n '.DS_Store',\n '',\n '# tsc sourcemap output — always in lib/, never src/.',\n '# (.d.ts not ignored — hand-written type declarations like colors.d.ts',\n '# are legit src files.)',\n 'src/*/.js.map',\n ];\n const existing = fs.existsSync(gitignorePath)\n ? fs.readFileSync(gitignorePath, 'utf8').split('\\n')\n : [];\n const existingSet = new Set(existing.map((l) => l.trim()));\n const toAdd = entries.filter((e) => e && !existingSet.has(e.trim()));\n if (toAdd.length === 0) {\n console.log(chalk.gray(' · .gitignore already has all entries'));\n return;\n }\n const merged = [\n ...existing.filter((l) => l.trim() !== ''),\n '',\n ...entries,\n ].join('\\n');\n fs.writeFileSync(gitignorePath, merged + '\\n');\n console.log(chalk.green(' ✓') + ' .gitignore');\n}\n\nasync function patchPackageJson(\n pkgJsonPath: string,\n pkgJson: any,\n repoSlug: string,\n): Promise<void> {\n if (applyPackageJsonPatches(pkgJson, repoSlug)) {\n fs.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n console.log(chalk.green(' ✓') + ' package.json (publishConfig + changesets devDeps)');\n } else {\n console.log(chalk.gray(' · package.json already configured'));\n }\n}\n\n/** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. /\nexport function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean {\n let modified = false;\n\n // `repository.url` must be set, and must match the repo the workflow builds in.\n //\n // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose\n // attestation cannot be matched against it:\n //\n // 422 Error verifying sigstore provenance bundle: Failed to validate repository\n // information: package.json \"repository.url\" is \"\", expected to match <repo>\n //\n // The slug is already resolved from `git remote` above, so there is no reason to leave a\n // package to discover this at its first release.\n if (repoSlug !== 'OWNER/REPO') {\n const url = `git+https://github.com/${repoSlug}.git`;\n const current =\n typeof pkgJson.repository === 'string'\n ? pkgJson.repository\n : pkgJson.repository?.url;\n if (!current) {\n pkgJson.repository = {type: 'git', url};\n modified = true;\n }\n }\n\n if (!pkgJson.publishConfig) {\n pkgJson.publishConfig = {access: 'public'};\n modified = true;\n } else {\n if (pkgJson.publishConfig.access !== 'public') {\n pkgJson.publishConfig.access = 'public';\n modified = true;\n }\n // `provenance` is deliberately left alone. It used to be stripped because publishing went\n // through NPM_AUTH_TOKEN only; the shared workflow now publishes with OIDC trusted publishing\n // first (`npm publish --provenance`, id-token: write on both caller and reusable workflow) and\n // falls back to the staged token release, so provenance is wanted, not a conflict.\n }\n\n pkgJson.devDependencies = pkgJson.devDependencies \|\| {};\n if (!pkgJson.devDependencies['@changesets/cli']) {\n pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';\n modified = true;\n }\n if (!pkgJson.devDependencies['@changesets/changelog-github']) {\n pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';\n modified = true;\n }\n\n return modified;\n}\n\nasync function ensureLockfile(cwd: string): Promise<void> {\n // Always regenerate — package.json has just been patched (new devDeps etc.),\n // so any existing lockfile is stale.\n console.log(chalk.magenta(' Running npm install --package-lock-only...'));\n\n // When running inside a yarn workspace (e.g. CN's packages/ layout), npm\n // climbs up, detects the parent workspace, and writes the lockfile at the\n // wrong level. Work around by copying the package to a tmpdir, generating\n // the lockfile in isolation, and copying it back.\n const os = await import('os');\n const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));\n const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));\n try {\n const pkgJsonPath = path.join(cwd, 'package.json');\n fs.copyFileSync(pkgJsonPath, path.join(tmpBase, 'package.json'));\n await execp(\n `npm install --legacy-peer-deps --package-lock-only --cache ${cacheDir}`,\n false,\n true,\n {cwd: tmpBase},\n );\n const lockPath = path.join(tmpBase, 'package-lock.json');\n if (fs.existsSync(lockPath)) {\n fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));\n console.log(chalk.green(' ✓') + ' package-lock.json');\n } else {\n console.warn(chalk.yellow(' ⚠ npm install did not produce a package-lock.json — likely because a dependency is not yet published on npm.'));\n console.warn(chalk.yellow(' Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n }\n } catch (err) {\n console.warn(chalk.yellow(' ⚠ Failed to generate package-lock.json — likely because a dependency is not yet published on npm.'));\n console.warn(chalk.yellow(' Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n } finally {\n fs.removeSync(tmpBase);\n fs.removeSync(cacheDir);\n }\n}\n\nasync function configureGithub(repoSlug: string): Promise<void> {\n console.log('');\n console.log(chalk.magenta('Configuring GitHub (branch protection)...'));\n\n // Check gh CLI available\n try {\n await execPromise('gh --version', false, false);\n } catch {\n console.warn(chalk.yellow(' ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --configure-github,'));\n console.warn(chalk.yellow(' or set branch protection manually at https://github.com/' + repoSlug + '/settings/branches'));\n return;\n }\n\n // Check gh CLI authenticated\n try {\n await execPromise('gh auth status', false, false);\n } catch {\n console.warn(chalk.yellow(' ⚠ `gh` CLI is not authenticated. Run `gh auth login` and retry.'));\n return;\n }\n\n const payload = JSON.stringify(buildBranchProtectionPayload());\n\n try {\n // Use --input - to pass the JSON payload via stdin\n await execPromise(\n `echo '${payload.replace(/'/g, \"'\\\\''\")}' \| gh api -X PUT /repos/${repoSlug}/branches/main/protection --input -`,\n false,\n false,\n );\n console.log(chalk.green(' ✓') + ` branch protection enabled on ${repoSlug}/main`);\n // A repo can pin a required check in a ruleset as well as in classic branch protection, and\n // the two are stored separately — this call only writes the classic one, so a leftover ruleset\n // keeps blocking merges on a check name that no longer reports.\n console.log(\n chalk.gray(` · check for a competing ruleset: gh api /repos/${repoSlug}/rulesets`),\n );\n } catch (err) {\n console.warn(chalk.yellow(' ⚠ Failed to set branch protection. Do it manually:'));\n console.warn(chalk.yellow(` https://github.com/${repoSlug}/settings/branches`));\n }\n\n // Enable \"Allow auto-merge\" so a PR can be queued to merge itself once checks pass. The publish\n // workflow authors the Release PR via the org App token (org secrets RELEASE_APP_ID /\n // RELEASE_APP_PRIVATE_KEY) so its CI runs without a manual approval gate.\n try {\n await execPromise(\n `gh api -X PATCH /repos/${repoSlug} -F allow_auto_merge=true`,\n false,\n false,\n );\n console.log(chalk.green(' ✓') + ` auto-merge enabled on ${repoSlug}`);\n } catch (err) {\n console.warn(chalk.yellow(' ⚠ Failed to enable auto-merge. Enable it manually:'));\n console.warn(chalk.yellow(` https://github.com/${repoSlug}/settings (General → Allow auto-merge)`));\n }\n}\n\nasync function grantTeamAccess(repoSlug: string, teamSlug: string): Promise<void> {\n console.log('');\n console.log(chalk.magenta(`Granting '${teamSlug}' team push access to ${repoSlug}...`));\n\n try {\n await execPromise('gh --version', false, false);\n } catch {\n console.warn(chalk.yellow(\" ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --grant-team,\"));\n console.warn(chalk.yellow(` or add the team manually at https://github.com/${repoSlug}/settings/access`));\n return;\n }\n\n const [owner, repo] = repoSlug.split('/');\n try {\n await execPromise(\n `gh api -X PUT /orgs/${owner}/teams/${teamSlug}/repos/${owner}/${repo} -f permission=push`,\n false,\n false,\n );\n console.log(chalk.green(' ✓') + ` team '${teamSlug}' granted push access on ${repoSlug}`);\n } catch (err: any) {\n const msg = err?.stderr \|\| err?.stdout \|\| String(err);\n console.warn(chalk.yellow(` ⚠ Failed to grant team access: ${msg.slice(0, 200)}`));\n console.warn(chalk.yellow(` Team may not exist in org '${owner}', or you may lack admin rights.`));\n console.warn(chalk.yellow(` Manual: https://github.com/${repoSlug}/settings/access`));\n }\n}\n\nfunction printNextSteps(\n repoSlug: string,\n npmSecretName: string,\n configuredGithub: boolean \| undefined,\n grantedTeam: string \| undefined,\n): void {\n console.log('');\n console.log(chalk.green('Done.'));\n console.log('');\n console.log(chalk.bold('Next steps:'));\n console.log('');\n const [owner, repo] = repoSlug.split('/');\n\n console.log(` 1. Review the generated files, adjust as needed.`);\n console.log(` 2. Commit:`);\n console.log(chalk.cyan(' git add . && git commit -m \"set up the publish pipeline\"'));\n console.log(` 3. Push to main — the publish workflow will trigger.`);\n console.log('');\n console.log(chalk.bold('Register the trusted publisher on npmjs.com (before the first release):'));\n console.log('');\n console.log(` package → Settings → Trusted Publisher, matching the caller workflow exactly:`);\n console.log(` organization: ${chalk.cyan(owner)} repository: ${chalk.cyan(repo)}`);\n console.log(` workflow filename: ${chalk.cyan('publish.yml')} environment: ${chalk.cyan('(empty)')}`);\n console.log(` \"Allow npm publish\": ${chalk.cyan('ticked')}`);\n console.log('');\n console.log(chalk.gray(` Without it the release still ships — the workflow falls back to a staged`));\n console.log(chalk.gray(` npm release that a maintainer approves with 2FA. A typo in the organization`));\n console.log(chalk.gray(` field looks exactly the same, so check that field first if a package that`));\n console.log(chalk.gray(` should publish directly keeps staging instead.`));\n console.log('');\n // No per-repo secret grant step: NPM_AUTH_TOKEN, RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are\n // \"All repositories\" org secrets, which is the whole reason first-party and community packages\n // live in separate orgs. Only mention what is genuinely still one-time-per-org.\n console.log(chalk.bold(`One-time org-level setup (already done on linked-fw and linked-cm):`));\n console.log('');\n console.log(` a. Org secrets ${chalk.cyan(npmSecretName)}, ${chalk.cyan('RELEASE_APP_ID')} and ${chalk.cyan('RELEASE_APP_PRIVATE_KEY')},`);\n console.log(` visible to ${chalk.cyan('All repositories')} — there is no per-repo grant step.`);\n console.log(` → https://github.com/organizations/${owner}/settings/secrets/actions`);\n console.log('');\n console.log(` b. Enable \"Allow GitHub Actions to create and approve pull requests\":`);\n console.log(` → https://github.com/organizations/${owner}/settings/actions`);\n\n if (!configuredGithub) {\n console.log('');\n console.log(chalk.bold('Branch protection:'));\n console.log(` Rerun with ${chalk.cyan('linked setup-publish --configure-github')} to configure automatically,`);\n console.log(` or set manually at https://github.com/${repoSlug}/settings/branches —`);\n console.log(` the required check is ${chalk.cyan('checks / Build & Test')}, not ${chalk.cyan('Build & Test')}.`);\n }\n console.log('');\n}\n"]}
1	+ {"version":3,"file":"setup-publish.js","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,EAAE,EAAC,OAAO,EAAC,MAAM,MAAM,CAAC;AACnC,OAAO,EAAC,KAAK,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AAE/C,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,WAAW;IAC9B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErD,wEAAwE;AACxE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,0FAA0F;AAC1F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,sBAAsB,EAAE,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAC;QAC5E,4FAA4F;QAC5F,uDAAuD;QACvD,cAAc,EAAE,IAAI;QACpB,8FAA8F;QAC9F,8FAA8F;QAC9F,2FAA2F;QAC3F,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,KAAK;YAC5B,0BAA0B,EAAE,KAAK;SAClC;QACD,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAgB,YAAY;yDAAC,OAA4B,EAAE;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,yFAAyF;QACzF,uFAAuF;QACvF,2FAA2F;QAC3F,+DAA+D;QAC/D,MAAM,aAAa,GAAG,gBAAgB,CAAC;QAEvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,sFAAsF;gBACpF,6DAA6D,CAChE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yGAAyG,CAC1G,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,4FAA4F;QAC5F,qEAAqE;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,4FAA4F;gBAC1F,wFAAwF;gBACxF,iEAAiE,CACpE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,0FAA0F;gBACxF,mFAAmF,CACtF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC,CAAC;QAEtD,gCAAgC;QAChC,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,uBAAuB;QACvB,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,gBAAgB;QAChB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAE3B,0BAA0B;QAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,yFAAyF;QACzF,MAAM,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAEpC,0DAA0D;QAC1D,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAE5C,2EAA2E;QAC3E,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAE1B,kDAAkD;QAClD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,yBAAyB;QACzB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW,EAAE,OAAY;;QACtD,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oCAAoC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvG,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,WAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvE,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3E,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yGAAyG,CAAC,CAAC,CAAC;QACtI,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAA4C;;IACxE,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,CAAC;IACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAID,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAkB;IACjE,OAAO,QAAQ;SACZ,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,WAAW,CAAC;SAClD,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAe,aAAa,CAAC,GAAW,EAAE,IAAkB;;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YACvF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,4FAA4F;QAC5F,mFAAmF;QACnF,0FAA0F;QAC1F,+DAA+D;QAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;CAAA;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,QAAgB;;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAE5D,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC;IAC5D,CAAC;CAAA;AAED,SAAe,qBAAqB,CAAC,GAAW,EAAE,OAAe;;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,OAAO,oEAAoE,CAAC;QAClG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC;IACrE,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW;;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,eAAe;YACf,MAAM;YACN,WAAW;YACX,OAAO;YACP,WAAW;YACX,EAAE;YACF,sDAAsD;YACtD,wEAAwE;YACxE,0BAA0B;YAC1B,iBAAiB;SAClB,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1C,EAAE;YACF,GAAG,OAAO;SACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;IAClD,CAAC;CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,MAAM,QAAQ,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtC,IAAI,WAAW,KAAK,WAAW;QAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAAkB;IAC7D,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,QAAQ;SACL,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACxE,GAAG,CAAC,KAAK,CAAC,CACd,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;IACrF,OAAO,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC1C,CAAC;AAED,SAAe,WAAW,CAAC,GAAW,EAAE,WAAmB;;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC;IAC9C,CAAC;CAAA;AAED,gGAAgG;AAChG,yCAAyC;AACzC,MAAM,qBAAqB,GAAG;IAC5B,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,aAAa;IACb,kBAAkB;IAClB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,OAAO,CACL,IAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,CAAC,SAAS,WAAW,kBAAkB,CAAC;KAClD,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;AACJ,CAAC;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,WAAmB;;QACjE,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qDAAqD,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,sBAAsB,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,2BAA2B,WAAW,mBAAmB,CAAC,CAAC;IAC9F,CAAC;CAAA;AAED,SAAe,gBAAgB,CAC7B,WAAmB,EACnB,OAAY,EACZ,QAAgB;;QAEhB,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oDAAoD,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,QAAgB;;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,gFAAgF;IAChF,EAAE;IACF,yFAAyF;IACzF,4CAA4C;IAC5C,EAAE;IACF,kFAAkF;IAClF,+EAA+E;IAC/E,EAAE;IACF,yFAAyF;IACzF,iDAAiD;IACjD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,0BAA0B,QAAQ,MAAM,CAAC;QACrD,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,0CAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,GAAG,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,aAAa,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAC,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;IACrF,CAAC;IAED,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QACtD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;QACnE,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAe,cAAc,CAAC,GAAW;;QACvC,6EAA6E;QAC7E,qCAAqC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;YAC9F,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,KAAK,CACT,4DAA4D,QAAQ,EAAE,EACtE,KAAK,EACL,IAAI,EACJ,EAAC,GAAG,EAAE,OAAO,EAAC,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gHAAgH,CAAC,CAAC,CAAC;gBAC7I,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qGAAqG,CAAC,CAAC,CAAC;YAClI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB;;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAExE,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iGAAiG,CAAC,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,GAAG,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,WAAW,CACf,SAAS,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,4BAA4B,QAAQ,qCAAqC,EAChH,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,iCAAiC,QAAQ,OAAO,CAAC,CAAC;YACnF,8FAA8F;YAC9F,+FAA+F;YAC/F,gEAAgE;YAChE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,oDAAoD,QAAQ,WAAW,CAAC,CACpF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,oBAAoB,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,gGAAgG;QAChG,sFAAsF;QACtF,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,WAAW,CACf,0BAA0B,QAAQ,2BAA2B,EAC7D,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,wCAAwC,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB,EAAE,QAAgB;;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,QAAQ,yBAAyB,QAAQ,KAAK,CAAC,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2FAA2F,CAAC,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,QAAQ,kBAAkB,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,WAAW,CACf,uBAAuB,KAAK,UAAU,QAAQ,UAAU,KAAK,IAAI,IAAI,qBAAqB,EAC1F,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,QAAQ,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,QAAQ,kBAAkB,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CAAA;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,aAAqB,EACrB,gBAAqC,EACrC,WAA+B;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,gGAAgG;IAChG,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,2BAA2B,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,mBAAmB,CAAC,CAAC;IAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,2CAA2C,QAAQ,sBAAsB,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import chalk from 'chalk';\nimport fs from 'fs-extra';\nimport path, {dirname} from 'path';\nimport {execp, execPromise} from '../utils.js';\n\nconst dirname__ =\n typeof __dirname !== 'undefined'\n ? __dirname\n : //@ts-ignore\n dirname(import.meta.url).replace('file:/', '');\n\n// defaults/setup-publish/ lives at packages/cli/defaults/setup-publish/\n// This file compiles to lib/{esm,cjs}/commands/setup-publish.js — go up three\n// levels to reach the package root, then into defaults/setup-publish.\nconst TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'setup-publish');\n\n// Both are callers of the shared reusable workflows. `publish.yml` in particular cannot be\n// renamed: npm's trusted-publisher check validates the calling workflow's filename, and a\n// mismatch only shows up as releases quietly needing manual approval again.\nexport const WORKFLOW_FILES = ['pr.yml', 'publish.yml'] as const;\n\n/*\n The uniform branch-protection profile every `@_linked` repo runs on `main`.\n \n The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked\n * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is\n * `checks`. A repo pinning the bare name waits forever on a check that never reports.\n /\nexport function buildBranchProtectionPayload() {\n return {\n required_status_checks: {strict: false, contexts: ['checks / Build & Test']},\n // Admins included: the point of the gate is that no release skips the build, and the people\n // most likely to push straight to main are the admins.\n enforce_admins: true,\n // Reviews enabled but zero approvals required. The publish workflow direct-merges the version\n // PR (GitHub's auto-merge queue does not honor review-bypass allowances), so a non-zero count\n // would stall every release; the block itself still has to exist for the profile to match.\n required_pull_request_reviews: {\n required_approving_review_count: 0,\n dismiss_stale_reviews: false,\n require_code_owner_reviews: false,\n },\n restrictions: null,\n allow_force_pushes: false,\n allow_deletions: false,\n };\n}\n\nexport type SetupPublishOptions = {\n configureGithub?: boolean;\n /\n @deprecated The npm secret is `NPM_AUTH_TOKEN` in every org, holding a token for that\n * org's own npm scope — there is no longer a second name to select between. Kept as an\n * accepted no-op for the same reason as `dualBranch`: commander aborts the whole command\n * on an unknown option, so a stale script would fail to set the repo up at all rather\n * than setting it up correctly.\n /\n scope?: string;\n /\n @deprecated The dual-branch (`main` + `dev`) flow and its `@next` prereleases are retired —\n * every package repo is `main`-only. Kept as an accepted no-op rather than removed because\n * commander aborts the whole command on an unknown option, so a stale script or copied\n * command line would fail to set the repo up at all instead of setting it up correctly.\n /\n dualBranch?: boolean;\n grantTeam?: string; // GitHub team slug to grant push access on the repo\n};\n\n/\n Set up the changesets publish pipeline in the current package repo.\n \n The workflows are thin callers of the shared reusable workflows in the repo's OWN org\n * `.github` repo (pinned `@v1`, a deliberately moving tag) — one edit there changes every\n * package's pipeline in that org, which is why nothing about the build or publish steps is\n * scaffolded per repo any more. Each org keeps its own copy so that community gates can be\n * stricter than first-party ones without a cross-org `workflow_call`.\n \n Installs:\n * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else\n * - .changeset/config.json + README.md\n * - .changeset/initial-release.md\n * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts\n * - package.json: @changesets/cli + @changesets/changelog-github devDeps,\n * publishConfig: {access: public}\n * - .npmrc: allow-remote=all, plus legacy-peer-deps=true in linked-cm (see npmrcSettings);\n * keys the repo already sets are left alone\n * - renovate.json extending <org>/renovate-config, unless the repo has a Renovate config\n * - package-lock.json refreshed via npm install --package-lock-only, keeping existing resolutions\n \n With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform\n * branch-protection profile on main and enables auto-merge.\n /\nexport async function setupPublish(opts: SetupPublishOptions = {}): Promise<void> {\n const cwd = process.cwd();\n // One secret NAME across every org. The orgs are separate, so each holds its own value —\n // a token scoped to that org's npm scope. (There used to be an `NPM_AUTH_TOKEN_CM` for\n // `@linked.cm`; that dates from before first-party and community repos were split into two\n // orgs and one org therefore had to hold both tokens at once.)\n const npmSecretName = 'NPM_AUTH_TOKEN';\n\n console.log(chalk.magenta('Setting up the publish pipeline (main only)...'));\n if (opts.scope) {\n console.log(\n chalk.yellow(\n ' ⚠ --scope is deprecated and ignored: every org uses NPM_AUTH_TOKEN, holding that\\n' +\n \" org's own token. The NPM_AUTH_TOKEN_CM name is retired.\",\n ),\n );\n }\n if (opts.dualBranch) {\n console.log(\n chalk.yellow(\n ' ⚠ --dual-branch is deprecated and ignored: the main + dev flow and its @next prereleases are retired.',\n ),\n );\n }\n console.log(` target: ${cwd}`);\n console.log(` npm secret: ${npmSecretName}`);\n\n const pkgJsonPath = path.join(cwd, 'package.json');\n if (!fs.existsSync(pkgJsonPath)) {\n console.error(chalk.red('No package.json found in current directory. Run from the repo root.'));\n process.exit(1);\n }\n\n const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));\n const repoSlug = await resolveRepoSlug(cwd, pkgJson);\n\n console.log(` repo: ${repoSlug}`);\n console.log('');\n\n // 1. Workflow files. The caller stubs point at the shared workflows in this repo's own org,\n // so a repo in linked-cm never reaches into linked-fw for its CI.\n const workflowOrg = repoSlug.split('/')[0];\n if (workflowOrg === 'OWNER') {\n console.warn(\n chalk.yellow(\n ' ⚠ The repo slug is unknown, so the workflow stubs will call OWNER/.github — which does\\n' +\n ' not exist. Set the git remote (or package.json repository) and rerun, or fix the\\n' +\n ' `uses:` line in .github/workflows/{pr,publish}.yml by hand.',\n ),\n );\n }\n const requireTests = hasTestScript(pkgJson);\n if (!requireTests) {\n console.warn(\n chalk.yellow(\n ' ⚠ package.json has no `test` script, so pr.yml is written with require-tests: false.\\n' +\n ' Set it to true in .github/workflows/pr.yml once the package has a test suite.',\n ),\n );\n }\n await copyWorkflows(cwd, {workflowOrg, requireTests});\n\n // 2. Changesets config + README\n await copyChangesetConfig(cwd, repoSlug);\n\n // 3. Initial changeset\n await writeInitialChangeset(cwd, pkgJson.name);\n\n // 4. .gitignore\n await updateGitignore(cwd);\n\n // 5. package.json patches\n await patchPackageJson(pkgJsonPath, pkgJson, repoSlug);\n\n // 6. .npmrc — before the lockfile step, which must resolve under the same settings as CI\n await updateNpmrc(cwd, workflowOrg);\n\n // 7. renovate.json stub extending the org's shared policy\n await writeRenovateConfig(cwd, workflowOrg);\n\n // 8. npm install --package-lock-only to generate lockfile (if not present)\n await ensureLockfile(cwd);\n\n // 9. Optional: configure GitHub branch protection\n if (opts.configureGithub) {\n await configureGithub(repoSlug);\n }\n\n // 10. Optional: grant a GitHub team push access\n if (opts.grantTeam) {\n await grantTeamAccess(repoSlug, opts.grantTeam);\n }\n\n // Summary + manual steps\n printNextSteps(repoSlug, npmSecretName, opts.configureGithub, opts.grantTeam);\n}\n\nasync function resolveRepoSlug(cwd: string, pkgJson: any): Promise<string> {\n // Try git remote first\n try {\n const remoteUrl = await execPromise('git config --get remote.origin.url', false, false, {cwd});\n const m = typeof remoteUrl === 'string' ? remoteUrl.match(/[:/]([^/:]+\\/[^/]+?)(?:\\.git)?\\s$/) : null;\n if (m) return m[1];\n } catch {\n // fall through\n }\n // Fallback: parse package.json repository\n const repoField = pkgJson.repository;\n if (typeof repoField === 'string') {\n const m = repoField.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n if (m) return m[1];\n } else if (repoField?.url) {\n const m = repoField.url.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n if (m) return m[1];\n }\n console.warn(chalk.yellow('Could not determine repo slug. Using placeholder \"OWNER/REPO\" — update .changeset/config.json manually.'));\n return 'OWNER/REPO';\n}\n\n/*\n Whether the package has a `test` script for the PR check to run. `require-tests: true` turns a\n * missing script into a failure, so it is only safe to write once one exists — and a fresh\n * `create-package` scaffold has none.\n /\nexport function hasTestScript(pkgJson: {scripts?: Record<string, unknown>}): boolean {\n const test = pkgJson.scripts?.test;\n return typeof test === 'string' && test.trim() !== '';\n}\n\nexport type WorkflowVars = {workflowOrg: string; requireTests: boolean};\n\nexport function renderWorkflow(template: string, vars: WorkflowVars): string {\n return template\n .replace(/\\{\\{WORKFLOW_ORG\\}\\}/g, vars.workflowOrg)\n .replace(/\\{\\{REQUIRE_TESTS\\}\\}/g, String(vars.requireTests));\n}\n\nasync function copyWorkflows(cwd: string, vars: WorkflowVars): Promise<void> {\n const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');\n const dstDir = path.join(cwd, '.github', 'workflows');\n fs.mkdirpSync(dstDir);\n\n for (const file of WORKFLOW_FILES) {\n const content = renderWorkflow(fs.readFileSync(path.join(srcDir, file), 'utf8'), vars);\n fs.writeFileSync(path.join(dstDir, file), content);\n console.log(chalk.green(' ✓') + ` .github/workflows/${file}`);\n }\n\n // ci.yml and changeset-check.yml became the two jobs of the shared pr.yml. Left behind on a\n // repo that was set up before the consolidation they keep running, so the old bare\n // `Build & Test` check reports alongside `checks / Build & Test` and re-setting a repo up\n // looks like it worked while the duplicate gate quietly stays.\n for (const stale of ['ci.yml', 'changeset-check.yml']) {\n const stalePath = path.join(dstDir, stale);\n if (fs.existsSync(stalePath)) {\n fs.removeSync(stalePath);\n console.log(chalk.green(' ✓') + ` removed superseded .github/workflows/${stale}`);\n }\n }\n}\n\nasync function copyChangesetConfig(cwd: string, repoSlug: string): Promise<void> {\n const srcDir = path.join(TEMPLATE_ROOT, 'changeset');\n const dstDir = path.join(cwd, '.changeset');\n fs.mkdirpSync(dstDir);\n\n let configContent = fs.readFileSync(path.join(srcDir, 'config.json'), 'utf8');\n configContent = configContent.replace(/\\{\\{REPO_SLUG\\}\\}/g, repoSlug);\n fs.writeFileSync(path.join(dstDir, 'config.json'), configContent);\n console.log(chalk.green(' ✓') + ' .changeset/config.json');\n\n fs.copyFileSync(path.join(srcDir, 'README.md'), path.join(dstDir, 'README.md'));\n console.log(chalk.green(' ✓') + ' .changeset/README.md');\n}\n\nasync function writeInitialChangeset(cwd: string, pkgName: string): Promise<void> {\n const changelogPath = path.join(cwd, 'CHANGELOG.md');\n if (fs.existsSync(changelogPath)) {\n console.log(chalk.gray(' · CHANGELOG.md exists — skipping initial changeset'));\n return;\n }\n const initial = path.join(cwd, '.changeset', 'initial-release.md');\n const body = `---\\n'${pkgName}': patch\\n---\\n\\nInitial release under the new publishing setup.\\n`;\n fs.writeFileSync(initial, body);\n console.log(chalk.green(' ✓') + ' .changeset/initial-release.md');\n}\n\nasync function updateGitignore(cwd: string): Promise<void> {\n const gitignorePath = path.join(cwd, '.gitignore');\n const entries = [\n 'node_modules/',\n 'lib/',\n 'yarn.lock',\n '.log',\n '.DS_Store',\n '',\n '# tsc sourcemap output — always in lib/, never src/.',\n '# (.d.ts not ignored — hand-written type declarations like colors.d.ts',\n '# are legit src files.)',\n 'src/*/.js.map',\n ];\n const existing = fs.existsSync(gitignorePath)\n ? fs.readFileSync(gitignorePath, 'utf8').split('\\n')\n : [];\n const existingSet = new Set(existing.map((l) => l.trim()));\n const toAdd = entries.filter((e) => e && !existingSet.has(e.trim()));\n if (toAdd.length === 0) {\n console.log(chalk.gray(' · .gitignore already has all entries'));\n return;\n }\n const merged = [\n ...existing.filter((l) => l.trim() !== ''),\n '',\n ...entries,\n ].join('\\n');\n fs.writeFileSync(gitignorePath, merged + '\\n');\n console.log(chalk.green(' ✓') + ' .gitignore');\n}\n\n/*\n The `.npmrc` settings a package repo needs so that a local `npm install` resolves the same tree\n * as its org's shared workflows and Renovate.\n \n - `allow-remote=all`: npm 12 defaults `allow-remote` to `none` and then refuses the registry\n * tarball of a bundled dependency (`@tailwindcss/oxide-wasm32-wasi` is in most of the fleet),\n * failing `npm install` with EALLOWREMOTE. npm 11, which CI runs, accepts the setting.\n * - `legacy-peer-deps=true`, linked-cm only: its workflows install with\n * `npm ci --legacy-peer-deps`. linked-fw's install strictly, and its Renovate policy requires\n * locks to be resolved under CI's peer rules — so writing it there would be the mismatch.\n /\nexport function npmrcSettings(workflowOrg: string): string[] {\n const settings = ['allow-remote=all'];\n if (workflowOrg === 'linked-cm') settings.push('legacy-peer-deps=true');\n return settings;\n}\n\n/\n Appends each setting whose key the existing `.npmrc` does not set. A key that is already set\n * keeps its value: the repo may have a reason, and silently flipping it would change installs.\n /\nexport function mergeNpmrc(existing: string, settings: string[]): string {\n const keyOf = (line: string) => line.split('=')[0].trim();\n const present = new Set(\n existing\n .split('\\n')\n .map((line) => line.trim())\n .filter((line) => line && !line.startsWith('#') && !line.startsWith(';'))\n .map(keyOf),\n );\n const missing = settings.filter((setting) => !present.has(keyOf(setting)));\n if (missing.length === 0) return existing;\n const base = existing === '' \|\| existing.endsWith('\\n') ? existing : existing + '\\n';\n return base + missing.join('\\n') + '\\n';\n}\n\nasync function updateNpmrc(cwd: string, workflowOrg: string): Promise<void> {\n const npmrcPath = path.join(cwd, '.npmrc');\n const existing = fs.existsSync(npmrcPath) ? fs.readFileSync(npmrcPath, 'utf8') : '';\n const next = mergeNpmrc(existing, npmrcSettings(workflowOrg));\n if (next === existing) {\n console.log(chalk.gray(' · .npmrc already has the required settings'));\n return;\n }\n fs.writeFileSync(npmrcPath, next);\n console.log(chalk.green(' ✓') + ' .npmrc');\n}\n\n// Every location Renovate reads a repo config from. If any exists, the repo has a config of its\n// own and setup-publish leaves it alone.\nconst RENOVATE_CONFIG_FILES = [\n 'renovate.json',\n 'renovate.json5',\n '.github/renovate.json',\n '.github/renovate.json5',\n '.gitlab/renovate.json',\n '.gitlab/renovate.json5',\n '.renovaterc',\n '.renovaterc.json',\n '.renovaterc.json5',\n];\n\n/\n The three-line stub every package repo carries: the policy itself lives in the org's\n * `renovate-config` repo, so one edit there reaches the whole fleet.\n /\nexport function renovateStub(workflowOrg: string): string {\n return (\n JSON.stringify(\n {\n $schema: 'https://docs.renovatebot.com/renovate-schema.json',\n extends: [`local>${workflowOrg}/renovate-config`],\n },\n null,\n 2,\n ) + '\\n'\n );\n}\n\nasync function writeRenovateConfig(cwd: string, workflowOrg: string): Promise<void> {\n if (workflowOrg === 'OWNER') {\n console.warn(chalk.yellow(' ⚠ Skipped renovate.json: the repo org is unknown.'));\n return;\n }\n const existing = RENOVATE_CONFIG_FILES.find((file) => fs.existsSync(path.join(cwd, file)));\n if (existing) {\n console.log(chalk.gray(` · ${existing} exists — left as is`));\n return;\n }\n fs.writeFileSync(path.join(cwd, 'renovate.json'), renovateStub(workflowOrg));\n console.log(chalk.green(' ✓') + ` renovate.json (extends ${workflowOrg}/renovate-config)`);\n}\n\nasync function patchPackageJson(\n pkgJsonPath: string,\n pkgJson: any,\n repoSlug: string,\n): Promise<void> {\n if (applyPackageJsonPatches(pkgJson, repoSlug)) {\n fs.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n console.log(chalk.green(' ✓') + ' package.json (publishConfig + changesets devDeps)');\n } else {\n console.log(chalk.gray(' · package.json already configured'));\n }\n}\n\n/* Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. /\nexport function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean {\n let modified = false;\n\n // `repository.url` must be set, and must match the repo the workflow builds in.\n //\n // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose\n // attestation cannot be matched against it:\n //\n // 422 Error verifying sigstore provenance bundle: Failed to validate repository\n // information: package.json \"repository.url\" is \"\", expected to match <repo>\n //\n // The slug is already resolved from `git remote` above, so there is no reason to leave a\n // package to discover this at its first release.\n if (repoSlug !== 'OWNER/REPO') {\n const url = `git+https://github.com/${repoSlug}.git`;\n const current =\n typeof pkgJson.repository === 'string'\n ? pkgJson.repository\n : pkgJson.repository?.url;\n if (!current) {\n pkgJson.repository = {type: 'git', url};\n modified = true;\n }\n }\n\n if (!pkgJson.publishConfig) {\n pkgJson.publishConfig = {access: 'public'};\n modified = true;\n } else {\n if (pkgJson.publishConfig.access !== 'public') {\n pkgJson.publishConfig.access = 'public';\n modified = true;\n }\n // `provenance` is deliberately left alone. It used to be stripped because publishing went\n // through NPM_AUTH_TOKEN only; the shared workflow now publishes with OIDC trusted publishing\n // first (`npm publish --provenance`, id-token: write on both caller and reusable workflow) and\n // falls back to the staged token release, so provenance is wanted, not a conflict.\n }\n\n pkgJson.devDependencies = pkgJson.devDependencies \|\| {};\n if (!pkgJson.devDependencies['@changesets/cli']) {\n pkgJson.devDependencies['@changesets/cli'] = '^3.0.0';\n modified = true;\n }\n if (!pkgJson.devDependencies['@changesets/changelog-github']) {\n pkgJson.devDependencies['@changesets/changelog-github'] = '^1.0.0';\n modified = true;\n }\n\n return modified;\n}\n\nasync function ensureLockfile(cwd: string): Promise<void> {\n // Always regenerate — package.json has just been patched (new devDeps etc.),\n // so any existing lockfile is stale.\n console.log(chalk.magenta(' Running npm install --package-lock-only...'));\n\n // When running inside a yarn workspace (e.g. CN's packages/ layout), npm\n // climbs up, detects the parent workspace, and writes the lockfile at the\n // wrong level. Work around by copying the package to a tmpdir, generating\n // the lockfile in isolation, and copying it back.\n const os = await import('os');\n const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));\n const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));\n try {\n // The existing lockfile comes along so its resolutions are kept (only what package.json just\n // gained is resolved), and .npmrc so the lock is resolved under the repo's own settings —\n // allow-remote for npm 12, and legacy-peer-deps exactly where the org's CI installs that way.\n for (const file of ['package.json', 'package-lock.json', '.npmrc']) {\n const src = path.join(cwd, file);\n if (fs.existsSync(src)) fs.copyFileSync(src, path.join(tmpBase, file));\n }\n await execp(\n `npm install --package-lock-only --ignore-scripts --cache ${cacheDir}`,\n false,\n true,\n {cwd: tmpBase},\n );\n const lockPath = path.join(tmpBase, 'package-lock.json');\n if (fs.existsSync(lockPath)) {\n fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));\n console.log(chalk.green(' ✓') + ' package-lock.json');\n } else {\n console.warn(chalk.yellow(' ⚠ npm install did not produce a package-lock.json — likely because a dependency is not yet published on npm.'));\n console.warn(chalk.yellow(' Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n }\n } catch (err) {\n console.warn(chalk.yellow(' ⚠ Failed to generate package-lock.json — likely because a dependency is not yet published on npm.'));\n console.warn(chalk.yellow(' Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n } finally {\n fs.removeSync(tmpBase);\n fs.removeSync(cacheDir);\n }\n}\n\nasync function configureGithub(repoSlug: string): Promise<void> {\n console.log('');\n console.log(chalk.magenta('Configuring GitHub (branch protection)...'));\n\n // Check gh CLI available\n try {\n await execPromise('gh --version', false, false);\n } catch {\n console.warn(chalk.yellow(' ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --configure-github,'));\n console.warn(chalk.yellow(' or set branch protection manually at https://github.com/' + repoSlug + '/settings/branches'));\n return;\n }\n\n // Check gh CLI authenticated\n try {\n await execPromise('gh auth status', false, false);\n } catch {\n console.warn(chalk.yellow(' ⚠ `gh` CLI is not authenticated. Run `gh auth login` and retry.'));\n return;\n }\n\n const payload = JSON.stringify(buildBranchProtectionPayload());\n\n try {\n // Use --input - to pass the JSON payload via stdin\n await execPromise(\n `echo '${payload.replace(/'/g, \"'\\\\''\")}' \| gh api -X PUT /repos/${repoSlug}/branches/main/protection --input -`,\n false,\n false,\n );\n console.log(chalk.green(' ✓') + ` branch protection enabled on ${repoSlug}/main`);\n // A repo can pin a required check in a ruleset as well as in classic branch protection, and\n // the two are stored separately — this call only writes the classic one, so a leftover ruleset\n // keeps blocking merges on a check name that no longer reports.\n console.log(\n chalk.gray(` · check for a competing ruleset: gh api /repos/${repoSlug}/rulesets`),\n );\n } catch (err) {\n console.warn(chalk.yellow(' ⚠ Failed to set branch protection. Do it manually:'));\n console.warn(chalk.yellow(` https://github.com/${repoSlug}/settings/branches`));\n }\n\n // Enable \"Allow auto-merge\" so a PR can be queued to merge itself once checks pass. The publish\n // workflow authors the Release PR via the org App token (org secrets RELEASE_APP_ID /\n // RELEASE_APP_PRIVATE_KEY) so its CI runs without a manual approval gate.\n try {\n await execPromise(\n `gh api -X PATCH /repos/${repoSlug} -F allow_auto_merge=true`,\n false,\n false,\n );\n console.log(chalk.green(' ✓') + ` auto-merge enabled on ${repoSlug}`);\n } catch (err) {\n console.warn(chalk.yellow(' ⚠ Failed to enable auto-merge. Enable it manually:'));\n console.warn(chalk.yellow(` https://github.com/${repoSlug}/settings (General → Allow auto-merge)`));\n }\n}\n\nasync function grantTeamAccess(repoSlug: string, teamSlug: string): Promise<void> {\n console.log('');\n console.log(chalk.magenta(`Granting '${teamSlug}' team push access to ${repoSlug}...`));\n\n try {\n await execPromise('gh --version', false, false);\n } catch {\n console.warn(chalk.yellow(\" ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --grant-team,\"));\n console.warn(chalk.yellow(` or add the team manually at https://github.com/${repoSlug}/settings/access`));\n return;\n }\n\n const [owner, repo] = repoSlug.split('/');\n try {\n await execPromise(\n `gh api -X PUT /orgs/${owner}/teams/${teamSlug}/repos/${owner}/${repo} -f permission=push`,\n false,\n false,\n );\n console.log(chalk.green(' ✓') + ` team '${teamSlug}' granted push access on ${repoSlug}`);\n } catch (err: any) {\n const msg = err?.stderr \|\| err?.stdout \|\| String(err);\n console.warn(chalk.yellow(` ⚠ Failed to grant team access: ${msg.slice(0, 200)}`));\n console.warn(chalk.yellow(` Team may not exist in org '${owner}', or you may lack admin rights.`));\n console.warn(chalk.yellow(` Manual: https://github.com/${repoSlug}/settings/access`));\n }\n}\n\nfunction printNextSteps(\n repoSlug: string,\n npmSecretName: string,\n configuredGithub: boolean \| undefined,\n grantedTeam: string \| undefined,\n): void {\n console.log('');\n console.log(chalk.green('Done.'));\n console.log('');\n console.log(chalk.bold('Next steps:'));\n console.log('');\n const [owner, repo] = repoSlug.split('/');\n\n console.log(` 1. Review the generated files, adjust as needed.`);\n console.log(` 2. Commit:`);\n console.log(chalk.cyan(' git add . && git commit -m \"set up the publish pipeline\"'));\n console.log(` 3. Push to main — the publish workflow will trigger.`);\n console.log('');\n console.log(chalk.bold('Register the trusted publisher on npmjs.com (before the first release):'));\n console.log('');\n console.log(` package → Settings → Trusted Publisher, matching the caller workflow exactly:`);\n console.log(` organization: ${chalk.cyan(owner)} repository: ${chalk.cyan(repo)}`);\n console.log(` workflow filename: ${chalk.cyan('publish.yml')} environment: ${chalk.cyan('(empty)')}`);\n console.log(` \"Allow npm publish\": ${chalk.cyan('ticked')}`);\n console.log('');\n console.log(chalk.gray(` Without it the release still ships — the workflow falls back to a staged`));\n console.log(chalk.gray(` npm release that a maintainer approves with 2FA. A typo in the organization`));\n console.log(chalk.gray(` field looks exactly the same, so check that field first if a package that`));\n console.log(chalk.gray(` should publish directly keeps staging instead.`));\n console.log('');\n // No per-repo secret grant step: NPM_AUTH_TOKEN, RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are\n // \"All repositories\" org secrets, which is the whole reason first-party and community packages\n // live in separate orgs. Only mention what is genuinely still one-time-per-org.\n console.log(chalk.bold(`One-time org-level setup (already done on linked-fw and linked-cm):`));\n console.log('');\n console.log(` a. Org secrets ${chalk.cyan(npmSecretName)}, ${chalk.cyan('RELEASE_APP_ID')} and ${chalk.cyan('RELEASE_APP_PRIVATE_KEY')},`);\n console.log(` visible to ${chalk.cyan('All repositories')} — there is no per-repo grant step.`);\n console.log(` → https://github.com/organizations/${owner}/settings/secrets/actions`);\n console.log('');\n console.log(` b. Enable \"Allow GitHub Actions to create and approve pull requests\":`);\n console.log(` → https://github.com/organizations/${owner}/settings/actions`);\n\n if (!configuredGithub) {\n console.log('');\n console.log(chalk.bold('Branch protection:'));\n console.log(` Rerun with ${chalk.cyan('linked setup-publish --configure-github')} to configure automatically,`);\n console.log(` or set manually at https://github.com/${repoSlug}/settings/branches —`);\n console.log(` the required check is ${chalk.cyan('checks / Build & Test')}, not ${chalk.cyan('Build & Test')}.`);\n }\n console.log('');\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@_linked/cli",
-  "version": "1.42.0",
+  "version": "1.43.0",
   "packageManager": "npm@11.21.0",
   "description": "Command line tools for the @_linked/* packages and apps",
   "main": "lib/esm/index.js",