@_linked/cli 1.42.0 → 1.43.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.43.1
+
+### Patch Changes
+
+- [#225](https://github.com/linked-fw/cli/pull/225) [`1b8e157`](https://github.com/linked-fw/cli/commit/1b8e157a3d28e232f7fe4df4db6ac6a248f41f44) Thanks [@flyon](https://github.com/flyon)! - Packages created with `create-package` now publish only the files consumers need: the template's `package.json` has `"files": ["lib", "CHANGELOG.md"]`, so their tarballs no longer include `.github/`, `.changeset/`, tests or tsconfig files.
+
+## 1.43.0
+
+### Minor Changes
+
+- [#224](https://github.com/linked-fw/cli/pull/224) [`51d38d1`](https://github.com/linked-fw/cli/commit/51d38d1392afd212e6c5b656d343a8f581cc42bf) Thanks [@flyon](https://github.com/flyon)! - `linked setup-publish` now also sets up what every linked-cm package needed by hand:
+
+  - an `.npmrc` with `allow-remote=all` (npm 12 otherwise fails `npm install` with EALLOWREMOTE on bundled tarballs), plus `legacy-peer-deps=true` in linked-cm, whose CI installs that way. Keys the repo already sets are kept.
+  - a `renovate.json` stub extending `<org>/renovate-config`, unless the repo already has a Renovate config.
+  - `@changesets/cli` ^3 and `@changesets/changelog-github` ^1, the versions the fleet runs.
+
+  The lockfile step now keeps the existing lockfile's resolutions and resolves under the repo's `.npmrc`, instead of re-resolving from scratch with `--legacy-peer-deps` everywhere.
+
 ## 1.42.0
 
 ### Minor Changes

package/defaults/package/package.json

@@ -18,6 +18,10 @@
   "//types": "Correct as written, do not 'fix' it: typesVersions below is applied to the types field too, so \"index.d.ts\" resolves to lib/esm/index.d.ts. Writing that literal path applies the mapping twice (lib/esm/lib/esm/index.d.ts) and breaks node10 resolution. Verify with ts.resolveModuleName under node10 AND bundler, not by looking for the file on disk.",
   "types": "index.d.ts",
   "license": "ISC",
+  "files": [
+    "lib",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "start": "linked dev",
     "build": "rimraf ./lib && npm run build-esm && npm run copy-to-lib",

package/lib/esm/commands/setup-publish.d.ts

@@ -56,7 +56,10 @@ export type SetupPublishOptions = {
  * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts
  * - package.json: @changesets/cli + @changesets/changelog-github devDeps,
  *   publishConfig: {access: public}
- * - package-lock.json generated via npm install --package-lock-only
+ * - .npmrc: allow-remote=all, plus legacy-peer-deps=true in linked-cm (see npmrcSettings);
+ *   keys the repo already sets are left alone
+ * - renovate.json extending <org>/renovate-config, unless the repo has a Renovate config
+ * - package-lock.json refreshed via npm install --package-lock-only, keeping existing resolutions
  *
  * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform
  * branch-protection profile on main and enables auto-merge.
@@ -75,6 +78,28 @@ export type WorkflowVars = {
     requireTests: boolean;
 };
 export declare function renderWorkflow(template: string, vars: WorkflowVars): string;
+/**
+ * The `.npmrc` settings a package repo needs so that a local `npm install` resolves the same tree
+ * as its org's shared workflows and Renovate.
+ *
+ * - `allow-remote=all`: npm 12 defaults `allow-remote` to `none` and then refuses the registry
+ *   tarball of a bundled dependency (`@tailwindcss/oxide-wasm32-wasi` is in most of the fleet),
+ *   failing `npm install` with EALLOWREMOTE. npm 11, which CI runs, accepts the setting.
+ * - `legacy-peer-deps=true`, linked-cm only: its workflows install with
+ *   `npm ci --legacy-peer-deps`. linked-fw's install strictly, and its Renovate policy requires
+ *   locks to be resolved under CI's peer rules — so writing it there would be the mismatch.
+ */
+export declare function npmrcSettings(workflowOrg: string): string[];
+/**
+ * Appends each setting whose key the existing `.npmrc` does not set. A key that is already set
+ * keeps its value: the repo may have a reason, and silently flipping it would change installs.
+ */
+export declare function mergeNpmrc(existing: string, settings: string[]): string;
+/**
+ * The three-line stub every package repo carries: the policy itself lives in the org's
+ * `renovate-config` repo, so one edit there reaches the whole fleet.
+ */
+export declare function renovateStub(workflowOrg: string): string;
 /** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */
 export declare function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean;
 //# sourceMappingURL=setup-publish.d.ts.map

package/lib/esm/commands/setup-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,oCAAqC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,4BAA4B;;;;;;;;;;;;;;EAkB3C;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyFhF;AAwBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAC,GAAG,OAAO,CAGnF;AAED,MAAM,MAAM,YAAY,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAC,CAAC;AAExE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAI3E;AAiGD,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkD/E"}
+{"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,oCAAqC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,4BAA4B;;;;;;;;;;;;;;EAkB3C;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+FhF;AAwBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAC,GAAG,OAAO,CAGnF;AAED,MAAM,MAAM,YAAY,GAAG;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAC,CAAC;AAExE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAI3E;AAoFD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAI3D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAavE;AA4BD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWxD;AA6BD,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkD/E"}

package/lib/esm/commands/setup-publish.js

@@ -65,7 +65,10 @@ export function buildBranchProtectionPayload() {
  * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts
  * - package.json: @changesets/cli + @changesets/changelog-github devDeps,
  *   publishConfig: {access: public}
- * - package-lock.json generated via npm install --package-lock-only
+ * - .npmrc: allow-remote=all, plus legacy-peer-deps=true in linked-cm (see npmrcSettings);
+ *   keys the repo already sets are left alone
+ * - renovate.json extending <org>/renovate-config, unless the repo has a Renovate config
+ * - package-lock.json refreshed via npm install --package-lock-only, keeping existing resolutions
  *
  * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform
  * branch-protection profile on main and enables auto-merge.
@@ -119,13 +122,17 @@ export function setupPublish() {
         yield updateGitignore(cwd);
         // 5. package.json patches
         yield patchPackageJson(pkgJsonPath, pkgJson, repoSlug);
-        // 6. npm install --package-lock-only to generate lockfile (if not present)
+        // 6. .npmrc — before the lockfile step, which must resolve under the same settings as CI
+        yield updateNpmrc(cwd, workflowOrg);
+        // 7. renovate.json stub extending the org's shared policy
+        yield writeRenovateConfig(cwd, workflowOrg);
+        // 8. npm install --package-lock-only to generate lockfile (if not present)
         yield ensureLockfile(cwd);
-        // 7. Optional: configure GitHub branch protection
+        // 9. Optional: configure GitHub branch protection
         if (opts.configureGithub) {
             yield configureGithub(repoSlug);
         }
-        // 8. Optional: grant a GitHub team push access
+        // 10. Optional: grant a GitHub team push access
         if (opts.grantTeam) {
             yield grantTeamAccess(repoSlug, opts.grantTeam);
         }
@@ -258,6 +265,91 @@ function updateGitignore(cwd) {
         console.log(chalk.green('  ✓') + ' .gitignore');
     });
 }
+/**
+ * The `.npmrc` settings a package repo needs so that a local `npm install` resolves the same tree
+ * as its org's shared workflows and Renovate.
+ *
+ * - `allow-remote=all`: npm 12 defaults `allow-remote` to `none` and then refuses the registry
+ *   tarball of a bundled dependency (`@tailwindcss/oxide-wasm32-wasi` is in most of the fleet),
+ *   failing `npm install` with EALLOWREMOTE. npm 11, which CI runs, accepts the setting.
+ * - `legacy-peer-deps=true`, linked-cm only: its workflows install with
+ *   `npm ci --legacy-peer-deps`. linked-fw's install strictly, and its Renovate policy requires
+ *   locks to be resolved under CI's peer rules — so writing it there would be the mismatch.
+ */
+export function npmrcSettings(workflowOrg) {
+    const settings = ['allow-remote=all'];
+    if (workflowOrg === 'linked-cm')
+        settings.push('legacy-peer-deps=true');
+    return settings;
+}
+/**
+ * Appends each setting whose key the existing `.npmrc` does not set. A key that is already set
+ * keeps its value: the repo may have a reason, and silently flipping it would change installs.
+ */
+export function mergeNpmrc(existing, settings) {
+    const keyOf = (line) => line.split('=')[0].trim();
+    const present = new Set(existing
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith('#') && !line.startsWith(';'))
+        .map(keyOf));
+    const missing = settings.filter((setting) => !present.has(keyOf(setting)));
+    if (missing.length === 0)
+        return existing;
+    const base = existing === '' || existing.endsWith('\n') ? existing : existing + '\n';
+    return base + missing.join('\n') + '\n';
+}
+function updateNpmrc(cwd, workflowOrg) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const npmrcPath = path.join(cwd, '.npmrc');
+        const existing = fs.existsSync(npmrcPath) ? fs.readFileSync(npmrcPath, 'utf8') : '';
+        const next = mergeNpmrc(existing, npmrcSettings(workflowOrg));
+        if (next === existing) {
+            console.log(chalk.gray('  · .npmrc already has the required settings'));
+            return;
+        }
+        fs.writeFileSync(npmrcPath, next);
+        console.log(chalk.green('  ✓') + ' .npmrc');
+    });
+}
+// Every location Renovate reads a repo config from. If any exists, the repo has a config of its
+// own and setup-publish leaves it alone.
+const RENOVATE_CONFIG_FILES = [
+    'renovate.json',
+    'renovate.json5',
+    '.github/renovate.json',
+    '.github/renovate.json5',
+    '.gitlab/renovate.json',
+    '.gitlab/renovate.json5',
+    '.renovaterc',
+    '.renovaterc.json',
+    '.renovaterc.json5',
+];
+/**
+ * The three-line stub every package repo carries: the policy itself lives in the org's
+ * `renovate-config` repo, so one edit there reaches the whole fleet.
+ */
+export function renovateStub(workflowOrg) {
+    return (JSON.stringify({
+        $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+        extends: [`local>${workflowOrg}/renovate-config`],
+    }, null, 2) + '\n');
+}
+function writeRenovateConfig(cwd, workflowOrg) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (workflowOrg === 'OWNER') {
+            console.warn(chalk.yellow('  ⚠ Skipped renovate.json: the repo org is unknown.'));
+            return;
+        }
+        const existing = RENOVATE_CONFIG_FILES.find((file) => fs.existsSync(path.join(cwd, file)));
+        if (existing) {
+            console.log(chalk.gray(`  · ${existing} exists — left as is`));
+            return;
+        }
+        fs.writeFileSync(path.join(cwd, 'renovate.json'), renovateStub(workflowOrg));
+        console.log(chalk.green('  ✓') + ` renovate.json (extends ${workflowOrg}/renovate-config)`);
+    });
+}
 function patchPackageJson(pkgJsonPath, pkgJson, repoSlug) {
     return __awaiter(this, void 0, void 0, function* () {
         if (applyPackageJsonPatches(pkgJson, repoSlug)) {
@@ -309,11 +401,11 @@ export function applyPackageJsonPatches(pkgJson, repoSlug) {
     }
     pkgJson.devDependencies = pkgJson.devDependencies || {};
     if (!pkgJson.devDependencies['@changesets/cli']) {
-        pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';
+        pkgJson.devDependencies['@changesets/cli'] = '^3.0.0';
         modified = true;
     }
     if (!pkgJson.devDependencies['@changesets/changelog-github']) {
-        pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';
+        pkgJson.devDependencies['@changesets/changelog-github'] = '^1.0.0';
         modified = true;
     }
     return modified;
@@ -331,9 +423,15 @@ function ensureLockfile(cwd) {
         const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));
         const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));
         try {
-            const pkgJsonPath = path.join(cwd, 'package.json');
-            fs.copyFileSync(pkgJsonPath, path.join(tmpBase, 'package.json'));
-            yield execp(`npm install --legacy-peer-deps --package-lock-only --cache ${cacheDir}`, false, true, { cwd: tmpBase });
+            // The existing lockfile comes along so its resolutions are kept (only what package.json just
+            // gained is resolved), and .npmrc so the lock is resolved under the repo's own settings —
+            // allow-remote for npm 12, and legacy-peer-deps exactly where the org's CI installs that way.
+            for (const file of ['package.json', 'package-lock.json', '.npmrc']) {
+                const src = path.join(cwd, file);
+                if (fs.existsSync(src))
+                    fs.copyFileSync(src, path.join(tmpBase, file));
+            }
+            yield execp(`npm install --package-lock-only --ignore-scripts --cache ${cacheDir}`, false, true, { cwd: tmpBase });
             const lockPath = path.join(tmpBase, 'package-lock.json');
             if (fs.existsSync(lockPath)) {
                 fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));

package/lib/esm/commands/setup-publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-publish.js","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,EAAE,EAAC,OAAO,EAAC,MAAM,MAAM,CAAC;AACnC,OAAO,EAAC,KAAK,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AAE/C,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,WAAW;IAC9B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErD,wEAAwE;AACxE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,0FAA0F;AAC1F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,sBAAsB,EAAE,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAC;QAC5E,4FAA4F;QAC5F,uDAAuD;QACvD,cAAc,EAAE,IAAI;QACpB,8FAA8F;QAC9F,8FAA8F;QAC9F,2FAA2F;QAC3F,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,KAAK;YAC5B,0BAA0B,EAAE,KAAK;SAClC;QACD,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAgB,YAAY;yDAAC,OAA4B,EAAE;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,yFAAyF;QACzF,uFAAuF;QACvF,2FAA2F;QAC3F,+DAA+D;QAC/D,MAAM,aAAa,GAAG,gBAAgB,CAAC;QAEvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,sFAAsF;gBACpF,6DAA6D,CAChE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yGAAyG,CAC1G,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,4FAA4F;QAC5F,qEAAqE;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,4FAA4F;gBAC1F,wFAAwF;gBACxF,iEAAiE,CACpE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,0FAA0F;gBACxF,mFAAmF,CACtF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC,CAAC;QAEtD,gCAAgC;QAChC,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,uBAAuB;QACvB,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,gBAAgB;QAChB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAE3B,0BAA0B;QAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,2EAA2E;QAC3E,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAE1B,kDAAkD;QAClD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,yBAAyB;QACzB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW,EAAE,OAAY;;QACtD,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oCAAoC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvG,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,WAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvE,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3E,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yGAAyG,CAAC,CAAC,CAAC;QACtI,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAA4C;;IACxE,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,CAAC;IACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAID,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAkB;IACjE,OAAO,QAAQ;SACZ,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,WAAW,CAAC;SAClD,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAe,aAAa,CAAC,GAAW,EAAE,IAAkB;;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YACvF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,4FAA4F;QAC5F,mFAAmF;QACnF,0FAA0F;QAC1F,+DAA+D;QAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;CAAA;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,QAAgB;;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAE5D,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC;IAC5D,CAAC;CAAA;AAED,SAAe,qBAAqB,CAAC,GAAW,EAAE,OAAe;;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,OAAO,oEAAoE,CAAC;QAClG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC;IACrE,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW;;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,eAAe;YACf,MAAM;YACN,WAAW;YACX,OAAO;YACP,WAAW;YACX,EAAE;YACF,sDAAsD;YACtD,wEAAwE;YACxE,0BAA0B;YAC1B,iBAAiB;SAClB,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1C,EAAE;YACF,GAAG,OAAO;SACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;IAClD,CAAC;CAAA;AAED,SAAe,gBAAgB,CAC7B,WAAmB,EACnB,OAAY,EACZ,QAAgB;;QAEhB,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oDAAoD,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,QAAgB;;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,gFAAgF;IAChF,EAAE;IACF,yFAAyF;IACzF,4CAA4C;IAC5C,EAAE;IACF,kFAAkF;IAClF,+EAA+E;IAC/E,EAAE;IACF,yFAAyF;IACzF,iDAAiD;IACjD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,0BAA0B,QAAQ,MAAM,CAAC;QACrD,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,0CAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,GAAG,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,aAAa,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAC,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;IACrF,CAAC;IAED,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;QACvD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;QACnE,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAe,cAAc,CAAC,GAAW;;QACvC,6EAA6E;QAC7E,qCAAqC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACnD,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YACjE,MAAM,KAAK,CACT,8DAA8D,QAAQ,EAAE,EACxE,KAAK,EACL,IAAI,EACJ,EAAC,GAAG,EAAE,OAAO,EAAC,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gHAAgH,CAAC,CAAC,CAAC;gBAC7I,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qGAAqG,CAAC,CAAC,CAAC;YAClI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB;;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAExE,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iGAAiG,CAAC,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,GAAG,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,WAAW,CACf,SAAS,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,4BAA4B,QAAQ,qCAAqC,EAChH,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,iCAAiC,QAAQ,OAAO,CAAC,CAAC;YACnF,8FAA8F;YAC9F,+FAA+F;YAC/F,gEAAgE;YAChE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,oDAAoD,QAAQ,WAAW,CAAC,CACpF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,oBAAoB,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,gGAAgG;QAChG,sFAAsF;QACtF,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,WAAW,CACf,0BAA0B,QAAQ,2BAA2B,EAC7D,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,wCAAwC,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB,EAAE,QAAgB;;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,QAAQ,yBAAyB,QAAQ,KAAK,CAAC,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2FAA2F,CAAC,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,QAAQ,kBAAkB,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,WAAW,CACf,uBAAuB,KAAK,UAAU,QAAQ,UAAU,KAAK,IAAI,IAAI,qBAAqB,EAC1F,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,QAAQ,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,QAAQ,kBAAkB,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CAAA;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,aAAqB,EACrB,gBAAqC,EACrC,WAA+B;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,gGAAgG;IAChG,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,2BAA2B,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,mBAAmB,CAAC,CAAC;IAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,2CAA2C,QAAQ,sBAAsB,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import chalk from 'chalk';\nimport fs from 'fs-extra';\nimport path, {dirname} from 'path';\nimport {execp, execPromise} from '../utils.js';\n\nconst dirname__ =\n  typeof __dirname !== 'undefined'\n    ? __dirname\n    : //@ts-ignore\n      dirname(import.meta.url).replace('file:/', '');\n\n// defaults/setup-publish/ lives at packages/cli/defaults/setup-publish/\n// This file compiles to lib/{esm,cjs}/commands/setup-publish.js — go up three\n// levels to reach the package root, then into defaults/setup-publish.\nconst TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'setup-publish');\n\n// Both are callers of the shared reusable workflows. `publish.yml` in particular cannot be\n// renamed: npm's trusted-publisher check validates the calling workflow's filename, and a\n// mismatch only shows up as releases quietly needing manual approval again.\nexport const WORKFLOW_FILES = ['pr.yml', 'publish.yml'] as const;\n\n/**\n * The uniform branch-protection profile every `@_linked` repo runs on `main`.\n *\n * The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked\n * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is\n * `checks`. A repo pinning the bare name waits forever on a check that never reports.\n */\nexport function buildBranchProtectionPayload() {\n  return {\n    required_status_checks: {strict: false, contexts: ['checks / Build & Test']},\n    // Admins included: the point of the gate is that no release skips the build, and the people\n    // most likely to push straight to main are the admins.\n    enforce_admins: true,\n    // Reviews enabled but zero approvals required. The publish workflow direct-merges the version\n    // PR (GitHub's auto-merge queue does not honor review-bypass allowances), so a non-zero count\n    // would stall every release; the block itself still has to exist for the profile to match.\n    required_pull_request_reviews: {\n      required_approving_review_count: 0,\n      dismiss_stale_reviews: false,\n      require_code_owner_reviews: false,\n    },\n    restrictions: null,\n    allow_force_pushes: false,\n    allow_deletions: false,\n  };\n}\n\nexport type SetupPublishOptions = {\n  configureGithub?: boolean;\n  /**\n   * @deprecated The npm secret is `NPM_AUTH_TOKEN` in every org, holding a token for that\n   * org's own npm scope — there is no longer a second name to select between. Kept as an\n   * accepted no-op for the same reason as `dualBranch`: commander aborts the whole command\n   * on an unknown option, so a stale script would fail to set the repo up at all rather\n   * than setting it up correctly.\n   */\n  scope?: string;\n  /**\n   * @deprecated The dual-branch (`main` + `dev`) flow and its `@next` prereleases are retired —\n   * every package repo is `main`-only. Kept as an accepted no-op rather than removed because\n   * commander aborts the whole command on an unknown option, so a stale script or copied\n   * command line would fail to set the repo up at all instead of setting it up correctly.\n   */\n  dualBranch?: boolean;\n  grantTeam?: string; // GitHub team slug to grant push access on the repo\n};\n\n/**\n * Set up the changesets publish pipeline in the current package repo.\n *\n * The workflows are thin callers of the shared reusable workflows in the repo's OWN org\n * `.github` repo (pinned `@v1`, a deliberately moving tag) — one edit there changes every\n * package's pipeline in that org, which is why nothing about the build or publish steps is\n * scaffolded per repo any more. Each org keeps its own copy so that community gates can be\n * stricter than first-party ones without a cross-org `workflow_call`.\n *\n * Installs:\n * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else\n * - .changeset/config.json + README.md\n * - .changeset/initial-release.md\n * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts\n * - package.json: @changesets/cli + @changesets/changelog-github devDeps,\n *   publishConfig: {access: public}\n * - package-lock.json generated via npm install --package-lock-only\n *\n * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform\n * branch-protection profile on main and enables auto-merge.\n */\nexport async function setupPublish(opts: SetupPublishOptions = {}): Promise<void> {\n  const cwd = process.cwd();\n  // One secret NAME across every org. The orgs are separate, so each holds its own value —\n  // a token scoped to that org's npm scope. (There used to be an `NPM_AUTH_TOKEN_CM` for\n  // `@linked.cm`; that dates from before first-party and community repos were split into two\n  // orgs and one org therefore had to hold both tokens at once.)\n  const npmSecretName = 'NPM_AUTH_TOKEN';\n\n  console.log(chalk.magenta('Setting up the publish pipeline (main only)...'));\n  if (opts.scope) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --scope is deprecated and ignored: every org uses NPM_AUTH_TOKEN, holding that\\n' +\n          \"    org's own token. The NPM_AUTH_TOKEN_CM name is retired.\",\n      ),\n    );\n  }\n  if (opts.dualBranch) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --dual-branch is deprecated and ignored: the main + dev flow and its @next prereleases are retired.',\n      ),\n    );\n  }\n  console.log(`  target: ${cwd}`);\n  console.log(`  npm secret: ${npmSecretName}`);\n\n  const pkgJsonPath = path.join(cwd, 'package.json');\n  if (!fs.existsSync(pkgJsonPath)) {\n    console.error(chalk.red('No package.json found in current directory. Run from the repo root.'));\n    process.exit(1);\n  }\n\n  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));\n  const repoSlug = await resolveRepoSlug(cwd, pkgJson);\n\n  console.log(`  repo: ${repoSlug}`);\n  console.log('');\n\n  // 1. Workflow files. The caller stubs point at the shared workflows in this repo's own org,\n  //    so a repo in linked-cm never reaches into linked-fw for its CI.\n  const workflowOrg = repoSlug.split('/')[0];\n  if (workflowOrg === 'OWNER') {\n    console.warn(\n      chalk.yellow(\n        '  ⚠ The repo slug is unknown, so the workflow stubs will call OWNER/.github — which does\\n' +\n          '    not exist. Set the git remote (or package.json repository) and rerun, or fix the\\n' +\n          '    `uses:` line in .github/workflows/{pr,publish}.yml by hand.',\n      ),\n    );\n  }\n  const requireTests = hasTestScript(pkgJson);\n  if (!requireTests) {\n    console.warn(\n      chalk.yellow(\n        '  ⚠ package.json has no `test` script, so pr.yml is written with require-tests: false.\\n' +\n          '    Set it to true in .github/workflows/pr.yml once the package has a test suite.',\n      ),\n    );\n  }\n  await copyWorkflows(cwd, {workflowOrg, requireTests});\n\n  // 2. Changesets config + README\n  await copyChangesetConfig(cwd, repoSlug);\n\n  // 3. Initial changeset\n  await writeInitialChangeset(cwd, pkgJson.name);\n\n  // 4. .gitignore\n  await updateGitignore(cwd);\n\n  // 5. package.json patches\n  await patchPackageJson(pkgJsonPath, pkgJson, repoSlug);\n\n  // 6. npm install --package-lock-only to generate lockfile (if not present)\n  await ensureLockfile(cwd);\n\n  // 7. Optional: configure GitHub branch protection\n  if (opts.configureGithub) {\n    await configureGithub(repoSlug);\n  }\n\n  // 8. Optional: grant a GitHub team push access\n  if (opts.grantTeam) {\n    await grantTeamAccess(repoSlug, opts.grantTeam);\n  }\n\n  // Summary + manual steps\n  printNextSteps(repoSlug, npmSecretName, opts.configureGithub, opts.grantTeam);\n}\n\nasync function resolveRepoSlug(cwd: string, pkgJson: any): Promise<string> {\n  // Try git remote first\n  try {\n    const remoteUrl = await execPromise('git config --get remote.origin.url', false, false, {cwd});\n    const m = typeof remoteUrl === 'string' ? remoteUrl.match(/[:/]([^/:]+\\/[^/]+?)(?:\\.git)?\\s*$/) : null;\n    if (m) return m[1];\n  } catch {\n    // fall through\n  }\n  // Fallback: parse package.json repository\n  const repoField = pkgJson.repository;\n  if (typeof repoField === 'string') {\n    const m = repoField.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  } else if (repoField?.url) {\n    const m = repoField.url.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  }\n  console.warn(chalk.yellow('Could not determine repo slug. Using placeholder \"OWNER/REPO\" — update .changeset/config.json manually.'));\n  return 'OWNER/REPO';\n}\n\n/**\n * Whether the package has a `test` script for the PR check to run. `require-tests: true` turns a\n * missing script into a failure, so it is only safe to write once one exists — and a fresh\n * `create-package` scaffold has none.\n */\nexport function hasTestScript(pkgJson: {scripts?: Record<string, unknown>}): boolean {\n  const test = pkgJson.scripts?.test;\n  return typeof test === 'string' && test.trim() !== '';\n}\n\nexport type WorkflowVars = {workflowOrg: string; requireTests: boolean};\n\nexport function renderWorkflow(template: string, vars: WorkflowVars): string {\n  return template\n    .replace(/\\{\\{WORKFLOW_ORG\\}\\}/g, vars.workflowOrg)\n    .replace(/\\{\\{REQUIRE_TESTS\\}\\}/g, String(vars.requireTests));\n}\n\nasync function copyWorkflows(cwd: string, vars: WorkflowVars): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');\n  const dstDir = path.join(cwd, '.github', 'workflows');\n  fs.mkdirpSync(dstDir);\n\n  for (const file of WORKFLOW_FILES) {\n    const content = renderWorkflow(fs.readFileSync(path.join(srcDir, file), 'utf8'), vars);\n    fs.writeFileSync(path.join(dstDir, file), content);\n    console.log(chalk.green('  ✓') + ` .github/workflows/${file}`);\n  }\n\n  // ci.yml and changeset-check.yml became the two jobs of the shared pr.yml. Left behind on a\n  // repo that was set up before the consolidation they keep running, so the old bare\n  // `Build & Test` check reports alongside `checks / Build & Test` and re-setting a repo up\n  // looks like it worked while the duplicate gate quietly stays.\n  for (const stale of ['ci.yml', 'changeset-check.yml']) {\n    const stalePath = path.join(dstDir, stale);\n    if (fs.existsSync(stalePath)) {\n      fs.removeSync(stalePath);\n      console.log(chalk.green('  ✓') + ` removed superseded .github/workflows/${stale}`);\n    }\n  }\n}\n\nasync function copyChangesetConfig(cwd: string, repoSlug: string): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'changeset');\n  const dstDir = path.join(cwd, '.changeset');\n  fs.mkdirpSync(dstDir);\n\n  let configContent = fs.readFileSync(path.join(srcDir, 'config.json'), 'utf8');\n  configContent = configContent.replace(/\\{\\{REPO_SLUG\\}\\}/g, repoSlug);\n  fs.writeFileSync(path.join(dstDir, 'config.json'), configContent);\n  console.log(chalk.green('  ✓') + ' .changeset/config.json');\n\n  fs.copyFileSync(path.join(srcDir, 'README.md'), path.join(dstDir, 'README.md'));\n  console.log(chalk.green('  ✓') + ' .changeset/README.md');\n}\n\nasync function writeInitialChangeset(cwd: string, pkgName: string): Promise<void> {\n  const changelogPath = path.join(cwd, 'CHANGELOG.md');\n  if (fs.existsSync(changelogPath)) {\n    console.log(chalk.gray('  · CHANGELOG.md exists — skipping initial changeset'));\n    return;\n  }\n  const initial = path.join(cwd, '.changeset', 'initial-release.md');\n  const body = `---\\n'${pkgName}': patch\\n---\\n\\nInitial release under the new publishing setup.\\n`;\n  fs.writeFileSync(initial, body);\n  console.log(chalk.green('  ✓') + ' .changeset/initial-release.md');\n}\n\nasync function updateGitignore(cwd: string): Promise<void> {\n  const gitignorePath = path.join(cwd, '.gitignore');\n  const entries = [\n    'node_modules/',\n    'lib/',\n    'yarn.lock',\n    '*.log',\n    '.DS_Store',\n    '',\n    '# tsc sourcemap output — always in lib/, never src/.',\n    '# (.d.ts not ignored — hand-written type declarations like colors.d.ts',\n    '#  are legit src files.)',\n    'src/**/*.js.map',\n  ];\n  const existing = fs.existsSync(gitignorePath)\n    ? fs.readFileSync(gitignorePath, 'utf8').split('\\n')\n    : [];\n  const existingSet = new Set(existing.map((l) => l.trim()));\n  const toAdd = entries.filter((e) => e && !existingSet.has(e.trim()));\n  if (toAdd.length === 0) {\n    console.log(chalk.gray('  · .gitignore already has all entries'));\n    return;\n  }\n  const merged = [\n    ...existing.filter((l) => l.trim() !== ''),\n    '',\n    ...entries,\n  ].join('\\n');\n  fs.writeFileSync(gitignorePath, merged + '\\n');\n  console.log(chalk.green('  ✓') + ' .gitignore');\n}\n\nasync function patchPackageJson(\n  pkgJsonPath: string,\n  pkgJson: any,\n  repoSlug: string,\n): Promise<void> {\n  if (applyPackageJsonPatches(pkgJson, repoSlug)) {\n    fs.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n    console.log(chalk.green('  ✓') + ' package.json (publishConfig + changesets devDeps)');\n  } else {\n    console.log(chalk.gray('  · package.json already configured'));\n  }\n}\n\n/** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */\nexport function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean {\n  let modified = false;\n\n  // `repository.url` must be set, and must match the repo the workflow builds in.\n  //\n  // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose\n  // attestation cannot be matched against it:\n  //\n  //   422 Error verifying sigstore provenance bundle: Failed to validate repository\n  //   information: package.json \"repository.url\" is \"\", expected to match <repo>\n  //\n  // The slug is already resolved from `git remote` above, so there is no reason to leave a\n  // package to discover this at its first release.\n  if (repoSlug !== 'OWNER/REPO') {\n    const url = `git+https://github.com/${repoSlug}.git`;\n    const current =\n      typeof pkgJson.repository === 'string'\n        ? pkgJson.repository\n        : pkgJson.repository?.url;\n    if (!current) {\n      pkgJson.repository = {type: 'git', url};\n      modified = true;\n    }\n  }\n\n  if (!pkgJson.publishConfig) {\n    pkgJson.publishConfig = {access: 'public'};\n    modified = true;\n  } else {\n    if (pkgJson.publishConfig.access !== 'public') {\n      pkgJson.publishConfig.access = 'public';\n      modified = true;\n    }\n    // `provenance` is deliberately left alone. It used to be stripped because publishing went\n    // through NPM_AUTH_TOKEN only; the shared workflow now publishes with OIDC trusted publishing\n    // first (`npm publish --provenance`, id-token: write on both caller and reusable workflow) and\n    // falls back to the staged token release, so provenance is wanted, not a conflict.\n  }\n\n  pkgJson.devDependencies = pkgJson.devDependencies || {};\n  if (!pkgJson.devDependencies['@changesets/cli']) {\n    pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';\n    modified = true;\n  }\n  if (!pkgJson.devDependencies['@changesets/changelog-github']) {\n    pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';\n    modified = true;\n  }\n\n  return modified;\n}\n\nasync function ensureLockfile(cwd: string): Promise<void> {\n  // Always regenerate — package.json has just been patched (new devDeps etc.),\n  // so any existing lockfile is stale.\n  console.log(chalk.magenta('  Running npm install --package-lock-only...'));\n\n  // When running inside a yarn workspace (e.g. CN's packages/* layout), npm\n  // climbs up, detects the parent workspace, and writes the lockfile at the\n  // wrong level. Work around by copying the package to a tmpdir, generating\n  // the lockfile in isolation, and copying it back.\n  const os = await import('os');\n  const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));\n  const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));\n  try {\n    const pkgJsonPath = path.join(cwd, 'package.json');\n    fs.copyFileSync(pkgJsonPath, path.join(tmpBase, 'package.json'));\n    await execp(\n      `npm install --legacy-peer-deps --package-lock-only --cache ${cacheDir}`,\n      false,\n      true,\n      {cwd: tmpBase},\n    );\n    const lockPath = path.join(tmpBase, 'package-lock.json');\n    if (fs.existsSync(lockPath)) {\n      fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));\n      console.log(chalk.green('  ✓') + ' package-lock.json');\n    } else {\n      console.warn(chalk.yellow('  ⚠ npm install did not produce a package-lock.json — likely because a dependency is not yet published on npm.'));\n      console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n    }\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to generate package-lock.json — likely because a dependency is not yet published on npm.'));\n    console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n  } finally {\n    fs.removeSync(tmpBase);\n    fs.removeSync(cacheDir);\n  }\n}\n\nasync function configureGithub(repoSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta('Configuring GitHub (branch protection)...'));\n\n  // Check gh CLI available\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --configure-github,'));\n    console.warn(chalk.yellow('    or set branch protection manually at https://github.com/' + repoSlug + '/settings/branches'));\n    return;\n  }\n\n  // Check gh CLI authenticated\n  try {\n    await execPromise('gh auth status', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI is not authenticated. Run `gh auth login` and retry.'));\n    return;\n  }\n\n  const payload = JSON.stringify(buildBranchProtectionPayload());\n\n  try {\n    // Use --input - to pass the JSON payload via stdin\n    await execPromise(\n      `echo '${payload.replace(/'/g, \"'\\\\''\")}' | gh api -X PUT /repos/${repoSlug}/branches/main/protection --input -`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` branch protection enabled on ${repoSlug}/main`);\n    // A repo can pin a required check in a *ruleset* as well as in classic branch protection, and\n    // the two are stored separately — this call only writes the classic one, so a leftover ruleset\n    // keeps blocking merges on a check name that no longer reports.\n    console.log(\n      chalk.gray(`  · check for a competing ruleset: gh api /repos/${repoSlug}/rulesets`),\n    );\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to set branch protection. Do it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings/branches`));\n  }\n\n  // Enable \"Allow auto-merge\" so a PR can be queued to merge itself once checks pass. The publish\n  // workflow authors the Release PR via the org App token (org secrets RELEASE_APP_ID /\n  // RELEASE_APP_PRIVATE_KEY) so its CI runs without a manual approval gate.\n  try {\n    await execPromise(\n      `gh api -X PATCH /repos/${repoSlug} -F allow_auto_merge=true`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` auto-merge enabled on ${repoSlug}`);\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to enable auto-merge. Enable it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings (General → Allow auto-merge)`));\n  }\n}\n\nasync function grantTeamAccess(repoSlug: string, teamSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta(`Granting '${teamSlug}' team push access to ${repoSlug}...`));\n\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow(\"  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --grant-team,\"));\n    console.warn(chalk.yellow(`    or add the team manually at https://github.com/${repoSlug}/settings/access`));\n    return;\n  }\n\n  const [owner, repo] = repoSlug.split('/');\n  try {\n    await execPromise(\n      `gh api -X PUT /orgs/${owner}/teams/${teamSlug}/repos/${owner}/${repo} -f permission=push`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` team '${teamSlug}' granted push access on ${repoSlug}`);\n  } catch (err: any) {\n    const msg = err?.stderr || err?.stdout || String(err);\n    console.warn(chalk.yellow(`  ⚠ Failed to grant team access: ${msg.slice(0, 200)}`));\n    console.warn(chalk.yellow(`    Team may not exist in org '${owner}', or you may lack admin rights.`));\n    console.warn(chalk.yellow(`    Manual: https://github.com/${repoSlug}/settings/access`));\n  }\n}\n\nfunction printNextSteps(\n  repoSlug: string,\n  npmSecretName: string,\n  configuredGithub: boolean | undefined,\n  grantedTeam: string | undefined,\n): void {\n  console.log('');\n  console.log(chalk.green('Done.'));\n  console.log('');\n  console.log(chalk.bold('Next steps:'));\n  console.log('');\n  const [owner, repo] = repoSlug.split('/');\n\n  console.log(`  1. Review the generated files, adjust as needed.`);\n  console.log(`  2. Commit:`);\n  console.log(chalk.cyan('       git add . && git commit -m \"set up the publish pipeline\"'));\n  console.log(`  3. Push to main — the publish workflow will trigger.`);\n  console.log('');\n  console.log(chalk.bold('Register the trusted publisher on npmjs.com (before the first release):'));\n  console.log('');\n  console.log(`  package → Settings → Trusted Publisher, matching the caller workflow exactly:`);\n  console.log(`    organization: ${chalk.cyan(owner)}   repository: ${chalk.cyan(repo)}`);\n  console.log(`    workflow filename: ${chalk.cyan('publish.yml')}   environment: ${chalk.cyan('(empty)')}`);\n  console.log(`    \"Allow npm publish\": ${chalk.cyan('ticked')}`);\n  console.log('');\n  console.log(chalk.gray(`  Without it the release still ships — the workflow falls back to a staged`));\n  console.log(chalk.gray(`  npm release that a maintainer approves with 2FA. A typo in the organization`));\n  console.log(chalk.gray(`  field looks exactly the same, so check that field first if a package that`));\n  console.log(chalk.gray(`  should publish directly keeps staging instead.`));\n  console.log('');\n  // No per-repo secret grant step: NPM_AUTH_TOKEN, RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are\n  // \"All repositories\" org secrets, which is the whole reason first-party and community packages\n  // live in separate orgs. Only mention what is genuinely still one-time-per-org.\n  console.log(chalk.bold(`One-time org-level setup (already done on linked-fw and linked-cm):`));\n  console.log('');\n  console.log(`  a. Org secrets ${chalk.cyan(npmSecretName)}, ${chalk.cyan('RELEASE_APP_ID')} and ${chalk.cyan('RELEASE_APP_PRIVATE_KEY')},`);\n  console.log(`     visible to ${chalk.cyan('All repositories')} — there is no per-repo grant step.`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/secrets/actions`);\n  console.log('');\n  console.log(`  b. Enable \"Allow GitHub Actions to create and approve pull requests\":`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/actions`);\n\n  if (!configuredGithub) {\n    console.log('');\n    console.log(chalk.bold('Branch protection:'));\n    console.log(`  Rerun with ${chalk.cyan('linked setup-publish --configure-github')} to configure automatically,`);\n    console.log(`  or set manually at https://github.com/${repoSlug}/settings/branches —`);\n    console.log(`  the required check is ${chalk.cyan('checks / Build & Test')}, not ${chalk.cyan('Build & Test')}.`);\n  }\n  console.log('');\n}\n"]}
+{"version":3,"file":"setup-publish.js","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,EAAE,EAAC,OAAO,EAAC,MAAM,MAAM,CAAC;AACnC,OAAO,EAAC,KAAK,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AAE/C,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,WAAW;IAC9B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErD,wEAAwE;AACxE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAE7F,2FAA2F;AAC3F,0FAA0F;AAC1F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,sBAAsB,EAAE,EAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAC;QAC5E,4FAA4F;QAC5F,uDAAuD;QACvD,cAAc,EAAE,IAAI;QACpB,8FAA8F;QAC9F,8FAA8F;QAC9F,2FAA2F;QAC3F,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,CAAC;YAClC,qBAAqB,EAAE,KAAK;YAC5B,0BAA0B,EAAE,KAAK;SAClC;QACD,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAgB,YAAY;yDAAC,OAA4B,EAAE;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,yFAAyF;QACzF,uFAAuF;QACvF,2FAA2F;QAC3F,+DAA+D;QAC/D,MAAM,aAAa,GAAG,gBAAgB,CAAC;QAEvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,sFAAsF;gBACpF,6DAA6D,CAChE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,yGAAyG,CAC1G,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,4FAA4F;QAC5F,qEAAqE;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,4FAA4F;gBAC1F,wFAAwF;gBACxF,iEAAiE,CACpE,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,0FAA0F;gBACxF,mFAAmF,CACtF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,WAAW,EAAE,YAAY,EAAC,CAAC,CAAC;QAEtD,gCAAgC;QAChC,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEzC,uBAAuB;QACvB,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,gBAAgB;QAChB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAE3B,0BAA0B;QAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,yFAAyF;QACzF,MAAM,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAEpC,0DAA0D;QAC1D,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAE5C,2EAA2E;QAC3E,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAE1B,kDAAkD;QAClD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,yBAAyB;QACzB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW,EAAE,OAAY;;QACtD,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oCAAoC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;YAC/F,MAAM,CAAC,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvG,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,WAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvE,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3E,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yGAAyG,CAAC,CAAC,CAAC;QACtI,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAA4C;;IACxE,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,CAAC;IACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC;AAID,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAkB;IACjE,OAAO,QAAQ;SACZ,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,WAAW,CAAC;SAClD,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAe,aAAa,CAAC,GAAW,EAAE,IAAkB;;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YACvF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,4FAA4F;QAC5F,mFAAmF;QACnF,0FAA0F;QAC1F,+DAA+D;QAC/D,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yCAAyC,KAAK,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;CAAA;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,QAAgB;;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAE5D,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC;IAC5D,CAAC;CAAA;AAED,SAAe,qBAAqB,CAAC,GAAW,EAAE,OAAe;;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,OAAO,oEAAoE,CAAC;QAClG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC;IACrE,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,GAAW;;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,eAAe;YACf,MAAM;YACN,WAAW;YACX,OAAO;YACP,WAAW;YACX,EAAE;YACF,sDAAsD;YACtD,wEAAwE;YACxE,0BAA0B;YAC1B,iBAAiB;SAClB,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAC1C,EAAE;YACF,GAAG,OAAO;SACX,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;IAClD,CAAC;CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,MAAM,QAAQ,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtC,IAAI,WAAW,KAAK,WAAW;QAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAAkB;IAC7D,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,QAAQ;SACL,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACxE,GAAG,CAAC,KAAK,CAAC,CACd,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;IACrF,OAAO,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC1C,CAAC;AAED,SAAe,WAAW,CAAC,GAAW,EAAE,WAAmB;;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC;IAC9C,CAAC;CAAA;AAED,gGAAgG;AAChG,yCAAyC;AACzC,MAAM,qBAAqB,GAAG;IAC5B,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,aAAa;IACb,kBAAkB;IAClB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,OAAO,CACL,IAAI,CAAC,SAAS,CACZ;QACE,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,CAAC,SAAS,WAAW,kBAAkB,CAAC;KAClD,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;AACJ,CAAC;AAED,SAAe,mBAAmB,CAAC,GAAW,EAAE,WAAmB;;QACjE,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qDAAqD,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,sBAAsB,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,2BAA2B,WAAW,mBAAmB,CAAC,CAAC;IAC9F,CAAC;CAAA;AAED,SAAe,gBAAgB,CAC7B,WAAmB,EACnB,OAAY,EACZ,QAAgB;;QAEhB,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oDAAoD,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,OAAY,EAAE,QAAgB;;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,gFAAgF;IAChF,EAAE;IACF,yFAAyF;IACzF,4CAA4C;IAC5C,EAAE;IACF,kFAAkF;IAClF,+EAA+E;IAC/E,EAAE;IACF,yFAAyF;IACzF,iDAAiD;IACjD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,0BAA0B,QAAQ,MAAM,CAAC;QACrD,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,MAAA,OAAO,CAAC,UAAU,0CAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,GAAG,EAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,aAAa,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAC,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC;YACxC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;IACrF,CAAC;IAED,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QACtD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC;QACnE,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAe,cAAc,CAAC,GAAW;;QACvC,6EAA6E;QAC7E,qCAAqC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;YAC9F,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,KAAK,CACT,4DAA4D,QAAQ,EAAE,EACtE,KAAK,EACL,IAAI,EACJ,EAAC,GAAG,EAAE,OAAO,EAAC,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gHAAgH,CAAC,CAAC,CAAC;gBAC7I,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qGAAqG,CAAC,CAAC,CAAC;YAClI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB;;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAExE,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iGAAiG,CAAC,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,8DAA8D,GAAG,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,WAAW,CACf,SAAS,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,4BAA4B,QAAQ,qCAAqC,EAChH,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,iCAAiC,QAAQ,OAAO,CAAC,CAAC;YACnF,8FAA8F;YAC9F,+FAA+F;YAC/F,gEAAgE;YAChE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,oDAAoD,QAAQ,WAAW,CAAC,CACpF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,oBAAoB,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,gGAAgG;QAChG,sFAAsF;QACtF,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,WAAW,CACf,0BAA0B,QAAQ,2BAA2B,EAC7D,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,QAAQ,wCAAwC,CAAC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;CAAA;AAED,SAAe,eAAe,CAAC,QAAgB,EAAE,QAAgB;;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,QAAQ,yBAAyB,QAAQ,KAAK,CAAC,CAAC,CAAC;QAExF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2FAA2F,CAAC,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,QAAQ,kBAAkB,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,WAAW,CACf,uBAAuB,KAAK,UAAU,QAAQ,UAAU,KAAK,IAAI,IAAI,qBAAqB,EAC1F,KAAK,EACL,KAAK,CACN,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,QAAQ,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,MAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAA,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,QAAQ,kBAAkB,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CAAA;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,aAAqB,EACrB,gBAAqC,EACrC,WAA+B;IAE/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,gGAAgG;IAChG,+FAA+F;IAC/F,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,2BAA2B,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,mBAAmB,CAAC,CAAC;IAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,8BAA8B,CAAC,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,2CAA2C,QAAQ,sBAAsB,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import chalk from 'chalk';\nimport fs from 'fs-extra';\nimport path, {dirname} from 'path';\nimport {execp, execPromise} from '../utils.js';\n\nconst dirname__ =\n  typeof __dirname !== 'undefined'\n    ? __dirname\n    : //@ts-ignore\n      dirname(import.meta.url).replace('file:/', '');\n\n// defaults/setup-publish/ lives at packages/cli/defaults/setup-publish/\n// This file compiles to lib/{esm,cjs}/commands/setup-publish.js — go up three\n// levels to reach the package root, then into defaults/setup-publish.\nconst TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'setup-publish');\n\n// Both are callers of the shared reusable workflows. `publish.yml` in particular cannot be\n// renamed: npm's trusted-publisher check validates the calling workflow's filename, and a\n// mismatch only shows up as releases quietly needing manual approval again.\nexport const WORKFLOW_FILES = ['pr.yml', 'publish.yml'] as const;\n\n/**\n * The uniform branch-protection profile every `@_linked` repo runs on `main`.\n *\n * The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked\n * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is\n * `checks`. A repo pinning the bare name waits forever on a check that never reports.\n */\nexport function buildBranchProtectionPayload() {\n  return {\n    required_status_checks: {strict: false, contexts: ['checks / Build & Test']},\n    // Admins included: the point of the gate is that no release skips the build, and the people\n    // most likely to push straight to main are the admins.\n    enforce_admins: true,\n    // Reviews enabled but zero approvals required. The publish workflow direct-merges the version\n    // PR (GitHub's auto-merge queue does not honor review-bypass allowances), so a non-zero count\n    // would stall every release; the block itself still has to exist for the profile to match.\n    required_pull_request_reviews: {\n      required_approving_review_count: 0,\n      dismiss_stale_reviews: false,\n      require_code_owner_reviews: false,\n    },\n    restrictions: null,\n    allow_force_pushes: false,\n    allow_deletions: false,\n  };\n}\n\nexport type SetupPublishOptions = {\n  configureGithub?: boolean;\n  /**\n   * @deprecated The npm secret is `NPM_AUTH_TOKEN` in every org, holding a token for that\n   * org's own npm scope — there is no longer a second name to select between. Kept as an\n   * accepted no-op for the same reason as `dualBranch`: commander aborts the whole command\n   * on an unknown option, so a stale script would fail to set the repo up at all rather\n   * than setting it up correctly.\n   */\n  scope?: string;\n  /**\n   * @deprecated The dual-branch (`main` + `dev`) flow and its `@next` prereleases are retired —\n   * every package repo is `main`-only. Kept as an accepted no-op rather than removed because\n   * commander aborts the whole command on an unknown option, so a stale script or copied\n   * command line would fail to set the repo up at all instead of setting it up correctly.\n   */\n  dualBranch?: boolean;\n  grantTeam?: string; // GitHub team slug to grant push access on the repo\n};\n\n/**\n * Set up the changesets publish pipeline in the current package repo.\n *\n * The workflows are thin callers of the shared reusable workflows in the repo's OWN org\n * `.github` repo (pinned `@v1`, a deliberately moving tag) — one edit there changes every\n * package's pipeline in that org, which is why nothing about the build or publish steps is\n * scaffolded per repo any more. Each org keeps its own copy so that community gates can be\n * stricter than first-party ones without a cross-org `workflow_call`.\n *\n * Installs:\n * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else\n * - .changeset/config.json + README.md\n * - .changeset/initial-release.md\n * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts\n * - package.json: @changesets/cli + @changesets/changelog-github devDeps,\n *   publishConfig: {access: public}\n * - .npmrc: allow-remote=all, plus legacy-peer-deps=true in linked-cm (see npmrcSettings);\n *   keys the repo already sets are left alone\n * - renovate.json extending <org>/renovate-config, unless the repo has a Renovate config\n * - package-lock.json refreshed via npm install --package-lock-only, keeping existing resolutions\n *\n * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform\n * branch-protection profile on main and enables auto-merge.\n */\nexport async function setupPublish(opts: SetupPublishOptions = {}): Promise<void> {\n  const cwd = process.cwd();\n  // One secret NAME across every org. The orgs are separate, so each holds its own value —\n  // a token scoped to that org's npm scope. (There used to be an `NPM_AUTH_TOKEN_CM` for\n  // `@linked.cm`; that dates from before first-party and community repos were split into two\n  // orgs and one org therefore had to hold both tokens at once.)\n  const npmSecretName = 'NPM_AUTH_TOKEN';\n\n  console.log(chalk.magenta('Setting up the publish pipeline (main only)...'));\n  if (opts.scope) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --scope is deprecated and ignored: every org uses NPM_AUTH_TOKEN, holding that\\n' +\n          \"    org's own token. The NPM_AUTH_TOKEN_CM name is retired.\",\n      ),\n    );\n  }\n  if (opts.dualBranch) {\n    console.log(\n      chalk.yellow(\n        '  ⚠ --dual-branch is deprecated and ignored: the main + dev flow and its @next prereleases are retired.',\n      ),\n    );\n  }\n  console.log(`  target: ${cwd}`);\n  console.log(`  npm secret: ${npmSecretName}`);\n\n  const pkgJsonPath = path.join(cwd, 'package.json');\n  if (!fs.existsSync(pkgJsonPath)) {\n    console.error(chalk.red('No package.json found in current directory. Run from the repo root.'));\n    process.exit(1);\n  }\n\n  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));\n  const repoSlug = await resolveRepoSlug(cwd, pkgJson);\n\n  console.log(`  repo: ${repoSlug}`);\n  console.log('');\n\n  // 1. Workflow files. The caller stubs point at the shared workflows in this repo's own org,\n  //    so a repo in linked-cm never reaches into linked-fw for its CI.\n  const workflowOrg = repoSlug.split('/')[0];\n  if (workflowOrg === 'OWNER') {\n    console.warn(\n      chalk.yellow(\n        '  ⚠ The repo slug is unknown, so the workflow stubs will call OWNER/.github — which does\\n' +\n          '    not exist. Set the git remote (or package.json repository) and rerun, or fix the\\n' +\n          '    `uses:` line in .github/workflows/{pr,publish}.yml by hand.',\n      ),\n    );\n  }\n  const requireTests = hasTestScript(pkgJson);\n  if (!requireTests) {\n    console.warn(\n      chalk.yellow(\n        '  ⚠ package.json has no `test` script, so pr.yml is written with require-tests: false.\\n' +\n          '    Set it to true in .github/workflows/pr.yml once the package has a test suite.',\n      ),\n    );\n  }\n  await copyWorkflows(cwd, {workflowOrg, requireTests});\n\n  // 2. Changesets config + README\n  await copyChangesetConfig(cwd, repoSlug);\n\n  // 3. Initial changeset\n  await writeInitialChangeset(cwd, pkgJson.name);\n\n  // 4. .gitignore\n  await updateGitignore(cwd);\n\n  // 5. package.json patches\n  await patchPackageJson(pkgJsonPath, pkgJson, repoSlug);\n\n  // 6. .npmrc — before the lockfile step, which must resolve under the same settings as CI\n  await updateNpmrc(cwd, workflowOrg);\n\n  // 7. renovate.json stub extending the org's shared policy\n  await writeRenovateConfig(cwd, workflowOrg);\n\n  // 8. npm install --package-lock-only to generate lockfile (if not present)\n  await ensureLockfile(cwd);\n\n  // 9. Optional: configure GitHub branch protection\n  if (opts.configureGithub) {\n    await configureGithub(repoSlug);\n  }\n\n  // 10. Optional: grant a GitHub team push access\n  if (opts.grantTeam) {\n    await grantTeamAccess(repoSlug, opts.grantTeam);\n  }\n\n  // Summary + manual steps\n  printNextSteps(repoSlug, npmSecretName, opts.configureGithub, opts.grantTeam);\n}\n\nasync function resolveRepoSlug(cwd: string, pkgJson: any): Promise<string> {\n  // Try git remote first\n  try {\n    const remoteUrl = await execPromise('git config --get remote.origin.url', false, false, {cwd});\n    const m = typeof remoteUrl === 'string' ? remoteUrl.match(/[:/]([^/:]+\\/[^/]+?)(?:\\.git)?\\s*$/) : null;\n    if (m) return m[1];\n  } catch {\n    // fall through\n  }\n  // Fallback: parse package.json repository\n  const repoField = pkgJson.repository;\n  if (typeof repoField === 'string') {\n    const m = repoField.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  } else if (repoField?.url) {\n    const m = repoField.url.match(/github\\.com[:/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n    if (m) return m[1];\n  }\n  console.warn(chalk.yellow('Could not determine repo slug. Using placeholder \"OWNER/REPO\" — update .changeset/config.json manually.'));\n  return 'OWNER/REPO';\n}\n\n/**\n * Whether the package has a `test` script for the PR check to run. `require-tests: true` turns a\n * missing script into a failure, so it is only safe to write once one exists — and a fresh\n * `create-package` scaffold has none.\n */\nexport function hasTestScript(pkgJson: {scripts?: Record<string, unknown>}): boolean {\n  const test = pkgJson.scripts?.test;\n  return typeof test === 'string' && test.trim() !== '';\n}\n\nexport type WorkflowVars = {workflowOrg: string; requireTests: boolean};\n\nexport function renderWorkflow(template: string, vars: WorkflowVars): string {\n  return template\n    .replace(/\\{\\{WORKFLOW_ORG\\}\\}/g, vars.workflowOrg)\n    .replace(/\\{\\{REQUIRE_TESTS\\}\\}/g, String(vars.requireTests));\n}\n\nasync function copyWorkflows(cwd: string, vars: WorkflowVars): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');\n  const dstDir = path.join(cwd, '.github', 'workflows');\n  fs.mkdirpSync(dstDir);\n\n  for (const file of WORKFLOW_FILES) {\n    const content = renderWorkflow(fs.readFileSync(path.join(srcDir, file), 'utf8'), vars);\n    fs.writeFileSync(path.join(dstDir, file), content);\n    console.log(chalk.green('  ✓') + ` .github/workflows/${file}`);\n  }\n\n  // ci.yml and changeset-check.yml became the two jobs of the shared pr.yml. Left behind on a\n  // repo that was set up before the consolidation they keep running, so the old bare\n  // `Build & Test` check reports alongside `checks / Build & Test` and re-setting a repo up\n  // looks like it worked while the duplicate gate quietly stays.\n  for (const stale of ['ci.yml', 'changeset-check.yml']) {\n    const stalePath = path.join(dstDir, stale);\n    if (fs.existsSync(stalePath)) {\n      fs.removeSync(stalePath);\n      console.log(chalk.green('  ✓') + ` removed superseded .github/workflows/${stale}`);\n    }\n  }\n}\n\nasync function copyChangesetConfig(cwd: string, repoSlug: string): Promise<void> {\n  const srcDir = path.join(TEMPLATE_ROOT, 'changeset');\n  const dstDir = path.join(cwd, '.changeset');\n  fs.mkdirpSync(dstDir);\n\n  let configContent = fs.readFileSync(path.join(srcDir, 'config.json'), 'utf8');\n  configContent = configContent.replace(/\\{\\{REPO_SLUG\\}\\}/g, repoSlug);\n  fs.writeFileSync(path.join(dstDir, 'config.json'), configContent);\n  console.log(chalk.green('  ✓') + ' .changeset/config.json');\n\n  fs.copyFileSync(path.join(srcDir, 'README.md'), path.join(dstDir, 'README.md'));\n  console.log(chalk.green('  ✓') + ' .changeset/README.md');\n}\n\nasync function writeInitialChangeset(cwd: string, pkgName: string): Promise<void> {\n  const changelogPath = path.join(cwd, 'CHANGELOG.md');\n  if (fs.existsSync(changelogPath)) {\n    console.log(chalk.gray('  · CHANGELOG.md exists — skipping initial changeset'));\n    return;\n  }\n  const initial = path.join(cwd, '.changeset', 'initial-release.md');\n  const body = `---\\n'${pkgName}': patch\\n---\\n\\nInitial release under the new publishing setup.\\n`;\n  fs.writeFileSync(initial, body);\n  console.log(chalk.green('  ✓') + ' .changeset/initial-release.md');\n}\n\nasync function updateGitignore(cwd: string): Promise<void> {\n  const gitignorePath = path.join(cwd, '.gitignore');\n  const entries = [\n    'node_modules/',\n    'lib/',\n    'yarn.lock',\n    '*.log',\n    '.DS_Store',\n    '',\n    '# tsc sourcemap output — always in lib/, never src/.',\n    '# (.d.ts not ignored — hand-written type declarations like colors.d.ts',\n    '#  are legit src files.)',\n    'src/**/*.js.map',\n  ];\n  const existing = fs.existsSync(gitignorePath)\n    ? fs.readFileSync(gitignorePath, 'utf8').split('\\n')\n    : [];\n  const existingSet = new Set(existing.map((l) => l.trim()));\n  const toAdd = entries.filter((e) => e && !existingSet.has(e.trim()));\n  if (toAdd.length === 0) {\n    console.log(chalk.gray('  · .gitignore already has all entries'));\n    return;\n  }\n  const merged = [\n    ...existing.filter((l) => l.trim() !== ''),\n    '',\n    ...entries,\n  ].join('\\n');\n  fs.writeFileSync(gitignorePath, merged + '\\n');\n  console.log(chalk.green('  ✓') + ' .gitignore');\n}\n\n/**\n * The `.npmrc` settings a package repo needs so that a local `npm install` resolves the same tree\n * as its org's shared workflows and Renovate.\n *\n * - `allow-remote=all`: npm 12 defaults `allow-remote` to `none` and then refuses the registry\n *   tarball of a bundled dependency (`@tailwindcss/oxide-wasm32-wasi` is in most of the fleet),\n *   failing `npm install` with EALLOWREMOTE. npm 11, which CI runs, accepts the setting.\n * - `legacy-peer-deps=true`, linked-cm only: its workflows install with\n *   `npm ci --legacy-peer-deps`. linked-fw's install strictly, and its Renovate policy requires\n *   locks to be resolved under CI's peer rules — so writing it there would be the mismatch.\n */\nexport function npmrcSettings(workflowOrg: string): string[] {\n  const settings = ['allow-remote=all'];\n  if (workflowOrg === 'linked-cm') settings.push('legacy-peer-deps=true');\n  return settings;\n}\n\n/**\n * Appends each setting whose key the existing `.npmrc` does not set. A key that is already set\n * keeps its value: the repo may have a reason, and silently flipping it would change installs.\n */\nexport function mergeNpmrc(existing: string, settings: string[]): string {\n  const keyOf = (line: string) => line.split('=')[0].trim();\n  const present = new Set(\n    existing\n      .split('\\n')\n      .map((line) => line.trim())\n      .filter((line) => line && !line.startsWith('#') && !line.startsWith(';'))\n      .map(keyOf),\n  );\n  const missing = settings.filter((setting) => !present.has(keyOf(setting)));\n  if (missing.length === 0) return existing;\n  const base = existing === '' || existing.endsWith('\\n') ? existing : existing + '\\n';\n  return base + missing.join('\\n') + '\\n';\n}\n\nasync function updateNpmrc(cwd: string, workflowOrg: string): Promise<void> {\n  const npmrcPath = path.join(cwd, '.npmrc');\n  const existing = fs.existsSync(npmrcPath) ? fs.readFileSync(npmrcPath, 'utf8') : '';\n  const next = mergeNpmrc(existing, npmrcSettings(workflowOrg));\n  if (next === existing) {\n    console.log(chalk.gray('  · .npmrc already has the required settings'));\n    return;\n  }\n  fs.writeFileSync(npmrcPath, next);\n  console.log(chalk.green('  ✓') + ' .npmrc');\n}\n\n// Every location Renovate reads a repo config from. If any exists, the repo has a config of its\n// own and setup-publish leaves it alone.\nconst RENOVATE_CONFIG_FILES = [\n  'renovate.json',\n  'renovate.json5',\n  '.github/renovate.json',\n  '.github/renovate.json5',\n  '.gitlab/renovate.json',\n  '.gitlab/renovate.json5',\n  '.renovaterc',\n  '.renovaterc.json',\n  '.renovaterc.json5',\n];\n\n/**\n * The three-line stub every package repo carries: the policy itself lives in the org's\n * `renovate-config` repo, so one edit there reaches the whole fleet.\n */\nexport function renovateStub(workflowOrg: string): string {\n  return (\n    JSON.stringify(\n      {\n        $schema: 'https://docs.renovatebot.com/renovate-schema.json',\n        extends: [`local>${workflowOrg}/renovate-config`],\n      },\n      null,\n      2,\n    ) + '\\n'\n  );\n}\n\nasync function writeRenovateConfig(cwd: string, workflowOrg: string): Promise<void> {\n  if (workflowOrg === 'OWNER') {\n    console.warn(chalk.yellow('  ⚠ Skipped renovate.json: the repo org is unknown.'));\n    return;\n  }\n  const existing = RENOVATE_CONFIG_FILES.find((file) => fs.existsSync(path.join(cwd, file)));\n  if (existing) {\n    console.log(chalk.gray(`  · ${existing} exists — left as is`));\n    return;\n  }\n  fs.writeFileSync(path.join(cwd, 'renovate.json'), renovateStub(workflowOrg));\n  console.log(chalk.green('  ✓') + ` renovate.json (extends ${workflowOrg}/renovate-config)`);\n}\n\nasync function patchPackageJson(\n  pkgJsonPath: string,\n  pkgJson: any,\n  repoSlug: string,\n): Promise<void> {\n  if (applyPackageJsonPatches(pkgJson, repoSlug)) {\n    fs.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n    console.log(chalk.green('  ✓') + ' package.json (publishConfig + changesets devDeps)');\n  } else {\n    console.log(chalk.gray('  · package.json already configured'));\n  }\n}\n\n/** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */\nexport function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean {\n  let modified = false;\n\n  // `repository.url` must be set, and must match the repo the workflow builds in.\n  //\n  // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose\n  // attestation cannot be matched against it:\n  //\n  //   422 Error verifying sigstore provenance bundle: Failed to validate repository\n  //   information: package.json \"repository.url\" is \"\", expected to match <repo>\n  //\n  // The slug is already resolved from `git remote` above, so there is no reason to leave a\n  // package to discover this at its first release.\n  if (repoSlug !== 'OWNER/REPO') {\n    const url = `git+https://github.com/${repoSlug}.git`;\n    const current =\n      typeof pkgJson.repository === 'string'\n        ? pkgJson.repository\n        : pkgJson.repository?.url;\n    if (!current) {\n      pkgJson.repository = {type: 'git', url};\n      modified = true;\n    }\n  }\n\n  if (!pkgJson.publishConfig) {\n    pkgJson.publishConfig = {access: 'public'};\n    modified = true;\n  } else {\n    if (pkgJson.publishConfig.access !== 'public') {\n      pkgJson.publishConfig.access = 'public';\n      modified = true;\n    }\n    // `provenance` is deliberately left alone. It used to be stripped because publishing went\n    // through NPM_AUTH_TOKEN only; the shared workflow now publishes with OIDC trusted publishing\n    // first (`npm publish --provenance`, id-token: write on both caller and reusable workflow) and\n    // falls back to the staged token release, so provenance is wanted, not a conflict.\n  }\n\n  pkgJson.devDependencies = pkgJson.devDependencies || {};\n  if (!pkgJson.devDependencies['@changesets/cli']) {\n    pkgJson.devDependencies['@changesets/cli'] = '^3.0.0';\n    modified = true;\n  }\n  if (!pkgJson.devDependencies['@changesets/changelog-github']) {\n    pkgJson.devDependencies['@changesets/changelog-github'] = '^1.0.0';\n    modified = true;\n  }\n\n  return modified;\n}\n\nasync function ensureLockfile(cwd: string): Promise<void> {\n  // Always regenerate — package.json has just been patched (new devDeps etc.),\n  // so any existing lockfile is stale.\n  console.log(chalk.magenta('  Running npm install --package-lock-only...'));\n\n  // When running inside a yarn workspace (e.g. CN's packages/* layout), npm\n  // climbs up, detects the parent workspace, and writes the lockfile at the\n  // wrong level. Work around by copying the package to a tmpdir, generating\n  // the lockfile in isolation, and copying it back.\n  const os = await import('os');\n  const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-'));\n  const cacheDir = fs.mkdtempSync(path.join(os.tmpdir(), 'linked-setup-cache-'));\n  try {\n    // The existing lockfile comes along so its resolutions are kept (only what package.json just\n    // gained is resolved), and .npmrc so the lock is resolved under the repo's own settings —\n    // allow-remote for npm 12, and legacy-peer-deps exactly where the org's CI installs that way.\n    for (const file of ['package.json', 'package-lock.json', '.npmrc']) {\n      const src = path.join(cwd, file);\n      if (fs.existsSync(src)) fs.copyFileSync(src, path.join(tmpBase, file));\n    }\n    await execp(\n      `npm install --package-lock-only --ignore-scripts --cache ${cacheDir}`,\n      false,\n      true,\n      {cwd: tmpBase},\n    );\n    const lockPath = path.join(tmpBase, 'package-lock.json');\n    if (fs.existsSync(lockPath)) {\n      fs.copyFileSync(lockPath, path.join(cwd, 'package-lock.json'));\n      console.log(chalk.green('  ✓') + ' package-lock.json');\n    } else {\n      console.warn(chalk.yellow('  ⚠ npm install did not produce a package-lock.json — likely because a dependency is not yet published on npm.'));\n      console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n    }\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to generate package-lock.json — likely because a dependency is not yet published on npm.'));\n    console.warn(chalk.yellow('    Regenerate manually once all deps are published: `npm install --package-lock-only`.'));\n  } finally {\n    fs.removeSync(tmpBase);\n    fs.removeSync(cacheDir);\n  }\n}\n\nasync function configureGithub(repoSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta('Configuring GitHub (branch protection)...'));\n\n  // Check gh CLI available\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --configure-github,'));\n    console.warn(chalk.yellow('    or set branch protection manually at https://github.com/' + repoSlug + '/settings/branches'));\n    return;\n  }\n\n  // Check gh CLI authenticated\n  try {\n    await execPromise('gh auth status', false, false);\n  } catch {\n    console.warn(chalk.yellow('  ⚠ `gh` CLI is not authenticated. Run `gh auth login` and retry.'));\n    return;\n  }\n\n  const payload = JSON.stringify(buildBranchProtectionPayload());\n\n  try {\n    // Use --input - to pass the JSON payload via stdin\n    await execPromise(\n      `echo '${payload.replace(/'/g, \"'\\\\''\")}' | gh api -X PUT /repos/${repoSlug}/branches/main/protection --input -`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` branch protection enabled on ${repoSlug}/main`);\n    // A repo can pin a required check in a *ruleset* as well as in classic branch protection, and\n    // the two are stored separately — this call only writes the classic one, so a leftover ruleset\n    // keeps blocking merges on a check name that no longer reports.\n    console.log(\n      chalk.gray(`  · check for a competing ruleset: gh api /repos/${repoSlug}/rulesets`),\n    );\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to set branch protection. Do it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings/branches`));\n  }\n\n  // Enable \"Allow auto-merge\" so a PR can be queued to merge itself once checks pass. The publish\n  // workflow authors the Release PR via the org App token (org secrets RELEASE_APP_ID /\n  // RELEASE_APP_PRIVATE_KEY) so its CI runs without a manual approval gate.\n  try {\n    await execPromise(\n      `gh api -X PATCH /repos/${repoSlug} -F allow_auto_merge=true`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` auto-merge enabled on ${repoSlug}`);\n  } catch (err) {\n    console.warn(chalk.yellow('  ⚠ Failed to enable auto-merge. Enable it manually:'));\n    console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings (General → Allow auto-merge)`));\n  }\n}\n\nasync function grantTeamAccess(repoSlug: string, teamSlug: string): Promise<void> {\n  console.log('');\n  console.log(chalk.magenta(`Granting '${teamSlug}' team push access to ${repoSlug}...`));\n\n  try {\n    await execPromise('gh --version', false, false);\n  } catch {\n    console.warn(chalk.yellow(\"  ⚠ `gh` CLI not found. Install from https://cli.github.com/ and retry with --grant-team,\"));\n    console.warn(chalk.yellow(`    or add the team manually at https://github.com/${repoSlug}/settings/access`));\n    return;\n  }\n\n  const [owner, repo] = repoSlug.split('/');\n  try {\n    await execPromise(\n      `gh api -X PUT /orgs/${owner}/teams/${teamSlug}/repos/${owner}/${repo} -f permission=push`,\n      false,\n      false,\n    );\n    console.log(chalk.green('  ✓') + ` team '${teamSlug}' granted push access on ${repoSlug}`);\n  } catch (err: any) {\n    const msg = err?.stderr || err?.stdout || String(err);\n    console.warn(chalk.yellow(`  ⚠ Failed to grant team access: ${msg.slice(0, 200)}`));\n    console.warn(chalk.yellow(`    Team may not exist in org '${owner}', or you may lack admin rights.`));\n    console.warn(chalk.yellow(`    Manual: https://github.com/${repoSlug}/settings/access`));\n  }\n}\n\nfunction printNextSteps(\n  repoSlug: string,\n  npmSecretName: string,\n  configuredGithub: boolean | undefined,\n  grantedTeam: string | undefined,\n): void {\n  console.log('');\n  console.log(chalk.green('Done.'));\n  console.log('');\n  console.log(chalk.bold('Next steps:'));\n  console.log('');\n  const [owner, repo] = repoSlug.split('/');\n\n  console.log(`  1. Review the generated files, adjust as needed.`);\n  console.log(`  2. Commit:`);\n  console.log(chalk.cyan('       git add . && git commit -m \"set up the publish pipeline\"'));\n  console.log(`  3. Push to main — the publish workflow will trigger.`);\n  console.log('');\n  console.log(chalk.bold('Register the trusted publisher on npmjs.com (before the first release):'));\n  console.log('');\n  console.log(`  package → Settings → Trusted Publisher, matching the caller workflow exactly:`);\n  console.log(`    organization: ${chalk.cyan(owner)}   repository: ${chalk.cyan(repo)}`);\n  console.log(`    workflow filename: ${chalk.cyan('publish.yml')}   environment: ${chalk.cyan('(empty)')}`);\n  console.log(`    \"Allow npm publish\": ${chalk.cyan('ticked')}`);\n  console.log('');\n  console.log(chalk.gray(`  Without it the release still ships — the workflow falls back to a staged`));\n  console.log(chalk.gray(`  npm release that a maintainer approves with 2FA. A typo in the organization`));\n  console.log(chalk.gray(`  field looks exactly the same, so check that field first if a package that`));\n  console.log(chalk.gray(`  should publish directly keeps staging instead.`));\n  console.log('');\n  // No per-repo secret grant step: NPM_AUTH_TOKEN, RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are\n  // \"All repositories\" org secrets, which is the whole reason first-party and community packages\n  // live in separate orgs. Only mention what is genuinely still one-time-per-org.\n  console.log(chalk.bold(`One-time org-level setup (already done on linked-fw and linked-cm):`));\n  console.log('');\n  console.log(`  a. Org secrets ${chalk.cyan(npmSecretName)}, ${chalk.cyan('RELEASE_APP_ID')} and ${chalk.cyan('RELEASE_APP_PRIVATE_KEY')},`);\n  console.log(`     visible to ${chalk.cyan('All repositories')} — there is no per-repo grant step.`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/secrets/actions`);\n  console.log('');\n  console.log(`  b. Enable \"Allow GitHub Actions to create and approve pull requests\":`);\n  console.log(`     → https://github.com/organizations/${owner}/settings/actions`);\n\n  if (!configuredGithub) {\n    console.log('');\n    console.log(chalk.bold('Branch protection:'));\n    console.log(`  Rerun with ${chalk.cyan('linked setup-publish --configure-github')} to configure automatically,`);\n    console.log(`  or set manually at https://github.com/${repoSlug}/settings/branches —`);\n    console.log(`  the required check is ${chalk.cyan('checks / Build & Test')}, not ${chalk.cyan('Build & Test')}.`);\n  }\n  console.log('');\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_linked/cli",
-  "version": "1.42.0",
+  "version": "1.43.1",
   "packageManager": "npm@11.21.0",
   "description": "Command line tools for the @_linked/* packages and apps",
   "main": "lib/esm/index.js",