@fairgarden/distribution 0.1.0-alpha.0

package/dist/submodules.js

@@ -0,0 +1,225 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import semver from 'semver';
+/** Run git, returning undefined rather than throwing when it fails. */
+const git = (cwd, args) => {
+    try {
+        return execFileSync('git', args, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return undefined;
+    }
+};
+const lines = (value) => value ? value.split('\n').filter(Boolean) : [];
+/**
+ * Whether this repository ships modules, as opposed to being one.
+ *
+ * Read from `.gitmodules`, which is committed, rather than from
+ * {@link submodules}, which only reports checkouts that are actually there. A
+ * clone made without `--recurse-submodules` has the file and none of the
+ * checkouts, and treating that as a module would write a module's readme over
+ * the distribution's and let it be released as if it were one.
+ */
+export const isDistribution = (root) => existsSync(path.join(root, '.gitmodules')) &&
+    (git(root, ['config', '--file', '.gitmodules', '--get-regexp', 'path']) ?? '') !== '';
+/**
+ * Submodules that are missing their checkout.
+ *
+ * Anything that reads a module's own package.json needs to say so rather than
+ * quietly leave it out.
+ */
+export const uninitialised = (root) => {
+    const config = git(root, ['config', '--file', '.gitmodules', '--get-regexp', 'path']);
+    return lines(config)
+        .map((line) => line.split(' ')[1])
+        .filter((relativePath) => Boolean(relativePath))
+        .filter((relativePath) => !existsSync(path.join(root, relativePath, '.git')));
+};
+/** The repository holding the submodules, which is not the monolith directory. */
+export const repositoryRoot = (from) => git(from, ['rev-parse', '--show-toplevel']);
+/**
+ * Submodules as `.gitmodules` records them, with the commit each is pinned to.
+ *
+ * Uninitialised submodules are left out — there is nothing to inspect until
+ * they are checked out.
+ */
+export const submodules = (root) => {
+    const config = git(root, ['config', '--file', '.gitmodules', '--get-regexp', 'path']);
+    const found = [];
+    for (const line of lines(config)) {
+        const [key, relativePath] = line.split(' ');
+        if (!relativePath)
+            continue;
+        const name = key.slice('submodule.'.length, -'.path'.length);
+        const url = git(root, ['config', '--file', '.gitmodules', '--get', `submodule.${name}.url`]) ?? '';
+        const full = path.join(root, relativePath);
+        // An uninitialised submodule is an empty directory, and git run inside one
+        // finds the distribution instead — reporting the distribution's own tags
+        // as the module's, and checking one out onto the distribution's HEAD.
+        if (!existsSync(path.join(full, '.git')))
+            continue;
+        const pinned = git(full, ['rev-parse', 'HEAD']);
+        if (!pinned)
+            continue;
+        found.push({
+            name: path.basename(relativePath),
+            configName: name,
+            relativePath,
+            path: full,
+            url,
+            pinned,
+        });
+    }
+    return found;
+};
+/** Tags that name a version, newest first. */
+const versionTags = (cwd) => lines(git(cwd, ['tag', '--list']))
+    .filter((tag) => semver.valid(tag) !== null)
+    .sort((a, b) => semver.rcompare(a, b));
+/** The branch tip the submodule is tracking, for counting unreleased work. */
+const upstream = (cwd) => {
+    for (const ref of ['origin/HEAD', 'origin/main', 'origin/master', 'main', 'master']) {
+        if (git(cwd, ['rev-parse', '--verify', '--quiet', ref]))
+            return ref;
+    }
+    return undefined;
+};
+/**
+ * Compare a submodule's pinned commit against the versions its repository has.
+ *
+ * Only tags that name a version are considered an upgrade. Commits past the
+ * newest tag are counted and reported, but never bumped to — a commit carries
+ * no statement about what changed, which is the whole point of the version.
+ */
+export const inspect = (submodule, { fetch = true } = {}) => {
+    const cwd = submodule.path;
+    let fetched;
+    if (fetch) {
+        fetched = git(cwd, ['fetch', '--tags', '--quiet']) !== undefined;
+    }
+    const dirty = (git(cwd, ['status', '--porcelain']) ?? '') !== '';
+    const tags = versionTags(cwd);
+    // Read HEAD rather than trusting the commit captured at discovery: a bump
+    // moves the checkout, and anything inspecting afterwards must see that.
+    const head = git(cwd, ['rev-parse', 'HEAD']) ?? submodule.pinned;
+    const exactTag = lines(git(cwd, ['tag', '--points-at', head])).find((tag) => semver.valid(tag) !== null);
+    // Otherwise the newest tag the pinned commit descends from.
+    const describedTag = git(cwd, ['describe', '--tags', '--abbrev=0', '--match', '*', head]);
+    const described = describedTag && semver.valid(describedTag) !== null ? describedTag : undefined;
+    const current = exactTag ?? described;
+    const available = current
+        ? tags.filter((tag) => semver.gt(tag, current))
+        : tags;
+    const upgrades = {};
+    for (const tag of available) {
+        // semver.diff also returns premajor, preminor and prepatch. Bucketing
+        // those as patch would let a jump to 1.0.0-alpha.0 apply without --major,
+        // which matters most for the 0.x.y-alpha.n versions this is built for.
+        const difference = current ? semver.diff(current, tag) : 'major';
+        const bucket = difference === 'major' || difference === 'premajor'
+            ? 'major'
+            : difference === 'minor' || difference === 'preminor'
+                ? 'minor'
+                : 'patch';
+        // available is newest first, so the first of each kind is the newest.
+        upgrades[bucket] ??= tag;
+    }
+    const tip = upstream(cwd);
+    const from = available[0] ?? current ?? head;
+    const untagged = tip
+        ? Number(git(cwd, ['rev-list', '--count', `${from}..${tip}`]) ?? '0')
+        : 0;
+    return {
+        submodule,
+        head,
+        current,
+        exact: exactTag !== undefined,
+        available,
+        upgrades,
+        untagged,
+        dirty,
+        fetched,
+    };
+};
+/**
+ * The version a bump should move to, or undefined when there is nothing to do.
+ *
+ * Major upgrades are held back unless asked for: they are the ones that need a
+ * person to read a changelog first.
+ */
+export const target = (state, { major = false } = {}) => {
+    const candidates = [
+        state.upgrades.patch,
+        state.upgrades.minor,
+        ...(major ? [state.upgrades.major] : []),
+    ].filter((tag) => tag !== undefined);
+    if (candidates.length === 0)
+        return undefined;
+    return candidates.sort((a, b) => semver.rcompare(a, b))[0];
+};
+/**
+ * Record a different URL for a submodule.
+ *
+ * `.gitmodules` is what gets committed, and `submodule sync` copies it into the
+ * local config so the existing checkout uses it too. The caller commits.
+ */
+export const setUrl = (root, submodule, url) => {
+    const written = git(root, [
+        'config',
+        '--file',
+        '.gitmodules',
+        `submodule.${submodule.configName}.url`,
+        url,
+    ]);
+    if (written === undefined) {
+        throw new Error(`Could not set the url for ${submodule.relativePath}.`);
+    }
+    git(root, ['submodule', 'sync', '--quiet', '--', submodule.relativePath]);
+};
+/**
+ * Whether a remote can be read with no credentials at all.
+ *
+ * This is the question a build host asks. Prompting is disabled so a private
+ * repository fails immediately instead of waiting for a password nobody is
+ * there to type.
+ */
+export const isPublic = (url, timeout = 15_000) => {
+    try {
+        execFileSync('git', ['ls-remote', '--exit-code', url, 'HEAD'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'ignore', 'ignore'],
+            timeout,
+            env: {
+                ...process.env,
+                GIT_TERMINAL_PROMPT: '0',
+                GIT_ASKPASS: 'echo',
+                GIT_SSH_COMMAND: 'ssh -oBatchMode=yes',
+                GIT_CONFIG_COUNT: '1',
+                GIT_CONFIG_KEY_0: 'credential.helper',
+                GIT_CONFIG_VALUE_0: '',
+            },
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/** Move a submodule's checkout to a tag. The caller commits the new pointer. */
+export const moveTo = (submodule, tag) => {
+    // Belt and braces: never check out inside something that is not the
+    // submodule's own repository.
+    if (!existsSync(path.join(submodule.path, '.git'))) {
+        throw new Error(`${submodule.relativePath} is not checked out, so there is nothing to move.`);
+    }
+    const result = git(submodule.path, ['checkout', '--quiet', `refs/tags/${tag}`]);
+    if (result === undefined) {
+        throw new Error(`Could not check out ${tag} in ${submodule.relativePath}.`);
+    }
+};
+//# sourceMappingURL=submodules.js.map

package/dist/submodules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submodules.js","sourceRoot":"","sources":["../src/submodules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,uEAAuE;AACvE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAc,EAAsB,EAAE;IAC9D,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAA;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAY,EAAE,CACpD,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAEhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CACtD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1C,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAA;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAY,EAAE;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;IAErF,OAAO,KAAK,CAAC,MAAM,CAAC;SACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SACjC,MAAM,CAAC,CAAC,YAAY,EAA0B,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;SACvE,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AACjF,CAAC,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAsB,EAAE,CACjE,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAe7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAe,EAAE;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;IACrF,MAAM,KAAK,GAAgB,EAAE,CAAA;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,YAAY;YAAE,SAAQ;QAE3B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5D,MAAM,GAAG,GACP,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACxF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAE1C,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAE,SAAQ;QAElD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM;YAAE,SAAQ;QAErB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YACjC,UAAU,EAAE,IAAI;YAChB,YAAY;YACZ,IAAI,EAAE,IAAI;YACV,GAAG;YACH,MAAM;SACP,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,8CAA8C;AAC9C,MAAM,WAAW,GAAG,CAAC,GAAW,EAAY,EAAE,CAC5C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;KAC/B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;KAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE1C,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAsB,EAAE;IACnD,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAA;IACrE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAwBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,SAAoB,EACpB,EAAE,KAAK,GAAG,IAAI,KAA0B,EAAE,EAC1B,EAAE;IAClB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAA;IAE1B,IAAI,OAA4B,CAAA;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,SAAS,CAAA;IAClE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAA;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAE7B,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,MAAM,CAAA;IAEhE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CACjE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CACpC,CAAA;IACD,4DAA4D;IAC5D,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;IACzF,MAAM,SAAS,GACb,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;IAEhF,MAAM,OAAO,GAAG,QAAQ,IAAI,SAAS,CAAA;IACrC,MAAM,SAAS,GAAG,OAAO;QACvB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,QAAQ,GAAyC,EAAE,CAAA;IACzD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QAChE,MAAM,MAAM,GACV,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,UAAU;YACjD,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,UAAU;gBACnD,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,OAAO,CAAA;QACf,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAA;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,IAAI,IAAI,CAAA;IAC5C,MAAM,QAAQ,GAAG,GAAG;QAClB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC;QACrE,CAAC,CAAC,CAAC,CAAA;IAEL,OAAO;QACL,SAAS;QACT,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,QAAQ,KAAK,SAAS;QAC7B,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,KAAK;QACL,OAAO;KACR,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,KAAqB,EACrB,EAAE,KAAK,GAAG,KAAK,KAA0B,EAAE,EACvB,EAAE;IACtB,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC,QAAQ,CAAC,KAAK;QACpB,KAAK,CAAC,QAAQ,CAAC,KAAK;QACpB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAA;IAEnD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,SAAoB,EAAE,GAAW,EAAQ,EAAE;IAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;QACxB,QAAQ;QACR,QAAQ;QACR,aAAa;QACb,aAAa,SAAS,CAAC,UAAU,MAAM;QACvC,GAAG;KACJ,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,CAAC,YAAY,GAAG,CAAC,CAAA;IACzE,CAAC;IACD,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,OAAO,GAAG,MAAM,EAAW,EAAE;IACjE,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE;YAC7D,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACrC,OAAO;YACP,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,mBAAmB,EAAE,GAAG;gBACxB,WAAW,EAAE,MAAM;gBACnB,eAAe,EAAE,qBAAqB;gBACtC,gBAAgB,EAAE,GAAG;gBACrB,gBAAgB,EAAE,mBAAmB;gBACrC,kBAAkB,EAAE,EAAE;aACvB;SACF,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAoB,EAAE,GAAW,EAAQ,EAAE;IAChE,oEAAoE;IACpE,8BAA8B;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,GAAG,SAAS,CAAC,YAAY,mDAAmD,CAC7E,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC,CAAA;IAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,OAAO,SAAS,CAAC,YAAY,GAAG,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC,CAAA"}

package/dist/workflows.d.ts

@@ -0,0 +1,57 @@
+import type { Files } from './scaffold.ts';
+/**
+ * The publishing workflow a module carries.
+ *
+ * A module releases on its own schedule, so the workflow lives in the module
+ * rather than the distribution. Authentication is npm trusted publishing over
+ * OIDC — there is no token to leak, and the package must already exist on npm
+ * with a trusted publisher pointing at this repository and this file.
+ */
+export declare const publishWorkflow: (packageName: string) => Files;
+export interface WorkflowUpdate {
+    relativePath: string;
+    files: string[];
+    skipped: boolean;
+    /** Whether `private: true` was taken off, so the module can publish at all. */
+    unprivated: boolean;
+    /** True when nothing in the manifest says what the tarball should contain. */
+    missingFiles: boolean;
+    /** True when nothing says whether the package publishes publicly. */
+    missingAccess: boolean;
+}
+/**
+ * The scripts the workflow calls, and a module releases by hand with.
+ *
+ * They are named rather than spelled out in the workflow so that every
+ * module's workflow is the same file, and so `pnpm release` is the answer to
+ * "how do I release this" wherever you are standing.
+ */
+export declare const releaseScripts: (packageName: string) => Record<string, string>;
+export interface ManifestChange {
+    changed: boolean;
+    unprivated: boolean;
+    missingFiles: boolean;
+    missingAccess: boolean;
+}
+/**
+ * Give a module what it needs to publish itself.
+ *
+ * One pass over the manifest rather than several: a structural rewrite undoes
+ * a careful textual splice, so doing both would mean the second silently
+ * discarding the first's formatting. Two-space JSON is what npm and pnpm write
+ * anyway.
+ */
+export declare const updateManifest: (moduleRoot: string, packageName: string, version: string | undefined, packageManager: string | undefined, { write }?: {
+    write?: boolean;
+}) => Promise<ManifestChange>;
+/**
+ * Give every module a publishing workflow.
+ *
+ * A module that already has one is left alone: it may have been changed on
+ * purpose, and overwriting it would be the kind of help nobody asked for.
+ */
+export declare const writeWorkflows: (root: string, { force, dryRun }?: {
+    force?: boolean;
+    dryRun?: boolean;
+}) => Promise<WorkflowUpdate[]>;
+//# sourceMappingURL=workflows.d.ts.map

package/dist/workflows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAE1C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAI,aAAa,MAAM,KAAG,KAmLpD,CAAA;AAEF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,+EAA+E;IAC/E,UAAU,EAAE,OAAO,CAAA;IACnB,8EAA8E;IAC9E,YAAY,EAAE,OAAO,CAAA;IACrB,qEAAqE;IACrE,aAAa,EAAE,OAAO,CAAA;CACvB;AA2BD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,aAAa,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAQzE,CAAA;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,OAAO,CAAA;IACrB,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACzB,YAAY,MAAM,EAClB,aAAa,MAAM,EACnB,SAAS,MAAM,GAAG,SAAS,EAC3B,gBAAgB,MAAM,GAAG,SAAS,EAClC,YAAkB;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,KACzC,OAAO,CAAC,cAAc,CA8DxB,CAAA;AAGD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,oBAAmC;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,KAC5E,OAAO,CAAC,cAAc,EAAE,CAiE1B,CAAA"}

package/dist/workflows.js

@@ -0,0 +1,358 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { submodules } from "./submodules.js";
+/**
+ * The publishing workflow a module carries.
+ *
+ * A module releases on its own schedule, so the workflow lives in the module
+ * rather than the distribution. Authentication is npm trusted publishing over
+ * OIDC — there is no token to leak, and the package must already exist on npm
+ * with a trusted publisher pointing at this repository and this file.
+ */
+export const publishWorkflow = (packageName) => ({
+    '.github/workflows/publish.yml': `name: Publish
+
+# npm trusted publishing is configured against one workflow file per package,
+# so canary and release both live here. There is no npm token: the package must
+# already exist on npm with a trusted publisher pointing at this repository and
+# this file. Bootstrap a new package by publishing it once from a workstation,
+# then configure trusted publishing on npmjs.com.
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '0 0 * * *' # Daily at midnight UTC
+  workflow_dispatch:
+    inputs:
+      dist-tag:
+        description: 'npm dist tag to publish the release to'
+        required: false
+        type: string
+        default: 'latest'
+      dry-run:
+        description: 'Pack and validate without publishing'
+        required: false
+        type: boolean
+        default: false
+
+permissions: {}
+
+concurrency:
+  group: publish-\${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  canary:
+    name: Publish canary
+    # Lockfile bumps do not warrant a canary.
+    if: >
+      github.event_name == 'schedule'
+      || (github.event_name == 'push' && github.event.head_commit.author.name != 'renovate[bot]')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Required for provenance and trusted publishing
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Prepare for publishing
+        uses: ./.github/actions/publish-prepare
+
+      - name: Stamp the canary version
+        id: canary
+        # \`fg-dist canary\` works out the version and whether there is anything
+        # to publish: a canary records the commit it was built from, so a
+        # nightly run with nothing new is a no-op rather than a version bump.
+        run: pnpm run canary
+
+      - name: Publish to npm
+        if: steps.canary.outputs.skip != 'true'
+        # Provenance only where npm will generate it: it refuses for anything
+        # not published publicly, and refusing is a failed publish.
+        run: |
+          if [ "\${{ steps.canary.outputs.provenance }}" = "true" ]; then
+            npm publish --tag canary --provenance
+          else
+            npm publish --tag canary
+          fi
+
+      - name: Summary
+        run: |
+          if [ "\${{ steps.canary.outputs.skip }}" = "true" ]; then
+            echo "\\\`\${{ steps.canary.outputs.version }}\\\` is already the canary for this commit." >> "\$GITHUB_STEP_SUMMARY"
+          else
+            echo "Published \\\`${packageName}@\${{ steps.canary.outputs.version }}\\\` to the \\\`canary\\\` tag." >> "\$GITHUB_STEP_SUMMARY"
+          fi
+
+  release:
+    name: Publish release
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required for pushing the tag and creating the release
+      id-token: write # Required for provenance and trusted publishing
+    environment:
+      name: npm-publish
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0 # \`gh release create --generate-notes\` needs history
+
+      - name: Prepare for publishing
+        uses: ./.github/actions/publish-prepare
+
+      - name: Resolve version
+        id: version
+        # Refuses when the version is already on npm: main is meant to carry the
+        # next unreleased version, so finding it published means \`fg-dist
+        # release\` has not run since the last one.
+        run: pnpm run release:check
+
+      - name: Publish to npm
+        env:
+          DIST_TAG: \${{ inputs.dist-tag }}
+          # npm refuses provenance for anything not published publicly.
+          PROVENANCE: \${{ steps.version.outputs.provenance }}
+          DRY_RUN: \${{ inputs.dry-run }}
+        run: |
+          flags="--tag \$DIST_TAG"
+          [ "\$PROVENANCE" = "true" ] && flags="\$flags --provenance"
+          [ "\$DRY_RUN" = "true" ] && flags="\$flags --dry-run"
+          npm publish \$flags
+
+      - name: Tag and create the GitHub release
+        if: inputs.dry-run != true
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          TAG: \${{ steps.version.outputs.tag }}
+        run: |
+          git tag "\$TAG"
+          git push origin "\$TAG"
+          gh release create "\$TAG" \\
+            --title "\$TAG" \\
+            --generate-notes \\
+            --verify-tag
+
+      - name: Summary
+        run: |
+          echo "Published \\\`${packageName}@\${{ steps.version.outputs.version }}\\\` to the \\\`\${{ inputs.dist-tag }}\\\` tag." >> "\$GITHUB_STEP_SUMMARY"
+`,
+    '.github/actions/publish-prepare/action.yml': `name: Prepare for publishing
+description: Install dependencies and build, so the package is ready to publish.
+
+# Kept as an action rather than repeated steps: npm trusted publishing pins one
+# workflow file per package, so the canary and release jobs both have to share
+# this.
+
+runs:
+  using: composite
+  steps:
+    # Pin these to a commit sha once Renovate is watching the repository. The
+    # checkout in the workflow is pinned already, because it handles credentials.
+    #
+    # No \`version\` here: the \`packageManager\` field in package.json is what
+    # pins pnpm, and giving both makes this action refuse to choose.
+    - uses: pnpm/action-setup@v4
+
+    - uses: actions/setup-node@v4
+      with:
+        # Inline rather than \`node-version-file\`, so this action works in a
+        # repository that has no \`.nvmrc\`.
+        node-version: 22
+        # No \`cache: pnpm\`: it needs a lockfile to hash, and a module developed
+        # inside a distribution keeps its lockfile in the distribution.
+        registry-url: https://registry.npmjs.org
+
+    - name: Install
+      shell: bash
+      run: |
+        if [ -f pnpm-lock.yaml ]; then
+          pnpm install --frozen-lockfile
+        else
+          # A module developed inside a distribution has no lockfile of its
+          # own; the distribution's workspace holds it.
+          pnpm install --no-frozen-lockfile
+        fi
+
+    - name: Build
+      shell: bash
+      # A module that is consumed as source has nothing to build; one that ships
+      # a \`dist\` does. Neither should have to edit this file.
+      run: pnpm run --if-present build
+`,
+});
+const readManifest = async (root) => {
+    try {
+        return JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+};
+/** The package whose CLI a module releases with. */
+const TOOL = '@fairgarden/distribution';
+/**
+ * This tool's own version, which is what a module is given to release with.
+ *
+ * Read rather than written down, so a module is pinned to the CLI that set it
+ * up instead of to whatever was current when this file was last edited.
+ */
+const toolVersion = async () => {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const own = await readManifest(path.join(here, '..'));
+    return typeof own?.version === 'string' ? own.version : undefined;
+};
+/**
+ * The scripts the workflow calls, and a module releases by hand with.
+ *
+ * They are named rather than spelled out in the workflow so that every
+ * module's workflow is the same file, and so `pnpm release` is the answer to
+ * "how do I release this" wherever you are standing.
+ */
+export const releaseScripts = (packageName) => {
+    // The tool cannot depend on itself being published to release itself.
+    const cli = packageName === TOOL ? 'node dist/cli.js' : 'fg-dist';
+    return {
+        canary: `${cli} canary`,
+        release: `${cli} release`,
+        'release:check': `${cli} release --check`,
+    };
+};
+/**
+ * Give a module what it needs to publish itself.
+ *
+ * One pass over the manifest rather than several: a structural rewrite undoes
+ * a careful textual splice, so doing both would mean the second silently
+ * discarding the first's formatting. Two-space JSON is what npm and pnpm write
+ * anyway.
+ */
+export const updateManifest = async (moduleRoot, packageName, version, packageManager, { write = true } = {}) => {
+    const manifest = await readManifest(moduleRoot);
+    if (!manifest) {
+        return { changed: false, unprivated: false, missingFiles: false, missingAccess: false };
+    }
+    const before = JSON.stringify(manifest);
+    const updated = { ...manifest };
+    // A private package cannot be published, which is the one thing the workflow
+    // being added here is for.
+    const unprivated = updated.private === true;
+    if (unprivated)
+        delete updated.private;
+    // `pnpm/action-setup` takes its version from this field and will not run
+    // without one. A module that pins its own is left alone.
+    if (!updated.packageManager && packageManager) {
+        updated.packageManager = packageManager;
+    }
+    const scripts = { ...updated.scripts };
+    for (const [name, command] of Object.entries(releaseScripts(packageName))) {
+        // A script the module already defines may call the tool differently on
+        // purpose.
+        if (!scripts[name])
+            scripts[name] = command;
+    }
+    updated.scripts = scripts;
+    const dependencies = updated.dependencies;
+    const devDependencies = updated.devDependencies;
+    // Whichever list already has it wins; the tool is only needed to release, so
+    // a module that does not already depend on it gets it as a devDependency.
+    if (packageName !== TOOL && !dependencies?.[TOOL] && !devDependencies?.[TOOL] && version) {
+        updated.devDependencies = { ...devDependencies, [TOOL]: `^${version}` };
+    }
+    const changed = JSON.stringify(updated) !== before;
+    if (changed && write) {
+        await writeFile(path.join(moduleRoot, 'package.json'), `${JSON.stringify(updated, null, 2)}\n`);
+    }
+    // Guessed at, this would be wrong: a module consumed as source ships `app`
+    // and `lib`, one that builds ships `dist`, and npm's default ships both plus
+    // whatever else is lying around. Report it instead.
+    // Both of these are reported rather than guessed. `files` because a module
+    // consumed as source ships `app` and `lib` while one that builds ships
+    // `dist`. `publishConfig.access` because npm takes an explicit value as an
+    // instruction to *change* an existing package's visibility — writing
+    // `restricted` into an already-public package would make it private on the
+    // next publish, or fail on an org with no paid plan.
+    return {
+        changed,
+        unprivated,
+        missingFiles: !updated.files,
+        missingAccess: packageName.startsWith('@') &&
+            updated.publishConfig?.access === undefined,
+    };
+};
+/**
+ * Give every module a publishing workflow.
+ *
+ * A module that already has one is left alone: it may have been changed on
+ * purpose, and overwriting it would be the kind of help nobody asked for.
+ */
+export const writeWorkflows = async (root, { force = false, dryRun = false } = {}) => {
+    const updates = [];
+    // What the distribution builds with, which is what its modules are developed
+    // against whether or not they say so themselves.
+    const packageManager = (await readManifest(root))?.packageManager;
+    const spec = typeof packageManager === 'string' ? packageManager : undefined;
+    const tool = await toolVersion();
+    for (const submodule of submodules(root)) {
+        const name = (await readManifest(submodule.path))?.name;
+        if (typeof name !== 'string')
+            continue;
+        const workflow = path.join(submodule.path, '.github/workflows/publish.yml');
+        if (existsSync(workflow) && !force) {
+            updates.push({
+                relativePath: submodule.relativePath,
+                files: [],
+                skipped: true,
+                unprivated: false,
+                missingFiles: false,
+                missingAccess: false,
+            });
+            continue;
+        }
+        const written = [];
+        for (const [relative, contents] of Object.entries(publishWorkflow(name))) {
+            const full = path.join(submodule.path, relative);
+            if (!dryRun) {
+                await mkdir(path.dirname(full), { recursive: true });
+                await writeFile(full, contents);
+            }
+            written.push(relative);
+        }
+        // An earlier version of this command shipped the canary stamper as a file
+        // in the module. It is a CLI command now, and a stale copy of it would go
+        // on being the thing anyone reads.
+        const stale = path.join(submodule.path, 'scripts/stampCanaryVersion.mjs');
+        if (existsSync(stale)) {
+            if (!dryRun) {
+                await rm(stale);
+                // And the directory, if that was the only thing in it. A module with
+                // scripts of its own keeps them.
+                await rm(path.dirname(stale), { recursive: false }).catch(() => { });
+            }
+            written.push('scripts/stampCanaryVersion.mjs (removed)');
+        }
+        const manifest = await updateManifest(submodule.path, name, tool, spec, {
+            write: !dryRun,
+        });
+        if (manifest.changed)
+            written.push('package.json');
+        updates.push({
+            relativePath: submodule.relativePath,
+            files: written.sort(),
+            skipped: false,
+            unprivated: manifest.unprivated,
+            missingFiles: manifest.missingFiles,
+            missingAccess: manifest.missingAccess,
+        });
+    }
+    return updates;
+};
+//# sourceMappingURL=workflows.js.map

package/dist/workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACrC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAG5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAS,EAAE,CAAC,CAAC;IAC9D,+BAA+B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCA4ED,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAuDb,WAAW;CAC1C;IAEC,4CAA4C,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0C/C;CAEA,CAAC,CAAA;AAcF,MAAM,YAAY,GAAG,KAAK,EACxB,IAAY,EACkC,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,oDAAoD;AACpD,MAAM,IAAI,GAAG,0BAA0B,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,WAAW,GAAG,KAAK,IAAiC,EAAE;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACrD,OAAO,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAmB,EAA0B,EAAE;IAC5E,sEAAsE;IACtE,MAAM,GAAG,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,OAAO;QACL,MAAM,EAAE,GAAG,GAAG,SAAS;QACvB,OAAO,EAAE,GAAG,GAAG,UAAU;QACzB,eAAe,EAAE,GAAG,GAAG,kBAAkB;KAC1C,CAAA;AACH,CAAC,CAAA;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAkB,EAClB,WAAmB,EACnB,OAA2B,EAC3B,cAAkC,EAClC,EAAE,KAAK,GAAG,IAAI,KAA0B,EAAE,EACjB,EAAE;IAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACzF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACvC,MAAM,OAAO,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAA;IAExD,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,CAAA;IAC3C,IAAI,UAAU;QAAE,OAAO,OAAO,CAAC,OAAO,CAAA;IAEtC,yEAAyE;IACzE,yDAAyD;IACzD,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,cAAc,EAAE,CAAC;QAC9C,OAAO,CAAC,cAAc,GAAG,cAAc,CAAA;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,GAAI,OAAO,CAAC,OAA8C,EAAE,CAAA;IAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1E,uEAAuE;QACvE,WAAW;QACX,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;IAC7C,CAAC;IACD,OAAO,CAAC,OAAO,GAAG,OAAO,CAAA;IAEzB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAkD,CAAA;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAqD,CAAA;IAErF,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACzF,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,EAAE,CAAA;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,MAAM,CAAA;IAClD,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACxC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,oDAAoD;IACpD,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,qDAAqD;IACrD,OAAO;QACL,OAAO;QACP,UAAU;QACV,YAAY,EAAE,CAAC,OAAO,CAAC,KAAK;QAC5B,aAAa,EACX,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAC1B,OAAO,CAAC,aAAkD,EAAE,MAAM,KAAK,SAAS;KACpF,CAAA;AACH,CAAC,CAAA;AAGD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,IAAY,EACZ,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,KAA4C,EAAE,EAClD,EAAE;IAC7B,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,cAAc,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,cAAc,CAAA;IACjE,MAAM,IAAI,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAA;IAEhC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAA;QACvD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAA;QAC3E,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,KAAK;gBACnB,aAAa,EAAE,KAAK;aACrB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACpD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACjC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxB,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAA;QACzE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC,KAAK,CAAC,CAAA;gBACf,qEAAqE;gBACrE,iCAAiC;gBACjC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;YACtE,KAAK,EAAE,CAAC,MAAM;SACf,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAElD,OAAO,CAAC,IAAI,CAAC;YACX,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE;YACrB,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;SACtC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}