@grimoire-rs/indexer 0.2.2 → 0.3.1

package/README.md

@@ -6,20 +6,33 @@ servers, and bundles available in one or more OCI registries.
 
 ## Subcommands
 
-- `grim-indexer init` — scaffold a new index repo (`index/**` content
-  tree, Astro site config, CI workflow).
+- `grim-indexer init` — scaffold a new index repo: the `index/**` content
+  tree, site config, a `package.json` that pins this package, and the CI
+  its forge runs.
+- `grim-indexer dev` — serve the index locally, through the same renderer
+  `build` uses. The review loop for an entry or a branding change.
 - `grim-indexer enrich` — refresh `enrich/**` from the registry: READMEs,
   changelogs, logos, versions and tag lists. The only step that goes
   online, and the only one that needs `grim` on `PATH`.
 - `grim-indexer build` — render `index/**` into a static site.
 - `grim-indexer validate` — CI gate for contribution PRs/MRs against an
   index repo.
+- `grim-indexer ci` — render the index repo's workflows from the `ci`
+  block of its `index.config.json`; `--check` verifies the committed ones
+  still match and exits 65 on drift.
+
+A scaffolded index owns its CI: the workflow files are committed in that
+repository and run `npm ci` against its own lockfile, so nothing is
+fetched from here at run time and the version that builds an index is the
+one that repo has locked. The generated `verify-ci` job re-renders and
+diffs on every push, which is what keeps a hand-edit from silently
+forking the pipeline.
 
 An index stores nothing but pointers — a ref and who owns it. Everything a
 reader looks at lives in the registry, so an index that never runs `enrich`
 renders a catalogue of names with *No README available* on every page. The
-scaffolded CI runs it before each build; set `enrich: false` (GitHub) or
-`GRIM_INDEXER_ENRICH: "false"` (GitLab) for a pointers-only site.
+scaffolded CI runs it before each build; set `"enrich": false` in the `ci`
+block for a pointers-only site.
 
 ## Install
 
@@ -30,10 +43,24 @@ npm install --save-dev @grimoire-rs/indexer
 ## Usage
 
 ```sh
-npx @grimoire-rs/indexer init
-npx @grimoire-rs/indexer enrich   # needs `grim` on PATH
-npx @grimoire-rs/indexer build
-npx @grimoire-rs/indexer validate
+npx @grimoire-rs/indexer init     # scaffold; writes package.json + lockfile
+```
+
+Or start from [`grimoire-rs/index-template`](https://github.com/grimoire-rs/index-template):
+"Use this template", clone, then `npm install && npm run setup` — which is
+`init` run in place, so it reads your `origin` remote and already knows the
+forge and the Pages URL.
+
+Everything after that runs through the scaffolded repo's own scripts, so it
+uses the version that repo locked:
+
+```sh
+npm run dev        # local preview
+npm run build      # index/** -> dist/
+npm run enrich     # needs `grim` on PATH
+npm run validate   # the contribution gate
+npm run ci         # re-render CI after editing index.config.json
+npm run ci:check   # fail on drift (what the verify-ci job runs)
 ```
 
 As an Astro integration:
@@ -60,9 +87,11 @@ unreachable OCI ref, unowned namespace).
 
 Two things that trial settled, both worth knowing before you scaffold:
 
-- **Requiring the gate needs the check named `validate / validate`**, not
-  `validate`. Requiring a context that never reports blocks every PR
-  forever and looks exactly like the gate rejecting your contribution.
+- **Require the check named `validate`.** It was `validate / validate`
+  while the scaffold emitted thin callers of reusable workflows; the
+  workflow is now committed in the index repo, so the context is just the
+  job key. Requiring a context that never reports blocks every PR forever
+  and looks exactly like the gate rejecting your contribution.
 - **In the combined (`--with-skills`) layout the gate does not cover your
   own CI's announce.** GitHub runs no workflows on a PR opened with
   `secrets.GITHUB_TOKEN`, so that PR arrives ungated — review it by hand.
@@ -70,8 +99,8 @@ Two things that trial settled, both worth knowing before you scaffold:
   requests" enabled, which is off by default and which also lets
   workflows approve PRs.
 
-Not yet proven live: the GitLab leg (hermetic tests only; the
-`include: remote:` URL is verified to resolve), and the cross-repository
+Not yet proven live: the GitLab leg (hermetic unit tests only - no live
+GitLab pipeline has run the rendered CI), and the cross-repository
 announce, which needs a credential beyond the CI token.
 
 Two things are frozen and safe to build on: the published URL layout
@@ -83,13 +112,25 @@ is deliberately no component-override API yet — publishing one would
 freeze a prop contract per slot, and that is not a promise worth making
 this early.
 
-> **Use `0.1.4` or later.** `0.1.0` installs without an executable — npm
+> **Use `0.1.4` or later.** `0.1.0` installs without an executable - npm
 > silently stripped its `bin` entry at publish time. `0.1.1` and `0.1.2`
 > scaffold CI that points at reusable workflows those tags do not contain,
-> so the first push to a scaffolded index fails before any job runs. An
-> index already scaffolded against `0.1.1`/`0.1.2` is fixed by bumping the
-> `@v0.1.x` refs in `.github/workflows/{pages,validate}.yml` — no
-> re-scaffold needed.
+> so the first push to a scaffolded index fails before any job runs.
+>
+> An index already scaffolded against a reusable-workflow version keeps
+> working as long as its pinned `uses:`/`include:` refs stay on an existing
+> tag - old tags are not deleted, so that resolution does not break on its
+> own. It breaks the moment something bumps the pinned ref, because `main`
+> no longer defines any reusable workflow or remote include for it to
+> resolve to: a Renovate update of an `@grimoire-rs/indexer` action ref
+> will now fail hard. Fix it before that happens by adding a `package.json`
+> pinning this package (if the old scaffold has none) and running
+> `npm run ci`, which re-renders the workflow files and nothing else.
+> **Not `init --force`**: that rewrites the whole scaffold from its
+> templates, discarding the added scripts in `package.json`, your
+> `.gitignore` rules, your `README.md`, and any `uses:` pin Renovate has
+> bumped since - `npm run ci` keeps all four. `publish.toml` and
+> `index-policy.json` are never rewritten, by `--force` or anything else.
 >
 > Through `0.1.3`, `init --with-skills` wrote a `publish.toml` with no
 > `[announce]` table, so `grim publish --announce` in a combined-layout

package/dist/ci.d.ts

@@ -0,0 +1,149 @@
+import { CliError } from "./cli/exit.js";
+/**
+ * Forges CI can be rendered for. One repository is hosted on one forge, so
+ * this is a choice rather than a set — rendering both left every index with a
+ * pipeline it would never run, and a second gate to keep honest for nothing.
+ */
+export type Forge = "github" | "gitlab";
+export declare const FORGES: readonly Forge[];
+/**
+ * When the combined layout publishes its own packages.
+ *
+ * `never` is the default and the only correct answer for a plain index, which
+ * holds pointers and owns no packages to push. The other two are the two
+ * release habits: cut a tag when a version is ready, or treat every merge to
+ * the default branch as a release and let skip-existing make the re-run a
+ * no-op.
+ */
+export type PublishTrigger = "never" | "tag" | "default-branch";
+export declare const PUBLISH_TRIGGERS: readonly PublishTrigger[];
+/**
+ * The `ci` block of `index.config.json` — everything that varies the
+ * generated pipeline. Every key is optional; [`resolveCi`] fills the gaps.
+ */
+export interface CiConfig {
+    /** Which forge's CI to render. Default `github`. */
+    forge?: Forge;
+    /**
+     * The branch the pipeline treats as the trunk — what deploys Pages, and what
+     * `publish: "default-branch"` releases from. Default `main`, which is what
+     * `init` creates and what every generated GitHub workflow assumed before
+     * this key existed.
+     *
+     * GitHub has no expression for it in an `on:` trigger, so it has to be a
+     * literal; a repository whose trunk is `master` had no way to say so and
+     * silently got workflows that never fired. GitLab reads `$CI_DEFAULT_BRANCH`
+     * at run time and ignores this.
+     */
+    defaultBranch?: string;
+    /**
+     * Publish this repository's own packages from CI, and announce them into the
+     * index beside them — the combined layout that `init --with-skills`
+     * scaffolds. Default `never`: a plain index owns no packages.
+     *
+     * `tag` fires on `v*` tags, `default-branch` on every push to the trunk.
+     * Either way `grim publish` skips versions the registry already has, so a
+     * re-run over unchanged packages pushes nothing.
+     */
+    publish?: PublishTrigger;
+    /** Node.js the jobs run on — `setup-node` version, and the GitLab image tag. Default `22`. */
+    nodeVersion?: string;
+    /**
+     * Refresh READMEs, changelogs, logos and version lists from the registry
+     * before building. `false` renders the enrichment steps away entirely, for
+     * a pointers-only site whose build never leaves the runner. Default `true`.
+     */
+    enrich?: boolean;
+    /** grim release the enrichment step reads the registry with — `latest` or a tag. Default `latest`. */
+    grimVersion?: string;
+    /**
+     * Squash-merge a pull request the gate passed, then deploy. Default `false`:
+     * merging an untrusted contribution unattended is a policy this package will
+     * not assume on a repository's behalf.
+     *
+     * GitHub only, and deliberately. GitHub always runs the base branch's copy
+     * of a `pull_request_target` workflow, so the gate a pull request faces is
+     * one it cannot edit. GitLab has no equivalent — the merge request supplies
+     * its own `.gitlab-ci.yml`, and a fork's pipeline runs in the fork — so an
+     * auto-merge there would act on a verdict the contributor could write.
+     */
+    autoMerge?: boolean;
+    /**
+     * Own these files by hand. The `verify-ci` drift guard is then not emitted,
+     * `ci --check` is the only thing left that would notice an edit, and CI
+     * fixes stop arriving by re-render. Discouraged, and deliberately not the
+     * default — but it is the repository's CI, so it is the repository's call.
+     */
+    allowManualEdits?: boolean;
+}
+export type ResolvedCiConfig = Required<CiConfig>;
+/** Fill every gap from the defaults documented on [`CiConfig`]. */
+export declare function resolveCi(ci: CiConfig | undefined): ResolvedCiConfig;
+/** Validate the `ci` block of an already-parsed config object. */
+export declare function validateCi(raw: unknown): CiConfig;
+/** Read the `ci` block out of `index.config.json`. A missing file means defaults. */
+export declare function loadCiConfig(root: string): Promise<CiConfig>;
+/**
+ * First line of every file this renderer writes. Stale detection keys on it,
+ * so a repository's hand-written workflows are never mistaken for ours.
+ *
+ * Deliberately carries no version stamp. The version that renders these files
+ * is the one in the repository's own `package-lock.json`; stamping it here too
+ * would be a second copy that goes stale, and every dependency bump would red
+ * the drift guard until somebody re-rendered a file whose content had not
+ * changed.
+ */
+export declare const GENERATED_HEADER = "# Generated by @grimoire-rs/indexer";
+/**
+ * Render the complete CI file set. Nothing touches disk — the caller writes
+ * it or diffs it against what is committed.
+ */
+export declare function renderCi(ci: ResolvedCiConfig): Map<string, string>;
+/**
+ * Canonicalize a generated file for drift comparison.
+ *
+ * The index repository owns the *pin* on every `uses:` action reference —
+ * its own Renovate or Dependabot will bump `uses: owner/action@<ref>  # vX`,
+ * and the guard must not read that as a hand-edit. Only the `@<ref>` suffix
+ * and any trailing version comment are stripped; `owner/action` survives, so
+ * swapping in a different action still trips drift.
+ */
+export declare function normalizeForDrift(content: string): string;
+/**
+ * Files on disk that carry our header but that the current config no longer
+ * renders — a `forge` narrowed from `both`, or `allowManualEdits` turned on
+ * after a guard was already committed. Reported, never deleted: removing a
+ * file from somebody's repository is their call, not the renderer's.
+ */
+export declare function staleCi(root: string, files: Map<string, string>): Promise<string[]>;
+export interface CiOutcome {
+    path: string;
+    /** `written` on a render; `drift`/`stale`/`ok` on a check. */
+    status: "written" | "unchanged" | "ok" | "drift" | "stale";
+}
+/**
+ * Write the rendered set, overwriting whatever is there.
+ *
+ * "Whatever is there" is judged through [`normalizeForDrift`], the same lens
+ * the guard uses — not raw bytes. Otherwise the two disagreed: `ci --check`
+ * deliberately tolerates a bumped `uses: owner/action@<ref>`, while a plain
+ * `npm run ci` rewrote it back to the pin baked into this package, silently
+ * undoing every Renovate bump the repository is told it may make. The repo
+ * owns its pins; a render must not take them back.
+ */
+export declare function writeCi(root: string, files: Map<string, string>): Promise<CiOutcome[]>;
+/**
+ * Compare the rendered set against what is committed. Missing counts as
+ * drift; a generated file the config no longer renders counts as stale.
+ * Hints are path-only — the contents of a repository's CI never go to stderr.
+ */
+export declare function checkCi(root: string, files: Map<string, string>): Promise<CiOutcome[]>;
+/**
+ * The re-render command a drift message tells the reader to run. It is the
+ * repository's own npm script, so it runs the renderer the lock pins rather
+ * than whatever `npx` would fetch today.
+ */
+export declare const RE_RENDER_COMMAND = "npm run ci";
+/** Turn a failed check into the error the CLI exits on. */
+export declare function driftError(outcomes: CiOutcome[]): CliError;
+//# sourceMappingURL=ci.d.ts.map

package/dist/ci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,QAAQ,EAAQ,MAAM,eAAe,CAAC;AAI/C;;;;GAIG;AACH,MAAM,MAAM,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExC,eAAO,MAAM,MAAM,EAAE,SAAS,KAAK,EAAyB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,GAAG,gBAAgB,CAAC;AAEhE,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAuC,CAAC;AAU9F;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,oDAAoD;IACpD,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAElD,mEAAmE;AACnE,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAWpE;AAMD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA+CjD;AAED,qFAAqF;AACrF,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkBlE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,wCAAwC,CAAC;AA4CtE;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASzD;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBzF;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;CAC5D;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAc5F;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAW5F;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,CAO1D"}

package/dist/ci.js

@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 The Grimoire Authors
+// The CI renderer: `index.config.json`'s `ci` block in, complete workflow
+// files out. The index repository owns and commits what it runs — there is no
+// reusable workflow to call, no remote include to fetch, and nothing about the
+// pipeline that lives anywhere but in the repository being pushed.
+//
+// The trade that buys is the drift guard: because the files are generated,
+// `grim-indexer ci --check` can re-render and diff, and the generated
+// `verify-ci` job runs exactly that on every push and pull request. So a
+// hand-edit is caught rather than silently forked, while the repository keeps
+// full ownership of its own CI — set `allowManualEdits` and the guard is not
+// emitted at all.
+import fs from "node:fs/promises";
+import path from "node:path";
+import { CliError, EXIT } from "./cli/exit.js";
+import { CONFIG_FILE, SiteConfigError } from "./config.js";
+import { fromTemplate } from "./templates.js";
+export const FORGES = ["github", "gitlab"];
+export const PUBLISH_TRIGGERS = ["never", "tag", "default-branch"];
+/**
+ * Branch names are a permissive set — anything git accepts minus its own
+ * rules — but this one lands unquoted inside a YAML flow sequence, so it is
+ * bounded to what cannot restructure the document. Every real branch name
+ * fits; `refs/heads/` prefixes and quoting do not, which is the point.
+ */
+const BRANCH = /^[A-Za-z0-9][\w./-]*$/;
+/** Fill every gap from the defaults documented on [`CiConfig`]. */
+export function resolveCi(ci) {
+    return {
+        forge: ci?.forge ?? "github",
+        defaultBranch: ci?.defaultBranch ?? "main",
+        nodeVersion: ci?.nodeVersion ?? "22",
+        enrich: ci?.enrich ?? true,
+        grimVersion: ci?.grimVersion ?? "latest",
+        allowManualEdits: ci?.allowManualEdits ?? false,
+        autoMerge: ci?.autoMerge ?? false,
+        publish: ci?.publish ?? "never",
+    };
+}
+function fail(msg) {
+    throw new SiteConfigError(`${CONFIG_FILE}: ci.${msg}`);
+}
+/** Validate the `ci` block of an already-parsed config object. */
+export function validateCi(raw) {
+    if (raw === undefined || raw === null)
+        return {};
+    if (typeof raw !== "object" || Array.isArray(raw)) {
+        throw new SiteConfigError(`${CONFIG_FILE}: ci must be an object`);
+    }
+    const ci = raw;
+    if (ci.forge !== undefined && !FORGES.includes(ci.forge)) {
+        fail(`forge must be one of ${FORGES.join(", ")}`);
+    }
+    // These land inside a double-quoted shell word or a docker image tag in the
+    // generated YAML. The repository owner writes this file, so it is a paste
+    // guard rather than a trust boundary — but a value carrying a quote or a `$`
+    // would rewrite the command around it, and no version string needs either.
+    for (const key of ["nodeVersion", "grimVersion"]) {
+        const value = ci[key];
+        if (value !== undefined && typeof value !== "string")
+            fail(`${key} must be a string`);
+        if (typeof value === "string" && !/^[\w.@^~><=* +-]+$/.test(value)) {
+            fail(`${key} must be a plain version or range`);
+        }
+    }
+    for (const key of ["enrich", "allowManualEdits", "autoMerge"]) {
+        if (ci[key] !== undefined && typeof ci[key] !== "boolean")
+            fail(`${key} must be a boolean`);
+    }
+    if (ci.publish !== undefined && !PUBLISH_TRIGGERS.includes(ci.publish)) {
+        fail(`publish must be one of ${PUBLISH_TRIGGERS.join(", ")}`);
+    }
+    if (ci.defaultBranch !== undefined) {
+        if (typeof ci.defaultBranch !== "string")
+            fail("defaultBranch must be a string");
+        if (!BRANCH.test(ci.defaultBranch))
+            fail("defaultBranch must be a plain branch name");
+        // Slashes are legal in a branch name, so the charset check cannot catch
+        // this one. GitHub's `branches:` matches the short name; a full ref there
+        // is accepted by the YAML, matches nothing, and the workflow simply never
+        // fires — a silent failure worth one explicit line.
+        if (ci.defaultBranch.startsWith("refs/")) {
+            fail("defaultBranch must be the short branch name, not a full ref");
+        }
+    }
+    // Refused rather than ignored. Rendering GitLab CI while the config asks for
+    // auto-merge would leave a repository believing contributions land by
+    // themselves, and the honest answer is that they cannot be made to safely
+    // there — see the field's doc comment.
+    if (ci.autoMerge === true && ci.forge === "gitlab") {
+        fail("autoMerge is github-only - the GitLab gate cannot be made tamper-proof");
+    }
+    return ci;
+}
+/** Read the `ci` block out of `index.config.json`. A missing file means defaults. */
+export async function loadCiConfig(root) {
+    let text;
+    try {
+        text = await fs.readFile(path.join(root, CONFIG_FILE), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        throw new SiteConfigError(`${CONFIG_FILE}: ${err.message}`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new SiteConfigError(`${CONFIG_FILE}: must contain a JSON object`);
+    }
+    return validateCi(parsed.ci);
+}
+// ── Rendering ────────────────────────────────────────────────────────────────
+/**
+ * First line of every file this renderer writes. Stale detection keys on it,
+ * so a repository's hand-written workflows are never mistaken for ours.
+ *
+ * Deliberately carries no version stamp. The version that renders these files
+ * is the one in the repository's own `package-lock.json`; stamping it here too
+ * would be a second copy that goes stale, and every dependency bump would red
+ * the drift guard until somebody re-rendered a file whose content had not
+ * changed.
+ */
+export const GENERATED_HEADER = "# Generated by @grimoire-rs/indexer";
+/**
+ * What CI scaffolded by a pre-header release (<= 0.2.2) looks like: a thin
+ * caller pointing back at this package's reusable workflow, or a GitLab
+ * remote include of the same. Those files carry no generated header, so
+ * without this the reaper was blind to exactly the repositories that most
+ * need telling — an index scaffolded with the old `--forge both` resolves to
+ * `forge: "github"` today (its config has no `ci` block at all) and would
+ * keep serving an orphaned `.gitlab-ci.yml` with nothing to say so.
+ */
+const LEGACY_SIGNATURE = /uses:\s*grimoire-rs\/indexer\/\.github\/workflows\/|raw\.githubusercontent\.com\/grimoire-rs\/indexer\//;
+/** Where each forge's files land. */
+const GITHUB_FILES = {
+    pages: ".github/workflows/pages.yml",
+    validate: ".github/workflows/validate.yml",
+    verify: ".github/workflows/verify-ci.yml",
+    publish: ".github/workflows/publish.yml",
+};
+const GITLAB_FILE = ".gitlab-ci.yml";
+/**
+ * Where the grim release tarball is fetched from. `latest` has its own URL
+ * shape on GitHub releases; anything else is a tag. Resolving it here rather
+ * than in the generated shell is the point of rendering CI from config: a
+ * value that is fixed at render time should not be a branch at run time.
+ */
+function grimReleaseBase(grimVersion) {
+    const releases = "https://github.com/grimoire-rs/grimoire/releases";
+    return grimVersion === "latest"
+        ? `${releases}/latest/download`
+        : `${releases}/download/${grimVersion}`;
+}
+/**
+ * `paths:` entries that must re-run the drift guard — every file it renders,
+ * plus the config they are rendered from. `package-lock.json` is in there
+ * because the lock is what decides which renderer produces them.
+ */
+const VERIFY_PATHS = [CONFIG_FILE, "package.json", "package-lock.json", ".github/workflows/**"];
+/**
+ * Render the complete CI file set. Nothing touches disk — the caller writes
+ * it or diffs it against what is committed.
+ */
+export function renderCi(ci) {
+    const base = {
+        nodeVersion: ci.nodeVersion,
+        defaultBranch: ci.defaultBranch,
+        grimVersion: ci.grimVersion,
+        grimReleaseBase: grimReleaseBase(ci.grimVersion),
+    };
+    // Rendered first: `render` is single-pass, so a block handed in as a value
+    // must already have its own placeholders resolved. The trailing newline is
+    // trimmed because the template supplies one on the placeholder's own line —
+    // keeping both would leave a stray blank line, or an empty block would not.
+    const block = (rel) => fromTemplate(rel, base).replace(/\n$/, "");
+    const vars = {
+        ...base,
+        header: fromTemplate("ci/header.txt", base),
+        githubEnrichSteps: ci.enrich ? block("ci/github-enrich.yml") : "",
+        gitlabEnrichScript: ci.enrich ? block("ci/gitlab-enrich.sh") : "",
+        verifyPaths: VERIFY_PATHS.map((entry) => `      - ${entry}`).join("\n"),
+        gitlabVerifyJob: ci.allowManualEdits ? "" : block("ci/gitlab-verify.yml"),
+        // GitHub only — `validateCi` refuses the GitLab combination outright, so
+        // there is no silently-inert case to render around here.
+        githubAutoMergeJob: ci.autoMerge ? block("ci/github-automerge.yml") : "",
+        // Two forges, one decision. Each spells "on a v-tag" and "on the trunk"
+        // its own way, and neither can express the other's — GitHub needs a
+        // literal branch in `on:` (hence `ci.defaultBranch`), GitLab reads
+        // `$CI_DEFAULT_BRANCH` at run time and needs no such key.
+        publishTrigger: ci.publish === "tag"
+            ? '  push:\n    tags: ["v*"]'
+            : `  push:\n    branches: [${ci.defaultBranch}]`,
+        // Rendered with its own rule already substituted: `render` is single-pass,
+        // so a placeholder inside a block handed in as a value never resolves.
+        gitlabPublishJob: ci.publish === "never"
+            ? ""
+            : fromTemplate("ci/gitlab-publish.yml", {
+                ...base,
+                gitlabPublishRule: ci.publish === "tag"
+                    ? "    - if: $CI_COMMIT_TAG =~ /^v/"
+                    : "    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
+            }).replace(/\n$/, ""),
+    };
+    // Exactly one trailing newline, whatever the placeholders resolved to. An
+    // optional block that renders empty at the end of a file otherwise leaves
+    // its own blank line behind, so the same config produced two shapes.
+    const file = (rel) => fromTemplate(rel, vars).replace(/\n*$/, "\n");
+    const files = new Map();
+    if (ci.forge === "github") {
+        files.set(GITHUB_FILES.pages, file("ci/github-pages.yml"));
+        files.set(GITHUB_FILES.validate, file("ci/github-validate.yml"));
+        if (!ci.allowManualEdits) {
+            files.set(GITHUB_FILES.verify, file("ci/github-verify-ci.yml"));
+        }
+        // Its own file rather than a job in `pages.yml`: it runs on a different
+        // trigger, and an index that publishes nothing should carry no publish
+        // workflow at all — `staleCi` then reports the leftover if the key is
+        // turned back off.
+        if (ci.publish !== "never") {
+            files.set(GITHUB_FILES.publish, file("ci/github-publish.yml"));
+        }
+    }
+    else {
+        files.set(GITLAB_FILE, file("ci/gitlab-ci.yml"));
+    }
+    return files;
+}
+/**
+ * Canonicalize a generated file for drift comparison.
+ *
+ * The index repository owns the *pin* on every `uses:` action reference —
+ * its own Renovate or Dependabot will bump `uses: owner/action@<ref>  # vX`,
+ * and the guard must not read that as a hand-edit. Only the `@<ref>` suffix
+ * and any trailing version comment are stripped; `owner/action` survives, so
+ * swapping in a different action still trips drift.
+ */
+export function normalizeForDrift(content) {
+    // Line endings first. Git for Windows installs with `core.autocrlf=true` by
+    // default, so an untouched clone has CRLF on disk while the renderer emits
+    // LF — every generated file read as drift, and `npm run ci` could not clear
+    // it because the rewrite was LF too. The scaffold ships a `.gitattributes`
+    // that prevents it; this unsticks the checkouts that already have it.
+    return content
+        .replace(/\r\n/g, "\n")
+        .replace(/^([ \t]*(?:-[ \t]+)?uses:[ \t]*[^@\s]+)@[^\s#]+(?:[ \t]*#[^\n]*)?$/gm, "$1");
+}
+/**
+ * Files on disk that carry our header but that the current config no longer
+ * renders — a `forge` narrowed from `both`, or `allowManualEdits` turned on
+ * after a guard was already committed. Reported, never deleted: removing a
+ * file from somebody's repository is their call, not the renderer's.
+ */
+export async function staleCi(root, files) {
+    const candidates = [GITLAB_FILE];
+    try {
+        for (const entry of await fs.readdir(path.join(root, ".github/workflows"))) {
+            if (/\.ya?ml$/.test(entry))
+                candidates.push(`.github/workflows/${entry}`);
+        }
+    }
+    catch {
+        /* no workflows directory — nothing of ours can be stale in it */
+    }
+    const stale = [];
+    for (const relative of candidates) {
+        if (files.has(relative))
+            continue;
+        const content = await fs.readFile(path.join(root, relative), "utf8").catch(() => null);
+        if (content === null)
+            continue;
+        if (content.startsWith(GENERATED_HEADER) || LEGACY_SIGNATURE.test(content)) {
+            stale.push(relative);
+        }
+    }
+    return stale.sort();
+}
+/**
+ * Write the rendered set, overwriting whatever is there.
+ *
+ * "Whatever is there" is judged through [`normalizeForDrift`], the same lens
+ * the guard uses — not raw bytes. Otherwise the two disagreed: `ci --check`
+ * deliberately tolerates a bumped `uses: owner/action@<ref>`, while a plain
+ * `npm run ci` rewrote it back to the pin baked into this package, silently
+ * undoing every Renovate bump the repository is told it may make. The repo
+ * owns its pins; a render must not take them back.
+ */
+export async function writeCi(root, files) {
+    const outcomes = [];
+    for (const [relative, content] of files) {
+        const abs = path.join(root, relative);
+        const current = await fs.readFile(abs, "utf8").catch(() => null);
+        if (current !== null && normalizeForDrift(current) === normalizeForDrift(content)) {
+            outcomes.push({ path: relative, status: "unchanged" });
+            continue;
+        }
+        await fs.mkdir(path.dirname(abs), { recursive: true });
+        await fs.writeFile(abs, content);
+        outcomes.push({ path: relative, status: "written" });
+    }
+    return outcomes;
+}
+/**
+ * Compare the rendered set against what is committed. Missing counts as
+ * drift; a generated file the config no longer renders counts as stale.
+ * Hints are path-only — the contents of a repository's CI never go to stderr.
+ */
+export async function checkCi(root, files) {
+    const outcomes = [];
+    for (const [relative, expected] of files) {
+        const actual = await fs.readFile(path.join(root, relative), "utf8").catch(() => null);
+        const same = actual !== null && normalizeForDrift(actual) === normalizeForDrift(expected);
+        outcomes.push({ path: relative, status: same ? "ok" : "drift" });
+    }
+    for (const relative of await staleCi(root, files)) {
+        outcomes.push({ path: relative, status: "stale" });
+    }
+    return outcomes;
+}
+/**
+ * The re-render command a drift message tells the reader to run. It is the
+ * repository's own npm script, so it runs the renderer the lock pins rather
+ * than whatever `npx` would fetch today.
+ */
+export const RE_RENDER_COMMAND = "npm run ci";
+/** Turn a failed check into the error the CLI exits on. */
+export function driftError(outcomes) {
+    const bad = outcomes.filter((outcome) => outcome.status !== "ok");
+    return new CliError(`${bad.length} generated CI file(s) do not match ${CONFIG_FILE} — ` +
+        `re-run \`${RE_RENDER_COMMAND}\` and commit the result`, EXIT.data);
+}
+//# sourceMappingURL=ci.js.map

package/dist/ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,kBAAkB;AAClB,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAS9C,MAAM,CAAC,MAAM,MAAM,GAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAa7D,MAAM,CAAC,MAAM,gBAAgB,GAA8B,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAgEvC,mEAAmE;AACnE,MAAM,UAAU,SAAS,CAAC,EAAwB;IAChD,OAAO;QACL,KAAK,EAAE,EAAE,EAAE,KAAK,IAAI,QAAQ;QAC5B,aAAa,EAAE,EAAE,EAAE,aAAa,IAAI,MAAM;QAC1C,WAAW,EAAE,EAAE,EAAE,WAAW,IAAI,IAAI;QACpC,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,IAAI;QAC1B,WAAW,EAAE,EAAE,EAAE,WAAW,IAAI,QAAQ;QACxC,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,IAAI,KAAK;QAC/C,SAAS,EAAE,EAAE,EAAE,SAAS,IAAI,KAAK;QACjC,OAAO,EAAE,EAAE,EAAE,OAAO,IAAI,OAAO;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,QAAQ,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,wBAAwB,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,EAAE,GAAG,GAA8B,CAAC;IAE1C,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAc,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG,GAAG,mCAAmC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9D,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAyB,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACtF,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,oDAAoD;QACpD,IAAI,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,sEAAsE;IACtE,0EAA0E;IAC1E,uCAAuC;IACvC,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnD,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,EAAc,CAAC;AACxB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,8BAA8B,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,UAAU,CAAE,MAAkC,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GACpB,yGAAyG,CAAC;AAE5G,qCAAqC;AACrC,MAAM,YAAY,GAAG;IACnB,KAAK,EAAE,6BAA6B;IACpC,QAAQ,EAAE,gCAAgC;IAC1C,MAAM,EAAE,iCAAiC;IACzC,OAAO,EAAE,+BAA+B;CAChC,CAAC;AAEX,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,QAAQ,GAAG,kDAAkD,CAAC;IACpE,OAAO,WAAW,KAAK,QAAQ;QAC7B,CAAC,CAAC,GAAG,QAAQ,kBAAkB;QAC/B,CAAC,CAAC,GAAG,QAAQ,aAAa,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;AAEhG;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAoB;IAC3C,MAAM,IAAI,GAA2B;QACnC,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;QAC/B,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC,WAAW,CAAC;KACjD,CAAC;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAA2B;QACnC,GAAG,IAAI;QACP,MAAM,EAAE,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC;QAC3C,iBAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;QACjE,kBAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE;QACjE,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACvE,eAAe,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACzE,yEAAyE;QACzE,yDAAyD;QACzD,kBAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,0DAA0D;QAC1D,cAAc,EACZ,EAAE,CAAC,OAAO,KAAK,KAAK;YAClB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,2BAA2B,EAAE,CAAC,aAAa,GAAG;QACpD,2EAA2E;QAC3E,uEAAuE;QACvE,gBAAgB,EACd,EAAE,CAAC,OAAO,KAAK,OAAO;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,YAAY,CAAC,uBAAuB,EAAE;gBACpC,GAAG,IAAI;gBACP,iBAAiB,EACf,EAAE,CAAC,OAAO,KAAK,KAAK;oBAClB,CAAC,CAAC,kCAAkC;oBACpC,CAAC,CAAC,mDAAmD;aAC1D,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;KAC5B,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC3D,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,mBAAmB;QACnB,IAAI,EAAE,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,OAAO,OAAO;SACX,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;SACtB,OAAO,CAAC,sEAAsE,EAAE,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAA0B;IACpE,MAAM,UAAU,GAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAA0B;IACpE,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,OAAO,KAAK,IAAI,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAA0B;IACpE,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE9C,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,QAAqB;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAClE,OAAO,IAAI,QAAQ,CACjB,GAAG,GAAG,CAAC,MAAM,sCAAsC,WAAW,KAAK;QACjE,YAAY,iBAAiB,0BAA0B,EACzD,IAAI,CAAC,IAAI,CACV,CAAC;AACJ,CAAC"}

package/dist/cli/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAQA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1D,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6B9E"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAQA,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGhD,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkB9E"}