@homeflare/config 0.11.1 → 0.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/repo-shape/dependabot.d.ts +11 -17
- package/dist/repo-shape/dependabot.d.ts.map +1 -1
- package/dist/repo-shape/drift.d.ts +1 -1
- package/dist/repo-shape/drift.d.ts.map +1 -1
- package/dist/repo-shape/guards.d.ts +5 -0
- package/dist/repo-shape/guards.d.ts.map +1 -1
- package/dist/repo-shape/refresh.d.ts +5 -1
- package/dist/repo-shape/refresh.d.ts.map +1 -1
- package/dist/repo-shape/render.d.ts.map +1 -1
- package/dist/repo-shape/retired.d.ts +54 -0
- package/dist/repo-shape/retired.d.ts.map +1 -0
- package/dist/repo-shape/shape.d.ts +1 -1
- package/dist/repo-shape/shape.d.ts.map +1 -1
- package/dist/repo-shape.d.ts +3 -4
- package/dist/repo-shape.d.ts.map +1 -1
- package/dist/repo-shape.js +167 -205
- package/dist/repo-shape.js.map +10 -10
- package/dist/versions.js +7 -1
- package/dist/versions.js.map +4 -4
- package/docs/repo-shape-dependabot.md +31 -43
- package/docs/repo-shape-retired.md +75 -0
- package/docs/repo-shape.md +11 -0
- package/package.json +1 -1
- package/src/repo-shape/dependabot.ts +23 -38
- package/src/repo-shape/drift.ts +19 -1
- package/src/repo-shape/guards.ts +11 -0
- package/src/repo-shape/refresh.ts +55 -2
- package/src/repo-shape/render.ts +0 -3
- package/src/repo-shape/retired.ts +113 -0
- package/src/repo-shape/shape.ts +0 -1
- package/src/repo-shape.ts +9 -4
- package/dist/repo-shape/automerge.d.ts +0 -17
- package/dist/repo-shape/automerge.d.ts.map +0 -1
- package/src/repo-shape/automerge.ts +0 -144
package/dist/repo-shape.js.map
CHANGED
|
@@ -1,20 +1,20 @@
|
|
|
1
1
|
{
|
|
2
2
|
"version": 3,
|
|
3
|
-
"sources": ["../src/repo-shape/
|
|
3
|
+
"sources": ["../src/repo-shape/guards.ts", "../src/repo-shape/shape.ts", "../src/repo-shape/yaml.ts", "../src/repo-shape/ci.ts", "../src/repo-shape/companions.ts", "../src/repo-shape/dependabot.ts", "../src/repo-shape/security.ts", "../src/repo-shape/render.ts", "../src/repo-shape/retired.ts", "../src/repo-shape/drift.ts", "../src/repo-shape/refresh.ts"],
|
|
4
4
|
"sourcesContent": [
|
|
5
|
-
"/**\n *
|
|
6
|
-
"/**\n * The runtime guards `repo-shape` needs and its types cannot express.\n *\n * ★ EXTRACTED FROM `shape.ts`, NOT INVENTED HERE. The types carry one half of the\n * contract — `Stated<R>` refuses an empty or computed reason at compile time — and\n * these carry the other half: the cases a literal type still lets through. Keeping\n * them in one file is what lets `shape.ts` stay the declaration and nothing else.\n *\n * ⚠️ EVERY MESSAGE STARTS `repo-shape:` AND NAMES THE FIELD. These throw at render or at\n * declaration, far from the workflow file they would otherwise break at job time, so\n * the message is the only thing pointing back at the call that caused it.\n */\n\nconst SENTENCE = 12;\n\nexport function requireNonEmpty(field: string, value: string): string {\n const trimmed = value.trim();\n if (trimmed.length === 0) throw new Error(`repo-shape: ${field} must not be blank`);\n return trimmed;\n}\n\nexport function requireSentence(field: string, value: string): string {\n const trimmed = value.trim();\n // ⚠️ THE TYPE CANNOT CATCH `reason: ' '`. `' '` is a non-empty literal, so `Stated`\n // lets it through and only this does not. Type and guard cover different halves.\n if (trimmed.length < SENTENCE) {\n throw new Error(`repo-shape: ${field} must be a sentence, got ${JSON.stringify(value)}`);\n }\n return trimmed;\n}\n\nexport function requireIsoDate(value: string): string {\n if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(value)) {\n throw new Error(`repo-shape: since must be YYYY-MM-DD, got ${JSON.stringify(value)}`);\n }\n return value;\n}\n\n/**\n * ⛔ A MAJOR, NOT A RANGE, AND NOT A FLOAT. `actions/setup-node` takes `node-version: 24`\n * and resolves the newest 24.x; a fractional or negative value renders YAML the action\n * accepts and then fails to resolve, mid-job, on the runner.\n */\nexport function requireMajor(value: number): number {\n if (!Number.isInteger(value) || value <= 0) {\n throw new Error(`repo-shape: node must be a positive integer major, got ${value}`);\n }\n return value;\n}\n\n/** `timeout-minutes` must be a positive whole number of minutes. */\nexport function requireMinutes(value: number): number {\n if (!Number.isInteger(value) || value <= 0) {\n throw new Error(`repo-shape: timeout must be a positive whole minute count, got ${value}`);\n }\n return value;\n}\n\nexport function requireJobId(value: string): string {\n // ⛔ The id becomes a YAML key and a `needs:` entry. Anything else renders a workflow\n // GitHub rejects at parse time, which reports as \"workflow file issue\" with no line.\n if (!/^[a-z][a-z0-9_-]*$/.test(value)) {\n throw new Error(\n `repo-shape: job id must match /^[a-z][a-z0-9_-]*$/, got ${JSON.stringify(value)}`,\n );\n }\n return value;\n}\n",
|
|
7
|
-
"/**\n * `RepoShape` — one HomeFlare repository's tooling, as a value.\n *\n * ★ WHY THIS TYPE EXISTS. Measured across the estate on 2026-09-22: 13 repositories each\n * carry a hand-written `.github/workflows/ci.yml`, `security.yml`, `.github/actionlint.yaml`\n * and `.changeset/config.json`. The changeset configs were byte-identical apart from the\n * repository name in 11 of 13. The security workflows were not: five still carried\n * `push: branches: [main]` that the other eight had removed, five were missing the\n * `concurrency:` block entirely, two were missing `pull-requests: read` (whose absence\n * makes every pull-request scan fail 403), the gitleaks action was pinned at `@v2` in\n * five and `@v3` in eight, and the weekly cron minute took three different values. Not\n * one of those differences was a decision. They are what happens when the same edit is\n * applied by hand thirteen times.\n *\n * ⛔ SO: A DIFFERENCE IS EITHER AN INPUT OR AN EXCEPTION. Nothing else. A repository that\n * needs something the standard does not give it either widens this type — and every\n * repository gets the widening — or declares an exception with a stated reason. There\n * is no third option where a file is quietly edited, because `drift.ts` fails on it.\n *\n * ⚠️ THE REASON IS ENFORCED BY THE COMPILER, NOT BY REVIEW. `except()` and `extraJob()`\n * below refuse an empty reason and refuse a reason read out of a variable, so the text\n * has to be written at the exception. See `Stated`.\n */\n\nimport {\n requireIsoDate,\n requireJobId,\n requireMajor,\n requireMinutes,\n requireNonEmpty,\n requireSentence,\n} from './guards.ts';\n\n/** Where a repository's jobs run. */\nexport type RepoRunner =\n /**\n * `[self-hosted, homeflare-mini]` — the interim Linux arm64 runner on the Mac mini.\n * ⚠️ GitHub-hosted runners are refused for this account (billing lock, 2026-09-22).\n */\n | 'mini'\n /** `ubuntu-latest`. Public repositories, where GitHub-hosted minutes are free. */\n | 'github';\n\n/** One step in a rendered job. Either a `uses:` or a `run:`, never both. */\nexport type JobStep = {\n readonly name?: string;\n /**\n * The step's `if:` condition, verbatim.\n *\n * ★ WIDENED RATHER THAN EXCEPTED, 2026-09-22. homeflare-kit's `consumer smoke test`\n * ends with a step that renders the packed tarball sizes onto the run summary, and\n * it carries `if: always()` on purpose — a FAILED smoke test is exactly when the\n * sizes are worth reading. Without this field kit had two options and both were\n * worse: drop the condition, losing the summary on the only runs that need it, or\n * `except('.github/workflows/ci.yml')`, which buys one repository its file back and\n * costs the estate the guarantee on it. One optional key gives every repository the\n * same freedom, which is the order of preference this module documents.\n * ⚠️ NOT VALIDATED. GitHub's expression grammar is the vendor's; a bad condition is\n * caught by `actionlint` in the `workflow lint` job, which is where it belongs.\n */\n readonly if?: string;\n readonly env?: Readonly<Record<string, string>>;\n} & (\n | {\n readonly uses: string;\n readonly with?: Readonly<Record<string, string | number>>;\n readonly run?: never;\n }\n | { readonly run: string; readonly uses?: never; readonly with?: never }\n);\n\n/**\n * ⛔ A REASON MUST BE WRITTEN, NOT COMPUTED. `'' extends R` is true for the empty literal\n * AND for the wide `string` type, so both collapse to `never` and fail to typecheck:\n * `reason: ''` is refused, and so is `reason: someVariable`. Only a string literal\n * written at the call site survives — which is the whole point, because a reason\n * assembled at runtime is a reason nobody reads in the diff.\n * Verified against TypeScript 7.0.2 on 2026-09-22; `tests/repo-shape-reason.test.ts`\n * compiles the refusals and asserts they still fail.\n */\nexport type Stated<R extends string> = '' extends R ? never : R;\n\n/** Paths this package renders. A deviation names one of these, not an arbitrary file. */\nexport type RenderedPath =\n | '.changeset/config.json'\n | '.github/actionlint.yaml'\n | '.github/dependabot.yml'\n | '.github/workflows/ci.yml'\n | '.github/workflows/dependabot-automerge.yml'\n | '.github/workflows/security.yml';\n\nexport interface RepoShapeException {\n /** The rendered file this repository does not take from the renderer. */\n readonly file: RenderedPath;\n /** Why — written at the exception, in a sentence a stranger can act on. */\n readonly reason: string;\n /** `YYYY-MM-DD` the exception was taken, so a stale one is visible. */\n readonly since: string;\n}\n\ninterface ExceptionInput {\n readonly file: RenderedPath;\n readonly reason: string;\n readonly since: string;\n}\n\n/**\n * Declare that this repository keeps its own copy of a rendered file.\n *\n * except({\n * file: '.github/workflows/ci.yml',\n * reason: 'Payload needs Node >=24.15, which the rendered job does not install',\n * since: '2026-09-22',\n * })\n *\n * ⛔ THE DRIFT CHECK STOPS CHECKING THAT FILE. That is the trade: an exception buys the\n * freedom to hand-edit one file and pays for it by losing the guarantee on that file.\n * Prefer widening `RepoShape` — then every repository benefits and nothing is lost.\n */\nexport function except<const E extends ExceptionInput>(\n exception: E & { readonly reason: Stated<E['reason']> },\n): RepoShapeException {\n return {\n file: exception.file,\n reason: requireSentence('reason', exception.reason),\n since: requireIsoDate(exception.since),\n };\n}\n\nexport interface ExtraJob {\n /** The job key in `jobs:`, e.g. `package`. Lower-case, dashes allowed. */\n readonly id: string;\n /**\n * The job's `name:`, which is also the status-check context. It joins the `ci`\n * aggregate's `needs`, so the branch ruleset still requires exactly one check.\n */\n readonly name: string;\n /** Why this repository has a job the other twelve do not. */\n readonly reason: string;\n /** Steps after checkout. The prologue (checkout, bun, install) is rendered for you. */\n readonly steps: readonly JobStep[];\n /** Job ids this one waits for. Default: none, so it runs beside `check`. */\n readonly needs?: readonly string[];\n /** `false` skips the rendered bun prologue — for a job that needs another toolchain. */\n readonly bun?: boolean;\n /**\n * `timeout-minutes:` for this job. Omitted takes GitHub's 360-minute default.\n *\n * ⚠️ AN INPUT BECAUSE A HUNG JOB IS NOT A FAILED JOB. Measured 2026-09-22:\n * homeflare-blog's `runtime` job drives Playwright against a local workerd, and a\n * browser that never reaches its first paint holds a self-hosted slot for six hours\n * rather than reporting red. On a 3-slot pool that is the whole pool. Only a job\n * that starts something with its own wait — a browser, a server, a container — needs\n * this; `check` does not, because `bun run check` exits.\n */\n readonly timeout?: number;\n}\n\ninterface ExtraJobInput extends Omit<ExtraJob, 'needs' | 'bun' | 'timeout'> {\n readonly needs?: readonly string[];\n readonly bun?: boolean;\n readonly timeout?: number;\n}\n\n/**\n * Declare a job this repository needs and the standard does not have.\n * ⛔ Same rule as `except`: the reason is a written literal or it does not compile.\n */\nexport function extraJob<const J extends ExtraJobInput>(\n job: J & { readonly reason: Stated<J['reason']> },\n): ExtraJob {\n if (job.steps.length === 0) {\n throw new Error(`repo-shape: extra job \"${job.id}\" has no steps`);\n }\n return {\n bun: job.bun ?? true,\n id: requireJobId(job.id),\n // ⚠️ A DISPLAY NAME IS NOT A SENTENCE. `build` and `consumer smoke test` are both\n // correct job names; only the REASON has to be prose, because only the reason is\n // there for a reader rather than for the checks list.\n name: requireNonEmpty('name', job.name),\n needs: [...(job.needs ?? [])],\n reason: requireSentence('reason', job.reason),\n steps: [...job.steps],\n ...(job.timeout === undefined ? {} : { timeout: requireMinutes(job.timeout) }),\n };\n}\n\nexport interface RepoShape {\n /** Repository owner — a user or organization login. */\n readonly owner: string;\n /** Repository name, which is also the checkout directory name. */\n readonly repository: string;\n /** Where its jobs run. */\n readonly runner: RepoRunner;\n /**\n * `true` when the repository publishes an npm tarball. It decides `access` in the\n * changeset config and whether `privatePackages` is written at all — the two keys\n * that differ between `homeflare-kit` and every other repository.\n */\n readonly publishes: boolean;\n /**\n * Node major to install before Bun, for a repository whose own gate needs a real\n * `node` on `PATH`. Omit it — twelve of fourteen repositories are Bun-only.\n *\n * ⛔ AN INPUT, NOT AN EXCEPTION, AND THE MEASUREMENT SAYS WHY. The mini's job image\n * carries no node at all (ubuntu-latest always did), so a Bun-only prologue is right\n * for most of the estate and *silently wrong* for two repositories:\n * · homeflare-alerts — tests/alchemy-import.test.ts spawns `node` to prove the\n * modules load the way the Alchemy CLI (`node …/cli.js`) loads them. Without it,\n * three tests fail with `Executable not found in $PATH: \"node\"` (measured on the\n * runner, 2026-09-22).\n * · homeflare-blog — Payload requires Node >= 24.15, so every lane needs it.\n * Both repositories carried the same hand-written `actions/setup-node@v6` block\n * before this existed. Excepting `ci.yml` instead would hand the estate's two most\n * complicated CI files back to hand-editing, which is the opposite of the point.\n *\n * ⚠️ `package-manager-cache: false` IS RENDERED WITH IT. Bun does the installing here;\n * letting setup-node prime an npm cache costs time and caches nothing anyone reads.\n */\n readonly node?: number;\n /** Jobs beyond `check` and `workflows`. Each carries its own stated reason. */\n readonly extraJobs?: readonly ExtraJob[];\n /** Rendered files this repository keeps its own copy of, each with a reason. */\n readonly exceptions?: readonly RepoShapeException[];\n}\n\n/**\n * The validated Node major this shape asks for, or `undefined` for a Bun-only prologue.\n * ★ `RepoShape` is a plain object, so this is where `node:` is checked — at render, not\n * at declaration. A bad value fails the refresh rather than the job.\n */\nexport function nodeMajor(shape: RepoShape): number | undefined {\n return shape.node === undefined ? undefined : requireMajor(shape.node);\n}\n\n/** `runs-on:` for a runner. */\nexport function runsOn(runner: RepoRunner): string {\n return runner === 'mini' ? '[self-hosted, homeflare-mini]' : 'ubuntu-latest';\n}\n\n/** Whether a rendered path is excepted by this shape. */\nexport function isExcepted(shape: RepoShape, file: RenderedPath): boolean {\n return (shape.exceptions ?? []).some((exception) => exception.file === file);\n}\n",
|
|
5
|
+
"/**\n * The runtime guards `repo-shape` needs and its types cannot express.\n *\n * ★ EXTRACTED FROM `shape.ts`, NOT INVENTED HERE. The types carry one half of the\n * contract — `Stated<R>` refuses an empty or computed reason at compile time — and\n * these carry the other half: the cases a literal type still lets through. Keeping\n * them in one file is what lets `shape.ts` stay the declaration and nothing else.\n *\n * ⚠️ EVERY MESSAGE STARTS `repo-shape:` AND NAMES THE FIELD. These throw at render or at\n * declaration, far from the workflow file they would otherwise break at job time, so\n * the message is the only thing pointing back at the call that caused it.\n */\n\nconst SENTENCE = 12;\n\nexport function requireNonEmpty(field: string, value: string): string {\n const trimmed = value.trim();\n if (trimmed.length === 0) throw new Error(`repo-shape: ${field} must not be blank`);\n return trimmed;\n}\n\nexport function requireSentence(field: string, value: string): string {\n const trimmed = value.trim();\n // ⚠️ THE TYPE CANNOT CATCH `reason: ' '`. `' '` is a non-empty literal, so `Stated`\n // lets it through and only this does not. Type and guard cover different halves.\n if (trimmed.length < SENTENCE) {\n throw new Error(`repo-shape: ${field} must be a sentence, got ${JSON.stringify(value)}`);\n }\n return trimmed;\n}\n\nexport function requireIsoDate(value: string): string {\n if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(value)) {\n throw new Error(`repo-shape: since must be YYYY-MM-DD, got ${JSON.stringify(value)}`);\n }\n return value;\n}\n\n/**\n * A retired file names the `@homeflare/config` release that stopped rendering it, so\n * anyone reading `retired.ts` can find the changeset that made the call.\n */\nexport function requireSemver(value: string): string {\n if (!/^\\d+\\.\\d+\\.\\d+$/.test(value)) {\n throw new Error(`repo-shape: retiredIn must be a released x.y.z, got ${JSON.stringify(value)}`);\n }\n return value;\n}\n\n/**\n * ⛔ A MAJOR, NOT A RANGE, AND NOT A FLOAT. `actions/setup-node` takes `node-version: 24`\n * and resolves the newest 24.x; a fractional or negative value renders YAML the action\n * accepts and then fails to resolve, mid-job, on the runner.\n */\nexport function requireMajor(value: number): number {\n if (!Number.isInteger(value) || value <= 0) {\n throw new Error(`repo-shape: node must be a positive integer major, got ${value}`);\n }\n return value;\n}\n\n/** `timeout-minutes` must be a positive whole number of minutes. */\nexport function requireMinutes(value: number): number {\n if (!Number.isInteger(value) || value <= 0) {\n throw new Error(`repo-shape: timeout must be a positive whole minute count, got ${value}`);\n }\n return value;\n}\n\nexport function requireJobId(value: string): string {\n // ⛔ The id becomes a YAML key and a `needs:` entry. Anything else renders a workflow\n // GitHub rejects at parse time, which reports as \"workflow file issue\" with no line.\n if (!/^[a-z][a-z0-9_-]*$/.test(value)) {\n throw new Error(\n `repo-shape: job id must match /^[a-z][a-z0-9_-]*$/, got ${JSON.stringify(value)}`,\n );\n }\n return value;\n}\n",
|
|
6
|
+
"/**\n * `RepoShape` — one HomeFlare repository's tooling, as a value.\n *\n * ★ WHY THIS TYPE EXISTS. Measured across the estate on 2026-09-22: 13 repositories each\n * carry a hand-written `.github/workflows/ci.yml`, `security.yml`, `.github/actionlint.yaml`\n * and `.changeset/config.json`. The changeset configs were byte-identical apart from the\n * repository name in 11 of 13. The security workflows were not: five still carried\n * `push: branches: [main]` that the other eight had removed, five were missing the\n * `concurrency:` block entirely, two were missing `pull-requests: read` (whose absence\n * makes every pull-request scan fail 403), the gitleaks action was pinned at `@v2` in\n * five and `@v3` in eight, and the weekly cron minute took three different values. Not\n * one of those differences was a decision. They are what happens when the same edit is\n * applied by hand thirteen times.\n *\n * ⛔ SO: A DIFFERENCE IS EITHER AN INPUT OR AN EXCEPTION. Nothing else. A repository that\n * needs something the standard does not give it either widens this type — and every\n * repository gets the widening — or declares an exception with a stated reason. There\n * is no third option where a file is quietly edited, because `drift.ts` fails on it.\n *\n * ⚠️ THE REASON IS ENFORCED BY THE COMPILER, NOT BY REVIEW. `except()` and `extraJob()`\n * below refuse an empty reason and refuse a reason read out of a variable, so the text\n * has to be written at the exception. See `Stated`.\n */\n\nimport {\n requireIsoDate,\n requireJobId,\n requireMajor,\n requireMinutes,\n requireNonEmpty,\n requireSentence,\n} from './guards.ts';\n\n/** Where a repository's jobs run. */\nexport type RepoRunner =\n /**\n * `[self-hosted, homeflare-mini]` — the interim Linux arm64 runner on the Mac mini.\n * ⚠️ GitHub-hosted runners are refused for this account (billing lock, 2026-09-22).\n */\n | 'mini'\n /** `ubuntu-latest`. Public repositories, where GitHub-hosted minutes are free. */\n | 'github';\n\n/** One step in a rendered job. Either a `uses:` or a `run:`, never both. */\nexport type JobStep = {\n readonly name?: string;\n /**\n * The step's `if:` condition, verbatim.\n *\n * ★ WIDENED RATHER THAN EXCEPTED, 2026-09-22. homeflare-kit's `consumer smoke test`\n * ends with a step that renders the packed tarball sizes onto the run summary, and\n * it carries `if: always()` on purpose — a FAILED smoke test is exactly when the\n * sizes are worth reading. Without this field kit had two options and both were\n * worse: drop the condition, losing the summary on the only runs that need it, or\n * `except('.github/workflows/ci.yml')`, which buys one repository its file back and\n * costs the estate the guarantee on it. One optional key gives every repository the\n * same freedom, which is the order of preference this module documents.\n * ⚠️ NOT VALIDATED. GitHub's expression grammar is the vendor's; a bad condition is\n * caught by `actionlint` in the `workflow lint` job, which is where it belongs.\n */\n readonly if?: string;\n readonly env?: Readonly<Record<string, string>>;\n} & (\n | {\n readonly uses: string;\n readonly with?: Readonly<Record<string, string | number>>;\n readonly run?: never;\n }\n | { readonly run: string; readonly uses?: never; readonly with?: never }\n);\n\n/**\n * ⛔ A REASON MUST BE WRITTEN, NOT COMPUTED. `'' extends R` is true for the empty literal\n * AND for the wide `string` type, so both collapse to `never` and fail to typecheck:\n * `reason: ''` is refused, and so is `reason: someVariable`. Only a string literal\n * written at the call site survives — which is the whole point, because a reason\n * assembled at runtime is a reason nobody reads in the diff.\n * Verified against TypeScript 7.0.2 on 2026-09-22; `tests/repo-shape-reason.test.ts`\n * compiles the refusals and asserts they still fail.\n */\nexport type Stated<R extends string> = '' extends R ? never : R;\n\n/** Paths this package renders. A deviation names one of these, not an arbitrary file. */\nexport type RenderedPath =\n | '.changeset/config.json'\n | '.github/actionlint.yaml'\n | '.github/dependabot.yml'\n | '.github/workflows/ci.yml'\n | '.github/workflows/security.yml';\n\nexport interface RepoShapeException {\n /** The rendered file this repository does not take from the renderer. */\n readonly file: RenderedPath;\n /** Why — written at the exception, in a sentence a stranger can act on. */\n readonly reason: string;\n /** `YYYY-MM-DD` the exception was taken, so a stale one is visible. */\n readonly since: string;\n}\n\ninterface ExceptionInput {\n readonly file: RenderedPath;\n readonly reason: string;\n readonly since: string;\n}\n\n/**\n * Declare that this repository keeps its own copy of a rendered file.\n *\n * except({\n * file: '.github/workflows/ci.yml',\n * reason: 'Payload needs Node >=24.15, which the rendered job does not install',\n * since: '2026-09-22',\n * })\n *\n * ⛔ THE DRIFT CHECK STOPS CHECKING THAT FILE. That is the trade: an exception buys the\n * freedom to hand-edit one file and pays for it by losing the guarantee on that file.\n * Prefer widening `RepoShape` — then every repository benefits and nothing is lost.\n */\nexport function except<const E extends ExceptionInput>(\n exception: E & { readonly reason: Stated<E['reason']> },\n): RepoShapeException {\n return {\n file: exception.file,\n reason: requireSentence('reason', exception.reason),\n since: requireIsoDate(exception.since),\n };\n}\n\nexport interface ExtraJob {\n /** The job key in `jobs:`, e.g. `package`. Lower-case, dashes allowed. */\n readonly id: string;\n /**\n * The job's `name:`, which is also the status-check context. It joins the `ci`\n * aggregate's `needs`, so the branch ruleset still requires exactly one check.\n */\n readonly name: string;\n /** Why this repository has a job the other twelve do not. */\n readonly reason: string;\n /** Steps after checkout. The prologue (checkout, bun, install) is rendered for you. */\n readonly steps: readonly JobStep[];\n /** Job ids this one waits for. Default: none, so it runs beside `check`. */\n readonly needs?: readonly string[];\n /** `false` skips the rendered bun prologue — for a job that needs another toolchain. */\n readonly bun?: boolean;\n /**\n * `timeout-minutes:` for this job. Omitted takes GitHub's 360-minute default.\n *\n * ⚠️ AN INPUT BECAUSE A HUNG JOB IS NOT A FAILED JOB. Measured 2026-09-22:\n * homeflare-blog's `runtime` job drives Playwright against a local workerd, and a\n * browser that never reaches its first paint holds a self-hosted slot for six hours\n * rather than reporting red. On a 3-slot pool that is the whole pool. Only a job\n * that starts something with its own wait — a browser, a server, a container — needs\n * this; `check` does not, because `bun run check` exits.\n */\n readonly timeout?: number;\n}\n\ninterface ExtraJobInput extends Omit<ExtraJob, 'needs' | 'bun' | 'timeout'> {\n readonly needs?: readonly string[];\n readonly bun?: boolean;\n readonly timeout?: number;\n}\n\n/**\n * Declare a job this repository needs and the standard does not have.\n * ⛔ Same rule as `except`: the reason is a written literal or it does not compile.\n */\nexport function extraJob<const J extends ExtraJobInput>(\n job: J & { readonly reason: Stated<J['reason']> },\n): ExtraJob {\n if (job.steps.length === 0) {\n throw new Error(`repo-shape: extra job \"${job.id}\" has no steps`);\n }\n return {\n bun: job.bun ?? true,\n id: requireJobId(job.id),\n // ⚠️ A DISPLAY NAME IS NOT A SENTENCE. `build` and `consumer smoke test` are both\n // correct job names; only the REASON has to be prose, because only the reason is\n // there for a reader rather than for the checks list.\n name: requireNonEmpty('name', job.name),\n needs: [...(job.needs ?? [])],\n reason: requireSentence('reason', job.reason),\n steps: [...job.steps],\n ...(job.timeout === undefined ? {} : { timeout: requireMinutes(job.timeout) }),\n };\n}\n\nexport interface RepoShape {\n /** Repository owner — a user or organization login. */\n readonly owner: string;\n /** Repository name, which is also the checkout directory name. */\n readonly repository: string;\n /** Where its jobs run. */\n readonly runner: RepoRunner;\n /**\n * `true` when the repository publishes an npm tarball. It decides `access` in the\n * changeset config and whether `privatePackages` is written at all — the two keys\n * that differ between `homeflare-kit` and every other repository.\n */\n readonly publishes: boolean;\n /**\n * Node major to install before Bun, for a repository whose own gate needs a real\n * `node` on `PATH`. Omit it — twelve of fourteen repositories are Bun-only.\n *\n * ⛔ AN INPUT, NOT AN EXCEPTION, AND THE MEASUREMENT SAYS WHY. The mini's job image\n * carries no node at all (ubuntu-latest always did), so a Bun-only prologue is right\n * for most of the estate and *silently wrong* for two repositories:\n * · homeflare-alerts — tests/alchemy-import.test.ts spawns `node` to prove the\n * modules load the way the Alchemy CLI (`node …/cli.js`) loads them. Without it,\n * three tests fail with `Executable not found in $PATH: \"node\"` (measured on the\n * runner, 2026-09-22).\n * · homeflare-blog — Payload requires Node >= 24.15, so every lane needs it.\n * Both repositories carried the same hand-written `actions/setup-node@v6` block\n * before this existed. Excepting `ci.yml` instead would hand the estate's two most\n * complicated CI files back to hand-editing, which is the opposite of the point.\n *\n * ⚠️ `package-manager-cache: false` IS RENDERED WITH IT. Bun does the installing here;\n * letting setup-node prime an npm cache costs time and caches nothing anyone reads.\n */\n readonly node?: number;\n /** Jobs beyond `check` and `workflows`. Each carries its own stated reason. */\n readonly extraJobs?: readonly ExtraJob[];\n /** Rendered files this repository keeps its own copy of, each with a reason. */\n readonly exceptions?: readonly RepoShapeException[];\n}\n\n/**\n * The validated Node major this shape asks for, or `undefined` for a Bun-only prologue.\n * ★ `RepoShape` is a plain object, so this is where `node:` is checked — at render, not\n * at declaration. A bad value fails the refresh rather than the job.\n */\nexport function nodeMajor(shape: RepoShape): number | undefined {\n return shape.node === undefined ? undefined : requireMajor(shape.node);\n}\n\n/** `runs-on:` for a runner. */\nexport function runsOn(runner: RepoRunner): string {\n return runner === 'mini' ? '[self-hosted, homeflare-mini]' : 'ubuntu-latest';\n}\n\n/** Whether a rendered path is excepted by this shape. */\nexport function isExcepted(shape: RepoShape, file: RenderedPath): boolean {\n return (shape.exceptions ?? []).some((exception) => exception.file === file);\n}\n",
|
|
8
7
|
"/**\n * The smallest YAML writer that renders a job's steps, and nothing else.\n *\n * ★ NOT A YAML LIBRARY, DELIBERATELY. A general serializer would take a dependency every\n * consumer of `@homeflare/config` inherits, and it would strip the comments — which in\n * this house are the product. The rendered workflows are written as text with holes;\n * only the step lists, whose shape varies per repository, go through here.\n *\n * ⚠️ Bun.YAML.stringify EXISTS (`Object.keys(Bun.YAML)` is `[\"parse\", \"stringify\"]`,\n * measured against Bun 1.4.0 on 2026-09-23) but its output does not fit these rules:\n * (a) a multi-line `run:` comes out as a double-quoted string with `\\n` escapes, e.g.\n * `run: \"echo a\\necho b\\n\"`, not a `|` block scalar; (b) `09:00` comes out UNQUOTED,\n * e.g. `cron: 09:00`, the YAML 1.1 sexagesimal trap the `scalar()` comment below guards\n * against; (c) a mapping key is followed by a trailing space, e.g. `\"steps: \\n - ...\"`;\n * and (d) a plain JS object has nowhere to attach a comment, so it cannot carry one. The\n * tests parse what this writes with `Bun.YAML.parse` and compare structures, so a\n * malformed emission fails rather than shipping.\n */\nimport type { JobStep } from './shape.ts';\n\n/** Two spaces per level, the house indent and GitHub's own. */\nconst INDENT = ' ';\n\nfunction indent(depth: number): string {\n return INDENT.repeat(depth);\n}\n\n/**\n * ⛔ QUOTE ANYTHING YAML WOULD RE-READ AS SOMETHING ELSE. `09:00` is a sexagesimal number\n * in YAML 1.1 and `on`/`no` are booleans; an unquoted value that looks like either\n * reaches GitHub as the wrong type, and the symptom is a schedule that never fires\n * rather than an error.\n */\nconst PLAIN = /^[A-Za-z0-9_./][A-Za-z0-9_ ./@:+-]*$/;\nconst YAML_KEYWORD =\n /^(y|Y|n|N|on|On|ON|no|No|NO|yes|Yes|YES|true|True|TRUE|false|False|FALSE|null|Null|NULL|~)$/;\n\nfunction scalar(value: string | number): string {\n if (typeof value === 'number') return String(value);\n if (value === '') return \"''\";\n const plain =\n PLAIN.test(value) &&\n !YAML_KEYWORD.test(value) &&\n !value.includes(': ') &&\n !value.includes(' #') &&\n // ⚠️ A LEADING DIGIT PLUS A COLON IS A YAML 1.1 SEXAGESIMAL NUMBER, not a string:\n // `09:00` would reach GitHub as an integer, and a schedule set to an integer\n // simply never fires. `bun run build:web` is safe because it does not start with\n // a digit, which is why this is narrower than \"contains a colon\".\n !/^\\d.*:/.test(value) &&\n value.trimEnd() === value;\n return plain ? value : `'${value.replaceAll(\"'\", \"''\")}'`;\n}\n\nfunction renderMapping(\n entries: Readonly<Record<string, string | number>>,\n depth: number,\n): string[] {\n return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);\n}\n\n/**\n * Trim trailing `\\n` characters the way `command.replace(/\\n+$/, '')` used to, but\n * linear instead of backtracking — the same pattern as `normalizeBaseUrl` in\n * `packages/distilled-netbox/src/credentials.ts`. Exported so a test can compare it\n * against the old regex directly.\n *\n * ⚠️ Linear on purpose: a `/\\n+$/` regex backtracks polynomially on a long run of\n * \"\\n\" that is not at the end (CodeQL js/polynomial-redos), and `command` here is\n * repository-configured step text.\n */\nexport function trimTrailingNewlines(value: string): string {\n let end = value.length;\n while (end > 0 && value.charCodeAt(end - 1) === 10) end--;\n return value.slice(0, end);\n}\n\n/**\n * ★ BLOCK SCALAR FOR EVERY MULTI-LINE `run:`. A folded or quoted form would join the\n * lines, and a shell script whose `if` and `then` end up on one line is a syntax error\n * at job time rather than at lint time. `|` keeps them exactly as written.\n */\nfunction renderRun(command: string, depth: number): string[] {\n const lines = trimTrailingNewlines(command).split('\\n');\n if (lines.length === 1) return [`${indent(depth)}run: ${scalar(lines[0] ?? '')}`];\n return [`${indent(depth)}run: |`, ...lines.map((line) => `${indent(depth + 1)}${line}`)];\n}\n\n/** One step, as the lines of a `steps:` list item at `depth`. */\nexport function renderStep(step: JobStep, depth: number): string[] {\n const lines: string[] = [];\n const body =\n step.uses === undefined\n ? renderRun(step.run ?? '', depth + 1)\n : [`${indent(depth + 1)}uses: ${step.uses}`];\n\n // ★ `name:` then `if:` then the body, because that is the order a reader scans: what\n // this step is, whether it runs, what it does. All three are ordinary mapping keys\n // to GitHub, so the order is for the person reading the diff, not the parser.\n const head: string[] = [];\n if (step.name !== undefined) head.push(`${indent(depth + 1)}name: ${scalar(step.name)}`);\n if (step.if !== undefined) head.push(`${indent(depth + 1)}if: ${scalar(step.if)}`);\n\n // ⚠️ The first line of the item carries the dash, whichever key it turns out to be —\n // an unnamed, unconditional step still inlines its `run:` or `uses:` after the dash\n // and lets any block body follow at its own indent.\n const [first = '', ...rest] = [...head, ...body];\n lines.push(`${indent(depth)}- ${first.trimStart()}`, ...rest);\n\n if (step.with !== undefined && Object.keys(step.with).length > 0) {\n lines.push(`${indent(depth + 1)}with:`, ...renderMapping(step.with, depth + 2));\n }\n if (step.env !== undefined && Object.keys(step.env).length > 0) {\n lines.push(`${indent(depth + 1)}env:`, ...renderMapping(step.env, depth + 2));\n }\n return lines;\n}\n\n/** A whole `steps:` list, already indented for a job at `depth`. */\nexport function renderSteps(steps: readonly JobStep[], depth: number): string {\n return steps.flatMap((step) => renderStep(step, depth)).join('\\n');\n}\n",
|
|
9
|
-
"/**\n * `.github/workflows/dependabot-automerge.yml`, rendered.\n *\n * ★ THE OTHER HALF OF THE `homeflare` GROUP. Dependabot opens the bump; this arms GitHub's\n * own auto-merge on it; the branch ruleset's required checks (`ci`, `secret scan`)\n * decide whether it ever merges. Nothing here merges anything itself, and a merge\n * deploys nothing — every stack in the estate is deployed by hand.\n *\n * ⛔ `gh pr merge --auto` IS NOT ALWAYS \"ARM\". When the pull request is already CLEAN,\n * UNSTABLE or HAS_HOOKS it merges AT ONCE instead (cli/cli `pkg/cmd/pr/merge/merge.go`,\n * `isImmediatelyMergeable`, read at v2.101.0 — the version the mini's job image ships).\n * UNSTABLE is \"mergeable, with a non-passing status\", which is every pull request on a\n * branch whose rules require no check: before `check` has run, and even after it failed.\n * So the step reads the base branch's active rules first and refuses — a red check, never\n * a merge — when none requires a status check. Measured 2026-09-22: homeflare-builds (its\n * ruleset not deployed yet) and homeflare-desktop have none.\n *\n * ⛔ FIRST-PARTY ONLY: A `run:` STEP AND THE GitHub CLI, NO `uses:` AT ALL. GitHub's own\n * example (\"Automating Dependabot with GitHub Actions\") identifies the update with\n * `dependabot/fetch-metadata`, which the same page marks as \"not certified by GitHub\".\n * The group is identified by the branch Dependabot gives it instead, whose format is\n * dependabot-core's (`branch_namer/dependency_group_strategy.rb`, read at v0.397.0):\n * `<prefix>/<package manager>/<directory>/<group>-<10 hex MD5 digest>`, with the root\n * directory collapsing to nothing.\n */\nimport { HOMEFLARE_GROUP } from './dependabot.ts';\nimport type { RepoShape } from './shape.ts';\nimport { runsOn } from './shape.ts';\nimport { renderSteps } from './yaml.ts';\n\n/**\n * The branch prefix a job-level `if:` can test with `startsWith`. GitHub's expression\n * language has no regex, so this is the cheap filter that keeps every other pull request\n * from taking a runner slot; `GROUP_BRANCH` is the exact test inside the step.\n */\nexport const GROUP_BRANCH_PREFIX: string = `dependabot/bun/${HOMEFLARE_GROUP}-`;\n\n/**\n * ⛔ EXACT, AND FAILS CLOSED. A solo update of `@homeflare/config` is\n * `dependabot/bun/homeflare/config-0.9.0` and a package named `homeflare-x` would be\n * `dependabot/bun/homeflare-x-1.2.3`; neither matches. If Dependabot ever changes its\n * format, the symptom is a bump that waits for a person — never one merged by mistake.\n */\nexport const GROUP_BRANCH: string = `^${GROUP_BRANCH_PREFIX}[0-9a-f]{10}$`;\n\nconst HEADER = `# Arms auto-merge on Dependabot's @homeflare/* group, and on nothing else.\n#\n# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.\n# Its input is this repository's \\`repo-shape.ts\\`; refresh with \\`bun run repo-shape:refresh\\`.\n#\n# ★ HOW A KIT RELEASE ARRIVES: the \\`${HOMEFLARE_GROUP}\\` group in .github/dependabot.yml opens one\n# pull request; this arms GitHub's auto-merge on it; the ruleset's required checks decide.\n# Nothing here merges anything itself, and merging deploys nothing.\n# ⛔ NO THIRD-PARTY ACTION. GitHub's own example uses dependabot/fetch-metadata, which its\n# docs mark \"not certified by GitHub\"; the group is recognised by its branch name instead.\n# ⛔ NO REQUIRED CHECK ON THE BASE BRANCH, NO ARMING: there \\`gh pr merge --auto\\` would merge\n# at once, unchecked. The job fails instead, so the pull request waits for a person.\n# ⚠️ A RENDERER CHANGE STILL NEEDS A PERSON. When a kit release changes what @homeflare/config\n# renders, the bump fails \\`check\\` (the drift test) and never goes green. Run\n# \\`bun run repo-shape:refresh\\` on Dependabot's branch and push. ⛔ This workflow does not do\n# it for you: a push made with GITHUB_TOKEN starts no workflow run, so a refreshed commit\n# would never get the required checks and the pull request would wait forever.\n`;\n\nconst TRIGGER = `name: dependabot auto-merge\n\non:\n pull_request:\n\n# ⛔ NOTHING AT THE TOP; the one job asks for exactly what \\`gh pr merge --auto\\` needs.\npermissions: {}\n\nconcurrency:\n group: automerge-\\${{ github.ref }}\n cancel-in-progress: true\n`;\n\nconst JOB_NOTE = ` # ⛔ BOTH LOGINS, NOT EITHER. \\`user.login\\` is who opened the pull request; \\`github.actor\\` is\n # who started this run. A person pushing to Dependabot's branch changes the actor, so\n # their commit never arms anything; only Dependabot's own rebases do.`;\n\nconst PERMISSIONS_NOTE = ` # ★ WHAT GitHub'S OWN EXAMPLE GRANTS FOR THIS STEP, AND NO MORE. A run Dependabot starts gets\n # a read-only GITHUB_TOKEN unless the workflow raises it (\"Troubleshooting Dependabot on\n # GitHub Actions\" → \"Changing GITHUB_TOKEN permissions\").`;\n\nconst ARM = `set -euo pipefail\nif [[ ! \"$HEAD_REF\" =~ ${GROUP_BRANCH} ]]; then\n echo \"::notice::$HEAD_REF is not the ${HOMEFLARE_GROUP} group's branch; auto-merge not armed\"\n exit 0\nfi\n# ⛔ gh merges a CLEAN or UNSTABLE pull request at once rather than arming it. Only a branch\n# rule that requires a status check keeps it BLOCKED until the checks have passed.\nrequired=$(gh api \"repos/$GITHUB_REPOSITORY/rules/branches/$BASE_REF\" \\\\\n --jq '[.[] | select(.type == \"required_status_checks\")] | length')\nif [ \"$required\" = 0 ]; then\n echo \"::error::$BASE_REF requires no status check, so gh would merge at once; auto-merge not armed\"\n exit 1\nfi\n# ★ --squash: the house repositories allow squash merges only (declareRepoPolicy).\ngh pr merge --auto --squash \"$PR_URL\"`;\n\n/** The whole `dependabot-automerge.yml` for a shape. */\nexport function renderAutomerge(shape: RepoShape): string {\n // ⚠️ GitHub ACTIONS EXPRESSIONS, NOT TEMPLATE LITERALS: the runner interpolates `${{ … }}`\n // at job time, so they must reach the file verbatim (see security.ts for the same note).\n // oxlint-disable-next-line no-template-curly-in-string\n const headRef = '${{ github.head_ref }}';\n // oxlint-disable-next-line no-template-curly-in-string\n const baseRef = '${{ github.base_ref }}';\n // oxlint-disable-next-line no-template-curly-in-string\n const prUrl = '${{ github.event.pull_request.html_url }}';\n // oxlint-disable-next-line no-template-curly-in-string\n const token = '${{ secrets.GITHUB_TOKEN }}';\n const condition = [\n \"github.event.pull_request.user.login == 'dependabot[bot]'\",\n \"github.actor == 'dependabot[bot]'\",\n `startsWith(github.head_ref, '${GROUP_BRANCH_PREFIX}')`,\n ].join(' && ');\n\n return `${HEADER}\n${TRIGGER}\njobs:\n${JOB_NOTE}\n arm:\n name: arm auto-merge\n if: ${condition}\n runs-on: ${runsOn(shape.runner)}\n${PERMISSIONS_NOTE}\n permissions:\n contents: write\n pull-requests: write\n steps:\n${renderSteps(\n [\n {\n env: { BASE_REF: baseRef, GH_TOKEN: token, HEAD_REF: headRef, PR_URL: prUrl },\n name: 'Arm auto-merge on the homeflare group',\n run: ARM,\n },\n ],\n 3,\n)}\n`;\n}\n",
|
|
10
8
|
"/**\n * `.github/workflows/ci.yml`, rendered.\n *\n * ★ THE COMMENTS ARE PART OF THE RENDER, NOT DECORATION. Thirteen repositories carried\n * thirteen hand-edited copies of the same reasoning; measured 2026-09-22, the header\n * comment alone had four different wordings and the actionlint block had three. Written\n * here once, every repository gets the same explanation, and correcting it is one edit.\n *\n * ⛔ THE AGGREGATE `ci` JOB IS THE ONLY REQUIRED CHECK. Every other job feeds it through\n * `needs`, so adding a job never means editing a branch ruleset. `repoShapeChecks()`\n * returns exactly `['ci', 'secret scan']`, which is what `declareRepoPolicy` requires.\n */\nimport type { ExtraJob, JobStep, RepoShape } from './shape.ts';\nimport { nodeMajor, runsOn } from './shape.ts';\nimport { renderSteps } from './yaml.ts';\n\n/** Bun the whole estate is pinned to. One line, one place. */\nexport const BUN_VERSION = '1.4.0';\n/** actionlint the `workflow lint` job runs, and the mini's job image preloads. */\nexport const ACTIONLINT_VERSION = '1.7.12';\n\nconst CHECKOUT = 'actions/checkout@v7';\nconst SETUP_BUN = 'oven-sh/setup-bun@v2';\nconst SETUP_NODE = 'actions/setup-node@v6';\n\nfunction runnerNote(shape: RepoShape): string {\n if (shape.runner !== 'mini') {\n return \"# ⚠️ RUNS ON GitHub-HOSTED `ubuntu-latest`. Only a public repository should: hosted minutes\\n# are refused for this account's private repos (billing lock, 2026-09-22).\\n\";\n }\n return [\n '# ⚠️ RUNS ON THE MINI (`[self-hosted, homeflare-mini]`): GitHub-hosted runners are refused for',\n '# this account (billing lock, 2026-09-22), so every job here runs in a one-job Linux arm64',\n \"# container started by homeflare-mini's src/ci-runner (docs/ci-runner.md there). Each action\",\n `# below was checked for linux/arm64. The job image preloads bun ${\n BUN_VERSION\n } where setup-bun`,\n '# looks, gh, actionlint, gitleaks, typos and shfmt; no node on PATH.',\n '',\n ].join('\\n');\n}\n\nconst HEADER = `# Pull requests: is this code correct?\n#\n# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.\n# Its input is this repository's \\`repo-shape.ts\\`. Change that, then:\n# bun run repo-shape:refresh\n# A hand edit is reverted by the next refresh and fails \\`bun run check\\` before that.\n# A file this repository must own outright is declared as an \\`except({...})\\` with a\n# reason, which stops the check from comparing it — see @homeflare/config/repo-shape.\n#\n# ★ SPLIT BY CONCERN, NOT ONE BIG JOB — AND NOT ONE JOB PER COMMAND EITHER: lanes that\n# share a prologue are steps inside \\`check\\`, so the install is paid once.\n# ⛔ EVERY ACTION IS FIRST-PARTY OR THE VENDOR'S OWN, PINNED TO A MAJOR TAG.\n`;\n\nconst TRIGGER = `name: ci\n\non:\n # ⛔ NO \\`push: branches: [main]\\`. Every commit reaches main through a pull request whose\n # \\`ci\\` had to be green — the branch ruleset requires it and carries no bypass actors —\n # so a second run on the squash commit recomputed an answer it already had. Measured\n # 2026-09-15..22 across the estate: 613 of 619 main-push runs had a head_sha identical\n # to the merge_commit_sha of an already-green PR. That duplication was ~41% of the Mac\n # mini's entire CI load.\n # ⚠️ WHAT THIS GIVES UP, SAID OUT LOUD: the ~4% of merges whose base DID move between the\n # PR run and the squash no longer get a post-merge re-test. That run gated nothing — it\n # reported after main already had the commit — and the next PR, which branches from the\n # merged main, is what actually catches a semantic conflict.\n pull_request:\n\npermissions:\n contents: read\n\nconcurrency:\n group: ci-\\${{ github.ref }}\n cancel-in-progress: true\n`;\n\nconst CHECK_NOTE = ` # ── One job, one install ────────────────────────────────────────────────────\n # ★ WAS 3 SEPARATE JOBS: lint and format, types, tests. They shared an identical\n # prologue — checkout, setup-bun, \\`bun install --frozen-lockfile\\` — and the install,\n # not the check, was the cost: measured on the mini 2026-09-22, install p50 51s /\n # p90 81s against 1-3s for the command the install existed to enable. 3 jobs meant 3\n # installs and 3 containers to compute one answer, and on a 3-slot pool that was one\n # pull request asking for every slot to answer a single question.\n # ⛔ ONE STEP: \\`bun run check\\`, THE REPOSITORY'S OWN GATE, NOT A COPY OF ITS LANES.\n # The house rule is that CI runs the same command a person runs, and a workflow that\n # re-lists \\`lint\\`, \\`types\\`, \\`test\\` is a second copy of that command which can quietly\n # check LESS than the local gate. Measured 2026-09-22: \\`bun run check\\` in homeflare-kit\n # is \\`lint && types && build && test\\`, and its tests/dist.test.ts SKIPS ITSELF when\n # dist/ is absent — so a workflow running lint/types/test without the build would drop\n # that test silently and still report green. homeflare-alerts' check runs\n # \\`check:types\\` and \\`build:web\\`; homeflare-subnet-calc's delegates to \\`verify\\`. All\n # fourteen repositories have a \\`check\\` script and every one is local-only — no network,\n # no deploy. Checked, not assumed.\n # ★ THE SPLIT OF RESPONSIBILITY: this renderer owns the PLUMBING — triggers, permissions,\n # concurrency, runner, action versions, the aggregate gate — and the repository owns\n # WHAT ITS GATE RUNS, in package.json, where a change to it shows up in that\n # repository's own diff rather than in a workflow nobody reads.\n # ⚠️ THE TRADE, STATED: a red X says \\`check\\` rather than naming the lane. \\`bun run check\\`\n # short-circuits on the first failure and its output names the lane, which is the same\n # signal a person gets locally.`;\n\nconst WORKFLOWS_NOTE = ` # ★ \\`workflow lint\\` STAYS ITS OWN JOB on purpose: it needs no \\`bun install\\` at all\n # (actionlint is preloaded on the mini's job image — measured 5s end to end), so\n # folding it into \\`check\\` would make a YAML-only change pay the install for nothing.`;\n\nconst ACTIONLINT_NOTE = ` # ⛔ THERE IS NO FIRST-PARTY actionlint ACTION, and the npm package by that name is\n # an unrelated wasm port with no \\`bin\\`. The vendor's own documented CI path is\n # \\`download-actionlint.bash\\` — but that script does NOT verify a checksum (read at\n # the v${ACTIONLINT_VERSION} tag, 2026-09-16: \\`curl -L \"$url\" | tar xvz\\`, no sha256sum anywhere).\n # rhysd's releases DO publish a \\`_checksums.txt\\` per version; this verifies against\n # that instead of trusting the tarball on receipt.\n # ⚠️ ARCH FROM THE RUNNER, NOT HARD-CODED: the mini's runners are arm64, and an amd64\n # binary fails with \"exec format error\" (the checksum file lists both).`;\n\nconst INSTALL_ACTIONLINT = `set -euo pipefail\nversion=${ACTIONLINT_VERSION}\nif command -v actionlint >/dev/null 2>&1 &&\n [ \"$(actionlint -version 2>/dev/null | sed -n 1p)\" = \"\\${version}\" ]; then\n cp \"$(command -v actionlint)\" ./actionlint\n exit 0\nfi\ncase \"$(uname -m)\" in\n x86_64) arch=amd64 ;;\n aarch64 | arm64) arch=arm64 ;;\n *) echo \"unsupported architecture $(uname -m)\" >&2; exit 1 ;;\nesac\nfile=\"actionlint_\\${version}_linux_\\${arch}.tar.gz\"\nbase=\"https://github.com/rhysd/actionlint/releases/download/v\\${version}\"\ncurl -sSfLO \"\\${base}/\\${file}\"\ncurl -sSfLO \"\\${base}/actionlint_\\${version}_checksums.txt\"\ngrep \" \\${file}\\\\$\" \"actionlint_\\${version}_checksums.txt\" | sha256sum -c -\ntar xzf \"\\${file}\" actionlint`;\n\nconst AGGREGATE_NOTE = ` # ── The one check a branch rule can require ─────────────────────────────────\n # ★ A single required check that depends on all of them. Without this, adding a job\n # means editing the branch ruleset too, and forgetting to means the new job is\n # advisory without anyone noticing.\n # ⛔ FAILS ON ANYTHING OTHER THAN success, INCLUDING skipped. A job result has exactly\n # four values: success, failure, cancelled, skipped. Checking only the first two lets\n # a skipped job — a bad \\`if:\\` condition, a misconfigured dependency, a runner picking\n # up nothing — report this aggregate green with a required job never having run.`;\n\nconst VERIFY = `if [ \"\\${{ contains(needs.*.result, 'failure') }}\" = \"true\" ] || \\\\\n [ \"\\${{ contains(needs.*.result, 'cancelled') }}\" = \"true\" ] || \\\\\n [ \"\\${{ contains(needs.*.result, 'skipped') }}\" = \"true\" ]; then\n echo \"one or more required jobs did not succeed: \\${{ toJSON(needs.*.result) }}\" >&2\n exit 1\nfi`;\n\nconst NODE_NOTE = ` # ⛔ REAL NODE, NOT BUN'S SHIM, AND ONLY WHERE THE GATE NEEDS IT. The mini's job\n # image has no node on PATH (ubuntu-latest always did), so a repository whose own\n # \\`check\\` spawns \\`node\\` — or whose framework demands a Node runtime — fails with\n # \\`Executable not found in $PATH: \"node\"\\` without this. Declared as \\`node:\\` in\n # repo-shape.ts, so it is one input rather than a hand-edited block per repository.\n # ⚠️ NO PACKAGE-MANAGER CACHE: bun does the installing, so priming npm's cache costs\n # time and caches nothing anything here reads.`;\n\nfunction prologue(shape: RepoShape): string {\n const node = nodeMajor(shape);\n const bun: JobStep[] = [\n { uses: SETUP_BUN, with: { 'bun-version': BUN_VERSION } },\n { run: 'bun install --frozen-lockfile' },\n ];\n if (node === undefined) return renderSteps([{ uses: CHECKOUT }, ...bun], 3);\n return [\n renderSteps([{ uses: CHECKOUT }], 3),\n NODE_NOTE,\n renderSteps(\n [{ uses: SETUP_NODE, with: { 'node-version': node, 'package-manager-cache': 'false' } }],\n 3,\n ),\n renderSteps(bun, 3),\n ].join('\\n');\n}\n\nfunction renderExtraJob(job: ExtraJob, shape: RepoShape, on: string): string {\n const needs =\n (job.needs ?? []).length === 0 ? '' : ` needs: [${(job.needs ?? []).join(', ')}]\\n`;\n // ★ A TIMEOUT IS THE JOB'S, NOT THE SHAPE'S. Only a job that starts something with its\n // own wait needs one, and it is rendered where a reader looks for it.\n const timeout = job.timeout === undefined ? '' : ` timeout-minutes: ${job.timeout}\\n`;\n const steps =\n job.bun === false\n ? renderSteps([{ uses: CHECKOUT }, ...job.steps], 3)\n : [prologue(shape), renderSteps(job.steps, 3)].join('\\n');\n // ★ The stated reason is rendered into the file. A job nobody can explain is a job\n // nobody dares delete, so the explanation travels with it.\n return ` # ★ NOT PART OF THE STANDARD SHAPE — ${job.reason}\n ${job.id}:\n name: ${job.name}\n${needs} runs-on: ${on}\n${timeout} steps:\n${steps}\n`;\n}\n\n/** The whole `ci.yml` for a shape. */\nexport function renderCi(shape: RepoShape): string {\n const on = runsOn(shape.runner);\n const extras = shape.extraJobs ?? [];\n const needs = ['check', 'workflows', ...extras.map((job) => job.id)];\n\n return `${HEADER}${runnerNote(shape)}${TRIGGER}\njobs:\n${CHECK_NOTE}\n check:\n name: check\n runs-on: ${on}\n steps:\n${prologue(shape)}\n${renderSteps([{ run: 'bun run check' }], 3)}\n\n${WORKFLOWS_NOTE}\n workflows:\n name: workflow lint\n runs-on: ${on}\n steps:\n${renderSteps([{ uses: CHECKOUT }], 3)}\n${ACTIONLINT_NOTE}\n${renderSteps([{ name: 'Install actionlint (checksum-verified)', run: INSTALL_ACTIONLINT }], 3)}\n${renderSteps([{ name: 'Lint workflows', run: './actionlint -color' }], 3)}\n\n${extras.map((job) => `${renderExtraJob(job, shape, on)}\\n`).join('')}${AGGREGATE_NOTE}\n ci:\n name: ci\n if: always()\n needs: [${needs.join(', ')}]\n runs-on: ${on}\n steps:\n${renderSteps([{ name: 'Verify every job succeeded', run: VERIFY }], 3)}\n`;\n}\n",
|
|
11
9
|
"/**\n * The two smaller rendered files: actionlint's config and the changeset config.\n * (Dependabot was the third; it grew a group and a schedule rule, so it is `dependabot.ts`.)\n *\n * ★ EACH ONE WAS MEASURED BEFORE IT WAS RENDERED (2026-09-22, across 13 repositories):\n * · `.changeset/config.json` — byte-identical apart from the repository name in 11 of\n * 13. The three that differed did so by accident: two pinned an older `$schema`\n * (3.1.4 against 4.0.1) and one used `@changesets/cli/changelog` instead of the\n * GitHub changelog everyone else had, which silently drops PR links from releases.\n * · `.github/actionlint.yaml` — 12 of 13 had it, with three wordings of one comment.\n * The one without it is the one repository still on `ubuntu-latest`, which is the\n * only case where it is genuinely not needed. That is an input, not an exception.\n */\nimport type { RepoShape } from './shape.ts';\n\n/**\n * ⚠️ PINNED, NOT `latest`. `unpkg.com/@changesets/config@latest/schema.json` would change\n * what editors validate against without a commit, and the two repositories that drifted\n * here drifted by being pinned to different versions — not by being pinned.\n */\nconst CHANGESET_SCHEMA = '4.0.1';\n\n/**\n * `.changeset/config.json`.\n *\n * ⛔ `privatePackages` IS WRITTEN ONLY FOR A REPOSITORY THAT DOES NOT PUBLISH, AND BOTH\n * OF ITS FIELDS ARE REQUIRED. `@changesets/cli` silently versions nothing when\n * `version` is absent, so a private repository without this key opens a Version\n * Packages PR that changes no version and tags no release — a release pipeline that\n * reports success and ships nothing.\n */\nexport function renderChangesetConfig(shape: RepoShape): string {\n const config = {\n $schema: `https://unpkg.com/@changesets/config@${CHANGESET_SCHEMA}/schema.json`,\n // ★ `@changesets/changelog-github` over the built-in: it writes the pull request and\n // author into CHANGELOG.md, which is the difference between a changelog you can\n // audit and a list of sentences.\n changelog: ['@changesets/changelog-github', { repo: `${shape.owner}/${shape.repository}` }],\n commit: false,\n fixed: [] as string[],\n linked: [] as string[],\n access: shape.publishes ? 'public' : 'restricted',\n baseBranch: 'main',\n updateInternalDependencies: 'patch',\n ignore: [] as string[],\n ...(shape.publishes ? {} : { privatePackages: { version: true, tag: false } }),\n };\n return `${JSON.stringify(config, undefined, 2)}\\n`;\n}\n\n/**\n * `.github/actionlint.yaml` — rendered only for a self-hosted runner.\n *\n * ★ DECLARED, NOT SUPPRESSED. actionlint's `runner-label` rule stays on, so a typo'd\n * label (`homeflare-mnii`) still fails the `workflow lint` job rather than silently\n * queueing a job no runner ever claims. Measured 2026-09-22 with actionlint 1.7.12: an\n * undeclared `homeflare-mini` is an error, not a warning, so this file is the reason\n * twelve repositories are green rather than a nicety.\n */\nexport function renderActionlintConfig(shape: RepoShape): string | undefined {\n if (shape.runner !== 'mini') return undefined;\n return `# actionlint's list of self-hosted runner labels (its \\`runner-label\\` check).\n#\n# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.\n# Refresh with \\`bun run repo-shape:refresh\\`.\n#\n# ★ DECLARED, NOT SUPPRESSED: the rule stays on, so a typo'd label (\\`homeflare-mnii\\`)\n# still fails the \\`workflow lint\\` job rather than queueing a job no runner claims.\n# \\`homeflare-mini\\` is the interim runner on the Mac mini (homeflare-mini's\n# docs/ci-runner.md); setting this repository's shape to \\`runner: 'github'\\` removes\n# this file with the \\`runs-on\\` that needed it.\nself-hosted-runner:\n labels:\n - homeflare-mini\n`;\n}\n",
|
|
10
|
+
"/**\n * `.github/dependabot.yml`, rendered.\n *\n * ★ MEASURED BEFORE IT WAS RENDERED (2026-09-22): 1 of 14 repositories had a Dependabot\n * config. Twelve took no dependency or Action updates at all, and nothing said so.\n *\n * ⛔ `@homeflare/*` IS IGNORED HERE, NOT GROUPED (retired 2026-09-23, kit auto-bumper\n * design, Tim). A `homeflare` group and a rendered `dependabot-automerge.yml`\n * used to carry kit releases into a consumer; both are gone. `homeflare-bumper` does\n * that job now, over `workflow_dispatch` from this repo's own release, with a schedule\n * backstop — a Dependabot bump running at the same time would open a SECOND, competing\n * pull request for the same version bump. The `ignore` entry below is what stops that:\n * Dependabot never proposes `@homeflare/*` at all, so there is only ever one bump PR.\n *\n * Every Dependabot claim below was read from GitHub's docs or dependabot-core's source on\n * 2026-09-22 (dependabot-core v0.397.0); `docs/repo-shape-dependabot.md` has the citations.\n */\nimport type { RepoShape } from './shape.ts';\n\n/** The first-party scope. Every package the kit publishes is under it. */\nexport const HOMEFLARE_PATTERN = '@homeflare/*';\n\n/**\n * ★ SEVEN DAYS. A third-party release is proposed once it is a week old rather than on\n * Dependabot's undocumented-but-real 3-day default — that is also the supply-chain\n * half, since a compromised release is usually yanked within days.\n */\nexport const THIRD_PARTY_COOLDOWN_DAYS = 7;\n\n/** `.github/dependabot.yml`. */\nexport function renderDependabot(shape: RepoShape): string {\n // ⚠️ `directories`, not `directory`, for bun: a workspace keeps a dependency in the\n // package that declares it, so pointing only at `/` leaves every `packages/*`\n // manifest unwatched — and the symptom is silence, not an error.\n const bunDirs = shape.publishes ? ['/', '/packages/*'] : ['/'];\n return `# Dependabot for ${shape.repository}.\n#\n# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.\n# Refresh with \\`bun run repo-shape:refresh\\`.\n#\n# ⛔ THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a\n# platform feature, not an Action — a config placed among the workflows is silently\n# ignored, and the symptom is simply that no pull requests ever arrive. Measured\n# 2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their\n# Actions and their toolchain went stale invisibly, which is exactly how nothing fails.\n#\n# ★ WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per\n# outdated package; that is a trickle nobody reviews properly. Each group below is a set\n# that is either safe to take together or needs deciding together.\n#\n# ★ THE BILLING LOCK DOES NOT STOP THIS FILE. Dependabot runs as a GitHub-hosted \"dynamic\"\n# workflow that GitHub's docs say \"does not count towards your included GitHub Actions\n# minutes\"; measured 2026-09-22, a private estate repository's Dependabot job got a hosted\n# runner 86 minutes after that account's ordinary hosted jobs were refused for billing.\n# It cannot use the mini anyway: a self-hosted Dependabot runner must be Linux x64 with\n# Docker, and the mini's runners are arm64 containers with no Docker socket.\nversion: 2\n\nupdates:\n # ── The toolchain (bun.lock) ────────────────────────────────────────────────\n # ⚠️ STILL BLOCKED UPSTREAM, 2026-09-22 — unrelated to the ignore below. bun 1.4 writes\n # bun.lock \\`lockfileVersion\\` 2 and Dependabot's updater bundles bun 1.3.14, which reads\n # up to 1, so this whole block fails in every estate repository with \"Unsupported\n # bun.lock 'lockfileVersion' 2\" before it reads a single manifest. The fix is\n # dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.\n - package-ecosystem: bun\n directories:\n${bunDirs.map((dir) => ` - ${dir}`).join('\\n')}\n schedule:\n interval: weekly\n day: monday\n time: '09:00'\n timezone: America/New_York\n cooldown:\n default-days: ${THIRD_PARTY_COOLDOWN_DAYS}\n # ⛔ NEVER PROPOSED HERE. \\`homeflare-bumper\\` opens the one pull request that bumps\n # \\`@homeflare/*\\` (kit auto-bumper design, Tim 2026-09-23) — a Dependabot\n # update for the same package would race it and, on the weeks they disagree, leave\n # two open pull requests fighting over the same \\`package.json\\` line.\n ignore:\n - dependency-name: '${HOMEFLARE_PATTERN}'\n open-pull-requests-limit: 5\n commit-message:\n prefix: 'chore'\n include: scope\n labels: [dependencies]\n groups:\n # oxfmt and oxlint move together and only affect style. Minor and patch bumps are\n # noise unless they fail CI, which is what CI is for.\n lint-and-format:\n patterns: ['oxfmt', 'oxlint']\n update-types: [minor, patch]\n\n # ⚠️ MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;\n # changesets majors have renamed inputs and dropped compatibility (the action's v2\n # did both). These want reading, not merging on green.\n build-tooling:\n patterns: ['typescript', '@changesets/*', '@types/bun']\n update-types: [minor, patch]\n\n # ── The workflows themselves ────────────────────────────────────────────────\n # ★ Actions go stale invisibly: nothing fails, they just keep running old code. The\n # estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1\n # (current: v2, with every input renamed) — measured 2026-09-15.\n - package-ecosystem: github-actions\n directory: /\n schedule:\n interval: weekly\n day: monday\n time: '09:00'\n timezone: America/New_York\n open-pull-requests-limit: 5\n commit-message:\n prefix: 'ci'\n labels: [dependencies, github-actions]\n groups:\n actions:\n patterns: ['*']\n update-types: [minor, patch]\n`;\n}\n",
|
|
12
11
|
"/**\n * `.github/workflows/security.yml`, rendered.\n *\n * ⛔ THIS FILE IS WHY THE RENDERER EXISTS. Measured across 13 repositories on 2026-09-22,\n * every one of these was a per-repo accident rather than a decision:\n * · `push: branches: [main]` still present in 5, removed in 8;\n * · the `concurrency:` block missing entirely in 5 — so a superseded scan ran to\n * completion holding one of the mini's 3 slots for a result nobody would read;\n * · `pull-requests: read` missing in 2, which makes every pull-request scan fail 403\n * before it inspects a single line;\n * · `gitleaks/gitleaks-action` pinned at `@v2` in 5 and `@v3` in 8. v2 declares\n * `runs: node20`; GitHub removed that runtime from its HOSTED runner images on\n * 2026-09-16, so v2 fails on ubuntu-latest and still runs on the mini. Moving to\n * v3 drops that dependency before any job moves back to a hosted runner — it is\n * not repairing a scan that is currently broken;\n * · the weekly cron at three different minutes.\n * One renderer makes all thirteen the same file, and the next such fix is one commit.\n */\nimport type { RepoShape } from './shape.ts';\nimport { runsOn } from './shape.ts';\nimport { renderSteps } from './yaml.ts';\n\n/**\n * ⚠️ Off the hour deliberately — `:00` is when every scheduled workflow on GitHub fires\n * at once, and queue time is the result. One minute for the whole estate: a repository\n * does NOT get its own, because \"which minute is this repo on\" is a question with no\n * useful answer and 13 repos produced 3 different ones by accident.\n */\nconst CRON = '41 6 * * 1';\n\nconst HEADER = `# Secret scanning, on its own schedule and its own check.\n#\n# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.\n# Its input is this repository's \\`repo-shape.ts\\`; refresh with \\`bun run repo-shape:refresh\\`.\n#\n# ★ SEPARATE FROM ci.yml BY CONCERN. A secret scan answers a different question from \"is\n# this code correct\", it runs on a schedule as well as on pull requests (a rule added\n# tomorrow can find a secret committed today), and it needs full history, which the CI\n# jobs deliberately do not fetch.\n`;\n\nconst TRIGGER = `name: security\n\non:\n # ⛔ NO \\`push: branches: [main]\\`, for the reason ci.yml gives: main only moves by\n # squashing a pull request this same workflow already scanned, so the post-merge scan\n # re-read commits it had just cleared. The weekly cron is what covers \"a rule added\n # tomorrow finds a secret committed today\" — and it is the one that fetches full history.\n pull_request:\n schedule:\n - cron: '${CRON}'\n\npermissions:\n contents: read\n # 🔴 gitleaks-action lists pull-request commits through GitHub's API before scanning,\n # and posts inline annotations. Without this, \\`pull_request\\` runs fail 403 before\n # inspecting any code. Two of thirteen repositories were missing it (2026-09-22).\n pull-requests: read\n\n# ⛔ cancel-in-progress IS CONDITIONAL, NOT \\`true\\`. The scheduled run's ref is\n# refs/heads/main; a plain \\`true\\` would let anything sharing that group kill the weekly\n# full-history scan. Only pull-request runs are ever cancelled.\nconcurrency:\n group: security-\\${{ github.ref }}\n cancel-in-progress: \\${{ github.event_name == 'pull_request' }}\n`;\n\nconst FETCH_NOTE = ` with:\n # ⛔ FULL HISTORY. A shallow clone scans only the tip, which misses the case that\n # matters most: a secret added and then removed in a later commit. It is still\n # in the history, still fetchable, and still compromised.\n fetch-depth: 0`;\n\nconst GITLEAKS_NOTE = ` # ⛔ v3, NOT v2. v2 declares \\`runs: node20\\`. GitHub removed that runtime from\n # its HOSTED runner images on 2026-09-16 (gitleaks/gitleaks-action's own v3.0.0\n # migration notes, verified 2026-09-17), so v2 fails on ubuntu-latest and still\n # runs on the mini's self-hosted runner. Moving to v3 drops a dependency on a\n # runtime the platform has already withdrawn, before any job moves back to a\n # hosted runner — it is not repairing a scan that is currently broken. v3\n # changes only the runtime to node24 — inputs, outputs and behaviour are unchanged.\n # ★ arm64-SAFE ON THE MINI, verified rather than assumed: v3's src/gitleaks.js builds\n # its download URL from \\`process.arch\\`, so the runner asks for\n # gitleaks_<version>_linux_arm64.tar.gz, an asset its default release publishes\n # (both read 2026-09-22). Nothing here is hard-coded to x64.\n # ★ No \\`GITLEAKS_LICENSE\\`: that env var is required only for GitHub Organization\n # accounts, and \\`taslabs-net\\` is a personal User account (2026-09-17,\n # \\`gh api users/taslabs-net --jq .type\\` -> \\`User\\`).`;\n\n/** The whole `security.yml` for a shape. */\nexport function renderSecurity(shape: RepoShape): string {\n const on = runsOn(shape.runner);\n // ⚠️ A GitHub ACTIONS EXPRESSION, NOT A TEMPLATE LITERAL. `${{ … }}` is interpolated by\n // the Actions runner at job time and must reach the file verbatim, so it is a regular\n // string on purpose — `no-template-curly-in-string` is warning about exactly the\n // confusion this comment resolves, and it is right to ask.\n // oxlint-disable-next-line no-template-curly-in-string\n const token = '${{ secrets.GITHUB_TOKEN }}';\n const scheduled =\n shape.runner === 'mini'\n ? `\\n # ⛔ THE SCHEDULED RUN GOES TO THE MINI TOO: if the runner daemon is down this queues\\n # rather than failing, so a missed weekly scan is silent. homeflare-mini's\\n # \\`ci-runner\\` vmalert group is what notices that, not this workflow.`\n : '';\n\n return `${HEADER}${TRIGGER}\njobs:\n secrets:\n name: secret scan${scheduled}\n runs-on: ${on}\n steps:\n${renderSteps([{ uses: 'actions/checkout@v7' }], 3)}\n${FETCH_NOTE}\n\n${GITLEAKS_NOTE}\n${renderSteps([{ uses: 'gitleaks/gitleaks-action@v3', env: { GITHUB_TOKEN: token } }], 3)}\n`;\n}\n",
|
|
13
|
-
"/**\n * `renderRepoShape` — one declaration, both halves of a standard repository.\n *\n * ★ THIS IS THE POINT OF THE WHOLE MODULE. A repository declares its shape once and gets\n * its FILES (here) and its GitHub SETTINGS (through `policy`, which is the options\n * object `@homeflare/alchemy`'s `declareRepoPolicy` takes). Before this, the workflow\n * that produces a status check and the ruleset that requires that status check were\n * written in two files by hand, and nothing connected them: renaming the aggregate job\n * would leave a required check that never reports, and a pull request would wait on it\n * forever with auto-merge armed. `checks` below is derived from the rendered workflows,\n * so the two cannot disagree.\n *\n * ⛔ NO IMPORT CROSSES BETWEEN THE PACKAGES, IN EITHER DIRECTION. `policy` is a plain\n * object that is structurally assignable to `RepoPolicyOptions`; `@homeflare/alchemy`\n * does not depend on `@homeflare/config` and this does not depend on Alchemy or Effect.\n * That matters because `@homeflare/config` is installed in 13 of 14 repositories and\n * `@homeflare/alchemy` in 4 — the drift check has to run everywhere, and it must not\n * drag a provider library into a repository that has no stack.\n * ⚠️ A structural seam is checked only where both sides are present: the assignability\n * test lives in `packages/alchemy/tests/repo-shape-policy.test.ts`, which is the one\n * place that imports both.\n */\nimport {
|
|
14
|
-
"/**\n *
|
|
15
|
-
"/**\n * The
|
|
12
|
+
"/**\n * `renderRepoShape` — one declaration, both halves of a standard repository.\n *\n * ★ THIS IS THE POINT OF THE WHOLE MODULE. A repository declares its shape once and gets\n * its FILES (here) and its GitHub SETTINGS (through `policy`, which is the options\n * object `@homeflare/alchemy`'s `declareRepoPolicy` takes). Before this, the workflow\n * that produces a status check and the ruleset that requires that status check were\n * written in two files by hand, and nothing connected them: renaming the aggregate job\n * would leave a required check that never reports, and a pull request would wait on it\n * forever with auto-merge armed. `checks` below is derived from the rendered workflows,\n * so the two cannot disagree.\n *\n * ⛔ NO IMPORT CROSSES BETWEEN THE PACKAGES, IN EITHER DIRECTION. `policy` is a plain\n * object that is structurally assignable to `RepoPolicyOptions`; `@homeflare/alchemy`\n * does not depend on `@homeflare/config` and this does not depend on Alchemy or Effect.\n * That matters because `@homeflare/config` is installed in 13 of 14 repositories and\n * `@homeflare/alchemy` in 4 — the drift check has to run everywhere, and it must not\n * drag a provider library into a repository that has no stack.\n * ⚠️ A structural seam is checked only where both sides are present: the assignability\n * test lives in `packages/alchemy/tests/repo-shape-policy.test.ts`, which is the one\n * place that imports both.\n */\nimport { renderCi } from './ci.ts';\nimport { renderActionlintConfig, renderChangesetConfig } from './companions.ts';\nimport { renderDependabot } from './dependabot.ts';\nimport { renderSecurity } from './security.ts';\nimport type { RenderedPath, RepoShape } from './shape.ts';\n\n/** The status-check contexts a rendered repository reports. */\nexport interface RepoShapePolicy {\n readonly owner: string;\n readonly repository: string;\n /**\n * ⛔ EXACTLY THE AGGREGATES, NEVER THE LEAF JOBS. `ci` is `if: always()` and fails when\n * any job it needs did not succeed, so requiring it requires all of them. Requiring a\n * leaf job instead would mean a ruleset edit every time a job is added, and a context\n * that stops reporting leaves every pull request pending rather than failing.\n */\n readonly checks: readonly string[];\n}\n\nexport interface RenderedRepo {\n /** Every rendered file, by its path relative to the repository root. */\n readonly files: Readonly<Record<string, string>>;\n /**\n * The options `declareRepoPolicy(id, { ...rendered.policy, settings })` takes.\n * Squash-only, auto-merge, delete-branch-on-merge and the `main` ruleset come from\n * there; the check names come from here.\n */\n readonly policy: RepoShapePolicy;\n}\n\n/**\n * Render a repository's tooling files and the policy that matches them.\n *\n * const rendered = renderRepoShape(shape);\n * rendered.files['.github/workflows/ci.yml'] // the file\n * rendered.policy.checks // ['ci', 'secret scan']\n *\n * ⚠️ EXCEPTED FILES ARE STILL RENDERED. `files` is what the standard says this repository\n * should have; `drift.ts` is what decides which of them are compared. Keeping them here\n * means `--show` can print the standard version of an excepted file, which is how\n * anyone judges whether the exception is still worth its reason.\n */\nexport function renderRepoShape(shape: RepoShape): RenderedRepo {\n const files: Record<string, string> = {\n '.changeset/config.json': renderChangesetConfig(shape),\n '.github/dependabot.yml': renderDependabot(shape),\n '.github/workflows/ci.yml': renderCi(shape),\n '.github/workflows/security.yml': renderSecurity(shape),\n };\n\n const actionlint = renderActionlintConfig(shape);\n if (actionlint !== undefined) files['.github/actionlint.yaml'] = actionlint;\n\n return {\n files,\n policy: { checks: ['ci', 'secret scan'], owner: shape.owner, repository: shape.repository },\n };\n}\n\n/** Every path this renderer can emit, whatever a given shape asks for. */\nexport const RENDERED_PATHS: readonly RenderedPath[] = [\n '.changeset/config.json',\n '.github/actionlint.yaml',\n '.github/dependabot.yml',\n '.github/workflows/ci.yml',\n '.github/workflows/security.yml',\n];\n",
|
|
13
|
+
"/**\n * Rendered paths this package stopped rendering — the \"no fossils\" list.\n *\n * ★ WHY THIS EXISTS. `renderRepoShape` only emits the files a shape asks for today; it\n * never says what it used to emit, and `refreshRepoShape` only writes what it renders —\n * so a file retired from the renderer was never deleted by a refresh. It just stopped\n * being updated, silently, forever, in every repository that had already taken it.\n *\n * MEASURED 2026-09-24: `@homeflare/config` 0.12.0 (kit PR 199) stopped rendering\n * `.github/workflows/dependabot-automerge.yml`. Every consumer that had refreshed to\n * 0.12.0 before this module existed (homeflare-wiki bump PR 19, homeflare-mini bump\n * PR 47) kept the dead file, and `driftInRepoShape` never said so — it only compares\n * paths the CURRENT shape renders, and a retired path is not one of those.\n *\n * ⛔ RETIRING A PATH IS A ONE-WAY DOOR, NOT A RENAME. Once a path is here it can never\n * become a `RenderedPath` again: `render.ts` would start writing a file this module is\n * also trying to delete, and every refresh would fight itself. Give the replacement a\n * new path instead. `repo-shape-retired.test.ts` asserts the two lists never overlap.\n *\n * ⚠️ DELETION IS GATED ON PROOF, NOT ON THE PATH ALONE. A repository can have a\n * hand-written file sitting at the exact path a retired renderer used to own — a fork of\n * the old rendered file, kept on purpose, or unrelated content that just landed there.\n * `wasRenderedByUs` is the proof: every renderer in this directory writes the\n * `🤖 RENDERED BY @homeflare/config` line into its header (grep the directory for it),\n * and that line is the one thing a hand-written file has no reason to contain.\n * `refreshRepoShape` deletes a retired path only when the line is present; otherwise it\n * refuses and reports the path, the same way it refuses to overwrite an excepted file.\n */\nimport { requireSemver, requireSentence } from './guards.ts';\n\n/**\n * A path `@homeflare/config` no longer renders, but may still find committed in a\n * repository that refreshed before the retirement. Extend this union at the same time a\n * path is added to `RETIRED_FILES` below — never reuse one already there.\n */\nexport type RetiredPath = '.github/workflows/dependabot-automerge.yml';\n\nexport interface RetiredFile {\n /** The path this package rendered, once. */\n readonly path: RetiredPath;\n /** The `@homeflare/config` version whose release stopped rendering it. */\n readonly retiredIn: string;\n /** Why, and which kit change did it — written at the retirement, like `except()`'s reason. */\n readonly reason: string;\n}\n\nfunction retire(file: RetiredFile): RetiredFile {\n return {\n path: file.path,\n reason: requireSentence('retired reason', file.reason),\n retiredIn: requireSemver(file.retiredIn),\n };\n}\n\n/** Every path `@homeflare/config` used to render, oldest retirement first. */\nexport const RETIRED_FILES: readonly RetiredFile[] = [\n retire({\n path: '.github/workflows/dependabot-automerge.yml',\n reason:\n 'kit PR 199 retired the Dependabot @homeflare group; taslabs-net/homeflare-bumper ' +\n \"carries a kit release into each consumer now, over the kit's own release workflow\",\n retiredIn: '0.12.0',\n }),\n];\n\n/**\n * The substring every generated file's header has carried since this package's first\n * renderer. Kept independent of the four current renderers' own copies of this text\n * (`ci.ts`, `security.ts`, `dependabot.ts`, `companions.ts`) on purpose: a future wording\n * change to the live header must not stop this module recognising a file rendered under\n * the old one.\n */\nexport const GENERATED_FILE_MARKER = '🤖 RENDERED BY @homeflare/config';\n\n/**\n * Whether `content` is provably a file this package once wrote.\n *\n * ⚠️ THE MARKER HAS TO START A LINE OF ITS OWN, NOT MERELY OCCUR SOMEWHERE IN THE TEXT.\n * Every real header carries it as a whole comment line — `# 🤖 RENDERED BY\n * @homeflare/config — DO NOT EDIT…`, third line in every renderer in this directory, so\n * this does not require it to be the FIRST line — but a bare `content.includes(...)`\n * would also match a hand-written file that merely *talks about* the marker, e.g. a\n * comment reading \"this file used to be 🤖 RENDERED BY @homeflare/config before it was\n * retired; keeping it by hand now\" — adversarial review, 2026-09-24, caught this exact\n * case before it shipped. Requiring the marker at the start of a trimmed line is what a\n * sentence built around it, rather than a header line consisting of it, cannot satisfy.\n * `repo-shape-retired.test.ts` asserts the mid-sentence form stays refused.\n *\n * ⚠️ STILL A PREFIX CHECK ON THAT LINE, NOT A FULL-LINE EXACT MATCH. The retired renderer\n * varied its trailing header prose by `shape.runner` and by repository name, and a\n * future wording change to what follows the marker on a live renderer's header must not\n * stop this recognising a file rendered under the old wording — only the marker itself,\n * `🤖 RENDERED BY @homeflare/config`, has been constant across every renderer this\n * package has ever shipped.\n */\nexport function wasRenderedByUs(content: string): boolean {\n return content\n .split('\\n')\n .some((line) => line.trimStart().startsWith(`# ${GENERATED_FILE_MARKER}`));\n}\n\n/**\n * The message `driftInRepoShape` reports for a retired path that is still present, and\n * `repoShapeCli --check` prints verbatim. Names the fix command either way — whether that\n * command can actually remove the file depends on `wasRenderedByUs`, which only\n * `refreshRepoShape` (holding the file's contents) can decide.\n */\nexport function retiredFileProblem(file: RetiredFile): string {\n return (\n `${file.path}: retired in @homeflare/config@${file.retiredIn} (${file.reason}) ` +\n 'but still present — run `bun run repo-shape:refresh` to remove it'\n );\n}\n",
|
|
14
|
+
"/**\n * The drift check: re-render, compare, and say what to run.\n *\n * ★ WHAT MAKES THIS DIFFERENT FROM A LINT RULE. It does not describe good workflows; it\n * asserts that this repository's committed files ARE the rendered ones. A hand edit\n * fails here before it can spread, which is the mechanism — not the convention — that\n * keeps fourteen repositories the same.\n *\n * ⛔ IT REPORTS, IT DOES NOT REPAIR, exactly like `checkProject` in this package. A check\n * that silently rewrote the working tree would erase the evidence of what someone\n * changed, and the one case worth catching — a deliberate edit that should have been an\n * exception — is the case it would erase. `refresh.ts` is the separate, explicit writer.\n *\n * ⚠️ EVERY COMPARISON IS EXACT TEXT, NOT STRUCTURE. `checkProject` compares parsed values\n * because a project may reformat its copy of a preset. Here the file IS generated, so\n * any difference at all — including a reflowed comment — means the file did not come\n * out of the renderer, and reformatting it would defeat the point of generating it.\n * The one exception is line endings, normalised so a CRLF checkout is not \"drift\".\n */\nimport { type RenderedRepo, renderRepoShape } from './render.ts';\nimport { RETIRED_FILES, retiredFileProblem } from './retired.ts';\nimport type { RenderedPath, RepoShape, RepoShapeException } from './shape.ts';\n\n/** One thing to fix, in the imperative — the same `Problem` shape `./check` reports. */\nexport type Problem = string;\n\n/** The command that makes a difference go away. Printed with every drift problem. */\nexport const REFRESH_COMMAND = 'bun run repo-shape:refresh';\n\nfunction normalize(text: string): string {\n return text.replaceAll('\\r\\n', '\\n');\n}\n\nasync function readIfPresent(path: string): Promise<string | undefined> {\n const file = Bun.file(path);\n return (await file.exists()) ? normalize(await file.text()) : undefined;\n}\n\n/**\n * ⛔ AN EXCEPTION FOR A FILE THE SHAPE DOES NOT RENDER IS ITSELF A PROBLEM. Otherwise a\n * repository that moved from the mini to GitHub-hosted runners would keep a stale\n * `.github/actionlint.yaml` exception forever, and the exception list — the one place\n * that is supposed to hold every deviation — would be lying about one of them.\n */\nfunction staleExceptions(\n rendered: RenderedRepo,\n exceptions: readonly RepoShapeException[],\n): Problem[] {\n return exceptions\n .filter((exception) => rendered.files[exception.file] === undefined)\n .map(\n (exception) =>\n `${exception.file}: excepted (since ${exception.since}) but this shape renders no such file — drop the exception`,\n );\n}\n\n/**\n * ⚠️ A DUPLICATE EXCEPTION HIDES A REASON. Two `except()` entries for one file means one\n * of the two reasons is never read, and the one that loses is arbitrary. Refuse both.\n */\nfunction duplicateExceptions(exceptions: readonly RepoShapeException[]): Problem[] {\n const seen = new Set<RenderedPath>();\n const duplicated = new Set<RenderedPath>();\n for (const exception of exceptions) {\n if (seen.has(exception.file)) duplicated.add(exception.file);\n seen.add(exception.file);\n }\n return [...duplicated].map(\n (file) => `${file}: declared as an exception more than once — keep one, with one reason`,\n );\n}\n\n/**\n * ★ A RETIRED PATH IS REPORTED WHETHER OR NOT IT IS PROVABLY OURS. This check only reads\n * the file to see if it is THERE — `wasRenderedByUs` is `refreshRepoShape`'s call to\n * make, because only the writer should decide whether to delete. Reporting here is what\n * makes a fossil visible even in a repository that only ever runs `--check` in CI.\n */\nasync function retiredFilesPresent(projectDir: string): Promise<Problem[]> {\n const problems: Problem[] = [];\n for (const file of RETIRED_FILES) {\n if ((await readIfPresent(`${projectDir}/${file.path}`)) !== undefined) {\n problems.push(retiredFileProblem(file));\n }\n }\n return problems;\n}\n\nexport interface DriftReport {\n /** Empty when the committed files are the rendered ones and no retired path lingers. */\n readonly problems: readonly Problem[];\n /** Paths whose committed text differs from the render, excluding excepted files. */\n readonly drifted: readonly string[];\n /** Paths the repository declared it owns, with the reason it gave. */\n readonly excepted: readonly RepoShapeException[];\n}\n\n/**\n * Compare a repository's committed tooling files against its declared shape.\n *\n * const report = await driftInRepoShape(process.cwd(), shape);\n * expect(report.problems).toEqual([]);\n *\n * A declared exception passes. An undeclared difference fails, and so does a missing file.\n */\nexport async function driftInRepoShape(projectDir: string, shape: RepoShape): Promise<DriftReport> {\n const rendered = renderRepoShape(shape);\n const exceptions = shape.exceptions ?? [];\n const excepted = new Map(exceptions.map((exception) => [exception.file as string, exception]));\n const problems: Problem[] = [\n ...duplicateExceptions(exceptions),\n ...staleExceptions(rendered, exceptions),\n ...(await retiredFilesPresent(projectDir)),\n ];\n const drifted: string[] = [];\n\n for (const [path, expected] of Object.entries(rendered.files)) {\n if (excepted.has(path)) continue;\n const actual = await readIfPresent(`${projectDir}/${path}`);\n if (actual === undefined) {\n problems.push(`${path}: missing — run \\`${REFRESH_COMMAND}\\``);\n drifted.push(path);\n continue;\n }\n if (actual !== normalize(expected)) {\n drifted.push(path);\n problems.push(\n `${path}: differs from what @homeflare/config renders for this shape. ` +\n `Run \\`${REFRESH_COMMAND}\\` to take the standard, ` +\n `or declare it with except({ file: '${path}', reason: '…', since: '…' }) in repo-shape.ts.`,\n );\n }\n }\n\n return { drifted, excepted: exceptions, problems };\n}\n\n/**\n * Every rendered path that is NOT compared, with why. For a report, not for a gate.\n * ★ Printed by `refresh --check` so a passing run still names what it did not check.\n * An exception that stops being visible is an exception that stops being reconsidered.\n */\nexport function exceptionSummary(shape: RepoShape): readonly string[] {\n return (shape.exceptions ?? []).map(\n (exception) =>\n `${exception.file}: not checked — ${exception.reason} (since ${exception.since})`,\n );\n}\n",
|
|
15
|
+
"/**\n * The writer, and the CLI a repository wires to `repo-shape:refresh`.\n *\n * ⛔ SEPARATE FROM THE CHECK, ON PURPOSE. `drift.ts` never writes and this never gates;\n * a tool that did both would repair the working tree during CI and report green on a\n * repository whose committed files are still wrong.\n *\n * ★ IT ONLY WRITES WHAT CHANGED. An unchanged file keeps its mtime, so a refresh in a\n * watch-mode session does not restart anything, and `git status` after a no-op refresh\n * is empty rather than \"14 files touched\".\n *\n * ⚠️ IT NEVER WRITES AN EXCEPTED FILE. Refreshing a file the repository declared it owns\n * would overwrite the deviation the reason was written for — the one destructive thing\n * this could do, and the one it must not.\n *\n * ⚠️ IT DELETES A RETIRED FILE ONLY WHEN IT CAN PROVE IT RENDERED IT. `RETIRED_FILES`\n * (`retired.ts`) names every path this package used to render; `wasRenderedByUs` is the\n * proof — the file still carries the generated-file header. A retired path present\n * without that header is left alone and reported as refused, on the same reasoning as\n * never overwriting an excepted file: this writer only ever removes what it is sure is\n * its own.\n */\nimport { REFRESH_COMMAND, driftInRepoShape, exceptionSummary } from './drift.ts';\nimport { renderRepoShape } from './render.ts';\nimport { RETIRED_FILES, wasRenderedByUs } from './retired.ts';\nimport { type RepoShape, isExcepted } from './shape.ts';\nimport type { RenderedPath } from './shape.ts';\n\nexport interface RefreshResult {\n /** Paths written because their content changed or they were absent. */\n readonly written: readonly string[];\n /** Paths already correct. */\n readonly unchanged: readonly string[];\n /** Paths skipped because the shape declares an exception for them. */\n readonly skipped: readonly string[];\n /** Retired paths deleted because they still carried the generated-file header. */\n readonly removed: readonly string[];\n /** Retired paths left alone because they did not — provably hand-written, not ours. */\n readonly refused: readonly string[];\n}\n\n/** Write a repository's rendered files into `projectDir`, and clear its rendered fossils. */\nexport async function refreshRepoShape(\n projectDir: string,\n shape: RepoShape,\n): Promise<RefreshResult> {\n const rendered = renderRepoShape(shape);\n const written: string[] = [];\n const unchanged: string[] = [];\n const skipped: string[] = [];\n\n for (const [path, contents] of Object.entries(rendered.files)) {\n if (isExcepted(shape, path as RenderedPath)) {\n skipped.push(path);\n continue;\n }\n const target = `${projectDir}/${path}`;\n const file = Bun.file(target);\n if ((await file.exists()) && (await file.text()) === contents) {\n unchanged.push(path);\n continue;\n }\n await Bun.write(target, contents);\n written.push(path);\n }\n\n const { refused, removed } = await clearRetiredFiles(projectDir);\n\n return { refused, removed, skipped, unchanged, written };\n}\n\n/**\n * Delete every retired path this package can prove it rendered; leave every other one, and\n * say so. A path absent from `projectDir` is neither removed nor refused — there is\n * nothing there to have an opinion about.\n */\nasync function clearRetiredFiles(\n projectDir: string,\n): Promise<{ removed: string[]; refused: string[] }> {\n const removed: string[] = [];\n const refused: string[] = [];\n\n for (const retiredFile of RETIRED_FILES) {\n const target = `${projectDir}/${retiredFile.path}`;\n const file = Bun.file(target);\n if (!(await file.exists())) continue;\n\n if (wasRenderedByUs(await file.text())) {\n await file.delete();\n removed.push(retiredFile.path);\n } else {\n refused.push(retiredFile.path);\n }\n }\n\n return { refused, removed };\n}\n\n/**\n * ★ `Bun.write(Bun.stdout, …)` RATHER THAN `console.log`. Two reasons, and the lint rule\n * is the lesser: a CLI's output is a stream it owns, and writing to it explicitly is\n * what lets `repoShapeCli` be called in a test and in a `repo-shape.ts` without either\n * one inheriting a global. `console` in `src/` is also off-limits in the house preset —\n * allowed under `tests/**` and `scripts/**`, and this is neither.\n */\nasync function say(\n stream: typeof Bun.stdout | typeof Bun.stderr,\n lines: readonly string[],\n): Promise<void> {\n if (lines.length === 0) return;\n await Bun.write(stream, `${lines.join('\\n')}\\n`);\n}\n\n/**\n * The `repo-shape:refresh` entry point. `--check` reports drift and exits non-zero\n * instead of writing, which is what a repository puts in CI when it does not want the\n * check inside `bun test`.\n */\nexport async function repoShapeCli(\n projectDir: string,\n shape: RepoShape,\n argv: readonly string[],\n): Promise<number> {\n if (argv.includes('--check')) {\n const report = await driftInRepoShape(projectDir, shape);\n // ★ The exceptions are printed on a PASSING run too. An exception that stops being\n // visible is an exception that stops being reconsidered.\n await say(\n Bun.stdout,\n exceptionSummary(shape).map((note) => `· ${note}`),\n );\n if (report.problems.length === 0) {\n const count = report.excepted.length;\n await say(Bun.stdout, [\n `repo shape: in step with @homeflare/config (${count} declared exception(s))`,\n ]);\n return 0;\n }\n await say(Bun.stderr, [\n ...report.problems.map((problem) => `✗ ${problem}`),\n '',\n `Run \\`${REFRESH_COMMAND}\\`, or declare the deviation with a reason.`,\n ]);\n return 1;\n }\n\n const result = await refreshRepoShape(projectDir, shape);\n await say(Bun.stdout, [\n ...result.written.map((path) => `wrote ${path}`),\n ...result.unchanged.map((path) => `ok ${path}`),\n ...result.skipped.map((path) => `excepted ${path}`),\n ...result.removed.map((path) => `removed ${path} (retired; carried our header)`),\n ]);\n // ★ ON ITS OWN LINE, TO STDERR: a refused retired file is the one outcome here that\n // still needs a person. `--check` (above) keeps failing on it — it reports any retired\n // path that is present, proof or not — so this is not the only place it is said, but\n // it is the only place that says WHY refresh did not just fix it.\n await say(\n Bun.stderr,\n result.refused.map(\n (path) =>\n `refused ${path} — present but not provably ours; not deleted. See docs/repo-shape-retired.md.`,\n ),\n );\n return 0;\n}\n"
|
|
16
16
|
],
|
|
17
|
-
"mappings": ";;AAuBO,IAAM,kBAAkB;AAGxB,IAAM,oBAAoB;AAQ1B,IAAM,4BAA4B;AAGlC,SAAS,gBAAgB,CAAC,OAA0B;AAAA,EAIzD,MAAM,UAAU,MAAM,YAAY,CAAC,KAAK,aAAa,IAAI,CAAC,GAAG;AAAA,EAC7D,OAAO,oBAAoB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkCjC,QAAQ,IAAI,CAAC,QAAQ,WAAW,KAAK,EAAE,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAU5B;AAAA,mBACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYX;AAAA,sBACc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACvFtB,IAAM,WAAW;AAEV,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,QAAQ,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,eAAe,yBAAyB;AAAA,EAClF,OAAO;AAAA;AAGF,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAG3B,IAAI,QAAQ,SAAS,UAAU;AAAA,IAC7B,MAAM,IAAI,MAAM,eAAe,iCAAiC,KAAK,UAAU,KAAK,GAAG;AAAA,EACzF;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AAAA,IACtC,MAAM,IAAI,MAAM,6CAA6C,KAAK,UAAU,KAAK,GAAG;AAAA,EACtF;AAAA,EACA,OAAO;AAAA;AAQF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAClD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,0DAA0D,OAAO;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,kEAAkE,OAAO;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAGlD,IAAI,CAAC,qBAAqB,KAAK,KAAK,GAAG;AAAA,IACrC,MAAM,IAAI,MACR,2DAA2D,KAAK,UAAU,KAAK,GACjF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACqDF,SAAS,MAAsC,CACpD,WACoB;AAAA,EACpB,OAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,QAAQ,gBAAgB,UAAU,UAAU,MAAM;AAAA,IAClD,OAAO,eAAe,UAAU,KAAK;AAAA,EACvC;AAAA;AA0CK,SAAS,QAAuC,CACrD,KACU;AAAA,EACV,IAAI,IAAI,MAAM,WAAW,GAAG;AAAA,IAC1B,MAAM,IAAI,MAAM,0BAA0B,IAAI,kBAAkB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA,IACL,KAAK,IAAI,OAAO;AAAA,IAChB,IAAI,aAAa,IAAI,EAAE;AAAA,IAIvB,MAAM,gBAAgB,QAAQ,IAAI,IAAI;AAAA,IACtC,OAAO,CAAC,GAAI,IAAI,SAAS,CAAC,CAAE;AAAA,IAC5B,QAAQ,gBAAgB,UAAU,IAAI,MAAM;AAAA,IAC5C,OAAO,CAAC,GAAG,IAAI,KAAK;AAAA,OAChB,IAAI,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,eAAe,IAAI,OAAO,EAAE;AAAA,EAC9E;AAAA;AA+CK,SAAS,SAAS,CAAC,OAAsC;AAAA,EAC9D,OAAO,MAAM,SAAS,YAAY,YAAY,aAAa,MAAM,IAAI;AAAA;AAIhE,SAAS,MAAM,CAAC,QAA4B;AAAA,EACjD,OAAO,WAAW,SAAS,kCAAkC;AAAA;AAIxD,SAAS,UAAU,CAAC,OAAkB,MAA6B;AAAA,EACxE,QAAQ,MAAM,cAAc,CAAC,GAAG,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAAA;;;AC9N7E,IAAM,SAAS;AAEf,SAAS,MAAM,CAAC,OAAuB;AAAA,EACrC,OAAO,OAAO,OAAO,KAAK;AAAA;AAS5B,IAAM,QAAQ;AACd,IAAM,eACJ;AAEF,SAAS,MAAM,CAAC,OAAgC;AAAA,EAC9C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,OAAO,KAAK;AAAA,EAClD,IAAI,UAAU;AAAA,IAAI,OAAO;AAAA,EACzB,MAAM,QACJ,MAAM,KAAK,KAAK,KAChB,CAAC,aAAa,KAAK,KAAK,KACxB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,IAAI,KAKpB,CAAC,SAAS,KAAK,KAAK,KACpB,MAAM,QAAQ,MAAM;AAAA,EACtB,OAAO,QAAQ,QAAQ,IAAI,MAAM,WAAW,KAAK,IAAI;AAAA;AAGvD,SAAS,aAAa,CACpB,SACA,OACU;AAAA,EACV,OAAO,OAAO,QAAQ,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,KAAK,IAAI,QAAQ,OAAO,KAAK,GAAG;AAAA;AAa1F,SAAS,oBAAoB,CAAC,OAAuB;AAAA,EAC1D,IAAI,MAAM,MAAM;AAAA,EAChB,OAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM;AAAA,IAAI;AAAA,EACpD,OAAO,MAAM,MAAM,GAAG,GAAG;AAAA;AAQ3B,SAAS,SAAS,CAAC,SAAiB,OAAyB;AAAA,EAC3D,MAAM,QAAQ,qBAAqB,OAAO,EAAE,MAAM;AAAA,CAAI;AAAA,EACtD,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO,CAAC,GAAG,OAAO,KAAK,SAAS,OAAO,MAAM,MAAM,EAAE,GAAG;AAAA,EAChF,OAAO,CAAC,GAAG,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,GAAG,OAAO,QAAQ,CAAC,IAAI,MAAM,CAAC;AAAA;AAIlF,SAAS,UAAU,CAAC,MAAe,OAAyB;AAAA,EACjE,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OACJ,KAAK,SAAS,YACV,UAAU,KAAK,OAAO,IAAI,QAAQ,CAAC,IACnC,CAAC,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,MAAM;AAAA,EAK/C,MAAM,OAAiB,CAAC;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,OAAO,KAAK,IAAI,GAAG;AAAA,EACvF,IAAI,KAAK,OAAO;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,QAAQ,OAAO,KAAK,EAAE,GAAG;AAAA,EAKjF,OAAO,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI;AAAA,EAC/C,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,IAAI;AAAA,EAE5D,IAAI,KAAK,SAAS,aAAa,OAAO,KAAK,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,IAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,GAAG,cAAc,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EAChF;AAAA,EACA,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,GAAG,EAAE,SAAS,GAAG;AAAA,IAC9D,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,SAAS,GAAG,cAAc,KAAK,KAAK,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,WAAW,CAAC,OAA2B,OAAuB;AAAA,EAC5E,OAAO,MAAM,QAAQ,CAAC,SAAS,WAAW,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;;;ACrF5D,IAAM,sBAA8B,kBAAkB;AAQtD,IAAM,eAAuB,IAAI;AAExC,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,4CAKwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcvC,IAAM,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAahB,IAAM,WAAW;AAAA;AAAA;AAIjB,IAAM,mBAAmB;AAAA;AAAA;AAIzB,IAAM,MAAM;AAAA,yBACa;AAAA,yCACgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAelC,SAAS,eAAe,CAAC,OAA0B;AAAA,EAIxD,MAAM,UAAU;AAAA,EAEhB,MAAM,UAAU;AAAA,EAEhB,MAAM,QAAQ;AAAA,EAEd,MAAM,QAAQ;AAAA,EACd,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA,gCAAgC;AAAA,EAClC,EAAE,KAAK,MAAM;AAAA,EAEb,OAAO,GAAG;AAAA,EACV;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA,UAGQ;AAAA,eACK,OAAO,MAAM,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,YACA;AAAA,IACE;AAAA,MACE,KAAK,EAAE,UAAU,SAAS,UAAU,OAAO,UAAU,SAAS,QAAQ,MAAM;AAAA,MAC5E,MAAM;AAAA,MACN,KAAK;AAAA,IACP;AAAA,EACF,GACA,CACF;AAAA;AAAA;;AC5HO,IAAM,cAAc;AAEpB,IAAM,qBAAqB;AAElC,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,SAAS,UAAU,CAAC,OAA0B;AAAA,EAC5C,IAAI,MAAM,WAAW,QAAQ;AAAA,IAC3B,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEACE;AAAA,IAEF;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,UAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcf,IAAM,WAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBhB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBnB,IAAM,iBAAiB;AAAA;AAAA;AAIvB,IAAM,kBAAkB;AAAA;AAAA;AAAA,iBAGP;AAAA;AAAA;AAAA;AAAA;AAMjB,IAAM,qBAAqB;AAAA,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBV,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASvB,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAOf,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQlB,SAAS,QAAQ,CAAC,OAA0B;AAAA,EAC1C,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,MAAM,MAAiB;AAAA,IACrB,EAAE,MAAM,WAAW,MAAM,EAAE,eAAe,YAAY,EAAE;AAAA,IACxD,EAAE,KAAK,gCAAgC;AAAA,EACzC;AAAA,EACA,IAAI,SAAS;AAAA,IAAW,OAAO,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC;AAAA,EAC1E,OAAO;AAAA,IACL,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,IACnC;AAAA,IACA,YACE,CAAC,EAAE,MAAM,YAAY,MAAM,EAAE,gBAAgB,MAAM,yBAAyB,QAAQ,EAAE,CAAC,GACvF,CACF;AAAA,IACA,YAAY,KAAK,CAAC;AAAA,EACpB,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,SAAS,cAAc,CAAC,KAAe,OAAkB,IAAoB;AAAA,EAC3E,MAAM,SACH,IAAI,SAAS,CAAC,GAAG,WAAW,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI;AAAA;AAAA,EAGlF,MAAM,UAAU,IAAI,YAAY,YAAY,KAAK,wBAAwB,IAAI;AAAA;AAAA,EAC7E,MAAM,QACJ,IAAI,QAAQ,QACR,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,IACjD,CAAC,SAAS,KAAK,GAAG,YAAY,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA,EAG5D,OAAO,oDAA0C,IAAI;AAAA,IACnD,IAAI;AAAA,YACI,IAAI;AAAA,EACd,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA;AAAA;AAKK,SAAS,QAAQ,CAAC,OAA0B;AAAA,EACjD,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EAC9B,MAAM,SAAS,MAAM,aAAa,CAAC;AAAA,EACnC,MAAM,QAAQ,CAAC,SAAS,aAAa,GAAG,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAAA,EAEnE,OAAO,GAAG,UAAS,WAAW,KAAK,IAAI;AAAA;AAAA,EAEvC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,SAAS,KAAK;AAAA,EACd,YAAY,CAAC,EAAE,KAAK,gBAAgB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEzC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,EACnC;AAAA,EACA,YAAY,CAAC,EAAE,MAAM,0CAA0C,KAAK,mBAAmB,CAAC,GAAG,CAAC;AAAA,EAC5F,YAAY,CAAC,EAAE,MAAM,kBAAkB,KAAK,sBAAsB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEvE,OAAO,IAAI,CAAC,QAAQ,GAAG,eAAe,KAAK,OAAO,EAAE;AAAA,CAAK,EAAE,KAAK,EAAE,IAAI;AAAA;AAAA;AAAA;AAAA,cAI1D,MAAM,KAAK,IAAI;AAAA,eACd;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,8BAA8B,KAAK,OAAO,CAAC,GAAG,CAAC;AAAA;AAAA;;ACnNtE,IAAM,mBAAmB;AAWlB,SAAS,qBAAqB,CAAC,OAA0B;AAAA,EAC9D,MAAM,SAAS;AAAA,IACb,SAAS,wCAAwC;AAAA,IAIjD,WAAW,CAAC,gCAAgC,EAAE,MAAM,GAAG,MAAM,SAAS,MAAM,aAAa,CAAC;AAAA,IAC1F,QAAQ;AAAA,IACR,OAAO,CAAC;AAAA,IACR,QAAQ,CAAC;AAAA,IACT,QAAQ,MAAM,YAAY,WAAW;AAAA,IACrC,YAAY;AAAA,IACZ,4BAA4B;AAAA,IAC5B,QAAQ,CAAC;AAAA,OACL,MAAM,YAAY,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,MAAM,KAAK,MAAM,EAAE;AAAA,EAC9E;AAAA,EACA,OAAO,GAAG,KAAK,UAAU,QAAQ,WAAW,CAAC;AAAA;AAAA;AAYxC,SAAS,sBAAsB,CAAC,OAAsC;AAAA,EAC3E,IAAI,MAAM,WAAW;AAAA,IAAQ;AAAA,EAC7B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;ACjCT,IAAM,OAAO;AAEb,IAAM,UAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWf,IAAM,WAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eASD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBf,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAMnB,IAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBf,SAAS,cAAc,CAAC,OAA0B;AAAA,EACvD,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EAM9B,MAAM,QAAQ;AAAA,EACd,MAAM,YACJ,MAAM,WAAW,SACb;AAAA;AAAA;AAAA,gFACA;AAAA,EAEN,OAAO,GAAG,UAAS;AAAA;AAAA;AAAA,uBAGE;AAAA,eACR;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,sBAAsB,CAAC,GAAG,CAAC;AAAA,EAChD;AAAA;AAAA,EAEA;AAAA,EACA,YAAY,CAAC,EAAE,MAAM,+BAA+B,KAAK,EAAE,cAAc,MAAM,EAAE,CAAC,GAAG,CAAC;AAAA;AAAA;;;AC/CjF,SAAS,eAAe,CAAC,OAAgC;AAAA,EAC9D,MAAM,QAAgC;AAAA,IACpC,0BAA0B,sBAAsB,KAAK;AAAA,IACrD,0BAA0B,iBAAiB,KAAK;AAAA,IAChD,4BAA4B,SAAS,KAAK;AAAA,IAC1C,8CAA8C,gBAAgB,KAAK;AAAA,IACnE,kCAAkC,eAAe,KAAK;AAAA,EACxD;AAAA,EAEA,MAAM,aAAa,uBAAuB,KAAK;AAAA,EAC/C,IAAI,eAAe;AAAA,IAAW,MAAM,6BAA6B;AAAA,EAEjE,OAAO;AAAA,IACL;AAAA,IACA,QAAQ,EAAE,QAAQ,CAAC,MAAM,aAAa,GAAG,OAAO,MAAM,OAAO,YAAY,MAAM,WAAW;AAAA,EAC5F;AAAA;AAIK,IAAM,iBAA0C;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACjEO,IAAM,kBAAkB;AAE/B,SAAS,SAAS,CAAC,MAAsB;AAAA,EACvC,OAAO,KAAK,WAAW;AAAA,GAAQ;AAAA,CAAI;AAAA;AAGrC,eAAe,aAAa,CAAC,MAA2C;AAAA,EACtE,MAAM,OAAO,IAAI,KAAK,IAAI;AAAA,EAC1B,OAAQ,MAAM,KAAK,OAAO,IAAK,UAAU,MAAM,KAAK,KAAK,CAAC,IAAI;AAAA;AAShE,SAAS,eAAe,CACtB,UACA,YACW;AAAA,EACX,OAAO,WACJ,OAAO,CAAC,cAAc,SAAS,MAAM,UAAU,UAAU,SAAS,EAClE,IACC,CAAC,cACC,GAAG,UAAU,yBAAyB,UAAU,sEACpD;AAAA;AAOJ,SAAS,mBAAmB,CAAC,YAAsD;AAAA,EACjF,MAAM,OAAO,IAAI;AAAA,EACjB,MAAM,aAAa,IAAI;AAAA,EACvB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,UAAU,IAAI;AAAA,MAAG,WAAW,IAAI,UAAU,IAAI;AAAA,IAC3D,KAAK,IAAI,UAAU,IAAI;AAAA,EACzB;AAAA,EACA,OAAO,CAAC,GAAG,UAAU,EAAE,IACrB,CAAC,SAAS,GAAG,gFACf;AAAA;AAoBF,eAAsB,gBAAgB,CAAC,YAAoB,OAAwC;AAAA,EACjG,MAAM,WAAW,gBAAgB,KAAK;AAAA,EACtC,MAAM,aAAa,MAAM,cAAc,CAAC;AAAA,EACxC,MAAM,WAAW,IAAI,IAAI,WAAW,IAAI,CAAC,cAAc,CAAC,UAAU,MAAgB,SAAS,CAAC,CAAC;AAAA,EAC7F,MAAM,WAAsB;AAAA,IAC1B,GAAG,oBAAoB,UAAU;AAAA,IACjC,GAAG,gBAAgB,UAAU,UAAU;AAAA,EACzC;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAE3B,YAAY,MAAM,aAAa,OAAO,QAAQ,SAAS,KAAK,GAAG;AAAA,IAC7D,IAAI,SAAS,IAAI,IAAI;AAAA,MAAG;AAAA,IACxB,MAAM,SAAS,MAAM,cAAc,GAAG,cAAc,MAAM;AAAA,IAC1D,IAAI,WAAW,WAAW;AAAA,MACxB,SAAS,KAAK,GAAG,8BAAyB,mBAAmB;AAAA,MAC7D,QAAQ,KAAK,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,IACA,IAAI,WAAW,UAAU,QAAQ,GAAG;AAAA,MAClC,QAAQ,KAAK,IAAI;AAAA,MACjB,SAAS,KACP,GAAG,uEACD,SAAS,6CACT,sCAAsC,+DAC1C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO,EAAE,SAAS,UAAU,YAAY,SAAS;AAAA;AAQ5C,SAAS,gBAAgB,CAAC,OAAqC;AAAA,EACpE,QAAQ,MAAM,cAAc,CAAC,GAAG,IAC9B,CAAC,cACC,GAAG,UAAU,4BAAuB,UAAU,iBAAiB,UAAU,QAC7E;AAAA;;AClGF,eAAsB,gBAAgB,CACpC,YACA,OACwB;AAAA,EACxB,MAAM,WAAW,gBAAgB,KAAK;AAAA,EACtC,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,UAAoB,CAAC;AAAA,EAE3B,YAAY,MAAM,aAAa,OAAO,QAAQ,SAAS,KAAK,GAAG;AAAA,IAC7D,IAAI,WAAW,OAAO,IAAoB,GAAG;AAAA,MAC3C,QAAQ,KAAK,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,IACA,MAAM,SAAS,GAAG,cAAc;AAAA,IAChC,MAAM,OAAO,IAAI,KAAK,MAAM;AAAA,IAC5B,IAAK,MAAM,KAAK,OAAO,KAAO,MAAM,KAAK,KAAK,MAAO,UAAU;AAAA,MAC7D,UAAU,KAAK,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,IACA,MAAM,IAAI,MAAM,QAAQ,QAAQ;AAAA,IAChC,QAAQ,KAAK,IAAI;AAAA,EACnB;AAAA,EAEA,OAAO,EAAE,SAAS,WAAW,QAAQ;AAAA;AAUvC,eAAe,GAAG,CAChB,QACA,OACe;AAAA,EACf,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,MAAM,IAAI,MAAM,QAAQ,GAAG,MAAM,KAAK;AAAA,CAAI;AAAA,CAAK;AAAA;AAQjD,eAAsB,YAAY,CAChC,YACA,OACA,MACiB;AAAA,EACjB,IAAI,KAAK,SAAS,SAAS,GAAG;AAAA,IAC5B,MAAM,SAAS,MAAM,iBAAiB,YAAY,KAAK;AAAA,IAGvD,MAAM,IACJ,IAAI,QACJ,iBAAiB,KAAK,EAAE,IAAI,CAAC,SAAS,QAAK,MAAM,CACnD;AAAA,IACA,IAAI,OAAO,SAAS,WAAW,GAAG;AAAA,MAChC,MAAM,QAAQ,OAAO,SAAS;AAAA,MAC9B,MAAM,IAAI,IAAI,QAAQ;AAAA,QACpB,+CAA+C;AAAA,MACjD,CAAC;AAAA,MACD,OAAO;AAAA,IACT;AAAA,IACA,MAAM,IAAI,IAAI,QAAQ;AAAA,MACpB,GAAG,OAAO,SAAS,IAAI,CAAC,YAAY,UAAK,SAAS;AAAA,MAClD;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,IACD,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAM,iBAAiB,YAAY,KAAK;AAAA,EACvD,MAAM,IAAI,IAAI,QAAQ;AAAA,IACpB,GAAG,OAAO,QAAQ,IAAI,CAAC,SAAS,YAAY,MAAM;AAAA,IAClD,GAAG,OAAO,UAAU,IAAI,CAAC,SAAS,YAAY,MAAM;AAAA,IACpD,GAAG,OAAO,QAAQ,IAAI,CAAC,SAAS,YAAY,MAAM;AAAA,EACpD,CAAC;AAAA,EACD,OAAO;AAAA;",
|
|
18
|
-
"debugId": "
|
|
17
|
+
"mappings": ";;AAaA,IAAM,WAAW;AAEV,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,IAAI,QAAQ,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,eAAe,yBAAyB;AAAA,EAClF,OAAO;AAAA;AAGF,SAAS,eAAe,CAAC,OAAe,OAAuB;AAAA,EACpE,MAAM,UAAU,MAAM,KAAK;AAAA,EAG3B,IAAI,QAAQ,SAAS,UAAU;AAAA,IAC7B,MAAM,IAAI,MAAM,eAAe,iCAAiC,KAAK,UAAU,KAAK,GAAG;AAAA,EACzF;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AAAA,IACtC,MAAM,IAAI,MAAM,6CAA6C,KAAK,UAAU,KAAK,GAAG;AAAA,EACtF;AAAA,EACA,OAAO;AAAA;AAOF,SAAS,aAAa,CAAC,OAAuB;AAAA,EACnD,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAAG;AAAA,IAClC,MAAM,IAAI,MAAM,uDAAuD,KAAK,UAAU,KAAK,GAAG;AAAA,EAChG;AAAA,EACA,OAAO;AAAA;AAQF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAClD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,0DAA0D,OAAO;AAAA,EACnF;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,cAAc,CAAC,OAAuB;AAAA,EACpD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,IAC1C,MAAM,IAAI,MAAM,kEAAkE,OAAO;AAAA,EAC3F;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,YAAY,CAAC,OAAuB;AAAA,EAGlD,IAAI,CAAC,qBAAqB,KAAK,KAAK,GAAG;AAAA,IACrC,MAAM,IAAI,MACR,2DAA2D,KAAK,UAAU,KAAK,GACjF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACyCF,SAAS,MAAsC,CACpD,WACoB;AAAA,EACpB,OAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,QAAQ,gBAAgB,UAAU,UAAU,MAAM;AAAA,IAClD,OAAO,eAAe,UAAU,KAAK;AAAA,EACvC;AAAA;AA0CK,SAAS,QAAuC,CACrD,KACU;AAAA,EACV,IAAI,IAAI,MAAM,WAAW,GAAG;AAAA,IAC1B,MAAM,IAAI,MAAM,0BAA0B,IAAI,kBAAkB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA,IACL,KAAK,IAAI,OAAO;AAAA,IAChB,IAAI,aAAa,IAAI,EAAE;AAAA,IAIvB,MAAM,gBAAgB,QAAQ,IAAI,IAAI;AAAA,IACtC,OAAO,CAAC,GAAI,IAAI,SAAS,CAAC,CAAE;AAAA,IAC5B,QAAQ,gBAAgB,UAAU,IAAI,MAAM;AAAA,IAC5C,OAAO,CAAC,GAAG,IAAI,KAAK;AAAA,OAChB,IAAI,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,eAAe,IAAI,OAAO,EAAE;AAAA,EAC9E;AAAA;AA+CK,SAAS,SAAS,CAAC,OAAsC;AAAA,EAC9D,OAAO,MAAM,SAAS,YAAY,YAAY,aAAa,MAAM,IAAI;AAAA;AAIhE,SAAS,MAAM,CAAC,QAA4B;AAAA,EACjD,OAAO,WAAW,SAAS,kCAAkC;AAAA;AAIxD,SAAS,UAAU,CAAC,OAAkB,MAA6B;AAAA,EACxE,QAAQ,MAAM,cAAc,CAAC,GAAG,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAAA;;;AC7N7E,IAAM,SAAS;AAEf,SAAS,MAAM,CAAC,OAAuB;AAAA,EACrC,OAAO,OAAO,OAAO,KAAK;AAAA;AAS5B,IAAM,QAAQ;AACd,IAAM,eACJ;AAEF,SAAS,MAAM,CAAC,OAAgC;AAAA,EAC9C,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO,OAAO,KAAK;AAAA,EAClD,IAAI,UAAU;AAAA,IAAI,OAAO;AAAA,EACzB,MAAM,QACJ,MAAM,KAAK,KAAK,KAChB,CAAC,aAAa,KAAK,KAAK,KACxB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,IAAI,KAKpB,CAAC,SAAS,KAAK,KAAK,KACpB,MAAM,QAAQ,MAAM;AAAA,EACtB,OAAO,QAAQ,QAAQ,IAAI,MAAM,WAAW,KAAK,IAAI;AAAA;AAGvD,SAAS,aAAa,CACpB,SACA,OACU;AAAA,EACV,OAAO,OAAO,QAAQ,OAAO,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,OAAO,KAAK,IAAI,QAAQ,OAAO,KAAK,GAAG;AAAA;AAa1F,SAAS,oBAAoB,CAAC,OAAuB;AAAA,EAC1D,IAAI,MAAM,MAAM;AAAA,EAChB,OAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM;AAAA,IAAI;AAAA,EACpD,OAAO,MAAM,MAAM,GAAG,GAAG;AAAA;AAQ3B,SAAS,SAAS,CAAC,SAAiB,OAAyB;AAAA,EAC3D,MAAM,QAAQ,qBAAqB,OAAO,EAAE,MAAM;AAAA,CAAI;AAAA,EACtD,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO,CAAC,GAAG,OAAO,KAAK,SAAS,OAAO,MAAM,MAAM,EAAE,GAAG;AAAA,EAChF,OAAO,CAAC,GAAG,OAAO,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,GAAG,OAAO,QAAQ,CAAC,IAAI,MAAM,CAAC;AAAA;AAIlF,SAAS,UAAU,CAAC,MAAe,OAAyB;AAAA,EACjE,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,OACJ,KAAK,SAAS,YACV,UAAU,KAAK,OAAO,IAAI,QAAQ,CAAC,IACnC,CAAC,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,MAAM;AAAA,EAK/C,MAAM,OAAiB,CAAC;AAAA,EACxB,IAAI,KAAK,SAAS;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,OAAO,KAAK,IAAI,GAAG;AAAA,EACvF,IAAI,KAAK,OAAO;AAAA,IAAW,KAAK,KAAK,GAAG,OAAO,QAAQ,CAAC,QAAQ,OAAO,KAAK,EAAE,GAAG;AAAA,EAKjF,OAAO,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI;AAAA,EAC/C,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,MAAM,UAAU,KAAK,GAAG,IAAI;AAAA,EAE5D,IAAI,KAAK,SAAS,aAAa,OAAO,KAAK,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,IAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,GAAG,cAAc,KAAK,MAAM,QAAQ,CAAC,CAAC;AAAA,EAChF;AAAA,EACA,IAAI,KAAK,QAAQ,aAAa,OAAO,KAAK,KAAK,GAAG,EAAE,SAAS,GAAG;AAAA,IAC9D,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,SAAS,GAAG,cAAc,KAAK,KAAK,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,WAAW,CAAC,OAA2B,OAAuB;AAAA,EAC5E,OAAO,MAAM,QAAQ,CAAC,SAAS,WAAW,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA;;;ACvG5D,IAAM,cAAc;AAEpB,IAAM,qBAAqB;AAElC,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,SAAS,UAAU,CAAC,OAA0B;AAAA,EAC5C,IAAI,MAAM,WAAW,QAAQ;AAAA,IAC3B,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEACE;AAAA,IAEF;AAAA,IACA;AAAA,EACF,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcf,IAAM,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBhB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBnB,IAAM,iBAAiB;AAAA;AAAA;AAIvB,IAAM,kBAAkB;AAAA;AAAA;AAAA,iBAGP;AAAA;AAAA;AAAA;AAAA;AAMjB,IAAM,qBAAqB;AAAA,UACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBV,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASvB,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAOf,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQlB,SAAS,QAAQ,CAAC,OAA0B;AAAA,EAC1C,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5B,MAAM,MAAiB;AAAA,IACrB,EAAE,MAAM,WAAW,MAAM,EAAE,eAAe,YAAY,EAAE;AAAA,IACxD,EAAE,KAAK,gCAAgC;AAAA,EACzC;AAAA,EACA,IAAI,SAAS;AAAA,IAAW,OAAO,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC;AAAA,EAC1E,OAAO;AAAA,IACL,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,IACnC;AAAA,IACA,YACE,CAAC,EAAE,MAAM,YAAY,MAAM,EAAE,gBAAgB,MAAM,yBAAyB,QAAQ,EAAE,CAAC,GACvF,CACF;AAAA,IACA,YAAY,KAAK,CAAC;AAAA,EACpB,EAAE,KAAK;AAAA,CAAI;AAAA;AAGb,SAAS,cAAc,CAAC,KAAe,OAAkB,IAAoB;AAAA,EAC3E,MAAM,SACH,IAAI,SAAS,CAAC,GAAG,WAAW,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI;AAAA;AAAA,EAGlF,MAAM,UAAU,IAAI,YAAY,YAAY,KAAK,wBAAwB,IAAI;AAAA;AAAA,EAC7E,MAAM,QACJ,IAAI,QAAQ,QACR,YAAY,CAAC,EAAE,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,IACjD,CAAC,SAAS,KAAK,GAAG,YAAY,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK;AAAA,CAAI;AAAA,EAG5D,OAAO,oDAA0C,IAAI;AAAA,IACnD,IAAI;AAAA,YACI,IAAI;AAAA,EACd,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA;AAAA;AAKK,SAAS,QAAQ,CAAC,OAA0B;AAAA,EACjD,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EAC9B,MAAM,SAAS,MAAM,aAAa,CAAC;AAAA,EACnC,MAAM,QAAQ,CAAC,SAAS,aAAa,GAAG,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;AAAA,EAEnE,OAAO,GAAG,SAAS,WAAW,KAAK,IAAI;AAAA;AAAA,EAEvC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,SAAS,KAAK;AAAA,EACd,YAAY,CAAC,EAAE,KAAK,gBAAgB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEzC;AAAA;AAAA;AAAA,eAGa;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;AAAA,EACnC;AAAA,EACA,YAAY,CAAC,EAAE,MAAM,0CAA0C,KAAK,mBAAmB,CAAC,GAAG,CAAC;AAAA,EAC5F,YAAY,CAAC,EAAE,MAAM,kBAAkB,KAAK,sBAAsB,CAAC,GAAG,CAAC;AAAA;AAAA,EAEvE,OAAO,IAAI,CAAC,QAAQ,GAAG,eAAe,KAAK,OAAO,EAAE;AAAA,CAAK,EAAE,KAAK,EAAE,IAAI;AAAA;AAAA;AAAA;AAAA,cAI1D,MAAM,KAAK,IAAI;AAAA,eACd;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,8BAA8B,KAAK,OAAO,CAAC,GAAG,CAAC;AAAA;AAAA;;ACnNtE,IAAM,mBAAmB;AAWlB,SAAS,qBAAqB,CAAC,OAA0B;AAAA,EAC9D,MAAM,SAAS;AAAA,IACb,SAAS,wCAAwC;AAAA,IAIjD,WAAW,CAAC,gCAAgC,EAAE,MAAM,GAAG,MAAM,SAAS,MAAM,aAAa,CAAC;AAAA,IAC1F,QAAQ;AAAA,IACR,OAAO,CAAC;AAAA,IACR,QAAQ,CAAC;AAAA,IACT,QAAQ,MAAM,YAAY,WAAW;AAAA,IACrC,YAAY;AAAA,IACZ,4BAA4B;AAAA,IAC5B,QAAQ,CAAC;AAAA,OACL,MAAM,YAAY,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,MAAM,KAAK,MAAM,EAAE;AAAA,EAC9E;AAAA,EACA,OAAO,GAAG,KAAK,UAAU,QAAQ,WAAW,CAAC;AAAA;AAAA;AAYxC,SAAS,sBAAsB,CAAC,OAAsC;AAAA,EAC3E,IAAI,MAAM,WAAW;AAAA,IAAQ;AAAA,EAC7B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;ACzCF,IAAM,oBAAoB;AAO1B,IAAM,4BAA4B;AAGlC,SAAS,gBAAgB,CAAC,OAA0B;AAAA,EAIzD,MAAM,UAAU,MAAM,YAAY,CAAC,KAAK,aAAa,IAAI,CAAC,GAAG;AAAA,EAC7D,OAAO,oBAAoB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgCjC,QAAQ,IAAI,CAAC,QAAQ,WAAW,KAAK,EAAE,KAAK;AAAA,CAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAO5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAMM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;ACpD5B,IAAM,OAAO;AAEb,IAAM,UAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWf,IAAM,WAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eASD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBf,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAMnB,IAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBf,SAAS,cAAc,CAAC,OAA0B;AAAA,EACvD,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EAM9B,MAAM,QAAQ;AAAA,EACd,MAAM,YACJ,MAAM,WAAW,SACb;AAAA;AAAA;AAAA,gFACA;AAAA,EAEN,OAAO,GAAG,UAAS;AAAA;AAAA;AAAA,uBAGE;AAAA,eACR;AAAA;AAAA,EAEb,YAAY,CAAC,EAAE,MAAM,sBAAsB,CAAC,GAAG,CAAC;AAAA,EAChD;AAAA;AAAA,EAEA;AAAA,EACA,YAAY,CAAC,EAAE,MAAM,+BAA+B,KAAK,EAAE,cAAc,MAAM,EAAE,CAAC,GAAG,CAAC;AAAA;AAAA;;;AChDjF,SAAS,eAAe,CAAC,OAAgC;AAAA,EAC9D,MAAM,QAAgC;AAAA,IACpC,0BAA0B,sBAAsB,KAAK;AAAA,IACrD,0BAA0B,iBAAiB,KAAK;AAAA,IAChD,4BAA4B,SAAS,KAAK;AAAA,IAC1C,kCAAkC,eAAe,KAAK;AAAA,EACxD;AAAA,EAEA,MAAM,aAAa,uBAAuB,KAAK;AAAA,EAC/C,IAAI,eAAe;AAAA,IAAW,MAAM,6BAA6B;AAAA,EAEjE,OAAO;AAAA,IACL;AAAA,IACA,QAAQ,EAAE,QAAQ,CAAC,MAAM,aAAa,GAAG,OAAO,MAAM,OAAO,YAAY,MAAM,WAAW;AAAA,EAC5F;AAAA;AAIK,IAAM,iBAA0C;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AC1CA,SAAS,MAAM,CAAC,MAAgC;AAAA,EAC9C,OAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,QAAQ,gBAAgB,kBAAkB,KAAK,MAAM;AAAA,IACrD,WAAW,cAAc,KAAK,SAAS;AAAA,EACzC;AAAA;AAIK,IAAM,gBAAwC;AAAA,EACnD,OAAO;AAAA,IACL,MAAM;AAAA,IACN,QACE,sFACA;AAAA,IACF,WAAW;AAAA,EACb,CAAC;AACH;AASO,IAAM,wBAAwB;AAuB9B,SAAS,eAAe,CAAC,SAA0B;AAAA,EACxD,OAAO,QACJ,MAAM;AAAA,CAAI,EACV,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,WAAW,KAAK,uBAAuB,CAAC;AAAA;AAStE,SAAS,kBAAkB,CAAC,MAA2B;AAAA,EAC5D,OACE,GAAG,KAAK,sCAAsC,KAAK,cAAc,KAAK,aACtE;AAAA;;;ACnFG,IAAM,kBAAkB;AAE/B,SAAS,SAAS,CAAC,MAAsB;AAAA,EACvC,OAAO,KAAK,WAAW;AAAA,GAAQ;AAAA,CAAI;AAAA;AAGrC,eAAe,aAAa,CAAC,MAA2C;AAAA,EACtE,MAAM,OAAO,IAAI,KAAK,IAAI;AAAA,EAC1B,OAAQ,MAAM,KAAK,OAAO,IAAK,UAAU,MAAM,KAAK,KAAK,CAAC,IAAI;AAAA;AAShE,SAAS,eAAe,CACtB,UACA,YACW;AAAA,EACX,OAAO,WACJ,OAAO,CAAC,cAAc,SAAS,MAAM,UAAU,UAAU,SAAS,EAClE,IACC,CAAC,cACC,GAAG,UAAU,yBAAyB,UAAU,sEACpD;AAAA;AAOJ,SAAS,mBAAmB,CAAC,YAAsD;AAAA,EACjF,MAAM,OAAO,IAAI;AAAA,EACjB,MAAM,aAAa,IAAI;AAAA,EACvB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,UAAU,IAAI;AAAA,MAAG,WAAW,IAAI,UAAU,IAAI;AAAA,IAC3D,KAAK,IAAI,UAAU,IAAI;AAAA,EACzB;AAAA,EACA,OAAO,CAAC,GAAG,UAAU,EAAE,IACrB,CAAC,SAAS,GAAG,gFACf;AAAA;AASF,eAAe,mBAAmB,CAAC,YAAwC;AAAA,EACzE,MAAM,WAAsB,CAAC;AAAA,EAC7B,WAAW,QAAQ,eAAe;AAAA,IAChC,IAAK,MAAM,cAAc,GAAG,cAAc,KAAK,MAAM,MAAO,WAAW;AAAA,MACrE,SAAS,KAAK,mBAAmB,IAAI,CAAC;AAAA,IACxC;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAoBT,eAAsB,gBAAgB,CAAC,YAAoB,OAAwC;AAAA,EACjG,MAAM,WAAW,gBAAgB,KAAK;AAAA,EACtC,MAAM,aAAa,MAAM,cAAc,CAAC;AAAA,EACxC,MAAM,WAAW,IAAI,IAAI,WAAW,IAAI,CAAC,cAAc,CAAC,UAAU,MAAgB,SAAS,CAAC,CAAC;AAAA,EAC7F,MAAM,WAAsB;AAAA,IAC1B,GAAG,oBAAoB,UAAU;AAAA,IACjC,GAAG,gBAAgB,UAAU,UAAU;AAAA,IACvC,GAAI,MAAM,oBAAoB,UAAU;AAAA,EAC1C;AAAA,EACA,MAAM,UAAoB,CAAC;AAAA,EAE3B,YAAY,MAAM,aAAa,OAAO,QAAQ,SAAS,KAAK,GAAG;AAAA,IAC7D,IAAI,SAAS,IAAI,IAAI;AAAA,MAAG;AAAA,IACxB,MAAM,SAAS,MAAM,cAAc,GAAG,cAAc,MAAM;AAAA,IAC1D,IAAI,WAAW,WAAW;AAAA,MACxB,SAAS,KAAK,GAAG,8BAAyB,mBAAmB;AAAA,MAC7D,QAAQ,KAAK,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,IACA,IAAI,WAAW,UAAU,QAAQ,GAAG;AAAA,MAClC,QAAQ,KAAK,IAAI;AAAA,MACjB,SAAS,KACP,GAAG,uEACD,SAAS,6CACT,sCAAsC,+DAC1C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO,EAAE,SAAS,UAAU,YAAY,SAAS;AAAA;AAQ5C,SAAS,gBAAgB,CAAC,OAAqC;AAAA,EACpE,QAAQ,MAAM,cAAc,CAAC,GAAG,IAC9B,CAAC,cACC,GAAG,UAAU,4BAAuB,UAAU,iBAAiB,UAAU,QAC7E;AAAA;;ACxGF,eAAsB,gBAAgB,CACpC,YACA,OACwB;AAAA,EACxB,MAAM,WAAW,gBAAgB,KAAK;AAAA,EACtC,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,UAAoB,CAAC;AAAA,EAE3B,YAAY,MAAM,aAAa,OAAO,QAAQ,SAAS,KAAK,GAAG;AAAA,IAC7D,IAAI,WAAW,OAAO,IAAoB,GAAG;AAAA,MAC3C,QAAQ,KAAK,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,IACA,MAAM,SAAS,GAAG,cAAc;AAAA,IAChC,MAAM,OAAO,IAAI,KAAK,MAAM;AAAA,IAC5B,IAAK,MAAM,KAAK,OAAO,KAAO,MAAM,KAAK,KAAK,MAAO,UAAU;AAAA,MAC7D,UAAU,KAAK,IAAI;AAAA,MACnB;AAAA,IACF;AAAA,IACA,MAAM,IAAI,MAAM,QAAQ,QAAQ;AAAA,IAChC,QAAQ,KAAK,IAAI;AAAA,EACnB;AAAA,EAEA,QAAQ,SAAS,YAAY,MAAM,kBAAkB,UAAU;AAAA,EAE/D,OAAO,EAAE,SAAS,SAAS,SAAS,WAAW,QAAQ;AAAA;AAQzD,eAAe,iBAAiB,CAC9B,YACmD;AAAA,EACnD,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,UAAoB,CAAC;AAAA,EAE3B,WAAW,eAAe,eAAe;AAAA,IACvC,MAAM,SAAS,GAAG,cAAc,YAAY;AAAA,IAC5C,MAAM,OAAO,IAAI,KAAK,MAAM;AAAA,IAC5B,IAAI,CAAE,MAAM,KAAK,OAAO;AAAA,MAAI;AAAA,IAE5B,IAAI,gBAAgB,MAAM,KAAK,KAAK,CAAC,GAAG;AAAA,MACtC,MAAM,KAAK,OAAO;AAAA,MAClB,QAAQ,KAAK,YAAY,IAAI;AAAA,IAC/B,EAAO;AAAA,MACL,QAAQ,KAAK,YAAY,IAAI;AAAA;AAAA,EAEjC;AAAA,EAEA,OAAO,EAAE,SAAS,QAAQ;AAAA;AAU5B,eAAe,GAAG,CAChB,QACA,OACe;AAAA,EACf,IAAI,MAAM,WAAW;AAAA,IAAG;AAAA,EACxB,MAAM,IAAI,MAAM,QAAQ,GAAG,MAAM,KAAK;AAAA,CAAI;AAAA,CAAK;AAAA;AAQjD,eAAsB,YAAY,CAChC,YACA,OACA,MACiB;AAAA,EACjB,IAAI,KAAK,SAAS,SAAS,GAAG;AAAA,IAC5B,MAAM,SAAS,MAAM,iBAAiB,YAAY,KAAK;AAAA,IAGvD,MAAM,IACJ,IAAI,QACJ,iBAAiB,KAAK,EAAE,IAAI,CAAC,SAAS,QAAK,MAAM,CACnD;AAAA,IACA,IAAI,OAAO,SAAS,WAAW,GAAG;AAAA,MAChC,MAAM,QAAQ,OAAO,SAAS;AAAA,MAC9B,MAAM,IAAI,IAAI,QAAQ;AAAA,QACpB,+CAA+C;AAAA,MACjD,CAAC;AAAA,MACD,OAAO;AAAA,IACT;AAAA,IACA,MAAM,IAAI,IAAI,QAAQ;AAAA,MACpB,GAAG,OAAO,SAAS,IAAI,CAAC,YAAY,UAAK,SAAS;AAAA,MAClD;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,IACD,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAM,iBAAiB,YAAY,KAAK;AAAA,EACvD,MAAM,IAAI,IAAI,QAAQ;AAAA,IACpB,GAAG,OAAO,QAAQ,IAAI,CAAC,SAAS,YAAY,MAAM;AAAA,IAClD,GAAG,OAAO,UAAU,IAAI,CAAC,SAAS,YAAY,MAAM;AAAA,IACpD,GAAG,OAAO,QAAQ,IAAI,CAAC,SAAS,YAAY,MAAM;AAAA,IAClD,GAAG,OAAO,QAAQ,IAAI,CAAC,SAAS,YAAY,oCAAoC;AAAA,EAClF,CAAC;AAAA,EAKD,MAAM,IACJ,IAAI,QACJ,OAAO,QAAQ,IACb,CAAC,SACC,YAAY,yFAChB,CACF;AAAA,EACA,OAAO;AAAA;",
|
|
18
|
+
"debugId": "B40D338DD6A7FD1664756E2164756E21",
|
|
19
19
|
"names": []
|
|
20
20
|
}
|
package/dist/versions.js
CHANGED
|
@@ -20,6 +20,12 @@ function requireIsoDate(value) {
|
|
|
20
20
|
}
|
|
21
21
|
return value;
|
|
22
22
|
}
|
|
23
|
+
function requireSemver(value) {
|
|
24
|
+
if (!/^\d+\.\d+\.\d+$/.test(value)) {
|
|
25
|
+
throw new Error(`repo-shape: retiredIn must be a released x.y.z, got ${JSON.stringify(value)}`);
|
|
26
|
+
}
|
|
27
|
+
return value;
|
|
28
|
+
}
|
|
23
29
|
function requireMajor(value) {
|
|
24
30
|
if (!Number.isInteger(value) || value <= 0) {
|
|
25
31
|
throw new Error(`repo-shape: node must be a positive integer major, got ${value}`);
|
|
@@ -336,5 +342,5 @@ export {
|
|
|
336
342
|
ESTATE_VERSIONS
|
|
337
343
|
};
|
|
338
344
|
|
|
339
|
-
//# debugId=
|
|
345
|
+
//# debugId=3E8EB110EB4CEAA964756E2164756E21
|
|
340
346
|
//# sourceMappingURL=versions.js.map
|