@invarn/cibuild 2.7.5 → 2.7.6

package/dist/src/commands/a-credential-target-follows-the-flavor-source-set.test.js

@@ -160,13 +160,16 @@ describe('the pipeline a flavored repository gets', () => {
             googleServices: true,
             googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
         }, FLAVORED);
-        const declared = envs(parse(yaml));
-        expect(Object.keys(declared).filter((k) => k.includes('GOOGLE_SERVICES_JSON'))).toEqual([
-            'CIBUILD_SW__PRIMARY__GOOGLE_SERVICES_JSON',
-            'CIBUILD_SW__PULL_REQUEST__GOOGLE_SERVICES_JSON',
-            'CIBUILD_SW__RELEASE__GOOGLE_SERVICES_JSON',
-        ]);
+        // One declaration per workflow, in that workflow's own `envs`, under the
+        // plain credential name — the block says which workflow, so nothing is
+        // encoded into the key.
+        const parsed = parse(yaml);
+        const declaringWorkflows = Object.keys(parsed.workflows ?? {}).filter((workflow) => 'GOOGLE_SERVICES_JSON' in
+            Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? [])));
+        expect(declaringWorkflows).toEqual(['primary', 'pull-request', 'release']);
+        expect(envs(parsed)).not.toHaveProperty('GOOGLE_SERVICES_JSON');
         expect(yaml).not.toMatch(/GOOGLE_SERVICES_JSON_[A-Z]/);
+        expect(yaml).not.toContain('CIBUILD_SW__');
     });
 });
 describe('a repository with no product flavors', () => {

package/dist/src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.js

@@ -40,7 +40,6 @@
 import { describe, test, expect } from '@jest/globals';
 import { load } from 'js-yaml';
 import { generateAndroidPipeline, googleServicesTargets, variantFlavors, credentialSlots, GENERATED_WORKFLOWS, } from './build.js';
-import { decodeSecretName } from './secrets-upload.js';
 function variant(name) {
     const buildType = name.charAt(0).toUpperCase() + name.slice(1);
     return { variant: name, buildType, gradleTask: `assemble${buildType}` };
@@ -92,6 +91,19 @@ function parse(yaml) {
 function envs(parsed) {
     return Object.assign({}, ...(parsed.app?.envs ?? []));
 }
+/** What one workflow's own `envs` block declares. */
+function workflowEnvs(parsed, workflow) {
+    return Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? []));
+}
+/**
+ * The workflows whose own `envs` declare `varName`, in pipeline order.
+ *
+ * The name is the plain credential now, so *where* the declaration sits is the
+ * whole answer to which workflow it belongs to.
+ */
+function declaringWorkflows(parsed, varName) {
+    return Object.keys(parsed.workflows ?? {}).filter((workflow) => varName in workflowEnvs(parsed, workflow));
+}
 /** The `var_name` of every `file@` step in `workflow`, in order. */
 function fileVarNames(parsed, workflow) {
     return (parsed.workflows?.[workflow]?.steps ?? [])
@@ -136,15 +148,18 @@ describe('the slots one credential gets', () => {
             release: 'ciDynamic',
         })).toEqual([{ slot: 'LOCAL_PROPERTIES', workflow: null }]);
     });
-    test('are one per workflow, encoded, when they do not', () => {
+    test('are one per workflow, under the plain name, when they do not', () => {
+        // The name never changes; the block it is declared in does.
+        // `CIBUILD_SW__<WF>__<VAR>` is the encoding `ci secrets upload` carries a
+        // workflow-scoped *value* under, and a pipeline has structure instead.
         expect(credentialSlots('LOCAL_PROPERTIES', {
             primary: 'ciDynamic',
             'pull-request': 'ciDynamic',
             release: 'prod',
         })).toEqual([
-            { slot: 'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES', workflow: 'primary' },
-            { slot: 'CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES', workflow: 'pull-request' },
-            { slot: 'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES', workflow: 'release' },
+            { slot: 'LOCAL_PROPERTIES', workflow: 'primary' },
+            { slot: 'LOCAL_PROPERTIES', workflow: 'pull-request' },
+            { slot: 'LOCAL_PROPERTIES', workflow: 'release' },
         ]);
     });
     test('include the workflows that agree, not only the odd one out', () => {
@@ -161,26 +176,26 @@ describe('the slots one credential gets', () => {
     });
 });
 describe('a flavored repository', () => {
-    test('declares the properties file once per workflow', () => {
+    test('declares the properties file in each workflow, and not globally', () => {
         const parsed = flavoredPipeline();
-        expect(slotsFor(parsed, 'LOCAL_PROPERTIES')).toEqual([
-            'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES',
-            'CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES',
-            'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES',
+        expect(declaringWorkflows(parsed, 'LOCAL_PROPERTIES')).toEqual([
+            'primary',
+            'pull-request',
+            'release',
         ]);
+        // Globally would be one value for three workflows, which is the bug.
+        expect(envs(parsed)).not.toHaveProperty('LOCAL_PROPERTIES');
     });
     test('declares google-services.json and the keystore per workflow too', () => {
         const parsed = flavoredPipeline();
-        expect(slotsFor(parsed, 'GOOGLE_SERVICES_JSON')).toEqual([
-            'CIBUILD_SW__PRIMARY__GOOGLE_SERVICES_JSON',
-            'CIBUILD_SW__PULL_REQUEST__GOOGLE_SERVICES_JSON',
-            'CIBUILD_SW__RELEASE__GOOGLE_SERVICES_JSON',
-        ]);
-        expect(slotsFor(parsed, 'KEYSTORE_BASE64')).toEqual([
-            'CIBUILD_SW__PRIMARY__KEYSTORE_BASE64',
-            'CIBUILD_SW__PULL_REQUEST__KEYSTORE_BASE64',
-            'CIBUILD_SW__RELEASE__KEYSTORE_BASE64',
-        ]);
+        for (const varName of ['GOOGLE_SERVICES_JSON', 'KEYSTORE_BASE64']) {
+            expect(declaringWorkflows(parsed, varName)).toEqual([
+                'primary',
+                'pull-request',
+                'release',
+            ]);
+            expect(envs(parsed)).not.toHaveProperty(varName);
+        }
     });
     test('keeps one slot for the credentials only `release` reads', () => {
         // Genuinely release-only, and legitimately so: nothing else signs a
@@ -205,27 +220,45 @@ describe('a flavored repository', () => {
     });
     test('declares every slot empty, which is what `invarn setup` searches by', () => {
         // `unsetEnvKeys` collects `envs` keys whose declared value is the empty
-        // string. A slot with anything else in it is never discovered on the
-        // developer's machine and never offered for upload.
-        const declared = envs(flavoredPipeline());
-        const credentialSlotKeys = Object.keys(declared).filter((k) => k.startsWith('CIBUILD_SW__') || /^(KEYSTORE|GOOGLE|LOCAL)_/.test(k));
-        // Three scoped slots each for the properties file, google-services.json
-        // and the keystore; one flat slot each for the two release-only ones.
-        expect(credentialSlotKeys.length).toBe(11);
-        for (const key of credentialSlotKeys)
-            expect(declared[key]).toBe('');
+        // string — from `app.envs` and from each workflow's own. A slot with
+        // anything else in it is never discovered on the developer's machine and
+        // never offered for upload.
+        const parsed = flavoredPipeline();
+        const isCredential = (k) => /^(KEYSTORE|GOOGLE|LOCAL)_/.test(k);
+        const declared = [
+            ...Object.entries(envs(parsed)),
+            ...Object.keys(parsed.workflows ?? {}).flatMap((w) => Object.entries(workflowEnvs(parsed, w))),
+        ].filter(([key]) => isCredential(key));
+        // Three per-workflow slots each for the properties file,
+        // google-services.json and the keystore; one flat slot each for the two
+        // release-only ones.
+        expect(declared.length).toBe(11);
+        for (const [, value] of declared)
+            expect(value).toBe('');
+    });
+    test('spends no encoding on what the block already says', () => {
+        // The workflow a declaration belongs to is the block it sits in. The
+        // `CIBUILD_SW__` prefix stays what it has always been: how `ci secrets
+        // upload` transports a workflow-scoped value into a flat key→value store
+        // that has no workflow column (Alex, 2026-09-10).
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE,
+            ...ALL_CREDENTIALS,
+            keystorePaths: SPLIT_KEYSTORES,
+            googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
+            workflowFlavors: variantFlavors(FLAVORED, FLAVORS),
+        }, FLAVORED);
+        expect(yaml).not.toContain('CIBUILD_SW__');
+        expect(yaml).not.toContain('CIBUILD_S__');
     });
-    test('names only workflows the pipeline actually has', () => {
-        // `decodeSecretName` lower-cases and turns `_` back into `-`, so the
-        // round trip is the only thing that proves `CIBUILD_SW__PULL_REQUEST__X`
-        // reaches `pull-request` and not a workflow nobody runs.
+    test('puts a per-workflow declaration in a workflow the pipeline has', () => {
+        // Structural now, and that is the point: a declaration cannot name a
+        // workflow that does not exist, because it lives inside one.
         const parsed = flavoredPipeline();
         const present = Object.keys(parsed.workflows ?? {});
-        const scoped = Object.keys(envs(parsed))
-            .filter((k) => k.startsWith('CIBUILD_SW__'))
-            .map((k) => decodeSecretName(k)?.workflow);
-        expect(scoped.length).toBe(9);
-        expect(scoped.every((w) => w !== undefined && present.includes(w))).toBe(true);
+        const perWorkflow = ['KEYSTORE_BASE64', 'GOOGLE_SERVICES_JSON', 'LOCAL_PROPERTIES'].flatMap((varName) => declaringWorkflows(parsed, varName));
+        expect(perWorkflow.length).toBe(9);
+        expect(perWorkflow.every((w) => present.includes(w))).toBe(true);
     });
 });
 describe('a repository whose workflows all want the same bytes', () => {

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.d.ts

@@ -0,0 +1,29 @@
+/**
+ * A value already in `.cibuild-secrets.json` answers "what are the bytes".
+ * It does not answer "where does each workflow write them", and
+ * `collectFileSecret` used to treat the two as one question.
+ *
+ * `pendingGroups` is empty when every group already has the secret — and a
+ * **global** entry satisfies `hasSecret(name, workflow)` for every workflow, so
+ * one `ci init` in the repository's past is enough. The call then returned an
+ * empty paths map, the caller assigned that to `setupOptions.keystorePaths`,
+ * and the fallback filled every workflow from one source: the `storeFile=`
+ * line of whatever `keystore.properties` was collected, or the first path
+ * Gradle mentioned. One path for three workflows is one discriminator, so
+ * `credentialSlots` declared a single flat `KEYSTORE_BASE64` and the whole
+ * per-workflow split was lost — silently, and on exactly the credential the
+ * split exists for.
+ *
+ * Measured on the real repository, 2026-09-09: the store held
+ * `KEYSTORE_BASE64` globally, the keystore prompt never appeared, and all
+ * three workflows were generated writing to `customer-android.jks` — the
+ * release key's path, over the two debug workflows. A fresh clone of the same
+ * repository prompts and splits correctly, which is why this never showed up
+ * in a test that builds its own fixture from nothing.
+ *
+ * The store records values and never paths, so the path has to be asked for
+ * whichever the value's state is. Only a caller that consumes the returned map
+ * is affected — `promptTargetPath` marks it — so nothing else gains a prompt.
+ */
+export {};
+//# sourceMappingURL=an-already-stored-value-does-not-answer-the-target-question.test.d.ts.map

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"an-already-stored-value-does-not-answer-the-target-question.test.d.ts","sourceRoot":"","sources":["../../../src/commands/an-already-stored-value-does-not-answer-the-target-question.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG"}

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.js

@@ -0,0 +1,160 @@
+/**
+ * A value already in `.cibuild-secrets.json` answers "what are the bytes".
+ * It does not answer "where does each workflow write them", and
+ * `collectFileSecret` used to treat the two as one question.
+ *
+ * `pendingGroups` is empty when every group already has the secret — and a
+ * **global** entry satisfies `hasSecret(name, workflow)` for every workflow, so
+ * one `ci init` in the repository's past is enough. The call then returned an
+ * empty paths map, the caller assigned that to `setupOptions.keystorePaths`,
+ * and the fallback filled every workflow from one source: the `storeFile=`
+ * line of whatever `keystore.properties` was collected, or the first path
+ * Gradle mentioned. One path for three workflows is one discriminator, so
+ * `credentialSlots` declared a single flat `KEYSTORE_BASE64` and the whole
+ * per-workflow split was lost — silently, and on exactly the credential the
+ * split exists for.
+ *
+ * Measured on the real repository, 2026-09-09: the store held
+ * `KEYSTORE_BASE64` globally, the keystore prompt never appeared, and all
+ * three workflows were generated writing to `customer-android.jks` — the
+ * release key's path, over the two debug workflows. A fresh clone of the same
+ * repository prompts and splits correctly, which is why this never showed up
+ * in a test that builds its own fixture from nothing.
+ *
+ * The store records values and never paths, so the path has to be asked for
+ * whichever the value's state is. Only a caller that consumes the returned map
+ * is affected — `promptTargetPath` marks it — so nothing else gains a prompt.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import prompts from 'prompts';
+import { collectFileSecret } from './file-secret-collector.js';
+import { SecretsManager } from '../yaml/secrets-manager.js';
+import { credentialSlots } from './build.js';
+const KEYSTORE_GROUPS = [
+    { label: 'debug builds (primary, pull-request)', workflows: ['primary', 'pull-request'] },
+    { label: 'release', workflows: ['release'] },
+];
+let workdir;
+let secretsManager;
+// `prompts.inject` concatenates, so a sentinel one test leaves queued becomes
+// the next test's answer. The queue itself is the only reset there is.
+const clearInjected = () => {
+    prompts._injected = undefined;
+};
+beforeEach(() => {
+    clearInjected();
+    workdir = resolve(mkdtempSync(join(tmpdir(), 'cibuild-stored-value-target-')));
+    secretsManager = new SecretsManager(join(workdir, '.cibuild-secrets.json'));
+});
+afterEach(() => {
+    clearInjected();
+    rmSync(workdir, { recursive: true, force: true });
+});
+function put(relPath, contents) {
+    const full = join(workdir, relPath);
+    mkdirSync(join(full, '..'), { recursive: true });
+    writeFileSync(full, contents, 'utf-8');
+    return full;
+}
+/** The repository's shape: a committed debug key and an uncommitted release key. */
+function twoKeystores() {
+    return {
+        debug: put('config/debug.keystore', 'debug-key-bytes'),
+        release: put('app/customer-android.jks', 'release-key-bytes'),
+    };
+}
+function collectKeystore() {
+    return collectFileSecret({
+        displayName: 'keystore',
+        secretName: 'KEYSTORE_BASE64',
+        fileMatch: (name) => name.endsWith('.jks') || name.endsWith('.keystore'),
+        readAs: 'base64',
+        workflowGroups: KEYSTORE_GROUPS,
+        promptTargetPath: true,
+    }, workdir, secretsManager);
+}
+describe('a keystore whose value the store already holds', () => {
+    test('is still asked where each workflow writes it', async () => {
+        const { debug, release } = twoKeystores();
+        // One `ci init` in this repository's past, filed globally — which is what
+        // the real repository had.
+        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
+        prompts.inject([debug, release]);
+        const paths = await collectKeystore();
+        expect(paths).toEqual({
+            primary: 'config/debug.keystore',
+            'pull-request': 'config/debug.keystore',
+            release: 'app/customer-android.jks',
+        });
+    });
+    test('so the credential still declares one slot per workflow', async () => {
+        const { debug, release } = twoKeystores();
+        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
+        prompts.inject([debug, release]);
+        const paths = await collectKeystore();
+        const discriminatorByWorkflow = Object.fromEntries(Object.entries(paths).map(([workflow, path]) => [workflow, path]));
+        // One declaration per workflow, each under the plain name — what varies is
+        // the `envs` block it is emitted into, not the key.
+        expect(credentialSlots('KEYSTORE_BASE64', discriminatorByWorkflow)).toEqual([
+            { slot: 'KEYSTORE_BASE64', workflow: 'primary' },
+            { slot: 'KEYSTORE_BASE64', workflow: 'pull-request' },
+            { slot: 'KEYSTORE_BASE64', workflow: 'release' },
+        ]);
+    });
+    test('and a workflow-scoped entry hides the question just as well as a global one', async () => {
+        const { debug, release } = twoKeystores();
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here', workflow);
+        }
+        prompts.inject([debug, release]);
+        expect(await collectKeystore()).toEqual({
+            primary: 'config/debug.keystore',
+            'pull-request': 'config/debug.keystore',
+            release: 'app/customer-android.jks',
+        });
+    });
+    test('and the value the user picks now replaces the one that was there', async () => {
+        const { debug, release } = twoKeystores();
+        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
+        prompts.inject([debug, release]);
+        await collectKeystore();
+        // Re-reading it is the point: a stale global value is what would otherwise
+        // be uploaded for all three workflows.
+        expect(secretsManager.getSecret('KEYSTORE_BASE64', 'primary')).toBe(Buffer.from('debug-key-bytes').toString('base64'));
+        expect(secretsManager.getSecret('KEYSTORE_BASE64', 'release')).toBe(Buffer.from('release-key-bytes').toString('base64'));
+    });
+});
+describe('a credential whose caller does not need a path back', () => {
+    test('still short-circuits on an already-stored value, and asks nothing', async () => {
+        // `google-services.json`, `local.properties` and `keystore.properties` take
+        // their targets from the pipeline's own flavors, not from this call, so the
+        // early return is right for them and must stay. No answer is injected: a
+        // prompt here would hang or take undefined, and either fails the test.
+        put('app/src/prod/google-services.json', '{}');
+        secretsManager.storeSecret('GOOGLE_SERVICES_JSON', 'already-here');
+        const paths = await collectFileSecret({
+            displayName: 'google-services.json',
+            secretName: 'GOOGLE_SERVICES_JSON',
+            fileMatch: (name) => name === 'google-services.json',
+            readAs: 'text',
+            workflowGroups: [{ label: 'release', workflows: ['release'] }],
+        }, workdir, secretsManager);
+        expect(paths).toEqual({});
+        expect(secretsManager.getSecret('GOOGLE_SERVICES_JSON', 'release')).toBe('already-here');
+    });
+});
+describe('a keystore the store has never seen', () => {
+    test('behaves exactly as it did before', async () => {
+        const { debug, release } = twoKeystores();
+        prompts.inject([debug, release]);
+        expect(await collectKeystore()).toEqual({
+            primary: 'config/debug.keystore',
+            'pull-request': 'config/debug.keystore',
+            release: 'app/customer-android.jks',
+        });
+    });
+});
+//# sourceMappingURL=an-already-stored-value-does-not-answer-the-target-question.test.js.map

package/dist/src/commands/android-scanner.d.ts

@@ -132,8 +132,16 @@ export declare function runnableJavaVersion(detectedJavaVersion: number | undefi
  */
 export declare function javaVersionProblem(detectedJavaVersion: number | undefined, gradleVersion?: string): string | undefined;
 /**
- * Detects build types and product flavors from Gradle files by static parsing.
+ * Detects build types and product flavors from Gradle files by static parsing,
+ * falling back to the module's source sets for the flavors when no Gradle file
+ * declares any (see `flavorsFromSourceSets`).
+ *
  * Always includes "debug" and "release" as defaults.
+ *
+ * The fallback only ever runs when the literal scan found nothing, so a
+ * project whose Gradle files declare flavors is decided by those files exactly
+ * as before. Merging the two would let a leftover directory invent a flavor
+ * the build does not have.
  */
 export declare function detectBuildVariants(gradleFiles: string[]): BuildVariants;
 export declare function scanAndroidProject(projectRoot: string): Promise<ScanResult>;

package/dist/src/commands/android-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAQR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAkBpB;AA6FD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAmCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoQjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAyD3D"}
+{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAQR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAkBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoQjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAyD3D"}

package/dist/src/commands/android-scanner.js

@@ -1,4 +1,4 @@
-import { resolve, relative } from "node:path";
+import { resolve, join, relative, dirname } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { parseSettingsModules } from "../shared/gradle-settings.js";
 // ---------------------------------------------------------------------------
@@ -655,9 +655,107 @@ function extractDirectChildNames(block) {
     }
     return [...new Set(names)];
 }
+/** Source-set directories AGP defines itself, which never name a flavor. */
+const SHARED_SOURCE_SETS = new Set(["main", "test", "androidTest", "testFixtures"]);
+/** `testProd` and `androidTestProd` are `prod`'s test source sets, not flavors. */
+const TEST_SOURCE_SET_PREFIXES = ["test", "androidTest"];
 /**
- * Detects build types and product flavors from Gradle files by static parsing.
+ * What a source set holds. A directory under `src/` carrying none of these is
+ * something a human left there, not a source set AGP would read.
+ */
+const SOURCE_SET_CONTENTS = new Set([
+    "java",
+    "kotlin",
+    "res",
+    "resources",
+    "assets",
+    "aidl",
+    "jni",
+    "jniLibs",
+    "rs",
+    "renderscript",
+    "shaders",
+    "ml",
+    "baselineProfiles",
+    "AndroidManifest.xml",
+    "google-services.json",
+]);
+function safeReaddir(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true }).map((e) => ({
+            name: e.name,
+            isDirectory: e.isDirectory(),
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+/** `testProd` starts with the segment `test`; a flavor called `testing` does not. */
+function startsWithSegment(name, segment) {
+    if (!name.startsWith(segment) || name.length === segment.length)
+        return false;
+    const next = name[segment.length];
+    return next === next.toUpperCase() && next !== next.toLowerCase();
+}
+/** `ciDynamicDebug` ends with the segment `debug`; `staging` does not. */
+function endsWithSegment(name, segment) {
+    const capitalized = segment.charAt(0).toUpperCase() + segment.slice(1);
+    return name.length > capitalized.length && name.endsWith(capitalized);
+}
+/**
+ * Product flavors read from the source sets a module has on disk.
+ *
+ * Modern Android declares its flavors in a convention plugin — an enum in
+ * Kotlin source, applied through `create(flavor.name)` — so there is no
+ * literal `productFlavors { … }` block anywhere to parse. The scan is static
+ * by design (running a Gradle configuration phase to list flavors would cost
+ * minutes on every `ci build`), so the evidence has to be something already on
+ * disk. A flavor has a source set, which is the same evidence `invarn setup`
+ * has always resolved `google-services.json` by.
+ *
+ * A directory under `<module>/src/` names a flavor when it is none of the
+ * things AGP creates for its own reasons: the shared and test source sets, a
+ * build type, a test source set for one flavor, or a variant — a flavor and a
+ * build type already joined, which taking for a flavor would cross with the
+ * build types a second time and offer `ciDynamicDebugDebug`.
+ */
+function flavorsFromSourceSets(gradleFiles, buildTypes) {
+    const found = new Set();
+    for (const filePath of gradleFiles) {
+        const srcDir = join(dirname(filePath), "src");
+        for (const entry of safeReaddir(srcDir)) {
+            if (!entry.isDirectory)
+                continue;
+            const name = entry.name;
+            if (SHARED_SOURCE_SETS.has(name))
+                continue;
+            if (buildTypes.includes(name))
+                continue;
+            if (TEST_SOURCE_SET_PREFIXES.some((p) => startsWithSegment(name, p)))
+                continue;
+            if (buildTypes.some((bt) => endsWithSegment(name, bt)))
+                continue;
+            const holds = safeReaddir(join(srcDir, name));
+            if (!holds.some((child) => SOURCE_SET_CONTENTS.has(child.name)))
+                continue;
+            found.add(name);
+        }
+    }
+    // The filesystem's order is not a declaration order, so give it one.
+    return Array.from(found).sort();
+}
+/**
+ * Detects build types and product flavors from Gradle files by static parsing,
+ * falling back to the module's source sets for the flavors when no Gradle file
+ * declares any (see `flavorsFromSourceSets`).
+ *
  * Always includes "debug" and "release" as defaults.
+ *
+ * The fallback only ever runs when the literal scan found nothing, so a
+ * project whose Gradle files declare flavors is decided by those files exactly
+ * as before. Merging the two would let a leftover directory invent a flavor
+ * the build does not have.
  */
 export function detectBuildVariants(gradleFiles) {
     const buildTypeSet = new Set(["debug", "release"]);
@@ -678,7 +776,9 @@ export function detectBuildVariants(gradleFiles) {
         }
     }
     const buildTypes = Array.from(buildTypeSet);
-    const productFlavors = Array.from(productFlavorSet);
+    const productFlavors = productFlavorSet.size > 0
+        ? Array.from(productFlavorSet)
+        : flavorsFromSourceSets(gradleFiles, buildTypes);
     const variants = productFlavors.length === 0
         ? buildTypes
         : productFlavors.flatMap((flavor) => buildTypes.map((bt) => `${flavor}${bt.charAt(0).toUpperCase()}${bt.slice(1)}`));

package/dist/src/commands/build.d.ts

@@ -139,20 +139,24 @@ export interface CredentialSlot {
  * genuinely release-only ones keep one slot however flavored the repository
  * is.
  *
- * A disagreement is declared under `CIBUILD_SW__<WORKFLOW>__<VAR>`: the name
- * `ci secrets upload` already encodes a workflow-scoped value under, that
- * `SecretsManager` already decodes, and that `EnvResolver` already resolves
- * for the workflow being run. Invarn's secret scopes have no workflow column,
- * but a flat key→value map carries a workflow perfectly well when the workflow
- * is part of the key.
+ * **The name never changes — the block it sits in does.** An agreed credential
+ * is declared once in `app.envs`; a disagreement is declared under the plain
+ * credential name in **each workflow's own `envs`**, which is where the YAML
+ * already says which workflow something belongs to. `EnvResolver` merges
+ * `app.envs` and then the running workflow's own, so `release`'s declaration is
+ * invisible to `primary` without anything being encoded.
  *
- * Every workflow gets a slot, not only the odd one out. The encoded name is
- * per workflow, so a workflow left without one would have neither a value nor
- * the declaration `file@1.0.0` refuses over.
+ * `CIBUILD_SW__<WORKFLOW>__<VAR>` is deliberately *not* used here. That prefix
+ * is the transport encoding `ci secrets upload` carries a workflow-scoped
+ * **value** under — Invarn's secret scopes have no workflow column, so the
+ * workflow travels in the key. A pipeline has structure instead, and spending
+ * the encoding there would be a second way to say what the block already says
+ * (Alex, 2026-09-10).
  *
- * The `file@` step's `var_name` stays unsuffixed either way. The decoding does
- * the mapping; a second naming convention in the step would be a second way to
- * say the same thing.
+ * Every workflow gets a slot, not only the odd one out: a workflow left without
+ * one would have neither a value nor the declaration `file@1.0.0` refuses over.
+ *
+ * The `file@` step's `var_name` is the same plain name either way.
  */
 export declare function credentialSlots(varName: string, discriminatorByWorkflow: Record<string, string | null | undefined>): CredentialSlot[];
 /** One group of workflows a credential's value is collected for, and what they share. */

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAMrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CASxF;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,SAAQ,GAAG,MAAM,CAInF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,SAAQ,GACb,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,iDAAkD,CAAC;AAWnF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAM/B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GACjE,cAAc,EAAE,CAOlB;AAgBD,yFAAyF;AACzF,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/C,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,MAAM,GAC5D,eAAe,EAAE,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC7C,eAAe,EAAE,CAInB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,GACvB,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,CAAC,CAoBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAmS,EAC1S,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAiSR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAMrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CASxF;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,SAAQ,GAAG,MAAM,CAInF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,SAAQ,GACb,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,iDAAkD,CAAC;AAWnF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAM/B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GACjE,cAAc,EAAE,CAOlB;AAgBD,yFAAyF;AACzF,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/C,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,MAAM,GAC5D,eAAe,EAAE,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC7C,eAAe,EAAE,CAInB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,GACvB,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,CAAC,CAoBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAmS,EAC1S,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAyTR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}