@svp-labs/talos 0.0.0 → 0.1.1

package/dist/govern/plan.js

@@ -0,0 +1,166 @@
+import { installationSteps } from './installations.js';
+import { CALLER_PATH, CODEOWNERS_PATHS, MERGE_QUEUE_RULESET, OWNER_REVIEW_RULESET, } from './state.js';
+import { change, manual, ok, rulesetStep } from './steps.js';
+import { isChannel } from './templates.js';
+import { oldKitCallers } from '../adopt/scaffold.js';
+export class GovernRefusal extends Error {
+    name = 'GovernRefusal';
+}
+/** The settings every governed repository has: rebase merges only, through auto-merge. */
+const SETTINGS = {
+    allow_rebase_merge: true,
+    allow_squash_merge: false,
+    allow_merge_commit: false,
+    allow_auto_merge: true,
+    delete_branch_on_merge: true,
+    pull_request_creation_policy: 'collaborators_only',
+};
+const SETTING_KEYS = [
+    'allow_rebase_merge',
+    'allow_squash_merge',
+    'allow_merge_commit',
+    'allow_auto_merge',
+    'delete_branch_on_merge',
+    'pull_request_creation_policy',
+];
+export function codeownersText(template, owner) {
+    return template.replaceAll('@OWNER', `@${owner}`);
+}
+/** The channel the repository ends at: the one asked for, the one it has, or `evaluate`. */
+export function targetChannel(state, request) {
+    const current = state.properties.talos ?? undefined;
+    if (request.channel !== undefined) {
+        if (!isChannel(current)) {
+            throw new GovernRefusal('a repository comes in at evaluate: run `talos govern` without --channel first');
+        }
+        return request.channel;
+    }
+    return isChannel(current) ? current : 'evaluate';
+}
+function hasOwnRulesets(state) {
+    return state.rulesets.some((r) => r.name === MERGE_QUEUE_RULESET || r.name === OWNER_REVIEW_RULESET);
+}
+function fileChanges(state, request) {
+    const additions = [];
+    if (state.caller !== request.caller) {
+        additions.push({ path: CALLER_PATH, contents: request.caller });
+    }
+    const owners = codeownersText(request.codeowners, request.owner);
+    if (state.codeowners?.text !== owners) {
+        additions.push({ path: state.codeowners?.path ?? CODEOWNERS_PATHS[0] ?? '', contents: owners });
+    }
+    for (const [path, contents] of Object.entries(request.seed ?? {})) {
+        if (state.extra[path] === undefined)
+            additions.push({ path, contents });
+    }
+    const deletions = oldKitCallers(state.workflows).filter((path) => path !== CALLER_PATH);
+    return { additions, deletions };
+}
+/**
+ * The caller and CODEOWNERS go straight onto the default branch, before any ruleset exists: no
+ * App may write a workflow file, and a PR's own caller never runs on that PR. Once the rulesets
+ * exist, the branch takes no direct commit, so a difference then is a PR for the owner to open.
+ */
+function filesStep(state, request, channel) {
+    const { additions, deletions } = fileChanges(state, request);
+    const branch = state.defaultBranch;
+    if (additions.length === 0 && deletions.length === 0) {
+        return ok('files', `the caller and CODEOWNERS are on ${branch}`);
+    }
+    const paths = [...additions.map((a) => a.path), ...deletions];
+    if (hasOwnRulesets(state) || channel !== 'evaluate') {
+        return manual('files', `${paths.join(', ')} differ from Talos's; ${branch} takes no direct commit once it is ` +
+            'governed, so change them through a PR');
+    }
+    const removed = deletions.length > 0 ? `, delete ${deletions.length} old-kit caller(s)` : '';
+    return change('files', `commit ${additions.map((a) => a.path).join(', ')}${removed}`, {
+        kind: 'commit',
+        repo: state.repo,
+        changes: {
+            branch,
+            expectedHead: state.head,
+            message: 'Govern the repository with Talos\n\nThe caller workflow and CODEOWNERS.',
+            additions,
+            deletions,
+        },
+    });
+}
+function settingsSteps(state) {
+    const steps = [];
+    const body = {};
+    for (const key of SETTING_KEYS) {
+        const current = state.settings[key];
+        if (key === 'pull_request_creation_policy' && current === undefined) {
+            steps.push(manual('pull-requests', 'restrict pull request creation to collaborators: Settings → General → Pull Requests'));
+            continue;
+        }
+        if (current !== SETTINGS[key])
+            body[key] = SETTINGS[key];
+    }
+    const keys = Object.keys(body);
+    steps.unshift(keys.length === 0
+        ? ok('settings', 'rebase-only merges, auto-merge, PRs from collaborators only')
+        : change('settings', `set ${keys.join(', ')}`, {
+            kind: 'patch-repo',
+            repo: state.repo,
+            body,
+        }));
+    steps.push(manual('issues', 'restrict issue creation to collaborators: Settings → General → Features → Issues ' +
+        "(GitHub's API has no field for it)"));
+    return steps;
+}
+function repoRuleset(state, desired) {
+    const current = state.rulesets.find((ruleset) => ruleset.name === desired.name);
+    return rulesetStep({ kind: 'repo', repo: state.repo }, current, desired);
+}
+function propertiesStep(state, request, channel) {
+    const agents = request.agents === undefined
+        ? (state.properties['talos-agents'] ?? 'false')
+        : String(request.agents);
+    const wanted = { talos: channel, 'talos-agents': agents };
+    const values = Object.entries(wanted)
+        .filter(([name, value]) => state.properties[name] !== value)
+        .map(([name, value]) => ({ property_name: name, value }));
+    const detail = `talos=${channel}, talos-agents=${agents}`;
+    if (values.length === 0)
+        return ok('properties', detail);
+    return change('properties', `set ${detail}`, {
+        kind: 'set-properties',
+        repo: state.repo,
+        values,
+    });
+}
+/**
+ * Everything `talos govern` would do to a repository, in the order it must happen: the files
+ * before any ruleset, the property before the owner's review rule goes, so a repository moving
+ * to a channel is never without an approval gate.
+ */
+export function governPlan(state, request) {
+    const channel = targetChannel(state, request);
+    const ownerReview = state.rulesets.find((r) => r.name === OWNER_REVIEW_RULESET);
+    const atEvaluate = channel === 'evaluate';
+    return [
+        filesStep(state, request, channel),
+        ...settingsSteps(state),
+        repoRuleset(state, request.templates.mergeQueue),
+        ...(atEvaluate ? [repoRuleset(state, request.templates.ownerReview)] : []),
+        state.alerts
+            ? ok('alerts', 'Dependabot alerts are on')
+            : change('alerts', 'switch on Dependabot alerts', {
+                kind: 'enable-alerts',
+                repo: state.repo,
+            }),
+        propertiesStep(state, request, channel),
+        ...(!atEvaluate && ownerReview !== undefined
+            ? [
+                change(`ruleset:${OWNER_REVIEW_RULESET}`, `delete ${OWNER_REVIEW_RULESET}`, {
+                    kind: 'delete-ruleset',
+                    scope: { kind: 'repo', repo: state.repo },
+                    id: ownerReview.id,
+                }),
+            ]
+            : []),
+        ...installationSteps(state.installations, { id: state.id, name: state.repo }),
+    ];
+}
+//# sourceMappingURL=plan.js.map

package/dist/govern/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/govern/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GAGrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAa,MAAM,YAAY,CAAC;AACxE,OAAO,EAAgB,SAAS,EAAoC,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAmBrD,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;CAC1C;AAID,0FAA0F;AAC1F,MAAM,QAAQ,GAAmD;IAC/D,kBAAkB,EAAE,IAAI;IACxB,kBAAkB,EAAE,KAAK;IACzB,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,IAAI;IACtB,sBAAsB,EAAE,IAAI;IAC5B,4BAA4B,EAAE,oBAAoB;CACnD,CAAC;AAEF,MAAM,YAAY,GAA0B;IAC1C,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,kBAAkB;IAClB,wBAAwB;IACxB,8BAA8B;CAC/B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAC5D,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,KAAgB,EAAE,OAAsB;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC;IACpD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CACrB,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,CACzE,CAAC;AACJ,CAAC;AAID,SAAS,WAAW,CAClB,KAAgB,EAChB,OAAsB;IAEtB,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IACxF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAgB,EAAE,OAAsB,EAAE,OAAgB;IAC3E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;IACnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,OAAO,EAAE,oCAAoC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QACpD,OAAO,MAAM,CACX,OAAO,EACP,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,qCAAqC;YACrF,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,OAAO,EAAE,UAAU,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,EAAE;QACpF,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE;YACP,MAAM;YACN,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,OAAO,EAAE,yEAAyE;YAClF,SAAS;YACT,SAAS;SACV;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,IAAI,GAAqC,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,8BAA8B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACpE,KAAK,CAAC,IAAI,CACR,MAAM,CACJ,eAAe,EACf,qFAAqF,CACtF,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,CAAC,OAAO,CACX,IAAI,CAAC,MAAM,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,6DAA6D,CAAC;QAC/E,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YAC3C,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI;SACL,CAAC,CACP,CAAC;IACF,KAAK,CAAC,IAAI,CACR,MAAM,CACJ,QAAQ,EACR,mFAAmF;QACjF,oCAAoC,CACvC,CACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAgB,EAAE,OAAoB;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB,EAAE,OAAsB,EAAE,OAAgB;IAChF,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,OAAO,kBAAkB,MAAM,EAAE,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,YAAY,EAAE,OAAO,MAAM,EAAE,EAAE;QAC3C,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,OAAsB;IACjE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,OAAO,KAAK,UAAU,CAAC;IAC1C,OAAO;QACL,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,GAAG,aAAa,CAAC,KAAK,CAAC;QACvB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;QAChD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,MAAM;YACV,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,0BAA0B,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,6BAA6B,EAAE;gBAC9C,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC;QACN,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QACvC,GAAG,CAAC,CAAC,UAAU,IAAI,WAAW,KAAK,SAAS;YAC1C,CAAC,CAAC;gBACE,MAAM,CAAC,WAAW,oBAAoB,EAAE,EAAE,UAAU,oBAAoB,EAAE,EAAE;oBAC1E,IAAI,EAAE,gBAAgB;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;oBACzC,EAAE,EAAE,WAAW,CAAC,EAAE;iBACnB,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/govern/rulesets-api.js

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+const summarySchema = z.object({
+    id: z.number().int(),
+    name: z.string(),
+    source_type: z.string().optional(),
+});
+const detailSchema = z.looseObject({
+    id: z.number().int(),
+    name: z.string(),
+    enforcement: z.string(),
+    rules: z.array(z.object({ type: z.string(), parameters: z.unknown().optional() })).default([]),
+});
+function basePath(scope) {
+    return scope.kind === 'repo'
+        ? `repos/${scope.repo}/rulesets`
+        : `orgs/${encodeURIComponent(scope.org)}/rulesets`;
+}
+/**
+ * The scope's own rulesets among `names`, read in full. A repository's listing leaves out the
+ * organisation's rulesets, which only `talos org` manages.
+ */
+export async function readRulesets(gh, scope, names) {
+    const list = scope.kind === 'repo' ? `${basePath(scope)}?includes_parents=false` : basePath(scope);
+    const summaries = z.array(summarySchema).parse(await gh.paginate(list));
+    const own = summaries.filter((summary) => names.includes(summary.name) &&
+        (scope.kind === 'org' || (summary.source_type ?? 'Repository') === 'Repository'));
+    return Promise.all(own.map(async (summary) => detailSchema.parse(await gh.request('GET', `${basePath(scope)}/${summary.id}`))));
+}
+export async function createRuleset(gh, scope, body) {
+    const created = await gh.request('POST', basePath(scope), { body });
+    return z.object({ id: z.number().int() }).parse(created).id;
+}
+export async function updateRuleset(gh, scope, id, body) {
+    await gh.request('PUT', `${basePath(scope)}/${id}`, { body });
+}
+export async function deleteRuleset(gh, scope, id) {
+    await gh.request('DELETE', `${basePath(scope)}/${id}`, { allowMissing: true });
+}
+//# sourceMappingURL=rulesets-api.js.map

package/dist/govern/rulesets-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesets-api.js","sourceRoot":"","sources":["../../src/govern/rulesets-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/F,CAAC,CAAC;AAKH,SAAS,QAAQ,CAAC,KAAmB;IACnC,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM;QAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,WAAW;QAChC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAU,EACV,KAAmB,EACnB,KAAwB;IAExB,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAU,IAAI,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAC1B,CAAC,OAAO,EAAE,EAAE,CACV,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,KAAK,YAAY,CAAC,CACnF,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACxB,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CACzF,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,KAAmB,EACnB,IAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,KAAmB,EACnB,EAAU,EACV,IAAiB;IAEjB,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU,EAAE,KAAmB,EAAE,EAAU;IAC7E,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/govern/state.js

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+import { readInstallations } from './installations.js';
+import { readRulesets } from './rulesets-api.js';
+import { GitHubError } from '../github/api.js';
+import { readFileAt } from '../github/contents.js';
+import { propertyValuesSchema } from '../github/repos.js';
+/** Where the caller lives in every governed repository. */
+export const CALLER_PATH = '.github/workflows/talos.yml';
+/** Where GitHub looks for CODEOWNERS, in its order. */
+export const CODEOWNERS_PATHS = [
+    '.github/CODEOWNERS',
+    'CODEOWNERS',
+    'docs/CODEOWNERS',
+];
+export const MERGE_QUEUE_RULESET = 'talos-merge-queue';
+export const OWNER_REVIEW_RULESET = 'talos-owner-review';
+const repositorySchema = z.object({
+    id: z.number().int(),
+    default_branch: z.string().min(1),
+    allow_rebase_merge: z.boolean().optional(),
+    allow_squash_merge: z.boolean().optional(),
+    allow_merge_commit: z.boolean().optional(),
+    allow_auto_merge: z.boolean().optional(),
+    delete_branch_on_merge: z.boolean().optional(),
+    pull_request_creation_policy: z.string().optional(),
+});
+const refSchema = z.object({ object: z.object({ sha: z.string() }) });
+const listingSchema = z.array(z.object({ path: z.string(), type: z.string() }));
+async function workflowFiles(gh, repo, ref) {
+    const raw = await gh.request('GET', `repos/${repo}/contents/.github/workflows?ref=${encodeURIComponent(ref)}`, { allowMissing: true });
+    if (raw === undefined)
+        return [];
+    const parsed = listingSchema.safeParse(raw);
+    if (!parsed.success)
+        return [];
+    const files = parsed.data.filter((entry) => entry.type === 'file').slice(0, 100);
+    const texts = await Promise.all(files.map((f) => readFileAt(gh, repo, f.path, ref)));
+    return files.flatMap((file, index) => {
+        const text = texts[index];
+        return text === undefined ? [] : [{ path: file.path, text }];
+    });
+}
+async function codeowners(gh, repo, ref) {
+    for (const path of CODEOWNERS_PATHS) {
+        const text = await readFileAt(gh, repo, path, ref);
+        if (text !== undefined)
+            return { path, text };
+    }
+    return undefined;
+}
+/** Dependabot alerts: 204 when on, 404 when off. */
+async function alertsOn(gh, repo) {
+    try {
+        await gh.request('GET', `repos/${repo}/vulnerability-alerts`);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof GitHubError && error.status === 404)
+            return false;
+        throw error;
+    }
+}
+async function propertyValues(gh, repo) {
+    const raw = await gh.request('GET', `repos/${repo}/properties/values`);
+    const values = {};
+    for (const entry of propertyValuesSchema.parse(raw)) {
+        values[entry.property_name] = Array.isArray(entry.value) ? entry.value.join(',') : entry.value;
+    }
+    return values;
+}
+/**
+ * Everything `talos govern` compares with what it would set. The owner's token reads it all; a
+ * token with `administration: read` on the repository reads everything but the installations.
+ */
+export async function readRepoState(gh, repo, who, options = {}) {
+    const extraPaths = options.extraPaths ?? [];
+    const raw = repositorySchema.parse(await gh.request('GET', `repos/${repo}`));
+    const { id, default_branch: defaultBranch, ...settings } = raw;
+    const ref = await gh.request('GET', `repos/${repo}/git/ref/heads/${defaultBranch.split('/').map(encodeURIComponent).join('/')}`);
+    const head = refSchema.parse(ref).object.sha;
+    const [caller, owners, workflows, extras, rulesets, alerts, properties, installations] = await Promise.all([
+        readFileAt(gh, repo, CALLER_PATH, head),
+        codeowners(gh, repo, head),
+        workflowFiles(gh, repo, head),
+        Promise.all(extraPaths.map((path) => readFileAt(gh, repo, path, head))),
+        readRulesets(gh, { kind: 'repo', repo }, [MERGE_QUEUE_RULESET, OWNER_REVIEW_RULESET]),
+        alertsOn(gh, repo),
+        propertyValues(gh, repo),
+        options.installations === false ? [] : readInstallations(gh, who, id),
+    ]);
+    const extra = Object.fromEntries(extraPaths.map((path, index) => [path, extras[index]]));
+    return {
+        repo,
+        id,
+        defaultBranch,
+        head,
+        settings,
+        caller,
+        codeowners: owners,
+        workflows,
+        extra,
+        rulesets,
+        alerts,
+        properties,
+        installations,
+    };
+}
+//# sourceMappingURL=state.js.map

package/dist/govern/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/govern/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA0B,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAoB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAe,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAEzD,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,oBAAoB;IACpB,YAAY;IACZ,iBAAiB;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9C,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAsBH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF,KAAK,UAAU,aAAa,CAC1B,EAAU,EACV,IAAY,EACZ,GAAW;IAEX,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,KAAK,EACL,SAAS,IAAI,mCAAmC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EACzE,EAAE,YAAY,EAAE,IAAI,EAAE,CACvB,CAAC;IACF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,GAAW;IAC7D,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,uBAAuB,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACvE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,oBAAoB,CAAC,CAAC;IAChF,MAAM,MAAM,GAAkC,EAAE,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,IAAY,EACZ,GAAe,EACf,UAAuB,EAAE;IAEzB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,KAAK,EACL,SAAS,IAAI,kBAAkB,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,GACpF,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC;QACvC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC;QAC1B,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;QACrF,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAClB,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC;QACxB,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACtE,CAAC,CAAC;IACL,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO;QACL,IAAI;QACJ,EAAE;QACF,aAAa;QACb,IAAI;QACJ,QAAQ;QACR,MAAM;QACN,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,KAAK;QACL,QAAQ;QACR,MAAM;QACN,UAAU;QACV,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/govern/steps.js

@@ -0,0 +1,143 @@
+import { commitFiles } from './commit.js';
+import { rulesetMatches } from './compare.js';
+import { createRuleset, deleteRuleset, updateRuleset, } from './rulesets-api.js';
+import { GitHubError } from '../github/api.js';
+export function ok(id, detail) {
+    return { id, status: 'ok', detail };
+}
+export function change(id, detail, effect, refused) {
+    return { id, status: 'change', detail, effect, ...(refused === undefined ? {} : { refused }) };
+}
+export function manual(id, detail) {
+    return { id, status: 'manual', detail };
+}
+/** Creates a ruleset that is missing, updates one that differs, and leaves a right one alone. */
+export function rulesetStep(scope, current, desired) {
+    const id = `ruleset:${desired.name}`;
+    if (current === undefined) {
+        return change(id, `create ${desired.name}`, { kind: 'create-ruleset', scope, body: desired });
+    }
+    if (rulesetMatches(current, desired))
+        return ok(id, `${desired.name} is as Talos sets it`);
+    return change(id, `update ${desired.name}`, {
+        kind: 'update-ruleset',
+        scope,
+        id: current.id,
+        body: desired,
+    });
+}
+async function run(gh, effect) {
+    switch (effect.kind) {
+        case 'commit': {
+            await commitFiles(gh, effect.repo, effect.changes);
+            return;
+        }
+        case 'patch-repo': {
+            await gh.request('PATCH', `repos/${effect.repo}`, { body: effect.body });
+            return;
+        }
+        case 'create-ruleset': {
+            await createRuleset(gh, effect.scope, effect.body);
+            return;
+        }
+        case 'update-ruleset': {
+            await updateRuleset(gh, effect.scope, effect.id, effect.body);
+            return;
+        }
+        case 'delete-ruleset': {
+            await deleteRuleset(gh, effect.scope, effect.id);
+            return;
+        }
+        default: {
+            await runSetting(gh, effect);
+        }
+    }
+}
+async function runSetting(gh, effect) {
+    switch (effect.kind) {
+        case 'enable-alerts': {
+            await gh.request('PUT', `repos/${effect.repo}/vulnerability-alerts`);
+            return;
+        }
+        case 'set-properties': {
+            await gh.request('PATCH', `repos/${effect.repo}/properties/values`, {
+                body: { properties: effect.values },
+            });
+            return;
+        }
+        case 'define-property': {
+            const path = `orgs/${encodeURIComponent(effect.org)}/properties/schema/${effect.name}`;
+            await gh.request('PUT', path, { body: effect.body });
+            return;
+        }
+        case 'install': {
+            const path = `user/installations/${effect.installationId}/repositories/${effect.repositoryId}`;
+            await gh.request('PUT', path);
+            return;
+        }
+    }
+}
+/**
+ * What to say about a failed step: the request, its status and GitHub's clipped reason, never the
+ * raw response body. Steps run only from an owner's own terminal, never a public log.
+ */
+function failure(step, error, hint) {
+    if (error instanceof GitHubError) {
+        const reason = error.reason === undefined ? '' : ` (${error.reason})`;
+        return `${step.detail}: ${error.message}${reason}${hint(error.status)}`;
+    }
+    return `${step.detail}: ${error instanceof Error ? error.message : String(error)}`;
+}
+/**
+ * Carries out every `change` in order. The order usually matters (the caller must be on the
+ * default branch before any ruleset blocks a direct commit), so the first failure stops the rest,
+ * unless the steps are `independent`: then each runs and each failure is reported. A change
+ * GitHub refuses that a person can still make by hand is reported as that manual step instead.
+ */
+export async function applySteps(gh, steps, options = {}) {
+    const hint = options.hint ?? (() => '');
+    const results = [];
+    let failed = false;
+    for (const step of steps) {
+        if (step.status !== 'change') {
+            results.push({ id: step.id, status: step.status, detail: step.detail });
+            continue;
+        }
+        if (failed && options.independent !== true) {
+            results.push({ id: step.id, status: 'skipped', detail: step.detail });
+            continue;
+        }
+        try {
+            await run(gh, step.effect);
+            results.push({ id: step.id, status: 'changed', detail: step.detail });
+        }
+        catch (error) {
+            if (step.refused !== undefined && error instanceof GitHubError && error.status === 403) {
+                results.push({ id: step.id, status: 'manual', detail: step.refused });
+                continue;
+            }
+            failed = true;
+            results.push({ id: step.id, status: 'failed', detail: failure(step, error, hint) });
+        }
+    }
+    return results;
+}
+/** The plan as results, for `--dry-run`: changes are `planned`, nothing is touched. */
+export function planned(steps) {
+    return steps.map((step) => ({
+        id: step.id,
+        status: step.status === 'change' ? 'planned' : step.status,
+        detail: step.detail,
+    }));
+}
+/** A hint for a refused request: which scopes the owner's `gh` login may lack. */
+export function scopeHint(status) {
+    if (status === 403 || status === 404) {
+        return ' (run `gh auth refresh -s admin:org,workflow` and check you are an owner of the org)';
+    }
+    // GraphQL reports a refusal inside a 200; the only GraphQL call is the commit of the caller.
+    return status === 200
+        ? ' (writing a workflow file needs the workflow scope: gh auth refresh -s workflow)'
+        : '';
+}
+//# sourceMappingURL=steps.js.map

package/dist/govern/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../src/govern/steps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAoB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,aAAa,EAGb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAe,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgD5D,MAAM,UAAU,EAAE,CAAC,EAAU,EAAE,MAAc;IAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,EAAU,EAAE,MAAc,EAAE,MAAc,EAAE,OAAgB;IACjF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,EAAU,EAAE,MAAc;IAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CACzB,KAAmB,EACnB,OAAgC,EAChC,OAAoB;IAEpB,MAAM,EAAE,GAAG,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,EAAE,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,sBAAsB,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,EAAE,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,EAAE;QAC1C,IAAI,EAAE,gBAAgB;QACtB,KAAK;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,EAAU,EAAE,MAAc;IAC3C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,EAAU,EACV,MAGC;IAED,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,MAAM,CAAC,IAAI,uBAAuB,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,oBAAoB,EAAE;gBAClE,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,QAAQ,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC;YACvF,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,sBAAsB,MAAM,CAAC,cAAc,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/F,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,SAAS,OAAO,CAAC,IAAU,EAAE,KAAc,EAAE,IAAgC;IAC3E,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QACtE,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrF,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,KAAsB,EACtB,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,KAAsB;IAC5C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;QAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,sFAAsF,CAAC;IAChG,CAAC;IACD,6FAA6F;IAC7F,OAAO,MAAM,KAAK,GAAG;QACnB,CAAC,CAAC,kFAAkF;QACpF,CAAC,CAAC,EAAE,CAAC;AACT,CAAC"}

package/dist/govern/templates.js

@@ -0,0 +1,140 @@
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import { workflowReferenceSchema } from '../github/rulesets.js';
+import { assetsDir } from '../version/self.js';
+/**
+ * The rulesets Talos creates, kept as JSON templates under `assets/rulesets/`. Each API body is
+ * built from its template by a pure function that fills in only what differs per organisation
+ * (repository and App ids) or per channel (name, enforcement, pin).
+ */
+const bypassActorSchema = z.strictObject({
+    actor_id: z.number().int().nullable().optional(),
+    actor_type: z.enum(['Integration', 'OrganizationAdmin', 'RepositoryRole', 'Team', 'User']),
+    bypass_mode: z.enum(['always', 'pull_request', 'exempt']),
+});
+const ruleSchema = z.strictObject({
+    type: z.string().min(1),
+    parameters: z.record(z.string(), z.unknown()).optional(),
+});
+const refNameSchema = z.strictObject({
+    include: z.array(z.string()),
+    exclude: z.array(z.string()),
+});
+const propertySpecSchema = z.strictObject({
+    name: z.string(),
+    property_values: z.array(z.string()),
+});
+const conditionsSchema = z.strictObject({
+    ref_name: refNameSchema,
+    repository_property: z
+        .strictObject({ include: z.array(propertySpecSchema), exclude: z.array(propertySpecSchema) })
+        .optional(),
+});
+const rulesetBodySchema = z.strictObject({
+    name: z.string().min(1),
+    target: z.enum(['branch', 'tag', 'push']),
+    enforcement: z.enum(['disabled', 'active', 'evaluate']),
+    bypass_actors: z.array(bypassActorSchema),
+    conditions: conditionsSchema,
+    rules: z.array(ruleSchema).min(1),
+});
+export function parseTemplate(name, text) {
+    const parsed = rulesetBodySchema.safeParse(JSON.parse(text));
+    if (!parsed.success) {
+        throw new Error(`assets/rulesets/${name}.json is invalid:\n${z.prettifyError(parsed.error)}`);
+    }
+    return parsed.data;
+}
+/** Every ruleset template Talos ships, validated. */
+export async function loadTemplates(dir = assetsDir()) {
+    const load = async (name) => parseTemplate(name, await readFile(new URL(`rulesets/${name}.json`, dir), 'utf8'));
+    const [mergeQueue, ownerReview, channel, releaseTags, channelsBranch, selfTest] = await Promise.all([
+        load('merge-queue'),
+        load('owner-review'),
+        load('channel'),
+        load('release-tags'),
+        load('channels-branch'),
+        load('self-test'),
+    ]);
+    return { mergeQueue, ownerReview, channel, releaseTags, channelsBranch, selfTest };
+}
+/** The channels a governed repository's `talos` property names, each with its org ruleset. */
+export const CHANNELS = ['evaluate', 'canary', 'stable'];
+const CHANNEL_NAMES = new Set(CHANNELS);
+export function isChannel(value) {
+    return value !== undefined && CHANNEL_NAMES.has(value);
+}
+export function channelRulesetName(channel) {
+    return `talos-${channel}`;
+}
+const workflowRefSchema = workflowReferenceSchema;
+const workflowsParameters = z.object({ workflows: z.array(workflowRefSchema).min(1) });
+const statusChecksParameters = z.object({
+    strict_required_status_checks_policy: z.boolean(),
+    required_status_checks: z
+        .array(z.object({ context: z.string(), integration_id: z.number().int().optional() }))
+        .min(1),
+});
+function pinRule(rule, sha, ids) {
+    if (rule.type === 'workflows') {
+        const parameters = workflowsParameters.parse(rule.parameters);
+        const workflows = parameters.workflows.map((w) => ({
+            path: w.path,
+            repository_id: ids.talosRepositoryId,
+            sha,
+        }));
+        return { type: rule.type, parameters: { ...parameters, workflows } };
+    }
+    if (rule.type === 'required_status_checks') {
+        const parameters = statusChecksParameters.parse(rule.parameters);
+        const checks = parameters.required_status_checks.map((check) => ({
+            context: check.context,
+            integration_id: ids.reviewerAppId,
+        }));
+        return { type: rule.type, parameters: { ...parameters, required_status_checks: checks } };
+    }
+    return rule;
+}
+/**
+ * One of the three org rulesets: it runs the gate pinned at `sha` and requires `talos/review`
+ * from the reviewer App, on the default branch of every repository whose `talos` property names
+ * the channel. `talos-evaluate` is in Evaluate mode as a whole, so it blocks nothing.
+ */
+export function channelRuleset(template, channel, sha, ids) {
+    const property = template.conditions.repository_property;
+    if (property === undefined)
+        throw new Error('the channel template targets no property');
+    return {
+        ...template,
+        name: channelRulesetName(channel),
+        enforcement: channel === 'evaluate' ? 'evaluate' : 'active',
+        conditions: {
+            ...template.conditions,
+            repository_property: {
+                ...property,
+                include: property.include.map((spec) => ({ ...spec, property_values: [channel] })),
+            },
+        },
+        rules: template.rules.map((rule) => pinRule(rule, sha, ids)),
+    };
+}
+/** The pin a ruleset's `workflows` rule carries, or `undefined` when it has none. */
+export function pinOf(rules) {
+    for (const rule of rules) {
+        if (rule.type !== 'workflows')
+            continue;
+        const parsed = workflowsParameters.safeParse(rule.parameters);
+        const sha = parsed.success ? parsed.data.workflows[0]?.sha : undefined;
+        if (sha !== undefined && /^[0-9a-f]{40}$/.test(sha))
+            return sha;
+    }
+    return undefined;
+}
+/** The `channels` branch of the Talos repository: only `talos-release` may write it. */
+export function channelsBranchRuleset(template, releaseAppId) {
+    return {
+        ...template,
+        bypass_actors: template.bypass_actors.map((actor) => actor.actor_type === 'Integration' ? { ...actor, actor_id: releaseAppId } : actor),
+    };
+}
+//# sourceMappingURL=templates.js.map

package/dist/govern/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/govern/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;;GAIG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1F,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtC,QAAQ,EAAE,aAAa;IACvB,mBAAmB,EAAE,CAAC;SACnB,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;SAC5F,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACzC,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAwBH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,sBAAsB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAW,SAAS,EAAE;IACxD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAwB,EAAE,CACxD,aAAa,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,IAAI,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,GAC7E,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,IAAI,CAAC,aAAa,CAAC;QACnB,IAAI,CAAC,cAAc,CAAC;QACpB,IAAI,CAAC,SAAS,CAAC;QACf,IAAI,CAAC,cAAc,CAAC;QACpB,IAAI,CAAC,iBAAiB,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC;KAClB,CAAC,CAAC;IACL,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AACrF,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGlE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;AAE7D,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE;IACjD,sBAAsB,EAAE,CAAC;SACtB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACrF,GAAG,CAAC,CAAC,CAAC;CACV,CAAC,CAAC;AASH,SAAS,OAAO,CAAC,IAAU,EAAE,GAAW,EAAE,GAAe;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,aAAa,EAAE,GAAG,CAAC,iBAAiB;YACpC,GAAG;SACJ,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,GAAG,CAAC,aAAa;SAClC,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAqB,EACrB,OAAgB,EAChB,GAAW,EACX,GAAe;IAEf,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxF,OAAO;QACL,GAAG,QAAQ;QACX,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACjC,WAAW,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;QAC3D,UAAU,EAAE;YACV,GAAG,QAAQ,CAAC,UAAU;YACtB,mBAAmB,EAAE;gBACnB,GAAG,QAAQ;gBACX,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aACnF;SACF;QACD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,KAAK,CACnB,KAAwD;IAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,GAAG,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,QAAqB,EAAE,YAAoB;IAC/E,OAAO;QACL,GAAG,QAAQ;QACX,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAClD,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAClF;KACF,CAAC;AACJ,CAAC"}