@svp-labs/talos 0.0.0 → 0.1.1

package/bootstrap/launch.ts

@@ -0,0 +1,347 @@
+#!/usr/bin/env node
+/**
+ * Runs Talos at the release this checkout of the Talos repository is at, for workflows that have
+ * no Talos yet. The checkout is at the pinned commit; this reads its own `package.json` version,
+ * installs `@svp-labs/talos@<version>` with npm (no install scripts), has `npm audit signatures`
+ * verify the registry's signatures and attestations, refuses the package unless its SLSA
+ * provenance names the Talos repository, this checkout's HEAD and the installed tarball, then
+ * runs it with the given arguments and exits with its code.
+ *
+ * Dependency-free on purpose: nothing is installed before it runs, and Node runs this file as it
+ * is, stripping its types, so it holds only syntax that erases (no enums, namespaces or parameter
+ * properties). What it reads from npm and the registry is narrowed by hand, field by field. It
+ * prints nothing of its own but one generic line when it refuses, since npm's messages can name
+ * things a public log must not show. Neither npm nor git is looked up on PATH: npm is the one
+ * beside the running Node, and HEAD is read from the checkout's files.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+export const PACKAGE = '@svp-labs/talos';
+export const SOURCE = 'SVP-Labs/Talos';
+const PROVENANCE = 'https://slsa.dev/provenance/v1';
+const STATEMENT = 'https://in-toto.io/Statement/v1';
+const PAYLOAD = 'application/vnd.in-toto+json';
+const GITHUB = 'https://github.com/';
+const REGISTRY = 'https://registry.npmjs.org';
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const COMMIT = /^[0-9a-f]{40}$/;
+const SHA512 = 'sha512-';
+
+type Env = Readonly<Record<string, string | undefined>>;
+
+/** A parsed JSON object: any field may hold anything. */
+type JsonObject = Readonly<Record<string, unknown>>;
+
+/** The DSSE envelope of an attestation, as far as it has been checked. */
+type Envelope = { readonly payload: string; readonly payloadType?: unknown };
+
+type BuildDefinition = {
+  readonly resolvedDependencies: readonly unknown[];
+  readonly externalParameters: { readonly workflow: { readonly repository: string } };
+};
+
+/** The parts of an in-toto statement of SLSA provenance this reads, as far as it checks them. */
+type Statement = {
+  readonly subject: readonly unknown[];
+  readonly predicate: { readonly buildDefinition: BuildDefinition };
+};
+
+/** The build a release must come from. */
+type Expected = {
+  readonly name: string;
+  readonly version: string;
+  /** `owner/name`. */
+  readonly repository: string;
+  readonly commit: string;
+  /** The installed tarball's integrity, from the lockfile. */
+  readonly integrity: string;
+};
+
+type Release = { readonly version: string; readonly sha: string };
+
+/** How an npm run ended; its status and output are null when it never started. */
+type NpmRun = { readonly status: number | null; readonly stdout: string | null };
+
+export class Refusal extends Error {
+  override name = 'Refusal';
+}
+
+function isObject(value: unknown): value is JsonObject {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function isList(value: unknown): value is readonly unknown[] {
+  return Array.isArray(value);
+}
+
+/** A parsed JSON value's field, as `value?.[key]` reads it: undefined unless it is an object. */
+function field(value: unknown, key: string): unknown {
+  return isObject(value) ? value[key] : undefined;
+}
+
+/**
+ * A parsed JSON value in lower case, as `value?.toLowerCase()` reads it: undefined when there is
+ * none, and a throw when it is there but not a string.
+ */
+function lowerCase(value: unknown): string | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== 'string') throw new TypeError('expected a string');
+  return value.toLowerCase();
+}
+
+function isEnvelope(value: unknown): value is Envelope {
+  return isObject(value) && typeof value.payload === 'string';
+}
+
+/** The SHA-512 of a Subresource Integrity string as hex, or undefined. */
+export function integrityHex(integrity: unknown): string | undefined {
+  if (typeof integrity !== 'string') return undefined;
+  const parts = integrity.trim().split(/\s+/);
+  const base64 = parts.find((part) => part.startsWith(SHA512))?.slice(SHA512.length);
+  const bytes = base64 === undefined ? undefined : Buffer.from(base64, 'base64');
+  return bytes?.length === 64 ? bytes.toString('hex') : undefined;
+}
+
+export function packageUrl(name: string, version: string): string {
+  return `pkg:npm/${name.replace(/^@/, '%40')}@${version}`;
+}
+
+function provenanceEnvelope(response: unknown): Envelope {
+  const attestations = field(response, 'attestations');
+  if (!isList(attestations)) throw new Refusal('the registry returned no attestations');
+  const provenance = attestations.filter((a) => field(a, 'predicateType') === PROVENANCE);
+  const envelope =
+    provenance.length === 1 ? field(field(provenance[0], 'bundle'), 'dsseEnvelope') : undefined;
+  if (!isEnvelope(envelope)) {
+    throw new Refusal(`expected one SLSA provenance attestation, found ${provenance.length}`);
+  }
+  if (envelope.payloadType !== PAYLOAD) throw new Refusal('the provenance is not in-toto');
+  return envelope;
+}
+
+function isProvenanceStatement(statement: unknown): statement is Statement {
+  const definition = field(field(statement, 'predicate'), 'buildDefinition');
+  const workflow = field(field(definition, 'externalParameters'), 'workflow');
+  return (
+    isObject(statement) &&
+    statement._type === STATEMENT &&
+    statement.predicateType === PROVENANCE &&
+    isList(statement.subject) &&
+    isList(field(definition, 'resolvedDependencies')) &&
+    typeof field(workflow, 'repository') === 'string'
+  );
+}
+
+/** The in-toto statement of the SLSA provenance among npm's attestations for a version. */
+export function readStatement(response: unknown): Statement {
+  const envelope = provenanceEnvelope(response);
+  let statement: unknown;
+  try {
+    statement = JSON.parse(Buffer.from(envelope.payload, 'base64').toString('utf8'));
+  } catch {
+    throw new Refusal('the provenance payload is not JSON');
+  }
+  if (!isProvenanceStatement(statement)) {
+    throw new Refusal('the provenance is not an in-toto statement of SLSA provenance v1');
+  }
+  return statement;
+}
+
+function sourceCommit(definition: BuildDefinition): string | undefined {
+  const prefix = `git+${definition.externalParameters.workflow.repository}@`.toLowerCase();
+  const source = definition.resolvedDependencies.find((d) => {
+    const uri = field(d, 'uri');
+    return typeof uri === 'string' && uri.toLowerCase().startsWith(prefix);
+  });
+  const commit = field(field(source, 'digest'), 'gitCommit');
+  return typeof commit === 'string' ? commit : undefined;
+}
+
+/** Every way a statement fails to describe the expected build; empty when it matches. */
+export function provenanceProblems(statement: Statement, expected: Expected): string[] {
+  const problems: string[] = [];
+  const definition = statement.predicate.buildDefinition;
+  const url = definition.externalParameters.workflow.repository;
+  const repository = url.toLowerCase().startsWith(GITHUB) ? url.slice(GITHUB.length) : url;
+  if (repository.toLowerCase() !== expected.repository.toLowerCase()) {
+    problems.push(`it was built from ${repository}, not ${expected.repository}`);
+  }
+  const commit = sourceCommit(definition);
+  if (commit?.toLowerCase() !== expected.commit.toLowerCase()) {
+    problems.push(`it was built from commit ${commit ?? '(none named)'}, not ${expected.commit}`);
+  }
+  const name = packageUrl(expected.name, expected.version);
+  const subject = statement.subject.find((s) => field(s, 'name') === name);
+  const digest = integrityHex(expected.integrity);
+  if (subject === undefined) {
+    problems.push(`it attests no ${name}`);
+  } else if (
+    digest === undefined ||
+    lowerCase(field(field(subject, 'digest'), 'sha512')) !== digest
+  ) {
+    problems.push('the digest it attests is not the installed tarball’s');
+  }
+  return problems;
+}
+
+/** What `npm audit signatures --json` objects to; empty when every signature verified. */
+export function auditProblems(code: number, stdout: string): string[] {
+  let report: unknown;
+  try {
+    report = JSON.parse(stdout);
+  } catch {
+    return [`npm audit signatures exited ${code} without a readable report`];
+  }
+  const invalid = field(report, 'invalid');
+  const missing = field(report, 'missing');
+  if (!isList(invalid) || !isList(missing)) {
+    return [`npm audit signatures exited ${code} without a readable report`];
+  }
+  const problems: string[] = [];
+  if (invalid.length > 0) problems.push(`${invalid.length} invalid signatures`);
+  if (missing.length > 0) problems.push(`${missing.length} missing signatures`);
+  if (problems.length === 0 && code !== 0) problems.push(`npm audit signatures exited ${code}`);
+  return problems;
+}
+
+/** The integrity npm recorded for the installed package, when it is the expected version. */
+export function lockedIntegrity(lock: unknown, version: string): string | undefined {
+  const entry = field(field(lock, 'packages'), `node_modules/${PACKAGE}`);
+  return isObject(entry) && entry.version === version && typeof entry.integrity === 'string'
+    ? entry.integrity
+    : undefined;
+}
+
+function readText(path: string): string | undefined {
+  try {
+    return readFileSync(path, 'utf8').trim();
+  } catch {
+    return undefined;
+  }
+}
+
+function gitDirOf(root: string): string {
+  const dotGit = join(root, '.git');
+  const pointer = readText(dotGit);
+  return pointer?.startsWith('gitdir: ') ? resolve(root, pointer.slice('gitdir: '.length)) : dotGit;
+}
+
+/**
+ * The commit a checkout's HEAD is at, read from its files rather than by running git: a detached
+ * HEAD holds the commit; a branch's HEAD points at a loose or a packed ref.
+ */
+export function headCommit(root: string): string | undefined {
+  const gitDir = gitDirOf(root);
+  const head = readText(join(gitDir, 'HEAD')) ?? '';
+  if (COMMIT.test(head)) return head;
+  const ref = /^ref: (refs\/[\w./-]+)$/.exec(head)?.[1];
+  if (ref === undefined) return undefined;
+  const loose = readText(join(gitDir, ref));
+  if (loose !== undefined) return COMMIT.test(loose) ? loose : undefined;
+  const packed = (readText(join(gitDir, 'packed-refs')) ?? '').split('\n');
+  const commit = packed.find((line) => line.endsWith(` ${ref}`))?.slice(0, 40);
+  return commit !== undefined && COMMIT.test(commit) ? commit : undefined;
+}
+
+/** The release a checkout of the Talos repository is at: its version and HEAD commit. */
+export function kitRelease(kitRoot: string): Release {
+  const manifest: unknown = JSON.parse(readFileSync(join(kitRoot, 'package.json'), 'utf8'));
+  const version = field(manifest, 'version');
+  if (
+    field(manifest, 'name') !== PACKAGE ||
+    typeof version !== 'string' ||
+    !VERSION.test(version)
+  ) {
+    throw new Refusal('the checkout is not a Talos release');
+  }
+  const sha = headCommit(kitRoot);
+  if (sha === undefined) throw new Refusal('the checkout has no commit');
+  return { version, sha };
+}
+
+/** npm's own script beside the running Node, so nothing is looked up on PATH. */
+export function npmCli(execPath: string, platform: string, env: Env): string | undefined {
+  const bin = dirname(execPath);
+  const beside =
+    platform === 'win32'
+      ? join(bin, 'node_modules', 'npm', 'bin', 'npm-cli.js')
+      : join(bin, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js');
+  return [beside, env.npm_execpath].find((path) => path !== undefined && existsSync(path));
+}
+
+function npm(args: readonly string[], cwd: string): NpmRun {
+  const cli = npmCli(process.execPath, process.platform, process.env);
+  if (cli === undefined) throw new Refusal('npm was not found beside node');
+  return spawnSync(process.execPath, [cli, ...args], {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 64 * 1024 * 1024,
+  });
+}
+
+async function verifiedProvenance(release: Release, integrity: string): Promise<void> {
+  const url = `${REGISTRY}/-/npm/v1/attestations/${encodeURIComponent(PACKAGE)}@${release.version}`;
+  const response = await fetch(url, { headers: { accept: 'application/json' } });
+  if (!response.ok) throw new Refusal(`${PACKAGE}@${release.version} has no provenance`);
+  const problems = provenanceProblems(readStatement(await response.json()), {
+    name: PACKAGE,
+    version: release.version,
+    repository: SOURCE,
+    commit: release.sha,
+    integrity,
+  });
+  if (problems.length > 0) throw new Refusal(problems.join('; '));
+}
+
+async function installVerified(release: Release, directory: string): Promise<string> {
+  writeFileSync(join(directory, 'package.json'), '{ "private": true }\n');
+  const spec = `${PACKAGE}@${release.version}`;
+  const flags = ['--ignore-scripts', '--no-audit', '--no-fund', '--save-exact'];
+  const install = npm(['install', ...flags, spec], directory);
+  if (install.status !== 0) throw new Refusal(`npm install exited ${String(install.status)}`);
+  const lock: unknown = JSON.parse(readFileSync(join(directory, 'package-lock.json'), 'utf8'));
+  const integrity = lockedIntegrity(lock, release.version);
+  if (integrity === undefined) throw new Refusal(`npm installed no ${spec}`);
+  const audit = npm(['audit', 'signatures', '--json'], directory);
+  const audited = auditProblems(audit.status ?? 1, audit.stdout ?? '');
+  if (audited.length > 0) throw new Refusal(audited.join('; '));
+  await verifiedProvenance(release, integrity);
+  return join(directory, 'node_modules', '@svp-labs', 'talos', 'dist', 'bin', 'talos.js');
+}
+
+function run(bin: string, args: readonly string[], env: Env): Promise<number> {
+  return new Promise((done) => {
+    const child = spawn(process.execPath, [bin, ...args], { stdio: 'inherit', env });
+    child.on('error', () => done(2));
+    child.on('exit', (code) => done(code ?? 1));
+  });
+}
+
+/** Installs and verifies the checkout's release, runs it with `args`, and returns its code. */
+export async function main(args: readonly string[], env: Env): Promise<number> {
+  const kitRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+  try {
+    const release = kitRelease(kitRoot);
+    const directory = mkdtempSync(join(env.RUNNER_TEMP ?? tmpdir(), 'talos-'));
+    const bin = await installVerified(release, directory);
+    return await run(bin, args, {
+      ...env,
+      TALOS_LAUNCHED: '1',
+      TALOS_VERSION: release.version,
+      TALOS_SHA: release.sha,
+    });
+  } catch (error) {
+    const reason = error instanceof Refusal ? error.message : 'the release could not be installed';
+    process.stderr.write(`talos bootstrap: refused: ${reason}\n`);
+    return 2;
+  }
+}
+
+if (process.argv[1] !== undefined && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  process.exitCode = await main(process.argv.slice(2), process.env);
+}

package/bootstrap/php.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Says which runs need PHP, and which PHP, for the workflows that set it up before Talos runs:
+# the PHP checks run the project's own toolchain, which needs PHP with pcov and composer on the
+# runner. Run it inside the repository's checkout, naming the commits whose talos.yml counts:
+#
+#   php.sh <commit>...
+#
+# A PHP component in talos.yml at any of the commits needs PHP on each OS it lists (linux when it
+# lists none). The version is the newest minor that any of their composer.json files asks for
+# (config.platform.php, else require.php), and never older than 8.4, the oldest PHP the toolchain
+# installs on. Prints two lines for $GITHUB_OUTPUT, the OSes as a JSON list and then the minor,
+# such as `oses=["linux"]` and `version=8.4`.
+#
+# Needs git, jq and yq (mikefarah's, which GitHub's runners carry, or the Python one). The caller
+# workflow, which never changes between releases, runs it from whichever release a repository
+# enforces, so every release keeps it, with these arguments and this output.
+set -euo pipefail
+
+floor='8.4'
+php_components='[.components[]? | select(.lang == "php")
+  | {root: ((.root // ".") | sub("/+$"; "") | sub("^\\./"; "") | if . == "" then "." else . end),
+     os: (.os // ["linux"])}]'
+minor_asked='(.config.platform.php // .require.php // "") | tostring
+  | [scan("[0-9]+\\.[0-9]+")] | .[0] // empty'
+
+fail() {
+  echo "php: $1" >&2
+  exit 1
+}
+
+(($# > 0)) || fail "name the commits whose talos.yml counts"
+command -v yq >/dev/null || fail "yq is not on PATH"
+
+oses=''
+versions="$floor"
+for commit in "$@"; do
+  config="$(git show "$commit:talos.yml" 2>/dev/null)" || continue
+  json="$(yq -o=json '.' <<<"$config" 2>/dev/null || yq '.' <<<"$config" 2>/dev/null)" ||
+    fail "talos.yml at $commit is not YAML"
+  php="$(jq -c "$php_components" <<<"$json" 2>/dev/null)" ||
+    fail "cannot read the components of talos.yml at $commit"
+  oses+="$(jq -r '.[].os[]' <<<"$php")"$'\n'
+  roots="$(jq -r '.[].root' <<<"$php")"
+  while IFS= read -r root; do
+    [[ -n "$root" ]] || continue
+    file="$root/composer.json"
+    [[ "$root" == "." ]] && file='composer.json'
+    composer="$(git show "$commit:$file" 2>/dev/null)" || continue
+    versions+=$'\n'"$(jq -r "$minor_asked" <<<"$composer" 2>/dev/null || true)"
+  done <<<"$roots"
+done
+
+version="$({ grep -E '^[0-9]+\.[0-9]+$' <<<"$versions" || true; } | sort -V | tail -n 1)"
+list="$({ grep -E '^(linux|windows|macos)$' <<<"$oses" || true; } | sort -u | jq -R . | jq -cs .)"
+printf 'oses=%s\nversion=%s\n' "$list" "$version"

package/dist/adopt/assets.js

@@ -0,0 +1,40 @@
+import { readdir, readFile } from 'node:fs/promises';
+import { parseDefaults } from './dependabot.js';
+import { RUNNER_PATCH } from './supply.js';
+import { assetsDir } from '../version/self.js';
+async function optional(url) {
+    try {
+        return await readFile(url, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The issue forms, PR template, Dependabot settings, `CLAUDE.md` block, patches and pre-push
+ * hook this Talos ships.
+ */
+export async function loadAdoptAssets(dir = assetsDir()) {
+    const formsDir = new URL('issue-forms/', dir);
+    const names = (await readdir(formsDir))
+        .filter((name) => /\.ya?ml$/.test(name))
+        .sort((a, b) => a.localeCompare(b));
+    const forms = await Promise.all(names.map((name) => readFile(new URL(name, formsDir), 'utf8')));
+    const issueForms = Object.fromEntries(names.map((name, index) => [name, forms[index] ?? '']));
+    const [prTemplate, defaults, claudeKit, runnerPatch, prePush] = await Promise.all([
+        optional(new URL('pull_request_template.md', dir)),
+        readFile(new URL('dependabot/update.yml', dir), 'utf8'),
+        readFile(new URL('claude/kit-block.md', dir), 'utf8'),
+        optional(new URL(`patches/${RUNNER_PATCH}`, dir)),
+        readFile(new URL('hooks/pre-push', dir), 'utf8'),
+    ]);
+    return {
+        issueForms,
+        prTemplate,
+        dependabot: parseDefaults(defaults),
+        claudeKit,
+        runnerPatch,
+        prePush,
+    };
+}
+//# sourceMappingURL=assets.js.map

package/dist/adopt/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/adopt/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,KAAK,UAAU,QAAQ,CAAC,GAAQ;IAC9B,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAW,SAAS,EAAE;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChF,QAAQ,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QACvD,QAAQ,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QACrD,QAAQ,CAAC,IAAI,GAAG,CAAC,WAAW,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,QAAQ,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;KACjD,CAAC,CAAC;IACH,OAAO;QACL,UAAU;QACV,UAAU;QACV,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC;QACnC,SAAS;QACT,WAAW;QACX,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/adopt/config.js

@@ -0,0 +1,68 @@
+import { detectComponents, detectDocs, guessExclude } from './detect.js';
+import { derivePrefix, isSeed, renderTalosYml } from './talos-yml.js';
+import { ConfigError, parseConfig } from '../config/load.js';
+import { prefixHolder } from '../govern/create.js';
+import { repoFacts } from '../repo/facts.js';
+export class AdoptRefusal extends Error {
+    name = 'AdoptRefusal';
+}
+export function parsed(text) {
+    try {
+        return parseConfig(text);
+    }
+    catch (error) {
+        if (error instanceof ConfigError)
+            throw new AdoptRefusal(error.message);
+        throw error;
+    }
+}
+function agree(flag, recorded, what) {
+    if (flag !== undefined && flag !== recorded) {
+        throw new AdoptRefusal(`talos.yml already names ${what} ${recorded}, not ${flag}`);
+    }
+}
+function draftConfig(input, recorded) {
+    const name = recorded?.name ?? input.name ?? input.repo.split('/').at(-1) ?? input.repo;
+    const exclude = guessExclude(input.files, input.read);
+    const facts = repoFacts(input.files, exclude);
+    return renderTalosYml({
+        name,
+        prefix: recorded?.prefix ?? input.prefix ?? derivePrefix(name),
+        components: detectComponents(facts.files, input.read, input.os),
+        exclude,
+        docs: detectDocs(facts.files),
+    });
+}
+/**
+ * The repository's `talos.yml`: kept when someone has set it up, completed when it is only the
+ * name and prefix `talos new` recorded, and written from the manifests when there is none.
+ */
+export function resolveConfig(input) {
+    const existing = input.files.includes('talos.yml') ? input.read('talos.yml') : undefined;
+    if (existing === undefined) {
+        const text = draftConfig(input, undefined);
+        return { config: parsed(text), text, status: 'written' };
+    }
+    const recorded = parsed(existing);
+    agree(input.prefix, recorded.prefix, 'the prefix');
+    agree(input.name, recorded.name, 'the name');
+    if (!isSeed(existing))
+        return { config: recorded, text: undefined, status: 'kept' };
+    const text = draftConfig(input, recorded);
+    return { config: parsed(text), text, status: 'completed' };
+}
+/**
+ * Refuses a prefix another repository of the organisation uses, as `talos new` does: a ticket
+ * branch `<P>-<N>` must name one repository. `uses` is `undefined` when the organisation couldn't
+ * be read, and then nothing is refused.
+ */
+export function checkPrefix(uses, repo, prefix) {
+    if (uses === undefined)
+        return;
+    const others = uses.filter((use) => use.repo.toLowerCase() !== repo.toLowerCase());
+    const holder = prefixHolder(others, prefix);
+    if (holder !== undefined) {
+        throw new AdoptRefusal(`prefix ${prefix} is in use by ${holder}; each repository needs its own`);
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/adopt/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/adopt/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAmB,MAAM,aAAa,CAAC;AAE1F,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAkB,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,cAAc,CAAC;CACzC;AAmBD,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,IAAwB,EAAE,QAAgB,EAAE,IAAY;IACrE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,2BAA2B,IAAI,IAAI,QAAQ,SAAS,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB,EAAE,QAAiC;IACxE,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;IACxF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,cAAc,CAAC;QACpB,IAAI;QACJ,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC;QAC9D,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO;QACP,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpF,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,IAAsC,EACtC,IAAY,EACZ,MAAc;IAEd,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CACpB,UAAU,MAAM,iBAAiB,MAAM,iCAAiC,CACzE,CAAC;IACJ,CAAC;AACH,CAAC"}