Changing front

front/app/node_modules/@npmcli/fs/LICENSE.md

@@ -0,0 +1,20 @@
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+ISC License
+
+Copyright npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this
+software for any purpose with or without fee is hereby
+granted, provided that the above copyright notice and this
+permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO
+EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.

front/app/node_modules/@npmcli/fs/README.md

@@ -0,0 +1,97 @@
+# @npmcli/fs
+
+polyfills, and extensions, of the core `fs` module.
+
+## Features
+
+- `fs.cp` polyfill for node < 16.7.0
+- `fs.withTempDir` added
+- `fs.readdirScoped` added
+- `fs.moveFile` added
+
+## `fs.withTempDir(root, fn, options) -> Promise`
+
+### Parameters
+
+- `root`: the directory in which to create the temporary directory
+- `fn`: a function that will be called with the path to the temporary directory
+- `options`
+  - `tmpPrefix`: a prefix to be used in the generated directory name
+
+### Usage
+
+The `withTempDir` function creates a temporary directory, runs the provided
+function (`fn`), then removes the temporary directory and resolves or rejects
+based on the result of `fn`.
+
+```js
+const fs = require('@npmcli/fs')
+const os = require('os')
+
+// this function will be called with the full path to the temporary directory
+// it is called with `await` behind the scenes, so can be async if desired.
+const myFunction = async (tempPath) => {
+  return 'done!'
+}
+
+const main = async () => {
+  const result = await fs.withTempDir(os.tmpdir(), myFunction)
+  // result === 'done!'
+}
+
+main()
+```
+
+## `fs.readdirScoped(root) -> Promise`
+
+### Parameters
+
+- `root`: the directory to read
+
+### Usage
+
+Like `fs.readdir` but handling `@org/module` dirs as if they were
+a single entry.
+
+```javascript
+const readdir = require('readdir-scoped-modules')
+const entries = await readdir('node_modules')
+// entries will be something like: ['a', '@org/foo', '@org/bar']
+```
+
+## `fs.moveFile(source, dest, options) -> Promise`
+
+A fork of [move-file](https://github.com/sindresorhus/move-file) with
+support for Common JS.
+
+### Highlights
+
+- Promise API.
+- Supports moving a file across partitions and devices.
+- Optionally prevent overwriting an existing file.
+- Creates non-existent destination directories for you.
+- Automatically recurses when source is a directory.
+
+### Parameters
+
+- `source`: File, or directory, you want to move.
+- `dest`: Where you want the file or directory moved.
+- `options`
+  - `overwrite` (`boolean`, default: `true`): Overwrite existing destination file(s).
+
+### Usage
+
+The built-in
+[`fs.rename()`](https://nodejs.org/api/fs.html#fs_fs_rename_oldpath_newpath_callback)
+is just a JavaScript wrapper for the C `rename(2)` function, which doesn't
+support moving files across partitions or devices. This module is what you
+would have expected `fs.rename()` to be.
+
+```js
+const { moveFile } = require('@npmcli/fs');
+
+(async () => {
+	await moveFile('source/unicorn.png', 'destination/unicorn.png');
+	console.log('The file has been moved');
+})();
+```

front/app/node_modules/@npmcli/fs/lib/common/get-options.js

@@ -0,0 +1,20 @@
+// given an input that may or may not be an object, return an object that has
+// a copy of every defined property listed in 'copy'. if the input is not an
+// object, assign it to the property named by 'wrap'
+const getOptions = (input, { copy, wrap }) => {
+  const result = {}
+
+  if (input && typeof input === 'object') {
+    for (const prop of copy) {
+      if (input[prop] !== undefined) {
+        result[prop] = input[prop]
+      }
+    }
+  } else {
+    result[wrap] = input
+  }
+
+  return result
+}
+
+module.exports = getOptions

front/app/node_modules/@npmcli/fs/lib/common/node.js

@@ -0,0 +1,9 @@
+const semver = require('semver')
+
+const satisfies = (range) => {
+  return semver.satisfies(process.version, range, { includePrerelease: true })
+}
+
+module.exports = {
+  satisfies,
+}

front/app/node_modules/@npmcli/fs/lib/cp/LICENSE

@@ -0,0 +1,15 @@
+(The MIT License)
+
+Copyright (c) 2011-2017 JP Richardson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files
+(the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify,
+ merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
+OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

front/app/node_modules/@npmcli/fs/lib/cp/errors.js

@@ -0,0 +1,129 @@
+'use strict'
+const { inspect } = require('util')
+
+// adapted from node's internal/errors
+// https://github.com/nodejs/node/blob/c8a04049/lib/internal/errors.js
+
+// close copy of node's internal SystemError class.
+class SystemError {
+  constructor (code, prefix, context) {
+    // XXX context.code is undefined in all constructors used in cp/polyfill
+    // that may be a bug copied from node, maybe the constructor should use
+    // `code` not `errno`?  nodejs/node#41104
+    let message = `${prefix}: ${context.syscall} returned ` +
+                  `${context.code} (${context.message})`
+
+    if (context.path !== undefined) {
+      message += ` ${context.path}`
+    }
+    if (context.dest !== undefined) {
+      message += ` => ${context.dest}`
+    }
+
+    this.code = code
+    Object.defineProperties(this, {
+      name: {
+        value: 'SystemError',
+        enumerable: false,
+        writable: true,
+        configurable: true,
+      },
+      message: {
+        value: message,
+        enumerable: false,
+        writable: true,
+        configurable: true,
+      },
+      info: {
+        value: context,
+        enumerable: true,
+        configurable: true,
+        writable: false,
+      },
+      errno: {
+        get () {
+          return context.errno
+        },
+        set (value) {
+          context.errno = value
+        },
+        enumerable: true,
+        configurable: true,
+      },
+      syscall: {
+        get () {
+          return context.syscall
+        },
+        set (value) {
+          context.syscall = value
+        },
+        enumerable: true,
+        configurable: true,
+      },
+    })
+
+    if (context.path !== undefined) {
+      Object.defineProperty(this, 'path', {
+        get () {
+          return context.path
+        },
+        set (value) {
+          context.path = value
+        },
+        enumerable: true,
+        configurable: true,
+      })
+    }
+
+    if (context.dest !== undefined) {
+      Object.defineProperty(this, 'dest', {
+        get () {
+          return context.dest
+        },
+        set (value) {
+          context.dest = value
+        },
+        enumerable: true,
+        configurable: true,
+      })
+    }
+  }
+
+  toString () {
+    return `${this.name} [${this.code}]: ${this.message}`
+  }
+
+  [Symbol.for('nodejs.util.inspect.custom')] (_recurseTimes, ctx) {
+    return inspect(this, {
+      ...ctx,
+      getters: true,
+      customInspect: false,
+    })
+  }
+}
+
+function E (code, message) {
+  module.exports[code] = class NodeError extends SystemError {
+    constructor (ctx) {
+      super(code, message, ctx)
+    }
+  }
+}
+
+E('ERR_FS_CP_DIR_TO_NON_DIR', 'Cannot overwrite directory with non-directory')
+E('ERR_FS_CP_EEXIST', 'Target already exists')
+E('ERR_FS_CP_EINVAL', 'Invalid src or dest')
+E('ERR_FS_CP_FIFO_PIPE', 'Cannot copy a FIFO pipe')
+E('ERR_FS_CP_NON_DIR_TO_DIR', 'Cannot overwrite non-directory with directory')
+E('ERR_FS_CP_SOCKET', 'Cannot copy a socket file')
+E('ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY', 'Cannot overwrite symlink in subdirectory of self')
+E('ERR_FS_CP_UNKNOWN', 'Cannot copy an unknown file type')
+E('ERR_FS_EISDIR', 'Path is a directory')
+
+module.exports.ERR_INVALID_ARG_TYPE = class ERR_INVALID_ARG_TYPE extends Error {
+  constructor (name, expected, actual) {
+    super()
+    this.code = 'ERR_INVALID_ARG_TYPE'
+    this.message = `The ${name} argument must be ${expected}. Received ${typeof actual}`
+  }
+}

front/app/node_modules/@npmcli/fs/lib/cp/index.js

@@ -0,0 +1,22 @@
+const fs = require('fs/promises')
+const getOptions = require('../common/get-options.js')
+const node = require('../common/node.js')
+const polyfill = require('./polyfill.js')
+
+// node 16.7.0 added fs.cp
+const useNative = node.satisfies('>=16.7.0')
+
+const cp = async (src, dest, opts) => {
+  const options = getOptions(opts, {
+    copy: ['dereference', 'errorOnExist', 'filter', 'force', 'preserveTimestamps', 'recursive'],
+  })
+
+  // the polyfill is tested separately from this module, no need to hack
+  // process.version to try to trigger it just for coverage
+  // istanbul ignore next
+  return useNative
+    ? fs.cp(src, dest, options)
+    : polyfill(src, dest, options)
+}
+
+module.exports = cp

front/app/node_modules/@npmcli/fs/lib/cp/polyfill.js

@@ -0,0 +1,428 @@
+// this file is a modified version of the code in node 17.2.0
+// which is, in turn, a modified version of the fs-extra module on npm
+// node core changes:
+// - Use of the assert module has been replaced with core's error system.
+// - All code related to the glob dependency has been removed.
+// - Bring your own custom fs module is not currently supported.
+// - Some basic code cleanup.
+// changes here:
+// - remove all callback related code
+// - drop sync support
+// - change assertions back to non-internal methods (see options.js)
+// - throws ENOTDIR when rmdir gets an ENOENT for a path that exists in Windows
+'use strict'
+
+const {
+  ERR_FS_CP_DIR_TO_NON_DIR,
+  ERR_FS_CP_EEXIST,
+  ERR_FS_CP_EINVAL,
+  ERR_FS_CP_FIFO_PIPE,
+  ERR_FS_CP_NON_DIR_TO_DIR,
+  ERR_FS_CP_SOCKET,
+  ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY,
+  ERR_FS_CP_UNKNOWN,
+  ERR_FS_EISDIR,
+  ERR_INVALID_ARG_TYPE,
+} = require('./errors.js')
+const {
+  constants: {
+    errno: {
+      EEXIST,
+      EISDIR,
+      EINVAL,
+      ENOTDIR,
+    },
+  },
+} = require('os')
+const {
+  chmod,
+  copyFile,
+  lstat,
+  mkdir,
+  readdir,
+  readlink,
+  stat,
+  symlink,
+  unlink,
+  utimes,
+} = require('fs/promises')
+const {
+  dirname,
+  isAbsolute,
+  join,
+  parse,
+  resolve,
+  sep,
+  toNamespacedPath,
+} = require('path')
+const { fileURLToPath } = require('url')
+
+const defaultOptions = {
+  dereference: false,
+  errorOnExist: false,
+  filter: undefined,
+  force: true,
+  preserveTimestamps: false,
+  recursive: false,
+}
+
+async function cp (src, dest, opts) {
+  if (opts != null && typeof opts !== 'object') {
+    throw new ERR_INVALID_ARG_TYPE('options', ['Object'], opts)
+  }
+  return cpFn(
+    toNamespacedPath(getValidatedPath(src)),
+    toNamespacedPath(getValidatedPath(dest)),
+    { ...defaultOptions, ...opts })
+}
+
+function getValidatedPath (fileURLOrPath) {
+  const path = fileURLOrPath != null && fileURLOrPath.href
+      && fileURLOrPath.origin
+    ? fileURLToPath(fileURLOrPath)
+    : fileURLOrPath
+  return path
+}
+
+async function cpFn (src, dest, opts) {
+  // Warn about using preserveTimestamps on 32-bit node
+  // istanbul ignore next
+  if (opts.preserveTimestamps && process.arch === 'ia32') {
+    const warning = 'Using the preserveTimestamps option in 32-bit ' +
+      'node is not recommended'
+    process.emitWarning(warning, 'TimestampPrecisionWarning')
+  }
+  const stats = await checkPaths(src, dest, opts)
+  const { srcStat, destStat } = stats
+  await checkParentPaths(src, srcStat, dest)
+  if (opts.filter) {
+    return handleFilter(checkParentDir, destStat, src, dest, opts)
+  }
+  return checkParentDir(destStat, src, dest, opts)
+}
+
+async function checkPaths (src, dest, opts) {
+  const { 0: srcStat, 1: destStat } = await getStats(src, dest, opts)
+  if (destStat) {
+    if (areIdentical(srcStat, destStat)) {
+      throw new ERR_FS_CP_EINVAL({
+        message: 'src and dest cannot be the same',
+        path: dest,
+        syscall: 'cp',
+        errno: EINVAL,
+      })
+    }
+    if (srcStat.isDirectory() && !destStat.isDirectory()) {
+      throw new ERR_FS_CP_DIR_TO_NON_DIR({
+        message: `cannot overwrite directory ${src} ` +
+            `with non-directory ${dest}`,
+        path: dest,
+        syscall: 'cp',
+        errno: EISDIR,
+      })
+    }
+    if (!srcStat.isDirectory() && destStat.isDirectory()) {
+      throw new ERR_FS_CP_NON_DIR_TO_DIR({
+        message: `cannot overwrite non-directory ${src} ` +
+            `with directory ${dest}`,
+        path: dest,
+        syscall: 'cp',
+        errno: ENOTDIR,
+      })
+    }
+  }
+
+  if (srcStat.isDirectory() && isSrcSubdir(src, dest)) {
+    throw new ERR_FS_CP_EINVAL({
+      message: `cannot copy ${src} to a subdirectory of self ${dest}`,
+      path: dest,
+      syscall: 'cp',
+      errno: EINVAL,
+    })
+  }
+  return { srcStat, destStat }
+}
+
+function areIdentical (srcStat, destStat) {
+  return destStat.ino && destStat.dev && destStat.ino === srcStat.ino &&
+    destStat.dev === srcStat.dev
+}
+
+function getStats (src, dest, opts) {
+  const statFunc = opts.dereference ?
+    (file) => stat(file, { bigint: true }) :
+    (file) => lstat(file, { bigint: true })
+  return Promise.all([
+    statFunc(src),
+    statFunc(dest).catch((err) => {
+      // istanbul ignore next: unsure how to cover.
+      if (err.code === 'ENOENT') {
+        return null
+      }
+      // istanbul ignore next: unsure how to cover.
+      throw err
+    }),
+  ])
+}
+
+async function checkParentDir (destStat, src, dest, opts) {
+  const destParent = dirname(dest)
+  const dirExists = await pathExists(destParent)
+  if (dirExists) {
+    return getStatsForCopy(destStat, src, dest, opts)
+  }
+  await mkdir(destParent, { recursive: true })
+  return getStatsForCopy(destStat, src, dest, opts)
+}
+
+function pathExists (dest) {
+  return stat(dest).then(
+    () => true,
+    // istanbul ignore next: not sure when this would occur
+    (err) => (err.code === 'ENOENT' ? false : Promise.reject(err)))
+}
+
+// Recursively check if dest parent is a subdirectory of src.
+// It works for all file types including symlinks since it
+// checks the src and dest inodes. It starts from the deepest
+// parent and stops once it reaches the src parent or the root path.
+async function checkParentPaths (src, srcStat, dest) {
+  const srcParent = resolve(dirname(src))
+  const destParent = resolve(dirname(dest))
+  if (destParent === srcParent || destParent === parse(destParent).root) {
+    return
+  }
+  let destStat
+  try {
+    destStat = await stat(destParent, { bigint: true })
+  } catch (err) {
+    // istanbul ignore else: not sure when this would occur
+    if (err.code === 'ENOENT') {
+      return
+    }
+    // istanbul ignore next: not sure when this would occur
+    throw err
+  }
+  if (areIdentical(srcStat, destStat)) {
+    throw new ERR_FS_CP_EINVAL({
+      message: `cannot copy ${src} to a subdirectory of self ${dest}`,
+      path: dest,
+      syscall: 'cp',
+      errno: EINVAL,
+    })
+  }
+  return checkParentPaths(src, srcStat, destParent)
+}
+
+const normalizePathToArray = (path) =>
+  resolve(path).split(sep).filter(Boolean)
+
+// Return true if dest is a subdir of src, otherwise false.
+// It only checks the path strings.
+function isSrcSubdir (src, dest) {
+  const srcArr = normalizePathToArray(src)
+  const destArr = normalizePathToArray(dest)
+  return srcArr.every((cur, i) => destArr[i] === cur)
+}
+
+async function handleFilter (onInclude, destStat, src, dest, opts, cb) {
+  const include = await opts.filter(src, dest)
+  if (include) {
+    return onInclude(destStat, src, dest, opts, cb)
+  }
+}
+
+function startCopy (destStat, src, dest, opts) {
+  if (opts.filter) {
+    return handleFilter(getStatsForCopy, destStat, src, dest, opts)
+  }
+  return getStatsForCopy(destStat, src, dest, opts)
+}
+
+async function getStatsForCopy (destStat, src, dest, opts) {
+  const statFn = opts.dereference ? stat : lstat
+  const srcStat = await statFn(src)
+  // istanbul ignore else: can't portably test FIFO
+  if (srcStat.isDirectory() && opts.recursive) {
+    return onDir(srcStat, destStat, src, dest, opts)
+  } else if (srcStat.isDirectory()) {
+    throw new ERR_FS_EISDIR({
+      message: `${src} is a directory (not copied)`,
+      path: src,
+      syscall: 'cp',
+      errno: EINVAL,
+    })
+  } else if (srcStat.isFile() ||
+            srcStat.isCharacterDevice() ||
+            srcStat.isBlockDevice()) {
+    return onFile(srcStat, destStat, src, dest, opts)
+  } else if (srcStat.isSymbolicLink()) {
+    return onLink(destStat, src, dest)
+  } else if (srcStat.isSocket()) {
+    throw new ERR_FS_CP_SOCKET({
+      message: `cannot copy a socket file: ${dest}`,
+      path: dest,
+      syscall: 'cp',
+      errno: EINVAL,
+    })
+  } else if (srcStat.isFIFO()) {
+    throw new ERR_FS_CP_FIFO_PIPE({
+      message: `cannot copy a FIFO pipe: ${dest}`,
+      path: dest,
+      syscall: 'cp',
+      errno: EINVAL,
+    })
+  }
+  // istanbul ignore next: should be unreachable
+  throw new ERR_FS_CP_UNKNOWN({
+    message: `cannot copy an unknown file type: ${dest}`,
+    path: dest,
+    syscall: 'cp',
+    errno: EINVAL,
+  })
+}
+
+function onFile (srcStat, destStat, src, dest, opts) {
+  if (!destStat) {
+    return _copyFile(srcStat, src, dest, opts)
+  }
+  return mayCopyFile(srcStat, src, dest, opts)
+}
+
+async function mayCopyFile (srcStat, src, dest, opts) {
+  if (opts.force) {
+    await unlink(dest)
+    return _copyFile(srcStat, src, dest, opts)
+  } else if (opts.errorOnExist) {
+    throw new ERR_FS_CP_EEXIST({
+      message: `${dest} already exists`,
+      path: dest,
+      syscall: 'cp',
+      errno: EEXIST,
+    })
+  }
+}
+
+async function _copyFile (srcStat, src, dest, opts) {
+  await copyFile(src, dest)
+  if (opts.preserveTimestamps) {
+    return handleTimestampsAndMode(srcStat.mode, src, dest)
+  }
+  return setDestMode(dest, srcStat.mode)
+}
+
+async function handleTimestampsAndMode (srcMode, src, dest) {
+  // Make sure the file is writable before setting the timestamp
+  // otherwise open fails with EPERM when invoked with 'r+'
+  // (through utimes call)
+  if (fileIsNotWritable(srcMode)) {
+    await makeFileWritable(dest, srcMode)
+    return setDestTimestampsAndMode(srcMode, src, dest)
+  }
+  return setDestTimestampsAndMode(srcMode, src, dest)
+}
+
+function fileIsNotWritable (srcMode) {
+  return (srcMode & 0o200) === 0
+}
+
+function makeFileWritable (dest, srcMode) {
+  return setDestMode(dest, srcMode | 0o200)
+}
+
+async function setDestTimestampsAndMode (srcMode, src, dest) {
+  await setDestTimestamps(src, dest)
+  return setDestMode(dest, srcMode)
+}
+
+function setDestMode (dest, srcMode) {
+  return chmod(dest, srcMode)
+}
+
+async function setDestTimestamps (src, dest) {
+  // The initial srcStat.atime cannot be trusted
+  // because it is modified by the read(2) system call
+  // (See https://nodejs.org/api/fs.html#fs_stat_time_values)
+  const updatedSrcStat = await stat(src)
+  return utimes(dest, updatedSrcStat.atime, updatedSrcStat.mtime)
+}
+
+function onDir (srcStat, destStat, src, dest, opts) {
+  if (!destStat) {
+    return mkDirAndCopy(srcStat.mode, src, dest, opts)
+  }
+  return copyDir(src, dest, opts)
+}
+
+async function mkDirAndCopy (srcMode, src, dest, opts) {
+  await mkdir(dest)
+  await copyDir(src, dest, opts)
+  return setDestMode(dest, srcMode)
+}
+
+async function copyDir (src, dest, opts) {
+  const dir = await readdir(src)
+  for (let i = 0; i < dir.length; i++) {
+    const item = dir[i]
+    const srcItem = join(src, item)
+    const destItem = join(dest, item)
+    const { destStat } = await checkPaths(srcItem, destItem, opts)
+    await startCopy(destStat, srcItem, destItem, opts)
+  }
+}
+
+async function onLink (destStat, src, dest) {
+  let resolvedSrc = await readlink(src)
+  if (!isAbsolute(resolvedSrc)) {
+    resolvedSrc = resolve(dirname(src), resolvedSrc)
+  }
+  if (!destStat) {
+    return symlink(resolvedSrc, dest)
+  }
+  let resolvedDest
+  try {
+    resolvedDest = await readlink(dest)
+  } catch (err) {
+    // Dest exists and is a regular file or directory,
+    // Windows may throw UNKNOWN error. If dest already exists,
+    // fs throws error anyway, so no need to guard against it here.
+    // istanbul ignore next: can only test on windows
+    if (err.code === 'EINVAL' || err.code === 'UNKNOWN') {
+      return symlink(resolvedSrc, dest)
+    }
+    // istanbul ignore next: should not be possible
+    throw err
+  }
+  if (!isAbsolute(resolvedDest)) {
+    resolvedDest = resolve(dirname(dest), resolvedDest)
+  }
+  if (isSrcSubdir(resolvedSrc, resolvedDest)) {
+    throw new ERR_FS_CP_EINVAL({
+      message: `cannot copy ${resolvedSrc} to a subdirectory of self ` +
+            `${resolvedDest}`,
+      path: dest,
+      syscall: 'cp',
+      errno: EINVAL,
+    })
+  }
+  // Do not copy if src is a subdir of dest since unlinking
+  // dest in this case would result in removing src contents
+  // and therefore a broken symlink would be created.
+  const srcStat = await stat(src)
+  if (srcStat.isDirectory() && isSrcSubdir(resolvedDest, resolvedSrc)) {
+    throw new ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY({
+      message: `cannot overwrite ${resolvedDest} with ${resolvedSrc}`,
+      path: dest,
+      syscall: 'cp',
+      errno: EINVAL,
+    })
+  }
+  return copyLink(resolvedSrc, dest)
+}
+
+async function copyLink (resolvedSrc, dest) {
+  await unlink(dest)
+  return symlink(resolvedSrc, dest)
+}
+
+module.exports = cp

front/app/node_modules/@npmcli/fs/lib/index.js

@@ -0,0 +1,13 @@
+'use strict'
+
+const cp = require('./cp/index.js')
+const withTempDir = require('./with-temp-dir.js')
+const readdirScoped = require('./readdir-scoped.js')
+const moveFile = require('./move-file.js')
+
+module.exports = {
+  cp,
+  withTempDir,
+  readdirScoped,
+  moveFile,
+}

front/app/node_modules/@npmcli/fs/lib/move-file.js

@@ -0,0 +1,78 @@
+const { dirname, join, resolve, relative, isAbsolute } = require('path')
+const fs = require('fs/promises')
+
+const pathExists = async path => {
+  try {
+    await fs.access(path)
+    return true
+  } catch (er) {
+    return er.code !== 'ENOENT'
+  }
+}
+
+const moveFile = async (source, destination, options = {}, root = true, symlinks = []) => {
+  if (!source || !destination) {
+    throw new TypeError('`source` and `destination` file required')
+  }
+
+  options = {
+    overwrite: true,
+    ...options,
+  }
+
+  if (!options.overwrite && await pathExists(destination)) {
+    throw new Error(`The destination file exists: ${destination}`)
+  }
+
+  await fs.mkdir(dirname(destination), { recursive: true })
+
+  try {
+    await fs.rename(source, destination)
+  } catch (error) {
+    if (error.code === 'EXDEV' || error.code === 'EPERM') {
+      const sourceStat = await fs.lstat(source)
+      if (sourceStat.isDirectory()) {
+        const files = await fs.readdir(source)
+        await Promise.all(files.map((file) =>
+          moveFile(join(source, file), join(destination, file), options, false, symlinks)
+        ))
+      } else if (sourceStat.isSymbolicLink()) {
+        symlinks.push({ source, destination })
+      } else {
+        await fs.copyFile(source, destination)
+      }
+    } else {
+      throw error
+    }
+  }
+
+  if (root) {
+    await Promise.all(symlinks.map(async ({ source: symSource, destination: symDestination }) => {
+      let target = await fs.readlink(symSource)
+      // junction symlinks in windows will be absolute paths, so we need to
+      // make sure they point to the symlink destination
+      if (isAbsolute(target)) {
+        target = resolve(symDestination, relative(symSource, target))
+      }
+      // try to determine what the actual file is so we can create the correct
+      // type of symlink in windows
+      let targetStat = 'file'
+      try {
+        targetStat = await fs.stat(resolve(dirname(symSource), target))
+        if (targetStat.isDirectory()) {
+          targetStat = 'junction'
+        }
+      } catch {
+        // targetStat remains 'file'
+      }
+      await fs.symlink(
+        target,
+        symDestination,
+        targetStat
+      )
+    }))
+    await fs.rm(source, { recursive: true, force: true })
+  }
+}
+
+module.exports = moveFile

front/app/node_modules/@npmcli/fs/lib/readdir-scoped.js

@@ -0,0 +1,20 @@
+const { readdir } = require('fs/promises')
+const { join } = require('path')
+
+const readdirScoped = async (dir) => {
+  const results = []
+
+  for (const item of await readdir(dir)) {
+    if (item.startsWith('@')) {
+      for (const scopedItem of await readdir(join(dir, item))) {
+        results.push(join(item, scopedItem))
+      }
+    } else {
+      results.push(item)
+    }
+  }
+
+  return results
+}
+
+module.exports = readdirScoped

front/app/node_modules/@npmcli/fs/lib/with-temp-dir.js

@@ -0,0 +1,39 @@
+const { join, sep } = require('path')
+
+const getOptions = require('./common/get-options.js')
+const { mkdir, mkdtemp, rm } = require('fs/promises')
+
+// create a temp directory, ensure its permissions match its parent, then call
+// the supplied function passing it the path to the directory. clean up after
+// the function finishes, whether it throws or not
+const withTempDir = async (root, fn, opts) => {
+  const options = getOptions(opts, {
+    copy: ['tmpPrefix'],
+  })
+  // create the directory
+  await mkdir(root, { recursive: true })
+
+  const target = await mkdtemp(join(`${root}${sep}`, options.tmpPrefix || ''))
+  let err
+  let result
+
+  try {
+    result = await fn(target)
+  } catch (_err) {
+    err = _err
+  }
+
+  try {
+    await rm(target, { force: true, recursive: true })
+  } catch {
+    // ignore errors
+  }
+
+  if (err) {
+    throw err
+  }
+
+  return result
+}
+
+module.exports = withTempDir

front/app/node_modules/@npmcli/fs/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@npmcli/fs",
+  "version": "3.1.0",
+  "description": "filesystem utilities for the npm cli",
+  "main": "lib/index.js",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "scripts": {
+    "snap": "tap",
+    "test": "tap",
+    "npmclilint": "npmcli-lint",
+    "lint": "eslint \"**/*.js\"",
+    "lintfix": "npm run lint -- --fix",
+    "posttest": "npm run lint",
+    "postsnap": "npm run lintfix --",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/fs.git"
+  },
+  "keywords": [
+    "npm",
+    "oss"
+  ],
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "tap": "^16.0.1"
+  },
+  "dependencies": {
+    "semver": "^7.3.5"
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.8.0"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  }
+}

front/app/node_modules/@npmcli/git/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE NPM DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE NPM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT,
+OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.

front/app/node_modules/@npmcli/git/README.md

@@ -0,0 +1,157 @@
+# @npmcli/git
+
+A utility for spawning git from npm CLI contexts.
+
+This is _not_ an implementation of git itself, it's just a thing that
+spawns child processes to tell the system git CLI implementation to do
+stuff.
+
+## USAGE
+
+```js
+const git = require('@npmcli/git')
+git.clone('git://foo/bar.git', 'some-branch', 'some-path', opts) // clone a repo
+  .then(() => git.spawn(['checkout', 'some-branch'], {cwd: 'bar'}))
+  .then(() => git.spawn(['you get the idea']))
+```
+
+## API
+
+Most methods take an options object.  Options are described below.
+
+### `git.spawn(args, opts = {})`
+
+Launch a `git` subprocess with the arguments specified.
+
+All the other functions call this one at some point.
+
+Processes are launched using
+[`@npmcli/promise-spawn`](http://npm.im/@npmcli/promise-spawn), with the
+`stdioString: true` option enabled by default, since git output is
+generally in readable string format.
+
+Return value is a `Promise` that resolves to a result object with `{cmd,
+args, code, signal, stdout, stderr}` members, or rejects with an error with
+the same fields, passed back from
+[`@npmcli/promise-spawn`](http://npm.im/@npmcli/promise-spawn).
+
+### `git.clone(repo, ref = 'HEAD', target = null, opts = {})` -> `Promise<sha String>`
+
+Clone the repository into `target` path (or the default path for the name
+of the repository), checking out `ref`.
+
+Return value is the sha of the current HEAD in the locally cloned
+repository.
+
+In lieu of a specific `ref`, you may also pass in a `spec` option, which is
+a [`npm-package-arg`](http://npm.im/npm-package-arg) object for a `git`
+package dependency reference.  In this way, you can select SemVer tags
+within a range, or any git committish value.  For example:
+
+```js
+const npa = require('npm-package-arg')
+git.clone('git@github.com:npm/git.git', '', null, {
+  spec: npa('github:npm/git#semver:1.x'),
+})
+
+// only gitRange and gitCommittish are relevant, so this works, too
+git.clone('git@github.com:npm/git.git', null, null, {
+  spec: { gitRange: '1.x' }
+})
+```
+
+This will automatically do a shallow `--depth=1` clone on any hosts that
+are known to support it.  To force a shallow or deep clone, you can set the
+`gitShallow` option to `true` or `false` respectively.
+
+### `git.revs(repo, opts = {})` -> `Promise<rev doc Object>`
+
+Fetch a representation of all of the named references in a given
+repository.  The resulting doc is intentionally somewhat
+[packument](https://www.npmjs.com/package/pacote#packuments)-like, so that
+git semver ranges can be applied using the same
+[`npm-pick-manifest`](http://npm.im/npm-pick-manifest) logic.
+
+The resulting object looks like:
+
+```js
+revs = {
+  versions: {
+    // all semver-looking tags go in here...
+    // version: { sha, ref, rawRef, type }
+    '1.0.0': {
+      sha: '1bc5fba3353f8e1b56493b266bc459276ab23139',
+      ref: 'v1.0.0',
+      rawRef: 'refs/tags/v1.0.0',
+      type: 'tag',
+    },
+  },
+  'dist-tags': {
+    HEAD: '1.0.0',
+    latest: '1.0.0',
+  },
+  refs: {
+    // all the advertised refs that can be cloned down remotely
+    HEAD: { sha, ref, rawRef, type: 'head' },
+    master: { ... },
+    'v1.0.0': { ... },
+    'refs/tags/v1.0.0': { ... },
+  },
+  shas: {
+    // all named shas referenced above
+    // sha: [list, of, refs]
+    '6b2501f9183a1753027a9bf89a184b7d3d4602c7': [
+      'HEAD',
+      'master',
+      'refs/heads/master',
+    ],
+    '1bc5fba3353f8e1b56493b266bc459276ab23139': [ 'v1.0.0', 'refs/tags/v1.0.0' ],
+  },
+}
+```
+
+### `git.is(opts)` -> `Promise<Boolean>`
+
+Resolve to `true` if the path argument refers to the root of a git
+repository.
+
+It does this by looking for a file in `${path}/.git/index`, which is not an
+airtight indicator, but at least avoids being fooled by an empty directory
+or a file named `.git`.
+
+### `git.find(opts)` -> `Promise<String | null>`
+
+Given a path, walk up the file system tree until a git repo working
+directory is found.  Since this calls `stat` a bunch of times, it's
+probably best to only call it if you're reasonably sure you're likely to be
+in a git project somewhere.
+
+Resolves to `null` if not in a git project.
+
+### `git.isClean(opts = {})` -> `Promise<Boolean>`
+
+Return true if in a git dir, and that git dir is free of changes.  This
+will resolve `true` if the git working dir is clean, or `false` if not, and
+reject if the path is not within a git directory or some other error
+occurs.
+
+## OPTIONS
+
+- `retry` An object to configure retry behavior for transient network
+  errors with exponential backoff.
+  - `retries`: Defaults to `opts.fetchRetries` or 2
+  - `factor`: Defaults to `opts.fetchRetryFactor` or 10
+  - `maxTimeout`: Defaults to `opts.fetchRetryMaxtimeout` or 60000
+  - `minTimeout`: Defaults to `opts.fetchRetryMintimeout` or 1000
+- `git` Path to the `git` binary to use.  Will look up the first `git` in
+  the `PATH` if not specified.
+- `spec` The [`npm-package-arg`](http://npm.im/npm-package-arg) specifier
+  object for the thing being fetched (if relevant).
+- `fakePlatform` set to a fake value of `process.platform` to use.  (Just
+  for testing `win32` behavior on Unix, and vice versa.)
+- `cwd` The current working dir for the git command.  Particularly for
+  `find` and `is` and `isClean`, it's good to know that this defaults to
+  `process.cwd()`, as one might expect.
+- Any other options that can be passed to
+  [`@npmcli/promise-spawn`](http://npm.im/@npmcli/promise-spawn), or
+  `child_process.spawn()`.

front/app/node_modules/@npmcli/git/lib/clone.js

@@ -0,0 +1,171 @@
+// The goal here is to minimize both git workload and
+// the number of refs we download over the network.
+//
+// Every method ends up with the checked out working dir
+// at the specified ref, and resolves with the git sha.
+
+// Only certain whitelisted hosts get shallow cloning.
+// Many hosts (including GHE) don't always support it.
+// A failed shallow fetch takes a LOT longer than a full
+// fetch in most cases, so we skip it entirely.
+// Set opts.gitShallow = true/false to force this behavior
+// one way or the other.
+const shallowHosts = new Set([
+  'github.com',
+  'gist.github.com',
+  'gitlab.com',
+  'bitbucket.com',
+  'bitbucket.org',
+])
+// we have to use url.parse until we add the same shim that hosted-git-info has
+// to handle scp:// urls
+const { parse } = require('url') // eslint-disable-line node/no-deprecated-api
+const path = require('path')
+
+const getRevs = require('./revs.js')
+const spawn = require('./spawn.js')
+const { isWindows } = require('./utils.js')
+
+const pickManifest = require('npm-pick-manifest')
+const fs = require('fs')
+const mkdirp = require('mkdirp')
+
+module.exports = (repo, ref = 'HEAD', target = null, opts = {}) =>
+  getRevs(repo, opts).then(revs => clone(
+    repo,
+    revs,
+    ref,
+    resolveRef(revs, ref, opts),
+    target || defaultTarget(repo, opts.cwd),
+    opts
+  ))
+
+const maybeShallow = (repo, opts) => {
+  if (opts.gitShallow === false || opts.gitShallow) {
+    return opts.gitShallow
+  }
+  return shallowHosts.has(parse(repo).host)
+}
+
+const defaultTarget = (repo, /* istanbul ignore next */ cwd = process.cwd()) =>
+  path.resolve(cwd, path.basename(repo.replace(/[/\\]?\.git$/, '')))
+
+const clone = (repo, revs, ref, revDoc, target, opts) => {
+  if (!revDoc) {
+    return unresolved(repo, ref, target, opts)
+  }
+  if (revDoc.sha === revs.refs.HEAD.sha) {
+    return plain(repo, revDoc, target, opts)
+  }
+  if (revDoc.type === 'tag' || revDoc.type === 'branch') {
+    return branch(repo, revDoc, target, opts)
+  }
+  return other(repo, revDoc, target, opts)
+}
+
+const resolveRef = (revs, ref, opts) => {
+  const { spec = {} } = opts
+  ref = spec.gitCommittish || ref
+  /* istanbul ignore next - will fail anyway, can't pull */
+  if (!revs) {
+    return null
+  }
+  if (spec.gitRange) {
+    return pickManifest(revs, spec.gitRange, opts)
+  }
+  if (!ref) {
+    return revs.refs.HEAD
+  }
+  if (revs.refs[ref]) {
+    return revs.refs[ref]
+  }
+  if (revs.shas[ref]) {
+    return revs.refs[revs.shas[ref][0]]
+  }
+  return null
+}
+
+// pull request or some other kind of advertised ref
+const other = (repo, revDoc, target, opts) => {
+  const shallow = maybeShallow(repo, opts)
+
+  const fetchOrigin = ['fetch', 'origin', revDoc.rawRef]
+    .concat(shallow ? ['--depth=1'] : [])
+
+  const git = (args) => spawn(args, { ...opts, cwd: target })
+  return mkdirp(target)
+    .then(() => git(['init']))
+    .then(() => isWindows(opts)
+      ? git(['config', '--local', '--add', 'core.longpaths', 'true'])
+      : null)
+    .then(() => git(['remote', 'add', 'origin', repo]))
+    .then(() => git(fetchOrigin))
+    .then(() => git(['checkout', revDoc.sha]))
+    .then(() => updateSubmodules(target, opts))
+    .then(() => revDoc.sha)
+}
+
+// tag or branches.  use -b
+const branch = (repo, revDoc, target, opts) => {
+  const args = [
+    'clone',
+    '-b',
+    revDoc.ref,
+    repo,
+    target,
+    '--recurse-submodules',
+  ]
+  if (maybeShallow(repo, opts)) {
+    args.push('--depth=1')
+  }
+  if (isWindows(opts)) {
+    args.push('--config', 'core.longpaths=true')
+  }
+  return spawn(args, opts).then(() => revDoc.sha)
+}
+
+// just the head.  clone it
+const plain = (repo, revDoc, target, opts) => {
+  const args = [
+    'clone',
+    repo,
+    target,
+    '--recurse-submodules',
+  ]
+  if (maybeShallow(repo, opts)) {
+    args.push('--depth=1')
+  }
+  if (isWindows(opts)) {
+    args.push('--config', 'core.longpaths=true')
+  }
+  return spawn(args, opts).then(() => revDoc.sha)
+}
+
+const updateSubmodules = (target, opts) => new Promise(resolve =>
+  fs.stat(target + '/.gitmodules', er => {
+    if (er) {
+      return resolve(null)
+    }
+    return resolve(spawn([
+      'submodule',
+      'update',
+      '-q',
+      '--init',
+      '--recursive',
+    ], { ...opts, cwd: target }))
+  }))
+
+const unresolved = (repo, ref, target, opts) => {
+  // can't do this one shallowly, because the ref isn't advertised
+  // but we can avoid checking out the working dir twice, at least
+  const lp = isWindows(opts) ? ['--config', 'core.longpaths=true'] : []
+  const cloneArgs = ['clone', '--mirror', '-q', repo, target + '/.git']
+  const git = (args) => spawn(args, { ...opts, cwd: target })
+  return mkdirp(target)
+    .then(() => git(cloneArgs.concat(lp)))
+    .then(() => git(['init']))
+    .then(() => git(['checkout', ref]))
+    .then(() => updateSubmodules(target, opts))
+    .then(() => git(['rev-parse', '--revs-only', 'HEAD']))
+    .then(({ stdout }) => stdout.trim())
+}

front/app/node_modules/@npmcli/git/lib/errors.js

@@ -0,0 +1,36 @@
+
+const maxRetry = 3
+
+class GitError extends Error {
+  shouldRetry () {
+    return false
+  }
+}
+
+class GitConnectionError extends GitError {
+  constructor (message) {
+    super('A git connection error occurred')
+  }
+
+  shouldRetry (number) {
+    return number < maxRetry
+  }
+}
+
+class GitPathspecError extends GitError {
+  constructor (message) {
+    super('The git reference could not be found')
+  }
+}
+
+class GitUnknownError extends GitError {
+  constructor (message) {
+    super('An unknown git error occurred')
+  }
+}
+
+module.exports = {
+  GitConnectionError,
+  GitPathspecError,
+  GitUnknownError,
+}

front/app/node_modules/@npmcli/git/lib/find.js

@@ -0,0 +1,15 @@
+const is = require('./is.js')
+const { dirname } = require('path')
+
+module.exports = async ({ cwd = process.cwd() } = {}) => {
+  if (await is({ cwd })) {
+    return cwd
+  }
+  while (cwd !== dirname(cwd)) {
+    cwd = dirname(cwd)
+    if (await is({ cwd })) {
+      return cwd
+    }
+  }
+  return null
+}

front/app/node_modules/@npmcli/git/lib/index.js

@@ -0,0 +1,9 @@
+module.exports = {
+  clone: require('./clone.js'),
+  revs: require('./revs.js'),
+  spawn: require('./spawn.js'),
+  is: require('./is.js'),
+  find: require('./find.js'),
+  isClean: require('./is-clean.js'),
+  errors: require('./errors.js'),
+}

front/app/node_modules/@npmcli/git/lib/is-clean.js

@@ -0,0 +1,6 @@
+const spawn = require('./spawn.js')
+
+module.exports = (opts = {}) =>
+  spawn(['status', '--porcelain=v1', '-uno'], opts)
+    .then(res => !res.stdout.trim().split(/\r?\n+/)
+      .map(l => l.trim()).filter(l => l).length)

front/app/node_modules/@npmcli/git/lib/is.js

@@ -0,0 +1,6 @@
+// not an airtight indicator, but a good gut-check to even bother trying
+const { promisify } = require('util')
+const fs = require('fs')
+const stat = promisify(fs.stat)
+module.exports = ({ cwd = process.cwd() } = {}) =>
+  stat(cwd + '/.git').then(() => true, () => false)

front/app/node_modules/@npmcli/git/lib/lines-to-revs.js

@@ -0,0 +1,147 @@
+// turn an array of lines from `git ls-remote` into a thing
+// vaguely resembling a packument, where docs are a resolved ref
+
+const semver = require('semver')
+
+module.exports = lines => finish(lines.reduce(linesToRevsReducer, {
+  versions: {},
+  'dist-tags': {},
+  refs: {},
+  shas: {},
+}))
+
+const finish = revs => distTags(shaList(peelTags(revs)))
+
+// We can check out shallow clones on specific SHAs if we have a ref
+const shaList = revs => {
+  Object.keys(revs.refs).forEach(ref => {
+    const doc = revs.refs[ref]
+    if (!revs.shas[doc.sha]) {
+      revs.shas[doc.sha] = [ref]
+    } else {
+      revs.shas[doc.sha].push(ref)
+    }
+  })
+  return revs
+}
+
+// Replace any tags with their ^{} counterparts, if those exist
+const peelTags = revs => {
+  Object.keys(revs.refs).filter(ref => ref.endsWith('^{}')).forEach(ref => {
+    const peeled = revs.refs[ref]
+    const unpeeled = revs.refs[ref.replace(/\^\{\}$/, '')]
+    if (unpeeled) {
+      unpeeled.sha = peeled.sha
+      delete revs.refs[ref]
+    }
+  })
+  return revs
+}
+
+const distTags = revs => {
+  // not entirely sure what situations would result in an
+  // ichabod repo, but best to be careful in Sleepy Hollow anyway
+  const HEAD = revs.refs.HEAD || /* istanbul ignore next */ {}
+  const versions = Object.keys(revs.versions)
+  versions.forEach(v => {
+    // simulate a dist-tags with latest pointing at the
+    // 'latest' branch if one exists and is a version,
+    // or HEAD if not.
+    const ver = revs.versions[v]
+    if (revs.refs.latest && ver.sha === revs.refs.latest.sha) {
+      revs['dist-tags'].latest = v
+    } else if (ver.sha === HEAD.sha) {
+      revs['dist-tags'].HEAD = v
+      if (!revs.refs.latest) {
+        revs['dist-tags'].latest = v
+      }
+    }
+  })
+  return revs
+}
+
+const refType = ref => {
+  if (ref.startsWith('refs/tags/')) {
+    return 'tag'
+  }
+  if (ref.startsWith('refs/heads/')) {
+    return 'branch'
+  }
+  if (ref.startsWith('refs/pull/')) {
+    return 'pull'
+  }
+  if (ref === 'HEAD') {
+    return 'head'
+  }
+  // Could be anything, ignore for now
+  /* istanbul ignore next */
+  return 'other'
+}
+
+// return the doc, or null if we should ignore it.
+const lineToRevDoc = line => {
+  const split = line.trim().split(/\s+/, 2)
+  if (split.length < 2) {
+    return null
+  }
+
+  const sha = split[0].trim()
+  const rawRef = split[1].trim()
+  const type = refType(rawRef)
+
+  if (type === 'tag') {
+    // refs/tags/foo^{} is the 'peeled tag', ie the commit
+    // that is tagged by refs/tags/foo they resolve to the same
+    // content, just different objects in git's data structure.
+    // But, we care about the thing the tag POINTS to, not the tag
+    // object itself, so we only look at the peeled tag refs, and
+    // ignore the pointer.
+    // For now, though, we have to save both, because some tags
+    // don't have peels, if they were not annotated.
+    const ref = rawRef.slice('refs/tags/'.length)
+    return { sha, ref, rawRef, type }
+  }
+
+  if (type === 'branch') {
+    const ref = rawRef.slice('refs/heads/'.length)
+    return { sha, ref, rawRef, type }
+  }
+
+  if (type === 'pull') {
+    // NB: merged pull requests installable with #pull/123/merge
+    // for the merged pr, or #pull/123 for the PR head
+    const ref = rawRef.slice('refs/'.length).replace(/\/head$/, '')
+    return { sha, ref, rawRef, type }
+  }
+
+  if (type === 'head') {
+    const ref = 'HEAD'
+    return { sha, ref, rawRef, type }
+  }
+
+  // at this point, all we can do is leave the ref un-munged
+  return { sha, ref: rawRef, rawRef, type }
+}
+
+const linesToRevsReducer = (revs, line) => {
+  const doc = lineToRevDoc(line)
+
+  if (!doc) {
+    return revs
+  }
+
+  revs.refs[doc.ref] = doc
+  revs.refs[doc.rawRef] = doc
+
+  if (doc.type === 'tag') {
+    // try to pull a semver value out of tags like `release-v1.2.3`
+    // which is a pretty common pattern.
+    const match = !doc.ref.endsWith('^{}') &&
+      doc.ref.match(/v?(\d+\.\d+\.\d+(?:[-+].+)?)$/)
+    if (match && semver.valid(match[1], true)) {
+      revs.versions[semver.clean(match[1], true)] = doc
+    }
+  }
+
+  return revs
+}

front/app/node_modules/@npmcli/git/lib/make-error.js

@@ -0,0 +1,33 @@
+const {
+  GitConnectionError,
+  GitPathspecError,
+  GitUnknownError,
+} = require('./errors.js')
+
+const connectionErrorRe = new RegExp([
+  'remote error: Internal Server Error',
+  'The remote end hung up unexpectedly',
+  'Connection timed out',
+  'Operation timed out',
+  'Failed to connect to .* Timed out',
+  'Connection reset by peer',
+  'SSL_ERROR_SYSCALL',
+  'The requested URL returned error: 503',
+].join('|'))
+
+const missingPathspecRe = /pathspec .* did not match any file\(s\) known to git/
+
+function makeError (er) {
+  const message = er.stderr
+  let gitEr
+  if (connectionErrorRe.test(message)) {
+    gitEr = new GitConnectionError(message)
+  } else if (missingPathspecRe.test(message)) {
+    gitEr = new GitPathspecError(message)
+  } else {
+    gitEr = new GitUnknownError(message)
+  }
+  return Object.assign(gitEr, er)
+}
+
+module.exports = makeError

front/app/node_modules/@npmcli/git/lib/opts.js

@@ -0,0 +1,12 @@
+// Values we want to set if they're not already defined by the end user
+// This defaults to accepting new ssh host key fingerprints
+const gitEnv = {
+  GIT_ASKPASS: 'echo',
+  GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new',
+}
+module.exports = (opts = {}) => ({
+  stdioString: true,
+  ...opts,
+  shell: false,
+  env: opts.env || { ...gitEnv, ...process.env },
+})

front/app/node_modules/@npmcli/git/lib/revs.js

@@ -0,0 +1,28 @@
+const pinflight = require('promise-inflight')
+const spawn = require('./spawn.js')
+const LRU = require('lru-cache')
+
+const revsCache = new LRU({
+  max: 100,
+  ttl: 5 * 60 * 1000,
+})
+
+const linesToRevs = require('./lines-to-revs.js')
+
+module.exports = async (repo, opts = {}) => {
+  if (!opts.noGitRevCache) {
+    const cached = revsCache.get(repo)
+    if (cached) {
+      return cached
+    }
+  }
+
+  return pinflight(`ls-remote:${repo}`, () =>
+    spawn(['ls-remote', repo], opts)
+      .then(({ stdout }) => linesToRevs(stdout.trim().split('\n')))
+      .then(revs => {
+        revsCache.set(repo, revs)
+        return revs
+      })
+  )
+}

front/app/node_modules/@npmcli/git/lib/spawn.js

@@ -0,0 +1,44 @@
+const spawn = require('@npmcli/promise-spawn')
+const promiseRetry = require('promise-retry')
+const log = require('proc-log')
+const makeError = require('./make-error.js')
+const whichGit = require('./which.js')
+const makeOpts = require('./opts.js')
+
+module.exports = (gitArgs, opts = {}) => {
+  const gitPath = whichGit(opts)
+
+  if (gitPath instanceof Error) {
+    return Promise.reject(gitPath)
+  }
+
+  // undocumented option, mostly only here for tests
+  const args = opts.allowReplace || gitArgs[0] === '--no-replace-objects'
+    ? gitArgs
+    : ['--no-replace-objects', ...gitArgs]
+
+  let retryOpts = opts.retry
+  if (retryOpts === null || retryOpts === undefined) {
+    retryOpts = {
+      retries: opts.fetchRetries || 2,
+      factor: opts.fetchRetryFactor || 10,
+      maxTimeout: opts.fetchRetryMaxtimeout || 60000,
+      minTimeout: opts.fetchRetryMintimeout || 1000,
+    }
+  }
+  return promiseRetry((retryFn, number) => {
+    if (number !== 1) {
+      log.silly('git', `Retrying git command: ${
+        args.join(' ')} attempt # ${number}`)
+    }
+
+    return spawn(gitPath, args, makeOpts(opts))
+      .catch(er => {
+        const gitError = makeError(er)
+        if (!gitError.shouldRetry(number)) {
+          throw gitError
+        }
+        retryFn(gitError)
+      })
+  }, retryOpts)
+}

front/app/node_modules/@npmcli/git/lib/utils.js

@@ -0,0 +1,3 @@
+const isWindows = opts => (opts.fakePlatform || process.platform) === 'win32'
+
+exports.isWindows = isWindows

front/app/node_modules/@npmcli/git/lib/which.js

@@ -0,0 +1,18 @@
+const which = require('which')
+
+let gitPath
+try {
+  gitPath = which.sync('git')
+} catch {
+  // ignore errors
+}
+
+module.exports = (opts = {}) => {
+  if (opts.git) {
+    return opts.git
+  }
+  if (!gitPath || opts.git === false) {
+    return Object.assign(new Error('No git binary found in $PATH'), { code: 'ENOGIT' })
+  }
+  return gitPath
+}

front/app/node_modules/@npmcli/git/node_modules/.bin/node-which

@@ -0,0 +1 @@
+../which/bin/which.js

front/app/node_modules/@npmcli/git/node_modules/proc-log/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) GitHub, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

front/app/node_modules/@npmcli/git/node_modules/proc-log/README.md

@@ -0,0 +1,90 @@
+# proc-log
+
+Emits 'log' events on the process object which a log output listener can
+consume and print to the terminal.
+
+This is used by various modules within the npm CLI stack in order to send
+log events that can be consumed by a listener on the process object.
+
+## API
+
+* `log.error(...args)` calls `process.emit('log', 'error', ...args)`
+  The highest log level.  For printing extremely serious errors that
+  indicate something went wrong.
+* `log.warn(...args)` calls `process.emit('log', 'warn', ...args)`
+  A fairly high log level.  Things that the user needs to be aware of, but
+  which won't necessarily cause improper functioning of the system.
+* `log.notice(...args)` calls `process.emit('log', 'notice', ...args)`
+  Notices which are important, but not necessarily dangerous or a cause for
+  excess concern.
+* `log.info(...args)` calls `process.emit('log', 'info', ...args)`
+  Informative messages that may benefit the user, but aren't particularly
+  important.
+* `log.verbose(...args)` calls `process.emit('log', 'verbose', ...args)`
+  Noisy output that is more detail that most users will care about.
+* `log.silly(...args)` calls `process.emit('log', 'silly', ...args)`
+  Extremely noisy excessive logging messages that are typically only useful
+  for debugging.
+* `log.http(...args)` calls `process.emit('log', 'http', ...args)`
+  Information about HTTP requests made and/or completed.
+* `log.pause()` calls `process.emit('log', 'pause')`  Used to tell
+  the consumer to stop printing messages.
+* `log.resume()` calls `process.emit('log', 'resume')`
+  Used to tell the consumer that it is ok to print messages again.
+* `log.LEVELS` an array of strings of all log method names
+
+## Examples
+
+Every method calls `process.emit('log', level, ...otherArgs)` internally.
+So in order to consume those events you need to do `process.on('log', fn)`.
+
+### Colorize based on level
+
+Here's an example of how to consume `proc-log` events and colorize them
+based on level:
+
+```js
+const chalk = require('chalk')
+
+process.on('log', (level, ...args) => {
+  if (level === 'error') {
+    console.log(chalk.red(level), ...args)
+  } else {
+    console.log(chalk.blue(level), ...args)
+  }
+})
+```
+
+### Pause and resume
+
+`pause` and `resume` are included so you have the ability to tell your consumer
+that you want to pause or resume your display of logs. In the npm CLI we use
+this to buffer all logs on init until we know the correct loglevel to display.
+But we  also setup a second handler that writes everything to a file even if
+paused.
+
+```js
+let paused = true
+const buffer = []
+
+// this handler will buffer and replay logs only
+// after `procLog.resume()` is called
+process.on('log', (level, ...args) => {
+  if (level === 'resume') {
+    buffer.forEach((item) => console.log(...item))
+    paused = false
+    return
+  } 
+
+  if (paused) {
+    buffer.push([level, ...args])
+  } else {
+    console.log(level, ...args)
+  }
+})
+
+// this handler will write everything to a file
+process.on('log', (...args) => {
+  fs.appendFileSync('debug.log', args.join(' '))
+})
+```

front/app/node_modules/@npmcli/git/node_modules/proc-log/lib/index.js

@@ -0,0 +1,23 @@
+// emits 'log' events on the process
+const LEVELS = [
+  'notice',
+  'error',
+  'warn',
+  'info',
+  'verbose',
+  'http',
+  'silly',
+  'pause',
+  'resume',
+]
+
+const log = level => (...args) => process.emit('log', level, ...args)
+
+const logger = {}
+for (const level of LEVELS) {
+  logger[level] = log(level)
+}
+
+logger.LEVELS = LEVELS
+
+module.exports = logger

front/app/node_modules/@npmcli/git/node_modules/proc-log/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "proc-log",
+  "version": "3.0.0",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "main": "lib/index.js",
+  "description": "just emit 'log' events on the process object",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/proc-log.git"
+  },
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "scripts": {
+    "test": "tap",
+    "snap": "tap",
+    "posttest": "npm run lint",
+    "postsnap": "eslint index.js test/*.js --fix",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "lintfix": "npm run lint -- --fix",
+    "template-oss-apply": "template-oss-apply --force"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^3.0.1",
+    "@npmcli/template-oss": "4.5.1",
+    "tap": "^16.0.1"
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.5.1"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  }
+}

front/app/node_modules/@npmcli/git/node_modules/which/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

front/app/node_modules/@npmcli/git/node_modules/which/README.md

@@ -0,0 +1,48 @@
+# which
+
+Like the unix `which` utility.
+
+Finds the first instance of a specified executable in the PATH
+environment variable.  Does not cache the results, so `hash -r` is not
+needed when the PATH changes.
+
+## USAGE
+
+```javascript
+const which = require('which')
+
+// async usage
+// rejects if not found
+const resolved = await which('node')
+
+// if nothrow option is used, returns null if not found
+const resolvedOrNull = await which('node', { nothrow: true })
+
+// sync usage
+// throws if not found
+const resolved = which.sync('node')
+
+// if nothrow option is used, returns null if not found
+const resolvedOrNull = which.sync('node', { nothrow: true })
+
+// Pass options to override the PATH and PATHEXT environment vars.
+await which('node', { path: someOtherPath, pathExt: somePathExt })
+```
+
+## CLI USAGE
+
+Same as the BSD `which(1)` binary.
+
+```
+usage: which [-as] program ...
+```
+
+## OPTIONS
+
+You may pass an options object as the second argument.
+
+- `path`: Use instead of the `PATH` environment variable.
+- `pathExt`: Use instead of the `PATHEXT` environment variable.
+- `all`: Return all matches, instead of just the first one.  Note that
+  this means the function returns an array of strings instead of a
+  single string.

front/app/node_modules/@npmcli/git/node_modules/which/bin/which.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+const which = require('../lib')
+const argv = process.argv.slice(2)
+
+const usage = (err) => {
+  if (err) {
+    console.error(`which: ${err}`)
+  }
+  console.error('usage: which [-as] program ...')
+  process.exit(1)
+}
+
+if (!argv.length) {
+  return usage()
+}
+
+let dashdash = false
+const [commands, flags] = argv.reduce((acc, arg) => {
+  if (dashdash || arg === '--') {
+    dashdash = true
+    return acc
+  }
+
+  if (!/^-/.test(arg)) {
+    acc[0].push(arg)
+    return acc
+  }
+
+  for (const flag of arg.slice(1).split('')) {
+    if (flag === 's') {
+      acc[1].silent = true
+    } else if (flag === 'a') {
+      acc[1].all = true
+    } else {
+      usage(`illegal option -- ${flag}`)
+    }
+  }
+
+  return acc
+}, [[], {}])
+
+for (const command of commands) {
+  try {
+    const res = which.sync(command, { all: flags.all })
+    if (!flags.silent) {
+      console.log([].concat(res).join('\n'))
+    }
+  } catch (err) {
+    process.exitCode = 1
+  }
+}

front/app/node_modules/@npmcli/git/node_modules/which/lib/index.js

@@ -0,0 +1,110 @@
+const isexe = require('isexe')
+const { join, delimiter, sep, posix } = require('path')
+
+const isWindows = process.platform === 'win32'
+
+// used to check for slashed in commands passed in. always checks for the posix
+// seperator on all platforms, and checks for the current separator when not on
+// a posix platform. don't use the isWindows check for this since that is mocked
+// in tests but we still need the code to actually work when called. that is also
+// why it is ignored from coverage.
+/* istanbul ignore next */
+const rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? '' : sep}]`.replace(/(\\)/g, '\\$1'))
+const rRel = new RegExp(`^\\.${rSlash.source}`)
+
+const getNotFoundError = (cmd) =>
+  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
+
+const getPathInfo = (cmd, {
+  path: optPath = process.env.PATH,
+  pathExt: optPathExt = process.env.PATHEXT,
+  delimiter: optDelimiter = delimiter,
+}) => {
+  // If it has a slash, then we don't bother searching the pathenv.
+  // just check the file itself, and that's it.
+  const pathEnv = cmd.match(rSlash) ? [''] : [
+    // windows always checks the cwd first
+    ...(isWindows ? [process.cwd()] : []),
+    ...(optPath || /* istanbul ignore next: very unusual */ '').split(optDelimiter),
+  ]
+
+  if (isWindows) {
+    const pathExtExe = optPathExt || ['.EXE', '.CMD', '.BAT', '.COM'].join(optDelimiter)
+    const pathExt = pathExtExe.split(optDelimiter)
+    if (cmd.includes('.') && pathExt[0] !== '') {
+      pathExt.unshift('')
+    }
+    return { pathEnv, pathExt, pathExtExe }
+  }
+
+  return { pathEnv, pathExt: [''] }
+}
+
+const getPathPart = (raw, cmd) => {
+  const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw
+  const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : ''
+  return prefix + join(pathPart, cmd)
+}
+
+const which = async (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const envPart of pathEnv) {
+    const p = getPathPart(envPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = await isexe(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+const whichSync = (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const pathEnvPart of pathEnv) {
+    const p = getPathPart(pathEnvPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = isexe.sync(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+module.exports = which
+which.sync = whichSync

front/app/node_modules/@npmcli/git/node_modules/which/package.json

@@ -0,0 +1,50 @@
+{
+  "author": "GitHub Inc.",
+  "name": "which",
+  "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
+  "version": "3.0.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/node-which.git"
+  },
+  "main": "lib/index.js",
+  "bin": {
+    "node-which": "./bin/which.js"
+  },
+  "license": "ISC",
+  "dependencies": {
+    "isexe": "^2.0.0"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "tap": "^16.3.0"
+  },
+  "scripts": {
+    "test": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "snap": "tap",
+    "posttest": "npm run lint"
+  },
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "tap": {
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.8.0"
+  }
+}

front/app/node_modules/@npmcli/git/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@npmcli/git",
+  "version": "4.0.3",
+  "main": "lib/index.js",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "description": "a util for spawning git from npm CLI contexts",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/git.git"
+  },
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "scripts": {
+    "lint": "eslint \"**/*.js\"",
+    "snap": "tap",
+    "test": "tap",
+    "posttest": "npm run lint",
+    "postlint": "template-oss-check",
+    "lintfix": "npm run lint -- --fix",
+    "template-oss-apply": "template-oss-apply --force"
+  },
+  "tap": {
+    "check-coverage": true,
+    "coverage-map": "map.js",
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "npm-package-arg": "^10.0.0",
+    "rimraf": "^3.0.2",
+    "slash": "^3.0.0",
+    "tap": "^16.0.1"
+  },
+  "dependencies": {
+    "@npmcli/promise-spawn": "^6.0.0",
+    "lru-cache": "^7.4.4",
+    "mkdirp": "^1.0.4",
+    "npm-pick-manifest": "^8.0.0",
+    "proc-log": "^3.0.0",
+    "promise-inflight": "^1.0.1",
+    "promise-retry": "^2.0.1",
+    "semver": "^7.3.5",
+    "which": "^3.0.0"
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "windowsCI": false,
+    "version": "4.8.0"
+  }
+}

front/app/node_modules/@npmcli/installed-package-contents/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

front/app/node_modules/@npmcli/installed-package-contents/README.md

@@ -0,0 +1,109 @@
+# @npmcli/installed-package-contents
+
+Get the list of files installed in a package in node_modules, including
+bundled dependencies.
+
+This is useful if you want to remove a package node from the tree _without_
+removing its child nodes, for example to extract a new version of the
+dependency into place safely.
+
+It's sort of the reflection of [npm-packlist](http://npm.im/npm-packlist),
+but for listing out the _installed_ files rather than the files that _will_
+be installed.  This is of course a much simpler operation, because we don't
+have to handle ignore files or package.json `files` lists.
+
+## USAGE
+
+```js
+// programmatic usage
+const pkgContents = require('@npmcli/installed-package-contents')
+
+pkgContents({ path: 'node_modules/foo', depth: 1 }).then(files => {
+  // files is an array of items that need to be passed to
+  // rimraf or moved out of the way to make the folder empty
+  // if foo bundled dependencies, those will be included.
+  // It will not traverse into child directories, because we set
+  // depth:1 in the options.
+  // If the folder doesn't exist, this returns an empty array.
+})
+
+pkgContents({ path: 'node_modules/foo', depth: Infinity }).then(files => {
+  // setting depth:Infinity tells it to keep walking forever
+  // until it hits something that isn't a directory, so we'll
+  // just get the list of all files, but not their containing
+  // directories.
+})
+```
+
+As a CLI:
+
+```bash
+$ installed-package-contents node_modules/bundle-some -d1
+node_modules/.bin/some
+node_modules/bundle-some/package.json
+node_modules/bundle-some/node_modules/@scope/baz
+node_modules/bundle-some/node_modules/.bin/foo
+node_modules/bundle-some/node_modules/foo
+```
+
+CLI options:
+
+```
+Usage:
+  installed-package-contents <path> [-d<n> --depth=<n>]
+
+Lists the files installed for a package specified by <path>.
+
+Options:
+  -d<n> --depth=<n>   Provide a numeric value ("Infinity" is allowed)
+                      to specify how deep in the file tree to traverse.
+                      Default=1
+  -h --help           Show this usage information
+```
+
+## OPTIONS
+
+* `depth` Number, default `1`.  How deep to traverse through folders to get
+    contents.  Typically you'd want to set this to either `1` (to get the
+    surface files and folders) or `Infinity` (to get all files), but any
+    other positive number is supported as well.  If set to `0` or a
+    negative number, returns the path provided and (if it is a package) its
+    set of linked bins.
+* `path` Required.  Path to the package in `node_modules` where traversal
+    should begin.
+
+## RETURN VALUE
+
+A Promise that resolves to an array of fully-resolved files and folders
+matching the criteria.  This includes all bundled dependencies in
+`node_modules`, and any linked executables in `node_modules/.bin` that the
+package caused to be installed.
+
+An empty or missing package folder will return an empty array.  Empty
+directories _within_ package contents are listed, even if the `depth`
+argument would cause them to be traversed into.
+
+## CAVEAT
+
+If using this module to generate a list of files that should be recursively
+removed to clear away the package, note that this will leave empty
+directories behind in certain cases:
+
+- If all child packages are bundled dependencies, then the
+    `node_modules` folder will remain.
+- If all child packages within a given scope were bundled dependencies,
+    then the `node_modules/@scope` folder will remain.
+- If all linked bin scripts were removed, then an empty `node_modules/.bin`
+    folder will remain.
+
+In the interest of speed and algorithmic complexity, this module does _not_
+do a subsequent readdir to see if it would remove all directory entries,
+though it would be easier to look at if it returned `node_modules` or
+`.bin` in that case rather than the contents.  However, if the intent is to
+pass these arguments to `rimraf`, it hardly makes sense to do _two_
+`readdir` calls just so that we can have the luxury of having to make a
+third.
+
+Since the primary use case is to delete a package's contents so that they
+can be re-filled with a new version of that package, this caveat does not
+pose a problem.  Empty directories are already ignored by both npm and git.

front/app/node_modules/@npmcli/installed-package-contents/lib/index.js

@@ -0,0 +1,240 @@
+// to GET CONTENTS for folder at PATH (which may be a PACKAGE):
+// - if PACKAGE, read path/package.json
+//   - if bins in ../node_modules/.bin, add those to result
+// - if depth >= maxDepth, add PATH to result, and finish
+// - readdir(PATH, with file types)
+// - add all FILEs in PATH to result
+// - if PARENT:
+//   - if depth < maxDepth, add GET CONTENTS of all DIRs in PATH
+//   - else, add all DIRs in PATH
+// - if no parent
+//   - if no bundled deps,
+//     - if depth < maxDepth, add GET CONTENTS of DIRs in path except
+//       node_modules
+//     - else, add all DIRs in path other than node_modules
+//   - if has bundled deps,
+//     - get list of bundled deps
+//     - add GET CONTENTS of bundled deps, PACKAGE=true, depth + 1
+
+const bundled = require('npm-bundled')
+const { promisify } = require('util')
+const fs = require('fs')
+const readFile = promisify(fs.readFile)
+const readdir = promisify(fs.readdir)
+const stat = promisify(fs.stat)
+const lstat = promisify(fs.lstat)
+const { relative, resolve, basename, dirname } = require('path')
+const normalizePackageBin = require('npm-normalize-package-bin')
+
+const readPackage = ({ path, packageJsonCache }) =>
+  packageJsonCache.has(path) ? Promise.resolve(packageJsonCache.get(path))
+  : readFile(path).then(json => {
+    const pkg = normalizePackageBin(JSON.parse(json))
+    packageJsonCache.set(path, pkg)
+    return pkg
+  })
+    .catch(er => null)
+
+// just normalize bundle deps and bin, that's all we care about here.
+const normalized = Symbol('package data has been normalized')
+const rpj = ({ path, packageJsonCache }) =>
+  readPackage({ path, packageJsonCache })
+    .then(pkg => {
+      if (!pkg || pkg[normalized]) {
+        return pkg
+      }
+      if (pkg.bundledDependencies && !pkg.bundleDependencies) {
+        pkg.bundleDependencies = pkg.bundledDependencies
+        delete pkg.bundledDependencies
+      }
+      const bd = pkg.bundleDependencies
+      if (bd === true) {
+        pkg.bundleDependencies = [
+          ...Object.keys(pkg.dependencies || {}),
+          ...Object.keys(pkg.optionalDependencies || {}),
+        ]
+      }
+      if (typeof bd === 'object' && !Array.isArray(bd)) {
+        pkg.bundleDependencies = Object.keys(bd)
+      }
+      pkg[normalized] = true
+      return pkg
+    })
+
+const pkgContents = async ({
+  path,
+  depth,
+  currentDepth = 0,
+  pkg = null,
+  result = null,
+  packageJsonCache = null,
+}) => {
+  if (!result) {
+    result = new Set()
+  }
+
+  if (!packageJsonCache) {
+    packageJsonCache = new Map()
+  }
+
+  if (pkg === true) {
+    return rpj({ path: path + '/package.json', packageJsonCache })
+      .then(p => pkgContents({
+        path,
+        depth,
+        currentDepth,
+        pkg: p,
+        result,
+        packageJsonCache,
+      }))
+  }
+
+  if (pkg) {
+    // add all bins to result if they exist
+    if (pkg.bin) {
+      const dir = dirname(path)
+      const scope = basename(dir)
+      const nm = /^@.+/.test(scope) ? dirname(dir) : dir
+
+      const binFiles = []
+      Object.keys(pkg.bin).forEach(b => {
+        const base = resolve(nm, '.bin', b)
+        binFiles.push(base, base + '.cmd', base + '.ps1')
+      })
+
+      const bins = await Promise.all(
+        binFiles.map(b => stat(b).then(() => b).catch((er) => null))
+      )
+      bins.filter(b => b).forEach(b => result.add(b))
+    }
+  }
+
+  if (currentDepth >= depth) {
+    result.add(path)
+    return result
+  }
+
+  // we'll need bundle list later, so get that now in parallel
+  const [dirEntries, bundleDeps] = await Promise.all([
+    readdir(path, { withFileTypes: true }),
+    currentDepth === 0 && pkg && pkg.bundleDependencies
+      ? bundled({ path, packageJsonCache }) : null,
+  ]).catch(() => [])
+
+  // not a thing, probably a missing folder
+  if (!dirEntries) {
+    return result
+  }
+
+  // empty folder, just add the folder itself to the result
+  if (!dirEntries.length && !bundleDeps && currentDepth !== 0) {
+    result.add(path)
+    return result
+  }
+
+  const recursePromises = []
+
+  // if we didn't get withFileTypes support, tack that on
+  if (typeof dirEntries[0] === 'string') {
+    // use a map so we can return a promise, but we mutate dirEntries in place
+    // this is much slower than getting the entries from the readdir call,
+    // but polyfills support for node versions before 10.10
+    await Promise.all(dirEntries.map(async (name, index) => {
+      const p = resolve(path, name)
+      const st = await lstat(p)
+      dirEntries[index] = Object.assign(st, { name })
+    }))
+  }
+
+  for (const entry of dirEntries) {
+    const p = resolve(path, entry.name)
+    if (entry.isDirectory() === false) {
+      result.add(p)
+      continue
+    }
+
+    if (currentDepth !== 0 || entry.name !== 'node_modules') {
+      if (currentDepth < depth - 1) {
+        recursePromises.push(pkgContents({
+          path: p,
+          packageJsonCache,
+          depth,
+          currentDepth: currentDepth + 1,
+          result,
+        }))
+      } else {
+        result.add(p)
+      }
+      continue
+    }
+  }
+
+  if (bundleDeps) {
+    // bundle deps are all folders
+    // we always recurse to get pkg bins, but if currentDepth is too high,
+    // it'll return early before walking their contents.
+    recursePromises.push(...bundleDeps.map(dep => {
+      const p = resolve(path, 'node_modules', dep)
+      return pkgContents({
+        path: p,
+        packageJsonCache,
+        pkg: true,
+        depth,
+        currentDepth: currentDepth + 1,
+        result,
+      })
+    }))
+  }
+
+  if (recursePromises.length) {
+    await Promise.all(recursePromises)
+  }
+
+  return result
+}
+
+module.exports = ({ path, depth = 1, packageJsonCache }) => pkgContents({
+  path: resolve(path),
+  depth,
+  pkg: true,
+  packageJsonCache,
+}).then(results => [...results])
+
+if (require.main === module) {
+  const options = { path: null, depth: 1 }
+  const usage = `Usage:
+  installed-package-contents <path> [-d<n> --depth=<n>]
+
+Lists the files installed for a package specified by <path>.
+
+Options:
+  -d<n> --depth=<n>   Provide a numeric value ("Infinity" is allowed)
+                      to specify how deep in the file tree to traverse.
+                      Default=1
+  -h --help           Show this usage information`
+
+  process.argv.slice(2).forEach(arg => {
+    let match
+    if ((match = arg.match(/^--depth=([0-9]+|Infinity)/)) ||
+        (match = arg.match(/^-d([0-9]+|Infinity)/))) {
+      options.depth = +match[1]
+    } else if (arg === '-h' || arg === '--help') {
+      console.log(usage)
+      process.exit(0)
+    } else {
+      options.path = arg
+    }
+  })
+  if (!options.path) {
+    console.error('ERROR: no path provided')
+    console.error(usage)
+    process.exit(1)
+  }
+  const cwd = process.cwd()
+  module.exports(options)
+    .then(list => list.sort().forEach(p => console.log(relative(cwd, p))))
+    .catch(/* istanbul ignore next - pretty unusual */ er => {
+      console.error(er)
+      process.exit(1)
+    })
+}

front/app/node_modules/@npmcli/installed-package-contents/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@npmcli/installed-package-contents",
+  "version": "2.0.1",
+  "description": "Get the list of files installed in a package in node_modules, including bundled dependencies",
+  "author": "GitHub Inc.",
+  "main": "lib/index.js",
+  "bin": {
+    "installed-package-contents": "lib/index.js"
+  },
+  "license": "ISC",
+  "scripts": {
+    "test": "tap",
+    "snap": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "posttest": "npm run lint"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.6.2",
+    "mkdirp": "^1.0.4",
+    "require-inject": "^1.4.4",
+    "tap": "^16.3.0"
+  },
+  "dependencies": {
+    "npm-bundled": "^3.0.0",
+    "npm-normalize-package-bin": "^3.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/installed-package-contents.git"
+  },
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.6.2"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  }
+}

front/app/node_modules/@npmcli/move-file/LICENSE.md

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+Copyright (c) npm, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the "Software"),
+to deal in the Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

front/app/node_modules/@npmcli/move-file/README.md

@@ -0,0 +1,69 @@
+# @npmcli/move-file
+
+A fork of [move-file](https://github.com/sindresorhus/move-file) with
+compatibility with all node 10.x versions.
+
+> Move a file (or directory)
+
+The built-in
+[`fs.rename()`](https://nodejs.org/api/fs.html#fs_fs_rename_oldpath_newpath_callback)
+is just a JavaScript wrapper for the C `rename(2)` function, which doesn't
+support moving files across partitions or devices. This module is what you
+would have expected `fs.rename()` to be.
+
+## Highlights
+
+- Promise API.
+- Supports moving a file across partitions and devices.
+- Optionally prevent overwriting an existing file.
+- Creates non-existent destination directories for you.
+- Support for Node versions that lack built-in recursive `fs.mkdir()`
+- Automatically recurses when source is a directory.
+
+## Install
+
+```
+$ npm install @npmcli/move-file
+```
+
+## Usage
+
+```js
+const moveFile = require('@npmcli/move-file');
+
+(async () => {
+	await moveFile('source/unicorn.png', 'destination/unicorn.png');
+	console.log('The file has been moved');
+})();
+```
+
+## API
+
+### moveFile(source, destination, options?)
+
+Returns a `Promise` that resolves when the file has been moved.
+
+### moveFile.sync(source, destination, options?)
+
+#### source
+
+Type: `string`
+
+File, or directory, you want to move.
+
+#### destination
+
+Type: `string`
+
+Where you want the file or directory moved.
+
+#### options
+
+Type: `object`
+
+##### overwrite
+
+Type: `boolean`\
+Default: `true`
+
+Overwrite existing destination file(s).

front/app/node_modules/@npmcli/move-file/lib/index.js

@@ -0,0 +1,185 @@
+const { dirname, join, resolve, relative, isAbsolute } = require('path')
+const rimraf_ = require('rimraf')
+const { promisify } = require('util')
+const {
+  access: access_,
+  accessSync,
+  copyFile: copyFile_,
+  copyFileSync,
+  readdir: readdir_,
+  readdirSync,
+  rename: rename_,
+  renameSync,
+  stat: stat_,
+  statSync,
+  lstat: lstat_,
+  lstatSync,
+  symlink: symlink_,
+  symlinkSync,
+  readlink: readlink_,
+  readlinkSync,
+} = require('fs')
+
+const access = promisify(access_)
+const copyFile = promisify(copyFile_)
+const readdir = promisify(readdir_)
+const rename = promisify(rename_)
+const stat = promisify(stat_)
+const lstat = promisify(lstat_)
+const symlink = promisify(symlink_)
+const readlink = promisify(readlink_)
+const rimraf = promisify(rimraf_)
+const rimrafSync = rimraf_.sync
+
+const mkdirp = require('mkdirp')
+
+const pathExists = async path => {
+  try {
+    await access(path)
+    return true
+  } catch (er) {
+    return er.code !== 'ENOENT'
+  }
+}
+
+const pathExistsSync = path => {
+  try {
+    accessSync(path)
+    return true
+  } catch (er) {
+    return er.code !== 'ENOENT'
+  }
+}
+
+const moveFile = async (source, destination, options = {}, root = true, symlinks = []) => {
+  if (!source || !destination) {
+    throw new TypeError('`source` and `destination` file required')
+  }
+
+  options = {
+    overwrite: true,
+    ...options,
+  }
+
+  if (!options.overwrite && await pathExists(destination)) {
+    throw new Error(`The destination file exists: ${destination}`)
+  }
+
+  await mkdirp(dirname(destination))
+
+  try {
+    await rename(source, destination)
+  } catch (error) {
+    if (error.code === 'EXDEV' || error.code === 'EPERM') {
+      const sourceStat = await lstat(source)
+      if (sourceStat.isDirectory()) {
+        const files = await readdir(source)
+        await Promise.all(files.map((file) =>
+          moveFile(join(source, file), join(destination, file), options, false, symlinks)
+        ))
+      } else if (sourceStat.isSymbolicLink()) {
+        symlinks.push({ source, destination })
+      } else {
+        await copyFile(source, destination)
+      }
+    } else {
+      throw error
+    }
+  }
+
+  if (root) {
+    await Promise.all(symlinks.map(async ({ source: symSource, destination: symDestination }) => {
+      let target = await readlink(symSource)
+      // junction symlinks in windows will be absolute paths, so we need to
+      // make sure they point to the symlink destination
+      if (isAbsolute(target)) {
+        target = resolve(symDestination, relative(symSource, target))
+      }
+      // try to determine what the actual file is so we can create the correct
+      // type of symlink in windows
+      let targetStat = 'file'
+      try {
+        targetStat = await stat(resolve(dirname(symSource), target))
+        if (targetStat.isDirectory()) {
+          targetStat = 'junction'
+        }
+      } catch {
+        // targetStat remains 'file'
+      }
+      await symlink(
+        target,
+        symDestination,
+        targetStat
+      )
+    }))
+    await rimraf(source)
+  }
+}
+
+const moveFileSync = (source, destination, options = {}, root = true, symlinks = []) => {
+  if (!source || !destination) {
+    throw new TypeError('`source` and `destination` file required')
+  }
+
+  options = {
+    overwrite: true,
+    ...options,
+  }
+
+  if (!options.overwrite && pathExistsSync(destination)) {
+    throw new Error(`The destination file exists: ${destination}`)
+  }
+
+  mkdirp.sync(dirname(destination))
+
+  try {
+    renameSync(source, destination)
+  } catch (error) {
+    if (error.code === 'EXDEV' || error.code === 'EPERM') {
+      const sourceStat = lstatSync(source)
+      if (sourceStat.isDirectory()) {
+        const files = readdirSync(source)
+        for (const file of files) {
+          moveFileSync(join(source, file), join(destination, file), options, false, symlinks)
+        }
+      } else if (sourceStat.isSymbolicLink()) {
+        symlinks.push({ source, destination })
+      } else {
+        copyFileSync(source, destination)
+      }
+    } else {
+      throw error
+    }
+  }
+
+  if (root) {
+    for (const { source: symSource, destination: symDestination } of symlinks) {
+      let target = readlinkSync(symSource)
+      // junction symlinks in windows will be absolute paths, so we need to
+      // make sure they point to the symlink destination
+      if (isAbsolute(target)) {
+        target = resolve(symDestination, relative(symSource, target))
+      }
+      // try to determine what the actual file is so we can create the correct
+      // type of symlink in windows
+      let targetStat = 'file'
+      try {
+        targetStat = statSync(resolve(dirname(symSource), target))
+        if (targetStat.isDirectory()) {
+          targetStat = 'junction'
+        }
+      } catch {
+        // targetStat remains 'file'
+      }
+      symlinkSync(
+        target,
+        symDestination,
+        targetStat
+      )
+    }
+    rimrafSync(source)
+  }
+}
+
+module.exports = moveFile
+module.exports.sync = moveFileSync

front/app/node_modules/@npmcli/move-file/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@npmcli/move-file",
+  "version": "2.0.1",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "main": "lib/index.js",
+  "description": "move a file (fork of move-file)",
+  "dependencies": {
+    "mkdirp": "^1.0.4",
+    "rimraf": "^3.0.2"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^3.0.1",
+    "@npmcli/template-oss": "3.5.0",
+    "tap": "^16.0.1"
+  },
+  "scripts": {
+    "test": "tap",
+    "snap": "tap",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "posttest": "npm run lint"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/move-file.git"
+  },
+  "tap": {
+    "check-coverage": true
+  },
+  "license": "MIT",
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+  },
+  "author": "GitHub Inc.",
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "3.5.0"
+  }
+}

front/app/node_modules/@npmcli/node-gyp/README.md

@@ -0,0 +1,16 @@
+# @npmcli/node-gyp
+
+This is the module npm uses to decide whether a package should be built
+using [`node-gyp`](https://github.com/nodejs/node-gyp) by default.
+
+## API
+
+* `isNodeGypPackage(path)`
+
+Returns a Promise that resolves to `true` or `false` based on whether the
+package at `path` has a `binding.gyp` file.
+
+* `defaultGypInstallScript`
+
+A string with the default string that should be used as the `install`
+script for node-gyp packages.

front/app/node_modules/@npmcli/node-gyp/lib/index.js

@@ -0,0 +1,14 @@
+const util = require('util')
+const fs = require('fs')
+const { stat } = fs.promises || { stat: util.promisify(fs.stat) }
+
+async function isNodeGypPackage (path) {
+  return await stat(`${path}/binding.gyp`)
+    .then(st => st.isFile())
+    .catch(() => false)
+}
+
+module.exports = {
+  isNodeGypPackage,
+  defaultGypInstallScript: 'node-gyp rebuild',
+}

front/app/node_modules/@npmcli/node-gyp/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@npmcli/node-gyp",
+  "version": "3.0.0",
+  "description": "Tools for dealing with node-gyp packages",
+  "scripts": {
+    "test": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "snap": "tap",
+    "posttest": "npm run lint"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/node-gyp.git"
+  },
+  "keywords": [
+    "npm",
+    "cli",
+    "node-gyp"
+  ],
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "main": "lib/index.js",
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "devDependencies": {
+    "@npmcli/eslint-config": "^3.0.1",
+    "@npmcli/template-oss": "4.5.1",
+    "tap": "^16.0.1"
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.5.1"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  }
+}

front/app/node_modules/@npmcli/promise-spawn/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE NPM DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE NPM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT,
+OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.

front/app/node_modules/@npmcli/promise-spawn/README.md

@@ -0,0 +1,79 @@
+# @npmcli/promise-spawn
+
+Spawn processes the way the npm cli likes to do.  Give it some options,
+it'll give you a Promise that resolves or rejects based on the results of
+the execution.
+
+## USAGE
+
+```js
+const promiseSpawn = require('@npmcli/promise-spawn')
+
+promiseSpawn('ls', [ '-laF', 'some/dir/*.js' ], {
+  cwd: '/tmp/some/path', // defaults to process.cwd()
+  stdioString: true, // stdout/stderr as strings rather than buffers
+  stdio: 'pipe', // any node spawn stdio arg is valid here
+  // any other arguments to node child_process.spawn can go here as well,
+}, {
+  extra: 'things',
+  to: 'decorate',
+  the: 'result',
+}).then(result => {
+  // {code === 0, signal === null, stdout, stderr, and all the extras}
+  console.log('ok!', result)
+}).catch(er => {
+  // er has all the same properties as the result, set appropriately
+  console.error('failed!', er)
+})
+```
+
+## API
+
+### `promiseSpawn(cmd, args, opts, extra)` -> `Promise`
+
+Run the command, return a Promise that resolves/rejects based on the
+process result.
+
+Result or error will be decorated with the properties in the `extra`
+object.  You can use this to attach some helpful info about _why_ the
+command is being run, if it makes sense for your use case.
+
+If `stdio` is set to anything other than `'inherit'`, then the result/error
+will be decorated with `stdout` and `stderr` values.  If `stdioString` is
+set to `true`, these will be strings.  Otherwise they will be Buffer
+objects.
+
+Returned promise is decorated with the `stdin` stream if the process is set
+to pipe from `stdin`.  Writing to this stream writes to the `stdin` of the
+spawned process.
+
+#### Options
+
+- `stdioString` Boolean, default `true`.  Return stdout/stderr output as
+  strings rather than buffers.
+- `cwd` String, default `process.cwd()`.  Current working directory for
+  running the script.  Also the argument to `infer-owner` to determine
+  effective uid/gid when run as root on Unix systems.
+- `shell` Boolean or String. If false, no shell is used during spawn. If true,
+  the system default shell is used. If a String, that specific shell is used.
+  When a shell is used, the given command runs from within that shell by
+  concatenating the command and its escaped arguments and running the result.
+  This option is _not_ passed through to `child_process.spawn`.
+- Any other options for `child_process.spawn` can be passed as well.
+
+### `promiseSpawn.open(arg, opts, extra)` -> `Promise`
+
+Use the operating system to open `arg` with a default program. This is useful
+for things like opening the user's default browser to a specific URL.
+
+Depending on the platform in use this will use `start` (win32), `open` (darwin)
+or `xdg-open` (everything else). In the case of Windows Subsystem for Linux we
+use the default win32 behavior as it is much more predictable to open the arg
+using the host operating system.
+
+#### Options
+
+Options are identical to `promiseSpawn` except for the following:
+
+- `command` String, the command to use to open the file in question. Default is
+   one of `start`, `open` or `xdg-open` depending on platform in use.

front/app/node_modules/@npmcli/promise-spawn/lib/escape.js

@@ -0,0 +1,68 @@
+'use strict'
+
+// eslint-disable-next-line max-len
+// this code adapted from: https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/
+const cmd = (input, doubleEscape) => {
+  if (!input.length) {
+    return '""'
+  }
+
+  let result
+  if (!/[ \t\n\v"]/.test(input)) {
+    result = input
+  } else {
+    result = '"'
+    for (let i = 0; i <= input.length; ++i) {
+      let slashCount = 0
+      while (input[i] === '\\') {
+        ++i
+        ++slashCount
+      }
+
+      if (i === input.length) {
+        result += '\\'.repeat(slashCount * 2)
+        break
+      }
+
+      if (input[i] === '"') {
+        result += '\\'.repeat(slashCount * 2 + 1)
+        result += input[i]
+      } else {
+        result += '\\'.repeat(slashCount)
+        result += input[i]
+      }
+    }
+    result += '"'
+  }
+
+  // and finally, prefix shell meta chars with a ^
+  result = result.replace(/[ !%^&()<>|"]/g, '^$&')
+  if (doubleEscape) {
+    result = result.replace(/[ !%^&()<>|"]/g, '^$&')
+  }
+
+  return result
+}
+
+const sh = (input) => {
+  if (!input.length) {
+    return `''`
+  }
+
+  if (!/[\t\n\r "#$&'()*;<>?\\`|~]/.test(input)) {
+    return input
+  }
+
+  // replace single quotes with '\'' and wrap the whole result in a fresh set of quotes
+  const result = `'${input.replace(/'/g, `'\\''`)}'`
+    // if the input string already had single quotes around it, clean those up
+    .replace(/^(?:'')+(?!$)/, '')
+    .replace(/\\'''/g, `\\'`)
+
+  return result
+}
+
+module.exports = {
+  cmd,
+  sh,
+}

front/app/node_modules/@npmcli/promise-spawn/lib/index.js

@@ -0,0 +1,195 @@
+'use strict'
+
+const { spawn } = require('child_process')
+const os = require('os')
+const which = require('which')
+
+const escape = require('./escape.js')
+
+// 'extra' object is for decorating the error a bit more
+const promiseSpawn = (cmd, args, opts = {}, extra = {}) => {
+  if (opts.shell) {
+    return spawnWithShell(cmd, args, opts, extra)
+  }
+
+  let proc
+
+  const p = new Promise((res, rej) => {
+    proc = spawn(cmd, args, opts)
+
+    const stdout = []
+    const stderr = []
+
+    const reject = er => rej(Object.assign(er, {
+      cmd,
+      args,
+      ...stdioResult(stdout, stderr, opts),
+      ...extra,
+    }))
+
+    proc.on('error', reject)
+
+    if (proc.stdout) {
+      proc.stdout.on('data', c => stdout.push(c)).on('error', reject)
+      proc.stdout.on('error', er => reject(er))
+    }
+
+    if (proc.stderr) {
+      proc.stderr.on('data', c => stderr.push(c)).on('error', reject)
+      proc.stderr.on('error', er => reject(er))
+    }
+
+    proc.on('close', (code, signal) => {
+      const result = {
+        cmd,
+        args,
+        code,
+        signal,
+        ...stdioResult(stdout, stderr, opts),
+        ...extra,
+      }
+
+      if (code || signal) {
+        rej(Object.assign(new Error('command failed'), result))
+      } else {
+        res(result)
+      }
+    })
+  })
+
+  p.stdin = proc.stdin
+  p.process = proc
+  return p
+}
+
+const spawnWithShell = (cmd, args, opts, extra) => {
+  let command = opts.shell
+  // if shell is set to true, we use a platform default. we can't let the core
+  // spawn method decide this for us because we need to know what shell is in use
+  // ahead of time so that we can escape arguments properly. we don't need coverage here.
+  if (command === true) {
+    // istanbul ignore next
+    command = process.platform === 'win32' ? process.env.ComSpec : 'sh'
+  }
+
+  const options = { ...opts, shell: false }
+  const realArgs = []
+  let script = cmd
+
+  // first, determine if we're in windows because if we are we need to know if we're
+  // running an .exe or a .cmd/.bat since the latter requires extra escaping
+  const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(command)
+  if (isCmd) {
+    let doubleEscape = false
+
+    // find the actual command we're running
+    let initialCmd = ''
+    let insideQuotes = false
+    for (let i = 0; i < cmd.length; ++i) {
+      const char = cmd.charAt(i)
+      if (char === ' ' && !insideQuotes) {
+        break
+      }
+
+      initialCmd += char
+      if (char === '"' || char === "'") {
+        insideQuotes = !insideQuotes
+      }
+    }
+
+    let pathToInitial
+    try {
+      pathToInitial = which.sync(initialCmd, {
+        path: (options.env && options.env.PATH) || process.env.PATH,
+        pathext: (options.env && options.env.PATHEXT) || process.env.PATHEXT,
+      }).toLowerCase()
+    } catch (err) {
+      pathToInitial = initialCmd.toLowerCase()
+    }
+
+    doubleEscape = pathToInitial.endsWith('.cmd') || pathToInitial.endsWith('.bat')
+    for (const arg of args) {
+      script += ` ${escape.cmd(arg, doubleEscape)}`
+    }
+    realArgs.push('/d', '/s', '/c', script)
+    options.windowsVerbatimArguments = true
+  } else {
+    for (const arg of args) {
+      script += ` ${escape.sh(arg)}`
+    }
+    realArgs.push('-c', script)
+  }
+
+  return promiseSpawn(command, realArgs, options, extra)
+}
+
+// open a file with the default application as defined by the user's OS
+const open = (_args, opts = {}, extra = {}) => {
+  const options = { ...opts, shell: true }
+  const args = [].concat(_args)
+
+  let platform = process.platform
+  // process.platform === 'linux' may actually indicate WSL, if that's the case
+  // we want to treat things as win32 anyway so the host can open the argument
+  if (platform === 'linux' && os.release().toLowerCase().includes('microsoft')) {
+    platform = 'win32'
+  }
+
+  let command = options.command
+  if (!command) {
+    if (platform === 'win32') {
+      // spawnWithShell does not do the additional os.release() check, so we
+      // have to force the shell here to make sure we treat WSL as windows.
+      options.shell = process.env.ComSpec
+      // also, the start command accepts a title so to make sure that we don't
+      // accidentally interpret the first arg as the title, we stick an empty
+      // string immediately after the start command
+      command = 'start ""'
+    } else if (platform === 'darwin') {
+      command = 'open'
+    } else {
+      command = 'xdg-open'
+    }
+  }
+
+  return spawnWithShell(command, args, options, extra)
+}
+promiseSpawn.open = open
+
+const isPipe = (stdio = 'pipe', fd) => {
+  if (stdio === 'pipe' || stdio === null) {
+    return true
+  }
+
+  if (Array.isArray(stdio)) {
+    return isPipe(stdio[fd], fd)
+  }
+
+  return false
+}
+
+const stdioResult = (stdout, stderr, { stdioString = true, stdio }) => {
+  const result = {
+    stdout: null,
+    stderr: null,
+  }
+
+  // stdio is [stdin, stdout, stderr]
+  if (isPipe(stdio, 1)) {
+    result.stdout = Buffer.concat(stdout)
+    if (stdioString) {
+      result.stdout = result.stdout.toString().trim()
+    }
+  }
+
+  if (isPipe(stdio, 2)) {
+    result.stderr = Buffer.concat(stderr)
+    if (stdioString) {
+      result.stderr = result.stderr.toString().trim()
+    }
+  }
+
+  return result
+}
+
+module.exports = promiseSpawn

front/app/node_modules/@npmcli/promise-spawn/node_modules/.bin/node-which

@@ -0,0 +1 @@
+../which/bin/which.js

front/app/node_modules/@npmcli/promise-spawn/node_modules/which/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

front/app/node_modules/@npmcli/promise-spawn/node_modules/which/README.md

@@ -0,0 +1,48 @@
+# which
+
+Like the unix `which` utility.
+
+Finds the first instance of a specified executable in the PATH
+environment variable.  Does not cache the results, so `hash -r` is not
+needed when the PATH changes.
+
+## USAGE
+
+```javascript
+const which = require('which')
+
+// async usage
+// rejects if not found
+const resolved = await which('node')
+
+// if nothrow option is used, returns null if not found
+const resolvedOrNull = await which('node', { nothrow: true })
+
+// sync usage
+// throws if not found
+const resolved = which.sync('node')
+
+// if nothrow option is used, returns null if not found
+const resolvedOrNull = which.sync('node', { nothrow: true })
+
+// Pass options to override the PATH and PATHEXT environment vars.
+await which('node', { path: someOtherPath, pathExt: somePathExt })
+```
+
+## CLI USAGE
+
+Same as the BSD `which(1)` binary.
+
+```
+usage: which [-as] program ...
+```
+
+## OPTIONS
+
+You may pass an options object as the second argument.
+
+- `path`: Use instead of the `PATH` environment variable.
+- `pathExt`: Use instead of the `PATHEXT` environment variable.
+- `all`: Return all matches, instead of just the first one.  Note that
+  this means the function returns an array of strings instead of a
+  single string.

front/app/node_modules/@npmcli/promise-spawn/node_modules/which/bin/which.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+const which = require('../lib')
+const argv = process.argv.slice(2)
+
+const usage = (err) => {
+  if (err) {
+    console.error(`which: ${err}`)
+  }
+  console.error('usage: which [-as] program ...')
+  process.exit(1)
+}
+
+if (!argv.length) {
+  return usage()
+}
+
+let dashdash = false
+const [commands, flags] = argv.reduce((acc, arg) => {
+  if (dashdash || arg === '--') {
+    dashdash = true
+    return acc
+  }
+
+  if (!/^-/.test(arg)) {
+    acc[0].push(arg)
+    return acc
+  }
+
+  for (const flag of arg.slice(1).split('')) {
+    if (flag === 's') {
+      acc[1].silent = true
+    } else if (flag === 'a') {
+      acc[1].all = true
+    } else {
+      usage(`illegal option -- ${flag}`)
+    }
+  }
+
+  return acc
+}, [[], {}])
+
+for (const command of commands) {
+  try {
+    const res = which.sync(command, { all: flags.all })
+    if (!flags.silent) {
+      console.log([].concat(res).join('\n'))
+    }
+  } catch (err) {
+    process.exitCode = 1
+  }
+}

front/app/node_modules/@npmcli/promise-spawn/node_modules/which/lib/index.js

@@ -0,0 +1,110 @@
+const isexe = require('isexe')
+const { join, delimiter, sep, posix } = require('path')
+
+const isWindows = process.platform === 'win32'
+
+// used to check for slashed in commands passed in. always checks for the posix
+// seperator on all platforms, and checks for the current separator when not on
+// a posix platform. don't use the isWindows check for this since that is mocked
+// in tests but we still need the code to actually work when called. that is also
+// why it is ignored from coverage.
+/* istanbul ignore next */
+const rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? '' : sep}]`.replace(/(\\)/g, '\\$1'))
+const rRel = new RegExp(`^\\.${rSlash.source}`)
+
+const getNotFoundError = (cmd) =>
+  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
+
+const getPathInfo = (cmd, {
+  path: optPath = process.env.PATH,
+  pathExt: optPathExt = process.env.PATHEXT,
+  delimiter: optDelimiter = delimiter,
+}) => {
+  // If it has a slash, then we don't bother searching the pathenv.
+  // just check the file itself, and that's it.
+  const pathEnv = cmd.match(rSlash) ? [''] : [
+    // windows always checks the cwd first
+    ...(isWindows ? [process.cwd()] : []),
+    ...(optPath || /* istanbul ignore next: very unusual */ '').split(optDelimiter),
+  ]
+
+  if (isWindows) {
+    const pathExtExe = optPathExt || ['.EXE', '.CMD', '.BAT', '.COM'].join(optDelimiter)
+    const pathExt = pathExtExe.split(optDelimiter)
+    if (cmd.includes('.') && pathExt[0] !== '') {
+      pathExt.unshift('')
+    }
+    return { pathEnv, pathExt, pathExtExe }
+  }
+
+  return { pathEnv, pathExt: [''] }
+}
+
+const getPathPart = (raw, cmd) => {
+  const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw
+  const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : ''
+  return prefix + join(pathPart, cmd)
+}
+
+const which = async (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const envPart of pathEnv) {
+    const p = getPathPart(envPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = await isexe(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+const whichSync = (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const pathEnvPart of pathEnv) {
+    const p = getPathPart(pathEnvPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = isexe.sync(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+module.exports = which
+which.sync = whichSync

front/app/node_modules/@npmcli/promise-spawn/node_modules/which/package.json

@@ -0,0 +1,50 @@
+{
+  "author": "GitHub Inc.",
+  "name": "which",
+  "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
+  "version": "3.0.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/node-which.git"
+  },
+  "main": "lib/index.js",
+  "bin": {
+    "node-which": "./bin/which.js"
+  },
+  "license": "ISC",
+  "dependencies": {
+    "isexe": "^2.0.0"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "tap": "^16.3.0"
+  },
+  "scripts": {
+    "test": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "snap": "tap",
+    "posttest": "npm run lint"
+  },
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "tap": {
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.8.0"
+  }
+}

front/app/node_modules/@npmcli/promise-spawn/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@npmcli/promise-spawn",
+  "version": "6.0.2",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "main": "./lib/index.js",
+  "description": "spawn processes the way the npm cli likes to do",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/promise-spawn.git"
+  },
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "scripts": {
+    "test": "tap",
+    "snap": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "lintfix": "npm run lint -- --fix",
+    "posttest": "npm run lint",
+    "postsnap": "npm run lintfix --",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force"
+  },
+  "tap": {
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.11.0",
+    "minipass": "^4.0.0",
+    "spawk": "^1.7.1",
+    "tap": "^16.0.1"
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.11.0"
+  },
+  "dependencies": {
+    "which": "^3.0.0"
+  }
+}

front/app/node_modules/@npmcli/run-script/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

front/app/node_modules/@npmcli/run-script/README.md

@@ -0,0 +1,175 @@
+# @npmcli/run-script
+
+Run a lifecycle script for a package (descendant of npm-lifecycle)
+
+## USAGE
+
+```js
+const runScript = require('@npmcli/run-script')
+
+runScript({
+  // required, the script to run
+  event: 'install',
+
+  // extra args to pass to the command, defaults to []
+  args: [],
+
+  // required, the folder where the package lives
+  path: '/path/to/package/folder',
+
+  // optional, these paths will be put at the beginning of `$PATH`, even
+  // after run-script adds the node_modules/.bin folder(s) from
+  // `process.cwd()`. This is for commands like `npm init`, `npm exec`,
+  // and `npx` to make sure manually installed  packages come before
+  // anything that happens to be in the tree in `process.cwd()`.
+  binPaths: [
+    '/path/to/npx/node_modules/.bin',
+    '/path/to/npm/prefix/node_modules/.bin',
+  ]
+
+  // optional, defaults to /bin/sh on unix, or cmd.exe on windows
+  scriptShell: '/bin/bash',
+
+  // optional, passed directly to `@npmcli/promise-spawn` which defaults it to true
+  // return stdout and stderr as strings rather than buffers
+  stdioString: false,
+
+  // optional, additional environment variables to add
+  // note that process.env IS inherited by default
+  // Always set:
+  // - npm_package_json The package.json file in the folder
+  // - npm_lifecycle_event The event that this is being run for
+  // - npm_lifecycle_script The script being run
+  // The fields described in https://github.com/npm/rfcs/pull/183
+  env: {
+    npm_package_from: 'foo@bar',
+    npm_package_resolved: 'https://registry.npmjs.org/foo/-/foo-1.2.3.tgz',
+    npm_package_integrity: 'sha512-foobarbaz',
+  },
+
+  // defaults to 'pipe'.  Can also pass an array like you would to node's
+  // exec or spawn functions.  Note that if it's anything other than
+  // 'pipe' then the stdout/stderr values on the result will be missing.
+  // npm cli sets this to 'inherit' for explicit run-scripts (test, etc.)
+  // but leaves it as 'pipe' for install scripts that run in parallel.
+  stdio: 'inherit',
+
+  // print the package id and script, and the command to be run, like:
+  // > somepackage@1.2.3 postinstall
+  // > make all-the-things
+  // Defaults true when stdio:'inherit', otherwise suppressed
+  banner: true,
+})
+  .then(({ code, signal, stdout, stderr, pkgid, path, event, script }) => {
+    // do something with the results
+  })
+  .catch(er => {
+    // command did not work.
+    // er is decorated with:
+    // - code
+    // - signal
+    // - stdout
+    // - stderr
+    // - path
+    // - pkgid (name@version string)
+    // - event
+    // - script
+  })
+```
+
+## API
+
+Call the exported `runScript` function with an options object.
+
+Returns a promise that resolves to the result of the execution.  Promise
+rejects if the execution fails (exits non-zero) or has any other error.
+Rejected errors are decorated with the same values as the result object.
+
+If the stdio options mean that it'll have a piped stdin, then the stdin is
+ended immediately on the child process.  If stdin is shared with the parent
+terminal, then it is up to the user to end it, of course.
+
+### Results
+
+- `code` Process exit code
+- `signal` Process exit signal
+- `stdout` stdout data (Buffer, or String when `stdioString` set to true)
+- `stderr` stderr data (Buffer, or String when `stdioString` set to true)
+- `path` Path to the package executing its script
+- `event` Lifecycle event being run
+- `script` Command being run
+
+### Options
+
+- `path` Required.  The path to the package having its script run.
+- `event` Required.  The event being executed.
+- `args` Optional, default `[]`.  Extra arguments to pass to the script.
+- `env` Optional, object of fields to add to the environment of the
+  subprocess.  Note that process.env IS inherited by default These are
+  always set:
+  - `npm_package_json` The package.json file in the folder
+  - `npm_lifecycle_event` The event that this is being run for
+  - `npm_lifecycle_script` The script being run
+  - The `package.json` fields described in
+    [RFC183](https://github.com/npm/rfcs/pull/183/files).
+- `scriptShell` Optional, defaults to `/bin/sh` on Unix, defaults to
+  `env.ComSpec` or `cmd` on Windows.  Custom script to use to execute the
+  command.
+- `stdio` Optional, defaults to `'pipe'`.  The same as the `stdio` argument
+  passed to `child_process` functions in Node.js.  Note that if a stdio
+  output is set to anything other than `pipe`, it will not be present in
+  the result/error object.
+- `cmd` Optional.  Override the script from the `package.json` with
+  something else, which will be run in an otherwise matching environment.
+- `stdioString` Optional, passed directly to `@npmcli/promise-spawn` which
+  defaults it to `true`.  Return string values for `stderr` and `stdout` rather
+  than Buffers.
+- `banner` Optional, defaults to `true`.  If the `stdio` option is set to
+  `'inherit'`, then print a banner with the package name and version, event
+  name, and script command to be run.  Set explicitly to `false` to disable
+  for inherited stdio.
+
+Note that this does _not_ run pre-event and post-event scripts.  The
+caller has to manage that process themselves.
+
+## Differences from [npm-lifecycle](https://github.com/npm/npm-lifecycle)
+
+This is an implementation to satisfy [RFC
+90](https://github.com/npm/rfcs/pull/90), [RFC
+77](https://github.com/npm/rfcs/pull/77), and [RFC
+73](https://github.com/npm/rfcs/pull/73).
+
+Apart from those behavior changes in npm v7, this is also just refresh of
+the codebase, with modern coding techniques and better test coverage.
+
+Functionally, this means:
+
+- Output is not dumped to the top level process's stdio by default.
+- Less stuff is put into the environment.
+- It is not opinionated about logging.  (So, at least with the logging
+  framework in npm v7.0 and before, the caller has to call
+  `log.disableProgress()` and `log.enableProgress()` at the appropriate
+  times, if necessary.)
+- The directory containing the `node` executable is _never_ added to the
+  `PATH` environment variable.  (Ie, `--scripts-prepend-node-path` is
+  effectively always set to `false`.)  Doing so causes more unintended side
+  effects than it ever prevented.
+- Hook scripts are not run by this module.  If the caller wishes to run
+  hook scripts, then they can override the default package script with an
+  explicit `cmd` option pointing to the `node_modules/.hook/${event}`
+  script.
+
+## Escaping
+
+In order to ensure that arguments are handled consistently, this module
+writes a temporary script file containing the command as it exists in
+the package.json, followed by the user supplied arguments having been
+escaped to ensure they are processed as literal strings. We then instruct
+the shell to execute the script file, and when the process exits we remove
+the temporary file.
+
+In Windows, when the shell is cmd, and when the initial command in the script
+is a known batch file (i.e. `something.cmd`) we double escape additional
+arguments so that the shim scripts npm installs work correctly.
+
+The actual implementation of the escaping is in `lib/escape.js`.

front/app/node_modules/@npmcli/run-script/lib/is-server-package.js

@@ -0,0 +1,12 @@
+const util = require('util')
+const fs = require('fs')
+const { stat } = fs.promises || { stat: util.promisify(fs.stat) }
+const { resolve } = require('path')
+module.exports = async path => {
+  try {
+    const st = await stat(resolve(path, 'server.js'))
+    return st.isFile()
+  } catch (er) {
+    return false
+  }
+}

front/app/node_modules/@npmcli/run-script/lib/is-windows.js

@@ -0,0 +1,2 @@
+const platform = process.env.__FAKE_TESTING_PLATFORM__ || process.platform
+module.exports = platform === 'win32'

front/app/node_modules/@npmcli/run-script/lib/make-spawn-args.js

@@ -0,0 +1,40 @@
+/* eslint camelcase: "off" */
+const setPATH = require('./set-path.js')
+const { resolve } = require('path')
+const npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
+
+const makeSpawnArgs = options => {
+  const {
+    event,
+    path,
+    scriptShell = true,
+    binPaths,
+    env = {},
+    stdio,
+    cmd,
+    args = [],
+    stdioString,
+  } = options
+
+  const spawnEnv = setPATH(path, binPaths, {
+    // we need to at least save the PATH environment var
+    ...process.env,
+    ...env,
+    npm_package_json: resolve(path, 'package.json'),
+    npm_lifecycle_event: event,
+    npm_lifecycle_script: cmd,
+    npm_config_node_gyp,
+  })
+
+  const spawnOpts = {
+    env: spawnEnv,
+    stdioString,
+    stdio,
+    cwd: path,
+    shell: scriptShell,
+  }
+
+  return [cmd, args, spawnOpts]
+}
+
+module.exports = makeSpawnArgs

front/app/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+node "$npm_config_node_gyp" "$@"

front/app/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp.cmd

@@ -0,0 +1 @@
+@node "%npm_config_node_gyp%" %*

front/app/node_modules/@npmcli/run-script/lib/package-envs.js

@@ -0,0 +1,26 @@
+// https://github.com/npm/rfcs/pull/183
+
+const envVal = val => Array.isArray(val) ? val.map(v => envVal(v)).join('\n\n')
+  : val === null || val === false ? ''
+  : String(val)
+
+const packageEnvs = (env, vals, prefix) => {
+  for (const [key, val] of Object.entries(vals)) {
+    if (val === undefined) {
+      continue
+    } else if (val && !Array.isArray(val) && typeof val === 'object') {
+      packageEnvs(env, val, `${prefix}${key}_`)
+    } else {
+      env[`${prefix}${key}`] = envVal(val)
+    }
+  }
+  return env
+}
+
+module.exports = (env, pkg) => packageEnvs({ ...env }, {
+  name: pkg.name,
+  version: pkg.version,
+  config: pkg.config,
+  engines: pkg.engines,
+  bin: pkg.bin,
+}, 'npm_package_')

front/app/node_modules/@npmcli/run-script/lib/run-script-pkg.js

@@ -0,0 +1,108 @@
+const makeSpawnArgs = require('./make-spawn-args.js')
+const promiseSpawn = require('@npmcli/promise-spawn')
+const packageEnvs = require('./package-envs.js')
+const { isNodeGypPackage, defaultGypInstallScript } = require('@npmcli/node-gyp')
+const signalManager = require('./signal-manager.js')
+const isServerPackage = require('./is-server-package.js')
+
+// you wouldn't like me when I'm angry...
+const bruce = (id, event, cmd, args) => {
+  let banner = id
+    ? `\n> ${id} ${event}\n`
+    : `\n> ${event}\n`
+  banner += `> ${cmd.trim().replace(/\n/g, '\n> ')}`
+  if (args.length) {
+    banner += ` ${args.join(' ')}`
+  }
+  banner += '\n'
+  return banner
+}
+
+const runScriptPkg = async options => {
+  const {
+    event,
+    path,
+    scriptShell,
+    binPaths = false,
+    env = {},
+    stdio = 'pipe',
+    pkg,
+    args = [],
+    stdioString,
+    // note: only used when stdio:inherit
+    banner = true,
+    // how long to wait for a process.kill signal
+    // only exposed here so that we can make the test go a bit faster.
+    signalTimeout = 500,
+  } = options
+
+  const { scripts = {}, gypfile } = pkg
+  let cmd = null
+  if (options.cmd) {
+    cmd = options.cmd
+  } else if (pkg.scripts && pkg.scripts[event]) {
+    cmd = pkg.scripts[event]
+  } else if (
+    // If there is no preinstall or install script, default to rebuilding node-gyp packages.
+    event === 'install' &&
+    !scripts.install &&
+    !scripts.preinstall &&
+    gypfile !== false &&
+    await isNodeGypPackage(path)
+  ) {
+    cmd = defaultGypInstallScript
+  } else if (event === 'start' && await isServerPackage(path)) {
+    cmd = 'node server.js'
+  }
+
+  if (!cmd) {
+    return { code: 0, signal: null }
+  }
+
+  if (stdio === 'inherit' && banner !== false) {
+    // we're dumping to the parent's stdout, so print the banner
+    console.log(bruce(pkg._id, event, cmd, args))
+  }
+
+  const [spawnShell, spawnArgs, spawnOpts] = makeSpawnArgs({
+    event,
+    path,
+    scriptShell,
+    binPaths,
+    env: packageEnvs(env, pkg),
+    stdio,
+    cmd,
+    args,
+    stdioString,
+  })
+
+  const p = promiseSpawn(spawnShell, spawnArgs, spawnOpts, {
+    event,
+    script: cmd,
+    pkgid: pkg._id,
+    path,
+  })
+
+  if (stdio === 'inherit') {
+    signalManager.add(p.process)
+  }
+
+  if (p.stdin) {
+    p.stdin.end()
+  }
+
+  return p.catch(er => {
+    const { signal } = er
+    if (stdio === 'inherit' && signal) {
+      process.kill(process.pid, signal)
+      // just in case we don't die, reject after 500ms
+      // this also keeps the node process open long enough to actually
+      // get the signal, rather than terminating gracefully.
+      return new Promise((res, rej) => setTimeout(() => rej(er), signalTimeout))
+    } else {
+      throw er
+    }
+  })
+}
+
+module.exports = runScriptPkg

front/app/node_modules/@npmcli/run-script/lib/run-script.js

@@ -0,0 +1,14 @@
+const rpj = require('read-package-json-fast')
+const runScriptPkg = require('./run-script-pkg.js')
+const validateOptions = require('./validate-options.js')
+const isServerPackage = require('./is-server-package.js')
+
+const runScript = options => {
+  validateOptions(options)
+  const { pkg, path } = options
+  return pkg ? runScriptPkg(options)
+    : rpj(path + '/package.json')
+      .then(readPackage => runScriptPkg({ ...options, pkg: readPackage }))
+}
+
+module.exports = Object.assign(runScript, { isServerPackage })

front/app/node_modules/@npmcli/run-script/lib/set-path.js

@@ -0,0 +1,45 @@
+const { resolve, dirname, delimiter } = require('path')
+// the path here is relative, even though it does not need to be
+// in order to make the posix tests pass in windows
+const nodeGypPath = resolve(__dirname, '../lib/node-gyp-bin')
+
+// Windows typically calls its PATH environ 'Path', but this is not
+// guaranteed, nor is it guaranteed to be the only one.  Merge them
+// all together in the order they appear in the object.
+const setPATH = (projectPath, binPaths, env) => {
+  const PATH = Object.keys(env).filter(p => /^path$/i.test(p) && env[p])
+    .map(p => env[p].split(delimiter))
+    .reduce((set, p) => set.concat(p.filter(concatted => !set.includes(concatted))), [])
+    .join(delimiter)
+
+  const pathArr = []
+  if (binPaths) {
+    pathArr.push(...binPaths)
+  }
+  // unshift the ./node_modules/.bin from every folder
+  // walk up until dirname() does nothing, at the root
+  // XXX we should specify a cwd that we don't go above
+  let p = projectPath
+  let pp
+  do {
+    pathArr.push(resolve(p, 'node_modules', '.bin'))
+    pp = p
+    p = dirname(p)
+  } while (p !== pp)
+  pathArr.push(nodeGypPath, PATH)
+
+  const pathVal = pathArr.join(delimiter)
+
+  // XXX include the node-gyp-bin path somehow?  Probably better for
+  // npm or arborist or whoever to just provide that by putting it in
+  // the PATH environ, since that's preserved anyway.
+  for (const key of Object.keys(env)) {
+    if (/^path$/i.test(key)) {
+      env[key] = pathVal
+    }
+  }
+
+  return env
+}
+
+module.exports = setPATH

front/app/node_modules/@npmcli/run-script/lib/signal-manager.js

@@ -0,0 +1,47 @@
+const runningProcs = new Set()
+let handlersInstalled = false
+
+const forwardedSignals = [
+  'SIGINT',
+  'SIGTERM',
+]
+
+const handleSignal = signal => {
+  for (const proc of runningProcs) {
+    proc.kill(signal)
+  }
+}
+
+const setupListeners = () => {
+  for (const signal of forwardedSignals) {
+    process.on(signal, handleSignal)
+  }
+  handlersInstalled = true
+}
+
+const cleanupListeners = () => {
+  if (runningProcs.size === 0) {
+    for (const signal of forwardedSignals) {
+      process.removeListener(signal, handleSignal)
+    }
+    handlersInstalled = false
+  }
+}
+
+const add = proc => {
+  runningProcs.add(proc)
+  if (!handlersInstalled) {
+    setupListeners()
+  }
+
+  proc.once('exit', () => {
+    runningProcs.delete(proc)
+    cleanupListeners()
+  })
+}
+
+module.exports = {
+  add,
+  handleSignal,
+  forwardedSignals,
+}

front/app/node_modules/@npmcli/run-script/lib/validate-options.js

@@ -0,0 +1,39 @@
+const validateOptions = options => {
+  if (typeof options !== 'object' || !options) {
+    throw new TypeError('invalid options object provided to runScript')
+  }
+
+  const {
+    event,
+    path,
+    scriptShell,
+    env = {},
+    stdio = 'pipe',
+    args = [],
+    cmd,
+  } = options
+
+  if (!event || typeof event !== 'string') {
+    throw new TypeError('valid event not provided to runScript')
+  }
+  if (!path || typeof path !== 'string') {
+    throw new TypeError('valid path not provided to runScript')
+  }
+  if (scriptShell !== undefined && typeof scriptShell !== 'string') {
+    throw new TypeError('invalid scriptShell option provided to runScript')
+  }
+  if (typeof env !== 'object' || !env) {
+    throw new TypeError('invalid env option provided to runScript')
+  }
+  if (typeof stdio !== 'string' && !Array.isArray(stdio)) {
+    throw new TypeError('invalid stdio option provided to runScript')
+  }
+  if (!Array.isArray(args) || args.some(a => typeof a !== 'string')) {
+    throw new TypeError('invalid args option provided to runScript')
+  }
+  if (cmd !== undefined && typeof cmd !== 'string') {
+    throw new TypeError('invalid cmd option provided to runScript')
+  }
+}
+
+module.exports = validateOptions

front/app/node_modules/@npmcli/run-script/node_modules/.bin/node-which

@@ -0,0 +1 @@
+../which/bin/which.js

front/app/node_modules/@npmcli/run-script/node_modules/which/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

front/app/node_modules/@npmcli/run-script/node_modules/which/README.md

@@ -0,0 +1,48 @@
+# which
+
+Like the unix `which` utility.
+
+Finds the first instance of a specified executable in the PATH
+environment variable.  Does not cache the results, so `hash -r` is not
+needed when the PATH changes.
+
+## USAGE
+
+```javascript
+const which = require('which')
+
+// async usage
+// rejects if not found
+const resolved = await which('node')
+
+// if nothrow option is used, returns null if not found
+const resolvedOrNull = await which('node', { nothrow: true })
+
+// sync usage
+// throws if not found
+const resolved = which.sync('node')
+
+// if nothrow option is used, returns null if not found
+const resolvedOrNull = which.sync('node', { nothrow: true })
+
+// Pass options to override the PATH and PATHEXT environment vars.
+await which('node', { path: someOtherPath, pathExt: somePathExt })
+```
+
+## CLI USAGE
+
+Same as the BSD `which(1)` binary.
+
+```
+usage: which [-as] program ...
+```
+
+## OPTIONS
+
+You may pass an options object as the second argument.
+
+- `path`: Use instead of the `PATH` environment variable.
+- `pathExt`: Use instead of the `PATHEXT` environment variable.
+- `all`: Return all matches, instead of just the first one.  Note that
+  this means the function returns an array of strings instead of a
+  single string.

front/app/node_modules/@npmcli/run-script/node_modules/which/bin/which.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+const which = require('../lib')
+const argv = process.argv.slice(2)
+
+const usage = (err) => {
+  if (err) {
+    console.error(`which: ${err}`)
+  }
+  console.error('usage: which [-as] program ...')
+  process.exit(1)
+}
+
+if (!argv.length) {
+  return usage()
+}
+
+let dashdash = false
+const [commands, flags] = argv.reduce((acc, arg) => {
+  if (dashdash || arg === '--') {
+    dashdash = true
+    return acc
+  }
+
+  if (!/^-/.test(arg)) {
+    acc[0].push(arg)
+    return acc
+  }
+
+  for (const flag of arg.slice(1).split('')) {
+    if (flag === 's') {
+      acc[1].silent = true
+    } else if (flag === 'a') {
+      acc[1].all = true
+    } else {
+      usage(`illegal option -- ${flag}`)
+    }
+  }
+
+  return acc
+}, [[], {}])
+
+for (const command of commands) {
+  try {
+    const res = which.sync(command, { all: flags.all })
+    if (!flags.silent) {
+      console.log([].concat(res).join('\n'))
+    }
+  } catch (err) {
+    process.exitCode = 1
+  }
+}

front/app/node_modules/@npmcli/run-script/node_modules/which/lib/index.js

@@ -0,0 +1,110 @@
+const isexe = require('isexe')
+const { join, delimiter, sep, posix } = require('path')
+
+const isWindows = process.platform === 'win32'
+
+// used to check for slashed in commands passed in. always checks for the posix
+// seperator on all platforms, and checks for the current separator when not on
+// a posix platform. don't use the isWindows check for this since that is mocked
+// in tests but we still need the code to actually work when called. that is also
+// why it is ignored from coverage.
+/* istanbul ignore next */
+const rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? '' : sep}]`.replace(/(\\)/g, '\\$1'))
+const rRel = new RegExp(`^\\.${rSlash.source}`)
+
+const getNotFoundError = (cmd) =>
+  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
+
+const getPathInfo = (cmd, {
+  path: optPath = process.env.PATH,
+  pathExt: optPathExt = process.env.PATHEXT,
+  delimiter: optDelimiter = delimiter,
+}) => {
+  // If it has a slash, then we don't bother searching the pathenv.
+  // just check the file itself, and that's it.
+  const pathEnv = cmd.match(rSlash) ? [''] : [
+    // windows always checks the cwd first
+    ...(isWindows ? [process.cwd()] : []),
+    ...(optPath || /* istanbul ignore next: very unusual */ '').split(optDelimiter),
+  ]
+
+  if (isWindows) {
+    const pathExtExe = optPathExt || ['.EXE', '.CMD', '.BAT', '.COM'].join(optDelimiter)
+    const pathExt = pathExtExe.split(optDelimiter)
+    if (cmd.includes('.') && pathExt[0] !== '') {
+      pathExt.unshift('')
+    }
+    return { pathEnv, pathExt, pathExtExe }
+  }
+
+  return { pathEnv, pathExt: [''] }
+}
+
+const getPathPart = (raw, cmd) => {
+  const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw
+  const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : ''
+  return prefix + join(pathPart, cmd)
+}
+
+const which = async (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const envPart of pathEnv) {
+    const p = getPathPart(envPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = await isexe(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+const whichSync = (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const pathEnvPart of pathEnv) {
+    const p = getPathPart(pathEnvPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = isexe.sync(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+module.exports = which
+which.sync = whichSync

front/app/node_modules/@npmcli/run-script/node_modules/which/package.json

@@ -0,0 +1,50 @@
+{
+  "author": "GitHub Inc.",
+  "name": "which",
+  "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
+  "version": "3.0.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/node-which.git"
+  },
+  "main": "lib/index.js",
+  "bin": {
+    "node-which": "./bin/which.js"
+  },
+  "license": "ISC",
+  "dependencies": {
+    "isexe": "^2.0.0"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "tap": "^16.3.0"
+  },
+  "scripts": {
+    "test": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "snap": "tap",
+    "posttest": "npm run lint"
+  },
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "tap": {
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.8.0"
+  }
+}

front/app/node_modules/@npmcli/run-script/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@npmcli/run-script",
+  "version": "6.0.0",
+  "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "scripts": {
+    "test": "tap",
+    "eslint": "eslint",
+    "lint": "eslint \"**/*.js\"",
+    "lintfix": "npm run lint -- --fix",
+    "postlint": "template-oss-check",
+    "snap": "tap",
+    "posttest": "npm run lint",
+    "template-oss-apply": "template-oss-apply --force"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "minipass": "^3.1.6",
+    "require-inject": "^1.4.4",
+    "tap": "^16.0.1"
+  },
+  "dependencies": {
+    "@npmcli/node-gyp": "^3.0.0",
+    "@npmcli/promise-spawn": "^6.0.0",
+    "node-gyp": "^9.0.0",
+    "read-package-json-fast": "^3.0.0",
+    "which": "^3.0.0"
+  },
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "main": "lib/run-script.js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/run-script.git"
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.8.0"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  }
+}