@descent-vtt/spec-harness 0.9.1 → 0.10.1

package/dist/manifests.js

@@ -8,6 +8,11 @@
  * declares dependencies and nothing more - no resolver, no lockfile, no
  * network. A manifest it cannot read is reported as unread, never as clean,
  * and so is a configured name it cannot read.
+ *
+ * The same holds for the one line that lets a dependency run code when it is
+ * installed. npm 12 runs a dependency's install scripts only where the root
+ * package's `allowScripts` allows the package, so an entry a round adds
+ * there turns on code that is nowhere in its diff.
  */
 import { globAlternatives, parseGlob } from './vendor/spec-core/pattern/index.js';
 /** The ecosystem a manifest file name belongs to, or `null`. */
@@ -82,7 +87,35 @@ function readNpm(text) {
         for (const [name, version] of Object.entries(table))
             out.push({ section, name, version: String(version) });
     }
-    return { ok: true, dependencies: out };
+    return { ok: true, dependencies: out, installScripts: npmInstallScripts(value) };
+}
+/**
+ * npm 12's install-script policy, where `npm install-scripts approve` and
+ * `deny` write it: a package, or a package at exact versions, to `true` or
+ * `false`.
+ */
+const NPM_INSTALL_SCRIPTS = 'allowScripts';
+/**
+ * The entries of `allowScripts`, read as npm reads them. It takes the field
+ * only when it is an object and an entry only when its value is `true` or
+ * `false`: anything else approves nothing and denies nothing, so it is no
+ * entry here either, and never a manifest that cannot be read. Each key is
+ * kept as written. Telling `canvas@1.2.3` from `canvas@^1`, which npm
+ * passes over, is npm's own reading of a package spec, and the audit names
+ * the entry for a person to read.
+ */
+function npmInstallScripts(manifest) {
+    const policy = manifest[NPM_INSTALL_SCRIPTS];
+    if (typeof policy !== 'object' || policy === null)
+        return [];
+    const out = [];
+    for (const [name, value] of Object.entries(policy)) {
+        if (value === true)
+            out.push({ section: NPM_INSTALL_SCRIPTS, name, verdict: 'allowed' });
+        else if (value === false)
+            out.push({ section: NPM_INSTALL_SCRIPTS, name, verdict: 'denied' });
+    }
+    return out;
 }
 /* -------------------------------------------------------------------- TOML */
 /** A TOML value on one line, or the start of a multi-line array. Comments and quotes read the way TOML reads them. */
@@ -312,11 +345,15 @@ function readGemfile(text) {
     }
     return { ok: true, dependencies: out };
 }
-/** Reads the dependencies a manifest declares. */
+/** Reads the dependencies a manifest declares, and the entries of its install-script policy where its format has one. */
 export function readManifest(ecosystem, text) {
+    if (ecosystem === 'npm')
+        return readNpm(text);
+    const read = readDependencies(ecosystem, text);
+    return read.ok ? { ...read, installScripts: [] } : read;
+}
+function readDependencies(ecosystem, text) {
     switch (ecosystem) {
-        case 'npm':
-            return readNpm(text);
         case 'cargo':
             return readCargo(text);
         case 'go':
@@ -331,17 +368,36 @@ export function readManifest(ecosystem, text) {
             return readGemfile(text);
     }
 }
+/** The entries added or said differently, in the order written, then those removed. */
+function moved(old, now) {
+    const key = (entry) => `${entry.section}\u0000${entry.name}`;
+    const was = new Map(old.map((entry) => [key(entry), entry]));
+    const is = new Map(now.map((entry) => [key(entry), entry]));
+    const out = [];
+    for (const [id, entry] of is) {
+        const previous = was.get(id);
+        if (previous === undefined || previous.value !== entry.value) {
+            out.push({ section: entry.section, name: entry.name, before: previous?.value ?? null, after: entry.value });
+        }
+    }
+    for (const [id, entry] of was) {
+        if (!is.has(id))
+            out.push({ section: entry.section, name: entry.name, before: entry.value, after: null });
+    }
+    return out;
+}
 /**
- * What changed between two versions of one manifest. `null` text is a file
- * that does not exist on that side. Returns the error instead when either
- * side cannot be read.
+ * What changed between two versions of one manifest: its dependencies, and
+ * the entries of its install-script policy. `null` text is a file that does
+ * not exist on that side. Returns the error instead when either side cannot
+ * be read.
  */
 export function diffManifest(file, ecosystem, before, after) {
     const read = (text, side) => {
         if (text === null)
-            return [];
+            return { dependencies: [], installScripts: [] };
         const result = readManifest(ecosystem, text);
-        return result.ok ? result.dependencies : `${file} (${side}): ${result.error}`;
+        return result.ok ? result : `${file} (${side}): ${result.error}`;
     };
     const old = read(before, 'before');
     if (typeof old === 'string')
@@ -349,20 +405,11 @@ export function diffManifest(file, ecosystem, before, after) {
     const now = read(after, 'after');
     if (typeof now === 'string')
         return { error: now };
-    const key = (d) => `${d.section}\u0000${d.name}`;
-    const was = new Map(old.map((d) => [key(d), d]));
-    const is = new Map(now.map((d) => [key(d), d]));
-    const changes = [];
-    for (const [id, dependency] of is) {
-        const previous = was.get(id);
-        if (previous === undefined || previous.version !== dependency.version) {
-            changes.push({ file, ecosystem, section: dependency.section, name: dependency.name, before: previous?.version ?? null, after: dependency.version });
-        }
-    }
-    for (const [id, dependency] of was) {
-        if (!is.has(id))
-            changes.push({ file, ecosystem, section: dependency.section, name: dependency.name, before: dependency.version, after: null });
-    }
-    return { changes };
+    const versions = (side) => side.dependencies.map((d) => ({ section: d.section, name: d.name, value: d.version }));
+    const verdicts = (side) => side.installScripts.map((e) => ({ section: e.section, name: e.name, value: e.verdict }));
+    return {
+        changes: moved(versions(old), versions(now)).map((change) => ({ file, ecosystem, ...change })),
+        installScripts: moved(verdicts(old), verdicts(now)).map((change) => ({ file, ecosystem, ...change })),
+    };
 }
 //# sourceMappingURL=manifests.js.map

package/dist/manifests.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifests.js","sourceRoot":"","sources":["../src/manifests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAmC,MAAM,qCAAqC,CAAC;AAwBnH,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,IAAI,KAAK,0BAA0B,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5F,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAA0D,CAAC;QAC5G,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC9E,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAE/E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAErG,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC1H,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,oBAAoB,EAAE,CAAC;QACtI,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,+EAA+E;AAE/E,sHAAsH;AACtH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;iBACpC,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACtC,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACtB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBAC1C,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC5B,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,KAAK,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAClF,CAAC;AAQD,kHAAkH;AAClH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,GAAI,MAAM,CAAC,CAAC,CAAY,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,CAAC,IAAI,CAAC,CAAC;gBACP,KAAK,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,kBAAkB,GAAG,mBAAmB,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;iBACpC,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACtC,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,GAAG,EAAE,CAAC;aAC3C,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,WAAW,GAAG,8EAA8E,CAAC;AAEnG,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,wEAAwE;YACxE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,EAAE,GAAG,GAAG,OAAO,SAAS,IAAI,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3G,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,SAAS,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtE,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAClD,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACtI,CAAC;aAAM,IAAI,KAAK,KAAK,+BAA+B,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACtF,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9I,CAAC;aAAM,IAAI,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,+EAA+E;AAE/E,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,KAAK,GAAG,KAAK,CAAC;gBACd,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,mDAAmD,CAAC;IACpE,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACtC,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnH,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAC,SAAoB,EAAE,IAAY;IAC7D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI;YACP,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,KAAK;YACR,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,SAAoB,EACpB,MAAqB,EACrB,KAAoB;IAEpB,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,IAAY,EAAkC,EAAE;QACjF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAChF,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACtJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC","sourcesContent":["/**\n * Which dependencies a round added, removed or moved, read from the manifests\n * it changed.\n *\n * \"No new dependency without saying so\" is one of the few audit questions\n * that can be answered exactly, and it matters: a dependency is code nobody in\n * the review read. Each reader here understands the part of its format that\n * declares dependencies and nothing more - no resolver, no lockfile, no\n * network. A manifest it cannot read is reported as unread, never as clean,\n * and so is a configured name it cannot read.\n */\n\nimport { globAlternatives, parseGlob, type Glob, type GlobAlternative } from './vendor/spec-core/pattern/index.js';\n\nexport type Ecosystem = 'npm' | 'cargo' | 'go' | 'pip' | 'python' | 'nuget' | 'bundler';\n\nexport interface Dependency {\n  readonly section: string;\n  readonly name: string;\n  /** The version or requirement as written; `''` when none is. */\n  readonly version: string;\n}\n\nexport interface DependencyChange {\n  readonly file: string;\n  readonly ecosystem: Ecosystem;\n  readonly section: string;\n  readonly name: string;\n  /** `null` when the dependency is new. */\n  readonly before: string | null;\n  /** `null` when the dependency was removed. */\n  readonly after: string | null;\n}\n\nexport type ManifestRead = { readonly ok: true; readonly dependencies: readonly Dependency[] } | { readonly ok: false; readonly error: string };\n\n/** The ecosystem a manifest file name belongs to, or `null`. */\nexport function ecosystemOf(path: string): Ecosystem | null {\n  const name = path.slice(path.lastIndexOf('/') + 1);\n  if (name === 'package.json') return 'npm';\n  if (name === 'Cargo.toml') return 'cargo';\n  if (name === 'go.mod') return 'go';\n  if (name === 'pyproject.toml') return 'python';\n  if (/^requirements.*\\.txt$/.test(name)) return 'pip';\n  if (name === 'Directory.Packages.props' || /\\.(?:cs|fs|vb)proj$/.test(name)) return 'nuget';\n  if (name === 'Gemfile') return 'bundler';\n  return null;\n}\n\nexport interface ManifestNames {\n  /** Whether a path is a manifest by one of the names that could be read, matched at any depth. */\n  readonly match: (path: string) => boolean;\n  /** The names spec-core's glob refused, malformed or too large to compile, each with its reason. */\n  readonly unread: readonly { readonly name: string; readonly reason: string }[];\n  /** The names a leading `/` roots, alone or on a brace alternative, and whether every alternative is. */\n  readonly rooted: readonly { readonly name: string; readonly whole: boolean }[];\n}\n\n/**\n * The configured manifest names, read. A name that cannot be read names no\n * manifest, and is returned so the audit can say so: every file it was\n * meant to name would otherwise go unmeasured in silence. So is a name a\n * leading `/` roots at the filesystem's root: it can be read, and names no\n * path the audit is given, all of which are repository-relative.\n */\nexport function readManifestNames(patterns: readonly string[]): ManifestNames {\n  const globs: Glob[] = [];\n  const unread: { name: string; reason: string }[] = [];\n  const rooted: { name: string; whole: boolean }[] = [];\n  for (const pattern of patterns) {\n    const parsed = parseGlob(pattern, { dialect: 'ripgrep', caseSensitive: true });\n    if (!parsed.ok) {\n      unread.push({ name: pattern, reason: parsed.error });\n      continue;\n    }\n    globs.push(parsed.glob);\n    // spec-core refuses here only what parseGlob refuses, so a name read\n    // above always has its alternatives read.\n    const { alternatives } = globAlternatives(pattern) as { readonly alternatives: readonly GlobAlternative[] };\n    const roots = alternatives.filter((alternative) => alternative.rooted).length;\n    if (roots > 0) rooted.push({ name: pattern, whole: roots === alternatives.length });\n  }\n  return { match: (path) => globs.some((glob) => glob.match(path)), unread, rooted };\n}\n\n/** A predicate over paths for the configured manifest names, matched at any depth. */\nexport function manifestMatcher(patterns: readonly string[]): (path: string) => boolean {\n  return readManifestNames(patterns).match;\n}\n\n/* --------------------------------------------------------------------- npm */\n\nconst NPM_SECTIONS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];\n\nfunction readNpm(text: string): ManifestRead {\n  let value: unknown;\n  try {\n    value = JSON.parse(text);\n  } catch {\n    return { ok: false, error: 'not valid JSON' };\n  }\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return { ok: false, error: 'not a JSON object' };\n  const out: Dependency[] = [];\n  for (const section of NPM_SECTIONS) {\n    const table = (value as Record<string, unknown>)[section];\n    if (table === undefined) continue;\n    if (typeof table !== 'object' || table === null || Array.isArray(table)) return { ok: false, error: `\"${section}\" is not an object` };\n    for (const [name, version] of Object.entries(table)) out.push({ section, name, version: String(version) });\n  }\n  return { ok: true, dependencies: out };\n}\n\n/* -------------------------------------------------------------------- TOML */\n\n/** A TOML value on one line, or the start of a multi-line array. Comments and quotes read the way TOML reads them. */\nfunction stripTomlComment(line: string): string {\n  let quote: string | null = null;\n  for (let i = 0; i < line.length; i += 1) {\n    const ch = line.charAt(i);\n    if (quote !== null) {\n      if (ch === '\\\\' && quote === '\"') i += 1;\n      else if (ch === quote) quote = null;\n    } else if (ch === '\"' || ch === \"'\") {\n      quote = ch;\n    } else if (ch === '#') {\n      return line.slice(0, i);\n    }\n  }\n  return line;\n}\n\nfunction unquote(value: string): string {\n  const trimmed = value.trim();\n  if (trimmed.length >= 2 && (trimmed.startsWith('\"') || trimmed.startsWith(\"'\")) && trimmed.endsWith(trimmed.charAt(0))) {\n    return trimmed.slice(1, -1);\n  }\n  return trimmed;\n}\n\n/**\n * The strings of a TOML array, `[\"a>=1\", 'b']`, possibly spread over lines.\n * A string inside an inline table is a value of that table, not an element:\n * `{include-group = \"test\"}` in a dependency group names a group, not a package.\n */\nfunction tomlStrings(text: string): string[] {\n  const out: string[] = [];\n  let depth = 0;\n  let i = 0;\n  while (i < text.length) {\n    const ch = text.charAt(i);\n    if (ch === '{') depth += 1;\n    else if (ch === '}') depth -= 1;\n    if (ch === '\"' || ch === \"'\") {\n      let j = i + 1;\n      let value = '';\n      while (j < text.length && text.charAt(j) !== ch) {\n        if (text.charAt(j) === '\\\\' && ch === '\"') {\n          value += text.charAt(j + 1);\n          j += 2;\n          continue;\n        }\n        value += text.charAt(j);\n        j += 1;\n      }\n      if (depth === 0) out.push(value);\n      i = j + 1;\n      continue;\n    }\n    i += 1;\n  }\n  return out;\n}\n\n/** The name a PEP 508 requirement names, normalised as PEP 503 says. */\nexport function pythonName(requirement: string): string {\n  const match = /^\\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(requirement);\n  return (match?.[1] ?? requirement.trim()).toLowerCase().replace(/[-_.]+/g, '-');\n}\n\ninterface TomlLine {\n  readonly table: string;\n  readonly key: string;\n  readonly value: string;\n}\n\n/** Top-level `key = value` lines per table header, arrays gathered across lines. Enough for dependency tables. */\nfunction tomlEntries(text: string): TomlLine[] | string {\n  const out: TomlLine[] = [];\n  let table = '';\n  const lines = text.split(/\\r?\\n/);\n  for (let i = 0; i < lines.length; i += 1) {\n    const line = stripTomlComment(lines[i] as string).trim();\n    if (line === '') continue;\n    const header = /^\\[\\[?\\s*([^\\]]+?)\\s*\\]\\]?$/.exec(line);\n    if (header !== null) {\n      table = (header[1] as string).replace(/\\s*\\.\\s*/g, '.');\n      continue;\n    }\n    const eq = line.indexOf('=');\n    if (eq <= 0) continue;\n    const key = unquote(line.slice(0, eq));\n    let value = line.slice(eq + 1).trim();\n    if (value.startsWith('[') && !balanced(value)) {\n      while (i + 1 < lines.length && !balanced(value)) {\n        i += 1;\n        value += ` ${stripTomlComment(lines[i] as string).trim()}`;\n      }\n      if (!balanced(value)) return `the array for \"${key}\" is never closed`;\n    }\n    out.push({ table, key, value });\n  }\n  return out;\n}\n\nfunction balanced(value: string): boolean {\n  let depth = 0;\n  let quote: string | null = null;\n  for (let i = 0; i < value.length; i += 1) {\n    const ch = value.charAt(i);\n    if (quote !== null) {\n      if (ch === '\\\\' && quote === '\"') i += 1;\n      else if (ch === quote) quote = null;\n    } else if (ch === '\"' || ch === \"'\") quote = ch;\n    else if (ch === '[') depth += 1;\n    else if (ch === ']') depth -= 1;\n  }\n  return depth <= 0 && quote === null;\n}\n\nconst CARGO_TABLE = /^(?:target\\..+\\.)?((?:workspace\\.)?(?:dev-|build-)?dependencies)(?:\\.(.+))?$/;\n\nfunction readCargo(text: string): ManifestRead {\n  const entries = tomlEntries(text);\n  if (typeof entries === 'string') return { ok: false, error: entries };\n  const out = new Map<string, Dependency>();\n  for (const { table, key, value } of entries) {\n    const match = CARGO_TABLE.exec(table);\n    if (match === null) continue;\n    const section = match[1] as string;\n    const inline = match[2];\n    if (inline !== undefined) {\n      // [dependencies.serde] then `version = \"1\"`: the table names the crate.\n      const name = unquote(inline);\n      const id = `${section}\\u0000${name}`;\n      const current = out.get(id) ?? { section, name, version: '' };\n      out.set(id, key === 'version' ? { ...current, version: unquote(value) } : current);\n      continue;\n    }\n    const version = value.startsWith('{') ? (/version\\s*=\\s*(\"[^\"]*\"|'[^']*')/.exec(value)?.[1] ?? '') : value;\n    out.set(`${section}\\u0000${key}`, { section, name: key, version: unquote(version) });\n  }\n  return { ok: true, dependencies: [...out.values()] };\n}\n\nfunction readPyproject(text: string): ManifestRead {\n  const entries = tomlEntries(text);\n  if (typeof entries === 'string') return { ok: false, error: entries };\n  const out: Dependency[] = [];\n  for (const { table, key, value } of entries) {\n    if (table === 'project' && key === 'dependencies') {\n      for (const requirement of tomlStrings(value)) out.push({ section: 'project', name: pythonName(requirement), version: requirement });\n    } else if (table === 'project.optional-dependencies' || table === 'dependency-groups') {\n      for (const requirement of tomlStrings(value)) out.push({ section: `${table}.${key}`, name: pythonName(requirement), version: requirement });\n    } else if (/^tool\\.poetry\\.(?:group\\.[^.]+\\.)?(?:dev-)?dependencies$/.test(table) && key.toLowerCase() !== 'python') {\n      out.push({ section: table, name: pythonName(key), version: unquote(value) });\n    }\n  }\n  return { ok: true, dependencies: out };\n}\n\n/* ------------------------------------------------------------ line formats */\n\nfunction readGoMod(text: string): ManifestRead {\n  const out: Dependency[] = [];\n  let block = false;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const indirect = /\\/\\/\\s*indirect\\b/.test(raw);\n    const line = raw.replace(/\\/\\/.*$/, '').trim();\n    if (line === '') continue;\n    if (block) {\n      if (line === ')') {\n        block = false;\n        continue;\n      }\n      const [name, version] = line.split(/\\s+/);\n      if (name !== undefined) out.push({ section: indirect ? 'require (indirect)' : 'require', name, version: version ?? '' });\n      continue;\n    }\n    if (/^require\\s*\\($/.test(line)) {\n      block = true;\n      continue;\n    }\n    const single = /^require\\s+(\\S+)\\s+(\\S+)/.exec(line);\n    if (single !== null) out.push({ section: indirect ? 'require (indirect)' : 'require', name: single[1] as string, version: single[2] as string });\n  }\n  if (block) return { ok: false, error: 'a require block is never closed' };\n  return { ok: true, dependencies: out };\n}\n\nfunction readRequirements(text: string): ManifestRead {\n  const out: Dependency[] = [];\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.replace(/(^|\\s)#.*$/, '').trim();\n    if (line === '' || line.startsWith('-')) continue;\n    out.push({ section: 'requirements', name: pythonName(line), version: line });\n  }\n  return { ok: true, dependencies: out };\n}\n\nfunction readNuget(text: string): ManifestRead {\n  const out: Dependency[] = [];\n  const element = /<(PackageReference|PackageVersion)\\b([^>]*?)\\/?>/g;\n  for (let match = element.exec(text); match !== null; match = element.exec(text)) {\n    const attributes = match[2] as string;\n    const name = /\\bInclude\\s*=\\s*\"([^\"]*)\"/.exec(attributes)?.[1] ?? /\\bUpdate\\s*=\\s*\"([^\"]*)\"/.exec(attributes)?.[1];\n    if (name === undefined) continue;\n    const version = /\\bVersion\\s*=\\s*\"([^\"]*)\"/.exec(attributes)?.[1] ?? '';\n    out.push({ section: match[1] as string, name, version });\n  }\n  return { ok: true, dependencies: out };\n}\n\nfunction readGemfile(text: string): ManifestRead {\n  const out: Dependency[] = [];\n  for (const raw of text.split(/\\r?\\n/)) {\n    const match = /^\\s*gem\\s+([\"'])([^\"']+)\\1\\s*(?:,\\s*([\"'])([^\"']*)\\3)?/.exec(raw);\n    if (match !== null) out.push({ section: 'gem', name: match[2] as string, version: match[4] ?? '' });\n  }\n  return { ok: true, dependencies: out };\n}\n\n/** Reads the dependencies a manifest declares. */\nexport function readManifest(ecosystem: Ecosystem, text: string): ManifestRead {\n  switch (ecosystem) {\n    case 'npm':\n      return readNpm(text);\n    case 'cargo':\n      return readCargo(text);\n    case 'go':\n      return readGoMod(text);\n    case 'python':\n      return readPyproject(text);\n    case 'pip':\n      return readRequirements(text);\n    case 'nuget':\n      return readNuget(text);\n    case 'bundler':\n      return readGemfile(text);\n  }\n}\n\n/**\n * What changed between two versions of one manifest. `null` text is a file\n * that does not exist on that side. Returns the error instead when either\n * side cannot be read.\n */\nexport function diffManifest(\n  file: string,\n  ecosystem: Ecosystem,\n  before: string | null,\n  after: string | null,\n): { readonly changes: readonly DependencyChange[] } | { readonly error: string } {\n  const read = (text: string | null, side: string): readonly Dependency[] | string => {\n    if (text === null) return [];\n    const result = readManifest(ecosystem, text);\n    return result.ok ? result.dependencies : `${file} (${side}): ${result.error}`;\n  };\n  const old = read(before, 'before');\n  if (typeof old === 'string') return { error: old };\n  const now = read(after, 'after');\n  if (typeof now === 'string') return { error: now };\n  const key = (d: Dependency): string => `${d.section}\\u0000${d.name}`;\n  const was = new Map(old.map((d) => [key(d), d]));\n  const is = new Map(now.map((d) => [key(d), d]));\n  const changes: DependencyChange[] = [];\n  for (const [id, dependency] of is) {\n    const previous = was.get(id);\n    if (previous === undefined || previous.version !== dependency.version) {\n      changes.push({ file, ecosystem, section: dependency.section, name: dependency.name, before: previous?.version ?? null, after: dependency.version });\n    }\n  }\n  for (const [id, dependency] of was) {\n    if (!is.has(id)) changes.push({ file, ecosystem, section: dependency.section, name: dependency.name, before: dependency.version, after: null });\n  }\n  return { changes };\n}\n"]}
+{"version":3,"file":"manifests.js","sourceRoot":"","sources":["../src/manifests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAmC,MAAM,qCAAqC,CAAC;AAmDnH,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,IAAI,KAAK,0BAA0B,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5F,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAA0D,CAAC;QAC5G,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC9E,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAE/E,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAErG,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC1H,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,oBAAoB,EAAE,CAAC;QACtI,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,EAAE,iBAAiB,CAAC,KAAgC,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,QAAiC;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;aACpF,IAAI,KAAK,KAAK,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,sHAAsH;AACtH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;iBACpC,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACtC,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACtB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBAC1C,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC5B,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,KAAK,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAClF,CAAC;AAQD,kHAAkH;AAClH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,GAAI,MAAM,CAAC,CAAC,CAAY,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,CAAC,IAAI,CAAC,CAAC;gBACP,KAAK,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,kBAAkB,GAAG,mBAAmB,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;iBACpC,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QACtC,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,GAAG,EAAE,CAAC;aAC3C,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,WAAW,GAAG,8EAA8E,CAAC;AAEnG,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,wEAAwE;YACxE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,EAAE,GAAG,GAAG,OAAO,SAAS,IAAI,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3G,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,SAAS,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtE,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAClD,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACtI,CAAC;aAAM,IAAI,KAAK,KAAK,+BAA+B,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACtF,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9I,CAAC;aAAM,IAAI,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,+EAA+E;AAE/E,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,KAAK,GAAG,KAAK,CAAC;gBACd,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,mDAAmD,CAAC;IACpE,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACtC,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnH,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,YAAY,CAAC,SAAoB,EAAE,IAAY;IAC7D,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAoC,EAAE,IAAY;IAC1E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI;YACP,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,KAAK;YACR,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AASD,uFAAuF;AACvF,SAAS,KAAK,CAAI,GAAwB,EAAE,GAAwB;IAClE,MAAM,GAAG,GAAG,CAAC,KAAe,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAA2E,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,SAAoB,EACpB,MAAqB,EACrB,KAAoB;IAEpB,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,IAAY,EAAiF,EAAE;QAChI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACnE,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAmB,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAiC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/J,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC9F,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;KACtG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Which dependencies a round added, removed or moved, read from the manifests\n * it changed.\n *\n * \"No new dependency without saying so\" is one of the few audit questions\n * that can be answered exactly, and it matters: a dependency is code nobody in\n * the review read. Each reader here understands the part of its format that\n * declares dependencies and nothing more - no resolver, no lockfile, no\n * network. A manifest it cannot read is reported as unread, never as clean,\n * and so is a configured name it cannot read.\n *\n * The same holds for the one line that lets a dependency run code when it is\n * installed. npm 12 runs a dependency's install scripts only where the root\n * package's `allowScripts` allows the package, so an entry a round adds\n * there turns on code that is nowhere in its diff.\n */\n\nimport { globAlternatives, parseGlob, type Glob, type GlobAlternative } from './vendor/spec-core/pattern/index.js';\n\nexport type Ecosystem = 'npm' | 'cargo' | 'go' | 'pip' | 'python' | 'nuget' | 'bundler';\n\nexport interface Dependency {\n  readonly section: string;\n  readonly name: string;\n  /** The version or requirement as written; `''` when none is. */\n  readonly version: string;\n}\n\nexport interface DependencyChange {\n  readonly file: string;\n  readonly ecosystem: Ecosystem;\n  readonly section: string;\n  readonly name: string;\n  /** `null` when the dependency is new. */\n  readonly before: string | null;\n  /** `null` when the dependency was removed. */\n  readonly after: string | null;\n}\n\n/** What an entry of an install-script policy says of the package it names. */\nexport type InstallScriptVerdict = 'allowed' | 'denied';\n\nexport interface InstallScriptEntry {\n  /** The field that holds the policy, `allowScripts`. */\n  readonly section: string;\n  /** The entry's key as written: a package, or a package at the versions it names. */\n  readonly name: string;\n  readonly verdict: InstallScriptVerdict;\n}\n\nexport interface InstallScriptChange {\n  readonly file: string;\n  readonly ecosystem: Ecosystem;\n  readonly section: string;\n  readonly name: string;\n  /** `null` when the policy had no such entry. */\n  readonly before: InstallScriptVerdict | null;\n  /** `null` when the entry was removed. */\n  readonly after: InstallScriptVerdict | null;\n}\n\n/** A format read for its dependencies alone: it has no install-script policy. */\ntype DependencyRead = { readonly ok: true; readonly dependencies: readonly Dependency[] } | { readonly ok: false; readonly error: string };\n\nexport type ManifestRead =\n  | { readonly ok: true; readonly dependencies: readonly Dependency[]; readonly installScripts: readonly InstallScriptEntry[] }\n  | { readonly ok: false; readonly error: string };\n\n/** The ecosystem a manifest file name belongs to, or `null`. */\nexport function ecosystemOf(path: string): Ecosystem | null {\n  const name = path.slice(path.lastIndexOf('/') + 1);\n  if (name === 'package.json') return 'npm';\n  if (name === 'Cargo.toml') return 'cargo';\n  if (name === 'go.mod') return 'go';\n  if (name === 'pyproject.toml') return 'python';\n  if (/^requirements.*\\.txt$/.test(name)) return 'pip';\n  if (name === 'Directory.Packages.props' || /\\.(?:cs|fs|vb)proj$/.test(name)) return 'nuget';\n  if (name === 'Gemfile') return 'bundler';\n  return null;\n}\n\nexport interface ManifestNames {\n  /** Whether a path is a manifest by one of the names that could be read, matched at any depth. */\n  readonly match: (path: string) => boolean;\n  /** The names spec-core's glob refused, malformed or too large to compile, each with its reason. */\n  readonly unread: readonly { readonly name: string; readonly reason: string }[];\n  /** The names a leading `/` roots, alone or on a brace alternative, and whether every alternative is. */\n  readonly rooted: readonly { readonly name: string; readonly whole: boolean }[];\n}\n\n/**\n * The configured manifest names, read. A name that cannot be read names no\n * manifest, and is returned so the audit can say so: every file it was\n * meant to name would otherwise go unmeasured in silence. So is a name a\n * leading `/` roots at the filesystem's root: it can be read, and names no\n * path the audit is given, all of which are repository-relative.\n */\nexport function readManifestNames(patterns: readonly string[]): ManifestNames {\n  const globs: Glob[] = [];\n  const unread: { name: string; reason: string }[] = [];\n  const rooted: { name: string; whole: boolean }[] = [];\n  for (const pattern of patterns) {\n    const parsed = parseGlob(pattern, { dialect: 'ripgrep', caseSensitive: true });\n    if (!parsed.ok) {\n      unread.push({ name: pattern, reason: parsed.error });\n      continue;\n    }\n    globs.push(parsed.glob);\n    // spec-core refuses here only what parseGlob refuses, so a name read\n    // above always has its alternatives read.\n    const { alternatives } = globAlternatives(pattern) as { readonly alternatives: readonly GlobAlternative[] };\n    const roots = alternatives.filter((alternative) => alternative.rooted).length;\n    if (roots > 0) rooted.push({ name: pattern, whole: roots === alternatives.length });\n  }\n  return { match: (path) => globs.some((glob) => glob.match(path)), unread, rooted };\n}\n\n/** A predicate over paths for the configured manifest names, matched at any depth. */\nexport function manifestMatcher(patterns: readonly string[]): (path: string) => boolean {\n  return readManifestNames(patterns).match;\n}\n\n/* --------------------------------------------------------------------- npm */\n\nconst NPM_SECTIONS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];\n\nfunction readNpm(text: string): ManifestRead {\n  let value: unknown;\n  try {\n    value = JSON.parse(text);\n  } catch {\n    return { ok: false, error: 'not valid JSON' };\n  }\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return { ok: false, error: 'not a JSON object' };\n  const out: Dependency[] = [];\n  for (const section of NPM_SECTIONS) {\n    const table = (value as Record<string, unknown>)[section];\n    if (table === undefined) continue;\n    if (typeof table !== 'object' || table === null || Array.isArray(table)) return { ok: false, error: `\"${section}\" is not an object` };\n    for (const [name, version] of Object.entries(table)) out.push({ section, name, version: String(version) });\n  }\n  return { ok: true, dependencies: out, installScripts: npmInstallScripts(value as Record<string, unknown>) };\n}\n\n/**\n * npm 12's install-script policy, where `npm install-scripts approve` and\n * `deny` write it: a package, or a package at exact versions, to `true` or\n * `false`.\n */\nconst NPM_INSTALL_SCRIPTS = 'allowScripts';\n\n/**\n * The entries of `allowScripts`, read as npm reads them. It takes the field\n * only when it is an object and an entry only when its value is `true` or\n * `false`: anything else approves nothing and denies nothing, so it is no\n * entry here either, and never a manifest that cannot be read. Each key is\n * kept as written. Telling `canvas@1.2.3` from `canvas@^1`, which npm\n * passes over, is npm's own reading of a package spec, and the audit names\n * the entry for a person to read.\n */\nfunction npmInstallScripts(manifest: Record<string, unknown>): InstallScriptEntry[] {\n  const policy = manifest[NPM_INSTALL_SCRIPTS];\n  if (typeof policy !== 'object' || policy === null) return [];\n  const out: InstallScriptEntry[] = [];\n  for (const [name, value] of Object.entries(policy)) {\n    if (value === true) out.push({ section: NPM_INSTALL_SCRIPTS, name, verdict: 'allowed' });\n    else if (value === false) out.push({ section: NPM_INSTALL_SCRIPTS, name, verdict: 'denied' });\n  }\n  return out;\n}\n\n/* -------------------------------------------------------------------- TOML */\n\n/** A TOML value on one line, or the start of a multi-line array. Comments and quotes read the way TOML reads them. */\nfunction stripTomlComment(line: string): string {\n  let quote: string | null = null;\n  for (let i = 0; i < line.length; i += 1) {\n    const ch = line.charAt(i);\n    if (quote !== null) {\n      if (ch === '\\\\' && quote === '\"') i += 1;\n      else if (ch === quote) quote = null;\n    } else if (ch === '\"' || ch === \"'\") {\n      quote = ch;\n    } else if (ch === '#') {\n      return line.slice(0, i);\n    }\n  }\n  return line;\n}\n\nfunction unquote(value: string): string {\n  const trimmed = value.trim();\n  if (trimmed.length >= 2 && (trimmed.startsWith('\"') || trimmed.startsWith(\"'\")) && trimmed.endsWith(trimmed.charAt(0))) {\n    return trimmed.slice(1, -1);\n  }\n  return trimmed;\n}\n\n/**\n * The strings of a TOML array, `[\"a>=1\", 'b']`, possibly spread over lines.\n * A string inside an inline table is a value of that table, not an element:\n * `{include-group = \"test\"}` in a dependency group names a group, not a package.\n */\nfunction tomlStrings(text: string): string[] {\n  const out: string[] = [];\n  let depth = 0;\n  let i = 0;\n  while (i < text.length) {\n    const ch = text.charAt(i);\n    if (ch === '{') depth += 1;\n    else if (ch === '}') depth -= 1;\n    if (ch === '\"' || ch === \"'\") {\n      let j = i + 1;\n      let value = '';\n      while (j < text.length && text.charAt(j) !== ch) {\n        if (text.charAt(j) === '\\\\' && ch === '\"') {\n          value += text.charAt(j + 1);\n          j += 2;\n          continue;\n        }\n        value += text.charAt(j);\n        j += 1;\n      }\n      if (depth === 0) out.push(value);\n      i = j + 1;\n      continue;\n    }\n    i += 1;\n  }\n  return out;\n}\n\n/** The name a PEP 508 requirement names, normalised as PEP 503 says. */\nexport function pythonName(requirement: string): string {\n  const match = /^\\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(requirement);\n  return (match?.[1] ?? requirement.trim()).toLowerCase().replace(/[-_.]+/g, '-');\n}\n\ninterface TomlLine {\n  readonly table: string;\n  readonly key: string;\n  readonly value: string;\n}\n\n/** Top-level `key = value` lines per table header, arrays gathered across lines. Enough for dependency tables. */\nfunction tomlEntries(text: string): TomlLine[] | string {\n  const out: TomlLine[] = [];\n  let table = '';\n  const lines = text.split(/\\r?\\n/);\n  for (let i = 0; i < lines.length; i += 1) {\n    const line = stripTomlComment(lines[i] as string).trim();\n    if (line === '') continue;\n    const header = /^\\[\\[?\\s*([^\\]]+?)\\s*\\]\\]?$/.exec(line);\n    if (header !== null) {\n      table = (header[1] as string).replace(/\\s*\\.\\s*/g, '.');\n      continue;\n    }\n    const eq = line.indexOf('=');\n    if (eq <= 0) continue;\n    const key = unquote(line.slice(0, eq));\n    let value = line.slice(eq + 1).trim();\n    if (value.startsWith('[') && !balanced(value)) {\n      while (i + 1 < lines.length && !balanced(value)) {\n        i += 1;\n        value += ` ${stripTomlComment(lines[i] as string).trim()}`;\n      }\n      if (!balanced(value)) return `the array for \"${key}\" is never closed`;\n    }\n    out.push({ table, key, value });\n  }\n  return out;\n}\n\nfunction balanced(value: string): boolean {\n  let depth = 0;\n  let quote: string | null = null;\n  for (let i = 0; i < value.length; i += 1) {\n    const ch = value.charAt(i);\n    if (quote !== null) {\n      if (ch === '\\\\' && quote === '\"') i += 1;\n      else if (ch === quote) quote = null;\n    } else if (ch === '\"' || ch === \"'\") quote = ch;\n    else if (ch === '[') depth += 1;\n    else if (ch === ']') depth -= 1;\n  }\n  return depth <= 0 && quote === null;\n}\n\nconst CARGO_TABLE = /^(?:target\\..+\\.)?((?:workspace\\.)?(?:dev-|build-)?dependencies)(?:\\.(.+))?$/;\n\nfunction readCargo(text: string): DependencyRead {\n  const entries = tomlEntries(text);\n  if (typeof entries === 'string') return { ok: false, error: entries };\n  const out = new Map<string, Dependency>();\n  for (const { table, key, value } of entries) {\n    const match = CARGO_TABLE.exec(table);\n    if (match === null) continue;\n    const section = match[1] as string;\n    const inline = match[2];\n    if (inline !== undefined) {\n      // [dependencies.serde] then `version = \"1\"`: the table names the crate.\n      const name = unquote(inline);\n      const id = `${section}\\u0000${name}`;\n      const current = out.get(id) ?? { section, name, version: '' };\n      out.set(id, key === 'version' ? { ...current, version: unquote(value) } : current);\n      continue;\n    }\n    const version = value.startsWith('{') ? (/version\\s*=\\s*(\"[^\"]*\"|'[^']*')/.exec(value)?.[1] ?? '') : value;\n    out.set(`${section}\\u0000${key}`, { section, name: key, version: unquote(version) });\n  }\n  return { ok: true, dependencies: [...out.values()] };\n}\n\nfunction readPyproject(text: string): DependencyRead {\n  const entries = tomlEntries(text);\n  if (typeof entries === 'string') return { ok: false, error: entries };\n  const out: Dependency[] = [];\n  for (const { table, key, value } of entries) {\n    if (table === 'project' && key === 'dependencies') {\n      for (const requirement of tomlStrings(value)) out.push({ section: 'project', name: pythonName(requirement), version: requirement });\n    } else if (table === 'project.optional-dependencies' || table === 'dependency-groups') {\n      for (const requirement of tomlStrings(value)) out.push({ section: `${table}.${key}`, name: pythonName(requirement), version: requirement });\n    } else if (/^tool\\.poetry\\.(?:group\\.[^.]+\\.)?(?:dev-)?dependencies$/.test(table) && key.toLowerCase() !== 'python') {\n      out.push({ section: table, name: pythonName(key), version: unquote(value) });\n    }\n  }\n  return { ok: true, dependencies: out };\n}\n\n/* ------------------------------------------------------------ line formats */\n\nfunction readGoMod(text: string): DependencyRead {\n  const out: Dependency[] = [];\n  let block = false;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const indirect = /\\/\\/\\s*indirect\\b/.test(raw);\n    const line = raw.replace(/\\/\\/.*$/, '').trim();\n    if (line === '') continue;\n    if (block) {\n      if (line === ')') {\n        block = false;\n        continue;\n      }\n      const [name, version] = line.split(/\\s+/);\n      if (name !== undefined) out.push({ section: indirect ? 'require (indirect)' : 'require', name, version: version ?? '' });\n      continue;\n    }\n    if (/^require\\s*\\($/.test(line)) {\n      block = true;\n      continue;\n    }\n    const single = /^require\\s+(\\S+)\\s+(\\S+)/.exec(line);\n    if (single !== null) out.push({ section: indirect ? 'require (indirect)' : 'require', name: single[1] as string, version: single[2] as string });\n  }\n  if (block) return { ok: false, error: 'a require block is never closed' };\n  return { ok: true, dependencies: out };\n}\n\nfunction readRequirements(text: string): DependencyRead {\n  const out: Dependency[] = [];\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.replace(/(^|\\s)#.*$/, '').trim();\n    if (line === '' || line.startsWith('-')) continue;\n    out.push({ section: 'requirements', name: pythonName(line), version: line });\n  }\n  return { ok: true, dependencies: out };\n}\n\nfunction readNuget(text: string): DependencyRead {\n  const out: Dependency[] = [];\n  const element = /<(PackageReference|PackageVersion)\\b([^>]*?)\\/?>/g;\n  for (let match = element.exec(text); match !== null; match = element.exec(text)) {\n    const attributes = match[2] as string;\n    const name = /\\bInclude\\s*=\\s*\"([^\"]*)\"/.exec(attributes)?.[1] ?? /\\bUpdate\\s*=\\s*\"([^\"]*)\"/.exec(attributes)?.[1];\n    if (name === undefined) continue;\n    const version = /\\bVersion\\s*=\\s*\"([^\"]*)\"/.exec(attributes)?.[1] ?? '';\n    out.push({ section: match[1] as string, name, version });\n  }\n  return { ok: true, dependencies: out };\n}\n\nfunction readGemfile(text: string): DependencyRead {\n  const out: Dependency[] = [];\n  for (const raw of text.split(/\\r?\\n/)) {\n    const match = /^\\s*gem\\s+([\"'])([^\"']+)\\1\\s*(?:,\\s*([\"'])([^\"']*)\\3)?/.exec(raw);\n    if (match !== null) out.push({ section: 'gem', name: match[2] as string, version: match[4] ?? '' });\n  }\n  return { ok: true, dependencies: out };\n}\n\n/** Reads the dependencies a manifest declares, and the entries of its install-script policy where its format has one. */\nexport function readManifest(ecosystem: Ecosystem, text: string): ManifestRead {\n  if (ecosystem === 'npm') return readNpm(text);\n  const read = readDependencies(ecosystem, text);\n  return read.ok ? { ...read, installScripts: [] } : read;\n}\n\nfunction readDependencies(ecosystem: Exclude<Ecosystem, 'npm'>, text: string): DependencyRead {\n  switch (ecosystem) {\n    case 'cargo':\n      return readCargo(text);\n    case 'go':\n      return readGoMod(text);\n    case 'python':\n      return readPyproject(text);\n    case 'pip':\n      return readRequirements(text);\n    case 'nuget':\n      return readNuget(text);\n    case 'bundler':\n      return readGemfile(text);\n  }\n}\n\n/** One entry of a section, by what it says: a dependency's version, or a policy's verdict. */\ninterface Entry<V> {\n  readonly section: string;\n  readonly name: string;\n  readonly value: V;\n}\n\n/** The entries added or said differently, in the order written, then those removed. */\nfunction moved<V>(old: readonly Entry<V>[], now: readonly Entry<V>[]): { section: string; name: string; before: V | null; after: V | null }[] {\n  const key = (entry: Entry<V>): string => `${entry.section}\\u0000${entry.name}`;\n  const was = new Map(old.map((entry) => [key(entry), entry]));\n  const is = new Map(now.map((entry) => [key(entry), entry]));\n  const out: { section: string; name: string; before: V | null; after: V | null }[] = [];\n  for (const [id, entry] of is) {\n    const previous = was.get(id);\n    if (previous === undefined || previous.value !== entry.value) {\n      out.push({ section: entry.section, name: entry.name, before: previous?.value ?? null, after: entry.value });\n    }\n  }\n  for (const [id, entry] of was) {\n    if (!is.has(id)) out.push({ section: entry.section, name: entry.name, before: entry.value, after: null });\n  }\n  return out;\n}\n\n/**\n * What changed between two versions of one manifest: its dependencies, and\n * the entries of its install-script policy. `null` text is a file that does\n * not exist on that side. Returns the error instead when either side cannot\n * be read.\n */\nexport function diffManifest(\n  file: string,\n  ecosystem: Ecosystem,\n  before: string | null,\n  after: string | null,\n): { readonly changes: readonly DependencyChange[]; readonly installScripts: readonly InstallScriptChange[] } | { readonly error: string } {\n  const read = (text: string | null, side: string): Pick<ManifestRead & { ok: true }, 'dependencies' | 'installScripts'> | string => {\n    if (text === null) return { dependencies: [], installScripts: [] };\n    const result = readManifest(ecosystem, text);\n    return result.ok ? result : `${file} (${side}): ${result.error}`;\n  };\n  const old = read(before, 'before');\n  if (typeof old === 'string') return { error: old };\n  const now = read(after, 'after');\n  if (typeof now === 'string') return { error: now };\n  const versions = (side: typeof old): Entry<string>[] => side.dependencies.map((d) => ({ section: d.section, name: d.name, value: d.version }));\n  const verdicts = (side: typeof old): Entry<InstallScriptVerdict>[] => side.installScripts.map((e) => ({ section: e.section, name: e.name, value: e.verdict }));\n  return {\n    changes: moved(versions(old), versions(now)).map((change) => ({ file, ecosystem, ...change })),\n    installScripts: moved(verdicts(old), verdicts(now)).map((change) => ({ file, ecosystem, ...change })),\n  };\n}\n"]}

package/dist/reader.js

@@ -6,6 +6,8 @@ import { findEntry, readFrontMatter, scanMarkdown } from './vendor/spec-core/mar
 import { splitLines } from './vendor/spec-core/text/index.js';
 /** Section names compare without case, emphasis, a leading number or a trailing colon. */
 export function sameSection(heading, name) {
+    // Both names are folded the same way and then compared, so the mutant that
+    // folds them to upper case is equivalent.
     const normal = (text) => text
         .replace(/[*_`]/g, '')
         .replace(/^\s*\d+[.)]?\s+/, '')
@@ -36,6 +38,8 @@ function scanOf(text, cache) {
 }
 export function createReader() {
     // Commands read the same brief several times in a row; one scan serves them.
+    // It spares a scan and changes no answer, so the mutant that keeps nothing
+    // is equivalent.
     let last = null;
     const scan = (text) => {
         const result = scanOf(text, last);

package/dist/reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"reader.js","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAuC,MAAM,sCAAsC,CAAC;AACrI,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,IAAI;SACD,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACnB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,KAAyB;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,QAAQ;SAClB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAW,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAkD;IAC9E,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,6EAA6E;IAC7E,IAAI,IAAI,GAAgD,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAgB,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,CAAC,IAAY;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACzF,OAAO,OAAO,CAAC,MAAM;iBAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;iBAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACb,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC9D,mEAAmE;gBACnE,mEAAmE;gBACnE,mEAAmE;gBACnE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;gBACpE,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;oBACvD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3E,CAAC,CAAC,CAAC;QACP,CAAC;QAED,SAAS,CAAC,IAAY,EAAE,IAAY;YAClC,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI;oBAAE,MAAM;gBAC/B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC;oBAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;YAC/C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,UAAU,CAAC,IAAY,EAAE,IAAY;YACnC,MAAM,IAAI,GAAsC,EAAE,CAAC;YACnD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI;oBAAE,MAAM;gBAC/B,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC;oBAAE,SAAS;gBAChC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAK,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAuB,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;oBAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1G,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,aAAa,CAAC,IAAY,EAAE,OAAe;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACxG,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAA8B,CAAC;YAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;YACtG,MAAM,KAAK,GAAgB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/C,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;aAC/F,CAAC,CAAC,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC3H,CAAC;QAED,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,CAAC,IAAI,CAAC;iBACd,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;iBAC7F,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,cAAc,CAAC,IAAY;YAMzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;YACpF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;YACnG,wEAAwE;YACxE,wEAAwE;YACxE,OAAO;gBACL,KAAK;gBACL,MAAM;gBACN,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,IAAI,KAAK,MAAM;gBACjE,qBAAqB,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The document reader, on spec-core's Markdown scanner: nothing inside code\n * or a comment is ever taken for a section, a table, a link or a probe.\n */\n\nimport type { Citation, DocumentReader, SectionTables, UnreadableFrontMatterLine } from './document.js';\nimport type { CodeBlock } from './probe.js';\nimport type { TableView } from './rulings.js';\nimport { findEntry, readFrontMatter, scanMarkdown, type FrontMatter, type MarkdownScan } from './vendor/spec-core/markdown/index.js';\nimport { splitLines } from './vendor/spec-core/text/index.js';\n\n/** Section names compare without case, emphasis, a leading number or a trailing colon. */\nexport function sameSection(heading: string, name: string): boolean {\n  const normal = (text: string): string =>\n    text\n      .replace(/[*_`]/g, '')\n      .replace(/^\\s*\\d+[.)]?\\s+/, '')\n      .replace(/[:\\s]+$/, '')\n      .trim()\n      .toLowerCase();\n  return normal(heading) === normal(name);\n}\n\n/**\n * The lines of closed YAML front matter spec-core's reader passes over, since\n * none is `key: value`, each with its reason. The reader reports a problem on\n * a line it read too - a key declared twice - and one on the opening line for\n * TOML front matter; neither is a line passed over, and only these are. A\n * byte-order mark, which the reader leaves out, sits on the opening line,\n * never one of these, so the text's own lines give each as written.\n */\nfunction unreadLines(text: string, front: FrontMatter | null): UnreadableFrontMatterLine[] {\n  if (front === null) return [];\n  const read = new Set(front.entries.map((entry) => entry.line));\n  const lines = splitLines(text);\n  return front.problems\n    .filter((problem) => problem.line > 0 && !read.has(problem.line))\n    .map((problem) => ({ line: problem.line + 1, text: lines[problem.line] as string, reason: problem.message }));\n}\n\nfunction scanOf(text: string, cache: { text: string; scan: MarkdownScan } | null): MarkdownScan {\n  return cache !== null && cache.text === text ? cache.scan : scanMarkdown(text);\n}\n\nexport function createReader(): DocumentReader {\n  // Commands read the same brief several times in a row; one scan serves them.\n  let last: { text: string; scan: MarkdownScan } | null = null;\n  const scan = (text: string): MarkdownScan => {\n    const result = scanOf(text, last);\n    last = { text, scan: result };\n    return result;\n  };\n\n  return {\n    codeBlocks(text: string): CodeBlock[] {\n      const scanned = scan(text);\n      const spaces = (line: string): number => (/^ */.exec(line) as RegExpExecArray)[0].length;\n      return scanned.blocks\n        .filter((block) => block.kind === 'fenced')\n        .map((block) => {\n          const first = block.line + 1;\n          const last = block.closed ? block.endLine - 1 : block.endLine;\n          // A fence in a block quote or a list item: its content is the code\n          // without the quote markers and without the fence's own indent, as\n          // CommonMark reads it, so a probe file is written as it was meant.\n          const indent = spaces(scanned.lines[block.line - 1]?.content ?? '');\n          const lines: string[] = [];\n          for (let line = first; line <= last; line += 1) {\n            const content = scanned.lines[line - 1]?.content ?? '';\n            lines.push(content.slice(Math.min(indent, spaces(content))));\n          }\n          return { info: block.info, content: lines.join('\\n'), line: block.line };\n        });\n    },\n\n    sectionAt(text: string, line: number): string | null {\n      let found: string | null = null;\n      for (const heading of scan(text).headings) {\n        if (heading.line > line) break;\n        if (heading.level >= 2) found = heading.text;\n      }\n      return found;\n    },\n\n    sectionsAt(text: string, line: number): string[] {\n      const open: { level: number; text: string }[] = [];\n      for (const heading of scan(text).headings) {\n        if (heading.line > line) break;\n        if (heading.level < 2) continue;\n        while (open.length > 0 && (open[open.length - 1] as { level: number }).level >= heading.level) open.pop();\n        open.push({ level: heading.level, text: heading.text });\n      }\n      return open.map((section) => section.text);\n    },\n\n    sectionTables(text: string, section: string): SectionTables {\n      const scanned = scan(text);\n      const headings = scanned.headings;\n      const index = headings.findIndex((heading) => heading.level >= 2 && sameSection(heading.text, section));\n      if (index < 0) return { tables: [], headingLine: null, tableEndLine: null };\n      const heading = headings[index] as (typeof headings)[number];\n      const next = headings.slice(index + 1).find((candidate) => candidate.level <= heading.level);\n      const endLine = next === undefined ? scanned.index.lineCount + 1 : next.line;\n      const tables = scanned.tables.filter((table) => table.line > heading.endLine && table.line < endLine);\n      const views: TableView[] = tables.map((table) => ({\n        headers: table.headers.map((cell) => cell.text),\n        rows: table.rows.map((row) => ({ cells: row.cells.map((cell) => cell.text), line: row.line })),\n      }));\n      const lastTable = tables[tables.length - 1];\n      return { tables: views, headingLine: heading.endLine, tableEndLine: lastTable === undefined ? null : lastTable.endLine };\n    },\n\n    citations(text: string): Citation[] {\n      return scan(text)\n        .links.filter((link) => !link.image && link.form !== 'autolink' && link.form !== 'definition')\n        .map((link) => ({ target: link.target, line: link.line }));\n    },\n\n    titleAndStatus(text: string): {\n      title: string | null;\n      status: string | null;\n      unclosedFrontMatter: boolean;\n      unreadableFrontMatter: UnreadableFrontMatterLine[];\n    } {\n      const scanned = scan(text);\n      const title = scanned.headings.find((heading) => heading.level === 1)?.text ?? null;\n      const front = readFrontMatter(text);\n      let status: string | null = null;\n      // The status is read under `status` alone: a key in another language,\n      // such as `狀態`, is another key (ADR-0001).\n      const entry = findEntry(front, 'status');\n      if (entry !== undefined && entry.value.kind === 'scalar') status = entry.value.scalar.text || null;\n      // TOML front matter gives no status, closed or not, so closing it would\n      // change nothing the context packet shows; only YAML's is worth saying.\n      return {\n        title,\n        status,\n        unclosedFrontMatter: scanned.unclosedFrontMatter?.kind === 'yaml',\n        unreadableFrontMatter: unreadLines(text, front),\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"reader.js","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAuC,MAAM,sCAAsC,CAAC;AACrI,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,IAAI;SACD,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACnB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,KAAyB;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,QAAQ;SAClB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAW,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAkD;IAC9E,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,6EAA6E;IAC7E,2EAA2E;IAC3E,iBAAiB;IACjB,IAAI,IAAI,GAAgD,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAgB,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,CAAC,IAAY;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACzF,OAAO,OAAO,CAAC,MAAM;iBAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;iBAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACb,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC9D,mEAAmE;gBACnE,mEAAmE;gBACnE,mEAAmE;gBACnE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;gBACpE,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;oBACvD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3E,CAAC,CAAC,CAAC;QACP,CAAC;QAED,SAAS,CAAC,IAAY,EAAE,IAAY;YAClC,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI;oBAAE,MAAM;gBAC/B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC;oBAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;YAC/C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,UAAU,CAAC,IAAY,EAAE,IAAY;YACnC,MAAM,IAAI,GAAsC,EAAE,CAAC;YACnD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI;oBAAE,MAAM;gBAC/B,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC;oBAAE,SAAS;gBAChC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAK,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAuB,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;oBAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1G,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,aAAa,CAAC,IAAY,EAAE,OAAe;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACxG,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAA8B,CAAC;YAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;YACtG,MAAM,KAAK,GAAgB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/C,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;aAC/F,CAAC,CAAC,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC3H,CAAC;QAED,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,CAAC,IAAI,CAAC;iBACd,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;iBAC7F,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,cAAc,CAAC,IAAY;YAMzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;YACpF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;YACnG,wEAAwE;YACxE,wEAAwE;YACxE,OAAO;gBACL,KAAK;gBACL,MAAM;gBACN,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,IAAI,KAAK,MAAM;gBACjE,qBAAqB,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The document reader, on spec-core's Markdown scanner: nothing inside code\n * or a comment is ever taken for a section, a table, a link or a probe.\n */\n\nimport type { Citation, DocumentReader, SectionTables, UnreadableFrontMatterLine } from './document.js';\nimport type { CodeBlock } from './probe.js';\nimport type { TableView } from './rulings.js';\nimport { findEntry, readFrontMatter, scanMarkdown, type FrontMatter, type MarkdownScan } from './vendor/spec-core/markdown/index.js';\nimport { splitLines } from './vendor/spec-core/text/index.js';\n\n/** Section names compare without case, emphasis, a leading number or a trailing colon. */\nexport function sameSection(heading: string, name: string): boolean {\n  // Both names are folded the same way and then compared, so the mutant that\n  // folds them to upper case is equivalent.\n  const normal = (text: string): string =>\n    text\n      .replace(/[*_`]/g, '')\n      .replace(/^\\s*\\d+[.)]?\\s+/, '')\n      .replace(/[:\\s]+$/, '')\n      .trim()\n      .toLowerCase();\n  return normal(heading) === normal(name);\n}\n\n/**\n * The lines of closed YAML front matter spec-core's reader passes over, since\n * none is `key: value`, each with its reason. The reader reports a problem on\n * a line it read too - a key declared twice - and one on the opening line for\n * TOML front matter; neither is a line passed over, and only these are. A\n * byte-order mark, which the reader leaves out, sits on the opening line,\n * never one of these, so the text's own lines give each as written.\n */\nfunction unreadLines(text: string, front: FrontMatter | null): UnreadableFrontMatterLine[] {\n  if (front === null) return [];\n  const read = new Set(front.entries.map((entry) => entry.line));\n  const lines = splitLines(text);\n  return front.problems\n    .filter((problem) => problem.line > 0 && !read.has(problem.line))\n    .map((problem) => ({ line: problem.line + 1, text: lines[problem.line] as string, reason: problem.message }));\n}\n\nfunction scanOf(text: string, cache: { text: string; scan: MarkdownScan } | null): MarkdownScan {\n  return cache !== null && cache.text === text ? cache.scan : scanMarkdown(text);\n}\n\nexport function createReader(): DocumentReader {\n  // Commands read the same brief several times in a row; one scan serves them.\n  // It spares a scan and changes no answer, so the mutant that keeps nothing\n  // is equivalent.\n  let last: { text: string; scan: MarkdownScan } | null = null;\n  const scan = (text: string): MarkdownScan => {\n    const result = scanOf(text, last);\n    last = { text, scan: result };\n    return result;\n  };\n\n  return {\n    codeBlocks(text: string): CodeBlock[] {\n      const scanned = scan(text);\n      const spaces = (line: string): number => (/^ */.exec(line) as RegExpExecArray)[0].length;\n      return scanned.blocks\n        .filter((block) => block.kind === 'fenced')\n        .map((block) => {\n          const first = block.line + 1;\n          const last = block.closed ? block.endLine - 1 : block.endLine;\n          // A fence in a block quote or a list item: its content is the code\n          // without the quote markers and without the fence's own indent, as\n          // CommonMark reads it, so a probe file is written as it was meant.\n          const indent = spaces(scanned.lines[block.line - 1]?.content ?? '');\n          const lines: string[] = [];\n          for (let line = first; line <= last; line += 1) {\n            const content = scanned.lines[line - 1]?.content ?? '';\n            lines.push(content.slice(Math.min(indent, spaces(content))));\n          }\n          return { info: block.info, content: lines.join('\\n'), line: block.line };\n        });\n    },\n\n    sectionAt(text: string, line: number): string | null {\n      let found: string | null = null;\n      for (const heading of scan(text).headings) {\n        if (heading.line > line) break;\n        if (heading.level >= 2) found = heading.text;\n      }\n      return found;\n    },\n\n    sectionsAt(text: string, line: number): string[] {\n      const open: { level: number; text: string }[] = [];\n      for (const heading of scan(text).headings) {\n        if (heading.line > line) break;\n        if (heading.level < 2) continue;\n        while (open.length > 0 && (open[open.length - 1] as { level: number }).level >= heading.level) open.pop();\n        open.push({ level: heading.level, text: heading.text });\n      }\n      return open.map((section) => section.text);\n    },\n\n    sectionTables(text: string, section: string): SectionTables {\n      const scanned = scan(text);\n      const headings = scanned.headings;\n      const index = headings.findIndex((heading) => heading.level >= 2 && sameSection(heading.text, section));\n      if (index < 0) return { tables: [], headingLine: null, tableEndLine: null };\n      const heading = headings[index] as (typeof headings)[number];\n      const next = headings.slice(index + 1).find((candidate) => candidate.level <= heading.level);\n      const endLine = next === undefined ? scanned.index.lineCount + 1 : next.line;\n      const tables = scanned.tables.filter((table) => table.line > heading.endLine && table.line < endLine);\n      const views: TableView[] = tables.map((table) => ({\n        headers: table.headers.map((cell) => cell.text),\n        rows: table.rows.map((row) => ({ cells: row.cells.map((cell) => cell.text), line: row.line })),\n      }));\n      const lastTable = tables[tables.length - 1];\n      return { tables: views, headingLine: heading.endLine, tableEndLine: lastTable === undefined ? null : lastTable.endLine };\n    },\n\n    citations(text: string): Citation[] {\n      return scan(text)\n        .links.filter((link) => !link.image && link.form !== 'autolink' && link.form !== 'definition')\n        .map((link) => ({ target: link.target, line: link.line }));\n    },\n\n    titleAndStatus(text: string): {\n      title: string | null;\n      status: string | null;\n      unclosedFrontMatter: boolean;\n      unreadableFrontMatter: UnreadableFrontMatterLine[];\n    } {\n      const scanned = scan(text);\n      const title = scanned.headings.find((heading) => heading.level === 1)?.text ?? null;\n      const front = readFrontMatter(text);\n      let status: string | null = null;\n      // The status is read under `status` alone: a key in another language,\n      // such as `狀態`, is another key (ADR-0001).\n      const entry = findEntry(front, 'status');\n      if (entry !== undefined && entry.value.kind === 'scalar') status = entry.value.scalar.text || null;\n      // TOML front matter gives no status, closed or not, so closing it would\n      // change nothing the context packet shows; only YAML's is worth saying.\n      return {\n        title,\n        status,\n        unclosedFrontMatter: scanned.unclosedFrontMatter?.kind === 'yaml',\n        unreadableFrontMatter: unreadLines(text, front),\n      };\n    },\n  };\n}\n"]}

package/dist/round.d.ts

@@ -9,7 +9,7 @@ import { type BaseSource, type ClaudeCodeWiring, type ClaudeSettings, type Plugi
 import { type ContextPacket } from './context.js';
 import type { DocumentReader } from './document.js';
 import { type Decision, type VerifiedRuling } from './guard.js';
-import { type DependencyChange } from './manifests.js';
+import { type DependencyChange, type InstallScriptChange } from './manifests.js';
 import { type EscalationOption, type EscalationRequest, type RulingRow } from './rulings.js';
 import type { BriefRow, Finding } from './types.js';
 import { type CliIO, type Workspace } from './workspace.js';
@@ -76,6 +76,8 @@ export interface AuditResult {
     readonly base: Base;
     readonly report: AuditReport;
     readonly dependencies: readonly DependencyChange[];
+    /** The entries of an install-script policy the round added, removed or turned. */
+    readonly installScripts: readonly InstallScriptChange[];
 }
 export declare function runAudit(workspace: Workspace, brief: BriefRow, reader: DocumentReader, baseFlag: string | undefined): Promise<AuditResult>;
 export declare function listEscalations(workspace: Workspace): Promise<EscalationRequest[]>;

package/dist/round.js

@@ -233,9 +233,10 @@ async function dependencyChanges(workspace, base) {
     // leave its manifests out of every audit measured from one.
     const names = readManifestNames(workspace.config.dependencies.manifests);
     if (base.kind === 'unresolved')
-        return { changes: [], unread: [], unreadNames: names.unread, rootedNames: names.rooted };
+        return { changes: [], installScripts: [], unread: [], unreadNames: names.unread, rootedNames: names.rooted };
     const isManifest = names.match;
     const out = [];
+    const installScripts = [];
     const unread = [];
     for (const change of await changes(base.mergeBase, base.head, workspace.root)) {
         if (!isManifest(change.path) && !(change.from !== undefined && isManifest(change.from)))
@@ -250,12 +251,14 @@ async function dependencyChanges(workspace, base) {
         const before = await show(base.mergeBase, change.from ?? change.path, workspace.root);
         const after = await show(base.head, change.path, workspace.root);
         const diff = diffManifest(change.path, ecosystem, before, after);
-        if ('error' in diff)
+        if ('error' in diff) {
             unread.push(change.path);
-        else
-            out.push(...diff.changes);
+            continue;
+        }
+        out.push(...diff.changes);
+        installScripts.push(...diff.installScripts);
     }
-    return { changes: out, unread, unreadNames: names.unread, rootedNames: names.rooted };
+    return { changes: out, installScripts, unread, unreadNames: names.unread, rootedNames: names.rooted };
 }
 /** A file's real path, links and the filesystem's case resolved, or `null` when there is no such file. */
 function realFile(path) {
@@ -397,7 +400,13 @@ export async function runAudit(workspace, brief, reader, baseFlag) {
         pluginLoaded: plugin.kind === 'loaded',
     });
     const findings = [...rulings.problems, ...report.findings];
-    return { brief, base, dependencies: dependencies.changes, report: { findings, counts: tally(findings), measured: report.measured } };
+    return {
+        brief,
+        base,
+        dependencies: dependencies.changes,
+        installScripts: dependencies.installScripts,
+        report: { findings, counts: tally(findings), measured: report.measured },
+    };
 }
 /* -------------------------------------------------------------- escalation */
 async function escalationDirectory(workspace) {