@paklo/core 0.1.0 → 0.2.0

package/dist/browser/usage.d.ts

@@ -43,28 +43,31 @@ declare const UsageTelemetryRequestDataSchema: z.ZodObject<{
   project: z.ZodOptional<z.ZodURL>;
   'package-manager': z.ZodEnum<{
     hex: "hex";
-    bun: "bun";
     bundler: "bundler";
     cargo: "cargo";
     composer: "composer";
-    devcontainers: "devcontainers";
+    pub: "pub";
     docker: "docker";
-    docker_compose: "docker_compose";
-    dotnet_sdk: "dotnet_sdk";
-    helm: "helm";
     elm: "elm";
-    submodules: "submodules";
     github_actions: "github_actions";
+    submodules: "submodules";
     go_modules: "go_modules";
     gradle: "gradle";
     maven: "maven";
-    npm_and_yarn: "npm_and_yarn";
     nuget: "nuget";
+    npm_and_yarn: "npm_and_yarn";
     pip: "pip";
-    pub: "pub";
+    rust_toolchain: "rust_toolchain";
     swift: "swift";
     terraform: "terraform";
+    devcontainers: "devcontainers";
+    dotnet_sdk: "dotnet_sdk";
+    bun: "bun";
+    docker_compose: "docker_compose";
     uv: "uv";
+    vcpkg: "vcpkg";
+    helm: "helm";
+    julia: "julia";
   }>;
   id: z.ZodNumber;
   started: z.ZodCoercedDate<unknown>;

package/dist/browser/usage.js

@@ -4,14 +4,18 @@ import "js-yaml";
 //#region src/dependabot/config.ts
 const DependabotRegistrySchema = z.object({
 	type: z.enum([
+		"cargo-registry",
 		"composer-repository",
 		"docker-registry",
 		"git",
+		"goproxy-server",
+		"helm-registry",
 		"hex-organization",
 		"hex-repository",
 		"maven-repository",
 		"npm-registry",
 		"nuget-feed",
+		"pub-repository",
 		"python-index",
 		"rubygems-server",
 		"terraform-registry"
@@ -127,18 +131,21 @@ const PackageEcosystemSchema = z.enum([
 	"github-actions",
 	"gomod",
 	"gradle",
+	"julia",
 	"maven",
 	"npm",
 	"nuget",
 	"pip",
+	"pip-compile",
+	"pipenv",
+	"pnpm",
+	"poetry",
 	"pub",
+	"rust-toolchain",
 	"swift",
 	"terraform",
 	"uv",
-	"pipenv",
-	"pip-compile",
-	"poetry",
-	"pnpm",
+	"vcpkg",
 	"yarn"
 ]);
 const VersioningStrategySchema = z.enum([
@@ -152,6 +159,7 @@ const DependabotUpdateSchema = z.object({
 	"package-ecosystem": PackageEcosystemSchema,
 	directory: z.string().optional(),
 	directories: z.string().array().optional(),
+	"exclude-paths": z.string().array().optional(),
 	allow: DependabotAllowConditionSchema.array().optional(),
 	assignees: z.string().array().optional(),
 	"commit-message": DependabotCommitMessageSchema.optional(),
@@ -168,22 +176,46 @@ const DependabotUpdateSchema = z.object({
 	schedule: DependabotScheduleSchema.optional(),
 	"target-branch": z.string().optional(),
 	vendor: z.boolean().optional(),
-	"versioning-strategy": VersioningStrategySchema.optional()
+	"versioning-strategy": VersioningStrategySchema.optional(),
+	patterns: z.string().array().optional(),
+	"multi-ecosystem-group": z.string().optional()
 }).transform((value, { addIssue }) => {
 	if (!value.directory && (!value.directories || value.directories.length === 0)) addIssue("Either 'directory' or 'directories' must be specified in the dependency update configuration.");
 	if (value.directory && /[*?[\]{}]/.test(value.directory)) addIssue("The 'directory' field must not include glob pattern.");
 	value["open-pull-requests-limit"] ?? (value["open-pull-requests-limit"] = 5);
+	if (value["multi-ecosystem-group"] && (!value.patterns || value.patterns.length === 0)) addIssue("The 'patterns' field must be specified and contain at least one pattern when using 'multi-ecosystem-group'.");
 	return value;
 });
+const DependabotMultiEcosystemGroupSchema = z.object({
+	schedule: DependabotScheduleSchema,
+	labels: z.string().array().optional(),
+	milestone: z.coerce.string().optional(),
+	assignees: z.string().array().optional(),
+	"target-branch": z.string().optional(),
+	"commit-message": DependabotCommitMessageSchema.optional(),
+	"pull-request-branch-name": DependabotPullRequestBranchNameSchema.optional()
+});
 /**
 * Represents the dependabot.yaml configuration file options.
 * See: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-dependabotyml
 */
 const DependabotConfigSchema = z.object({
 	version: z.number().refine((v) => v === 2, { message: "Only version 2 of dependabot is supported" }),
+	"multi-ecosystem-groups": z.record(z.string(), DependabotMultiEcosystemGroupSchema).optional(),
 	updates: DependabotUpdateSchema.array().check(z.minLength(1, { message: "At least one update configuration is required" })),
 	registries: z.record(z.string(), DependabotRegistrySchema).optional(),
 	"enable-beta-ecosystems": z.boolean().optional()
+}).transform((value, { addIssue }) => {
+	const groupOnlyKeys = [
+		"milestone",
+		"target-branch",
+		"commit-message",
+		"pull-request-branch-name"
+	];
+	if (value["multi-ecosystem-groups"]) {
+		for (const update of value.updates) for (const key of groupOnlyKeys) if (key in update) addIssue(`The '${key}' field must not be specified in the 'updates' section when using 'multi-ecosystem-groups'. It is a group-only field.`);
+	}
+	return value;
 });
 
 //#endregion
@@ -273,29 +305,32 @@ const DependabotCommitOptionsSchema = z.object({
 });
 const DependabotExperimentsSchema = z.record(z.string(), z.union([z.string(), z.boolean()]));
 const DependabotPackageManagerSchema = z.enum([
-	"bun",
 	"bundler",
 	"cargo",
 	"composer",
-	"devcontainers",
+	"pub",
 	"docker",
-	"docker_compose",
-	"dotnet_sdk",
-	"helm",
-	"hex",
 	"elm",
-	"submodules",
 	"github_actions",
+	"submodules",
 	"go_modules",
 	"gradle",
 	"maven",
-	"npm_and_yarn",
+	"hex",
 	"nuget",
+	"npm_and_yarn",
 	"pip",
-	"pub",
+	"rust_toolchain",
 	"swift",
 	"terraform",
-	"uv"
+	"devcontainers",
+	"dotnet_sdk",
+	"bun",
+	"docker_compose",
+	"uv",
+	"vcpkg",
+	"helm",
+	"julia"
 ]);
 const DependabotCommandSchema = z.enum([
 	"graph",
@@ -331,7 +366,8 @@ const DependabotJobConfigSchema = z.object({
 	cooldown: DependabotCooldownSchema.nullish(),
 	"proxy-log-response-body-on-auth-failure": z.boolean().nullish(),
 	"enable-beta-ecosystems": z.boolean().nullish(),
-	"multi-ecosystem-update": z.boolean().nullish()
+	"multi-ecosystem-update": z.boolean().nullish(),
+	"exclude-paths": z.string().array().optional()
 });
 const DependabotJobFileSchema = z.object({ job: DependabotJobConfigSchema });
 

package/dist/browser/usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"usage.js","names":[],"sources":["../../src/dependabot/config.ts","../../src/dependabot/job.ts","../../src/usage.ts"],"sourcesContent":["import * as yaml from 'js-yaml';\nimport { z } from 'zod/v4';\n\nimport { convertPlaceholder, type VariableFinderFn } from './placeholder';\n\nexport const DependabotRegistrySchema = z\n  .object({\n    type: z.enum([\n      'composer-repository',\n      'docker-registry',\n      'git',\n      'hex-organization',\n      'hex-repository',\n      'maven-repository',\n      'npm-registry',\n      'nuget-feed',\n      'python-index',\n      'rubygems-server',\n      'terraform-registry',\n    ]),\n    url: z.string().optional(),\n    username: z.string().optional(),\n    password: z.string().optional(),\n    key: z.string().optional(),\n    token: z.string().optional(),\n    'replaces-base': z.boolean().optional(),\n    host: z.string().optional(), // for terraform and composer only\n    registry: z.string().optional(), // for npm only\n    organization: z.string().optional(), // for hex-organisation only\n    repo: z.string().optional(), // for hex-repository only\n    'public-key-fingerprint': z.string().optional(), // for hex-repository only\n    'index-url': z.string().optional(), // for python-index only\n    'auth-key': z.string().optional(), // used by composer-repository, docker-registry, etc\n    'tenant-id': z.string().optional(), // can only be for azure related stuff, not sure\n    'client-id': z.string().optional(), // can only be for azure related stuff, not sure\n  })\n  // change underscore to dash in the registry key/type\n  .transform((value) => ({ ...value, type: value.type.replace('-', '_') }));\nexport type DependabotRegistry = z.infer<typeof DependabotRegistrySchema>;\n\nexport const DependabotGroupSchema = z.object({\n  // Define an identifier for the group to use in branch names and pull request titles.\n  // This must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.\n  IDENTIFIER: z\n    .string()\n    .check(\n      z.regex(/^[a-zA-Z][a-zA-Z0-9|_-]*[a-zA-Z]$/, {\n        message:\n          'Group identifier must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.',\n      }),\n    )\n    .optional(),\n  'applies-to': z.enum(['version-updates', 'security-updates']).optional(),\n  'dependency-type': z.enum(['development', 'production']).optional(),\n  patterns: z.string().array().optional(),\n  'exclude-patterns': z.string().array().optional(),\n  'update-types': z.enum(['major', 'minor', 'patch']).array().optional(),\n});\nexport type DependabotGroup = z.infer<typeof DependabotGroupSchema>;\n\nexport const DependabotAllowConditionSchema = z.object({\n  'dependency-name': z.string().optional(),\n  'dependency-type': z.enum(['direct', 'indirect', 'all', 'production', 'development']).optional(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowCondition = z.infer<typeof DependabotAllowConditionSchema>;\n\nexport const DependabotIgnoreConditionSchema = z\n  .object({\n    'dependency-name': z.string().optional(),\n    versions: z.string().array().or(z.string()).optional(),\n    'update-types': z\n      .enum(['version-update:semver-major', 'version-update:semver-minor', 'version-update:semver-patch'])\n      .array()\n      .optional(),\n  })\n  .and(z.record(z.string(), z.any()));\nexport type DependabotIgnoreCondition = z.infer<typeof DependabotIgnoreConditionSchema>;\n\nexport const DependabotScheduleSchema = z.object({\n  interval: z.enum(['daily', 'weekly', 'monthly', 'quarterly', 'semiannually', 'yearly', 'cron']),\n\n  day: z\n    .enum(['sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'])\n    .optional()\n    .default('monday'),\n\n  time: z\n    .string()\n    .default('02:00')\n    .check(z.regex(/^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$/, { message: 'Time must be in HH:MM format' }))\n    .optional(),\n\n  timezone: z\n    .string()\n    .optional()\n    .default('Etc/UTC')\n    .refine(\n      (value) => {\n        try {\n          // If tz is not a valid IANA name, this throws a RangeError\n          Intl.DateTimeFormat(undefined, { timeZone: value });\n          return true;\n        } catch {\n          return false;\n        }\n      },\n      { message: 'Invalid IANA time zone' },\n    ),\n  cronjob: z\n    .string()\n    .check(z.regex(/^\\S+ \\S+ \\S+ \\S+ \\S+$/, { message: 'Cronjob must be in standard cron format' }))\n    .optional(),\n});\nexport type DependabotSchedule = z.infer<typeof DependabotScheduleSchema>;\n\nexport const DependabotCommitMessageSchema = z.object({\n  prefix: z.string().optional(),\n  'prefix-development': z.string().optional(),\n  include: z.string().optional(),\n});\nexport type DependabotCommitMessage = z.infer<typeof DependabotCommitMessageSchema>;\n\nexport const DependabotCooldownSchema = z.object({\n  'default-days': z.number().optional(),\n  'semver-major-days': z.number().optional(),\n  'semver-minor-days': z.number().optional(),\n  'semver-patch-days': z.number().optional(),\n  include: z.string().array().optional(),\n  exclude: z.string().array().optional(),\n});\nexport type DependabotCooldown = z.infer<typeof DependabotCooldownSchema>;\n\nconst DependabotPullRequestBranchNameSchema = z.object({\n  separator: z.string().optional(),\n});\nexport type DependabotPullRequestBranchName = z.infer<typeof DependabotPullRequestBranchNameSchema>;\n\nexport const PackageEcosystemSchema = z.enum([\n  'bun',\n  'bundler',\n  'cargo',\n  'composer',\n  'devcontainers',\n  'docker',\n  'docker-compose',\n  'dotnet-sdk',\n  'helm',\n  'mix',\n  'elm',\n  'gitsubmodule',\n  'github-actions',\n  'gomod',\n  'gradle',\n  'maven',\n  'npm',\n  'nuget',\n  'pip',\n  'pub',\n  'swift',\n  'terraform',\n  'uv',\n\n  // Additional aliases, sometimes used for convenience\n  'pipenv',\n  'pip-compile',\n  'poetry',\n  'pnpm',\n  'yarn',\n]);\nexport type PackageEcosystem = z.infer<typeof PackageEcosystemSchema>;\n\nexport const VersioningStrategySchema = z.enum(['auto', 'increase', 'increase-if-necessary', 'lockfile-only', 'widen']);\nexport type VersioningStrategy = z.infer<typeof VersioningStrategySchema>;\n\nexport const DependabotUpdateSchema = z\n  .object({\n    'package-ecosystem': PackageEcosystemSchema,\n    directory: z.string().optional(),\n    directories: z.string().array().optional(),\n    allow: DependabotAllowConditionSchema.array().optional(),\n    assignees: z.string().array().optional(),\n    'commit-message': DependabotCommitMessageSchema.optional(),\n    cooldown: DependabotCooldownSchema.optional(),\n    groups: z.record(z.string(), DependabotGroupSchema).optional(),\n    ignore: DependabotIgnoreConditionSchema.array().optional(),\n    'insecure-external-code-execution': z.enum(['allow', 'deny']).optional(),\n    labels: z.string().array().optional(),\n    milestone: z.coerce.string().optional(),\n    'open-pull-requests-limit': z.number().check(z.int(), z.gte(0)).optional(),\n    'pull-request-branch-name': DependabotPullRequestBranchNameSchema.optional(),\n    'rebase-strategy': z.string().optional(),\n    registries: z.string().array().optional(),\n    schedule: DependabotScheduleSchema.optional(),\n    'target-branch': z.string().optional(),\n    vendor: z.boolean().optional(),\n    'versioning-strategy': VersioningStrategySchema.optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // either 'directory' or 'directories' must be specified\n    if (!value.directory && (!value.directories || value.directories.length === 0)) {\n      addIssue(\"Either 'directory' or 'directories' must be specified in the dependency update configuration.\");\n    }\n\n    // validate that 'directory' does not contain glob patterns\n    if (value.directory && /[*?[\\]{}]/.test(value.directory)) {\n      addIssue(\"The 'directory' field must not include glob pattern.\");\n    }\n\n    value['open-pull-requests-limit'] ??= 5; // default to 5 if not specified\n\n    return value;\n  });\nexport type DependabotUpdate = z.infer<typeof DependabotUpdateSchema>;\n\n/**\n * Represents the dependabot.yaml configuration file options.\n * See: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-dependabotyml\n */\nexport const DependabotConfigSchema = z.object({\n  /**\n   * Mandatory. configuration file version.\n   **/\n  version: z.number().refine((v) => v === 2, { message: 'Only version 2 of dependabot is supported' }),\n\n  /**\n   * Mandatory. Configure how Dependabot updates the versions or project dependencies.\n   * Each entry configures the update settings for a particular package manager.\n   */\n  updates: DependabotUpdateSchema.array().check(\n    z.minLength(1, { message: 'At least one update configuration is required' }),\n  ),\n\n  /**\n   * Optional.\n   * Specify authentication details to access private package registries.\n   */\n  registries: z.record(z.string(), DependabotRegistrySchema).optional(),\n\n  /**\n   * Optional. Enables updates for ecosystems that are not yet generally available.\n   * https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#enable-beta-ecosystems-\n   */\n  'enable-beta-ecosystems': z.boolean().optional(),\n});\n\nexport type DependabotConfig = z.infer<typeof DependabotConfigSchema>;\n\nexport function parseUpdates(config: DependabotConfig, configPath: string): DependabotUpdate[] {\n  const updates: DependabotUpdate[] = [];\n\n  // Parse the value of each of the updates obtained from the file\n  for (const update of config.updates) {\n    // populate the 'ignore' conditions 'source' and 'updated-at' properties, if missing\n    // NOTE: 'source' and 'updated-at' are not documented in the dependabot.yml config docs, but are defined in the dependabot-core and dependabot-cli models.\n    //       Currently they don't appear to add much value to the update process, but are populated here for completeness.\n    if (update.ignore) {\n      for (const condition of update.ignore) {\n        condition.source ??= configPath;\n        // we don't know the last updated time, so we use the current time\n        condition['updated-at'] ??= new Date().toISOString();\n      }\n    }\n\n    updates.push(update);\n  }\n  return updates;\n}\n\nexport async function parseRegistries(\n  config: DependabotConfig,\n  variableFinder: VariableFinderFn,\n): Promise<Record<string, DependabotRegistry>> {\n  // Parse the value of each of the registries obtained from the config\n  const registries: Record<string, DependabotRegistry> = {};\n  for (const [key, registry] of Object.entries(config.registries || {})) {\n    const updated = { ...registry };\n    const { type } = updated;\n\n    // handle special fields for 'hex-organization' types\n    if (type === 'hex_organization' && !updated.organization) {\n      throw new Error(`The value 'organization' in dependency registry config '${type}' is missing`);\n    }\n\n    // handle special fields for 'hex-repository' types\n    if (type === 'hex_repository' && !updated.repo) {\n      throw new Error(`The value 'repo' in dependency registry config '${key}' is missing`);\n    }\n\n    // parse username, password, key, and token while replacing tokens where necessary\n    updated.username = await convertPlaceholder({ input: updated.username, variableFinder: variableFinder });\n    updated.password = await convertPlaceholder({ input: updated.password, variableFinder: variableFinder });\n    updated.key = await convertPlaceholder({ input: updated.key, variableFinder: variableFinder });\n    updated.token = await convertPlaceholder({ input: updated.token, variableFinder: variableFinder });\n\n    // parse the url\n    const url = updated.url;\n    if (!url && type !== 'hex_organization') {\n      throw new Error(`The value 'url' in dependency registry config '${key}' is missing`);\n    }\n    if (url) {\n      /*\n       * Some credentials do not use the 'url' property in the Ruby updater.\n       * The 'host' and 'registry' properties are derived from the given URL.\n       * The 'registry' property is derived from the 'url' by stripping off the scheme.\n       * The 'host' property is derived from the hostname of the 'url'.\n       *\n       * 'npm_registry' and 'docker_registry' use 'registry' only.\n       * 'terraform_registry' uses 'host' only.\n       * 'composer_repository' uses both 'url' and 'host'.\n       * 'python_index' uses 'index-url' instead of 'url'.\n       */\n\n      if (URL.canParse(url)) {\n        const parsedUrl = new URL(url);\n\n        const addRegistry = type === 'docker_registry' || type === 'npm_registry';\n        if (addRegistry) updated.registry = url.replace('https://', '').replace('http://', '');\n\n        const addHost = type === 'terraform_registry' || type === 'composer_repository';\n        if (addHost) updated.host = parsedUrl.hostname;\n      }\n\n      if (type === 'python_index') updated['index-url'] = url;\n\n      const removeUrl =\n        type === 'docker_registry' ||\n        type === 'npm_registry' ||\n        type === 'terraform_registry' ||\n        type === 'python_index';\n      if (removeUrl) delete updated.url; // remove the url if not needed\n    }\n\n    // add to list\n    registries[key] = updated;\n  }\n  return registries;\n}\n\nexport function validateConfiguration(updates: DependabotUpdate[], registries: Record<string, DependabotRegistry>) {\n  const configured = Object.keys(registries);\n  const referenced: string[] = [];\n  for (const u of updates) referenced.push(...(u.registries ?? []));\n\n  // ensure there are no configured registries that have not been referenced\n  const missingConfiguration = referenced.filter((el) => !configured.includes(el));\n  if (missingConfiguration.length > 0) {\n    throw new Error(\n      `Referenced registries: '${missingConfiguration.join(',')}' have not been configured in the root of dependabot.yml`,\n    );\n  }\n\n  // ensure there are no registries referenced but not configured\n  const missingReferences = configured.filter((el) => !referenced.includes(el));\n  if (missingReferences.length > 0) {\n    throw new Error(`Registries: '${missingReferences.join(',')}' have not been referenced by any update`);\n  }\n}\n\n/**\n * Possible paths to the dependabot config file.\n * Remember to prefix with a forward slash when querying API endpoints or where necessary.\n */\nexport const POSSIBLE_CONFIG_FILE_PATHS = [\n  '.azuredevops/dependabot.yml',\n  '.azuredevops/dependabot.yaml',\n  '.github/dependabot.yaml',\n  '.github/dependabot.yml',\n];\n\n/**\n * Parse the contents of a dependabot config YAML file\n * @returns {DependabotConfig} config - the dependabot configuration\n */\nexport async function parseDependabotConfig({\n  configContents,\n  configPath,\n  variableFinder,\n}: {\n  configContents: string;\n  configPath: string;\n  variableFinder: VariableFinderFn;\n}): Promise<DependabotConfig> {\n  // Load the config\n  const loadedConfig = yaml.load(configContents);\n  if (loadedConfig === null || typeof loadedConfig !== 'object') {\n    throw new Error('Invalid dependabot config object');\n  }\n\n  // Parse the config\n  const config = await DependabotConfigSchema.parseAsync(loadedConfig);\n  const updates = parseUpdates(config, configPath);\n  const registries = await parseRegistries(config, variableFinder);\n  validateConfiguration(updates, registries);\n\n  return { ...config, updates, registries };\n}\n","import { z } from 'zod/v4';\nimport { DependabotCooldownSchema } from './config';\n\n// we use nullish() because it does optional() and allows the value to be set to null\n\nexport const DependabotCredentialSchema = z.record(z.string(), z.any());\nexport type DependabotCredential = z.infer<typeof DependabotCredentialSchema>;\n\nexport const CertificateAuthoritySchema = z.object({\n  cert: z.string(),\n  key: z.string(),\n});\nexport type CertificateAuthority = z.infer<typeof CertificateAuthoritySchema>;\n\nexport const DependabotProxyConfigSchema = z.object({\n  all_credentials: DependabotCredentialSchema.array(),\n  ca: CertificateAuthoritySchema,\n});\nexport type DependabotProxyConfig = z.infer<typeof DependabotProxyConfigSchema>;\n\nexport const DependabotSourceProviderSchema = z.enum(['azure']);\nexport type DependabotSourceProvider = z.infer<typeof DependabotSourceProviderSchema>;\n\nexport const DependabotSourceSchema = z.object({\n  provider: DependabotSourceProviderSchema,\n  repo: z.string(),\n  directory: z.string().nullish(),\n  directories: z.string().array().nullish(),\n  branch: z.string().nullish(),\n  commit: z.string().nullish(),\n  hostname: z.string().nullish(), // Must be provided if api-endpoint is\n  'api-endpoint': z.string().nullish(), // Must be provided if hostname is\n  // TODO: refine to ensure either directory or directories is provided\n  // TODO: refine to ensure either both hostname and api-endpoint have a value or both are undefined\n});\nexport type DependabotSource = z.infer<typeof DependabotSourceSchema>;\n\nexport const DependabotExistingPRSchema = z.object({\n  'dependency-name': z.string(),\n  'dependency-version': z.string().nullish(),\n  directory: z.string().nullish(),\n  removed: z.boolean().nullish(),\n});\nexport type DependabotExistingPR = z.infer<typeof DependabotExistingPRSchema>;\n\nexport const DependabotExistingGroupPRSchema = z.object({\n  'dependency-group-name': z.string(),\n  dependencies: DependabotExistingPRSchema.array(),\n});\nexport type DependabotExistingGroupPR = z.infer<typeof DependabotExistingGroupPRSchema>;\n\nexport const DependabotAllowedSchema = z.object({\n  'dependency-name': z.string().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowed = z.infer<typeof DependabotAllowedSchema>;\n\nexport const DependabotGroupRuleJobSchema = z.object({\n  patterns: z.string().array().nullish(),\n  'exclude-patterns': z.string().array().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n});\nexport type DependabotGroupRuleJob = z.infer<typeof DependabotGroupRuleJobSchema>;\n\nexport const DependabotGroupJobSchema = z.object({\n  name: z.string(),\n  'applies-to': z.string().nullish(),\n  rules: DependabotGroupRuleJobSchema,\n});\nexport type DependabotGroupJob = z.infer<typeof DependabotGroupJobSchema>;\n\nexport const DependabotConditionSchema = z.object({\n  'dependency-name': z.string(),\n  source: z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n  'updated-at': z.coerce.string().nullish(),\n  'version-requirement': z.string().nullish(),\n});\nexport type DependabotCondition = z.infer<typeof DependabotConditionSchema>;\n\nexport const DependabotSecurityAdvisorySchema = z.object({\n  'dependency-name': z.string(),\n  'affected-versions': z.string().array(),\n  'patched-versions': z.string().array().nullish(), // may not be patched as of yet\n  'unaffected-versions': z.string().array(),\n});\nexport type DependabotSecurityAdvisory = z.infer<typeof DependabotSecurityAdvisorySchema>;\n\nexport const DependabotRequirementSourceSchema = z.record(z.string(), z.any());\nexport type DependabotRequirementSource = z.infer<typeof DependabotRequirementSourceSchema>;\n\nexport const DependabotRequirementSchema = z.object({\n  file: z.string().nullish(), // e.g. 'requirements.txt' or '/Root.csproj'\n  groups: z.string().array().nullish(), // e.g. ['dependencies']\n  metadata: z.record(z.string(), z.any()).nullish(),\n  requirement: z.string().nullish(), // e.g. '==3.2.0' or '8.1.0'\n  source: DependabotRequirementSourceSchema.nullish(),\n  version: z.string().nullish(),\n  'previous-version': z.string().nullish(),\n});\nexport type DependabotRequirement = z.infer<typeof DependabotRequirementSchema>;\n\nexport const DependabotDependencySchema = z.object({\n  name: z.string(), // e.g. 'django' or 'GraphQL.Server.Ui.Voyager'\n  'previous-requirements': DependabotRequirementSchema.array().nullish(),\n  'previous-version': z.string().nullish(),\n  version: z.string().nullish(), // e.g. '5.0.1' or '8.1.0'\n  requirements: DependabotRequirementSchema.array().nullish(),\n  removed: z.boolean().nullish(),\n  directory: z.string().nullish(),\n});\nexport type DependabotDependency = z.infer<typeof DependabotDependencySchema>;\n\nexport const DependabotCommitOptionsSchema = z.object({\n  prefix: z.string().nullish(),\n  'prefix-development': z.string().nullish(),\n  'include-scope': z.boolean().nullish(),\n});\nexport type DependabotCommitOptions = z.infer<typeof DependabotCommitOptionsSchema>;\n\nexport const DependabotExperimentsSchema = z.record(z.string(), z.union([z.string(), z.boolean()]));\nexport type DependabotExperiments = z.infer<typeof DependabotExperimentsSchema>;\n\nexport const DependabotPackageManagerSchema = z.enum([\n  'bun',\n  'bundler',\n  'cargo',\n  'composer',\n  'devcontainers',\n  'docker',\n  'docker_compose', //  // ecosystem(s): 'docker-compose',\n  'dotnet_sdk', // ecosystem(s): 'dotnet-sdk'\n  'helm',\n  'hex', // ecosystem(s): 'mix'\n  'elm',\n  'submodules', // ecosystem(s): 'gitsubmodule'\n  'github_actions', // ecosystem(s): 'github-actions'\n  'go_modules', // ecosystem(s): 'gomod'\n  'gradle',\n  'maven',\n  'npm_and_yarn', // ecosystem(s): 'npm', 'pnpm', 'yarn'\n  'nuget',\n  'pip', // ecosystem(s): 'pipenv', 'pip-compile', 'poetry'\n  'pub',\n  'swift',\n  'terraform',\n  'uv',\n]);\nexport type DependabotPackageManager = z.infer<typeof DependabotPackageManagerSchema>;\n\nexport const DependabotCommandSchema = z.enum(['graph', 'version', 'recreate']);\nexport type DependabotCommand = z.infer<typeof DependabotCommandSchema>;\n\n// See: https://github.com/dependabot/cli/blob/main/internal/model/job.go\n//      https://github.com/dependabot/dependabot-core/blob/main/updater/lib/dependabot/job.rb\nexport const DependabotJobConfigSchema = z.object({\n  id: z.number().optional(),\n  command: DependabotCommandSchema.optional(),\n  'package-manager': DependabotPackageManagerSchema,\n  'allowed-updates': DependabotAllowedSchema.array(),\n  debug: z.boolean().nullable(),\n  'dependency-groups': DependabotGroupJobSchema.array().nullish(),\n  dependencies: z.string().array().nullable(),\n  'dependency-group-to-refresh': z.string().nullish(),\n  'existing-pull-requests': DependabotExistingPRSchema.array().array(),\n  'existing-group-pull-requests': DependabotExistingGroupPRSchema.array(),\n  experiments: DependabotExperimentsSchema,\n  'ignore-conditions': DependabotConditionSchema.array(),\n  'lockfile-only': z.boolean(),\n  'requirements-update-strategy': z.string().nullable(),\n  'security-advisories': DependabotSecurityAdvisorySchema.array(),\n  'security-updates-only': z.boolean(),\n  source: DependabotSourceSchema,\n  'update-subdependencies': z.boolean(),\n  'updating-a-pull-request': z.boolean(),\n  'vendor-dependencies': z.boolean(),\n  'reject-external-code': z.boolean().nullish(),\n  'repo-private': z.boolean(),\n  'commit-message-options': DependabotCommitOptionsSchema,\n  'credentials-metadata': DependabotCredentialSchema.array().nullish(),\n  'max-updater-run-time': z.int().nullish(),\n  cooldown: DependabotCooldownSchema.nullish(),\n  'proxy-log-response-body-on-auth-failure': z.boolean().nullish(),\n  'enable-beta-ecosystems': z.boolean().nullish(),\n  'multi-ecosystem-update': z.boolean().nullish(),\n});\nexport type DependabotJobConfig = z.infer<typeof DependabotJobConfigSchema>;\n\nexport const DependabotJobFileSchema = z.object({\n  job: DependabotJobConfigSchema,\n});\nexport type DependabotJobFile = z.infer<typeof DependabotJobFileSchema>;\n\n// Code below is borrowed and adapted from dependabot-action\n\n// biome-ignore-start lint/suspicious/noExplicitAny: generic\nexport type FetchedFiles = {\n  base_commit_sha: string;\n  dependency_files: any[];\n  base64_dependency_files: any[];\n};\n// biome-ignore-end lint/suspicious/noExplicitAny: generic\n\nexport type FileFetcherInput = {\n  job: DependabotJobConfig;\n};\n\nexport type FileUpdaterInput = FetchedFiles & {\n  job: DependabotJobConfig;\n};\n","import { z } from 'zod/v4';\nimport { DependabotPackageManagerSchema, DependabotSourceProviderSchema } from '@/dependabot/job';\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\"\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/tingle/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true\n * }\n * ```\n */\nexport const UsageTelemetryRequestDataSchema = z.object({\n  host: z.object({\n    platform: z.string().max(50), // e.g. linux, darwin, win32\n    release: z.string().max(100), // e.g. 26.0.0, 10.0.19043\n    arch: z.string().max(50), // e.g. x64, arm64\n    'machine-hash': z.string().max(250), // e.g. \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\" for \"Maxwells-MacBook-Pro.local\"\n  }),\n  version: z.string().max(50),\n  trigger: z.enum(['user', 'service']),\n  provider: DependabotSourceProviderSchema,\n  owner: z.url(),\n  project: z.url().optional(), // was added later hence optional for backward compatibility\n  'package-manager': DependabotPackageManagerSchema,\n  id: z.number(), // job identifier, for correlation\n  started: z.coerce.date(),\n  duration: z.number().min(0), // in milliseconds\n  success: z.boolean(),\n});\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\"\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/tingle/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true\n * }\n * ```\n */\nexport type UsageTelemetryRequestData = z.infer<typeof UsageTelemetryRequestDataSchema>;\n"],"mappings":";;;;AAKA,MAAa,2BAA2B,EACrC,OAAO;CACN,MAAM,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;CACF,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,iBAAiB,EAAE,SAAS,CAAC,UAAU;CACvC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,cAAc,EAAE,QAAQ,CAAC,UAAU;CACnC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,0BAA0B,EAAE,QAAQ,CAAC,UAAU;CAC/C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,aAAa,EAAE,QAAQ,CAAC,UAAU;CACnC,CAAC,CAED,WAAW,WAAW;CAAE,GAAG;CAAO,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;CAAE,EAAE;AAG3E,MAAa,wBAAwB,EAAE,OAAO;CAG5C,YAAY,EACT,QAAQ,CACR,MACC,EAAE,MAAM,qCAAqC,EAC3C,SACE,qHACH,CAAC,CACH,CACA,UAAU;CACb,cAAc,EAAE,KAAK,CAAC,mBAAmB,mBAAmB,CAAC,CAAC,UAAU;CACxE,mBAAmB,EAAE,KAAK,CAAC,eAAe,aAAa,CAAC,CAAC,UAAU;CACnE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACjD,gBAAgB,EAAE,KAAK;EAAC;EAAS;EAAS;EAAQ,CAAC,CAAC,OAAO,CAAC,UAAU;CACvE,CAAC;AAGF,MAAa,iCAAiC,EAAE,OAAO;CACrD,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,mBAAmB,EAAE,KAAK;EAAC;EAAU;EAAY;EAAO;EAAc;EAAc,CAAC,CAAC,UAAU;CAChG,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,kCAAkC,EAC5C,OAAO;CACN,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,UAAU;CACtD,gBAAgB,EACb,KAAK;EAAC;EAA+B;EAA+B;EAA8B,CAAC,CACnG,OAAO,CACP,UAAU;CACd,CAAC,CACD,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAGrC,MAAa,2BAA2B,EAAE,OAAO;CAC/C,UAAU,EAAE,KAAK;EAAC;EAAS;EAAU;EAAW;EAAa;EAAgB;EAAU;EAAO,CAAC;CAE/F,KAAK,EACF,KAAK;EAAC;EAAU;EAAU;EAAW;EAAa;EAAY;EAAU;EAAW,CAAC,CACpF,UAAU,CACV,QAAQ,SAAS;CAEpB,MAAM,EACH,QAAQ,CACR,QAAQ,QAAQ,CAChB,MAAM,EAAE,MAAM,uCAAuC,EAAE,SAAS,gCAAgC,CAAC,CAAC,CAClG,UAAU;CAEb,UAAU,EACP,QAAQ,CACR,UAAU,CACV,QAAQ,UAAU,CAClB,QACE,UAAU;AACT,MAAI;AAEF,QAAK,eAAe,QAAW,EAAE,UAAU,OAAO,CAAC;AACnD,UAAO;UACD;AACN,UAAO;;IAGX,EAAE,SAAS,0BAA0B,CACtC;CACH,SAAS,EACN,QAAQ,CACR,MAAM,EAAE,MAAM,yBAAyB,EAAE,SAAS,2CAA2C,CAAC,CAAC,CAC/F,UAAU;CACd,CAAC;AAGF,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,UAAU;CAC3C,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC/B,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,gBAAgB,EAAE,QAAQ,CAAC,UAAU;CACrC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACtC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,CAAC;AAGF,MAAM,wCAAwC,EAAE,OAAO,EACrD,WAAW,EAAE,QAAQ,CAAC,UAAU,EACjC,CAAC;AAGF,MAAa,yBAAyB,EAAE,KAAK;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,2BAA2B,EAAE,KAAK;CAAC;CAAQ;CAAY;CAAyB;CAAiB;CAAQ,CAAC;AAGvH,MAAa,yBAAyB,EACnC,OAAO;CACN,qBAAqB;CACrB,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC1C,OAAO,+BAA+B,OAAO,CAAC,UAAU;CACxD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACxC,kBAAkB,8BAA8B,UAAU;CAC1D,UAAU,yBAAyB,UAAU;CAC7C,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;CAC9D,QAAQ,gCAAgC,OAAO,CAAC,UAAU;CAC1D,oCAAoC,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,CAAC,UAAU;CACxE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACrC,WAAW,EAAE,OAAO,QAAQ,CAAC,UAAU;CACvC,4BAA4B,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU;CAC1E,4BAA4B,sCAAsC,UAAU;CAC5E,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACzC,UAAU,yBAAyB,UAAU;CAC7C,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACtC,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,uBAAuB,yBAAyB,UAAU;CAC3D,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;AAElC,KAAI,CAAC,MAAM,cAAc,CAAC,MAAM,eAAe,MAAM,YAAY,WAAW,GAC1E,UAAS,gGAAgG;AAI3G,KAAI,MAAM,aAAa,YAAY,KAAK,MAAM,UAAU,CACtD,UAAS,uDAAuD;AAGlE,OAAM,gCAAN,MAAM,8BAAgC;AAEtC,QAAO;EACP;;;;;AAOJ,MAAa,yBAAyB,EAAE,OAAO;CAI7C,SAAS,EAAE,QAAQ,CAAC,QAAQ,MAAM,MAAM,GAAG,EAAE,SAAS,6CAA6C,CAAC;CAMpG,SAAS,uBAAuB,OAAO,CAAC,MACtC,EAAE,UAAU,GAAG,EAAE,SAAS,iDAAiD,CAAC,CAC7E;CAMD,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,UAAU;CAMrE,0BAA0B,EAAE,SAAS,CAAC,UAAU;CACjD,CAAC;;;;AC/OF,MAAa,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAGvE,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO;CAClD,iBAAiB,2BAA2B,OAAO;CACnD,IAAI;CACL,CAAC;AAGF,MAAa,iCAAiC,EAAE,KAAK,CAAC,QAAQ,CAAC;AAG/D,MAAa,yBAAyB,EAAE,OAAO;CAC7C,UAAU;CACV,MAAM,EAAE,QAAQ;CAChB,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACzC,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;CAGrC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,mBAAmB,EAAE,QAAQ;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;CAC/B,CAAC;AAGF,MAAa,kCAAkC,EAAE,OAAO;CACtD,yBAAyB,EAAE,QAAQ;CACnC,cAAc,2BAA2B,OAAO;CACjD,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO;CAC9C,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,+BAA+B,EAAE,OAAO;CACnD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACtC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC7C,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,MAAM,EAAE,QAAQ;CAChB,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,OAAO;CACR,CAAC;AAGF,MAAa,4BAA4B,EAAE,OAAO;CAChD,mBAAmB,EAAE,QAAQ;CAC7B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC5C,cAAc,EAAE,OAAO,QAAQ,CAAC,SAAS;CACzC,uBAAuB,EAAE,QAAQ,CAAC,SAAS;CAC5C,CAAC;AAGF,MAAa,mCAAmC,EAAE,OAAO;CACvD,mBAAmB,EAAE,QAAQ;CAC7B,qBAAqB,EAAE,QAAQ,CAAC,OAAO;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,uBAAuB,EAAE,QAAQ,CAAC,OAAO;CAC1C,CAAC;AAGF,MAAa,oCAAoC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAG9E,MAAa,8BAA8B,EAAE,OAAO;CAClD,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACpC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CACjD,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,QAAQ,kCAAkC,SAAS;CACnD,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACzC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,yBAAyB,4BAA4B,OAAO,CAAC,SAAS;CACtE,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,cAAc,4BAA4B,OAAO,CAAC,SAAS;CAC3D,SAAS,EAAE,SAAS,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ,CAAC,SAAS;CAChC,CAAC;AAGF,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,iBAAiB,EAAE,SAAS,CAAC,SAAS;CACvC,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAGnG,MAAa,iCAAiC,EAAE,KAAK;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,0BAA0B,EAAE,KAAK;CAAC;CAAS;CAAW;CAAW,CAAC;AAK/E,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,QAAQ,CAAC,UAAU;CACzB,SAAS,wBAAwB,UAAU;CAC3C,mBAAmB;CACnB,mBAAmB,wBAAwB,OAAO;CAClD,OAAO,EAAE,SAAS,CAAC,UAAU;CAC7B,qBAAqB,yBAAyB,OAAO,CAAC,SAAS;CAC/D,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC3C,+BAA+B,EAAE,QAAQ,CAAC,SAAS;CACnD,0BAA0B,2BAA2B,OAAO,CAAC,OAAO;CACpE,gCAAgC,gCAAgC,OAAO;CACvE,aAAa;CACb,qBAAqB,0BAA0B,OAAO;CACtD,iBAAiB,EAAE,SAAS;CAC5B,gCAAgC,EAAE,QAAQ,CAAC,UAAU;CACrD,uBAAuB,iCAAiC,OAAO;CAC/D,yBAAyB,EAAE,SAAS;CACpC,QAAQ;CACR,0BAA0B,EAAE,SAAS;CACrC,2BAA2B,EAAE,SAAS;CACtC,uBAAuB,EAAE,SAAS;CAClC,wBAAwB,EAAE,SAAS,CAAC,SAAS;CAC7C,gBAAgB,EAAE,SAAS;CAC3B,0BAA0B;CAC1B,wBAAwB,2BAA2B,OAAO,CAAC,SAAS;CACpE,wBAAwB,EAAE,KAAK,CAAC,SAAS;CACzC,UAAU,yBAAyB,SAAS;CAC5C,2CAA2C,EAAE,SAAS,CAAC,SAAS;CAChE,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAChD,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO,EAC9C,KAAK,2BACN,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;ACvKF,MAAa,kCAAkC,EAAE,OAAO;CACtD,MAAM,EAAE,OAAO;EACb,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG;EAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,IAAI;EAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG;EACxB,gBAAgB,EAAE,QAAQ,CAAC,IAAI,IAAI;EACpC,CAAC;CACF,SAAS,EAAE,QAAQ,CAAC,IAAI,GAAG;CAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;CACpC,UAAU;CACV,OAAO,EAAE,KAAK;CACd,SAAS,EAAE,KAAK,CAAC,UAAU;CAC3B,mBAAmB;CACnB,IAAI,EAAE,QAAQ;CACd,SAAS,EAAE,OAAO,MAAM;CACxB,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,SAAS,EAAE,SAAS;CACrB,CAAC"}
+{"version":3,"file":"usage.js","names":[],"sources":["../../src/dependabot/config.ts","../../src/dependabot/job.ts","../../src/usage.ts"],"sourcesContent":["import * as yaml from 'js-yaml';\nimport { z } from 'zod/v4';\n\nimport { convertPlaceholder, type VariableFinderFn } from './placeholder';\n\nexport const DependabotRegistrySchema = z\n  .object({\n    type: z.enum([\n      // order matches\n      // https://docs.github.com/en/enterprise-cloud@latest/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#supported-private-registries\n\n      'cargo-registry',\n      'composer-repository',\n      'docker-registry',\n      'git',\n      'goproxy-server',\n      'helm-registry',\n      'hex-organization',\n      'hex-repository',\n      'maven-repository',\n      'npm-registry',\n      'nuget-feed',\n      'pub-repository',\n      'python-index',\n      'rubygems-server',\n      'terraform-registry',\n    ]),\n    url: z.string().optional(),\n    username: z.string().optional(),\n    password: z.string().optional(),\n    key: z.string().optional(),\n    token: z.string().optional(),\n    'replaces-base': z.boolean().optional(),\n    host: z.string().optional(), // for terraform and composer only\n    registry: z.string().optional(), // for npm only\n    organization: z.string().optional(), // for hex-organisation only\n    repo: z.string().optional(), // for hex-repository only\n    'public-key-fingerprint': z.string().optional(), // for hex-repository only\n    'index-url': z.string().optional(), // for python-index only\n    'auth-key': z.string().optional(), // used by composer-repository, docker-registry, etc\n    'tenant-id': z.string().optional(), // can only be for azure related stuff, not sure\n    'client-id': z.string().optional(), // can only be for azure related stuff, not sure\n  })\n  // change underscore to dash in the registry key/type\n  .transform((value) => ({ ...value, type: value.type.replace('-', '_') }));\nexport type DependabotRegistry = z.infer<typeof DependabotRegistrySchema>;\n\nexport const DependabotGroupSchema = z.object({\n  // Define an identifier for the group to use in branch names and pull request titles.\n  // This must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.\n  IDENTIFIER: z\n    .string()\n    .check(\n      z.regex(/^[a-zA-Z][a-zA-Z0-9|_-]*[a-zA-Z]$/, {\n        message:\n          'Group identifier must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.',\n      }),\n    )\n    .optional(),\n  'applies-to': z.enum(['version-updates', 'security-updates']).optional(),\n  'dependency-type': z.enum(['development', 'production']).optional(),\n  patterns: z.string().array().optional(),\n  'exclude-patterns': z.string().array().optional(),\n  'update-types': z.enum(['major', 'minor', 'patch']).array().optional(),\n});\nexport type DependabotGroup = z.infer<typeof DependabotGroupSchema>;\n\nexport const DependabotAllowConditionSchema = z.object({\n  'dependency-name': z.string().optional(),\n  'dependency-type': z.enum(['direct', 'indirect', 'all', 'production', 'development']).optional(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowCondition = z.infer<typeof DependabotAllowConditionSchema>;\n\nexport const DependabotIgnoreConditionSchema = z\n  .object({\n    'dependency-name': z.string().optional(),\n    versions: z.string().array().or(z.string()).optional(),\n    'update-types': z\n      .enum(['version-update:semver-major', 'version-update:semver-minor', 'version-update:semver-patch'])\n      .array()\n      .optional(),\n  })\n  .and(z.record(z.string(), z.any()));\nexport type DependabotIgnoreCondition = z.infer<typeof DependabotIgnoreConditionSchema>;\n\nexport const DependabotScheduleSchema = z.object({\n  interval: z.enum(['daily', 'weekly', 'monthly', 'quarterly', 'semiannually', 'yearly', 'cron']),\n\n  day: z\n    .enum(['sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'])\n    .optional()\n    .default('monday'),\n\n  time: z\n    .string()\n    .default('02:00')\n    .check(z.regex(/^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$/, { message: 'Time must be in HH:MM format' }))\n    .optional(),\n\n  timezone: z\n    .string()\n    .optional()\n    .default('Etc/UTC')\n    .refine(\n      (value) => {\n        try {\n          // If tz is not a valid IANA name, this throws a RangeError\n          Intl.DateTimeFormat(undefined, { timeZone: value });\n          return true;\n        } catch {\n          return false;\n        }\n      },\n      { message: 'Invalid IANA time zone' },\n    ),\n  cronjob: z\n    .string()\n    .check(z.regex(/^\\S+ \\S+ \\S+ \\S+ \\S+$/, { message: 'Cronjob must be in standard cron format' }))\n    .optional(),\n});\nexport type DependabotSchedule = z.infer<typeof DependabotScheduleSchema>;\n\nexport const DependabotCommitMessageSchema = z.object({\n  prefix: z.string().optional(),\n  'prefix-development': z.string().optional(),\n  include: z.string().optional(),\n});\nexport type DependabotCommitMessage = z.infer<typeof DependabotCommitMessageSchema>;\n\nexport const DependabotCooldownSchema = z.object({\n  'default-days': z.number().optional(),\n  'semver-major-days': z.number().optional(),\n  'semver-minor-days': z.number().optional(),\n  'semver-patch-days': z.number().optional(),\n  include: z.string().array().optional(),\n  exclude: z.string().array().optional(),\n});\nexport type DependabotCooldown = z.infer<typeof DependabotCooldownSchema>;\n\nconst DependabotPullRequestBranchNameSchema = z.object({\n  separator: z.string().optional(),\n});\nexport type DependabotPullRequestBranchName = z.infer<typeof DependabotPullRequestBranchNameSchema>;\n\nexport const PackageEcosystemSchema = z.enum([\n  // order matches\n  // https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-\n\n  'bun',\n  'bundler',\n  'cargo',\n  'composer',\n  'devcontainers',\n  'docker',\n  'docker-compose',\n  'dotnet-sdk',\n  'helm',\n  'mix',\n  'elm',\n  'gitsubmodule',\n  'github-actions',\n  'gomod',\n  'gradle',\n  'julia',\n  'maven',\n  'npm',\n  'nuget',\n  'pip',\n  'pip-compile', // alias mapped to 'pip'\n  'pipenv', // alias mapped to 'pip'\n  'pnpm', // alias mapped to 'npm'\n  'poetry', // alias mapped to 'pip'\n  'pub',\n  'rust-toolchain',\n  'swift',\n  'terraform',\n  'uv',\n  'vcpkg',\n  'yarn', // alias mapped to 'npm'\n]);\nexport type PackageEcosystem = z.infer<typeof PackageEcosystemSchema>;\n\nexport const VersioningStrategySchema = z.enum(['auto', 'increase', 'increase-if-necessary', 'lockfile-only', 'widen']);\nexport type VersioningStrategy = z.infer<typeof VersioningStrategySchema>;\n\nexport const DependabotUpdateSchema = z\n  .object({\n    'package-ecosystem': PackageEcosystemSchema,\n    directory: z.string().optional(),\n    directories: z.string().array().optional(),\n    'exclude-paths': z.string().array().optional(),\n    allow: DependabotAllowConditionSchema.array().optional(),\n    assignees: z.string().array().optional(),\n    'commit-message': DependabotCommitMessageSchema.optional(),\n    cooldown: DependabotCooldownSchema.optional(),\n    groups: z.record(z.string(), DependabotGroupSchema).optional(),\n    ignore: DependabotIgnoreConditionSchema.array().optional(),\n    'insecure-external-code-execution': z.enum(['allow', 'deny']).optional(),\n    labels: z.string().array().optional(),\n    milestone: z.coerce.string().optional(),\n    'open-pull-requests-limit': z.number().check(z.int(), z.gte(0)).optional(),\n    'pull-request-branch-name': DependabotPullRequestBranchNameSchema.optional(),\n    'rebase-strategy': z.string().optional(),\n    registries: z.string().array().optional(),\n    schedule: DependabotScheduleSchema.optional(), // TODO: make required after 2025-Nov-30\n    'target-branch': z.string().optional(),\n    vendor: z.boolean().optional(),\n    'versioning-strategy': VersioningStrategySchema.optional(),\n    patterns: z.string().array().optional(),\n    'multi-ecosystem-group': z.string().optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // either 'directory' or 'directories' must be specified\n    if (!value.directory && (!value.directories || value.directories.length === 0)) {\n      addIssue(\"Either 'directory' or 'directories' must be specified in the dependency update configuration.\");\n    }\n\n    // validate that 'directory' does not contain glob patterns\n    if (value.directory && /[*?[\\]{}]/.test(value.directory)) {\n      addIssue(\"The 'directory' field must not include glob pattern.\");\n    }\n\n    value['open-pull-requests-limit'] ??= 5; // default to 5 if not specified\n\n    // The patterns key is required when using multi-ecosystem-group.\n    // You can specify dependency patterns to include only certain dependencies in the group,\n    // or use [\"*\"] to include all dependencies.\n    if (value['multi-ecosystem-group'] && (!value.patterns || value.patterns.length === 0)) {\n      addIssue(\n        \"The 'patterns' field must be specified and contain at least one pattern when using 'multi-ecosystem-group'.\",\n      );\n    }\n\n    return value;\n  });\nexport type DependabotUpdate = z.infer<typeof DependabotUpdateSchema>;\n\nexport const DependabotMultiEcosystemGroupSchema = z.object({\n  schedule: DependabotScheduleSchema,\n  labels: z.string().array().optional(), // behaviour: additive\n  milestone: z.coerce.string().optional(), // behaviour: group-only\n  assignees: z.string().array().optional(), // behaviour: additive\n  'target-branch': z.string().optional(), // behaviour: group-only\n  'commit-message': DependabotCommitMessageSchema.optional(), // behaviour: group-only\n  'pull-request-branch-name': DependabotPullRequestBranchNameSchema.optional(), // behaviour: group-only\n});\nexport type DependabotMultiEcosystemGroup = z.infer<typeof DependabotMultiEcosystemGroupSchema>;\n\n/**\n * Represents the dependabot.yaml configuration file options.\n * See: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-dependabotyml\n */\nexport const DependabotConfigSchema = z\n  .object({\n    /**\n     * Mandatory. configuration file version.\n     **/\n    version: z.number().refine((v) => v === 2, { message: 'Only version 2 of dependabot is supported' }),\n\n    /**\n     * Optional. Configure groups of ecosystems to update together in a single pull request.\n     */\n    'multi-ecosystem-groups': z.record(z.string(), DependabotMultiEcosystemGroupSchema).optional(),\n\n    /**\n     * Mandatory. Configure how Dependabot updates the versions or project dependencies.\n     * Each entry configures the update settings for a particular package manager.\n     */\n    updates: DependabotUpdateSchema.array().check(\n      z.minLength(1, { message: 'At least one update configuration is required' }),\n    ),\n\n    /**\n     * Optional.\n     * Specify authentication details to access private package registries.\n     */\n    registries: z.record(z.string(), DependabotRegistrySchema).optional(),\n\n    /**\n     * Optional. Enables updates for ecosystems that are not yet generally available.\n     * https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#enable-beta-ecosystems-\n     */\n    'enable-beta-ecosystems': z.boolean().optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // If you attempt to set group-only keys at the ecosystem level (in updates entries),\n    // Dependabot will throw a configuration error and fail to process your dependabot.yml file.\n    // These keys must only be specified in the multi-ecosystem-groups section.\n    // https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates#group-only-keys\n    const groupOnlyKeys = ['milestone', 'target-branch', 'commit-message', 'pull-request-branch-name'] as const;\n    if (value['multi-ecosystem-groups']) {\n      for (const update of value.updates) {\n        for (const key of groupOnlyKeys) {\n          if (key in update) {\n            addIssue(\n              `The '${key}' field must not be specified in the 'updates' section when using 'multi-ecosystem-groups'. It is a group-only field.`,\n            );\n          }\n        }\n      }\n    }\n\n    return value;\n  });\n\nexport type DependabotConfig = z.infer<typeof DependabotConfigSchema>;\n\nexport function parseUpdates(config: DependabotConfig, configPath: string): DependabotUpdate[] {\n  const updates: DependabotUpdate[] = [];\n\n  // Parse the value of each of the updates obtained from the file\n  for (const update of config.updates) {\n    // populate the 'ignore' conditions 'source' and 'updated-at' properties, if missing\n    // NOTE: 'source' and 'updated-at' are not documented in the dependabot.yml config docs, but are defined in the dependabot-core and dependabot-cli models.\n    //       Currently they don't appear to add much value to the update process, but are populated here for completeness.\n    if (update.ignore) {\n      for (const condition of update.ignore) {\n        condition.source ??= configPath;\n        // we don't know the last updated time, so we use the current time\n        condition['updated-at'] ??= new Date().toISOString();\n      }\n    }\n\n    updates.push(update);\n  }\n  return updates;\n}\n\nexport async function parseRegistries(\n  config: DependabotConfig,\n  variableFinder: VariableFinderFn,\n): Promise<Record<string, DependabotRegistry>> {\n  // Parse the value of each of the registries obtained from the config\n  const registries: Record<string, DependabotRegistry> = {};\n  for (const [key, registry] of Object.entries(config.registries || {})) {\n    const updated = { ...registry };\n    const { type } = updated;\n\n    // handle special fields for 'hex-organization' types\n    if (type === 'hex_organization' && !updated.organization) {\n      throw new Error(`The value 'organization' in dependency registry config '${type}' is missing`);\n    }\n\n    // handle special fields for 'hex-repository' types\n    if (type === 'hex_repository' && !updated.repo) {\n      throw new Error(`The value 'repo' in dependency registry config '${key}' is missing`);\n    }\n\n    // parse username, password, key, and token while replacing tokens where necessary\n    updated.username = await convertPlaceholder({ input: updated.username, variableFinder: variableFinder });\n    updated.password = await convertPlaceholder({ input: updated.password, variableFinder: variableFinder });\n    updated.key = await convertPlaceholder({ input: updated.key, variableFinder: variableFinder });\n    updated.token = await convertPlaceholder({ input: updated.token, variableFinder: variableFinder });\n\n    // TODO: include sources for this logic, otherwise it looks like magic.\n    // Initially, this was based on reading through the dependabot-core logic\n    // but much has since changed.\n\n    // parse the url\n    const url = updated.url;\n    if (!url && type !== 'hex_organization') {\n      throw new Error(`The value 'url' in dependency registry config '${key}' is missing`);\n    }\n    if (url) {\n      /*\n       * Some credentials do not use the 'url' property in the Ruby updater.\n       * The 'host' and 'registry' properties are derived from the given URL.\n       * The 'registry' property is derived from the 'url' by stripping off the scheme.\n       * The 'host' property is derived from the hostname of the 'url'.\n       *\n       * 'npm_registry' and 'docker_registry' use 'registry' only.\n       * 'terraform_registry' uses 'host' only.\n       * 'composer_repository' uses both 'url' and 'host'.\n       * 'python_index' uses 'index-url' instead of 'url'.\n       */\n\n      if (URL.canParse(url)) {\n        const parsedUrl = new URL(url);\n\n        const addRegistry = type === 'docker_registry' || type === 'npm_registry';\n        if (addRegistry) updated.registry = url.replace('https://', '').replace('http://', '');\n\n        const addHost = type === 'composer_repository' || type === 'terraform_registry';\n        if (addHost) updated.host = parsedUrl.hostname;\n      }\n\n      if (type === 'python_index') updated['index-url'] = url;\n\n      const removeUrl =\n        type === 'docker_registry' ||\n        type === 'npm_registry' ||\n        type === 'terraform_registry' ||\n        type === 'python_index';\n      if (removeUrl) delete updated.url; // remove the url if not needed\n    }\n\n    // add to list\n    registries[key] = updated;\n  }\n  return registries;\n}\n\nexport function validateConfiguration(updates: DependabotUpdate[], registries: Record<string, DependabotRegistry>) {\n  const configured = Object.keys(registries);\n  const referenced: string[] = [];\n  for (const u of updates) referenced.push(...(u.registries ?? []));\n\n  // ensure there are no configured registries that have not been referenced\n  const missingConfiguration = referenced.filter((el) => !configured.includes(el));\n  if (missingConfiguration.length > 0) {\n    throw new Error(\n      `Referenced registries: '${missingConfiguration.join(',')}' have not been configured in the root of dependabot.yml`,\n    );\n  }\n\n  // ensure there are no registries referenced but not configured\n  const missingReferences = configured.filter((el) => !referenced.includes(el));\n  if (missingReferences.length > 0) {\n    throw new Error(`Registries: '${missingReferences.join(',')}' have not been referenced by any update`);\n  }\n}\n\n/**\n * Possible paths to the dependabot config file.\n * Remember to prefix with a forward slash when querying API endpoints or where necessary.\n */\nexport const POSSIBLE_CONFIG_FILE_PATHS = [\n  '.azuredevops/dependabot.yml',\n  '.azuredevops/dependabot.yaml',\n  '.github/dependabot.yaml',\n  '.github/dependabot.yml',\n];\n\n/**\n * Parse the contents of a dependabot config YAML file\n * @returns {DependabotConfig} config - the dependabot configuration\n */\nexport async function parseDependabotConfig({\n  configContents,\n  configPath,\n  variableFinder,\n}: {\n  configContents: string;\n  configPath: string;\n  variableFinder: VariableFinderFn;\n}): Promise<DependabotConfig> {\n  // Load the config\n  const loadedConfig = yaml.load(configContents);\n  if (loadedConfig === null || typeof loadedConfig !== 'object') {\n    throw new Error('Invalid dependabot config object');\n  }\n\n  // Parse the config\n  const config = await DependabotConfigSchema.parseAsync(loadedConfig);\n  const updates = parseUpdates(config, configPath);\n  const registries = await parseRegistries(config, variableFinder);\n  validateConfiguration(updates, registries);\n\n  return { ...config, updates, registries };\n}\n","import { z } from 'zod/v4';\nimport { DependabotCooldownSchema } from './config';\n\n// we use nullish() because it does optional() and allows the value to be set to null\n\nexport const DependabotCredentialSchema = z.record(z.string(), z.any());\nexport type DependabotCredential = z.infer<typeof DependabotCredentialSchema>;\n\nexport const CertificateAuthoritySchema = z.object({\n  cert: z.string(),\n  key: z.string(),\n});\nexport type CertificateAuthority = z.infer<typeof CertificateAuthoritySchema>;\n\nexport const DependabotProxyConfigSchema = z.object({\n  all_credentials: DependabotCredentialSchema.array(),\n  ca: CertificateAuthoritySchema,\n});\nexport type DependabotProxyConfig = z.infer<typeof DependabotProxyConfigSchema>;\n\nexport const DependabotSourceProviderSchema = z.enum(['azure']);\nexport type DependabotSourceProvider = z.infer<typeof DependabotSourceProviderSchema>;\n\nexport const DependabotSourceSchema = z.object({\n  provider: DependabotSourceProviderSchema,\n  repo: z.string(),\n  directory: z.string().nullish(),\n  directories: z.string().array().nullish(),\n  branch: z.string().nullish(),\n  commit: z.string().nullish(),\n  hostname: z.string().nullish(), // Must be provided if api-endpoint is\n  'api-endpoint': z.string().nullish(), // Must be provided if hostname is\n  // TODO: refine to ensure either directory or directories is provided\n  // TODO: refine to ensure either both hostname and api-endpoint have a value or both are undefined\n});\nexport type DependabotSource = z.infer<typeof DependabotSourceSchema>;\n\nexport const DependabotExistingPRSchema = z.object({\n  'dependency-name': z.string(),\n  'dependency-version': z.string().nullish(),\n  directory: z.string().nullish(),\n  removed: z.boolean().nullish(),\n});\nexport type DependabotExistingPR = z.infer<typeof DependabotExistingPRSchema>;\n\nexport const DependabotExistingGroupPRSchema = z.object({\n  'dependency-group-name': z.string(),\n  dependencies: DependabotExistingPRSchema.array(),\n});\nexport type DependabotExistingGroupPR = z.infer<typeof DependabotExistingGroupPRSchema>;\n\nexport const DependabotAllowedSchema = z.object({\n  'dependency-name': z.string().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowed = z.infer<typeof DependabotAllowedSchema>;\n\nexport const DependabotGroupRuleJobSchema = z.object({\n  patterns: z.string().array().nullish(),\n  'exclude-patterns': z.string().array().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n});\nexport type DependabotGroupRuleJob = z.infer<typeof DependabotGroupRuleJobSchema>;\n\nexport const DependabotGroupJobSchema = z.object({\n  name: z.string(),\n  'applies-to': z.string().nullish(),\n  rules: DependabotGroupRuleJobSchema,\n});\nexport type DependabotGroupJob = z.infer<typeof DependabotGroupJobSchema>;\n\nexport const DependabotConditionSchema = z.object({\n  'dependency-name': z.string(),\n  source: z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n  'updated-at': z.coerce.string().nullish(),\n  'version-requirement': z.string().nullish(),\n});\nexport type DependabotCondition = z.infer<typeof DependabotConditionSchema>;\n\nexport const DependabotSecurityAdvisorySchema = z.object({\n  'dependency-name': z.string(),\n  'affected-versions': z.string().array(),\n  'patched-versions': z.string().array().nullish(), // may not be patched as of yet\n  'unaffected-versions': z.string().array(),\n});\nexport type DependabotSecurityAdvisory = z.infer<typeof DependabotSecurityAdvisorySchema>;\n\nexport const DependabotRequirementSourceSchema = z.record(z.string(), z.any());\nexport type DependabotRequirementSource = z.infer<typeof DependabotRequirementSourceSchema>;\n\nexport const DependabotRequirementSchema = z.object({\n  file: z.string().nullish(), // e.g. 'requirements.txt' or '/Root.csproj'\n  groups: z.string().array().nullish(), // e.g. ['dependencies']\n  metadata: z.record(z.string(), z.any()).nullish(),\n  requirement: z.string().nullish(), // e.g. '==3.2.0' or '8.1.0'\n  source: DependabotRequirementSourceSchema.nullish(),\n  version: z.string().nullish(),\n  'previous-version': z.string().nullish(),\n});\nexport type DependabotRequirement = z.infer<typeof DependabotRequirementSchema>;\n\nexport const DependabotDependencySchema = z.object({\n  name: z.string(), // e.g. 'django' or 'GraphQL.Server.Ui.Voyager'\n  'previous-requirements': DependabotRequirementSchema.array().nullish(),\n  'previous-version': z.string().nullish(),\n  version: z.string().nullish(), // e.g. '5.0.1' or '8.1.0'\n  requirements: DependabotRequirementSchema.array().nullish(),\n  removed: z.boolean().nullish(),\n  directory: z.string().nullish(),\n});\nexport type DependabotDependency = z.infer<typeof DependabotDependencySchema>;\n\nexport const DependabotCommitOptionsSchema = z.object({\n  prefix: z.string().nullish(),\n  'prefix-development': z.string().nullish(),\n  'include-scope': z.boolean().nullish(),\n});\nexport type DependabotCommitOptions = z.infer<typeof DependabotCommitOptionsSchema>;\n\nexport const DependabotExperimentsSchema = z.record(z.string(), z.union([z.string(), z.boolean()]));\nexport type DependabotExperiments = z.infer<typeof DependabotExperimentsSchema>;\n\nexport const DependabotPackageManagerSchema = z.enum([\n  // order matches dependabot-action/src/update-containers.ts\n\n  'bundler',\n  'cargo',\n  'composer',\n  'pub',\n  'docker',\n  'elm',\n  'github_actions', // ecosystem(s): 'github-actions'\n  'submodules', // ecosystem(s): 'gitsubmodule'\n  'go_modules', // ecosystem(s): 'gomod'\n  'gradle',\n  'maven',\n  'hex', // ecosystem(s): 'mix'\n  'nuget',\n  'npm_and_yarn', // ecosystem(s): 'npm', 'pnpm', 'yarn'\n  'pip', // ecosystem(s): 'pipenv', 'pip-compile', 'poetry'\n  'rust_toolchain', // ecosystem(s): 'rust-toolchain'\n  'swift',\n  'terraform',\n  'devcontainers',\n  'dotnet_sdk', // ecosystem(s): 'dotnet-sdk'\n  'bun',\n  'docker_compose', //  // ecosystem(s): 'docker-compose',\n  'uv',\n  'vcpkg',\n  'helm',\n  'julia',\n]);\nexport type DependabotPackageManager = z.infer<typeof DependabotPackageManagerSchema>;\n\nexport const DependabotCommandSchema = z.enum(['graph', 'version', 'recreate']);\nexport type DependabotCommand = z.infer<typeof DependabotCommandSchema>;\n\n// See: https://github.com/dependabot/cli/blob/main/internal/model/job.go\n//      https://github.com/dependabot/dependabot-core/blob/main/updater/lib/dependabot/job.rb\nexport const DependabotJobConfigSchema = z.object({\n  id: z.number().optional(),\n  command: DependabotCommandSchema.optional(),\n  'package-manager': DependabotPackageManagerSchema,\n  'allowed-updates': DependabotAllowedSchema.array(),\n  debug: z.boolean().nullable(),\n  'dependency-groups': DependabotGroupJobSchema.array().nullish(),\n  dependencies: z.string().array().nullable(),\n  'dependency-group-to-refresh': z.string().nullish(),\n  'existing-pull-requests': DependabotExistingPRSchema.array().array(),\n  'existing-group-pull-requests': DependabotExistingGroupPRSchema.array(),\n  experiments: DependabotExperimentsSchema,\n  'ignore-conditions': DependabotConditionSchema.array(),\n  'lockfile-only': z.boolean(),\n  'requirements-update-strategy': z.string().nullable(),\n  'security-advisories': DependabotSecurityAdvisorySchema.array(),\n  'security-updates-only': z.boolean(),\n  source: DependabotSourceSchema,\n  'update-subdependencies': z.boolean(),\n  'updating-a-pull-request': z.boolean(),\n  'vendor-dependencies': z.boolean(),\n  'reject-external-code': z.boolean().nullish(),\n  'repo-private': z.boolean(),\n  'commit-message-options': DependabotCommitOptionsSchema,\n  'credentials-metadata': DependabotCredentialSchema.array().nullish(),\n  'max-updater-run-time': z.int().nullish(),\n  cooldown: DependabotCooldownSchema.nullish(),\n  'proxy-log-response-body-on-auth-failure': z.boolean().nullish(),\n  'enable-beta-ecosystems': z.boolean().nullish(),\n  'multi-ecosystem-update': z.boolean().nullish(),\n  'exclude-paths': z.string().array().optional(),\n});\nexport type DependabotJobConfig = z.infer<typeof DependabotJobConfigSchema>;\n\nexport const DependabotJobFileSchema = z.object({\n  job: DependabotJobConfigSchema,\n});\nexport type DependabotJobFile = z.infer<typeof DependabotJobFileSchema>;\n\n// Code below is borrowed and adapted from dependabot-action\n\n// biome-ignore-start lint/suspicious/noExplicitAny: generic\nexport type FetchedFiles = {\n  base_commit_sha: string;\n  dependency_files: any[];\n  base64_dependency_files: any[];\n};\n// biome-ignore-end lint/suspicious/noExplicitAny: generic\n\nexport type FileFetcherInput = {\n  job: DependabotJobConfig;\n};\n\nexport type FileUpdaterInput = FetchedFiles & {\n  job: DependabotJobConfig;\n};\n","import { z } from 'zod/v4';\nimport { DependabotPackageManagerSchema, DependabotSourceProviderSchema } from '@/dependabot/job';\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\"\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/tingle/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true\n * }\n * ```\n */\nexport const UsageTelemetryRequestDataSchema = z.object({\n  host: z.object({\n    platform: z.string().max(50), // e.g. linux, darwin, win32\n    release: z.string().max(100), // e.g. 26.0.0, 10.0.19043\n    arch: z.string().max(50), // e.g. x64, arm64\n    'machine-hash': z.string().max(250), // e.g. \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\" for \"Maxwells-MacBook-Pro.local\"\n  }),\n  version: z.string().max(50),\n  trigger: z.enum(['user', 'service']),\n  provider: DependabotSourceProviderSchema,\n  owner: z.url(),\n  project: z.url().optional(), // was added later hence optional for backward compatibility\n  'package-manager': DependabotPackageManagerSchema,\n  id: z.number(), // job identifier, for correlation\n  started: z.coerce.date(),\n  duration: z.number().min(0), // in milliseconds\n  success: z.boolean(),\n});\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\"\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/tingle/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true\n * }\n * ```\n */\nexport type UsageTelemetryRequestData = z.infer<typeof UsageTelemetryRequestDataSchema>;\n"],"mappings":";;;;AAKA,MAAa,2BAA2B,EACrC,OAAO;CACN,MAAM,EAAE,KAAK;EAIX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;CACF,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,iBAAiB,EAAE,SAAS,CAAC,UAAU;CACvC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,cAAc,EAAE,QAAQ,CAAC,UAAU;CACnC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,0BAA0B,EAAE,QAAQ,CAAC,UAAU;CAC/C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,aAAa,EAAE,QAAQ,CAAC,UAAU;CACnC,CAAC,CAED,WAAW,WAAW;CAAE,GAAG;CAAO,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;CAAE,EAAE;AAG3E,MAAa,wBAAwB,EAAE,OAAO;CAG5C,YAAY,EACT,QAAQ,CACR,MACC,EAAE,MAAM,qCAAqC,EAC3C,SACE,qHACH,CAAC,CACH,CACA,UAAU;CACb,cAAc,EAAE,KAAK,CAAC,mBAAmB,mBAAmB,CAAC,CAAC,UAAU;CACxE,mBAAmB,EAAE,KAAK,CAAC,eAAe,aAAa,CAAC,CAAC,UAAU;CACnE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACjD,gBAAgB,EAAE,KAAK;EAAC;EAAS;EAAS;EAAQ,CAAC,CAAC,OAAO,CAAC,UAAU;CACvE,CAAC;AAGF,MAAa,iCAAiC,EAAE,OAAO;CACrD,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,mBAAmB,EAAE,KAAK;EAAC;EAAU;EAAY;EAAO;EAAc;EAAc,CAAC,CAAC,UAAU;CAChG,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,kCAAkC,EAC5C,OAAO;CACN,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,UAAU;CACtD,gBAAgB,EACb,KAAK;EAAC;EAA+B;EAA+B;EAA8B,CAAC,CACnG,OAAO,CACP,UAAU;CACd,CAAC,CACD,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAGrC,MAAa,2BAA2B,EAAE,OAAO;CAC/C,UAAU,EAAE,KAAK;EAAC;EAAS;EAAU;EAAW;EAAa;EAAgB;EAAU;EAAO,CAAC;CAE/F,KAAK,EACF,KAAK;EAAC;EAAU;EAAU;EAAW;EAAa;EAAY;EAAU;EAAW,CAAC,CACpF,UAAU,CACV,QAAQ,SAAS;CAEpB,MAAM,EACH,QAAQ,CACR,QAAQ,QAAQ,CAChB,MAAM,EAAE,MAAM,uCAAuC,EAAE,SAAS,gCAAgC,CAAC,CAAC,CAClG,UAAU;CAEb,UAAU,EACP,QAAQ,CACR,UAAU,CACV,QAAQ,UAAU,CAClB,QACE,UAAU;AACT,MAAI;AAEF,QAAK,eAAe,QAAW,EAAE,UAAU,OAAO,CAAC;AACnD,UAAO;UACD;AACN,UAAO;;IAGX,EAAE,SAAS,0BAA0B,CACtC;CACH,SAAS,EACN,QAAQ,CACR,MAAM,EAAE,MAAM,yBAAyB,EAAE,SAAS,2CAA2C,CAAC,CAAC,CAC/F,UAAU;CACd,CAAC;AAGF,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,UAAU;CAC3C,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC/B,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,gBAAgB,EAAE,QAAQ,CAAC,UAAU;CACrC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACtC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,CAAC;AAGF,MAAM,wCAAwC,EAAE,OAAO,EACrD,WAAW,EAAE,QAAQ,CAAC,UAAU,EACjC,CAAC;AAGF,MAAa,yBAAyB,EAAE,KAAK;CAI3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,2BAA2B,EAAE,KAAK;CAAC;CAAQ;CAAY;CAAyB;CAAiB;CAAQ,CAAC;AAGvH,MAAa,yBAAyB,EACnC,OAAO;CACN,qBAAqB;CACrB,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC1C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC9C,OAAO,+BAA+B,OAAO,CAAC,UAAU;CACxD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACxC,kBAAkB,8BAA8B,UAAU;CAC1D,UAAU,yBAAyB,UAAU;CAC7C,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;CAC9D,QAAQ,gCAAgC,OAAO,CAAC,UAAU;CAC1D,oCAAoC,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,CAAC,UAAU;CACxE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACrC,WAAW,EAAE,OAAO,QAAQ,CAAC,UAAU;CACvC,4BAA4B,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU;CAC1E,4BAA4B,sCAAsC,UAAU;CAC5E,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACzC,UAAU,yBAAyB,UAAU;CAC7C,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACtC,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,uBAAuB,yBAAyB,UAAU;CAC1D,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,yBAAyB,EAAE,QAAQ,CAAC,UAAU;CAC/C,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;AAElC,KAAI,CAAC,MAAM,cAAc,CAAC,MAAM,eAAe,MAAM,YAAY,WAAW,GAC1E,UAAS,gGAAgG;AAI3G,KAAI,MAAM,aAAa,YAAY,KAAK,MAAM,UAAU,CACtD,UAAS,uDAAuD;AAGlE,OAAM,gCAAN,MAAM,8BAAgC;AAKtC,KAAI,MAAM,6BAA6B,CAAC,MAAM,YAAY,MAAM,SAAS,WAAW,GAClF,UACE,8GACD;AAGH,QAAO;EACP;AAGJ,MAAa,sCAAsC,EAAE,OAAO;CAC1D,UAAU;CACV,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACrC,WAAW,EAAE,OAAO,QAAQ,CAAC,UAAU;CACvC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACxC,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACtC,kBAAkB,8BAA8B,UAAU;CAC1D,4BAA4B,sCAAsC,UAAU;CAC7E,CAAC;;;;;AAOF,MAAa,yBAAyB,EACnC,OAAO;CAIN,SAAS,EAAE,QAAQ,CAAC,QAAQ,MAAM,MAAM,GAAG,EAAE,SAAS,6CAA6C,CAAC;CAKpG,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE,oCAAoC,CAAC,UAAU;CAM9F,SAAS,uBAAuB,OAAO,CAAC,MACtC,EAAE,UAAU,GAAG,EAAE,SAAS,iDAAiD,CAAC,CAC7E;CAMD,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,UAAU;CAMrE,0BAA0B,EAAE,SAAS,CAAC,UAAU;CACjD,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;CAKlC,MAAM,gBAAgB;EAAC;EAAa;EAAiB;EAAkB;EAA2B;AAClG,KAAI,MAAM,2BACR;OAAK,MAAM,UAAU,MAAM,QACzB,MAAK,MAAM,OAAO,cAChB,KAAI,OAAO,OACT,UACE,QAAQ,IAAI,uHACb;;AAMT,QAAO;EACP;;;;AC3SJ,MAAa,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAGvE,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO;CAClD,iBAAiB,2BAA2B,OAAO;CACnD,IAAI;CACL,CAAC;AAGF,MAAa,iCAAiC,EAAE,KAAK,CAAC,QAAQ,CAAC;AAG/D,MAAa,yBAAyB,EAAE,OAAO;CAC7C,UAAU;CACV,MAAM,EAAE,QAAQ;CAChB,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACzC,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;CAGrC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,mBAAmB,EAAE,QAAQ;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;CAC/B,CAAC;AAGF,MAAa,kCAAkC,EAAE,OAAO;CACtD,yBAAyB,EAAE,QAAQ;CACnC,cAAc,2BAA2B,OAAO;CACjD,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO;CAC9C,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,+BAA+B,EAAE,OAAO;CACnD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACtC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC7C,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,MAAM,EAAE,QAAQ;CAChB,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,OAAO;CACR,CAAC;AAGF,MAAa,4BAA4B,EAAE,OAAO;CAChD,mBAAmB,EAAE,QAAQ;CAC7B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC5C,cAAc,EAAE,OAAO,QAAQ,CAAC,SAAS;CACzC,uBAAuB,EAAE,QAAQ,CAAC,SAAS;CAC5C,CAAC;AAGF,MAAa,mCAAmC,EAAE,OAAO;CACvD,mBAAmB,EAAE,QAAQ;CAC7B,qBAAqB,EAAE,QAAQ,CAAC,OAAO;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,uBAAuB,EAAE,QAAQ,CAAC,OAAO;CAC1C,CAAC;AAGF,MAAa,oCAAoC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAG9E,MAAa,8BAA8B,EAAE,OAAO;CAClD,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACpC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CACjD,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,QAAQ,kCAAkC,SAAS;CACnD,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACzC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,yBAAyB,4BAA4B,OAAO,CAAC,SAAS;CACtE,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,cAAc,4BAA4B,OAAO,CAAC,SAAS;CAC3D,SAAS,EAAE,SAAS,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ,CAAC,SAAS;CAChC,CAAC;AAGF,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,iBAAiB,EAAE,SAAS,CAAC,SAAS;CACvC,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAGnG,MAAa,iCAAiC,EAAE,KAAK;CAGnD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,0BAA0B,EAAE,KAAK;CAAC;CAAS;CAAW;CAAW,CAAC;AAK/E,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,QAAQ,CAAC,UAAU;CACzB,SAAS,wBAAwB,UAAU;CAC3C,mBAAmB;CACnB,mBAAmB,wBAAwB,OAAO;CAClD,OAAO,EAAE,SAAS,CAAC,UAAU;CAC7B,qBAAqB,yBAAyB,OAAO,CAAC,SAAS;CAC/D,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC3C,+BAA+B,EAAE,QAAQ,CAAC,SAAS;CACnD,0BAA0B,2BAA2B,OAAO,CAAC,OAAO;CACpE,gCAAgC,gCAAgC,OAAO;CACvE,aAAa;CACb,qBAAqB,0BAA0B,OAAO;CACtD,iBAAiB,EAAE,SAAS;CAC5B,gCAAgC,EAAE,QAAQ,CAAC,UAAU;CACrD,uBAAuB,iCAAiC,OAAO;CAC/D,yBAAyB,EAAE,SAAS;CACpC,QAAQ;CACR,0BAA0B,EAAE,SAAS;CACrC,2BAA2B,EAAE,SAAS;CACtC,uBAAuB,EAAE,SAAS;CAClC,wBAAwB,EAAE,SAAS,CAAC,SAAS;CAC7C,gBAAgB,EAAE,SAAS;CAC3B,0BAA0B;CAC1B,wBAAwB,2BAA2B,OAAO,CAAC,SAAS;CACpE,wBAAwB,EAAE,KAAK,CAAC,SAAS;CACzC,UAAU,yBAAyB,SAAS;CAC5C,2CAA2C,EAAE,SAAS,CAAC,SAAS;CAChE,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC/C,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO,EAC9C,KAAK,2BACN,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;AC7KF,MAAa,kCAAkC,EAAE,OAAO;CACtD,MAAM,EAAE,OAAO;EACb,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG;EAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,IAAI;EAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG;EACxB,gBAAgB,EAAE,QAAQ,CAAC,IAAI,IAAI;EACpC,CAAC;CACF,SAAS,EAAE,QAAQ,CAAC,IAAI,GAAG;CAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;CACpC,UAAU;CACV,OAAO,EAAE,KAAK;CACd,SAAS,EAAE,KAAK,CAAC,UAAU;CAC3B,mBAAmB;CACnB,IAAI,EAAE,QAAQ;CACd,SAAS,EAAE,OAAO,MAAM;CACxB,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,SAAS,EAAE,SAAS;CACrB,CAAC"}

package/dist/node/azure.d.ts

@@ -1,4 +1,4 @@
-import { D as DependabotUpdatePullRequest, Yt as DependabotConfig, ft as DependabotDependency, gt as DependabotExistingPR, mt as DependabotExistingGroupPR, r as DependabotCreatePullRequest, t as DependabotClosePullRequest, yn as VariableFinderFn } from "./index-DP9JfUPG.js";
+import { D as DependabotUpdatePullRequest, Yt as DependabotConfig, ft as DependabotDependency, gt as DependabotExistingPR, mt as DependabotExistingGroupPR, r as DependabotCreatePullRequest, t as DependabotClosePullRequest, xn as VariableFinderFn } from "./index-Dgl6vmM4.js";
 import "./index-3wZw74Ah.js";
 import * as zod_v40 from "zod/v4";
 import * as zod_v4_core0 from "zod/v4/core";
@@ -170,21 +170,41 @@ interface IAbandonPullRequest {
 }
 //#endregion
 //#region src/azure/url-parts.d.ts
-type AzureDevOpsUrl = {
+type AzureDevOpsOrganizationUrl = {
   /** URL of the organisation. This may lack the project name */
   url: URL;
   /** Organisation URL hostname */
   hostname: string;
   /** Organisation API endpoint URL */
   'api-endpoint': string;
+  /** Organisation name/slug */
+  organisation: string;
+  /** Virtual directory if present (on-premises only) */
+  'virtual-directory'?: string;
+};
+type AzureDevOpsProjectUrl = AzureDevOpsOrganizationUrl & {
   /** Project ID or Name */
   project: string;
+};
+type AzureDevOpsRepositoryUrl = AzureDevOpsProjectUrl & {
   /** Repository ID or Name */
   repository: string;
   /** Slug of the repository e.g. `contoso/prj1/_git/repo1`, `tfs/contoso/prj1/_git/repo1` */
   'repository-slug': string;
 };
-declare function extractUrlParts({
+declare function extractOrganizationUrl({
+  organisationUrl
+}: {
+  organisationUrl: string;
+}): AzureDevOpsOrganizationUrl;
+declare function extractProjectUrl({
+  organisationUrl,
+  project
+}: {
+  organisationUrl: string;
+  project: string;
+}): AzureDevOpsProjectUrl;
+declare function extractRepositoryUrl({
   organisationUrl,
   project,
   repository
@@ -192,9 +212,11 @@ declare function extractUrlParts({
   organisationUrl: string;
   project: string;
   repository: string;
-}): AzureDevOpsUrl;
+}): AzureDevOpsRepositoryUrl;
 //#endregion
 //#region src/azure/client.d.ts
+/** Returned from AzureDevOpsWebApiClient.getUserId() when no user is authenticated */
+declare const ANONYMOUS_USER_ID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa";
 /** Azure DevOps REST API client. */
 declare class AzureDevOpsWebApiClient {
   private readonly organisationApiUrl;
@@ -205,7 +227,7 @@ declare class AzureDevOpsWebApiClient {
   private resolvedUserIds;
   static API_VERSION: string;
   static API_VERSION_PREVIEW: string;
-  constructor(url: AzureDevOpsUrl, accessToken: string, debug?: boolean);
+  constructor(url: AzureDevOpsOrganizationUrl, accessToken: string, debug?: boolean);
   /**
    * Get the identity of the authenticated user.
    * @returns
@@ -296,7 +318,7 @@ declare function getDependabotConfig({
   rootDir,
   variableFinder
 }: {
-  url: AzureDevOpsUrl;
+  url: AzureDevOpsRepositoryUrl;
   token: string;
   /**
    * Whether to fetch the configuration file via the REST API (true) or look for it locally (false).
@@ -334,5 +356,5 @@ declare function getPullRequestCloseReasonForOutputData(data: DependabotClosePul
 declare function getPullRequestDependenciesPropertyValueForOutputData(data: DependabotCreatePullRequest): DependabotExistingPR[] | DependabotExistingGroupPR;
 declare function getPullRequestDescription(packageManager: string, body: string | null | undefined, dependencies: DependabotDependency[]): string;
 //#endregion
-export { type AzureDevOpsUrl, AzureDevOpsWebApiClient, CommentThreadStatus, CommentType, DEVOPS_PR_PROPERTY_DEPENDABOT_DEPENDENCIES, DEVOPS_PR_PROPERTY_DEPENDABOT_PACKAGE_MANAGER, DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, DependenciesPrPropertySchema, GitPullRequestMergeStrategy, IAbandonPullRequest, IApprovePullRequest, ICreatePullRequest, IFileChange, IPullRequestProperties, IUpdatePullRequest, IdentityRefWithVote, ItemContentType, PullRequestAsyncStatus, PullRequestStatus, VersionControlChangeType, buildPullRequestProperties, extractUrlParts, getDependabotConfig, getPullRequestChangedFilesForOutputData, getPullRequestCloseReasonForOutputData, getPullRequestDependenciesPropertyValueForOutputData, getPullRequestDescription, getPullRequestForDependencyNames, normalizeBranchName, normalizeFilePath, parsePullRequestProperties, sendRestApiRequestWithRetry };
+export { ANONYMOUS_USER_ID, type AzureDevOpsOrganizationUrl, type AzureDevOpsProjectUrl, type AzureDevOpsRepositoryUrl, AzureDevOpsWebApiClient, CommentThreadStatus, CommentType, DEVOPS_PR_PROPERTY_DEPENDABOT_DEPENDENCIES, DEVOPS_PR_PROPERTY_DEPENDABOT_PACKAGE_MANAGER, DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, DependenciesPrPropertySchema, GitPullRequestMergeStrategy, IAbandonPullRequest, IApprovePullRequest, ICreatePullRequest, IFileChange, IPullRequestProperties, IUpdatePullRequest, IdentityRefWithVote, ItemContentType, PullRequestAsyncStatus, PullRequestStatus, VersionControlChangeType, buildPullRequestProperties, extractOrganizationUrl, extractProjectUrl, extractRepositoryUrl, getDependabotConfig, getPullRequestChangedFilesForOutputData, getPullRequestCloseReasonForOutputData, getPullRequestDependenciesPropertyValueForOutputData, getPullRequestDescription, getPullRequestForDependencyNames, normalizeBranchName, normalizeFilePath, parsePullRequestProperties, sendRestApiRequestWithRetry };
 //# sourceMappingURL=azure.d.ts.map

package/dist/node/azure.js

@@ -1,8 +1,8 @@
 import "./environment-DX5CD-dD.js";
 import { n as logger } from "./logger-bWnHxtAf.js";
 import { r as isErrorTemporaryFailure, t as HttpRequestError } from "./http-BG_-s47I.js";
-import { P as parseDependabotConfig, c as DependabotExistingGroupPRSchema, j as POSSIBLE_CONFIG_FILE_PATHS, l as DependabotExistingPRSchema } from "./job-Crr4kh3e.js";
-import "./dependabot-BteoKZVy.js";
+import { F as parseDependabotConfig, M as POSSIBLE_CONFIG_FILE_PATHS, c as DependabotExistingGroupPRSchema, l as DependabotExistingPRSchema } from "./job-C8KX68QT.js";
+import "./dependabot-BmHuie46.js";
 import * as path from "node:path";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -188,6 +188,8 @@ function getPullRequestDescription(packageManager, body, dependencies) {
 
 //#endregion
 //#region src/azure/client.ts
+/** Returned from AzureDevOpsWebApiClient.getUserId() when no user is authenticated */
+const ANONYMOUS_USER_ID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa";
 /** Azure DevOps REST API client. */
 var AzureDevOpsWebApiClient = class AzureDevOpsWebApiClient {
 	organisationApiUrl;
@@ -681,7 +683,7 @@ async function getDependabotConfig({ url, token, remote, rootDir = process.cwd()
 
 //#endregion
 //#region src/azure/url-parts.ts
-function extractUrlParts({ organisationUrl, project, repository }) {
+function extractOrganizationUrl({ organisationUrl }) {
 	const url = new URL(organisationUrl);
 	const protocol = url.protocol.slice(0, -1);
 	let { hostname } = url;
@@ -689,14 +691,32 @@ function extractUrlParts({ organisationUrl, project, repository }) {
 	const organisation = extractOrganisation(organisationUrl);
 	const virtualDirectory = extractVirtualDirectory(url);
 	const apiEndpoint = `${protocol}://${hostname}${url.port ? `:${url.port}` : ""}/${virtualDirectory ? `${virtualDirectory}/` : ""}`;
-	const escapedProject = encodeURI(project);
-	const escapedRepository = encodeURI(repository);
-	const repoSlug = `${virtualDirectory ? `${virtualDirectory}/` : ""}${organisation}/${escapedProject}/_git/${escapedRepository}`;
 	return {
 		url,
 		hostname,
 		"api-endpoint": apiEndpoint,
-		project: escapedProject,
+		organisation,
+		"virtual-directory": virtualDirectory
+	};
+}
+function extractProjectUrl({ organisationUrl, project }) {
+	const extracted = extractOrganizationUrl({ organisationUrl });
+	const escapedProject = encodeURI(project);
+	return {
+		...extracted,
+		project: escapedProject
+	};
+}
+function extractRepositoryUrl({ organisationUrl, project, repository }) {
+	const extracted = extractProjectUrl({
+		organisationUrl,
+		project
+	});
+	const { organisation, "virtual-directory": virtualDirectory, project: escapedProject } = extracted;
+	const escapedRepository = encodeURI(repository);
+	const repoSlug = `${virtualDirectory ? `${virtualDirectory}/` : ""}${organisation}/${escapedProject}/_git/${escapedRepository}`;
+	return {
+		...extracted,
 		repository: escapedRepository,
 		"repository-slug": repoSlug
 	};
@@ -731,5 +751,5 @@ function extractVirtualDirectory(organisationUrl) {
 }
 
 //#endregion
-export { AzureDevOpsWebApiClient, CommentThreadStatus, CommentType, DEVOPS_PR_PROPERTY_DEPENDABOT_DEPENDENCIES, DEVOPS_PR_PROPERTY_DEPENDABOT_PACKAGE_MANAGER, DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, DependenciesPrPropertySchema, GitPullRequestMergeStrategy, ItemContentType, PullRequestAsyncStatus, PullRequestStatus, VersionControlChangeType, buildPullRequestProperties, extractUrlParts, getDependabotConfig, getPullRequestChangedFilesForOutputData, getPullRequestCloseReasonForOutputData, getPullRequestDependenciesPropertyValueForOutputData, getPullRequestDescription, getPullRequestForDependencyNames, normalizeBranchName, normalizeFilePath, parsePullRequestProperties, sendRestApiRequestWithRetry };
+export { ANONYMOUS_USER_ID, AzureDevOpsWebApiClient, CommentThreadStatus, CommentType, DEVOPS_PR_PROPERTY_DEPENDABOT_DEPENDENCIES, DEVOPS_PR_PROPERTY_DEPENDABOT_PACKAGE_MANAGER, DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, DependenciesPrPropertySchema, GitPullRequestMergeStrategy, ItemContentType, PullRequestAsyncStatus, PullRequestStatus, VersionControlChangeType, buildPullRequestProperties, extractOrganizationUrl, extractProjectUrl, extractRepositoryUrl, getDependabotConfig, getPullRequestChangedFilesForOutputData, getPullRequestCloseReasonForOutputData, getPullRequestDependenciesPropertyValueForOutputData, getPullRequestDescription, getPullRequestForDependencyNames, normalizeBranchName, normalizeFilePath, parsePullRequestProperties, sendRestApiRequestWithRetry };
 //# sourceMappingURL=azure.js.map