@paklo/core 0.11.1 → 0.12.1

package/dist/{dependabot-DbKUmEV3.mjs → dependabot-DAdoJJp4.mjs}

@@ -35,18 +35,15 @@ const DEFAULT_EXPERIMENTS = {
 	"record-ecosystem-versions": true,
 	"record-update-job-unknown-error": true,
 	"proxy-cached": true,
-	"dependency-change-validation": true,
-	"enable-file-parser-python-local": true,
-	"npm-fallback-version-above-v6": true,
 	"enable-record-ecosystem-meta": true,
 	"enable-corepack-for-npm-and-yarn": true,
+	"enable-private-registry-for-corepack": true,
 	"enable-shared-helpers-command-timeout": true,
 	"enable-dependabot-setting-up-cronjob": true,
 	"enable-engine-version-detection": true,
 	"avoid-duplicate-updates-package-json": true,
 	"allow-refresh-for-existing-pr-dependencies": true,
 	"allow-refresh-group-with-all-dependencies": true,
-	"exclude-local-composer-packages": true,
 	"enable-enhanced-error-details-for-updater": true,
 	"gradle-lockfile-updater": true,
 	"enable-exclude-paths-subdirectory-manifest-files": true,
@@ -700,4 +697,4 @@ function getPullRequestDescription({ packageManager, body, dependencies, maxDesc
 
 //#endregion
 export { DependabotJobBuilder as A, DEFAULT_EXPERIMENTS as B, DependabotRecordEcosystemMetaSchema as C, DependabotRecordUpdateJobWarningSchema as D, DependabotRecordUpdateJobUnknownErrorSchema as E, mapIgnoreConditionsFromDependabotConfigToJobConfig as F, DEPENDABOT_DEFAULT_AUTHOR_EMAIL as G, setExperiment as H, mapPackageEcosystemToPackageManager as I, DEPENDABOT_DEFAULT_AUTHOR_NAME as K, mapSecurityAdvisories as L, mapCredentials as M, mapExperiments as N, DependabotUpdateDependencyListSchema as O, mapGroupsFromDependabotConfigToJobConfig as P, mapSourceFromDependabotConfigToJobConfig as R, DependabotRecordCooldownMetaSchema as S, DependabotRecordUpdateJobErrorSchema as T, getBranchNameForUpdate as U, parseExperiments as V, sanitizeRef as W, DependabotEcosystemVersionManagerSchema as _, getPullRequestDescription as a, DependabotMarkAsProcessedSchema as b, DependabotRequestSchema as c, DependabotClosePullRequestReasonEnum as d, DependabotClosePullRequestSchema as f, DependabotEcosystemMetaSchema as g, DependabotDependencySubmissionSchema as h, getPullRequestDependencies as i, mapAllowedUpdatesFromDependabotConfigToJobConfig as j, DependabotUpdatePullRequestSchema as k, DependabotRequestTypeSchema as l, DependabotDependencyFileSchema as m, getDependencyNames as n, normalizeBranchName as o, DependabotCreatePullRequestSchema as p, getPullRequestCloseReason as r, normalizeFilePath as s, areEqual as t, createApiServerApp as u, DependabotIncrementMetricSchema as v, DependabotRecordEcosystemVersionsSchema as w, DependabotMetricSchema as x, DependabotJobErrorSchema as y, mapVersionStrategyToRequirementsUpdateStrategy as z };
-//# sourceMappingURL=dependabot-DbKUmEV3.mjs.map
+//# sourceMappingURL=dependabot-DAdoJJp4.mjs.map

package/dist/dependabot-DAdoJJp4.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependabot-DAdoJJp4.mjs","names":[],"sources":["../src/dependabot/author.ts","../src/dependabot/branch-name.ts","../src/dependabot/experiments.ts","../src/dependabot/job-builder.ts","../src/dependabot/update.ts","../src/dependabot/server.ts","../src/dependabot/utils.ts"],"sourcesContent":["export type GitAuthor = {\n  name: string;\n  email: string;\n};\n\nexport const DEPENDABOT_DEFAULT_AUTHOR_EMAIL = 'noreply@github.com';\nexport const DEPENDABOT_DEFAULT_AUTHOR_NAME = 'dependabot[bot]';\n","import * as crypto from 'node:crypto';\nimport type { PackageEcosystem } from './config';\nimport type { DependabotExistingPR } from './job';\n\n// TODO: figure out how to handle IDENTIFIER field (in a group) in branch naming\n// Docs: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#groups--\n// -> An identifier for a group is used in branch names and pull request titles.\n\nexport function getBranchNameForUpdate({\n  packageEcosystem,\n  targetBranchName,\n  directory,\n  dependencyGroupName,\n  dependencies,\n  separator = '/',\n}: {\n  packageEcosystem: PackageEcosystem;\n  targetBranchName?: string;\n  directory?: string;\n  dependencyGroupName?: string;\n  dependencies: DependabotExistingPR[];\n  separator?: string;\n}): string {\n  // Based on dependabot-core implementation:\n  // https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/pull_request_creator/branch_namer/solo_strategy.rb\n  // https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/pull_request_creator/branch_namer/dependency_group_strategy.rb\n  let branchName: string;\n  const branchNameMightBeTooLong = dependencyGroupName || dependencies.length > 1;\n  if (branchNameMightBeTooLong) {\n    // Group/multi dependency update\n    // e.g. dependabot/nuget/main/microsoft-3b49c54d9e\n    const dependencyDigest = crypto\n      .createHash('md5')\n      .update(dependencies.map((d) => `${d['dependency-name']}-${d['dependency-version']}`).join(','))\n      .digest('hex')\n      .substring(0, 10);\n    branchName = `${dependencyGroupName || 'multi'}-${dependencyDigest}`;\n  } else {\n    // Single dependency update\n    // e.g. dependabot/nuget/main/Microsoft.Extensions.Logging-1.0.0\n    const dependencyNames = dependencies\n      .map((d) => d['dependency-name'])\n      .join('-and-')\n      .replace(/[:[]]/g, '-') // Replace `:` and `[]` with `-`\n      .replace(/@/g, ''); // Remove `@`\n    const versionSuffix = dependencies[0]?.removed ? 'removed' : dependencies[0]?.['dependency-version'];\n    branchName = `${dependencyNames}-${versionSuffix}`;\n  }\n\n  return sanitizeRef(\n    [\n      'dependabot',\n      packageEcosystem,\n      targetBranchName,\n      // normalize directory to remove leading/trailing slashes and replace remaining ones with the separator\n      directory\n        ? directory\n            .split('/')\n            .filter((part) => part.length > 0)\n            .join(separator)\n        : undefined,\n      branchName,\n    ],\n    separator,\n  );\n}\n\nexport function sanitizeRef(refParts: (string | undefined)[], separator: string): string {\n  // Based on dependabot-core implementation:\n  // https://github.com/dependabot/dependabot-core/blob/fc31ae64f492dc977cfe6773ab13fb6373aabec4/common/lib/dependabot/pull_request_creator/branch_namer/base.rb#L99\n\n  // This isn't a complete implementation of git's ref validation, but it\n  // covers most cases that crop up. Its list of allowed characters is a\n  // bit stricter than git's, but that's for cosmetic reasons.\n  return (\n    refParts\n      // Join the parts with the separator, ignore empty parts\n      .filter((p) => p && p.trim().length > 0)\n      .join(separator)\n      // Remove forbidden characters (those not already replaced elsewhere)\n      .replace(/[^A-Za-z0-9/\\-_.(){}]/g, '')\n      // Slashes can't be followed by periods\n      .replace(/\\/\\./g, '/dot-')\n      // Squeeze out consecutive periods and slashes\n      .replace(/\\.+/g, '.')\n      .replace(/\\/+/g, '/')\n      // Trailing periods are forbidden\n      .replace(/\\.$/, '')\n  );\n}\n","import type { DependabotExperiments } from './job';\n\n// The default experiments known to be used by the GitHub Dependabot service.\n// This changes often, update as needed by extracting them from a Dependabot GitHub Action run.\n//  e.g. https://github.com/mburumaxwell/paklo/actions/workflows/dependabot/dependabot-updates\nexport const DEFAULT_EXPERIMENTS: DependabotExperiments = {\n  'record-ecosystem-versions': true,\n  'record-update-job-unknown-error': true,\n  'proxy-cached': true,\n  'enable-record-ecosystem-meta': true,\n  'enable-corepack-for-npm-and-yarn': true,\n  'enable-private-registry-for-corepack': true,\n  'enable-shared-helpers-command-timeout': true,\n  'enable-dependabot-setting-up-cronjob': true,\n  'enable-engine-version-detection': true,\n  'avoid-duplicate-updates-package-json': true,\n  'allow-refresh-for-existing-pr-dependencies': true,\n  'allow-refresh-group-with-all-dependencies': true,\n  'enable-enhanced-error-details-for-updater': true,\n  'gradle-lockfile-updater': true,\n  'enable-exclude-paths-subdirectory-manifest-files': true,\n  'group-membership-enforcement': true,\n  'deprecate-close-command': true,\n  'deprecate-reopen-command': true,\n  'deprecate-merge-command': true,\n  'deprecate-cancel-merge-command': true,\n  'deprecate-squash-merge-command': true,\n};\n\n/**\n * Parses a comma-separated list of key=value pairs representing experiments.\n * @param raw A comma-separated list of key=value pairs representing experiments.\n * @returns A map of experiment names to their values.\n */\nexport function parseExperiments(raw?: string): DependabotExperiments | undefined {\n  return raw\n    ?.split(',')\n    .filter((entry) => entry.trim() !== '') // <-- filter out empty entries\n    .reduce((acc, cur) => {\n      const [key, value] = cur.split('=', 2);\n      acc[key!] = value || true;\n      return acc;\n    }, {} as DependabotExperiments);\n}\n\n/**\n * Set experiment in the given experiments map.\n * If the experiments map is undefined, a new map will be created.\n * @param experiments The experiments map to set the experiment in.\n * @param name The name of the experiment to set.\n * @param value The value of the experiment to set. Defaults to true.\n * @returns The updated experiments map.\n */\nexport function setExperiment(\n  experiments: DependabotExperiments | undefined,\n  name: string,\n  value: boolean | string = true,\n): DependabotExperiments {\n  return {\n    ...(experiments || {}),\n    // always add the experiment, even if the value is false or an empty string\n    // this allows explicit disabling of experiments\n    [name]: value,\n  };\n}\n","import type { SecurityVulnerability } from '@/github';\nimport type {\n  DependabotAllowCondition,\n  DependabotConfig,\n  DependabotGroup,\n  DependabotIgnoreCondition,\n  DependabotRegistry,\n  DependabotUpdate,\n  PackageEcosystem,\n  VersioningStrategy,\n} from './config';\nimport { setExperiment } from './experiments';\nimport type {\n  DependabotAllowed,\n  DependabotCondition,\n  DependabotCredential,\n  DependabotExistingGroupPR,\n  DependabotExperiments,\n  DependabotGroupJob,\n  DependabotJobConfig,\n  DependabotPackageManager,\n  DependabotPersistedPr,\n  DependabotSecurityAdvisory,\n  DependabotSource,\n  DependabotSourceProvider,\n} from './job';\n\nexport type DependabotSourceInfo = {\n  provider: DependabotSourceProvider;\n  hostname: string;\n  'api-endpoint': string;\n  'repository-slug': string;\n};\n\nexport type DependabotJobBuilderOutput = {\n  job: DependabotJobConfig;\n  credentials: DependabotCredential[];\n};\n\n/**\n * Class for building dependabot job objects\n */\nexport class DependabotJobBuilder {\n  private readonly config: DependabotConfig;\n  private readonly update: DependabotUpdate;\n  private readonly experiments: DependabotExperiments;\n  private readonly debug: boolean;\n\n  private readonly packageManager: DependabotPackageManager;\n  private readonly source: DependabotSource;\n  private readonly credentials: DependabotCredential[];\n\n  constructor({\n    source,\n    config,\n    update,\n    systemAccessUser,\n    systemAccessToken,\n    githubToken,\n    experiments,\n    debug,\n  }: {\n    source: DependabotSourceInfo;\n    config: DependabotConfig;\n    update: DependabotUpdate;\n    experiments: DependabotExperiments;\n    systemAccessUser?: string;\n    systemAccessToken?: string;\n    githubToken?: string;\n    /** Determines if verbose log messages are logged */\n    debug: boolean;\n  }) {\n    this.config = config;\n    this.update = update;\n    this.debug = debug;\n\n    this.experiments = setExperiment(experiments, 'enable_beta_ecosystems', config['enable-beta-ecosystems']);\n\n    this.packageManager = mapPackageEcosystemToPackageManager(update['package-ecosystem']);\n    this.source = mapSourceFromDependabotConfigToJobConfig(source, update);\n    this.credentials = mapCredentials({\n      sourceHostname: source.hostname,\n      systemAccessUser,\n      systemAccessToken,\n      githubToken,\n      registries: config.registries,\n    });\n  }\n\n  /**\n   * Create a dependabot update job that updates nothing, but will discover the dependency list for a package ecosystem\n   */\n  public forDependenciesList({\n    id,\n    command,\n  }: {\n    id: string;\n    command: DependabotJobConfig['command'];\n  }): DependabotJobBuilderOutput {\n    return {\n      job: {\n        id: id,\n        command: command,\n        'package-manager': this.packageManager,\n        'updating-a-pull-request': false,\n        dependencies: null,\n        'allowed-updates': [{ 'dependency-type': 'direct', 'update-type': 'all' }],\n        'ignore-conditions': [{ 'dependency-name': '*' }],\n        'security-updates-only': false,\n        'security-advisories': [],\n        source: this.source,\n        'update-subdependencies': false,\n        'existing-pull-requests': [],\n        'existing-group-pull-requests': [],\n        experiments: this.experiments,\n        'requirements-update-strategy': null,\n        'lockfile-only': false,\n        'commit-message-options': {\n          prefix: null,\n          'prefix-development': null,\n          'include-scope': null,\n        },\n        'vendor-dependencies': false,\n        'repo-private': true,\n        debug: this.debug,\n      },\n      credentials: this.credentials,\n    };\n  }\n\n  /**\n   * Create a dependabot update job that updates all dependencies for a package ecosystem\n   */\n  public forUpdate({\n    id,\n    command,\n    dependencyNamesToUpdate,\n    existingPullRequests,\n    pullRequestToUpdate,\n    securityVulnerabilities,\n  }: {\n    id: string;\n    command: DependabotJobConfig['command'];\n    dependencyNamesToUpdate?: string[];\n    existingPullRequests: DependabotPersistedPr[];\n    pullRequestToUpdate?: DependabotPersistedPr;\n    securityVulnerabilities?: SecurityVulnerability[];\n  }): DependabotJobBuilderOutput {\n    const securityOnlyUpdate = this.update['open-pull-requests-limit'] === 0;\n\n    let updatingPullRequest: boolean;\n    let updateDependencyGroupName: string | null = null;\n    let updateDependencyNames: string[] | null;\n    let vulnerabilities: SecurityVulnerability[] | undefined;\n\n    if (pullRequestToUpdate) {\n      updatingPullRequest = true;\n      updateDependencyGroupName = Array.isArray(pullRequestToUpdate)\n        ? null\n        : pullRequestToUpdate['dependency-group-name'];\n      updateDependencyNames = (\n        Array.isArray(pullRequestToUpdate) ? pullRequestToUpdate : pullRequestToUpdate.dependencies\n      )?.map((d) => d['dependency-name']);\n      vulnerabilities = securityVulnerabilities?.filter((v) => updateDependencyNames?.includes(v.package.name));\n    } else {\n      updatingPullRequest = false;\n      const names = dependencyNamesToUpdate?.length ? dependencyNamesToUpdate : null;\n      updateDependencyNames =\n        securityOnlyUpdate && names\n          ? names?.filter((d) => securityVulnerabilities?.find((v) => v.package.name === d))\n          : names;\n      vulnerabilities = securityVulnerabilities;\n    }\n\n    return {\n      job: {\n        id: id,\n        command: command,\n        'package-manager': this.packageManager,\n        'updating-a-pull-request': updatingPullRequest || false,\n        'dependency-group-to-refresh': updateDependencyGroupName,\n        'dependency-groups': mapGroupsFromDependabotConfigToJobConfig(this.update.groups),\n        dependencies: updateDependencyNames,\n        'allowed-updates': mapAllowedUpdatesFromDependabotConfigToJobConfig(this.update.allow, securityOnlyUpdate),\n        'ignore-conditions': mapIgnoreConditionsFromDependabotConfigToJobConfig(this.update.ignore),\n        'security-updates-only': securityOnlyUpdate,\n        'security-advisories': mapSecurityAdvisories(vulnerabilities),\n        source: this.source,\n        'update-subdependencies': false,\n        'existing-pull-requests': existingPullRequests.filter((pr) => Array.isArray(pr)),\n        'existing-group-pull-requests': existingPullRequests.filter(\n          (pr): pr is DependabotExistingGroupPR => !Array.isArray(pr),\n        ),\n        'commit-message-options': {\n          prefix: this.update['commit-message']?.prefix ?? null,\n          'prefix-development': this.update['commit-message']?.['prefix-development'] ?? null,\n          'include-scope':\n            this.update['commit-message']?.include?.toLocaleLowerCase()?.trim() === 'scope' ? true : null,\n        },\n        cooldown: this.update.cooldown,\n        experiments: mapExperiments(this.experiments),\n        'reject-external-code':\n          this.update['insecure-external-code-execution']?.toLocaleLowerCase()?.trim() === 'allow',\n        'requirements-update-strategy': mapVersionStrategyToRequirementsUpdateStrategy(\n          this.update['versioning-strategy'],\n        ),\n        'lockfile-only': this.update['versioning-strategy'] === 'lockfile-only',\n        'vendor-dependencies': this.update.vendor ?? false,\n        'repo-private': true,\n        debug: this.debug,\n        'proxy-log-response-body-on-auth-failure': true,\n        'max-updater-run-time': 2700,\n        'enable-beta-ecosystems': this.config['enable-beta-ecosystems'] || false,\n        // Updates across ecosystems is still in development\n        // See https://github.com/dependabot/dependabot-core/issues/8126\n        //     https://github.com/dependabot/dependabot-core/pull/12339\n        // It needs to merged in the core repo first before we support it\n        // However, to match current job configs and to prevent surprises, we disable it\n        'multi-ecosystem-update': false,\n        'exclude-paths': this.update['exclude-paths'],\n      },\n      credentials: this.credentials,\n    };\n  }\n}\n\nexport function mapPackageEcosystemToPackageManager(ecosystem: PackageEcosystem): DependabotPackageManager {\n  // Map the dependabot config \"package ecosystem\" to the equivalent dependabot-core/cli \"package manager\".\n  // Config values: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-\n  // Core/CLI values: https://github.com/dependabot/dependabot-core/blob/main/common/lib/dependabot/config/file.rb#L60-L81\n  switch (ecosystem) {\n    case 'docker-compose':\n      return 'docker_compose';\n    case 'dotnet-sdk':\n      return 'dotnet_sdk';\n    case 'github-actions':\n      return 'github_actions';\n    case 'gitsubmodule':\n      return 'submodules';\n    case 'gomod':\n      return 'go_modules';\n    case 'mix':\n      return 'hex';\n    case 'npm':\n      return 'npm_and_yarn';\n    // Additional aliases, sometimes used for convenience\n    case 'pipenv':\n      return 'pip';\n    case 'pip-compile':\n      return 'pip';\n    case 'poetry':\n      return 'pip';\n    case 'pnpm':\n      return 'npm_and_yarn';\n    case 'rust-toolchain':\n      return 'rust_toolchain';\n    case 'yarn':\n      return 'npm_and_yarn';\n    default:\n      return ecosystem;\n  }\n}\n\nexport function mapSourceFromDependabotConfigToJobConfig(\n  source: DependabotSourceInfo,\n  update: DependabotUpdate,\n): DependabotSource {\n  return {\n    provider: source.provider,\n    'api-endpoint': source['api-endpoint'],\n    hostname: source.hostname,\n    repo: source['repository-slug'],\n    branch: update['target-branch'],\n    commit: null, // use latest commit of target branch\n    directory: update.directory,\n    directories: update.directories,\n  };\n}\n\nexport function mapVersionStrategyToRequirementsUpdateStrategy(strategy?: VersioningStrategy): string | null {\n  if (!strategy) return null;\n  switch (strategy) {\n    case 'auto':\n      return null;\n    case 'increase':\n      return 'bump_versions';\n    case 'increase-if-necessary':\n      return 'bump_versions_if_necessary';\n    case 'lockfile-only':\n      return 'lockfile_only';\n    case 'widen':\n      return 'widen_ranges';\n    default:\n      throw new Error(`Invalid dependabot.yaml versioning strategy option '${strategy}'`);\n  }\n}\n\nexport function mapGroupsFromDependabotConfigToJobConfig(\n  dependencyGroups?: Record<string, DependabotGroup | null>,\n): DependabotGroupJob[] {\n  if (!dependencyGroups || !Object.keys(dependencyGroups).length) return [];\n  return Object.keys(dependencyGroups)\n    .filter((name) => dependencyGroups[name])\n    .map((name) => {\n      const group = dependencyGroups[name]!;\n      return {\n        name: name,\n        'applies-to': group['applies-to'],\n        rules: {\n          patterns: group.patterns?.length ? group.patterns : ['*'],\n          'exclude-patterns': group['exclude-patterns'],\n          'dependency-type': group['dependency-type'],\n          'update-types': group['update-types'],\n        },\n      } satisfies DependabotGroupJob;\n    });\n}\n\nexport function mapAllowedUpdatesFromDependabotConfigToJobConfig(\n  allowedUpdates?: DependabotAllowCondition[],\n  securityOnlyUpdate?: boolean,\n): DependabotAllowed[] {\n  // If no allow conditions are specified, update direct dependencies by default; This is what GitHub does.\n  // NOTE: 'update-type' appears to be a deprecated config, but still appears in the dependabot-core model and GitHub Dependabot job logs.\n  //       See: https://github.com/dependabot/dependabot-core/blob/b3a0c1f86c20729494097ebc695067099f5b4ada/updater/lib/dependabot/job.rb#L253C1-L257C78\n  if (!allowedUpdates) {\n    return [\n      {\n        'dependency-type': 'direct',\n        'update-type': securityOnlyUpdate ? 'security' : 'all',\n      },\n    ];\n  }\n  return allowedUpdates.map((allow) => {\n    return {\n      'dependency-name': allow['dependency-name'],\n      'dependency-type': allow['dependency-type'],\n      'update-type': allow['update-type'],\n    };\n  });\n}\n\nexport function mapIgnoreConditionsFromDependabotConfigToJobConfig(\n  ignoreConditions?: DependabotIgnoreCondition[],\n): DependabotCondition[] {\n  if (!ignoreConditions) return [];\n  return ignoreConditions.map((ignore) => {\n    return {\n      source: ignore.source,\n      'updated-at': ignore['updated-at'],\n      'dependency-name': ignore['dependency-name'] ?? '*',\n      'update-types': ignore['update-types'],\n\n      // The dependabot.yml config docs are not very clear about acceptable values; after scanning dependabot-core and dependabot-cli,\n      // this could either be a single version string (e.g. '>1.0.0'), or multiple version strings separated by commas (e.g. '>1.0.0, <2.0.0')\n      'version-requirement': Array.isArray(ignore.versions) ? (<string[]>ignore.versions)?.join(', ') : ignore.versions,\n    } satisfies DependabotCondition;\n  });\n}\n\nexport function mapExperiments(experiments?: DependabotExperiments): DependabotExperiments {\n  experiments ??= {};\n  return Object.keys(experiments).reduce((acc, key) => {\n    // Experiment values are known to be either 'true', 'false', or a string value.\n    // If the value is 'true' or 'false', convert it to a boolean type so that dependabot-core handles it correctly.\n    const value = experiments[key];\n    if (typeof value === 'string' && value?.toLocaleLowerCase() === 'true') {\n      acc[key] = true;\n    } else if (typeof value === 'string' && value?.toLocaleLowerCase() === 'false') {\n      acc[key] = false;\n    } else {\n      if (typeof value === 'string' || typeof value === 'boolean') acc[key] = value;\n    }\n    return acc;\n  }, {} as DependabotExperiments);\n}\n\nexport function mapSecurityAdvisories(securityVulnerabilities?: SecurityVulnerability[]): DependabotSecurityAdvisory[] {\n  if (!securityVulnerabilities) return [];\n\n  // A single security advisory can cause a vulnerability in multiple versions of a package.\n  // We need to map each unique security advisory to a list of affected-versions and patched-versions.\n  const vulnerabilitiesGroupedByPackageNameAndAdvisoryId = new Map<string, SecurityVulnerability[]>();\n  for (const vuln of securityVulnerabilities) {\n    const key = `${vuln.package.name}/${vuln.advisory.identifiers.map((i) => `${i.type}:${i.value}`).join('/')}`;\n    if (!vulnerabilitiesGroupedByPackageNameAndAdvisoryId.has(key)) {\n      vulnerabilitiesGroupedByPackageNameAndAdvisoryId.set(key, []);\n    }\n    vulnerabilitiesGroupedByPackageNameAndAdvisoryId.get(key)!.push(vuln);\n  }\n  return Array.from(vulnerabilitiesGroupedByPackageNameAndAdvisoryId.values()).map((vulns) => {\n    return {\n      'dependency-name': vulns[0]!.package.name,\n      'affected-versions': vulns.map((v) => v.vulnerableVersionRange).filter((v) => v && v.length > 0),\n      'patched-versions': vulns\n        .map((v) => v.firstPatchedVersion?.identifier)\n        .filter((v) => v && v.length > 0)\n        .map((v) => v!),\n      'unaffected-versions': [],\n    } satisfies DependabotSecurityAdvisory;\n  });\n}\n\nexport function mapCredentials({\n  sourceHostname,\n  systemAccessUser,\n  systemAccessToken,\n  githubToken,\n  registries,\n}: {\n  sourceHostname: string;\n  systemAccessUser?: string;\n  systemAccessToken?: string;\n  githubToken?: string;\n  registries?: Record<string, DependabotRegistry>;\n}): DependabotCredential[] {\n  const credentials = [];\n\n  // Required to authenticate with the git repository when cloning the source code\n  if (systemAccessToken) {\n    credentials.push({\n      type: 'git_source',\n      host: sourceHostname,\n      username: (systemAccessUser ?? '').trim()?.length > 0 ? systemAccessUser : 'x-access-token',\n      password: systemAccessToken,\n    });\n  }\n\n  // Required to avoid rate-limiting errors when generating pull request descriptions (e.g. fetching release notes, commit messages, etc)\n  if (githubToken) {\n    credentials.push({\n      type: 'git_source',\n      host: 'github.com',\n      username: 'x-access-token',\n      password: githubToken,\n    });\n  }\n  if (registries) {\n    // TODO: only registries for the current update should be set\n    // Required to authenticate with private package feeds when finding the latest version of dependencies.\n    // The registries have already been worked on (see parseRegistries) so there is no need to do anything else.\n    credentials.push(...Object.values(registries));\n  }\n\n  return credentials;\n}\n","import { z } from 'zod';\nimport { DependabotDependencySchema, DependabotPackageManagerSchema } from './job';\n\n// we use nullish() because it does optional() and allows the value to be set to null\n\nexport const DependabotDependencyFileSchema = z.object({\n  // https://github.com/dependabot/dependabot-core/blob/5e2711f9913cc387acb7cb0d29d51fb52d235ef2/common/lib/dependabot/dependency_file.rb#L14-L15\n  content: z.string().nullish(),\n  content_encoding: z\n    .enum([\n      'utf-8',\n      'base64',\n      // for some reason, some files (e.g. txt in gomod) are marked as empty string encoding\n      '',\n    ])\n    .nullish(),\n  deleted: z.boolean().nullish(),\n  directory: z.string(),\n  name: z.string(),\n  operation: z.enum(['update', 'create', 'delete']),\n  support_file: z.boolean().nullish(),\n  vendored_file: z.boolean().nullish(),\n  symlink_target: z.string().nullish(),\n  type: z.string().nullish(),\n  mode: z\n    .enum({\n      executable: '100755',\n      file: '100644',\n      directory: '040000',\n      submodule: '160000',\n      symlink: '120000',\n    })\n    .or(z.string())\n    .nullish(),\n});\nexport type DependabotDependencyFile = z.infer<typeof DependabotDependencyFileSchema>;\n\nexport const DependabotUpdateDependencyListSchema = z.object({\n  dependencies: DependabotDependencySchema.array(),\n  dependency_files: z.string().array().nullish(),\n});\nexport type DependabotUpdateDependencyList = z.infer<typeof DependabotUpdateDependencyListSchema>;\n\nexport const DependabotDependencySubmissionSchema = z.object({\n  version: z.number(),\n  sha: z.string(),\n  ref: z.string(),\n  job: z.object({\n    correlator: z.string(),\n    id: z.string(),\n  }),\n  detector: z.object({\n    name: z.string(),\n    version: z.string(),\n    url: z.string(),\n  }),\n  manifests: z.object({\n    name: z.string().nullish(),\n    file: z.object({ source_location: z.string() }).nullish(),\n    metadata: z.object({ ecosystem: DependabotPackageManagerSchema }).nullish(),\n    resolved: z\n      .object({\n        package_url: z.string(),\n        relationship: z.enum(['direct', 'indirect']),\n        scope: z.enum(['runtime', 'development']),\n        dependencies: DependabotDependencySchema.array(),\n      })\n      .nullish(),\n  }),\n});\nexport type DependabotDependencySubmission = z.infer<typeof DependabotDependencySubmissionSchema>;\n\nexport const DependabotCreatePullRequestSchema = z.object({\n  'base-commit-sha': z.string(),\n  dependencies: DependabotDependencySchema.array(),\n  'updated-dependency-files': DependabotDependencyFileSchema.array(),\n  'pr-title': z.string(),\n  'pr-body': z.string().nullish(),\n  'commit-message': z.string(),\n  'dependency-group': z.record(z.string(), z.any()).nullish(),\n});\nexport type DependabotCreatePullRequest = z.infer<typeof DependabotCreatePullRequestSchema>;\n\nexport const DependabotUpdatePullRequestSchema = z.object({\n  'base-commit-sha': z.string(),\n  'dependency-names': z.string().array(),\n  'updated-dependency-files': DependabotDependencyFileSchema.array(),\n  'pr-title': z.string().nullish(), // this is usually excluded when working with dependabot-cli and an empty string if the API\n  'pr-body': z.string().nullish(), // this is usually excluded when working with dependabot-cli and an empty string if the API\n  'commit-message': z.string().nullish(), // this is usually excluded when working with dependabot-cli and an empty string if the API\n  'dependency-group': z.record(z.string(), z.any()).nullish(),\n});\nexport type DependabotUpdatePullRequest = z.infer<typeof DependabotUpdatePullRequestSchema>;\n\nexport const DependabotClosePullRequestReasonEnum = z.enum([\n  'dependencies_changed',\n  'dependency_group_empty',\n  'dependency_removed',\n  'up_to_date',\n  'update_no_longer_possible',\n]);\nexport type DependabotClosePullRequestReason = z.infer<typeof DependabotClosePullRequestReasonEnum>;\nexport const DependabotClosePullRequestSchema = z.object({\n  'dependency-names': z.string().array(),\n  reason: DependabotClosePullRequestReasonEnum.nullish(),\n});\nexport type DependabotClosePullRequest = z.infer<typeof DependabotClosePullRequestSchema>;\n\nexport const DependabotMarkAsProcessedSchema = z.object({\n  'base-commit-sha': z.string().nullish(),\n});\nexport type DependabotMarkAsProcessed = z.infer<typeof DependabotMarkAsProcessedSchema>;\n\nexport const DependabotJobErrorSchema = z.object({\n  'error-type': z.string(),\n  'error-details': z.record(z.string(), z.any()).nullish(),\n  unknown: z.boolean().nullish(), // own property to differentiate between known and unknown errors\n});\nexport type DependabotJobError = z.infer<typeof DependabotJobErrorSchema>;\n\nexport const DependabotRecordUpdateJobErrorSchema = DependabotJobErrorSchema.extend({});\nexport type DependabotRecordUpdateJobError = z.infer<typeof DependabotRecordUpdateJobErrorSchema>;\n\nexport const DependabotRecordUpdateJobWarningSchema = z.object({\n  'warn-type': z.string(),\n  'warn-title': z.string(),\n  'warn-description': z.string(),\n});\nexport type DependabotRecordUpdateJobWarning = z.infer<typeof DependabotRecordUpdateJobWarningSchema>;\n\nexport const DependabotRecordUpdateJobUnknownErrorSchema = DependabotJobErrorSchema.extend({});\nexport type DependabotRecordUpdateJobUnknownError = z.infer<typeof DependabotRecordUpdateJobUnknownErrorSchema>;\n\nexport const DependabotRecordEcosystemVersionsSchema = z.object({\n  ecosystem_versions: z.record(z.string(), z.any()).nullish(),\n});\nexport type DependabotRecordEcosystemVersions = z.infer<typeof DependabotRecordEcosystemVersionsSchema>;\n\nexport const DependabotEcosystemVersionManagerSchema = z.object({\n  name: z.string(),\n  version: z.string(),\n  raw_version: z.string(),\n  requirement: z.record(z.string(), z.any()).nullish(),\n});\nexport type DependabotEcosystemVersionManager = z.infer<typeof DependabotEcosystemVersionManagerSchema>;\n\nexport const DependabotEcosystemMetaSchema = z.object({\n  name: z.string(),\n  package_manager: DependabotEcosystemVersionManagerSchema.nullish(),\n  language: DependabotEcosystemVersionManagerSchema.nullish(),\n  version: DependabotEcosystemVersionManagerSchema.nullish(),\n});\nexport type DependabotEcosystemMeta = z.infer<typeof DependabotEcosystemMetaSchema>;\n\nexport const DependabotRecordEcosystemMetaSchema = z.object({\n  ecosystem: DependabotEcosystemMetaSchema,\n});\nexport type DependabotRecordEcosystemMeta = z.infer<typeof DependabotRecordEcosystemMetaSchema>;\n\nexport const DependabotRecordCooldownMetaSchema = z.object({\n  cooldown: z.object({\n    ecosystem_name: DependabotPackageManagerSchema,\n    config: z.object({\n      default_days: z.number(),\n      semver_major_days: z.number(),\n      semver_minor_days: z.number(),\n      semver_patch_days: z.number(),\n    }),\n  }),\n});\nexport type DependabotRecordCooldownMeta = z.infer<typeof DependabotRecordCooldownMetaSchema>;\n\nexport const DependabotIncrementMetricSchema = z.object({\n  metric: z.string(),\n  tags: z.record(z.string(), z.any()).nullish(),\n});\nexport type DependabotIncrementMetric = z.infer<typeof DependabotIncrementMetricSchema>;\n\nexport const DependabotMetricSchema = z.object({\n  metric: z.string(),\n  type: z.enum(['increment', 'gauge', 'distribution', 'histogram']),\n  value: z.number().nullish(),\n  values: z.number().array().nullish(),\n  tags: z.record(z.string(), z.string()).nullish(),\n});\nexport type DependabotMetric = z.infer<typeof DependabotMetricSchema>;\n","import { zValidator } from '@hono/zod-validator';\nimport { Hono } from 'hono';\nimport { type ZodType, z } from 'zod';\nimport { logger } from '@/logger';\nimport type { DependabotCredential, DependabotJobConfig } from './job';\nimport {\n  DependabotClosePullRequestSchema,\n  DependabotCreatePullRequestSchema,\n  DependabotDependencySubmissionSchema,\n  DependabotIncrementMetricSchema,\n  DependabotMarkAsProcessedSchema,\n  DependabotMetricSchema,\n  DependabotRecordCooldownMetaSchema,\n  DependabotRecordEcosystemMetaSchema,\n  DependabotRecordEcosystemVersionsSchema,\n  DependabotRecordUpdateJobErrorSchema,\n  DependabotRecordUpdateJobUnknownErrorSchema,\n  DependabotRecordUpdateJobWarningSchema,\n  DependabotUpdateDependencyListSchema,\n  DependabotUpdatePullRequestSchema,\n} from './update';\n\nexport const DependabotRequestTypeSchema = z.enum([\n  'create_pull_request',\n  'update_pull_request',\n  'close_pull_request',\n  'record_update_job_error',\n  'record_update_job_warning',\n  'record_update_job_unknown_error',\n  'mark_as_processed',\n  'update_dependency_list',\n  'create_dependency_submission',\n  'record_ecosystem_versions',\n  'increment_metric',\n  'record_ecosystem_meta',\n  'record_cooldown_meta',\n  'record_metrics', // from the runner\n]);\nexport type DependabotRequestType = z.infer<typeof DependabotRequestTypeSchema>;\n\nexport const DependabotRequestSchema = z.discriminatedUnion('type', [\n  z.object({ type: z.literal('create_pull_request'), data: DependabotCreatePullRequestSchema }),\n  z.object({ type: z.literal('update_pull_request'), data: DependabotUpdatePullRequestSchema }),\n  z.object({ type: z.literal('close_pull_request'), data: DependabotClosePullRequestSchema }),\n  z.object({ type: z.literal('record_update_job_error'), data: DependabotRecordUpdateJobErrorSchema }),\n  z.object({ type: z.literal('record_update_job_warning'), data: DependabotRecordUpdateJobWarningSchema }),\n  z.object({ type: z.literal('record_update_job_unknown_error'), data: DependabotRecordUpdateJobUnknownErrorSchema }),\n  z.object({ type: z.literal('mark_as_processed'), data: DependabotMarkAsProcessedSchema }),\n  z.object({ type: z.literal('update_dependency_list'), data: DependabotUpdateDependencyListSchema }),\n  z.object({ type: z.literal('create_dependency_submission'), data: DependabotDependencySubmissionSchema }),\n  z.object({ type: z.literal('record_ecosystem_versions'), data: DependabotRecordEcosystemVersionsSchema }),\n  z.object({ type: z.literal('record_ecosystem_meta'), data: DependabotRecordEcosystemMetaSchema.array() }),\n  z.object({ type: z.literal('record_cooldown_meta'), data: DependabotRecordCooldownMetaSchema.array() }),\n  z.object({ type: z.literal('increment_metric'), data: DependabotIncrementMetricSchema }),\n  z.object({ type: z.literal('record_metrics'), data: DependabotMetricSchema.array() }), // from the runner\n]);\nexport type DependabotRequest = z.infer<typeof DependabotRequestSchema>;\n\nexport type DependabotTokenType = 'job' | 'credentials';\n\n/**\n * Function type for authenticating requests.\n * @param type - The type of authentication ('job' or 'credentials').\n * @param id - The ID of the dependabot job.\n * @param value - The authentication value (e.g., API key).\n * @returns A promise that resolves to a boolean indicating whether the authentication was successful.\n */\ntype AuthenticatorFunc = (type: DependabotTokenType, id: string, value: string) => Promise<boolean>;\n\n/**\n * Handler function for processing dependabot requests.\n * @param id - The ID of the dependabot job.\n * @param request - The dependabot request to handle.\n * @returns A promise that resolves to the result of handling the request.\n */\ntype HandlerFunc = (id: string, request: DependabotRequest) => Promise<boolean>;\n\n/**\n * Function for inspecting raw dependabot requests.\n * @param id - The ID of the dependabot job.\n * @param type - The type of dependabot request.\n * @param raw - The raw JSON data of the request.\n * @returns A promise that resolves when the operation is complete.\n */\ntype InspectRequestFunc = (id: string, type: DependabotRequestType, raw: unknown) => Promise<void>;\n\n/**\n * Function for getting a dependabot job config by ID.\n * @param id - The ID of the dependabot job.\n * @returns A promise that resolves to the dependabot job config, or undefined if not found.\n */\ntype GetJobFunc = (id: string) => Promise<DependabotJobConfig | undefined>;\n\n/**\n * Function for getting dependabot credentials by job ID.\n * @param id - The ID of the dependabot job.\n * @returns A promise that resolves to an array of dependabot credentials, or undefined if not found.\n */\ntype GetCredentialsFunc = (id: string) => Promise<DependabotCredential[] | undefined>;\n\nexport type CreateApiServerAppOptions = {\n  /**\n   * Base path for the endpoints.\n   * @default `/api/update_jobs`\n   */\n  basePath?: string;\n\n  /** Handler function for authenticating requests. */\n  authenticate: AuthenticatorFunc;\n\n  /** Function for getting a dependabot job by ID. */\n  getJob: GetJobFunc;\n\n  /** Function for getting dependabot credentials by job ID. */\n  getCredentials: GetCredentialsFunc;\n\n  /**\n   * Optional function for inspecting raw dependabot requests.\n   * Should only be used for troubleshooting.\n   * */\n  inspect?: InspectRequestFunc;\n\n  /** Handler function for processing the operations. */\n  handle: HandlerFunc;\n};\n\n/**\n * Creates an API server application for handling dependabot update jobs.\n * The endpoints in the server application have paths in the format: `/api/update_jobs/:id/{operation}`,\n * where `:id` is the job ID and `{operation}` is one of the defined operations e.g. `create_pull_request`.\n *\n * You should set the job endpoint URL in the job container to\n * `http://<host>:<port>/api/update_jobs/:id` where `<host>` and `<port>` are the host and port\n *\n * These endpoints are protected using the provided API key.\n * @param params - The parameters for creating the API server application.\n * @returns The created API server application.\n */\nexport function createApiServerApp({\n  basePath = `/api/update_jobs`,\n  authenticate,\n  getJob,\n  getCredentials,\n  inspect,\n  handle,\n}: CreateApiServerAppOptions): Hono {\n  // Setup app with base path and middleware\n  const app = new Hono().basePath(basePath);\n\n  // Handle endpoints:\n  // - POST  request to /create_pull_request\n  // - POST  request to /update_pull_request\n  // - POST  request to /close_pull_request\n  // - POST  request to /record_update_job_error\n  // - POST  request to /record_update_job_warning\n  // - POST  request to /record_update_job_unknown_error\n  // - PATCH request to /mark_as_processed\n  // - POST  request to /update_dependency_list\n  // - POST  request to /create_dependency_submission\n  // - POST  request to /record_ecosystem_versions\n  // - POST  request to /record_ecosystem_meta\n  // - POST  request to /increment_metric\n\n  function operation<T extends ZodType>(type: DependabotRequestType, schema: T, method?: string) {\n    app.on(\n      method || 'post',\n      `/:id/${type}`,\n      zValidator('param', z.object({ id: z.string() })),\n      async (context, next) => {\n        /**\n         * Do not authenticate in scenarios where the server is not using HTTPS because the\n         * dependabot proxy will not send the job token over HTTP, yet trying to get HTTPS to work\n         * with localhost (self-signed certs) against docker (host.docker.internal) is complicated.\n         */\n        const url = new URL(context.req.url);\n        const isHTTPS = url.protocol === 'https:';\n        const { id } = context.req.valid('param');\n        if (isHTTPS) {\n          const value = context.req.header('Authorization');\n          if (!value) return context.body(null, 401);\n          const valid = await authenticate('job', id, value);\n          if (!valid) return context.body(null, 403);\n        } else {\n          logger.trace(`Skipping authentication because it is not secure ${context.req.url}`);\n        }\n\n        // if inspection is provided, call it with the raw request data\n        if (inspect) {\n          await inspect(id, type, await context.req.json());\n        }\n\n        await next();\n      },\n      zValidator('json', z.object({ data: schema })),\n      async (context) => {\n        const { id } = context.req.valid('param');\n        const { data } = context.req.valid('json') as { data: z.infer<typeof schema> };\n        // biome-ignore lint/suspicious/noExplicitAny: generic\n        const success: boolean = await handle(id, { type, data: data as any });\n        return context.body(null, success ? 204 : 400);\n      },\n    );\n  }\n\n  operation('create_pull_request', DependabotCreatePullRequestSchema);\n  operation('update_pull_request', DependabotUpdatePullRequestSchema);\n  operation('close_pull_request', DependabotClosePullRequestSchema);\n  operation('record_update_job_error', DependabotRecordUpdateJobErrorSchema);\n  operation('record_update_job_warning', DependabotRecordUpdateJobWarningSchema);\n  operation('record_update_job_unknown_error', DependabotRecordUpdateJobUnknownErrorSchema);\n  operation('mark_as_processed', DependabotMarkAsProcessedSchema, 'patch');\n  operation('update_dependency_list', DependabotUpdateDependencyListSchema);\n  operation('create_dependency_submission', DependabotDependencySubmissionSchema);\n  operation('record_ecosystem_versions', DependabotRecordEcosystemVersionsSchema);\n  operation('record_ecosystem_meta', DependabotRecordEcosystemMetaSchema.array());\n  operation('record_cooldown_meta', DependabotRecordCooldownMetaSchema.array());\n  operation('increment_metric', DependabotIncrementMetricSchema);\n  operation('record_metrics', DependabotMetricSchema.array()); // from the runner\n\n  // Handle endpoints:\n  // - GET request to /details\n  // - GET request to /credentials\n  app.on(\n    'get',\n    '/:id/details',\n    zValidator('param', z.object({ id: z.string() })),\n    async (context, next) => {\n      const { id } = context.req.valid('param');\n      const value = context.req.header('Authorization');\n      if (!value) return context.body(null, 401);\n      const valid = await authenticate('job', id, value);\n      if (!valid) return context.body(null, 403);\n      await next();\n    },\n    async (context) => {\n      const { id } = context.req.valid('param');\n      const job = await getJob(id);\n      if (!job) return context.body(null, 204);\n      return context.json(job);\n    },\n  );\n  app.on(\n    'get',\n    '/:id/credentials',\n    zValidator('param', z.object({ id: z.string() })),\n    async (context, next) => {\n      const { id } = context.req.valid('param');\n      const value = context.req.header('Authorization');\n      if (!value) return context.body(null, 401);\n      const valid = await authenticate('credentials', id, value);\n      if (!valid) return context.body(null, 403);\n      await next();\n    },\n    async (context) => {\n      const { id } = context.req.valid('param');\n      const credentials = await getCredentials(id);\n      if (!credentials) return context.body(null, 204);\n      return context.json(credentials);\n    },\n  );\n\n  return app;\n}\n","import type { DependabotDependency, DependabotExistingGroupPR, DependabotPersistedPr } from './job';\nimport type { DependabotClosePullRequest, DependabotCreatePullRequest } from './update';\n\nexport function normalizeFilePath(path: string): string {\n  // Convert backslashes to forward slashes, convert './' => '/' and ensure the path starts with a forward slash if it doesn't already, this is how DevOps paths are formatted\n  return path\n    ?.replace(/\\\\/g, '/')\n    ?.replace(/^\\.\\//, '/')\n    ?.replace(/^([^/])/, '/$1');\n}\n\nexport function normalizeBranchName(branch: string): string;\nexport function normalizeBranchName(branch?: string): string | undefined;\nexport function normalizeBranchName(branch?: string): string | undefined {\n  // Strip the 'refs/heads/' prefix from the branch name, if present\n  return branch?.replace(/^refs\\/heads\\//i, '');\n}\n\nexport function getDependencyNames(dependencies: DependabotPersistedPr): string[] {\n  const deps = Array.isArray(dependencies) ? dependencies : dependencies.dependencies;\n  return deps.map((dep) => dep['dependency-name']?.toString());\n}\n\nexport function areEqual(a: string[], b: string[]): boolean {\n  if (a.length !== b.length) return false;\n  return a.every((name) => b.includes(name));\n}\n\nexport function getPullRequestCloseReason(data: DependabotClosePullRequest): string | undefined {\n  // The first dependency is the \"lead\" dependency in a multi-dependency update\n  const leadDependencyName = data['dependency-names'][0];\n  let reason: string | undefined;\n  switch (data.reason) {\n    case 'dependencies_changed':\n      reason = `Looks like the dependencies have changed`;\n      break;\n    case 'dependency_group_empty':\n      reason = `Looks like the dependencies in this group are now empty`;\n      break;\n    case 'dependency_removed':\n      reason = `Looks like ${leadDependencyName} is no longer a dependency`;\n      break;\n    case 'up_to_date':\n      reason = `Looks like ${leadDependencyName} is up-to-date now`;\n      break;\n    case 'update_no_longer_possible':\n      reason = `Looks like ${leadDependencyName} can no longer be updated`;\n      break;\n  }\n  if (reason && reason.length > 0) {\n    reason += ', so this is no longer needed.';\n  }\n  return reason;\n}\n\nexport function getPullRequestDependencies(data: DependabotCreatePullRequest): DependabotPersistedPr {\n  const dependencies = data.dependencies?.map((dep) => {\n    return {\n      'dependency-name': dep.name,\n      'dependency-version': dep.version,\n      directory: dep.directory,\n    };\n  });\n  const dependencyGroupName = data['dependency-group']?.name;\n  if (!dependencyGroupName) return dependencies;\n  return {\n    'dependency-group-name': dependencyGroupName,\n    dependencies: dependencies,\n  } as DependabotExistingGroupPR;\n}\n\nexport function getPullRequestDescription({\n  packageManager,\n  body,\n  dependencies,\n  maxDescriptionLength,\n}: {\n  packageManager: string;\n  body: string | null | undefined;\n  dependencies: DependabotDependency[];\n  maxDescriptionLength?: number;\n}): string {\n  let header = '';\n  const footer = '';\n\n  // Fix up GitHub mentions encoding issues by removing instances of the zero-width space '\\u200B' as it does not render correctly in Azure DevOps.\n  // https://github.com/dependabot/dependabot-core/issues/9572\n  // https://github.com/dependabot/dependabot-core/blob/313fcff149b3126cb78b38d15f018907d729f8cc/common/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb#L245-L252\n  const description = (body || '').replace(new RegExp(decodeURIComponent('%EF%BF%BD%EF%BF%BD%EF%BF%BD'), 'g'), '');\n\n  // If there is exactly one dependency, add a compatibility score badge to the description header.\n  // Compatibility scores are intended for single dependency security updates, not group updates.\n  // https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores\n  if (dependencies.length === 1) {\n    const compatibilityScoreBadges = dependencies.map((dep) => {\n      return `![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=${dep.name}&package-manager=${packageManager}&previous-version=${dep['previous-version']}&new-version=${dep.version})`;\n    });\n    header += `${compatibilityScoreBadges.join(' ')}\\n\\n`;\n  }\n\n  // Build the full pull request description.\n  // The header/footer must not be truncated.\n  // If the description is too long and a max length is provided, we truncate the body.\n  if (maxDescriptionLength) {\n    const maxDescriptionLengthAfterHeaderAndFooter = maxDescriptionLength - header.length - footer.length;\n    return `${header}${description.substring(0, maxDescriptionLengthAfterHeaderAndFooter)}${footer}`;\n  }\n  return `${header}${description}${footer}`;\n}\n"],"mappings":";;;;;;;;AAKA,MAAa,kCAAkC;AAC/C,MAAa,iCAAiC;;;;ACE9C,SAAgB,uBAAuB,EACrC,kBACA,kBACA,WACA,qBACA,cACA,YAAY,OAQH;CAIT,IAAI;AAEJ,KADiC,uBAAuB,aAAa,SAAS,GAChD;EAG5B,MAAM,mBAAmB,OACtB,WAAW,MAAM,CACjB,OAAO,aAAa,KAAK,MAAM,GAAG,EAAE,mBAAmB,GAAG,EAAE,wBAAwB,CAAC,KAAK,IAAI,CAAC,CAC/F,OAAO,MAAM,CACb,UAAU,GAAG,GAAG;AACnB,eAAa,GAAG,uBAAuB,QAAQ,GAAG;OAUlD,cAAa,GANW,aACrB,KAAK,MAAM,EAAE,mBAAmB,CAChC,KAAK,QAAQ,CACb,QAAQ,UAAU,IAAI,CACtB,QAAQ,MAAM,GAAG,CAEY,GADV,aAAa,IAAI,UAAU,YAAY,aAAa,KAAK;AAIjF,QAAO,YACL;EACE;EACA;EACA;EAEA,YACI,UACG,MAAM,IAAI,CACV,QAAQ,SAAS,KAAK,SAAS,EAAE,CACjC,KAAK,UAAU,GAClB;EACJ;EACD,EACD,UACD;;AAGH,SAAgB,YAAY,UAAkC,WAA2B;AAOvF,QACE,SAEG,QAAQ,MAAM,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,CACvC,KAAK,UAAU,CAEf,QAAQ,0BAA0B,GAAG,CAErC,QAAQ,SAAS,QAAQ,CAEzB,QAAQ,QAAQ,IAAI,CACpB,QAAQ,QAAQ,IAAI,CAEpB,QAAQ,OAAO,GAAG;;;;;AClFzB,MAAa,sBAA6C;CACxD,6BAA6B;CAC7B,mCAAmC;CACnC,gBAAgB;CAChB,gCAAgC;CAChC,oCAAoC;CACpC,wCAAwC;CACxC,yCAAyC;CACzC,wCAAwC;CACxC,mCAAmC;CACnC,wCAAwC;CACxC,8CAA8C;CAC9C,6CAA6C;CAC7C,6CAA6C;CAC7C,2BAA2B;CAC3B,oDAAoD;CACpD,gCAAgC;CAChC,2BAA2B;CAC3B,4BAA4B;CAC5B,2BAA2B;CAC3B,kCAAkC;CAClC,kCAAkC;CACnC;;;;;;AAOD,SAAgB,iBAAiB,KAAiD;AAChF,QAAO,KACH,MAAM,IAAI,CACX,QAAQ,UAAU,MAAM,MAAM,KAAK,GAAG,CACtC,QAAQ,KAAK,QAAQ;EACpB,MAAM,CAAC,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;AACtC,MAAI,OAAQ,SAAS;AACrB,SAAO;IACN,EAAE,CAA0B;;;;;;;;;;AAWnC,SAAgB,cACd,aACA,MACA,QAA0B,MACH;AACvB,QAAO;EACL,GAAI,eAAe,EAAE;GAGpB,OAAO;EACT;;;;;;;;ACrBH,IAAa,uBAAb,MAAkC;CAChC,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,EACV,QACA,QACA,QACA,kBACA,mBACA,aACA,aACA,SAWC;AACD,OAAK,SAAS;AACd,OAAK,SAAS;AACd,OAAK,QAAQ;AAEb,OAAK,cAAc,cAAc,aAAa,0BAA0B,OAAO,0BAA0B;AAEzG,OAAK,iBAAiB,oCAAoC,OAAO,qBAAqB;AACtF,OAAK,SAAS,yCAAyC,QAAQ,OAAO;AACtE,OAAK,cAAc,eAAe;GAChC,gBAAgB,OAAO;GACvB;GACA;GACA;GACA,YAAY,OAAO;GACpB,CAAC;;;;;CAMJ,AAAO,oBAAoB,EACzB,IACA,WAI6B;AAC7B,SAAO;GACL,KAAK;IACC;IACK;IACT,mBAAmB,KAAK;IACxB,2BAA2B;IAC3B,cAAc;IACd,mBAAmB,CAAC;KAAE,mBAAmB;KAAU,eAAe;KAAO,CAAC;IAC1E,qBAAqB,CAAC,EAAE,mBAAmB,KAAK,CAAC;IACjD,yBAAyB;IACzB,uBAAuB,EAAE;IACzB,QAAQ,KAAK;IACb,0BAA0B;IAC1B,0BAA0B,EAAE;IAC5B,gCAAgC,EAAE;IAClC,aAAa,KAAK;IAClB,gCAAgC;IAChC,iBAAiB;IACjB,0BAA0B;KACxB,QAAQ;KACR,sBAAsB;KACtB,iBAAiB;KAClB;IACD,uBAAuB;IACvB,gBAAgB;IAChB,OAAO,KAAK;IACb;GACD,aAAa,KAAK;GACnB;;;;;CAMH,AAAO,UAAU,EACf,IACA,SACA,yBACA,sBACA,qBACA,2BAQ6B;EAC7B,MAAM,qBAAqB,KAAK,OAAO,gCAAgC;EAEvE,IAAI;EACJ,IAAI,4BAA2C;EAC/C,IAAI;EACJ,IAAI;AAEJ,MAAI,qBAAqB;AACvB,yBAAsB;AACtB,+BAA4B,MAAM,QAAQ,oBAAoB,GAC1D,OACA,oBAAoB;AACxB,4BACE,MAAM,QAAQ,oBAAoB,GAAG,sBAAsB,oBAAoB,eAC9E,KAAK,MAAM,EAAE,mBAAmB;AACnC,qBAAkB,yBAAyB,QAAQ,MAAM,uBAAuB,SAAS,EAAE,QAAQ,KAAK,CAAC;SACpG;AACL,yBAAsB;GACtB,MAAM,QAAQ,yBAAyB,SAAS,0BAA0B;AAC1E,2BACE,sBAAsB,QAClB,OAAO,QAAQ,MAAM,yBAAyB,MAAM,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC,GAChF;AACN,qBAAkB;;AAGpB,SAAO;GACL,KAAK;IACC;IACK;IACT,mBAAmB,KAAK;IACxB,2BAA2B,uBAAuB;IAClD,+BAA+B;IAC/B,qBAAqB,yCAAyC,KAAK,OAAO,OAAO;IACjF,cAAc;IACd,mBAAmB,iDAAiD,KAAK,OAAO,OAAO,mBAAmB;IAC1G,qBAAqB,mDAAmD,KAAK,OAAO,OAAO;IAC3F,yBAAyB;IACzB,uBAAuB,sBAAsB,gBAAgB;IAC7D,QAAQ,KAAK;IACb,0BAA0B;IAC1B,0BAA0B,qBAAqB,QAAQ,OAAO,MAAM,QAAQ,GAAG,CAAC;IAChF,gCAAgC,qBAAqB,QAClD,OAAwC,CAAC,MAAM,QAAQ,GAAG,CAC5D;IACD,0BAA0B;KACxB,QAAQ,KAAK,OAAO,mBAAmB,UAAU;KACjD,sBAAsB,KAAK,OAAO,oBAAoB,yBAAyB;KAC/E,iBACE,KAAK,OAAO,mBAAmB,SAAS,mBAAmB,EAAE,MAAM,KAAK,UAAU,OAAO;KAC5F;IACD,UAAU,KAAK,OAAO;IACtB,aAAa,eAAe,KAAK,YAAY;IAC7C,wBACE,KAAK,OAAO,qCAAqC,mBAAmB,EAAE,MAAM,KAAK;IACnF,gCAAgC,+CAC9B,KAAK,OAAO,uBACb;IACD,iBAAiB,KAAK,OAAO,2BAA2B;IACxD,uBAAuB,KAAK,OAAO,UAAU;IAC7C,gBAAgB;IAChB,OAAO,KAAK;IACZ,2CAA2C;IAC3C,wBAAwB;IACxB,0BAA0B,KAAK,OAAO,6BAA6B;IAMnE,0BAA0B;IAC1B,iBAAiB,KAAK,OAAO;IAC9B;GACD,aAAa,KAAK;GACnB;;;AAIL,SAAgB,oCAAoC,WAAuD;AAIzG,SAAQ,WAAR;EACE,KAAK,iBACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,MACH,QAAO;EACT,KAAK,MACH,QAAO;EAET,KAAK,SACH,QAAO;EACT,KAAK,cACH,QAAO;EACT,KAAK,SACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,QACE,QAAO;;;AAIb,SAAgB,yCACd,QACA,QACkB;AAClB,QAAO;EACL,UAAU,OAAO;EACjB,gBAAgB,OAAO;EACvB,UAAU,OAAO;EACjB,MAAM,OAAO;EACb,QAAQ,OAAO;EACf,QAAQ;EACR,WAAW,OAAO;EAClB,aAAa,OAAO;EACrB;;AAGH,SAAgB,+CAA+C,UAA8C;AAC3G,KAAI,CAAC,SAAU,QAAO;AACtB,SAAQ,UAAR;EACE,KAAK,OACH,QAAO;EACT,KAAK,WACH,QAAO;EACT,KAAK,wBACH,QAAO;EACT,KAAK,gBACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,QACE,OAAM,IAAI,MAAM,uDAAuD,SAAS,GAAG;;;AAIzF,SAAgB,yCACd,kBACsB;AACtB,KAAI,CAAC,oBAAoB,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAQ,QAAO,EAAE;AACzE,QAAO,OAAO,KAAK,iBAAiB,CACjC,QAAQ,SAAS,iBAAiB,MAAM,CACxC,KAAK,SAAS;EACb,MAAM,QAAQ,iBAAiB;AAC/B,SAAO;GACC;GACN,cAAc,MAAM;GACpB,OAAO;IACL,UAAU,MAAM,UAAU,SAAS,MAAM,WAAW,CAAC,IAAI;IACzD,oBAAoB,MAAM;IAC1B,mBAAmB,MAAM;IACzB,gBAAgB,MAAM;IACvB;GACF;GACD;;AAGN,SAAgB,iDACd,gBACA,oBACqB;AAIrB,KAAI,CAAC,eACH,QAAO,CACL;EACE,mBAAmB;EACnB,eAAe,qBAAqB,aAAa;EAClD,CACF;AAEH,QAAO,eAAe,KAAK,UAAU;AACnC,SAAO;GACL,mBAAmB,MAAM;GACzB,mBAAmB,MAAM;GACzB,eAAe,MAAM;GACtB;GACD;;AAGJ,SAAgB,mDACd,kBACuB;AACvB,KAAI,CAAC,iBAAkB,QAAO,EAAE;AAChC,QAAO,iBAAiB,KAAK,WAAW;AACtC,SAAO;GACL,QAAQ,OAAO;GACf,cAAc,OAAO;GACrB,mBAAmB,OAAO,sBAAsB;GAChD,gBAAgB,OAAO;GAIvB,uBAAuB,MAAM,QAAQ,OAAO,SAAS,GAAc,OAAO,UAAW,KAAK,KAAK,GAAG,OAAO;GAC1G;GACD;;AAGJ,SAAgB,eAAe,aAA4D;AACzF,iBAAgB,EAAE;AAClB,QAAO,OAAO,KAAK,YAAY,CAAC,QAAQ,KAAK,QAAQ;EAGnD,MAAM,QAAQ,YAAY;AAC1B,MAAI,OAAO,UAAU,YAAY,OAAO,mBAAmB,KAAK,OAC9D,KAAI,OAAO;WACF,OAAO,UAAU,YAAY,OAAO,mBAAmB,KAAK,QACrE,KAAI,OAAO;WAEP,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,KAAI,OAAO;AAE1E,SAAO;IACN,EAAE,CAA0B;;AAGjC,SAAgB,sBAAsB,yBAAiF;AACrH,KAAI,CAAC,wBAAyB,QAAO,EAAE;CAIvC,MAAM,mEAAmD,IAAI,KAAsC;AACnG,MAAK,MAAM,QAAQ,yBAAyB;EAC1C,MAAM,MAAM,GAAG,KAAK,QAAQ,KAAK,GAAG,KAAK,SAAS,YAAY,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,QAAQ,CAAC,KAAK,IAAI;AAC1G,MAAI,CAAC,iDAAiD,IAAI,IAAI,CAC5D,kDAAiD,IAAI,KAAK,EAAE,CAAC;AAE/D,mDAAiD,IAAI,IAAI,CAAE,KAAK,KAAK;;AAEvE,QAAO,MAAM,KAAK,iDAAiD,QAAQ,CAAC,CAAC,KAAK,UAAU;AAC1F,SAAO;GACL,mBAAmB,MAAM,GAAI,QAAQ;GACrC,qBAAqB,MAAM,KAAK,MAAM,EAAE,uBAAuB,CAAC,QAAQ,MAAM,KAAK,EAAE,SAAS,EAAE;GAChG,oBAAoB,MACjB,KAAK,MAAM,EAAE,qBAAqB,WAAW,CAC7C,QAAQ,MAAM,KAAK,EAAE,SAAS,EAAE,CAChC,KAAK,MAAM,EAAG;GACjB,uBAAuB,EAAE;GAC1B;GACD;;AAGJ,SAAgB,eAAe,EAC7B,gBACA,kBACA,mBACA,aACA,cAOyB;CACzB,MAAM,cAAc,EAAE;AAGtB,KAAI,kBACF,aAAY,KAAK;EACf,MAAM;EACN,MAAM;EACN,WAAW,oBAAoB,IAAI,MAAM,EAAE,SAAS,IAAI,mBAAmB;EAC3E,UAAU;EACX,CAAC;AAIJ,KAAI,YACF,aAAY,KAAK;EACf,MAAM;EACN,MAAM;EACN,UAAU;EACV,UAAU;EACX,CAAC;AAEJ,KAAI,WAIF,aAAY,KAAK,GAAG,OAAO,OAAO,WAAW,CAAC;AAGhD,QAAO;;;;;ACvbT,MAAa,iCAAiC,EAAE,OAAO;CAErD,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,kBAAkB,EACf,KAAK;EACJ;EACA;EAEA;EACD,CAAC,CACD,SAAS;CACZ,SAAS,EAAE,SAAS,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ;CACrB,MAAM,EAAE,QAAQ;CAChB,WAAW,EAAE,KAAK;EAAC;EAAU;EAAU;EAAS,CAAC;CACjD,cAAc,EAAE,SAAS,CAAC,SAAS;CACnC,eAAe,EAAE,SAAS,CAAC,SAAS;CACpC,gBAAgB,EAAE,QAAQ,CAAC,SAAS;CACpC,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,MAAM,EACH,KAAK;EACJ,YAAY;EACZ,MAAM;EACN,WAAW;EACX,WAAW;EACX,SAAS;EACV,CAAC,CACD,GAAG,EAAE,QAAQ,CAAC,CACd,SAAS;CACb,CAAC;AAGF,MAAa,uCAAuC,EAAE,OAAO;CAC3D,cAAc,2BAA2B,OAAO;CAChD,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC/C,CAAC;AAGF,MAAa,uCAAuC,EAAE,OAAO;CAC3D,SAAS,EAAE,QAAQ;CACnB,KAAK,EAAE,QAAQ;CACf,KAAK,EAAE,QAAQ;CACf,KAAK,EAAE,OAAO;EACZ,YAAY,EAAE,QAAQ;EACtB,IAAI,EAAE,QAAQ;EACf,CAAC;CACF,UAAU,EAAE,OAAO;EACjB,MAAM,EAAE,QAAQ;EAChB,SAAS,EAAE,QAAQ;EACnB,KAAK,EAAE,QAAQ;EAChB,CAAC;CACF,WAAW,EAAE,OAAO;EAClB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS;EACzD,UAAU,EAAE,OAAO,EAAE,WAAW,gCAAgC,CAAC,CAAC,SAAS;EAC3E,UAAU,EACP,OAAO;GACN,aAAa,EAAE,QAAQ;GACvB,cAAc,EAAE,KAAK,CAAC,UAAU,WAAW,CAAC;GAC5C,OAAO,EAAE,KAAK,CAAC,WAAW,cAAc,CAAC;GACzC,cAAc,2BAA2B,OAAO;GACjD,CAAC,CACD,SAAS;EACb,CAAC;CACH,CAAC;AAGF,MAAa,oCAAoC,EAAE,OAAO;CACxD,mBAAmB,EAAE,QAAQ;CAC7B,cAAc,2BAA2B,OAAO;CAChD,4BAA4B,+BAA+B,OAAO;CAClE,YAAY,EAAE,QAAQ;CACtB,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,kBAAkB,EAAE,QAAQ;CAC5B,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CAC5D,CAAC;AAGF,MAAa,oCAAoC,EAAE,OAAO;CACxD,mBAAmB,EAAE,QAAQ;CAC7B,oBAAoB,EAAE,QAAQ,CAAC,OAAO;CACtC,4BAA4B,+BAA+B,OAAO;CAClE,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;CACtC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CAC5D,CAAC;AAGF,MAAa,uCAAuC,EAAE,KAAK;CACzD;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,MAAa,mCAAmC,EAAE,OAAO;CACvD,oBAAoB,EAAE,QAAQ,CAAC,OAAO;CACtC,QAAQ,qCAAqC,SAAS;CACvD,CAAC;AAGF,MAAa,kCAAkC,EAAE,OAAO,EACtD,mBAAmB,EAAE,QAAQ,CAAC,SAAS,EACxC,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,cAAc,EAAE,QAAQ;CACxB,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CACxD,SAAS,EAAE,SAAS,CAAC,SAAS;CAC/B,CAAC;AAGF,MAAa,uCAAuC,yBAAyB,OAAO,EAAE,CAAC;AAGvF,MAAa,yCAAyC,EAAE,OAAO;CAC7D,aAAa,EAAE,QAAQ;CACvB,cAAc,EAAE,QAAQ;CACxB,oBAAoB,EAAE,QAAQ;CAC/B,CAAC;AAGF,MAAa,8CAA8C,yBAAyB,OAAO,EAAE,CAAC;AAG9F,MAAa,0CAA0C,EAAE,OAAO,EAC9D,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS,EAC5D,CAAC;AAGF,MAAa,0CAA0C,EAAE,OAAO;CAC9D,MAAM,EAAE,QAAQ;CAChB,SAAS,EAAE,QAAQ;CACnB,aAAa,EAAE,QAAQ;CACvB,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CACrD,CAAC;AAGF,MAAa,gCAAgC,EAAE,OAAO;CACpD,MAAM,EAAE,QAAQ;CAChB,iBAAiB,wCAAwC,SAAS;CAClE,UAAU,wCAAwC,SAAS;CAC3D,SAAS,wCAAwC,SAAS;CAC3D,CAAC;AAGF,MAAa,sCAAsC,EAAE,OAAO,EAC1D,WAAW,+BACZ,CAAC;AAGF,MAAa,qCAAqC,EAAE,OAAO,EACzD,UAAU,EAAE,OAAO;CACjB,gBAAgB;CAChB,QAAQ,EAAE,OAAO;EACf,cAAc,EAAE,QAAQ;EACxB,mBAAmB,EAAE,QAAQ;EAC7B,mBAAmB,EAAE,QAAQ;EAC7B,mBAAmB,EAAE,QAAQ;EAC9B,CAAC;CACH,CAAC,EACH,CAAC;AAGF,MAAa,kCAAkC,EAAE,OAAO;CACtD,QAAQ,EAAE,QAAQ;CAClB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9C,CAAC;AAGF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,QAAQ,EAAE,QAAQ;CAClB,MAAM,EAAE,KAAK;EAAC;EAAa;EAAS;EAAgB;EAAY,CAAC;CACjE,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,SAAS;CACjD,CAAC;;;;AClKF,MAAa,8BAA8B,EAAE,KAAK;CAChD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,0BAA0B,EAAE,mBAAmB,QAAQ;CAClE,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,sBAAsB;EAAE,MAAM;EAAmC,CAAC;CAC7F,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,sBAAsB;EAAE,MAAM;EAAmC,CAAC;CAC7F,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,qBAAqB;EAAE,MAAM;EAAkC,CAAC;CAC3F,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,0BAA0B;EAAE,MAAM;EAAsC,CAAC;CACpG,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,4BAA4B;EAAE,MAAM;EAAwC,CAAC;CACxG,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,kCAAkC;EAAE,MAAM;EAA6C,CAAC;CACnH,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,oBAAoB;EAAE,MAAM;EAAiC,CAAC;CACzF,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,yBAAyB;EAAE,MAAM;EAAsC,CAAC;CACnG,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,+BAA+B;EAAE,MAAM;EAAsC,CAAC;CACzG,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,4BAA4B;EAAE,MAAM;EAAyC,CAAC;CACzG,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,wBAAwB;EAAE,MAAM,oCAAoC,OAAO;EAAE,CAAC;CACzG,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,uBAAuB;EAAE,MAAM,mCAAmC,OAAO;EAAE,CAAC;CACvG,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,mBAAmB;EAAE,MAAM;EAAiC,CAAC;CACxF,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,iBAAiB;EAAE,MAAM,uBAAuB,OAAO;EAAE,CAAC;CACtF,CAAC;;;;;;;;;;;;;AAmFF,SAAgB,mBAAmB,EACjC,WAAW,oBACX,cACA,QACA,gBACA,SACA,UACkC;CAElC,MAAM,MAAM,IAAI,MAAM,CAAC,SAAS,SAAS;CAgBzC,SAAS,UAA6B,MAA6B,QAAW,QAAiB;AAC7F,MAAI,GACF,UAAU,QACV,QAAQ,QACR,WAAW,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EACjD,OAAO,SAAS,SAAS;GAOvB,MAAM,UADM,IAAI,IAAI,QAAQ,IAAI,IAAI,CAChB,aAAa;GACjC,MAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,QAAQ;AACzC,OAAI,SAAS;IACX,MAAM,QAAQ,QAAQ,IAAI,OAAO,gBAAgB;AACjD,QAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,MAAM,IAAI;AAE1C,QAAI,CADU,MAAM,aAAa,OAAO,IAAI,MAAM,CACtC,QAAO,QAAQ,KAAK,MAAM,IAAI;SAE1C,QAAO,MAAM,oDAAoD,QAAQ,IAAI,MAAM;AAIrF,OAAI,QACF,OAAM,QAAQ,IAAI,MAAM,MAAM,QAAQ,IAAI,MAAM,CAAC;AAGnD,SAAM,MAAM;KAEd,WAAW,QAAQ,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC,CAAC,EAC9C,OAAO,YAAY;GACjB,MAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,QAAQ;GACzC,MAAM,EAAE,SAAS,QAAQ,IAAI,MAAM,OAAO;GAE1C,MAAM,UAAmB,MAAM,OAAO,IAAI;IAAE;IAAY;IAAa,CAAC;AACtE,UAAO,QAAQ,KAAK,MAAM,UAAU,MAAM,IAAI;IAEjD;;AAGH,WAAU,uBAAuB,kCAAkC;AACnE,WAAU,uBAAuB,kCAAkC;AACnE,WAAU,sBAAsB,iCAAiC;AACjE,WAAU,2BAA2B,qCAAqC;AAC1E,WAAU,6BAA6B,uCAAuC;AAC9E,WAAU,mCAAmC,4CAA4C;AACzF,WAAU,qBAAqB,iCAAiC,QAAQ;AACxE,WAAU,0BAA0B,qCAAqC;AACzE,WAAU,gCAAgC,qCAAqC;AAC/E,WAAU,6BAA6B,wCAAwC;AAC/E,WAAU,yBAAyB,oCAAoC,OAAO,CAAC;AAC/E,WAAU,wBAAwB,mCAAmC,OAAO,CAAC;AAC7E,WAAU,oBAAoB,gCAAgC;AAC9D,WAAU,kBAAkB,uBAAuB,OAAO,CAAC;AAK3D,KAAI,GACF,OACA,gBACA,WAAW,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EACjD,OAAO,SAAS,SAAS;EACvB,MAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,QAAQ;EACzC,MAAM,QAAQ,QAAQ,IAAI,OAAO,gBAAgB;AACjD,MAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,MAAM,IAAI;AAE1C,MAAI,CADU,MAAM,aAAa,OAAO,IAAI,MAAM,CACtC,QAAO,QAAQ,KAAK,MAAM,IAAI;AAC1C,QAAM,MAAM;IAEd,OAAO,YAAY;EACjB,MAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,QAAQ;EACzC,MAAM,MAAM,MAAM,OAAO,GAAG;AAC5B,MAAI,CAAC,IAAK,QAAO,QAAQ,KAAK,MAAM,IAAI;AACxC,SAAO,QAAQ,KAAK,IAAI;GAE3B;AACD,KAAI,GACF,OACA,oBACA,WAAW,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EACjD,OAAO,SAAS,SAAS;EACvB,MAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,QAAQ;EACzC,MAAM,QAAQ,QAAQ,IAAI,OAAO,gBAAgB;AACjD,MAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,MAAM,IAAI;AAE1C,MAAI,CADU,MAAM,aAAa,eAAe,IAAI,MAAM,CAC9C,QAAO,QAAQ,KAAK,MAAM,IAAI;AAC1C,QAAM,MAAM;IAEd,OAAO,YAAY;EACjB,MAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,QAAQ;EACzC,MAAM,cAAc,MAAM,eAAe,GAAG;AAC5C,MAAI,CAAC,YAAa,QAAO,QAAQ,KAAK,MAAM,IAAI;AAChD,SAAO,QAAQ,KAAK,YAAY;GAEnC;AAED,QAAO;;;;;AClQT,SAAgB,kBAAkB,MAAsB;AAEtD,QAAO,MACH,QAAQ,OAAO,IAAI,EACnB,QAAQ,SAAS,IAAI,EACrB,QAAQ,WAAW,MAAM;;AAK/B,SAAgB,oBAAoB,QAAqC;AAEvE,QAAO,QAAQ,QAAQ,mBAAmB,GAAG;;AAG/C,SAAgB,mBAAmB,cAA+C;AAEhF,SADa,MAAM,QAAQ,aAAa,GAAG,eAAe,aAAa,cAC3D,KAAK,QAAQ,IAAI,oBAAoB,UAAU,CAAC;;AAG9D,SAAgB,SAAS,GAAa,GAAsB;AAC1D,KAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAO,EAAE,OAAO,SAAS,EAAE,SAAS,KAAK,CAAC;;AAG5C,SAAgB,0BAA0B,MAAsD;CAE9F,MAAM,qBAAqB,KAAK,oBAAoB;CACpD,IAAI;AACJ,SAAQ,KAAK,QAAb;EACE,KAAK;AACH,YAAS;AACT;EACF,KAAK;AACH,YAAS;AACT;EACF,KAAK;AACH,YAAS,cAAc,mBAAmB;AAC1C;EACF,KAAK;AACH,YAAS,cAAc,mBAAmB;AAC1C;EACF,KAAK;AACH,YAAS,cAAc,mBAAmB;AAC1C;;AAEJ,KAAI,UAAU,OAAO,SAAS,EAC5B,WAAU;AAEZ,QAAO;;AAGT,SAAgB,2BAA2B,MAA0D;CACnG,MAAM,eAAe,KAAK,cAAc,KAAK,QAAQ;AACnD,SAAO;GACL,mBAAmB,IAAI;GACvB,sBAAsB,IAAI;GAC1B,WAAW,IAAI;GAChB;GACD;CACF,MAAM,sBAAsB,KAAK,qBAAqB;AACtD,KAAI,CAAC,oBAAqB,QAAO;AACjC,QAAO;EACL,yBAAyB;EACX;EACf;;AAGH,SAAgB,0BAA0B,EACxC,gBACA,MACA,cACA,wBAMS;CACT,IAAI,SAAS;CACb,MAAM,SAAS;CAKf,MAAM,eAAe,QAAQ,IAAI,QAAQ,IAAI,OAAO,mBAAmB,8BAA8B,EAAE,IAAI,EAAE,GAAG;AAKhH,KAAI,aAAa,WAAW,GAAG;EAC7B,MAAM,2BAA2B,aAAa,KAAK,QAAQ;AACzD,UAAO,wHAAwH,IAAI,KAAK,mBAAmB,eAAe,oBAAoB,IAAI,oBAAoB,eAAe,IAAI,QAAQ;IACjP;AACF,YAAU,GAAG,yBAAyB,KAAK,IAAI,CAAC;;AAMlD,KAAI,sBAAsB;EACxB,MAAM,2CAA2C,uBAAuB,OAAO,SAAS;AACxF,SAAO,GAAG,SAAS,YAAY,UAAU,GAAG,yCAAyC,GAAG;;AAE1F,QAAO,GAAG,SAAS,cAAc"}

package/dist/github/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["results: T2[]","v"],"sources":["../../src/github/client.ts","../../src/github/ghsa.ts"],"sourcesContent":["import { Octokit } from 'octokit';\n\n/**\n * Creates an authenticated GitHub API client using Octokit.\n *\n * @param token - GitHub personal access token or fine-grained token with appropriate permissions\n * @returns Configured Octokit instance ready for API calls\n */\nexport function createGitHubClient({ token }: { token: string }): Octokit {\n  return new Octokit({\n    auth: token,\n    // could add retry here perhaps?\n  });\n}\n","import type { Octokit } from 'octokit';\nimport * as semver from 'semver';\nimport { z } from 'zod';\n\nimport { logger } from '@/logger';\nimport { createGitHubClient } from './client';\n\n// we use nullish() because it does optional() and allows the value to be set to null\n\nconst GHSA_SECURITY_VULNERABILITIES_QUERY = `\n  query($ecosystem: SecurityAdvisoryEcosystem, $package: String) {\n    securityVulnerabilities(first: 100, ecosystem: $ecosystem, package: $package) {\n      nodes {\n        advisory {\n          identifiers {\n            type,\n            value\n          },\n          severity,\n          summary,\n          description,\n          references {\n            url\n          }\n          cvssSeverities {\n            cvssV3 {\n              score\n              vectorString\n            }\n            cvssV4 {\n              score\n              vectorString\n            }\n          }\n          epss {\n            percentage\n            percentile\n          }\n          cwes (first: 100) {\n            nodes {\n              cweId\n              name\n              description\n            }\n          }\n          publishedAt\n          updatedAt\n          withdrawnAt\n          permalink\n        }\n        vulnerableVersionRange\n        firstPatchedVersion {\n          identifier\n        }\n      }\n    }\n  }\n`;\n\nexport const PackageEcosystemSchema = z.enum([\n  // https://docs.github.com/en/enterprise-cloud@latest/graphql/reference/enums#securityadvisoryecosystem\n  'COMPOSER',\n  'ERLANG',\n  'GO',\n  'ACTIONS',\n  'MAVEN',\n  'NPM',\n  'NUGET',\n  'PIP',\n  'PUB',\n  'RUBYGEMS',\n  'RUST',\n  'SWIFT',\n]);\nexport type PackageEcosystem = z.infer<typeof PackageEcosystemSchema>;\n\nexport const PackageSchema = z.object({\n  name: z.string(),\n  version: z.string().nullish(),\n});\nexport type Package = z.infer<typeof PackageSchema>;\n\nexport const SecurityAdvisoryIdentifierSchema = z.enum(['CVE', 'GHSA']);\nexport type SecurityAdvisoryIdentifierType = z.infer<typeof SecurityAdvisoryIdentifierSchema>;\n\nexport const SecurityAdvisorySeveritySchema = z.enum(['LOW', 'MODERATE', 'HIGH', 'CRITICAL']);\nexport type SecurityAdvisorySeverity = z.infer<typeof SecurityAdvisorySeveritySchema>;\n\nconst CweSchema = z.object({\n  cweId: z.string(),\n  name: z.string(),\n  description: z.string(),\n});\n\nconst CvssSchema = z.object({\n  score: z.number(),\n  vectorString: z.string().nullish(),\n});\ntype Cvss = z.infer<typeof CvssSchema>;\n\nexport const SecurityAdvisorySchema = z.object({\n  identifiers: z\n    .object({\n      type: z.union([SecurityAdvisoryIdentifierSchema, z.string()]),\n      value: z.string(),\n    })\n    .array(),\n  severity: SecurityAdvisorySeveritySchema.nullish(),\n  summary: z.string(),\n  description: z.string().nullish(),\n  references: z.object({ url: z.string() }).array().nullish(),\n  cvss: CvssSchema.nullish(),\n  epss: z\n    .object({\n      percentage: z.number().nullish(),\n      percentile: z.number().nullish(),\n    })\n    .nullish(),\n  cwes: CweSchema.array().nullish(),\n  publishedAt: z.string().nullish(),\n  updatedAt: z.string().nullish(),\n  withdrawnAt: z.string().nullish(),\n  permalink: z.string().nullish(),\n});\nexport type SecurityAdvisory = z.infer<typeof SecurityAdvisorySchema>;\n\nconst FirstPatchedVersionSchema = z.object({ identifier: z.string() });\nexport type FirstPatchedVersion = z.infer<typeof FirstPatchedVersionSchema>;\n\nexport const SecurityVulnerabilitySchema = z.object({\n  package: PackageSchema,\n  advisory: SecurityAdvisorySchema,\n  vulnerableVersionRange: z.string(),\n  firstPatchedVersion: FirstPatchedVersionSchema.nullish(),\n});\nexport type SecurityVulnerability = z.infer<typeof SecurityVulnerabilitySchema>;\n\nconst CvssSeveritiesSchema = z.object({\n  cvssV3: CvssSchema.nullish(),\n  cvssV4: CvssSchema.nullish(),\n});\ntype CvssSeverities = z.infer<typeof CvssSeveritiesSchema>;\n\nconst GitHubSecurityVulnerabilitiesResponseSchema = z.object({\n  securityVulnerabilities: z.object({\n    nodes: z\n      .object({\n        advisory: SecurityAdvisorySchema.omit({ cvss: true /* incoming is cvssSeverities */ }).extend({\n          cvssSeverities: CvssSeveritiesSchema,\n          cwes: z.object({ nodes: CweSchema.array() }).nullish(),\n        }),\n        firstPatchedVersion: FirstPatchedVersionSchema.nullish(),\n        vulnerableVersionRange: z.string(),\n      })\n      .array(),\n  }),\n});\ntype GitHubSecurityVulnerabilitiesResponse = z.infer<typeof GitHubSecurityVulnerabilitiesResponseSchema>;\n\nexport function getGhsaPackageEcosystemFromDependabotPackageManager(\n  dependabotPackageManager: string,\n): PackageEcosystem {\n  switch (dependabotPackageManager) {\n    case 'composer':\n      return 'COMPOSER';\n    case 'elm':\n      return 'ERLANG';\n    case 'github_actions':\n      return 'ACTIONS';\n    case 'go_modules':\n      return 'GO';\n    case 'maven':\n      return 'MAVEN';\n    case 'npm_and_yarn':\n      return 'NPM';\n    case 'nuget':\n      return 'NUGET';\n    case 'pip':\n      return 'PIP';\n    case 'pub':\n      return 'PUB';\n    case 'bundler':\n      return 'RUBYGEMS';\n    case 'cargo':\n      return 'RUST';\n    case 'swift':\n      return 'SWIFT';\n    default:\n      throw new Error(`Unknown dependabot package manager: ${dependabotPackageManager}`);\n  }\n}\n\n/**\n * GitHub Security Advisory client\n */\nexport class GitHubSecurityAdvisoryClient {\n  private readonly octokit: Octokit;\n\n  /**\n   * @param token GitHub personal access token with access to the GHSA API\n   */\n  constructor(token: string) {\n    this.octokit = createGitHubClient({ token });\n  }\n\n  /**\n   * Get the list of security vulnerabilities for a given package ecosystem and list of packages\n   * @param packageEcosystem\n   * @param packages\n   */\n  public async getSecurityVulnerabilitiesAsync(\n    packageEcosystem: PackageEcosystem,\n    packages: Package[],\n  ): Promise<SecurityVulnerability[]> {\n    // GitHub API doesn't support querying multiple package at once, so we need to make a request for each package individually.\n    // To speed up the process, we can make the requests in parallel, 100 at a time. We batch the requests to avoid hitting the rate limit too quickly.\n    // https://docs.github.com/en/graphql/overview/rate-limits-and-node-limits-for-the-graphql-api\n    const securityVulnerabilities = await this.batchGraphQueryAsync<Package, SecurityVulnerability>(\n      100,\n      packages,\n      async (pkg) => {\n        const variables = {\n          ecosystem: packageEcosystem,\n          package: pkg.name,\n        };\n\n        function pickCvss(value: CvssSeverities): Cvss | undefined {\n          // Pick the one with a non-zero score\n          if (value.cvssV4 && value.cvssV4.score > 0) return value.cvssV4;\n          if (value.cvssV3 && value.cvssV3.score > 0) return value.cvssV3;\n        }\n\n        try {\n          const response = await this.octokit.graphql<GitHubSecurityVulnerabilitiesResponse>(\n            GHSA_SECURITY_VULNERABILITIES_QUERY,\n            variables,\n          );\n          const parsed = GitHubSecurityVulnerabilitiesResponseSchema.parse(response);\n          const vulnerabilities = parsed.securityVulnerabilities.nodes;\n          return (\n            vulnerabilities\n              ?.filter((v) => v.advisory != null)\n              ?.map(\n                (v) =>\n                  ({\n                    ...v,\n                    package: pkg,\n                    advisory: {\n                      ...v.advisory,\n                      cwes: v.advisory.cwes?.nodes,\n                      cvss: pickCvss(v.advisory.cvssSeverities),\n                    },\n                  }) satisfies SecurityVulnerability,\n              ) || []\n          );\n        } catch (error) {\n          logger.warn(`GHSA GraphQL request failed for package ${pkg.name}: ${error}. Continuing with other packages.`);\n          return [];\n        }\n      },\n    );\n\n    return securityVulnerabilities;\n  }\n\n  /**\n   * Batch requests in parallel to speed up the process when we are forced to do a N+1 query\n   * @param batchSize\n   * @param items\n   * @param action\n   * @returns\n   */\n  private async batchGraphQueryAsync<T1, T2>(batchSize: number, items: T1[], action: (item: T1) => Promise<T2[]>) {\n    const results: T2[] = [];\n    for (let i = 0; i < items.length; i += batchSize) {\n      const batch = items.slice(i, i + batchSize);\n      if (batch?.length) {\n        try {\n          const batchResults = await Promise.all(batch.map(action));\n          if (batchResults?.length) {\n            results.push(...batchResults.flat());\n          }\n        } catch (error) {\n          logger.warn(`Request batch [${i}-${i + batchSize}] failed; The data may be incomplete. ${error}`);\n        }\n      }\n    }\n    return results;\n  }\n}\n\nexport function filterVulnerabilities(securityVulnerabilities: SecurityVulnerability[]): SecurityVulnerability[] {\n  // Filter out vulnerabilities that have been withdrawn or that are not relevant the current version of the package\n  const affectedVulnerabilities = securityVulnerabilities\n    .filter((v) => !v.advisory.withdrawnAt)\n    .filter((v) => {\n      const pkg = v.package;\n      if (!pkg || !pkg.version || !v.vulnerableVersionRange) {\n        return false;\n      }\n\n      /**\n       * The vulnerable version range follows a basic syntax with a few forms:\n       *   `= 0.2.0` denotes a single vulnerable version\n       *   `<= 1.0.8` denotes a version range up to and including the specified version\n       *   `< 0.1.11` denotes a version range up to, but excluding, the specified version\n       *   `>= 4.3.0, < 4.3.5` denotes a version range with a known minimum and maximum version\n       *   `>= 0.0.1` denotes a version range with a known minimum, but no known maximum\n       */\n      const versionRangeRequirements = v.vulnerableVersionRange.split(',').map((v) => v.trim());\n      return versionRangeRequirements.every((r) => pkg.version && semver.satisfies(pkg.version, r));\n    });\n  return affectedVulnerabilities;\n}\n"],"mappings":";;;;;;;;;;;;AAQA,SAAgB,mBAAmB,EAAE,SAAqC;AACxE,QAAO,IAAI,QAAQ,EACjB,MAAM,OAEP,CAAC;;;;;ACHJ,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkD5C,MAAa,yBAAyB,EAAE,KAAK;CAE3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,gBAAgB,EAAE,OAAO;CACpC,MAAM,EAAE,QAAQ;CAChB,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC9B,CAAC;AAGF,MAAa,mCAAmC,EAAE,KAAK,CAAC,OAAO,OAAO,CAAC;AAGvE,MAAa,iCAAiC,EAAE,KAAK;CAAC;CAAO;CAAY;CAAQ;CAAW,CAAC;AAG7F,MAAM,YAAY,EAAE,OAAO;CACzB,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,QAAQ;CACxB,CAAC;AAEF,MAAM,aAAa,EAAE,OAAO;CAC1B,OAAO,EAAE,QAAQ;CACjB,cAAc,EAAE,QAAQ,CAAC,SAAS;CACnC,CAAC;AAGF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,aAAa,EACV,OAAO;EACN,MAAM,EAAE,MAAM,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC;EAC7D,OAAO,EAAE,QAAQ;EAClB,CAAC,CACD,OAAO;CACV,UAAU,+BAA+B,SAAS;CAClD,SAAS,EAAE,QAAQ;CACnB,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;CAC3D,MAAM,WAAW,SAAS;CAC1B,MAAM,EACH,OAAO;EACN,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,YAAY,EAAE,QAAQ,CAAC,SAAS;EACjC,CAAC,CACD,SAAS;CACZ,MAAM,UAAU,OAAO,CAAC,SAAS;CACjC,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAChC,CAAC;AAGF,MAAM,4BAA4B,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAGtE,MAAa,8BAA8B,EAAE,OAAO;CAClD,SAAS;CACT,UAAU;CACV,wBAAwB,EAAE,QAAQ;CAClC,qBAAqB,0BAA0B,SAAS;CACzD,CAAC;AAGF,MAAM,uBAAuB,EAAE,OAAO;CACpC,QAAQ,WAAW,SAAS;CAC5B,QAAQ,WAAW,SAAS;CAC7B,CAAC;AAGF,MAAM,8CAA8C,EAAE,OAAO,EAC3D,yBAAyB,EAAE,OAAO,EAChC,OAAO,EACJ,OAAO;CACN,UAAU,uBAAuB,KAAK,EAAE,MAAM,MAAuC,CAAC,CAAC,OAAO;EAC5F,gBAAgB;EAChB,MAAM,EAAE,OAAO,EAAE,OAAO,UAAU,OAAO,EAAE,CAAC,CAAC,SAAS;EACvD,CAAC;CACF,qBAAqB,0BAA0B,SAAS;CACxD,wBAAwB,EAAE,QAAQ;CACnC,CAAC,CACD,OAAO,EACX,CAAC,EACH,CAAC;AAGF,SAAgB,oDACd,0BACkB;AAClB,SAAQ,0BAAR;EACE,KAAK,WACH,QAAO;EACT,KAAK,MACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,MACH,QAAO;EACT,KAAK,MACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,QACE,OAAM,IAAI,MAAM,uCAAuC,2BAA2B;;;;;;AAOxF,IAAa,+BAAb,MAA0C;CACxC,AAAiB;;;;CAKjB,YAAY,OAAe;AACzB,OAAK,UAAU,mBAAmB,EAAE,OAAO,CAAC;;;;;;;CAQ9C,MAAa,gCACX,kBACA,UACkC;AAiDlC,SA7CgC,MAAM,KAAK,qBACzC,KACA,UACA,OAAO,QAAQ;GACb,MAAM,YAAY;IAChB,WAAW;IACX,SAAS,IAAI;IACd;GAED,SAAS,SAAS,OAAyC;AAEzD,QAAI,MAAM,UAAU,MAAM,OAAO,QAAQ,EAAG,QAAO,MAAM;AACzD,QAAI,MAAM,UAAU,MAAM,OAAO,QAAQ,EAAG,QAAO,MAAM;;AAG3D,OAAI;IACF,MAAM,WAAW,MAAM,KAAK,QAAQ,QAClC,qCACA,UACD;AAGD,WAFe,4CAA4C,MAAM,SAAS,CAC3C,wBAAwB,OAGjD,QAAQ,MAAM,EAAE,YAAY,KAAK,EACjC,KACC,OACE;KACC,GAAG;KACH,SAAS;KACT,UAAU;MACR,GAAG,EAAE;MACL,MAAM,EAAE,SAAS,MAAM;MACvB,MAAM,SAAS,EAAE,SAAS,eAAe;MAC1C;KACF,EACJ,IAAI,EAAE;YAEJ,OAAO;AACd,WAAO,KAAK,2CAA2C,IAAI,KAAK,IAAI,MAAM,mCAAmC;AAC7G,WAAO,EAAE;;IAGd;;;;;;;;;CAYH,MAAc,qBAA6B,WAAmB,OAAa,QAAqC;EAC9G,MAAMA,UAAgB,EAAE;AACxB,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,WAAW;GAChD,MAAM,QAAQ,MAAM,MAAM,GAAG,IAAI,UAAU;AAC3C,OAAI,OAAO,OACT,KAAI;IACF,MAAM,eAAe,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC;AACzD,QAAI,cAAc,OAChB,SAAQ,KAAK,GAAG,aAAa,MAAM,CAAC;YAE/B,OAAO;AACd,WAAO,KAAK,kBAAkB,EAAE,GAAG,IAAI,UAAU,wCAAwC,QAAQ;;;AAIvG,SAAO;;;AAIX,SAAgB,sBAAsB,yBAA2E;AAqB/G,QAnBgC,wBAC7B,QAAQ,MAAM,CAAC,EAAE,SAAS,YAAY,CACtC,QAAQ,MAAM;EACb,MAAM,MAAM,EAAE;AACd,MAAI,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,EAAE,uBAC7B,QAAO;AAYT,SADiC,EAAE,uBAAuB,MAAM,IAAI,CAAC,KAAK,QAAMC,IAAE,MAAM,CAAC,CACzD,OAAO,MAAM,IAAI,WAAW,OAAO,UAAU,IAAI,SAAS,EAAE,CAAC;GAC7F"}
+{"version":3,"file":"index.mjs","names":["v"],"sources":["../../src/github/client.ts","../../src/github/ghsa.ts"],"sourcesContent":["import { Octokit } from 'octokit';\n\n/**\n * Creates an authenticated GitHub API client using Octokit.\n *\n * @param token - GitHub personal access token or fine-grained token with appropriate permissions\n * @returns Configured Octokit instance ready for API calls\n */\nexport function createGitHubClient({ token }: { token: string }): Octokit {\n  return new Octokit({\n    auth: token,\n    // could add retry here perhaps?\n  });\n}\n","import type { Octokit } from 'octokit';\nimport * as semver from 'semver';\nimport { z } from 'zod';\n\nimport { logger } from '@/logger';\nimport { createGitHubClient } from './client';\n\n// we use nullish() because it does optional() and allows the value to be set to null\n\nconst GHSA_SECURITY_VULNERABILITIES_QUERY = `\n  query($ecosystem: SecurityAdvisoryEcosystem, $package: String) {\n    securityVulnerabilities(first: 100, ecosystem: $ecosystem, package: $package) {\n      nodes {\n        advisory {\n          identifiers {\n            type,\n            value\n          },\n          severity,\n          summary,\n          description,\n          references {\n            url\n          }\n          cvssSeverities {\n            cvssV3 {\n              score\n              vectorString\n            }\n            cvssV4 {\n              score\n              vectorString\n            }\n          }\n          epss {\n            percentage\n            percentile\n          }\n          cwes (first: 100) {\n            nodes {\n              cweId\n              name\n              description\n            }\n          }\n          publishedAt\n          updatedAt\n          withdrawnAt\n          permalink\n        }\n        vulnerableVersionRange\n        firstPatchedVersion {\n          identifier\n        }\n      }\n    }\n  }\n`;\n\nexport const PackageEcosystemSchema = z.enum([\n  // https://docs.github.com/en/enterprise-cloud@latest/graphql/reference/enums#securityadvisoryecosystem\n  'COMPOSER',\n  'ERLANG',\n  'GO',\n  'ACTIONS',\n  'MAVEN',\n  'NPM',\n  'NUGET',\n  'PIP',\n  'PUB',\n  'RUBYGEMS',\n  'RUST',\n  'SWIFT',\n]);\nexport type PackageEcosystem = z.infer<typeof PackageEcosystemSchema>;\n\nexport const PackageSchema = z.object({\n  name: z.string(),\n  version: z.string().nullish(),\n});\nexport type Package = z.infer<typeof PackageSchema>;\n\nexport const SecurityAdvisoryIdentifierSchema = z.enum(['CVE', 'GHSA']);\nexport type SecurityAdvisoryIdentifierType = z.infer<typeof SecurityAdvisoryIdentifierSchema>;\n\nexport const SecurityAdvisorySeveritySchema = z.enum(['LOW', 'MODERATE', 'HIGH', 'CRITICAL']);\nexport type SecurityAdvisorySeverity = z.infer<typeof SecurityAdvisorySeveritySchema>;\n\nconst CweSchema = z.object({\n  cweId: z.string(),\n  name: z.string(),\n  description: z.string(),\n});\n\nconst CvssSchema = z.object({\n  score: z.number(),\n  vectorString: z.string().nullish(),\n});\ntype Cvss = z.infer<typeof CvssSchema>;\n\nexport const SecurityAdvisorySchema = z.object({\n  identifiers: z\n    .object({\n      type: z.union([SecurityAdvisoryIdentifierSchema, z.string()]),\n      value: z.string(),\n    })\n    .array(),\n  severity: SecurityAdvisorySeveritySchema.nullish(),\n  summary: z.string(),\n  description: z.string().nullish(),\n  references: z.object({ url: z.string() }).array().nullish(),\n  cvss: CvssSchema.nullish(),\n  epss: z\n    .object({\n      percentage: z.number().nullish(),\n      percentile: z.number().nullish(),\n    })\n    .nullish(),\n  cwes: CweSchema.array().nullish(),\n  publishedAt: z.string().nullish(),\n  updatedAt: z.string().nullish(),\n  withdrawnAt: z.string().nullish(),\n  permalink: z.string().nullish(),\n});\nexport type SecurityAdvisory = z.infer<typeof SecurityAdvisorySchema>;\n\nconst FirstPatchedVersionSchema = z.object({ identifier: z.string() });\nexport type FirstPatchedVersion = z.infer<typeof FirstPatchedVersionSchema>;\n\nexport const SecurityVulnerabilitySchema = z.object({\n  package: PackageSchema,\n  advisory: SecurityAdvisorySchema,\n  vulnerableVersionRange: z.string(),\n  firstPatchedVersion: FirstPatchedVersionSchema.nullish(),\n});\nexport type SecurityVulnerability = z.infer<typeof SecurityVulnerabilitySchema>;\n\nconst CvssSeveritiesSchema = z.object({\n  cvssV3: CvssSchema.nullish(),\n  cvssV4: CvssSchema.nullish(),\n});\ntype CvssSeverities = z.infer<typeof CvssSeveritiesSchema>;\n\nconst GitHubSecurityVulnerabilitiesResponseSchema = z.object({\n  securityVulnerabilities: z.object({\n    nodes: z\n      .object({\n        advisory: SecurityAdvisorySchema.omit({ cvss: true /* incoming is cvssSeverities */ }).extend({\n          cvssSeverities: CvssSeveritiesSchema,\n          cwes: z.object({ nodes: CweSchema.array() }).nullish(),\n        }),\n        firstPatchedVersion: FirstPatchedVersionSchema.nullish(),\n        vulnerableVersionRange: z.string(),\n      })\n      .array(),\n  }),\n});\ntype GitHubSecurityVulnerabilitiesResponse = z.infer<typeof GitHubSecurityVulnerabilitiesResponseSchema>;\n\nexport function getGhsaPackageEcosystemFromDependabotPackageManager(\n  dependabotPackageManager: string,\n): PackageEcosystem {\n  switch (dependabotPackageManager) {\n    case 'composer':\n      return 'COMPOSER';\n    case 'elm':\n      return 'ERLANG';\n    case 'github_actions':\n      return 'ACTIONS';\n    case 'go_modules':\n      return 'GO';\n    case 'maven':\n      return 'MAVEN';\n    case 'npm_and_yarn':\n      return 'NPM';\n    case 'nuget':\n      return 'NUGET';\n    case 'pip':\n      return 'PIP';\n    case 'pub':\n      return 'PUB';\n    case 'bundler':\n      return 'RUBYGEMS';\n    case 'cargo':\n      return 'RUST';\n    case 'swift':\n      return 'SWIFT';\n    default:\n      throw new Error(`Unknown dependabot package manager: ${dependabotPackageManager}`);\n  }\n}\n\n/**\n * GitHub Security Advisory client\n */\nexport class GitHubSecurityAdvisoryClient {\n  private readonly octokit: Octokit;\n\n  /**\n   * @param token GitHub personal access token with access to the GHSA API\n   */\n  constructor(token: string) {\n    this.octokit = createGitHubClient({ token });\n  }\n\n  /**\n   * Get the list of security vulnerabilities for a given package ecosystem and list of packages\n   * @param packageEcosystem\n   * @param packages\n   */\n  public async getSecurityVulnerabilitiesAsync(\n    packageEcosystem: PackageEcosystem,\n    packages: Package[],\n  ): Promise<SecurityVulnerability[]> {\n    // GitHub API doesn't support querying multiple package at once, so we need to make a request for each package individually.\n    // To speed up the process, we can make the requests in parallel, 100 at a time. We batch the requests to avoid hitting the rate limit too quickly.\n    // https://docs.github.com/en/graphql/overview/rate-limits-and-node-limits-for-the-graphql-api\n    const securityVulnerabilities = await this.batchGraphQueryAsync<Package, SecurityVulnerability>(\n      100,\n      packages,\n      async (pkg) => {\n        const variables = {\n          ecosystem: packageEcosystem,\n          package: pkg.name,\n        };\n\n        function pickCvss(value: CvssSeverities): Cvss | undefined {\n          // Pick the one with a non-zero score\n          if (value.cvssV4 && value.cvssV4.score > 0) return value.cvssV4;\n          if (value.cvssV3 && value.cvssV3.score > 0) return value.cvssV3;\n        }\n\n        try {\n          const response = await this.octokit.graphql<GitHubSecurityVulnerabilitiesResponse>(\n            GHSA_SECURITY_VULNERABILITIES_QUERY,\n            variables,\n          );\n          const parsed = GitHubSecurityVulnerabilitiesResponseSchema.parse(response);\n          const vulnerabilities = parsed.securityVulnerabilities.nodes;\n          return (\n            vulnerabilities\n              ?.filter((v) => v.advisory != null)\n              ?.map(\n                (v) =>\n                  ({\n                    ...v,\n                    package: pkg,\n                    advisory: {\n                      ...v.advisory,\n                      cwes: v.advisory.cwes?.nodes,\n                      cvss: pickCvss(v.advisory.cvssSeverities),\n                    },\n                  }) satisfies SecurityVulnerability,\n              ) || []\n          );\n        } catch (error) {\n          logger.warn(`GHSA GraphQL request failed for package ${pkg.name}: ${error}. Continuing with other packages.`);\n          return [];\n        }\n      },\n    );\n\n    return securityVulnerabilities;\n  }\n\n  /**\n   * Batch requests in parallel to speed up the process when we are forced to do a N+1 query\n   * @param batchSize\n   * @param items\n   * @param action\n   * @returns\n   */\n  private async batchGraphQueryAsync<T1, T2>(batchSize: number, items: T1[], action: (item: T1) => Promise<T2[]>) {\n    const results: T2[] = [];\n    for (let i = 0; i < items.length; i += batchSize) {\n      const batch = items.slice(i, i + batchSize);\n      if (batch?.length) {\n        try {\n          const batchResults = await Promise.all(batch.map(action));\n          if (batchResults?.length) {\n            results.push(...batchResults.flat());\n          }\n        } catch (error) {\n          logger.warn(`Request batch [${i}-${i + batchSize}] failed; The data may be incomplete. ${error}`);\n        }\n      }\n    }\n    return results;\n  }\n}\n\nexport function filterVulnerabilities(securityVulnerabilities: SecurityVulnerability[]): SecurityVulnerability[] {\n  // Filter out vulnerabilities that have been withdrawn or that are not relevant the current version of the package\n  const affectedVulnerabilities = securityVulnerabilities\n    .filter((v) => !v.advisory.withdrawnAt)\n    .filter((v) => {\n      const pkg = v.package;\n      if (!pkg || !pkg.version || !v.vulnerableVersionRange) {\n        return false;\n      }\n\n      /**\n       * The vulnerable version range follows a basic syntax with a few forms:\n       *   `= 0.2.0` denotes a single vulnerable version\n       *   `<= 1.0.8` denotes a version range up to and including the specified version\n       *   `< 0.1.11` denotes a version range up to, but excluding, the specified version\n       *   `>= 4.3.0, < 4.3.5` denotes a version range with a known minimum and maximum version\n       *   `>= 0.0.1` denotes a version range with a known minimum, but no known maximum\n       */\n      const versionRangeRequirements = v.vulnerableVersionRange.split(',').map((v) => v.trim());\n      return versionRangeRequirements.every((r) => pkg.version && semver.satisfies(pkg.version, r));\n    });\n  return affectedVulnerabilities;\n}\n"],"mappings":";;;;;;;;;;;;AAQA,SAAgB,mBAAmB,EAAE,SAAqC;AACxE,QAAO,IAAI,QAAQ,EACjB,MAAM,OAEP,CAAC;;;;;ACHJ,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkD5C,MAAa,yBAAyB,EAAE,KAAK;CAE3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,gBAAgB,EAAE,OAAO;CACpC,MAAM,EAAE,QAAQ;CAChB,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC9B,CAAC;AAGF,MAAa,mCAAmC,EAAE,KAAK,CAAC,OAAO,OAAO,CAAC;AAGvE,MAAa,iCAAiC,EAAE,KAAK;CAAC;CAAO;CAAY;CAAQ;CAAW,CAAC;AAG7F,MAAM,YAAY,EAAE,OAAO;CACzB,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,QAAQ;CACxB,CAAC;AAEF,MAAM,aAAa,EAAE,OAAO;CAC1B,OAAO,EAAE,QAAQ;CACjB,cAAc,EAAE,QAAQ,CAAC,SAAS;CACnC,CAAC;AAGF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,aAAa,EACV,OAAO;EACN,MAAM,EAAE,MAAM,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC;EAC7D,OAAO,EAAE,QAAQ;EAClB,CAAC,CACD,OAAO;CACV,UAAU,+BAA+B,SAAS;CAClD,SAAS,EAAE,QAAQ;CACnB,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;CAC3D,MAAM,WAAW,SAAS;CAC1B,MAAM,EACH,OAAO;EACN,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,YAAY,EAAE,QAAQ,CAAC,SAAS;EACjC,CAAC,CACD,SAAS;CACZ,MAAM,UAAU,OAAO,CAAC,SAAS;CACjC,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAChC,CAAC;AAGF,MAAM,4BAA4B,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAGtE,MAAa,8BAA8B,EAAE,OAAO;CAClD,SAAS;CACT,UAAU;CACV,wBAAwB,EAAE,QAAQ;CAClC,qBAAqB,0BAA0B,SAAS;CACzD,CAAC;AAGF,MAAM,uBAAuB,EAAE,OAAO;CACpC,QAAQ,WAAW,SAAS;CAC5B,QAAQ,WAAW,SAAS;CAC7B,CAAC;AAGF,MAAM,8CAA8C,EAAE,OAAO,EAC3D,yBAAyB,EAAE,OAAO,EAChC,OAAO,EACJ,OAAO;CACN,UAAU,uBAAuB,KAAK,EAAE,MAAM,MAAuC,CAAC,CAAC,OAAO;EAC5F,gBAAgB;EAChB,MAAM,EAAE,OAAO,EAAE,OAAO,UAAU,OAAO,EAAE,CAAC,CAAC,SAAS;EACvD,CAAC;CACF,qBAAqB,0BAA0B,SAAS;CACxD,wBAAwB,EAAE,QAAQ;CACnC,CAAC,CACD,OAAO,EACX,CAAC,EACH,CAAC;AAGF,SAAgB,oDACd,0BACkB;AAClB,SAAQ,0BAAR;EACE,KAAK,WACH,QAAO;EACT,KAAK,MACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,MACH,QAAO;EACT,KAAK,MACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,KAAK,QACH,QAAO;EACT,QACE,OAAM,IAAI,MAAM,uCAAuC,2BAA2B;;;;;;AAOxF,IAAa,+BAAb,MAA0C;CACxC,AAAiB;;;;CAKjB,YAAY,OAAe;AACzB,OAAK,UAAU,mBAAmB,EAAE,OAAO,CAAC;;;;;;;CAQ9C,MAAa,gCACX,kBACA,UACkC;AAiDlC,SA7CgC,MAAM,KAAK,qBACzC,KACA,UACA,OAAO,QAAQ;GACb,MAAM,YAAY;IAChB,WAAW;IACX,SAAS,IAAI;IACd;GAED,SAAS,SAAS,OAAyC;AAEzD,QAAI,MAAM,UAAU,MAAM,OAAO,QAAQ,EAAG,QAAO,MAAM;AACzD,QAAI,MAAM,UAAU,MAAM,OAAO,QAAQ,EAAG,QAAO,MAAM;;AAG3D,OAAI;IACF,MAAM,WAAW,MAAM,KAAK,QAAQ,QAClC,qCACA,UACD;AAGD,WAFe,4CAA4C,MAAM,SAAS,CAC3C,wBAAwB,OAGjD,QAAQ,MAAM,EAAE,YAAY,KAAK,EACjC,KACC,OACE;KACC,GAAG;KACH,SAAS;KACT,UAAU;MACR,GAAG,EAAE;MACL,MAAM,EAAE,SAAS,MAAM;MACvB,MAAM,SAAS,EAAE,SAAS,eAAe;MAC1C;KACF,EACJ,IAAI,EAAE;YAEJ,OAAO;AACd,WAAO,KAAK,2CAA2C,IAAI,KAAK,IAAI,MAAM,mCAAmC;AAC7G,WAAO,EAAE;;IAGd;;;;;;;;;CAYH,MAAc,qBAA6B,WAAmB,OAAa,QAAqC;EAC9G,MAAM,UAAgB,EAAE;AACxB,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,WAAW;GAChD,MAAM,QAAQ,MAAM,MAAM,GAAG,IAAI,UAAU;AAC3C,OAAI,OAAO,OACT,KAAI;IACF,MAAM,eAAe,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC;AACzD,QAAI,cAAc,OAChB,SAAQ,KAAK,GAAG,aAAa,MAAM,CAAC;YAE/B,OAAO;AACd,WAAO,KAAK,kBAAkB,EAAE,GAAG,IAAI,UAAU,wCAAwC,QAAQ;;;AAIvG,SAAO;;;AAIX,SAAgB,sBAAsB,yBAA2E;AAqB/G,QAnBgC,wBAC7B,QAAQ,MAAM,CAAC,EAAE,SAAS,YAAY,CACtC,QAAQ,MAAM;EACb,MAAM,MAAM,EAAE;AACd,MAAI,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,EAAE,uBAC7B,QAAO;AAYT,SADiC,EAAE,uBAAuB,MAAM,IAAI,CAAC,KAAK,QAAMA,IAAE,MAAM,CAAC,CACzD,OAAO,MAAM,IAAI,WAAW,OAAO,UAAU,IAAI,SAAS,EAAE,CAAC;GAC7F"}

package/dist/{index-t1Aj_PJX.d.mts → index-rsiHDQ5U.d.mts}

@@ -562,7 +562,7 @@ declare const BETA_ECOSYSTEMS: PackageEcosystem[];
  * See: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-dependabotyml
  */
 declare const DependabotConfigSchema: z.ZodPipe<z.ZodObject<{
-  version: z.ZodNumber;
+  version: z.ZodNumber & z.ZodType<2, number, z.core.$ZodTypeInternals<2, number>>;
   'multi-ecosystem-groups': z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
     schedule: z.ZodPipe<z.ZodObject<{
       interval: z.ZodEnum<{
@@ -952,7 +952,7 @@ declare const DependabotConfigSchema: z.ZodPipe<z.ZodObject<{
   }>>>>;
   'enable-beta-ecosystems': z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>, z.ZodTransform<{
-  version: number;
+  version: 2;
   updates: {
     'package-ecosystem': "bundler" | "cargo" | "composer" | "conda" | "pub" | "docker" | "elm" | "gradle" | "maven" | "nuget" | "pip" | "swift" | "terraform" | "devcontainers" | "bun" | "uv" | "vcpkg" | "helm" | "julia" | "bazel" | "opentofu" | "docker-compose" | "dotnet-sdk" | "mix" | "gitsubmodule" | "github-actions" | "gomod" | "npm" | "pip-compile" | "pipenv" | "pnpm" | "poetry" | "rust-toolchain" | "yarn";
     schedule: {
@@ -1053,7 +1053,7 @@ declare const DependabotConfigSchema: z.ZodPipe<z.ZodObject<{
   }> | undefined;
   'enable-beta-ecosystems'?: boolean | undefined;
 }, {
-  version: number;
+  version: 2;
   updates: {
     'package-ecosystem': "bundler" | "cargo" | "composer" | "conda" | "pub" | "docker" | "elm" | "gradle" | "maven" | "nuget" | "pip" | "swift" | "terraform" | "devcontainers" | "bun" | "uv" | "vcpkg" | "helm" | "julia" | "bazel" | "opentofu" | "docker-compose" | "dotnet-sdk" | "mix" | "gitsubmodule" | "github-actions" | "gomod" | "npm" | "pip-compile" | "pipenv" | "pnpm" | "poetry" | "rust-toolchain" | "yarn";
     schedule: {
@@ -2711,4 +2711,4 @@ declare function getPullRequestDescription({
 }): string;
 //#endregion
 export { DependabotJobBuilder as $, DependabotRequirementSchema as $t, DependabotRecordCooldownMeta as A, DependabotRegistry as An, DependabotDependency as At, DependabotRecordUpdateJobWarning as B, parseDependabotConfig as Bn, DependabotGroupRuleJob as Bt, DependabotIncrementMetricSchema as C, DependabotGroup as Cn, DependabotCommandSchema as Ct, DependabotMarkAsProcessedSchema as D, DependabotMultiEcosystemGroup as Dn, DependabotConditionSchema as Dt, DependabotMarkAsProcessed as E, DependabotIgnoreConditionSchema as En, DependabotCondition as Et, DependabotRecordEcosystemVersionsSchema as F, DependabotUpdateSchema as Fn, DependabotExistingPRSchema as Ft, DependabotUpdatePullRequestSchema as G, convertPlaceholder as Gn, DependabotJobFileSchema as Gt, DependabotUpdateDependencyList as H, parseUpdates as Hn, DependabotJobConfig as Ht, DependabotRecordUpdateJobError as I, PackageEcosystem as In, DependabotExperiments as It, DependabotRequestSchema as J, DEPENDABOT_DEFAULT_AUTHOR_NAME as Jn, DependabotPersistedPr as Jt, CreateApiServerAppOptions as K, extractPlaceholder as Kn, DependabotPackageManager as Kt, DependabotRecordUpdateJobErrorSchema as L, PackageEcosystemSchema as Ln, DependabotExperimentsSchema as Lt, DependabotRecordEcosystemMeta as M, DependabotSchedule as Mn, DependabotExistingGroupPR as Mt, DependabotRecordEcosystemMetaSchema as N, DependabotScheduleSchema as Nn, DependabotExistingGroupPRSchema as Nt, DependabotMetric as O, DependabotMultiEcosystemGroupSchema as On, DependabotCredential as Ot, DependabotRecordEcosystemVersions as P, DependabotUpdate as Pn, DependabotExistingPR as Pt, createApiServerApp as Q, DependabotRequirement as Qt, DependabotRecordUpdateJobUnknownError as R, VersioningStrategy as Rn, DependabotGroupJob as Rt, DependabotIncrementMetric as S, DependabotCooldownSchema as Sn, DependabotCommand as St, DependabotJobErrorSchema as T, DependabotIgnoreCondition as Tn, DependabotCommitOptionsSchema as Tt, DependabotUpdateDependencyListSchema as U, validateConfiguration as Un, DependabotJobConfigSchema as Ut, DependabotRecordUpdateJobWarningSchema as V, parseRegistries as Vn, DependabotGroupRuleJobSchema as Vt, DependabotUpdatePullRequest as W, VariableFinderFn as Wn, DependabotJobFile as Wt, DependabotRequestTypeSchema as X, DependabotProxyConfig as Xt, DependabotRequestType as Y, GitAuthor as Yn, DependabotPersistedPrSchema as Yt, DependabotTokenType as Z, DependabotProxyConfigSchema as Zt, DependabotDependencySubmissionSchema as _, DependabotCommitMessage as _n, CertificateAuthority as _t, getPullRequestDescription as a, DependabotSourceProvider as an, mapGroupsFromDependabotConfigToJobConfig as at, DependabotEcosystemVersionManager as b, DependabotConfigSchema as bn, DependabotAllowed as bt, DependabotClosePullRequest as c, FetchedFiles as cn, mapSecurityAdvisories as ct, DependabotClosePullRequestSchema as d, BETA_ECOSYSTEMS as dn, DEFAULT_EXPERIMENTS as dt, DependabotRequirementSource as en, DependabotJobBuilderOutput as et, DependabotCreatePullRequest as f, CONFIG_FILE_NAMES as fn, parseExperiments as ft, DependabotDependencySubmission as g, DependabotAllowConditionSchema as gn, sanitizeRef as gt, DependabotDependencyFileSchema as h, DependabotAllowCondition as hn, getBranchNameForUpdate as ht, getPullRequestDependencies as i, DependabotSource as in, mapExperiments as it, DependabotRecordCooldownMetaSchema as j, DependabotRegistrySchema as jn, DependabotDependencySchema as jt, DependabotMetricSchema as k, DependabotPullRequestBranchName as kn, DependabotCredentialSchema as kt, DependabotClosePullRequestReason as l, FileFetcherInput as ln, mapSourceFromDependabotConfigToJobConfig as lt, DependabotDependencyFile as m, CONFIG_FILE_PATHS_GITHUB as mn, makeDirectoryKey as mt, getDependencyNames as n, DependabotSecurityAdvisory as nn, mapAllowedUpdatesFromDependabotConfigToJobConfig as nt, normalizeBranchName as o, DependabotSourceProviderSchema as on, mapIgnoreConditionsFromDependabotConfigToJobConfig as ot, DependabotCreatePullRequestSchema as p, CONFIG_FILE_PATHS_AZURE as pn, setExperiment as pt, DependabotRequest as q, DEPENDABOT_DEFAULT_AUTHOR_EMAIL as qn, DependabotPackageManagerSchema as qt, getPullRequestCloseReason as r, DependabotSecurityAdvisorySchema as rn, mapCredentials as rt, normalizeFilePath as s, DependabotSourceSchema as sn, mapPackageEcosystemToPackageManager as st, areEqual as t, DependabotRequirementSourceSchema as tn, DependabotSourceInfo as tt, DependabotClosePullRequestReasonEnum as u, FileUpdaterInput as un, mapVersionStrategyToRequirementsUpdateStrategy as ut, DependabotEcosystemMeta as v, DependabotCommitMessageSchema as vn, CertificateAuthoritySchema as vt, DependabotJobError as w, DependabotGroupSchema as wn, DependabotCommitOptions as wt, DependabotEcosystemVersionManagerSchema as x, DependabotCooldown as xn, DependabotAllowedSchema as xt, DependabotEcosystemMetaSchema as y, DependabotConfig as yn, DEPENDABOT_COMMANDS as yt, DependabotRecordUpdateJobUnknownErrorSchema as z, VersioningStrategySchema as zn, DependabotGroupJobSchema as zt };
-//# sourceMappingURL=index-t1Aj_PJX.d.mts.map
+//# sourceMappingURL=index-rsiHDQ5U.d.mts.map

package/dist/job-ClEevC5P.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"job-ClEevC5P.mjs","names":["matches: RegExpExecArray[]","regexp: RegExp","BETA_ECOSYSTEMS: PackageEcosystem[]","updates: DependabotUpdate[]","registries: Record<string, DependabotRegistry>","referenced: string[]"],"sources":["../src/dependabot/directory-key.ts","../src/dependabot/placeholder.ts","../src/dependabot/config.ts","../src/dependabot/job.ts"],"sourcesContent":["/**\n * Options for creating a directory key that supports both naming conventions:\n * - `ecosystem` (standard format)\n * - `package-ecosystem` (alternative format for compatibility)\n *\n * Either a single `directory` or multiple `directories` can be specified.\n */\ntype MakeDirectoryKeyOptions =\n  | {\n      /** The package ecosystem (e.g., 'npm', 'pip', 'bundler') */\n      ecosystem: string;\n      /** Single directory path (optional if directories is provided) */\n      directory?: string | null;\n      /** Multiple directory paths (optional if directory is provided) */\n      directories?: string[];\n    }\n  | {\n      /** The package ecosystem using alternative naming convention */\n      'package-ecosystem': string;\n      /** Single directory path (optional if directories is provided) */\n      directory?: string | null;\n      /** Multiple directory paths (optional if directory is provided) */\n      directories?: string[];\n    };\n\n/**\n * Creates a unique directory key by combining the ecosystem and directory information.\n *\n * The key format is: `{ecosystem}::{directory_info}`\n * - For single directory: `npm::/src/frontend`\n * - For multiple directories: `npm::/src/frontend,/src/backend`\n *\n * @param options - Configuration object containing ecosystem and directory information\n * @returns A unique string key in the format `{ecosystem}::{directories}`\n *\n * @example\n * ```typescript\n * // Single directory\n * const key1 = makeDirectoryKey({ ecosystem: 'npm', directory: '/src' });\n * // Returns: \"npm::/src\"\n *\n * // Multiple directories\n * const key2 = makeDirectoryKey({\n *   ecosystem: 'pip',\n *   directories: ['/backend', '/scripts']\n * });\n * // Returns: \"pip::/backend,/scripts\"\n *\n * // Using alternative naming convention\n * const key3 = makeDirectoryKey({\n *   'package-ecosystem': 'bundler',\n *   directory: '/app'\n * });\n * // Returns: \"bundler::/app\"\n * ```\n */\nexport function makeDirectoryKey(options: MakeDirectoryKeyOptions): string {\n  // Extract ecosystem name from either naming convention\n  const ecosystem = 'ecosystem' in options ? options.ecosystem : options['package-ecosystem'];\n\n  // Use single directory if provided, otherwise join multiple directories with comma\n  const directoryPart = options.directory ?? options.directories!.join(',');\n\n  return `${ecosystem}::${directoryPart}`;\n}\n","export type VariableFinderFn = (name: string) => string | undefined | Promise<string | undefined>;\n\nasync function convertPlaceholder({\n  input,\n  variableFinder,\n}: {\n  input?: string;\n  variableFinder: VariableFinderFn;\n}): Promise<string | undefined> {\n  if (!input) return undefined;\n\n  const matches: RegExpExecArray[] = extractPlaceholder(input);\n  let result = input;\n  for (const match of matches) {\n    const placeholder = match[0];\n    const name = match[1]!;\n    const value = (await variableFinder(name)) ?? placeholder;\n    result = result.replace(placeholder, value);\n  }\n  return result;\n}\n\nfunction extractPlaceholder(input: string) {\n  const matches: RegExpExecArray[] = [];\n  const regexp: RegExp = /\\$\\{\\{\\s{0,10}([a-zA-Z_][a-zA-Z0-9._-]{0,99})\\s{0,10}\\}\\}/;\n\n  let searchInput = input;\n  let offset = 0;\n\n  while (searchInput.length > 0) {\n    const match = searchInput.match(regexp);\n    if (!match || match.index === undefined) break;\n\n    // Adjust match index to account for previous slices\n    const adjustedMatch = Object.assign([...match], {\n      index: match.index + offset,\n      input: input,\n      groups: match.groups,\n    }) as RegExpExecArray;\n\n    matches.push(adjustedMatch);\n\n    // Move past this match\n    const nextStart = match.index + match[0].length;\n    offset += nextStart;\n    searchInput = searchInput.slice(nextStart);\n  }\n\n  return matches;\n}\n\nexport { convertPlaceholder, extractPlaceholder };\n","import * as yaml from 'js-yaml';\nimport { z } from 'zod';\n\nimport { makeDirectoryKey } from './directory-key';\nimport { convertPlaceholder, type VariableFinderFn } from './placeholder';\n\nexport const DependabotRegistrySchema = z\n  .object({\n    type: z.enum([\n      // order matches\n      // https://docs.github.com/en/enterprise-cloud@latest/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#supported-private-registries\n\n      'cargo-registry',\n      'composer-repository',\n      'docker-registry',\n      'git',\n      'goproxy-server',\n      'helm-registry',\n      'hex-organization',\n      'hex-repository',\n      'maven-repository',\n      'npm-registry',\n      'nuget-feed',\n      'pub-repository',\n      'python-index',\n      'rubygems-server',\n      'terraform-registry',\n    ]),\n    url: z.string().optional(),\n    username: z.string().optional(),\n    password: z.string().optional(),\n    key: z.string().optional(),\n    token: z.string().optional(),\n    'replaces-base': z.boolean().optional(),\n    host: z.string().optional(), // for terraform and composer only\n    registry: z.string().optional(), // for npm only\n    organization: z.string().optional(), // for hex-organisation only\n    repo: z.string().optional(), // for hex-repository only\n    'public-key-fingerprint': z.string().optional(), // for hex-repository only\n    'index-url': z.string().optional(), // for python-index only\n    'auth-key': z.string().optional(), // used by composer-repository, docker-registry, etc\n    'tenant-id': z.string().optional(), // can only be for azure related stuff, not sure\n    'client-id': z.string().optional(), // can only be for azure related stuff, not sure\n  })\n  // change underscore to dash in the registry key/type\n  .transform((value) => ({ ...value, type: value.type.replace('-', '_') }));\nexport type DependabotRegistry = z.infer<typeof DependabotRegistrySchema>;\n\nexport const DependabotGroupSchema = z.object({\n  // Define an identifier for the group to use in branch names and pull request titles.\n  // This must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.\n  IDENTIFIER: z\n    .string()\n    .check(\n      z.regex(/^[a-zA-Z][a-zA-Z0-9|_-]*[a-zA-Z]$/, {\n        message:\n          'Group identifier must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.',\n      }),\n    )\n    .optional(),\n  'applies-to': z.enum(['version-updates', 'security-updates']).optional(),\n  'dependency-type': z.enum(['development', 'production']).optional(),\n  patterns: z.string().array().optional(),\n  'exclude-patterns': z.string().array().optional(),\n  'update-types': z.enum(['major', 'minor', 'patch']).array().optional(),\n});\nexport type DependabotGroup = z.infer<typeof DependabotGroupSchema>;\n\nexport const DependabotAllowConditionSchema = z.object({\n  'dependency-name': z.string().optional(),\n  'dependency-type': z.enum(['direct', 'indirect', 'all', 'production', 'development']).optional(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowCondition = z.infer<typeof DependabotAllowConditionSchema>;\n\nexport const DependabotIgnoreConditionSchema = z\n  .object({\n    'dependency-name': z.string().optional(),\n    versions: z.string().array().or(z.string()).optional(),\n    'update-types': z\n      .enum(['version-update:semver-major', 'version-update:semver-minor', 'version-update:semver-patch'])\n      .array()\n      .optional(),\n  })\n  .and(z.record(z.string(), z.any()));\nexport type DependabotIgnoreCondition = z.infer<typeof DependabotIgnoreConditionSchema>;\n\nexport const DependabotScheduleSchema = z\n  .object({\n    interval: z.enum(['daily', 'weekly', 'monthly', 'quarterly', 'semiannually', 'yearly', 'cron']),\n\n    day: z\n      .enum(['sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'])\n      .optional()\n      .default('monday'),\n\n    time: z\n      .string()\n      .default('02:00')\n      .check(z.regex(/^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$/, { message: 'Time must be in HH:MM format' }))\n      .optional(),\n\n    timezone: z\n      .string()\n      .optional()\n      .default('Etc/UTC')\n      .refine(\n        (value) => {\n          try {\n            // If tz is not a valid IANA name, this throws a RangeError\n            Intl.DateTimeFormat(undefined, { timeZone: value });\n            return true;\n          } catch {\n            return false;\n          }\n        },\n        { message: 'Invalid IANA time zone' },\n      ),\n    cronjob: z\n      .string()\n      .check(z.regex(/^\\S+ \\S+ \\S+ \\S+ \\S+$/, { message: 'Cronjob must be in standard cron format' }))\n      .optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // if interval is 'cron', cronjob must be specified\n    if (value.interval === 'cron' && !value.cronjob) {\n      addIssue(\"The 'cronjob' field must be specified when the interval is set to 'cron'.\");\n    }\n\n    return value;\n  });\nexport type DependabotSchedule = z.infer<typeof DependabotScheduleSchema>;\n\nexport const DependabotCommitMessageSchema = z.object({\n  prefix: z.string().optional(),\n  'prefix-development': z.string().optional(),\n  include: z.string().optional(),\n});\nexport type DependabotCommitMessage = z.infer<typeof DependabotCommitMessageSchema>;\n\nexport const DependabotCooldownSchema = z.object({\n  'default-days': z.number().optional(),\n  'semver-major-days': z.number().optional(),\n  'semver-minor-days': z.number().optional(),\n  'semver-patch-days': z.number().optional(),\n  include: z.string().array().optional(),\n  exclude: z.string().array().optional(),\n});\nexport type DependabotCooldown = z.infer<typeof DependabotCooldownSchema>;\n\nconst DependabotPullRequestBranchNameSchema = z.object({\n  separator: z.string().optional(),\n});\nexport type DependabotPullRequestBranchName = z.infer<typeof DependabotPullRequestBranchNameSchema>;\n\nexport const PackageEcosystemSchema = z.enum([\n  // order matches\n  // https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-\n\n  'bazel',\n  'bun',\n  'bundler',\n  'cargo',\n  'composer',\n  'conda',\n  'devcontainers',\n  'docker',\n  'docker-compose',\n  'dotnet-sdk',\n  'helm',\n  'mix',\n  'elm',\n  'gitsubmodule',\n  'github-actions',\n  'gomod',\n  'gradle',\n  'julia',\n  'maven',\n  'npm',\n  'nuget',\n  'opentofu',\n  'pip',\n  'pip-compile', // alias mapped to 'pip'\n  'pipenv', // alias mapped to 'pip'\n  'pnpm', // alias mapped to 'npm'\n  'poetry', // alias mapped to 'pip'\n  'pub',\n  'rust-toolchain',\n  'swift',\n  'terraform',\n  'uv',\n  'vcpkg',\n  'yarn', // alias mapped to 'npm'\n]);\nexport type PackageEcosystem = z.infer<typeof PackageEcosystemSchema>;\n\nexport const VersioningStrategySchema = z.enum(['auto', 'increase', 'increase-if-necessary', 'lockfile-only', 'widen']);\nexport type VersioningStrategy = z.infer<typeof VersioningStrategySchema>;\n\nexport const DependabotUpdateSchema = z\n  .object({\n    'package-ecosystem': PackageEcosystemSchema,\n    directory: z.string().optional(),\n    directories: z.string().array().optional(),\n    'exclude-paths': z.string().array().optional(),\n    allow: DependabotAllowConditionSchema.array().optional(),\n    assignees: z.string().array().optional(),\n    'commit-message': DependabotCommitMessageSchema.optional(),\n    cooldown: DependabotCooldownSchema.optional(),\n    groups: z.record(z.string(), DependabotGroupSchema).optional(),\n    ignore: DependabotIgnoreConditionSchema.array().optional(),\n    'insecure-external-code-execution': z.enum(['allow', 'deny']).optional(),\n    labels: z.string().array().optional(),\n    milestone: z.coerce.string().optional(),\n    'open-pull-requests-limit': z.number().check(z.int(), z.gte(0)).optional(),\n    'pull-request-branch-name': DependabotPullRequestBranchNameSchema.optional(),\n    'rebase-strategy': z.string().optional(),\n    registries: z.string().array().optional(),\n    schedule: DependabotScheduleSchema,\n    'target-branch': z.string().optional(),\n    vendor: z.boolean().optional(),\n    'versioning-strategy': VersioningStrategySchema.optional(),\n    patterns: z.string().array().optional(),\n    'multi-ecosystem-group': z.string().optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // either 'directory' or 'directories' must be specified\n    if (!value.directory && (!value.directories || value.directories.length === 0)) {\n      addIssue(\"Either 'directory' or 'directories' must be specified in the dependency update configuration.\");\n    }\n\n    // validate that 'directory' does not contain glob patterns\n    if (value.directory && /[*?[\\]{}]/.test(value.directory)) {\n      addIssue(\"The 'directory' field must not include glob pattern.\");\n    }\n\n    value['open-pull-requests-limit'] ??= 5; // default to 5 if not specified\n\n    // The patterns key is required when using multi-ecosystem-group.\n    // You can specify dependency patterns to include only certain dependencies in the group,\n    // or use [\"*\"] to include all dependencies.\n    if (value['multi-ecosystem-group'] && (!value.patterns || value.patterns.length === 0)) {\n      addIssue(\n        \"The 'patterns' field must be specified and contain at least one pattern when using 'multi-ecosystem-group'.\",\n      );\n    }\n\n    return value;\n  });\nexport type DependabotUpdate = z.infer<typeof DependabotUpdateSchema>;\n\nexport const DependabotMultiEcosystemGroupSchema = z.object({\n  schedule: DependabotScheduleSchema,\n  labels: z.string().array().optional(), // behaviour: additive\n  milestone: z.coerce.string().optional(), // behaviour: group-only\n  assignees: z.string().array().optional(), // behaviour: additive\n  'target-branch': z.string().optional(), // behaviour: group-only\n  'commit-message': DependabotCommitMessageSchema.optional(), // behaviour: group-only\n  'pull-request-branch-name': DependabotPullRequestBranchNameSchema.optional(), // behaviour: group-only\n});\nexport type DependabotMultiEcosystemGroup = z.infer<typeof DependabotMultiEcosystemGroupSchema>;\n\n/* Ecosystems that are currently in beta */\nexport const BETA_ECOSYSTEMS: PackageEcosystem[] = [];\n\n/**\n * Represents the dependabot.yaml configuration file options.\n * See: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-dependabotyml\n */\nexport const DependabotConfigSchema = z\n  .object({\n    /**\n     * Mandatory. configuration file version.\n     **/\n    version: z.number().refine((v) => v === 2, { message: 'Only version 2 of dependabot is supported' }),\n\n    /**\n     * Optional. Configure groups of ecosystems to update together in a single pull request.\n     */\n    'multi-ecosystem-groups': z.record(z.string(), DependabotMultiEcosystemGroupSchema).optional(),\n\n    /**\n     * Mandatory. Configure how Dependabot updates the versions or project dependencies.\n     * Each entry configures the update settings for a particular package manager.\n     */\n    updates: DependabotUpdateSchema.array().check(\n      z.minLength(1, { message: 'At least one update configuration is required' }),\n    ),\n\n    /**\n     * Optional.\n     * Specify authentication details to access private package registries.\n     */\n    registries: z.record(z.string(), DependabotRegistrySchema).optional(),\n\n    /**\n     * Optional. Enables updates for ecosystems that are not yet generally available.\n     * https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#enable-beta-ecosystems-\n     */\n    'enable-beta-ecosystems': z.boolean().optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // If you attempt to set group-only keys at the ecosystem level (in updates entries),\n    // Dependabot will throw a configuration error and fail to process your dependabot.yml file.\n    // These keys must only be specified in the multi-ecosystem-groups section.\n    // https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates#group-only-keys\n    const groupOnlyKeys = ['milestone', 'target-branch', 'commit-message', 'pull-request-branch-name'] as const;\n    if (value['multi-ecosystem-groups']) {\n      for (const update of value.updates) {\n        for (const key of groupOnlyKeys) {\n          if (key in update) {\n            addIssue(\n              `The '${key}' field must not be specified in the 'updates' section when using 'multi-ecosystem-groups'. It is a group-only field.`,\n            );\n          }\n        }\n      }\n    }\n\n    // ensure there is no update with the same package-ecosystem and directory/directories combination\n    const seen = new Set<string>();\n    for (const update of value.updates) {\n      const key = makeDirectoryKey(update);\n      if (seen.has(key)) {\n        addIssue(\n          `Duplicate update configuration found for '${update['package-ecosystem']}' and directory: '${update.directory ?? update.directories?.join(',')}'`,\n        );\n      }\n      seen.add(key);\n    }\n\n    // ensure that the ecosystems in beta are only used when 'enable-beta-ecosystems' is true\n    if (!value['enable-beta-ecosystems']) {\n      for (const update of value.updates) {\n        if (BETA_ECOSYSTEMS.includes(update['package-ecosystem'])) {\n          addIssue(\n            `The package ecosystem '${update['package-ecosystem']}' is currently in beta. To use it, set 'enable-beta-ecosystems' to true in the dependabot configuration.`,\n          );\n        }\n      }\n    }\n\n    return value;\n  });\n\nexport type DependabotConfig = z.infer<typeof DependabotConfigSchema>;\n\nexport function parseUpdates(config: DependabotConfig, configPath: string): DependabotUpdate[] {\n  const updates: DependabotUpdate[] = [];\n\n  // Parse the value of each of the updates obtained from the file\n  for (const update of config.updates) {\n    // populate the 'ignore' conditions 'source' and 'updated-at' properties, if missing\n    // NOTE: 'source' and 'updated-at' are not documented in the dependabot.yml config docs, but are defined in the dependabot-core and dependabot-cli models.\n    //       Currently they don't appear to add much value to the update process, but are populated here for completeness.\n    if (update.ignore) {\n      for (const condition of update.ignore) {\n        condition.source ??= configPath;\n        // we don't know the last updated time, so we use the current time\n        condition['updated-at'] ??= new Date().toISOString();\n      }\n    }\n\n    updates.push(update);\n  }\n  return updates;\n}\n\nexport async function parseRegistries(\n  config: DependabotConfig,\n  variableFinder: VariableFinderFn,\n): Promise<Record<string, DependabotRegistry>> {\n  // Parse the value of each of the registries obtained from the config\n  const registries: Record<string, DependabotRegistry> = {};\n  for (const [key, registry] of Object.entries(config.registries || {})) {\n    const updated = { ...registry };\n    const { type } = updated;\n\n    // handle special fields for 'hex-organization' types\n    if (type === 'hex_organization' && !updated.organization) {\n      throw new Error(`The value 'organization' in dependency registry config '${type}' is missing`);\n    }\n\n    // handle special fields for 'hex-repository' types\n    if (type === 'hex_repository' && !updated.repo) {\n      throw new Error(`The value 'repo' in dependency registry config '${key}' is missing`);\n    }\n\n    // parse username, password, key, and token while replacing tokens where necessary\n    updated.username = await convertPlaceholder({ input: updated.username, variableFinder: variableFinder });\n    updated.password = await convertPlaceholder({ input: updated.password, variableFinder: variableFinder });\n    updated.key = await convertPlaceholder({ input: updated.key, variableFinder: variableFinder });\n    updated.token = await convertPlaceholder({ input: updated.token, variableFinder: variableFinder });\n\n    // TODO: include sources for this logic, otherwise it looks like magic.\n    // Initially, this was based on reading through the dependabot-core logic\n    // but much has since changed.\n\n    // parse the url\n    const url = updated.url;\n    if (!url && type !== 'hex_organization') {\n      throw new Error(`The value 'url' in dependency registry config '${key}' is missing`);\n    }\n    if (url) {\n      /*\n       * Some credentials do not use the 'url' property in the Ruby updater.\n       * The 'host' and 'registry' properties are derived from the given URL.\n       * The 'registry' property is derived from the 'url' by stripping off the scheme.\n       * The 'host' property is derived from the hostname of the 'url'.\n       *\n       * 'npm_registry' and 'docker_registry' use 'registry' only.\n       * 'terraform_registry' uses 'host' only.\n       * 'composer_repository' uses both 'url' and 'host'.\n       * 'python_index' uses 'index-url' instead of 'url'.\n       */\n\n      if (URL.canParse(url)) {\n        const parsedUrl = new URL(url);\n\n        const addRegistry = type === 'docker_registry' || type === 'npm_registry';\n        if (addRegistry) updated.registry = url.replace('https://', '').replace('http://', '');\n\n        const addHost = type === 'composer_repository' || type === 'terraform_registry';\n        if (addHost) updated.host = parsedUrl.hostname;\n      }\n\n      if (type === 'python_index') updated['index-url'] = url;\n\n      const removeUrl =\n        type === 'docker_registry' ||\n        type === 'npm_registry' ||\n        type === 'terraform_registry' ||\n        type === 'python_index';\n      if (removeUrl) delete updated.url; // remove the url if not needed\n    }\n\n    // add to list\n    registries[key] = updated;\n  }\n  return registries;\n}\n\nexport function validateConfiguration(updates: DependabotUpdate[], registries: Record<string, DependabotRegistry>) {\n  const configured = Object.keys(registries);\n  const referenced: string[] = [];\n  for (const u of updates) referenced.push(...(u.registries ?? []));\n\n  // ensure there are no configured registries that have not been referenced\n  const missingConfiguration = referenced.filter((el) => !configured.includes(el));\n  if (missingConfiguration.length > 0) {\n    throw new Error(\n      `Referenced registries: '${missingConfiguration.join(',')}' have not been configured in the root of dependabot.yml`,\n    );\n  }\n\n  // ensure there are no registries referenced but not configured\n  const missingReferences = configured.filter((el) => !referenced.includes(el));\n  if (missingReferences.length > 0) {\n    throw new Error(`Registries: '${missingReferences.join(',')}' have not been referenced by any update`);\n  }\n}\n\n/** Possible paths to the dependabot config file for GitHub. */\nexport const CONFIG_FILE_NAMES = ['dependabot.yaml', 'dependabot.yml'];\nexport const CONFIG_FILE_PATHS_GITHUB = CONFIG_FILE_NAMES.map((name) => `.github/${name}`);\n/** Possible paths to the dependabot config file for Azure. */\nexport const CONFIG_FILE_PATHS_AZURE = [\n  ...CONFIG_FILE_NAMES.map((name) => `.azuredevops/${name}`),\n  ...CONFIG_FILE_PATHS_GITHUB,\n];\n\n/**\n * Parse the contents of a dependabot config YAML file\n * @returns {DependabotConfig} config - the dependabot configuration\n */\nexport async function parseDependabotConfig({\n  configContents,\n  configPath,\n  variableFinder,\n}: {\n  configContents: string;\n  configPath: string;\n  variableFinder: VariableFinderFn;\n}): Promise<DependabotConfig> {\n  // Load the config\n  const loadedConfig = yaml.load(configContents);\n  if (loadedConfig === null || typeof loadedConfig !== 'object') {\n    throw new Error('Invalid dependabot config object');\n  }\n\n  // Parse the config\n  const config = await DependabotConfigSchema.parseAsync(loadedConfig);\n  const updates = parseUpdates(config, configPath);\n  const registries = await parseRegistries(config, variableFinder);\n  validateConfiguration(updates, registries);\n\n  return { ...config, updates, registries };\n}\n","import { z } from 'zod';\nimport { DependabotCooldownSchema } from './config';\n\n// we use nullish() because it does optional() and allows the value to be set to null\n\nexport const DependabotCredentialSchema = z.record(z.string(), z.any());\nexport type DependabotCredential = z.infer<typeof DependabotCredentialSchema>;\n\nexport const CertificateAuthoritySchema = z.object({\n  cert: z.string(),\n  key: z.string(),\n});\nexport type CertificateAuthority = z.infer<typeof CertificateAuthoritySchema>;\n\nexport const DependabotProxyConfigSchema = z.object({\n  all_credentials: DependabotCredentialSchema.array(),\n  ca: CertificateAuthoritySchema,\n});\nexport type DependabotProxyConfig = z.infer<typeof DependabotProxyConfigSchema>;\n\nexport const DependabotSourceProviderSchema = z.enum(['azure', 'bitbucket', 'gitlab']);\nexport type DependabotSourceProvider = z.infer<typeof DependabotSourceProviderSchema>;\n\nexport const DependabotSourceSchema = z.object({\n  provider: DependabotSourceProviderSchema,\n  repo: z.string(),\n  directory: z.string().nullish(),\n  directories: z.string().array().nullish(),\n  branch: z.string().nullish(),\n  commit: z.string().nullish(),\n  hostname: z.string().nullish(), // Must be provided if api-endpoint is\n  'api-endpoint': z.string().nullish(), // Must be provided if hostname is\n});\nexport type DependabotSource = z.infer<typeof DependabotSourceSchema>;\n\nexport const DependabotExistingPRSchema = z.object({\n  'dependency-name': z.string(),\n  'dependency-version': z.string().nullish(),\n  directory: z.string().nullish(),\n  removed: z.boolean().nullish(),\n});\nexport type DependabotExistingPR = z.infer<typeof DependabotExistingPRSchema>;\n\nexport const DependabotExistingGroupPRSchema = z.object({\n  'dependency-group-name': z.string(),\n  dependencies: DependabotExistingPRSchema.array(),\n});\nexport type DependabotExistingGroupPR = z.infer<typeof DependabotExistingGroupPRSchema>;\n\nexport const DependabotAllowedSchema = z.object({\n  'dependency-name': z.string().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowed = z.infer<typeof DependabotAllowedSchema>;\n\nexport const DependabotGroupRuleJobSchema = z.object({\n  patterns: z.string().array().nullish(),\n  'exclude-patterns': z.string().array().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n});\nexport type DependabotGroupRuleJob = z.infer<typeof DependabotGroupRuleJobSchema>;\n\nexport const DependabotGroupJobSchema = z.object({\n  name: z.string(),\n  'applies-to': z.string().nullish(),\n  rules: DependabotGroupRuleJobSchema,\n});\nexport type DependabotGroupJob = z.infer<typeof DependabotGroupJobSchema>;\n\nexport const DependabotConditionSchema = z.object({\n  'dependency-name': z.string(),\n  source: z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n  'updated-at': z.coerce.string().nullish(),\n  'version-requirement': z.string().nullish(),\n});\nexport type DependabotCondition = z.infer<typeof DependabotConditionSchema>;\n\nexport const DependabotSecurityAdvisorySchema = z.object({\n  'dependency-name': z.string(),\n  'affected-versions': z.string().array(),\n  'patched-versions': z.string().array().nullish(), // may not be patched as of yet\n  'unaffected-versions': z.string().array(),\n});\nexport type DependabotSecurityAdvisory = z.infer<typeof DependabotSecurityAdvisorySchema>;\n\nexport const DependabotRequirementSourceSchema = z.record(z.string(), z.any());\nexport type DependabotRequirementSource = z.infer<typeof DependabotRequirementSourceSchema>;\n\nexport const DependabotRequirementSchema = z.object({\n  file: z.string().nullish(), // e.g. 'requirements.txt' or '/Root.csproj'\n  groups: z.string().array().nullish(), // e.g. ['dependencies']\n  metadata: z.record(z.string(), z.any()).nullish(),\n  requirement: z.string().nullish(), // e.g. '==3.2.0' or '8.1.0'\n  source: DependabotRequirementSourceSchema.nullish(),\n  version: z.string().nullish(),\n  'previous-version': z.string().nullish(),\n});\nexport type DependabotRequirement = z.infer<typeof DependabotRequirementSchema>;\n\nexport const DependabotDependencySchema = z.object({\n  name: z.string(), // e.g. 'django' or 'GraphQL.Server.Ui.Voyager'\n  'previous-requirements': DependabotRequirementSchema.array().nullish(),\n  'previous-version': z.string().nullish(),\n  version: z.string().nullish(), // e.g. '5.0.1' or '8.1.0'\n  requirements: DependabotRequirementSchema.array().nullish(),\n  removed: z.boolean().nullish(),\n  directory: z.string().nullish(),\n});\nexport type DependabotDependency = z.infer<typeof DependabotDependencySchema>;\n\nexport const DependabotCommitOptionsSchema = z.object({\n  prefix: z.string().nullish(),\n  'prefix-development': z.string().nullish(),\n  'include-scope': z.boolean().nullish(),\n});\nexport type DependabotCommitOptions = z.infer<typeof DependabotCommitOptionsSchema>;\n\nexport const DependabotExperimentsSchema = z.record(z.string(), z.union([z.string(), z.boolean()]));\nexport type DependabotExperiments = z.infer<typeof DependabotExperimentsSchema>;\n\nexport const DependabotPackageManagerSchema = z.enum([\n  'bundler',\n  'cargo',\n  'composer',\n  'conda',\n  'pub',\n  'docker',\n  'elm',\n  'github_actions', // ecosystem(s): 'github-actions'\n  'submodules', // ecosystem(s): 'gitsubmodule'\n  'go_modules', // ecosystem(s): 'gomod'\n  'gradle',\n  'maven',\n  'hex', // ecosystem(s): 'mix'\n  'nuget',\n  'npm_and_yarn', // ecosystem(s): 'npm', 'pnpm', 'yarn'\n  'pip', // ecosystem(s): 'pipenv', 'pip-compile', 'poetry'\n  'rust_toolchain', // ecosystem(s): 'rust-toolchain'\n  'swift',\n  'terraform',\n  'devcontainers',\n  'dotnet_sdk', // ecosystem(s): 'dotnet-sdk'\n  'bun',\n  'docker_compose', //  // ecosystem(s): 'docker-compose',\n  'uv',\n  'vcpkg',\n  'helm',\n  'julia',\n  'bazel',\n  'opentofu',\n]);\nexport type DependabotPackageManager = z.infer<typeof DependabotPackageManagerSchema>;\n\nexport const DEPENDABOT_COMMANDS = ['graph', 'version', 'recreate'] as const;\nexport const DependabotCommandSchema = z.enum(DEPENDABOT_COMMANDS);\nexport type DependabotCommand = z.infer<typeof DependabotCommandSchema>;\n\n// See: https://github.com/dependabot/cli/blob/main/internal/model/job.go\n//      https://github.com/dependabot/dependabot-core/blob/main/updater/lib/dependabot/job.rb\nexport const DependabotJobConfigSchema = z.object({\n  id: z.string(),\n  command: DependabotCommandSchema.optional(),\n  'package-manager': DependabotPackageManagerSchema,\n  'allowed-updates': DependabotAllowedSchema.array(),\n  debug: z.boolean().nullable(),\n  'dependency-groups': DependabotGroupJobSchema.array().nullish(),\n  dependencies: z.string().array().nullable(),\n  'dependency-group-to-refresh': z.string().nullish(),\n  'existing-pull-requests': DependabotExistingPRSchema.array().array(),\n  'existing-group-pull-requests': DependabotExistingGroupPRSchema.array(),\n  experiments: DependabotExperimentsSchema,\n  'ignore-conditions': DependabotConditionSchema.array(),\n  'lockfile-only': z.boolean(),\n  'requirements-update-strategy': z.string().nullable(),\n  'security-advisories': DependabotSecurityAdvisorySchema.array(),\n  'security-updates-only': z.boolean(),\n  source: DependabotSourceSchema,\n  'update-subdependencies': z.boolean(),\n  'updating-a-pull-request': z.boolean(),\n  'vendor-dependencies': z.boolean(),\n  'reject-external-code': z.boolean().nullish(),\n  'repo-private': z.boolean(),\n  'commit-message-options': DependabotCommitOptionsSchema,\n  'credentials-metadata': DependabotCredentialSchema.array().nullish(),\n  'max-updater-run-time': z.int().nullish(),\n  cooldown: DependabotCooldownSchema.nullish(),\n  'proxy-log-response-body-on-auth-failure': z.boolean().nullish(),\n  'enable-beta-ecosystems': z.boolean().nullish(),\n  'multi-ecosystem-update': z.boolean().nullish(),\n  'exclude-paths': z.string().array().optional(),\n});\nexport type DependabotJobConfig = z.infer<typeof DependabotJobConfigSchema>;\n\nexport const DependabotJobFileSchema = z.object({\n  job: DependabotJobConfigSchema,\n});\nexport type DependabotJobFile = z.infer<typeof DependabotJobFileSchema>;\n\n// Code below is borrowed and adapted from dependabot-action\n\n// biome-ignore-start lint/suspicious/noExplicitAny: generic\nexport type FetchedFiles = {\n  base_commit_sha: string;\n  dependency_files: any[];\n  base64_dependency_files: any[];\n};\n// biome-ignore-end lint/suspicious/noExplicitAny: generic\n\nexport type FileFetcherInput = {\n  job: DependabotJobConfig;\n};\n\nexport type FileUpdaterInput = FetchedFiles & {\n  job: DependabotJobConfig;\n};\n\nexport const DependabotPersistedPrSchema = DependabotExistingPRSchema.array().or(DependabotExistingGroupPRSchema);\nexport type DependabotPersistedPr = z.infer<typeof DependabotPersistedPrSchema>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,SAAgB,iBAAiB,SAA0C;AAOzE,QAAO,GALW,eAAe,UAAU,QAAQ,YAAY,QAAQ,qBAKnD,IAFE,QAAQ,aAAa,QAAQ,YAAa,KAAK,IAAI;;;;;AC3D3E,eAAe,mBAAmB,EAChC,OACA,kBAI8B;AAC9B,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAMA,UAA6B,mBAAmB,MAAM;CAC5D,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,cAAc,MAAM;EAC1B,MAAM,OAAO,MAAM;EACnB,MAAM,QAAS,MAAM,eAAe,KAAK,IAAK;AAC9C,WAAS,OAAO,QAAQ,aAAa,MAAM;;AAE7C,QAAO;;AAGT,SAAS,mBAAmB,OAAe;CACzC,MAAMA,UAA6B,EAAE;CACrC,MAAMC,SAAiB;CAEvB,IAAI,cAAc;CAClB,IAAI,SAAS;AAEb,QAAO,YAAY,SAAS,GAAG;EAC7B,MAAM,QAAQ,YAAY,MAAM,OAAO;AACvC,MAAI,CAAC,SAAS,MAAM,UAAU,OAAW;EAGzC,MAAM,gBAAgB,OAAO,OAAO,CAAC,GAAG,MAAM,EAAE;GAC9C,OAAO,MAAM,QAAQ;GACd;GACP,QAAQ,MAAM;GACf,CAAC;AAEF,UAAQ,KAAK,cAAc;EAG3B,MAAM,YAAY,MAAM,QAAQ,MAAM,GAAG;AACzC,YAAU;AACV,gBAAc,YAAY,MAAM,UAAU;;AAG5C,QAAO;;;;;AC1CT,MAAa,2BAA2B,EACrC,OAAO;CACN,MAAM,EAAE,KAAK;EAIX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;CACF,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,iBAAiB,EAAE,SAAS,CAAC,UAAU;CACvC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,cAAc,EAAE,QAAQ,CAAC,UAAU;CACnC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,0BAA0B,EAAE,QAAQ,CAAC,UAAU;CAC/C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,aAAa,EAAE,QAAQ,CAAC,UAAU;CACnC,CAAC,CAED,WAAW,WAAW;CAAE,GAAG;CAAO,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;CAAE,EAAE;AAG3E,MAAa,wBAAwB,EAAE,OAAO;CAG5C,YAAY,EACT,QAAQ,CACR,MACC,EAAE,MAAM,qCAAqC,EAC3C,SACE,qHACH,CAAC,CACH,CACA,UAAU;CACb,cAAc,EAAE,KAAK,CAAC,mBAAmB,mBAAmB,CAAC,CAAC,UAAU;CACxE,mBAAmB,EAAE,KAAK,CAAC,eAAe,aAAa,CAAC,CAAC,UAAU;CACnE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACjD,gBAAgB,EAAE,KAAK;EAAC;EAAS;EAAS;EAAQ,CAAC,CAAC,OAAO,CAAC,UAAU;CACvE,CAAC;AAGF,MAAa,iCAAiC,EAAE,OAAO;CACrD,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,mBAAmB,EAAE,KAAK;EAAC;EAAU;EAAY;EAAO;EAAc;EAAc,CAAC,CAAC,UAAU;CAChG,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,kCAAkC,EAC5C,OAAO;CACN,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,UAAU;CACtD,gBAAgB,EACb,KAAK;EAAC;EAA+B;EAA+B;EAA8B,CAAC,CACnG,OAAO,CACP,UAAU;CACd,CAAC,CACD,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAGrC,MAAa,2BAA2B,EACrC,OAAO;CACN,UAAU,EAAE,KAAK;EAAC;EAAS;EAAU;EAAW;EAAa;EAAgB;EAAU;EAAO,CAAC;CAE/F,KAAK,EACF,KAAK;EAAC;EAAU;EAAU;EAAW;EAAa;EAAY;EAAU;EAAW,CAAC,CACpF,UAAU,CACV,QAAQ,SAAS;CAEpB,MAAM,EACH,QAAQ,CACR,QAAQ,QAAQ,CAChB,MAAM,EAAE,MAAM,uCAAuC,EAAE,SAAS,gCAAgC,CAAC,CAAC,CAClG,UAAU;CAEb,UAAU,EACP,QAAQ,CACR,UAAU,CACV,QAAQ,UAAU,CAClB,QACE,UAAU;AACT,MAAI;AAEF,QAAK,eAAe,QAAW,EAAE,UAAU,OAAO,CAAC;AACnD,UAAO;UACD;AACN,UAAO;;IAGX,EAAE,SAAS,0BAA0B,CACtC;CACH,SAAS,EACN,QAAQ,CACR,MAAM,EAAE,MAAM,yBAAyB,EAAE,SAAS,2CAA2C,CAAC,CAAC,CAC/F,UAAU;CACd,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;AAElC,KAAI,MAAM,aAAa,UAAU,CAAC,MAAM,QACtC,UAAS,4EAA4E;AAGvF,QAAO;EACP;AAGJ,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,UAAU;CAC3C,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC/B,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,gBAAgB,EAAE,QAAQ,CAAC,UAAU;CACrC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACtC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,CAAC;AAGF,MAAM,wCAAwC,EAAE,OAAO,EACrD,WAAW,EAAE,QAAQ,CAAC,UAAU,EACjC,CAAC;AAGF,MAAa,yBAAyB,EAAE,KAAK;CAI3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,2BAA2B,EAAE,KAAK;CAAC;CAAQ;CAAY;CAAyB;CAAiB;CAAQ,CAAC;AAGvH,MAAa,yBAAyB,EACnC,OAAO;CACN,qBAAqB;CACrB,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC1C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC9C,OAAO,+BAA+B,OAAO,CAAC,UAAU;CACxD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACxC,kBAAkB,8BAA8B,UAAU;CAC1D,UAAU,yBAAyB,UAAU;CAC7C,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;CAC9D,QAAQ,gCAAgC,OAAO,CAAC,UAAU;CAC1D,oCAAoC,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,CAAC,UAAU;CACxE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACrC,WAAW,EAAE,OAAO,QAAQ,CAAC,UAAU;CACvC,4BAA4B,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU;CAC1E,4BAA4B,sCAAsC,UAAU;CAC5E,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACzC,UAAU;CACV,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACtC,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,uBAAuB,yBAAyB,UAAU;CAC1D,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,yBAAyB,EAAE,QAAQ,CAAC,UAAU;CAC/C,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;AAElC,KAAI,CAAC,MAAM,cAAc,CAAC,MAAM,eAAe,MAAM,YAAY,WAAW,GAC1E,UAAS,gGAAgG;AAI3G,KAAI,MAAM,aAAa,YAAY,KAAK,MAAM,UAAU,CACtD,UAAS,uDAAuD;AAGlE,OAAM,gCAAgC;AAKtC,KAAI,MAAM,6BAA6B,CAAC,MAAM,YAAY,MAAM,SAAS,WAAW,GAClF,UACE,8GACD;AAGH,QAAO;EACP;AAGJ,MAAa,sCAAsC,EAAE,OAAO;CAC1D,UAAU;CACV,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACrC,WAAW,EAAE,OAAO,QAAQ,CAAC,UAAU;CACvC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACxC,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACtC,kBAAkB,8BAA8B,UAAU;CAC1D,4BAA4B,sCAAsC,UAAU;CAC7E,CAAC;AAIF,MAAaC,kBAAsC,EAAE;;;;;AAMrD,MAAa,yBAAyB,EACnC,OAAO;CAIN,SAAS,EAAE,QAAQ,CAAC,QAAQ,MAAM,MAAM,GAAG,EAAE,SAAS,6CAA6C,CAAC;CAKpG,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE,oCAAoC,CAAC,UAAU;CAM9F,SAAS,uBAAuB,OAAO,CAAC,MACtC,EAAE,UAAU,GAAG,EAAE,SAAS,iDAAiD,CAAC,CAC7E;CAMD,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,UAAU;CAMrE,0BAA0B,EAAE,SAAS,CAAC,UAAU;CACjD,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;CAKlC,MAAM,gBAAgB;EAAC;EAAa;EAAiB;EAAkB;EAA2B;AAClG,KAAI,MAAM,2BACR;OAAK,MAAM,UAAU,MAAM,QACzB,MAAK,MAAM,OAAO,cAChB,KAAI,OAAO,OACT,UACE,QAAQ,IAAI,uHACb;;CAOT,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,UAAU,MAAM,SAAS;EAClC,MAAM,MAAM,iBAAiB,OAAO;AACpC,MAAI,KAAK,IAAI,IAAI,CACf,UACE,6CAA6C,OAAO,qBAAqB,oBAAoB,OAAO,aAAa,OAAO,aAAa,KAAK,IAAI,CAAC,GAChJ;AAEH,OAAK,IAAI,IAAI;;AAIf,KAAI,CAAC,MAAM,2BACT;OAAK,MAAM,UAAU,MAAM,QACzB,KAAI,gBAAgB,SAAS,OAAO,qBAAqB,CACvD,UACE,0BAA0B,OAAO,qBAAqB,0GACvD;;AAKP,QAAO;EACP;AAIJ,SAAgB,aAAa,QAA0B,YAAwC;CAC7F,MAAMC,UAA8B,EAAE;AAGtC,MAAK,MAAM,UAAU,OAAO,SAAS;AAInC,MAAI,OAAO,OACT,MAAK,MAAM,aAAa,OAAO,QAAQ;AACrC,aAAU,WAAW;AAErB,aAAU,mCAAkB,IAAI,MAAM,EAAC,aAAa;;AAIxD,UAAQ,KAAK,OAAO;;AAEtB,QAAO;;AAGT,eAAsB,gBACpB,QACA,gBAC6C;CAE7C,MAAMC,aAAiD,EAAE;AACzD,MAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,OAAO,cAAc,EAAE,CAAC,EAAE;EACrE,MAAM,UAAU,EAAE,GAAG,UAAU;EAC/B,MAAM,EAAE,SAAS;AAGjB,MAAI,SAAS,sBAAsB,CAAC,QAAQ,aAC1C,OAAM,IAAI,MAAM,2DAA2D,KAAK,cAAc;AAIhG,MAAI,SAAS,oBAAoB,CAAC,QAAQ,KACxC,OAAM,IAAI,MAAM,mDAAmD,IAAI,cAAc;AAIvF,UAAQ,WAAW,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAA0B;GAAgB,CAAC;AACxG,UAAQ,WAAW,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAA0B;GAAgB,CAAC;AACxG,UAAQ,MAAM,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAAqB;GAAgB,CAAC;AAC9F,UAAQ,QAAQ,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAAuB;GAAgB,CAAC;EAOlG,MAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,OAAO,SAAS,mBACnB,OAAM,IAAI,MAAM,kDAAkD,IAAI,cAAc;AAEtF,MAAI,KAAK;AAaP,OAAI,IAAI,SAAS,IAAI,EAAE;IACrB,MAAM,YAAY,IAAI,IAAI,IAAI;AAG9B,QADoB,SAAS,qBAAqB,SAAS,eAC1C,SAAQ,WAAW,IAAI,QAAQ,YAAY,GAAG,CAAC,QAAQ,WAAW,GAAG;AAGtF,QADgB,SAAS,yBAAyB,SAAS,qBAC9C,SAAQ,OAAO,UAAU;;AAGxC,OAAI,SAAS,eAAgB,SAAQ,eAAe;AAOpD,OAJE,SAAS,qBACT,SAAS,kBACT,SAAS,wBACT,SAAS,eACI,QAAO,QAAQ;;AAIhC,aAAW,OAAO;;AAEpB,QAAO;;AAGT,SAAgB,sBAAsB,SAA6B,YAAgD;CACjH,MAAM,aAAa,OAAO,KAAK,WAAW;CAC1C,MAAMC,aAAuB,EAAE;AAC/B,MAAK,MAAM,KAAK,QAAS,YAAW,KAAK,GAAI,EAAE,cAAc,EAAE,CAAE;CAGjE,MAAM,uBAAuB,WAAW,QAAQ,OAAO,CAAC,WAAW,SAAS,GAAG,CAAC;AAChF,KAAI,qBAAqB,SAAS,EAChC,OAAM,IAAI,MACR,2BAA2B,qBAAqB,KAAK,IAAI,CAAC,0DAC3D;CAIH,MAAM,oBAAoB,WAAW,QAAQ,OAAO,CAAC,WAAW,SAAS,GAAG,CAAC;AAC7E,KAAI,kBAAkB,SAAS,EAC7B,OAAM,IAAI,MAAM,gBAAgB,kBAAkB,KAAK,IAAI,CAAC,0CAA0C;;;AAK1G,MAAa,oBAAoB,CAAC,mBAAmB,iBAAiB;AACtE,MAAa,2BAA2B,kBAAkB,KAAK,SAAS,WAAW,OAAO;;AAE1F,MAAa,0BAA0B,CACrC,GAAG,kBAAkB,KAAK,SAAS,gBAAgB,OAAO,EAC1D,GAAG,yBACJ;;;;;AAMD,eAAsB,sBAAsB,EAC1C,gBACA,YACA,kBAK4B;CAE5B,MAAM,eAAe,KAAK,KAAK,eAAe;AAC9C,KAAI,iBAAiB,QAAQ,OAAO,iBAAiB,SACnD,OAAM,IAAI,MAAM,mCAAmC;CAIrD,MAAM,SAAS,MAAM,uBAAuB,WAAW,aAAa;CACpE,MAAM,UAAU,aAAa,QAAQ,WAAW;CAChD,MAAM,aAAa,MAAM,gBAAgB,QAAQ,eAAe;AAChE,uBAAsB,SAAS,WAAW;AAE1C,QAAO;EAAE,GAAG;EAAQ;EAAS;EAAY;;;;;AC3e3C,MAAa,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAGvE,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO;CAClD,iBAAiB,2BAA2B,OAAO;CACnD,IAAI;CACL,CAAC;AAGF,MAAa,iCAAiC,EAAE,KAAK;CAAC;CAAS;CAAa;CAAS,CAAC;AAGtF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,UAAU;CACV,MAAM,EAAE,QAAQ;CAChB,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACzC,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;CACrC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,mBAAmB,EAAE,QAAQ;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;CAC/B,CAAC;AAGF,MAAa,kCAAkC,EAAE,OAAO;CACtD,yBAAyB,EAAE,QAAQ;CACnC,cAAc,2BAA2B,OAAO;CACjD,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO;CAC9C,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,+BAA+B,EAAE,OAAO;CACnD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACtC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC7C,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,MAAM,EAAE,QAAQ;CAChB,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,OAAO;CACR,CAAC;AAGF,MAAa,4BAA4B,EAAE,OAAO;CAChD,mBAAmB,EAAE,QAAQ;CAC7B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC5C,cAAc,EAAE,OAAO,QAAQ,CAAC,SAAS;CACzC,uBAAuB,EAAE,QAAQ,CAAC,SAAS;CAC5C,CAAC;AAGF,MAAa,mCAAmC,EAAE,OAAO;CACvD,mBAAmB,EAAE,QAAQ;CAC7B,qBAAqB,EAAE,QAAQ,CAAC,OAAO;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,uBAAuB,EAAE,QAAQ,CAAC,OAAO;CAC1C,CAAC;AAGF,MAAa,oCAAoC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAG9E,MAAa,8BAA8B,EAAE,OAAO;CAClD,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACpC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CACjD,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,QAAQ,kCAAkC,SAAS;CACnD,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACzC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,yBAAyB,4BAA4B,OAAO,CAAC,SAAS;CACtE,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,cAAc,4BAA4B,OAAO,CAAC,SAAS;CAC3D,SAAS,EAAE,SAAS,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ,CAAC,SAAS;CAChC,CAAC;AAGF,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,iBAAiB,EAAE,SAAS,CAAC,SAAS;CACvC,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAGnG,MAAa,iCAAiC,EAAE,KAAK;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,sBAAsB;CAAC;CAAS;CAAW;CAAW;AACnE,MAAa,0BAA0B,EAAE,KAAK,oBAAoB;AAKlE,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,QAAQ;CACd,SAAS,wBAAwB,UAAU;CAC3C,mBAAmB;CACnB,mBAAmB,wBAAwB,OAAO;CAClD,OAAO,EAAE,SAAS,CAAC,UAAU;CAC7B,qBAAqB,yBAAyB,OAAO,CAAC,SAAS;CAC/D,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC3C,+BAA+B,EAAE,QAAQ,CAAC,SAAS;CACnD,0BAA0B,2BAA2B,OAAO,CAAC,OAAO;CACpE,gCAAgC,gCAAgC,OAAO;CACvE,aAAa;CACb,qBAAqB,0BAA0B,OAAO;CACtD,iBAAiB,EAAE,SAAS;CAC5B,gCAAgC,EAAE,QAAQ,CAAC,UAAU;CACrD,uBAAuB,iCAAiC,OAAO;CAC/D,yBAAyB,EAAE,SAAS;CACpC,QAAQ;CACR,0BAA0B,EAAE,SAAS;CACrC,2BAA2B,EAAE,SAAS;CACtC,uBAAuB,EAAE,SAAS;CAClC,wBAAwB,EAAE,SAAS,CAAC,SAAS;CAC7C,gBAAgB,EAAE,SAAS;CAC3B,0BAA0B;CAC1B,wBAAwB,2BAA2B,OAAO,CAAC,SAAS;CACpE,wBAAwB,EAAE,KAAK,CAAC,SAAS;CACzC,UAAU,yBAAyB,SAAS;CAC5C,2CAA2C,EAAE,SAAS,CAAC,SAAS;CAChE,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC/C,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO,EAC9C,KAAK,2BACN,CAAC;AAqBF,MAAa,8BAA8B,2BAA2B,OAAO,CAAC,GAAG,gCAAgC"}
+{"version":3,"file":"job-ClEevC5P.mjs","names":[],"sources":["../src/dependabot/directory-key.ts","../src/dependabot/placeholder.ts","../src/dependabot/config.ts","../src/dependabot/job.ts"],"sourcesContent":["/**\n * Options for creating a directory key that supports both naming conventions:\n * - `ecosystem` (standard format)\n * - `package-ecosystem` (alternative format for compatibility)\n *\n * Either a single `directory` or multiple `directories` can be specified.\n */\ntype MakeDirectoryKeyOptions =\n  | {\n      /** The package ecosystem (e.g., 'npm', 'pip', 'bundler') */\n      ecosystem: string;\n      /** Single directory path (optional if directories is provided) */\n      directory?: string | null;\n      /** Multiple directory paths (optional if directory is provided) */\n      directories?: string[];\n    }\n  | {\n      /** The package ecosystem using alternative naming convention */\n      'package-ecosystem': string;\n      /** Single directory path (optional if directories is provided) */\n      directory?: string | null;\n      /** Multiple directory paths (optional if directory is provided) */\n      directories?: string[];\n    };\n\n/**\n * Creates a unique directory key by combining the ecosystem and directory information.\n *\n * The key format is: `{ecosystem}::{directory_info}`\n * - For single directory: `npm::/src/frontend`\n * - For multiple directories: `npm::/src/frontend,/src/backend`\n *\n * @param options - Configuration object containing ecosystem and directory information\n * @returns A unique string key in the format `{ecosystem}::{directories}`\n *\n * @example\n * ```typescript\n * // Single directory\n * const key1 = makeDirectoryKey({ ecosystem: 'npm', directory: '/src' });\n * // Returns: \"npm::/src\"\n *\n * // Multiple directories\n * const key2 = makeDirectoryKey({\n *   ecosystem: 'pip',\n *   directories: ['/backend', '/scripts']\n * });\n * // Returns: \"pip::/backend,/scripts\"\n *\n * // Using alternative naming convention\n * const key3 = makeDirectoryKey({\n *   'package-ecosystem': 'bundler',\n *   directory: '/app'\n * });\n * // Returns: \"bundler::/app\"\n * ```\n */\nexport function makeDirectoryKey(options: MakeDirectoryKeyOptions): string {\n  // Extract ecosystem name from either naming convention\n  const ecosystem = 'ecosystem' in options ? options.ecosystem : options['package-ecosystem'];\n\n  // Use single directory if provided, otherwise join multiple directories with comma\n  const directoryPart = options.directory ?? options.directories!.join(',');\n\n  return `${ecosystem}::${directoryPart}`;\n}\n","export type VariableFinderFn = (name: string) => string | undefined | Promise<string | undefined>;\n\nasync function convertPlaceholder({\n  input,\n  variableFinder,\n}: {\n  input?: string;\n  variableFinder: VariableFinderFn;\n}): Promise<string | undefined> {\n  if (!input) return undefined;\n\n  const matches: RegExpExecArray[] = extractPlaceholder(input);\n  let result = input;\n  for (const match of matches) {\n    const placeholder = match[0];\n    const name = match[1]!;\n    const value = (await variableFinder(name)) ?? placeholder;\n    result = result.replace(placeholder, value);\n  }\n  return result;\n}\n\nfunction extractPlaceholder(input: string) {\n  const matches: RegExpExecArray[] = [];\n  const regexp: RegExp = /\\$\\{\\{\\s{0,10}([a-zA-Z_][a-zA-Z0-9._-]{0,99})\\s{0,10}\\}\\}/;\n\n  let searchInput = input;\n  let offset = 0;\n\n  while (searchInput.length > 0) {\n    const match = searchInput.match(regexp);\n    if (!match || match.index === undefined) break;\n\n    // Adjust match index to account for previous slices\n    const adjustedMatch = Object.assign([...match], {\n      index: match.index + offset,\n      input: input,\n      groups: match.groups,\n    }) as RegExpExecArray;\n\n    matches.push(adjustedMatch);\n\n    // Move past this match\n    const nextStart = match.index + match[0].length;\n    offset += nextStart;\n    searchInput = searchInput.slice(nextStart);\n  }\n\n  return matches;\n}\n\nexport { convertPlaceholder, extractPlaceholder };\n","import * as yaml from 'js-yaml';\nimport { z } from 'zod';\n\nimport { makeDirectoryKey } from './directory-key';\nimport { convertPlaceholder, type VariableFinderFn } from './placeholder';\n\nexport const DependabotRegistrySchema = z\n  .object({\n    type: z.enum([\n      // order matches\n      // https://docs.github.com/en/enterprise-cloud@latest/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#supported-private-registries\n\n      'cargo-registry',\n      'composer-repository',\n      'docker-registry',\n      'git',\n      'goproxy-server',\n      'helm-registry',\n      'hex-organization',\n      'hex-repository',\n      'maven-repository',\n      'npm-registry',\n      'nuget-feed',\n      'pub-repository',\n      'python-index',\n      'rubygems-server',\n      'terraform-registry',\n    ]),\n    url: z.string().optional(),\n    username: z.string().optional(),\n    password: z.string().optional(),\n    key: z.string().optional(),\n    token: z.string().optional(),\n    'replaces-base': z.boolean().optional(),\n    host: z.string().optional(), // for terraform and composer only\n    registry: z.string().optional(), // for npm only\n    organization: z.string().optional(), // for hex-organization only\n    repo: z.string().optional(), // for hex-repository only\n    'public-key-fingerprint': z.string().optional(), // for hex-repository only\n    'index-url': z.string().optional(), // for python-index only\n    'auth-key': z.string().optional(), // used by composer-repository, docker-registry, etc\n    'tenant-id': z.string().optional(), // can only be for azure related stuff, not sure\n    'client-id': z.string().optional(), // can only be for azure related stuff, not sure\n  })\n  // change underscore to dash in the registry key/type\n  .transform((value) => ({ ...value, type: value.type.replace('-', '_') }));\nexport type DependabotRegistry = z.infer<typeof DependabotRegistrySchema>;\n\nexport const DependabotGroupSchema = z.object({\n  // Define an identifier for the group to use in branch names and pull request titles.\n  // This must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.\n  IDENTIFIER: z\n    .string()\n    .check(\n      z.regex(/^[a-zA-Z][a-zA-Z0-9|_-]*[a-zA-Z]$/, {\n        message:\n          'Group identifier must start and end with a letter, and can contain letters, pipes |, underscores _, or hyphens -.',\n      }),\n    )\n    .optional(),\n  'applies-to': z.enum(['version-updates', 'security-updates']).optional(),\n  'dependency-type': z.enum(['development', 'production']).optional(),\n  patterns: z.string().array().optional(),\n  'exclude-patterns': z.string().array().optional(),\n  'update-types': z.enum(['major', 'minor', 'patch']).array().optional(),\n});\nexport type DependabotGroup = z.infer<typeof DependabotGroupSchema>;\n\nexport const DependabotAllowConditionSchema = z.object({\n  'dependency-name': z.string().optional(),\n  'dependency-type': z.enum(['direct', 'indirect', 'all', 'production', 'development']).optional(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowCondition = z.infer<typeof DependabotAllowConditionSchema>;\n\nexport const DependabotIgnoreConditionSchema = z\n  .object({\n    'dependency-name': z.string().optional(),\n    versions: z.string().array().or(z.string()).optional(),\n    'update-types': z\n      .enum(['version-update:semver-major', 'version-update:semver-minor', 'version-update:semver-patch'])\n      .array()\n      .optional(),\n  })\n  .and(z.record(z.string(), z.any()));\nexport type DependabotIgnoreCondition = z.infer<typeof DependabotIgnoreConditionSchema>;\n\nexport const DependabotScheduleSchema = z\n  .object({\n    interval: z.enum(['daily', 'weekly', 'monthly', 'quarterly', 'semiannually', 'yearly', 'cron']),\n\n    day: z\n      .enum(['sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'])\n      .optional()\n      .default('monday'),\n\n    time: z\n      .string()\n      .default('02:00')\n      .check(z.regex(/^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$/, { message: 'Time must be in HH:MM format' }))\n      .optional(),\n\n    timezone: z\n      .string()\n      .optional()\n      .default('Etc/UTC')\n      .refine(\n        (value) => {\n          try {\n            // If tz is not a valid IANA name, this throws a RangeError\n            Intl.DateTimeFormat(undefined, { timeZone: value });\n            return true;\n          } catch {\n            return false;\n          }\n        },\n        { message: 'Invalid IANA time zone' },\n      ),\n    cronjob: z\n      .string()\n      .check(z.regex(/^\\S+ \\S+ \\S+ \\S+ \\S+$/, { message: 'Cronjob must be in standard cron format' }))\n      .optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // if interval is 'cron', cronjob must be specified\n    if (value.interval === 'cron' && !value.cronjob) {\n      addIssue(\"The 'cronjob' field must be specified when the interval is set to 'cron'.\");\n    }\n\n    return value;\n  });\nexport type DependabotSchedule = z.infer<typeof DependabotScheduleSchema>;\n\nexport const DependabotCommitMessageSchema = z.object({\n  prefix: z.string().optional(),\n  'prefix-development': z.string().optional(),\n  include: z.string().optional(),\n});\nexport type DependabotCommitMessage = z.infer<typeof DependabotCommitMessageSchema>;\n\nexport const DependabotCooldownSchema = z.object({\n  'default-days': z.number().optional(),\n  'semver-major-days': z.number().optional(),\n  'semver-minor-days': z.number().optional(),\n  'semver-patch-days': z.number().optional(),\n  include: z.string().array().optional(),\n  exclude: z.string().array().optional(),\n});\nexport type DependabotCooldown = z.infer<typeof DependabotCooldownSchema>;\n\nconst DependabotPullRequestBranchNameSchema = z.object({\n  separator: z.string().optional(),\n});\nexport type DependabotPullRequestBranchName = z.infer<typeof DependabotPullRequestBranchNameSchema>;\n\nexport const PackageEcosystemSchema = z.enum([\n  // order matches\n  // https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-\n\n  'bazel',\n  'bun',\n  'bundler',\n  'cargo',\n  'composer',\n  'conda',\n  'devcontainers',\n  'docker',\n  'docker-compose',\n  'dotnet-sdk',\n  'helm',\n  'mix',\n  'elm',\n  'gitsubmodule',\n  'github-actions',\n  'gomod',\n  'gradle',\n  'julia',\n  'maven',\n  'npm',\n  'nuget',\n  'opentofu',\n  'pip',\n  'pip-compile', // alias mapped to 'pip'\n  'pipenv', // alias mapped to 'pip'\n  'pnpm', // alias mapped to 'npm'\n  'poetry', // alias mapped to 'pip'\n  'pub',\n  'rust-toolchain',\n  'swift',\n  'terraform',\n  'uv',\n  'vcpkg',\n  'yarn', // alias mapped to 'npm'\n]);\nexport type PackageEcosystem = z.infer<typeof PackageEcosystemSchema>;\n\nexport const VersioningStrategySchema = z.enum(['auto', 'increase', 'increase-if-necessary', 'lockfile-only', 'widen']);\nexport type VersioningStrategy = z.infer<typeof VersioningStrategySchema>;\n\nexport const DependabotUpdateSchema = z\n  .object({\n    'package-ecosystem': PackageEcosystemSchema,\n    directory: z.string().optional(),\n    directories: z.string().array().optional(),\n    'exclude-paths': z.string().array().optional(),\n    allow: DependabotAllowConditionSchema.array().optional(),\n    assignees: z.string().array().optional(),\n    'commit-message': DependabotCommitMessageSchema.optional(),\n    cooldown: DependabotCooldownSchema.optional(),\n    groups: z.record(z.string(), DependabotGroupSchema).optional(),\n    ignore: DependabotIgnoreConditionSchema.array().optional(),\n    'insecure-external-code-execution': z.enum(['allow', 'deny']).optional(),\n    labels: z.string().array().optional(),\n    milestone: z.coerce.string().optional(),\n    'open-pull-requests-limit': z.number().check(z.int(), z.gte(0)).optional(),\n    'pull-request-branch-name': DependabotPullRequestBranchNameSchema.optional(),\n    'rebase-strategy': z.string().optional(),\n    registries: z.string().array().optional(),\n    schedule: DependabotScheduleSchema,\n    'target-branch': z.string().optional(),\n    vendor: z.boolean().optional(),\n    'versioning-strategy': VersioningStrategySchema.optional(),\n    patterns: z.string().array().optional(),\n    'multi-ecosystem-group': z.string().optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // either 'directory' or 'directories' must be specified\n    if (!value.directory && (!value.directories || value.directories.length === 0)) {\n      addIssue(\"Either 'directory' or 'directories' must be specified in the dependency update configuration.\");\n    }\n\n    // validate that 'directory' does not contain glob patterns\n    if (value.directory && /[*?[\\]{}]/.test(value.directory)) {\n      addIssue(\"The 'directory' field must not include glob pattern.\");\n    }\n\n    value['open-pull-requests-limit'] ??= 5; // default to 5 if not specified\n\n    // The patterns key is required when using multi-ecosystem-group.\n    // You can specify dependency patterns to include only certain dependencies in the group,\n    // or use [\"*\"] to include all dependencies.\n    if (value['multi-ecosystem-group'] && (!value.patterns || value.patterns.length === 0)) {\n      addIssue(\n        \"The 'patterns' field must be specified and contain at least one pattern when using 'multi-ecosystem-group'.\",\n      );\n    }\n\n    return value;\n  });\nexport type DependabotUpdate = z.infer<typeof DependabotUpdateSchema>;\n\nexport const DependabotMultiEcosystemGroupSchema = z.object({\n  schedule: DependabotScheduleSchema,\n  labels: z.string().array().optional(), // behaviour: additive\n  milestone: z.coerce.string().optional(), // behaviour: group-only\n  assignees: z.string().array().optional(), // behaviour: additive\n  'target-branch': z.string().optional(), // behaviour: group-only\n  'commit-message': DependabotCommitMessageSchema.optional(), // behaviour: group-only\n  'pull-request-branch-name': DependabotPullRequestBranchNameSchema.optional(), // behaviour: group-only\n});\nexport type DependabotMultiEcosystemGroup = z.infer<typeof DependabotMultiEcosystemGroupSchema>;\n\n/* Ecosystems that are currently in beta */\nexport const BETA_ECOSYSTEMS: PackageEcosystem[] = [];\n\n/**\n * Represents the dependabot.yaml configuration file options.\n * See: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-dependabotyml\n */\nexport const DependabotConfigSchema = z\n  .object({\n    /**\n     * Mandatory. configuration file version.\n     **/\n    version: z.number().refine((v) => v === 2, { message: 'Only version 2 of dependabot is supported' }),\n\n    /**\n     * Optional. Configure groups of ecosystems to update together in a single pull request.\n     */\n    'multi-ecosystem-groups': z.record(z.string(), DependabotMultiEcosystemGroupSchema).optional(),\n\n    /**\n     * Mandatory. Configure how Dependabot updates the versions or project dependencies.\n     * Each entry configures the update settings for a particular package manager.\n     */\n    updates: DependabotUpdateSchema.array().check(\n      z.minLength(1, { message: 'At least one update configuration is required' }),\n    ),\n\n    /**\n     * Optional.\n     * Specify authentication details to access private package registries.\n     */\n    registries: z.record(z.string(), DependabotRegistrySchema).optional(),\n\n    /**\n     * Optional. Enables updates for ecosystems that are not yet generally available.\n     * https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#enable-beta-ecosystems-\n     */\n    'enable-beta-ecosystems': z.boolean().optional(),\n  })\n  .transform((value, { addIssue }) => {\n    // If you attempt to set group-only keys at the ecosystem level (in updates entries),\n    // Dependabot will throw a configuration error and fail to process your dependabot.yml file.\n    // These keys must only be specified in the multi-ecosystem-groups section.\n    // https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-multi-ecosystem-updates#group-only-keys\n    const groupOnlyKeys = ['milestone', 'target-branch', 'commit-message', 'pull-request-branch-name'] as const;\n    if (value['multi-ecosystem-groups']) {\n      for (const update of value.updates) {\n        for (const key of groupOnlyKeys) {\n          if (key in update) {\n            addIssue(\n              `The '${key}' field must not be specified in the 'updates' section when using 'multi-ecosystem-groups'. It is a group-only field.`,\n            );\n          }\n        }\n      }\n    }\n\n    // ensure there is no update with the same package-ecosystem and directory/directories combination\n    const seen = new Set<string>();\n    for (const update of value.updates) {\n      const key = makeDirectoryKey(update);\n      if (seen.has(key)) {\n        addIssue(\n          `Duplicate update configuration found for '${update['package-ecosystem']}' and directory: '${update.directory ?? update.directories?.join(',')}'`,\n        );\n      }\n      seen.add(key);\n    }\n\n    // ensure that the ecosystems in beta are only used when 'enable-beta-ecosystems' is true\n    if (!value['enable-beta-ecosystems']) {\n      for (const update of value.updates) {\n        if (BETA_ECOSYSTEMS.includes(update['package-ecosystem'])) {\n          addIssue(\n            `The package ecosystem '${update['package-ecosystem']}' is currently in beta. To use it, set 'enable-beta-ecosystems' to true in the dependabot configuration.`,\n          );\n        }\n      }\n    }\n\n    return value;\n  });\n\nexport type DependabotConfig = z.infer<typeof DependabotConfigSchema>;\n\nexport function parseUpdates(config: DependabotConfig, configPath: string): DependabotUpdate[] {\n  const updates: DependabotUpdate[] = [];\n\n  // Parse the value of each of the updates obtained from the file\n  for (const update of config.updates) {\n    // populate the 'ignore' conditions 'source' and 'updated-at' properties, if missing\n    // NOTE: 'source' and 'updated-at' are not documented in the dependabot.yml config docs, but are defined in the dependabot-core and dependabot-cli models.\n    //       Currently they don't appear to add much value to the update process, but are populated here for completeness.\n    if (update.ignore) {\n      for (const condition of update.ignore) {\n        condition.source ??= configPath;\n        // we don't know the last updated time, so we use the current time\n        condition['updated-at'] ??= new Date().toISOString();\n      }\n    }\n\n    updates.push(update);\n  }\n  return updates;\n}\n\nexport async function parseRegistries(\n  config: DependabotConfig,\n  variableFinder: VariableFinderFn,\n): Promise<Record<string, DependabotRegistry>> {\n  // Parse the value of each of the registries obtained from the config\n  const registries: Record<string, DependabotRegistry> = {};\n  for (const [key, registry] of Object.entries(config.registries || {})) {\n    const updated = { ...registry };\n    const { type } = updated;\n\n    // handle special fields for 'hex-organization' types\n    if (type === 'hex_organization' && !updated.organization) {\n      throw new Error(`The value 'organization' in dependency registry config '${type}' is missing`);\n    }\n\n    // handle special fields for 'hex-repository' types\n    if (type === 'hex_repository' && !updated.repo) {\n      throw new Error(`The value 'repo' in dependency registry config '${key}' is missing`);\n    }\n\n    // parse username, password, key, and token while replacing tokens where necessary\n    updated.username = await convertPlaceholder({ input: updated.username, variableFinder: variableFinder });\n    updated.password = await convertPlaceholder({ input: updated.password, variableFinder: variableFinder });\n    updated.key = await convertPlaceholder({ input: updated.key, variableFinder: variableFinder });\n    updated.token = await convertPlaceholder({ input: updated.token, variableFinder: variableFinder });\n\n    // TODO: include sources for this logic, otherwise it looks like magic.\n    // Initially, this was based on reading through the dependabot-core logic\n    // but much has since changed.\n\n    // parse the url\n    const url = updated.url;\n    if (!url && type !== 'hex_organization') {\n      throw new Error(`The value 'url' in dependency registry config '${key}' is missing`);\n    }\n    if (url) {\n      /*\n       * Some credentials do not use the 'url' property in the Ruby updater.\n       * The 'host' and 'registry' properties are derived from the given URL.\n       * The 'registry' property is derived from the 'url' by stripping off the scheme.\n       * The 'host' property is derived from the hostname of the 'url'.\n       *\n       * 'npm_registry' and 'docker_registry' use 'registry' only.\n       * 'terraform_registry' uses 'host' only.\n       * 'composer_repository' uses both 'url' and 'host'.\n       * 'python_index' uses 'index-url' instead of 'url'.\n       */\n\n      if (URL.canParse(url)) {\n        const parsedUrl = new URL(url);\n\n        const addRegistry = type === 'docker_registry' || type === 'npm_registry';\n        if (addRegistry) updated.registry = url.replace('https://', '').replace('http://', '');\n\n        const addHost = type === 'composer_repository' || type === 'terraform_registry';\n        if (addHost) updated.host = parsedUrl.hostname;\n      }\n\n      if (type === 'python_index') updated['index-url'] = url;\n\n      const removeUrl =\n        type === 'docker_registry' ||\n        type === 'npm_registry' ||\n        type === 'terraform_registry' ||\n        type === 'python_index';\n      if (removeUrl) delete updated.url; // remove the url if not needed\n    }\n\n    // add to list\n    registries[key] = updated;\n  }\n  return registries;\n}\n\nexport function validateConfiguration(updates: DependabotUpdate[], registries: Record<string, DependabotRegistry>) {\n  const configured = Object.keys(registries);\n  const referenced: string[] = [];\n  for (const u of updates) referenced.push(...(u.registries ?? []));\n\n  // ensure there are no configured registries that have not been referenced\n  const missingConfiguration = referenced.filter((el) => !configured.includes(el));\n  if (missingConfiguration.length > 0) {\n    throw new Error(\n      `Referenced registries: '${missingConfiguration.join(',')}' have not been configured in the root of dependabot.yml`,\n    );\n  }\n\n  // ensure there are no registries referenced but not configured\n  const missingReferences = configured.filter((el) => !referenced.includes(el));\n  if (missingReferences.length > 0) {\n    throw new Error(`Registries: '${missingReferences.join(',')}' have not been referenced by any update`);\n  }\n}\n\n/** Possible paths to the dependabot config file for GitHub. */\nexport const CONFIG_FILE_NAMES = ['dependabot.yaml', 'dependabot.yml'];\nexport const CONFIG_FILE_PATHS_GITHUB = CONFIG_FILE_NAMES.map((name) => `.github/${name}`);\n/** Possible paths to the dependabot config file for Azure. */\nexport const CONFIG_FILE_PATHS_AZURE = [\n  ...CONFIG_FILE_NAMES.map((name) => `.azuredevops/${name}`),\n  ...CONFIG_FILE_PATHS_GITHUB,\n];\n\n/**\n * Parse the contents of a dependabot config YAML file\n * @returns {DependabotConfig} config - the dependabot configuration\n */\nexport async function parseDependabotConfig({\n  configContents,\n  configPath,\n  variableFinder,\n}: {\n  configContents: string;\n  configPath: string;\n  variableFinder: VariableFinderFn;\n}): Promise<DependabotConfig> {\n  // Load the config\n  const loadedConfig = yaml.load(configContents);\n  if (loadedConfig === null || typeof loadedConfig !== 'object') {\n    throw new Error('Invalid dependabot config object');\n  }\n\n  // Parse the config\n  const config = await DependabotConfigSchema.parseAsync(loadedConfig);\n  const updates = parseUpdates(config, configPath);\n  const registries = await parseRegistries(config, variableFinder);\n  validateConfiguration(updates, registries);\n\n  return { ...config, updates, registries };\n}\n","import { z } from 'zod';\nimport { DependabotCooldownSchema } from './config';\n\n// we use nullish() because it does optional() and allows the value to be set to null\n\nexport const DependabotCredentialSchema = z.record(z.string(), z.any());\nexport type DependabotCredential = z.infer<typeof DependabotCredentialSchema>;\n\nexport const CertificateAuthoritySchema = z.object({\n  cert: z.string(),\n  key: z.string(),\n});\nexport type CertificateAuthority = z.infer<typeof CertificateAuthoritySchema>;\n\nexport const DependabotProxyConfigSchema = z.object({\n  all_credentials: DependabotCredentialSchema.array(),\n  ca: CertificateAuthoritySchema,\n});\nexport type DependabotProxyConfig = z.infer<typeof DependabotProxyConfigSchema>;\n\nexport const DependabotSourceProviderSchema = z.enum(['azure', 'bitbucket', 'gitlab']);\nexport type DependabotSourceProvider = z.infer<typeof DependabotSourceProviderSchema>;\n\nexport const DependabotSourceSchema = z.object({\n  provider: DependabotSourceProviderSchema,\n  repo: z.string(),\n  directory: z.string().nullish(),\n  directories: z.string().array().nullish(),\n  branch: z.string().nullish(),\n  commit: z.string().nullish(),\n  hostname: z.string().nullish(), // Must be provided if api-endpoint is\n  'api-endpoint': z.string().nullish(), // Must be provided if hostname is\n});\nexport type DependabotSource = z.infer<typeof DependabotSourceSchema>;\n\nexport const DependabotExistingPRSchema = z.object({\n  'dependency-name': z.string(),\n  'dependency-version': z.string().nullish(),\n  directory: z.string().nullish(),\n  removed: z.boolean().nullish(),\n});\nexport type DependabotExistingPR = z.infer<typeof DependabotExistingPRSchema>;\n\nexport const DependabotExistingGroupPRSchema = z.object({\n  'dependency-group-name': z.string(),\n  dependencies: DependabotExistingPRSchema.array(),\n});\nexport type DependabotExistingGroupPR = z.infer<typeof DependabotExistingGroupPRSchema>;\n\nexport const DependabotAllowedSchema = z.object({\n  'dependency-name': z.string().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-type': z.enum(['all', 'security']).optional(),\n});\nexport type DependabotAllowed = z.infer<typeof DependabotAllowedSchema>;\n\nexport const DependabotGroupRuleJobSchema = z.object({\n  patterns: z.string().array().nullish(),\n  'exclude-patterns': z.string().array().nullish(),\n  'dependency-type': z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n});\nexport type DependabotGroupRuleJob = z.infer<typeof DependabotGroupRuleJobSchema>;\n\nexport const DependabotGroupJobSchema = z.object({\n  name: z.string(),\n  'applies-to': z.string().nullish(),\n  rules: DependabotGroupRuleJobSchema,\n});\nexport type DependabotGroupJob = z.infer<typeof DependabotGroupJobSchema>;\n\nexport const DependabotConditionSchema = z.object({\n  'dependency-name': z.string(),\n  source: z.string().nullish(),\n  'update-types': z.string().array().nullish(),\n  'updated-at': z.coerce.string().nullish(),\n  'version-requirement': z.string().nullish(),\n});\nexport type DependabotCondition = z.infer<typeof DependabotConditionSchema>;\n\nexport const DependabotSecurityAdvisorySchema = z.object({\n  'dependency-name': z.string(),\n  'affected-versions': z.string().array(),\n  'patched-versions': z.string().array().nullish(), // may not be patched as of yet\n  'unaffected-versions': z.string().array(),\n});\nexport type DependabotSecurityAdvisory = z.infer<typeof DependabotSecurityAdvisorySchema>;\n\nexport const DependabotRequirementSourceSchema = z.record(z.string(), z.any());\nexport type DependabotRequirementSource = z.infer<typeof DependabotRequirementSourceSchema>;\n\nexport const DependabotRequirementSchema = z.object({\n  file: z.string().nullish(), // e.g. 'requirements.txt' or '/Root.csproj'\n  groups: z.string().array().nullish(), // e.g. ['dependencies']\n  metadata: z.record(z.string(), z.any()).nullish(),\n  requirement: z.string().nullish(), // e.g. '==3.2.0' or '8.1.0'\n  source: DependabotRequirementSourceSchema.nullish(),\n  version: z.string().nullish(),\n  'previous-version': z.string().nullish(),\n});\nexport type DependabotRequirement = z.infer<typeof DependabotRequirementSchema>;\n\nexport const DependabotDependencySchema = z.object({\n  name: z.string(), // e.g. 'django' or 'GraphQL.Server.Ui.Voyager'\n  'previous-requirements': DependabotRequirementSchema.array().nullish(),\n  'previous-version': z.string().nullish(),\n  version: z.string().nullish(), // e.g. '5.0.1' or '8.1.0'\n  requirements: DependabotRequirementSchema.array().nullish(),\n  removed: z.boolean().nullish(),\n  directory: z.string().nullish(),\n});\nexport type DependabotDependency = z.infer<typeof DependabotDependencySchema>;\n\nexport const DependabotCommitOptionsSchema = z.object({\n  prefix: z.string().nullish(),\n  'prefix-development': z.string().nullish(),\n  'include-scope': z.boolean().nullish(),\n});\nexport type DependabotCommitOptions = z.infer<typeof DependabotCommitOptionsSchema>;\n\nexport const DependabotExperimentsSchema = z.record(z.string(), z.union([z.string(), z.boolean()]));\nexport type DependabotExperiments = z.infer<typeof DependabotExperimentsSchema>;\n\nexport const DependabotPackageManagerSchema = z.enum([\n  'bundler',\n  'cargo',\n  'composer',\n  'conda',\n  'pub',\n  'docker',\n  'elm',\n  'github_actions', // ecosystem(s): 'github-actions'\n  'submodules', // ecosystem(s): 'gitsubmodule'\n  'go_modules', // ecosystem(s): 'gomod'\n  'gradle',\n  'maven',\n  'hex', // ecosystem(s): 'mix'\n  'nuget',\n  'npm_and_yarn', // ecosystem(s): 'npm', 'pnpm', 'yarn'\n  'pip', // ecosystem(s): 'pipenv', 'pip-compile', 'poetry'\n  'rust_toolchain', // ecosystem(s): 'rust-toolchain'\n  'swift',\n  'terraform',\n  'devcontainers',\n  'dotnet_sdk', // ecosystem(s): 'dotnet-sdk'\n  'bun',\n  'docker_compose', //  // ecosystem(s): 'docker-compose',\n  'uv',\n  'vcpkg',\n  'helm',\n  'julia',\n  'bazel',\n  'opentofu',\n]);\nexport type DependabotPackageManager = z.infer<typeof DependabotPackageManagerSchema>;\n\nexport const DEPENDABOT_COMMANDS = ['graph', 'version', 'recreate'] as const;\nexport const DependabotCommandSchema = z.enum(DEPENDABOT_COMMANDS);\nexport type DependabotCommand = z.infer<typeof DependabotCommandSchema>;\n\n// See: https://github.com/dependabot/cli/blob/main/internal/model/job.go\n//      https://github.com/dependabot/dependabot-core/blob/main/updater/lib/dependabot/job.rb\nexport const DependabotJobConfigSchema = z.object({\n  id: z.string(),\n  command: DependabotCommandSchema.optional(),\n  'package-manager': DependabotPackageManagerSchema,\n  'allowed-updates': DependabotAllowedSchema.array(),\n  debug: z.boolean().nullable(),\n  'dependency-groups': DependabotGroupJobSchema.array().nullish(),\n  dependencies: z.string().array().nullable(),\n  'dependency-group-to-refresh': z.string().nullish(),\n  'existing-pull-requests': DependabotExistingPRSchema.array().array(),\n  'existing-group-pull-requests': DependabotExistingGroupPRSchema.array(),\n  experiments: DependabotExperimentsSchema,\n  'ignore-conditions': DependabotConditionSchema.array(),\n  'lockfile-only': z.boolean(),\n  'requirements-update-strategy': z.string().nullable(),\n  'security-advisories': DependabotSecurityAdvisorySchema.array(),\n  'security-updates-only': z.boolean(),\n  source: DependabotSourceSchema,\n  'update-subdependencies': z.boolean(),\n  'updating-a-pull-request': z.boolean(),\n  'vendor-dependencies': z.boolean(),\n  'reject-external-code': z.boolean().nullish(),\n  'repo-private': z.boolean(),\n  'commit-message-options': DependabotCommitOptionsSchema,\n  'credentials-metadata': DependabotCredentialSchema.array().nullish(),\n  'max-updater-run-time': z.int().nullish(),\n  cooldown: DependabotCooldownSchema.nullish(),\n  'proxy-log-response-body-on-auth-failure': z.boolean().nullish(),\n  'enable-beta-ecosystems': z.boolean().nullish(),\n  'multi-ecosystem-update': z.boolean().nullish(),\n  'exclude-paths': z.string().array().optional(),\n});\nexport type DependabotJobConfig = z.infer<typeof DependabotJobConfigSchema>;\n\nexport const DependabotJobFileSchema = z.object({\n  job: DependabotJobConfigSchema,\n});\nexport type DependabotJobFile = z.infer<typeof DependabotJobFileSchema>;\n\n// Code below is borrowed and adapted from dependabot-action\n\n// biome-ignore-start lint/suspicious/noExplicitAny: generic\nexport type FetchedFiles = {\n  base_commit_sha: string;\n  dependency_files: any[];\n  base64_dependency_files: any[];\n};\n// biome-ignore-end lint/suspicious/noExplicitAny: generic\n\nexport type FileFetcherInput = {\n  job: DependabotJobConfig;\n};\n\nexport type FileUpdaterInput = FetchedFiles & {\n  job: DependabotJobConfig;\n};\n\nexport const DependabotPersistedPrSchema = DependabotExistingPRSchema.array().or(DependabotExistingGroupPRSchema);\nexport type DependabotPersistedPr = z.infer<typeof DependabotPersistedPrSchema>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,SAAgB,iBAAiB,SAA0C;AAOzE,QAAO,GALW,eAAe,UAAU,QAAQ,YAAY,QAAQ,qBAKnD,IAFE,QAAQ,aAAa,QAAQ,YAAa,KAAK,IAAI;;;;;AC3D3E,eAAe,mBAAmB,EAChC,OACA,kBAI8B;AAC9B,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,UAA6B,mBAAmB,MAAM;CAC5D,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,cAAc,MAAM;EAC1B,MAAM,OAAO,MAAM;EACnB,MAAM,QAAS,MAAM,eAAe,KAAK,IAAK;AAC9C,WAAS,OAAO,QAAQ,aAAa,MAAM;;AAE7C,QAAO;;AAGT,SAAS,mBAAmB,OAAe;CACzC,MAAM,UAA6B,EAAE;CACrC,MAAM,SAAiB;CAEvB,IAAI,cAAc;CAClB,IAAI,SAAS;AAEb,QAAO,YAAY,SAAS,GAAG;EAC7B,MAAM,QAAQ,YAAY,MAAM,OAAO;AACvC,MAAI,CAAC,SAAS,MAAM,UAAU,OAAW;EAGzC,MAAM,gBAAgB,OAAO,OAAO,CAAC,GAAG,MAAM,EAAE;GAC9C,OAAO,MAAM,QAAQ;GACd;GACP,QAAQ,MAAM;GACf,CAAC;AAEF,UAAQ,KAAK,cAAc;EAG3B,MAAM,YAAY,MAAM,QAAQ,MAAM,GAAG;AACzC,YAAU;AACV,gBAAc,YAAY,MAAM,UAAU;;AAG5C,QAAO;;;;;AC1CT,MAAa,2BAA2B,EACrC,OAAO;CACN,MAAM,EAAE,KAAK;EAIX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;CACF,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC1B,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,iBAAiB,EAAE,SAAS,CAAC,UAAU;CACvC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,cAAc,EAAE,QAAQ,CAAC,UAAU;CACnC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,0BAA0B,EAAE,QAAQ,CAAC,UAAU;CAC/C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,aAAa,EAAE,QAAQ,CAAC,UAAU;CACnC,CAAC,CAED,WAAW,WAAW;CAAE,GAAG;CAAO,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;CAAE,EAAE;AAG3E,MAAa,wBAAwB,EAAE,OAAO;CAG5C,YAAY,EACT,QAAQ,CACR,MACC,EAAE,MAAM,qCAAqC,EAC3C,SACE,qHACH,CAAC,CACH,CACA,UAAU;CACb,cAAc,EAAE,KAAK,CAAC,mBAAmB,mBAAmB,CAAC,CAAC,UAAU;CACxE,mBAAmB,EAAE,KAAK,CAAC,eAAe,aAAa,CAAC,CAAC,UAAU;CACnE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACjD,gBAAgB,EAAE,KAAK;EAAC;EAAS;EAAS;EAAQ,CAAC,CAAC,OAAO,CAAC,UAAU;CACvE,CAAC;AAGF,MAAa,iCAAiC,EAAE,OAAO;CACrD,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,mBAAmB,EAAE,KAAK;EAAC;EAAU;EAAY;EAAO;EAAc;EAAc,CAAC,CAAC,UAAU;CAChG,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,kCAAkC,EAC5C,OAAO;CACN,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,UAAU;CACtD,gBAAgB,EACb,KAAK;EAAC;EAA+B;EAA+B;EAA8B,CAAC,CACnG,OAAO,CACP,UAAU;CACd,CAAC,CACD,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAGrC,MAAa,2BAA2B,EACrC,OAAO;CACN,UAAU,EAAE,KAAK;EAAC;EAAS;EAAU;EAAW;EAAa;EAAgB;EAAU;EAAO,CAAC;CAE/F,KAAK,EACF,KAAK;EAAC;EAAU;EAAU;EAAW;EAAa;EAAY;EAAU;EAAW,CAAC,CACpF,UAAU,CACV,QAAQ,SAAS;CAEpB,MAAM,EACH,QAAQ,CACR,QAAQ,QAAQ,CAChB,MAAM,EAAE,MAAM,uCAAuC,EAAE,SAAS,gCAAgC,CAAC,CAAC,CAClG,UAAU;CAEb,UAAU,EACP,QAAQ,CACR,UAAU,CACV,QAAQ,UAAU,CAClB,QACE,UAAU;AACT,MAAI;AAEF,QAAK,eAAe,QAAW,EAAE,UAAU,OAAO,CAAC;AACnD,UAAO;UACD;AACN,UAAO;;IAGX,EAAE,SAAS,0BAA0B,CACtC;CACH,SAAS,EACN,QAAQ,CACR,MAAM,EAAE,MAAM,yBAAyB,EAAE,SAAS,2CAA2C,CAAC,CAAC,CAC/F,UAAU;CACd,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;AAElC,KAAI,MAAM,aAAa,UAAU,CAAC,MAAM,QACtC,UAAS,4EAA4E;AAGvF,QAAO;EACP;AAGJ,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,UAAU;CAC3C,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC/B,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,gBAAgB,EAAE,QAAQ,CAAC,UAAU;CACrC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACtC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,CAAC;AAGF,MAAM,wCAAwC,EAAE,OAAO,EACrD,WAAW,EAAE,QAAQ,CAAC,UAAU,EACjC,CAAC;AAGF,MAAa,yBAAyB,EAAE,KAAK;CAI3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,2BAA2B,EAAE,KAAK;CAAC;CAAQ;CAAY;CAAyB;CAAiB;CAAQ,CAAC;AAGvH,MAAa,yBAAyB,EACnC,OAAO;CACN,qBAAqB;CACrB,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC1C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC9C,OAAO,+BAA+B,OAAO,CAAC,UAAU;CACxD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACxC,kBAAkB,8BAA8B,UAAU;CAC1D,UAAU,yBAAyB,UAAU;CAC7C,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,UAAU;CAC9D,QAAQ,gCAAgC,OAAO,CAAC,UAAU;CAC1D,oCAAoC,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,CAAC,UAAU;CACxE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACrC,WAAW,EAAE,OAAO,QAAQ,CAAC,UAAU;CACvC,4BAA4B,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU;CAC1E,4BAA4B,sCAAsC,UAAU;CAC5E,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACzC,UAAU;CACV,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACtC,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,uBAAuB,yBAAyB,UAAU;CAC1D,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACvC,yBAAyB,EAAE,QAAQ,CAAC,UAAU;CAC/C,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;AAElC,KAAI,CAAC,MAAM,cAAc,CAAC,MAAM,eAAe,MAAM,YAAY,WAAW,GAC1E,UAAS,gGAAgG;AAI3G,KAAI,MAAM,aAAa,YAAY,KAAK,MAAM,UAAU,CACtD,UAAS,uDAAuD;AAGlE,OAAM,gCAAgC;AAKtC,KAAI,MAAM,6BAA6B,CAAC,MAAM,YAAY,MAAM,SAAS,WAAW,GAClF,UACE,8GACD;AAGH,QAAO;EACP;AAGJ,MAAa,sCAAsC,EAAE,OAAO;CAC1D,UAAU;CACV,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACrC,WAAW,EAAE,OAAO,QAAQ,CAAC,UAAU;CACvC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CACxC,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACtC,kBAAkB,8BAA8B,UAAU;CAC1D,4BAA4B,sCAAsC,UAAU;CAC7E,CAAC;AAIF,MAAa,kBAAsC,EAAE;;;;;AAMrD,MAAa,yBAAyB,EACnC,OAAO;CAIN,SAAS,EAAE,QAAQ,CAAC,QAAQ,MAAM,MAAM,GAAG,EAAE,SAAS,6CAA6C,CAAC;CAKpG,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE,oCAAoC,CAAC,UAAU;CAM9F,SAAS,uBAAuB,OAAO,CAAC,MACtC,EAAE,UAAU,GAAG,EAAE,SAAS,iDAAiD,CAAC,CAC7E;CAMD,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,UAAU;CAMrE,0BAA0B,EAAE,SAAS,CAAC,UAAU;CACjD,CAAC,CACD,WAAW,OAAO,EAAE,eAAe;CAKlC,MAAM,gBAAgB;EAAC;EAAa;EAAiB;EAAkB;EAA2B;AAClG,KAAI,MAAM,2BACR;OAAK,MAAM,UAAU,MAAM,QACzB,MAAK,MAAM,OAAO,cAChB,KAAI,OAAO,OACT,UACE,QAAQ,IAAI,uHACb;;CAOT,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,UAAU,MAAM,SAAS;EAClC,MAAM,MAAM,iBAAiB,OAAO;AACpC,MAAI,KAAK,IAAI,IAAI,CACf,UACE,6CAA6C,OAAO,qBAAqB,oBAAoB,OAAO,aAAa,OAAO,aAAa,KAAK,IAAI,CAAC,GAChJ;AAEH,OAAK,IAAI,IAAI;;AAIf,KAAI,CAAC,MAAM,2BACT;OAAK,MAAM,UAAU,MAAM,QACzB,KAAI,gBAAgB,SAAS,OAAO,qBAAqB,CACvD,UACE,0BAA0B,OAAO,qBAAqB,0GACvD;;AAKP,QAAO;EACP;AAIJ,SAAgB,aAAa,QAA0B,YAAwC;CAC7F,MAAM,UAA8B,EAAE;AAGtC,MAAK,MAAM,UAAU,OAAO,SAAS;AAInC,MAAI,OAAO,OACT,MAAK,MAAM,aAAa,OAAO,QAAQ;AACrC,aAAU,WAAW;AAErB,aAAU,mCAAkB,IAAI,MAAM,EAAC,aAAa;;AAIxD,UAAQ,KAAK,OAAO;;AAEtB,QAAO;;AAGT,eAAsB,gBACpB,QACA,gBAC6C;CAE7C,MAAM,aAAiD,EAAE;AACzD,MAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,OAAO,cAAc,EAAE,CAAC,EAAE;EACrE,MAAM,UAAU,EAAE,GAAG,UAAU;EAC/B,MAAM,EAAE,SAAS;AAGjB,MAAI,SAAS,sBAAsB,CAAC,QAAQ,aAC1C,OAAM,IAAI,MAAM,2DAA2D,KAAK,cAAc;AAIhG,MAAI,SAAS,oBAAoB,CAAC,QAAQ,KACxC,OAAM,IAAI,MAAM,mDAAmD,IAAI,cAAc;AAIvF,UAAQ,WAAW,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAA0B;GAAgB,CAAC;AACxG,UAAQ,WAAW,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAA0B;GAAgB,CAAC;AACxG,UAAQ,MAAM,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAAqB;GAAgB,CAAC;AAC9F,UAAQ,QAAQ,MAAM,mBAAmB;GAAE,OAAO,QAAQ;GAAuB;GAAgB,CAAC;EAOlG,MAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,OAAO,SAAS,mBACnB,OAAM,IAAI,MAAM,kDAAkD,IAAI,cAAc;AAEtF,MAAI,KAAK;AAaP,OAAI,IAAI,SAAS,IAAI,EAAE;IACrB,MAAM,YAAY,IAAI,IAAI,IAAI;AAG9B,QADoB,SAAS,qBAAqB,SAAS,eAC1C,SAAQ,WAAW,IAAI,QAAQ,YAAY,GAAG,CAAC,QAAQ,WAAW,GAAG;AAGtF,QADgB,SAAS,yBAAyB,SAAS,qBAC9C,SAAQ,OAAO,UAAU;;AAGxC,OAAI,SAAS,eAAgB,SAAQ,eAAe;AAOpD,OAJE,SAAS,qBACT,SAAS,kBACT,SAAS,wBACT,SAAS,eACI,QAAO,QAAQ;;AAIhC,aAAW,OAAO;;AAEpB,QAAO;;AAGT,SAAgB,sBAAsB,SAA6B,YAAgD;CACjH,MAAM,aAAa,OAAO,KAAK,WAAW;CAC1C,MAAM,aAAuB,EAAE;AAC/B,MAAK,MAAM,KAAK,QAAS,YAAW,KAAK,GAAI,EAAE,cAAc,EAAE,CAAE;CAGjE,MAAM,uBAAuB,WAAW,QAAQ,OAAO,CAAC,WAAW,SAAS,GAAG,CAAC;AAChF,KAAI,qBAAqB,SAAS,EAChC,OAAM,IAAI,MACR,2BAA2B,qBAAqB,KAAK,IAAI,CAAC,0DAC3D;CAIH,MAAM,oBAAoB,WAAW,QAAQ,OAAO,CAAC,WAAW,SAAS,GAAG,CAAC;AAC7E,KAAI,kBAAkB,SAAS,EAC7B,OAAM,IAAI,MAAM,gBAAgB,kBAAkB,KAAK,IAAI,CAAC,0CAA0C;;;AAK1G,MAAa,oBAAoB,CAAC,mBAAmB,iBAAiB;AACtE,MAAa,2BAA2B,kBAAkB,KAAK,SAAS,WAAW,OAAO;;AAE1F,MAAa,0BAA0B,CACrC,GAAG,kBAAkB,KAAK,SAAS,gBAAgB,OAAO,EAC1D,GAAG,yBACJ;;;;;AAMD,eAAsB,sBAAsB,EAC1C,gBACA,YACA,kBAK4B;CAE5B,MAAM,eAAe,KAAK,KAAK,eAAe;AAC9C,KAAI,iBAAiB,QAAQ,OAAO,iBAAiB,SACnD,OAAM,IAAI,MAAM,mCAAmC;CAIrD,MAAM,SAAS,MAAM,uBAAuB,WAAW,aAAa;CACpE,MAAM,UAAU,aAAa,QAAQ,WAAW;CAChD,MAAM,aAAa,MAAM,gBAAgB,QAAQ,eAAe;AAChE,uBAAsB,SAAS,WAAW;AAE1C,QAAO;EAAE,GAAG;EAAQ;EAAS;EAAY;;;;;AC3e3C,MAAa,6BAA6B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAGvE,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO;CAClD,iBAAiB,2BAA2B,OAAO;CACnD,IAAI;CACL,CAAC;AAGF,MAAa,iCAAiC,EAAE,KAAK;CAAC;CAAS;CAAa;CAAS,CAAC;AAGtF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,UAAU;CACV,MAAM,EAAE,QAAQ;CAChB,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACzC,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;CACrC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,mBAAmB,EAAE,QAAQ;CAC7B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;CAC/B,CAAC;AAGF,MAAa,kCAAkC,EAAE,OAAO;CACtD,yBAAyB,EAAE,QAAQ;CACnC,cAAc,2BAA2B,OAAO;CACjD,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO;CAC9C,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,eAAe,EAAE,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU;CACtD,CAAC;AAGF,MAAa,+BAA+B,EAAE,OAAO;CACnD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACtC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,mBAAmB,EAAE,QAAQ,CAAC,SAAS;CACvC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC7C,CAAC;AAGF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,MAAM,EAAE,QAAQ;CAChB,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,OAAO;CACR,CAAC;AAGF,MAAa,4BAA4B,EAAE,OAAO;CAChD,mBAAmB,EAAE,QAAQ;CAC7B,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAC5C,cAAc,EAAE,OAAO,QAAQ,CAAC,SAAS;CACzC,uBAAuB,EAAE,QAAQ,CAAC,SAAS;CAC5C,CAAC;AAGF,MAAa,mCAAmC,EAAE,OAAO;CACvD,mBAAmB,EAAE,QAAQ;CAC7B,qBAAqB,EAAE,QAAQ,CAAC,OAAO;CACvC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CAChD,uBAAuB,EAAE,QAAQ,CAAC,OAAO;CAC1C,CAAC;AAGF,MAAa,oCAAoC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;AAG9E,MAAa,8BAA8B,EAAE,OAAO;CAClD,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;CACpC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC,SAAS;CACjD,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,QAAQ,kCAAkC,SAAS;CACnD,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACzC,CAAC;AAGF,MAAa,6BAA6B,EAAE,OAAO;CACjD,MAAM,EAAE,QAAQ;CAChB,yBAAyB,4BAA4B,OAAO,CAAC,SAAS;CACtE,oBAAoB,EAAE,QAAQ,CAAC,SAAS;CACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;CAC7B,cAAc,4BAA4B,OAAO,CAAC,SAAS;CAC3D,SAAS,EAAE,SAAS,CAAC,SAAS;CAC9B,WAAW,EAAE,QAAQ,CAAC,SAAS;CAChC,CAAC;AAGF,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,CAAC,SAAS;CAC5B,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAC1C,iBAAiB,EAAE,SAAS,CAAC,SAAS;CACvC,CAAC;AAGF,MAAa,8BAA8B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAGnG,MAAa,iCAAiC,EAAE,KAAK;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAGF,MAAa,sBAAsB;CAAC;CAAS;CAAW;CAAW;AACnE,MAAa,0BAA0B,EAAE,KAAK,oBAAoB;AAKlE,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,QAAQ;CACd,SAAS,wBAAwB,UAAU;CAC3C,mBAAmB;CACnB,mBAAmB,wBAAwB,OAAO;CAClD,OAAO,EAAE,SAAS,CAAC,UAAU;CAC7B,qBAAqB,yBAAyB,OAAO,CAAC,SAAS;CAC/D,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC3C,+BAA+B,EAAE,QAAQ,CAAC,SAAS;CACnD,0BAA0B,2BAA2B,OAAO,CAAC,OAAO;CACpE,gCAAgC,gCAAgC,OAAO;CACvE,aAAa;CACb,qBAAqB,0BAA0B,OAAO;CACtD,iBAAiB,EAAE,SAAS;CAC5B,gCAAgC,EAAE,QAAQ,CAAC,UAAU;CACrD,uBAAuB,iCAAiC,OAAO;CAC/D,yBAAyB,EAAE,SAAS;CACpC,QAAQ;CACR,0BAA0B,EAAE,SAAS;CACrC,2BAA2B,EAAE,SAAS;CACtC,uBAAuB,EAAE,SAAS;CAClC,wBAAwB,EAAE,SAAS,CAAC,SAAS;CAC7C,gBAAgB,EAAE,SAAS;CAC3B,0BAA0B;CAC1B,wBAAwB,2BAA2B,OAAO,CAAC,SAAS;CACpE,wBAAwB,EAAE,KAAK,CAAC,SAAS;CACzC,UAAU,yBAAyB,SAAS;CAC5C,2CAA2C,EAAE,SAAS,CAAC,SAAS;CAChE,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;CAC/C,CAAC;AAGF,MAAa,0BAA0B,EAAE,OAAO,EAC9C,KAAK,2BACN,CAAC;AAqBF,MAAa,8BAA8B,2BAA2B,OAAO,CAAC,GAAG,gCAAgC"}

package/dist/usage.d.mts

@@ -15,7 +15,7 @@ import { z } from "zod";
  *   },
  *   "trigger": "user",
  *   "provider": "azure",
- *   "owner": "https://dev.azure.com/tingle/",
+ *   "owner": "https://dev.azure.com/paklo/",
  *   "package-manager": "terraform",
  *   "version": "0.9.0",
  *   "id": 2850677077,
@@ -100,7 +100,7 @@ declare const UsageTelemetryRequestDataSchema: z.ZodObject<{
  *   },
  *   "trigger": "user",
  *   "provider": "azure",
- *   "owner": "https://dev.azure.com/tingle/",
+ *   "owner": "https://dev.azure.com/paklo/",
  *   "package-manager": "terraform",
  *   "version": "0.9.0",
  *   "id": 2850677077,

package/dist/usage.mjs

@@ -15,7 +15,7 @@ import { z } from "zod";
 *   },
 *   "trigger": "user",
 *   "provider": "azure",
-*   "owner": "https://dev.azure.com/tingle/",
+*   "owner": "https://dev.azure.com/paklo/",
 *   "package-manager": "terraform",
 *   "version": "0.9.0",
 *   "id": 2850677077,

package/dist/usage.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"usage.mjs","names":[],"sources":["../src/usage.ts"],"sourcesContent":["import { z } from 'zod';\nimport { DependabotPackageManagerSchema, DependabotSourceProviderSchema } from '@/dependabot/job';\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\",\n *     \"docker-container\": false\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/tingle/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true,\n *   \"error\": {\n *     \"message\": \"An error occurred\"\n *   }\n * }\n * ```\n */\nexport const UsageTelemetryRequestDataSchema = z.object({\n  host: z.object({\n    platform: z.string().max(50), // e.g. linux, darwin, win32\n    release: z.string().max(100), // e.g. 26.0.0, 10.0.19043\n    arch: z.string().max(50), // e.g. x64, arm64\n    'machine-hash': z.string().max(250), // e.g. \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\" for \"Maxwells-MacBook-Pro.local\"\n    'docker-container': z.boolean().optional(), // whether running inside a Docker container\n  }),\n  version: z.string().max(50),\n  trigger: z.enum(['user', 'service']),\n  provider: DependabotSourceProviderSchema,\n  owner: z.url(),\n  project: z.url(),\n  'package-manager': DependabotPackageManagerSchema,\n  id: z.string(), // job identifier, for correlation\n  started: z.coerce.date(),\n  duration: z.number().min(0), // in milliseconds\n  success: z.boolean(),\n  error: z.object({ message: z.string() }).optional(),\n});\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\",\n *     \"docker-container\": false\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/tingle/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true\n * }\n * ```\n */\nexport type UsageTelemetryRequestData = z.infer<typeof UsageTelemetryRequestDataSchema>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,kCAAkC,EAAE,OAAO;CACtD,MAAM,EAAE,OAAO;EACb,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG;EAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,IAAI;EAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG;EACxB,gBAAgB,EAAE,QAAQ,CAAC,IAAI,IAAI;EACnC,oBAAoB,EAAE,SAAS,CAAC,UAAU;EAC3C,CAAC;CACF,SAAS,EAAE,QAAQ,CAAC,IAAI,GAAG;CAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;CACpC,UAAU;CACV,OAAO,EAAE,KAAK;CACd,SAAS,EAAE,KAAK;CAChB,mBAAmB;CACnB,IAAI,EAAE,QAAQ;CACd,SAAS,EAAE,OAAO,MAAM;CACxB,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,SAAS,EAAE,SAAS;CACpB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU;CACpD,CAAC"}
+{"version":3,"file":"usage.mjs","names":[],"sources":["../src/usage.ts"],"sourcesContent":["import { z } from 'zod';\nimport { DependabotPackageManagerSchema, DependabotSourceProviderSchema } from '@/dependabot/job';\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\",\n *     \"docker-container\": false\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/paklo/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true,\n *   \"error\": {\n *     \"message\": \"An error occurred\"\n *   }\n * }\n * ```\n */\nexport const UsageTelemetryRequestDataSchema = z.object({\n  host: z.object({\n    platform: z.string().max(50), // e.g. linux, darwin, win32\n    release: z.string().max(100), // e.g. 26.0.0, 10.0.19043\n    arch: z.string().max(50), // e.g. x64, arm64\n    'machine-hash': z.string().max(250), // e.g. \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\" for \"Maxwells-MacBook-Pro.local\"\n    'docker-container': z.boolean().optional(), // whether running inside a Docker container\n  }),\n  version: z.string().max(50),\n  trigger: z.enum(['user', 'service']),\n  provider: DependabotSourceProviderSchema,\n  owner: z.url(),\n  project: z.url(),\n  'package-manager': DependabotPackageManagerSchema,\n  id: z.string(), // job identifier, for correlation\n  started: z.coerce.date(),\n  duration: z.number().min(0), // in milliseconds\n  success: z.boolean(),\n  error: z.object({ message: z.string() }).optional(),\n});\n\n/**\n * @example\n * ```json\n * {\n *   \"host\": {\n *     \"platform\": \"darwin\",\n *     \"os\": \"25.0.0\",\n *     \"arch\": \"arm64\",\n *     \"machine-hash\": \"d3bbb66be2ad9dfab10af69b450f7e7e814ef7bbf1277a6d0df9e1db44ba4f5c\",\n *     \"docker-container\": false\n *   },\n *   \"trigger\": \"user\",\n *   \"provider\": \"azure\",\n *   \"owner\": \"https://dev.azure.com/paklo/\",\n *   \"package-manager\": \"terraform\",\n *   \"version\": \"0.9.0\",\n *   \"id\": 2850677077,\n *   \"started\": \"2025-10-03T14:44:00.191Z\",\n *   \"duration\": 31812,\n *   \"success\": true\n * }\n * ```\n */\nexport type UsageTelemetryRequestData = z.infer<typeof UsageTelemetryRequestDataSchema>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,kCAAkC,EAAE,OAAO;CACtD,MAAM,EAAE,OAAO;EACb,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG;EAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,IAAI;EAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG;EACxB,gBAAgB,EAAE,QAAQ,CAAC,IAAI,IAAI;EACnC,oBAAoB,EAAE,SAAS,CAAC,UAAU;EAC3C,CAAC;CACF,SAAS,EAAE,QAAQ,CAAC,IAAI,GAAG;CAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;CACpC,UAAU;CACV,OAAO,EAAE,KAAK;CACd,SAAS,EAAE,KAAK;CAChB,mBAAmB;CACnB,IAAI,EAAE,QAAQ;CACd,SAAS,EAAE,OAAO,MAAM;CACxB,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,SAAS,EAAE,SAAS;CACpB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU;CACpD,CAAC"}