@paklo/runner 0.7.0 → 0.8.1

package/dist/index.d.mts

@@ -47,7 +47,8 @@ declare class ProxyBuilder {
   private readonly docker;
   private readonly proxyImage;
   private readonly cachedMode;
-  constructor(docker: Docker, proxyImage: string, cachedMode: boolean);
+  private readonly debug;
+  constructor(docker: Docker, proxyImage: string, cachedMode: boolean, debug: boolean);
   run(jobId: string, jobToken: string, dependabotApiUrl: string, credentials: DependabotCredential[]): Promise<Proxy>;
   private ensureNetwork;
   private buildProxyConfig;
@@ -67,6 +68,7 @@ type RunJobOptions = {
   credentialsToken: string;
   updaterImage?: string;
   secretMasker: SecretMasker;
+  debug: boolean;
   usage: Pick<UsageTelemetryRequestData, 'trigger' | 'provider' | 'owner' | 'project' | 'package-manager'>;
 };
 type RunJobResult = {
@@ -89,8 +91,9 @@ declare class Updater {
   private readonly params;
   private readonly job;
   private readonly credentials;
+  private readonly debug;
   docker: Docker;
-  constructor(updaterImage: string, proxyImage: string, params: JobParameters, job: DependabotJobConfig, credentials: DependabotCredential[]);
+  constructor(updaterImage: string, proxyImage: string, params: JobParameters, job: DependabotJobConfig, credentials: DependabotCredential[], debug: boolean);
   /**
    * Execute an update job and report the result to Dependabot API.
    */

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as CredentialFetchingError, C as PROXY_IMAGE_NAME, D as updaterImageName, E as repositoryName, O as updaterImages, S as extractUpdaterSha, T as hasDigest, _ as getJobParameters, a as Updater, b as ContainerRuntimeError, c as JOB_INPUT_FILENAME, d as JOB_OUTPUT_PATH, f as REPO_CONTENTS_PATH, g as JobParameters, h as ProxyBuilder, i as runJob, j as JobDetailsFetchingError, k as ApiClient, l as JOB_INPUT_PATH, m as CONFIG_FILE_NAME, n as JobRunnerUpdaterError, o as CA_CERT_FILENAME, p as UpdaterBuilder, r as isRunningInDocker, s as CA_CERT_INPUT_PATH, t as JobRunnerImagingError, u as JOB_OUTPUT_FILENAME, v as ImageService, w as digestName, x as ContainerService, y as getOrgFromImage } from "./run-CJUFvK8K.mjs";
+import { A as CredentialFetchingError, C as PROXY_IMAGE_NAME, D as updaterImageName, E as repositoryName, O as updaterImages, S as extractUpdaterSha, T as hasDigest, _ as getJobParameters, a as Updater, b as ContainerRuntimeError, c as JOB_INPUT_FILENAME, d as JOB_OUTPUT_PATH, f as REPO_CONTENTS_PATH, g as JobParameters, h as ProxyBuilder, i as runJob, j as JobDetailsFetchingError, k as ApiClient, l as JOB_INPUT_PATH, m as CONFIG_FILE_NAME, n as JobRunnerUpdaterError, o as CA_CERT_FILENAME, p as UpdaterBuilder, r as isRunningInDocker, s as CA_CERT_INPUT_PATH, t as JobRunnerImagingError, u as JOB_OUTPUT_FILENAME, v as ImageService, w as digestName, x as ContainerService, y as getOrgFromImage } from "./run-BCnN-4vw.mjs";
 import { logger } from "@paklo/core/logger";
 import Docker from "dockerode";
 

package/dist/local/azure/index.d.mts

@@ -1,19 +1,19 @@
 import "../../api-client-BoQ6jjRB.mjs";
-import { a as LocalJobsRunner, i as LocalDependabotServerOptions, n as LocalDependabotServer, o as LocalJobsRunnerOptions, s as RunJobsResult } from "../../server-89g3AXRY.mjs";
+import { a as LocalJobsRunner, i as LocalDependabotServerOptions, n as LocalDependabotServer, o as LocalJobsRunnerOptions, s as RunJobsResult } from "../../server-6BlJr2bw.mjs";
 import { DependabotRequest } from "@paklo/core/dependabot";
-import { AzdoPullRequestMergeStrategy, AzureDevOpsRepositoryUrl, AzureDevOpsWebApiClient, IPullRequestProperties } from "@paklo/core/azure";
+import { AzdoPrExtractedWithProperties, AzdoPullRequestMergeStrategy, AzureDevOpsClientWrapper, AzureDevOpsRepositoryUrl } from "@paklo/core/azure";
 
 //#region src/local/azure/server.d.ts
 type AzureLocalDependabotServerOptions = LocalDependabotServerOptions & {
   url: AzureDevOpsRepositoryUrl;
-  authorClient: AzureDevOpsWebApiClient;
+  authorClient: AzureDevOpsClientWrapper;
   autoApprove: boolean;
-  approverClient?: AzureDevOpsWebApiClient;
+  approverClient?: AzureDevOpsClientWrapper;
   setAutoComplete: boolean;
   mergeStrategy?: AzdoPullRequestMergeStrategy;
   autoCompleteIgnoreConfigIds: number[];
   existingBranchNames: string[] | undefined;
-  existingPullRequests: IPullRequestProperties[];
+  existingPullRequests: AzdoPrExtractedWithProperties[];
 };
 declare class AzureLocalDependabotServer extends LocalDependabotServer {
   private readonly options;

package/dist/local/azure/index.mjs

@@ -1,10 +1,10 @@
-import { i as runJob } from "../../run-CJUFvK8K.mjs";
+import { i as runJob } from "../../run-BCnN-4vw.mjs";
 import { n as LocalJobsRunner, t as LocalDependabotServer } from "../../server-BxUu1gGo.mjs";
 import { logger } from "@paklo/core/logger";
 import { readFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { DependabotJobBuilder, getBranchNameForUpdate, mapPackageEcosystemToPackageManager } from "@paklo/core/dependabot";
-import { AzureDevOpsWebApiClient, DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, buildPullRequestProperties, getPullRequestChangedFilesForOutputData, getPullRequestCloseReasonForOutputData, getPullRequestDependenciesPropertyValueForOutputData, getPullRequestDescription, getPullRequestForDependencyNames, normalizeBranchName, parsePullRequestProperties } from "@paklo/core/azure";
+import { DependabotJobBuilder, getBranchNameForUpdate, getPullRequestCloseReason, getPullRequestDependencies, getPullRequestDescription, mapPackageEcosystemToPackageManager, normalizeBranchName } from "@paklo/core/dependabot";
+import { AzureDevOpsClientWrapper, PR_DESCRIPTION_MAX_LENGTH, PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME, buildPullRequestProperties, getPullRequestChangedFiles, getPullRequestForDependencyNames, parsePullRequestProperties } from "@paklo/core/azure";
 import { GitHubSecurityAdvisoryClient, SecurityVulnerabilitySchema, filterVulnerabilities, getGhsaPackageEcosystemFromDependabotPackageManager } from "@paklo/core/github";
 
 //#region src/local/azure/server.ts
@@ -43,10 +43,20 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 					logger.warn(`Skipping pull request creation of '${title}' as the open pull requests limit (${openPullRequestsLimit}) has been reached`);
 					return true;
 				}
-				const changedFiles = getPullRequestChangedFilesForOutputData(data);
-				const dependencies = getPullRequestDependenciesPropertyValueForOutputData(data);
-				const targetBranch = update["target-branch"] || await authorClient.getDefaultBranch(project, repository);
-				const sourceBranch = getBranchNameForUpdate(update["package-ecosystem"], targetBranch, update.directory || update.directories?.find((dir) => changedFiles[0]?.path?.startsWith(dir)), !Array.isArray(dependencies) ? dependencies["dependency-group-name"] : void 0, !Array.isArray(dependencies) ? dependencies.dependencies : dependencies, update["pull-request-branch-name"]?.separator);
+				const changedFiles = getPullRequestChangedFiles(data);
+				const dependencies = getPullRequestDependencies(data);
+				const targetBranch = update["target-branch"] || await authorClient.getDefaultBranch({
+					project,
+					repository
+				});
+				const sourceBranch = getBranchNameForUpdate({
+					packageEcosystem: update["package-ecosystem"],
+					targetBranchName: targetBranch,
+					directory: update.directory || update.directories?.find((dir) => changedFiles[0]?.path?.startsWith(dir)),
+					dependencyGroupName: !Array.isArray(dependencies) ? dependencies["dependency-group-name"] : void 0,
+					dependencies: !Array.isArray(dependencies) ? dependencies.dependencies : dependencies,
+					separator: update["pull-request-branch-name"]?.separator
+				});
 				if ((existingBranchNames?.find((branch) => sourceBranch === branch) || []).length) {
 					logger.error(`Unable to create pull request '${title}' as source branch '${sourceBranch}' already exists; Delete the existing branch and try again.`);
 					return false;
@@ -66,7 +76,12 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 					target: { branch: targetBranch },
 					author,
 					title,
-					description: getPullRequestDescription(packageManager, data["pr-body"], data.dependencies),
+					description: getPullRequestDescription({
+						packageManager,
+						body: data["pr-body"],
+						dependencies: data.dependencies,
+						maxDescriptionLength: PR_DESCRIPTION_MAX_LENGTH
+					}),
 					commitMessage: data["commit-message"],
 					autoComplete: setAutoComplete ? {
 						ignorePolicyConfigIds: autoCompleteIgnoreConfigIds,
@@ -83,10 +98,11 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 					repository,
 					pullRequestId: newPullRequestId
 				});
-				if (newPullRequestId && newPullRequestId > 0) {
+				if (newPullRequestId) {
 					affectedPullRequestIds.get(id).created.push(newPullRequestId);
 					return true;
-				} else return false;
+				}
+				return false;
 			}
 			case "update_pull_request": {
 				if (dryRun) {
@@ -101,21 +117,18 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 				const pullRequestWasUpdated = await authorClient.updatePullRequest({
 					project,
 					repository,
-					pullRequestId: pullRequestToUpdate.id,
+					pullRequestId: pullRequestToUpdate.pullRequestId,
 					commit: data["base-commit-sha"] || job.source.commit,
 					author,
-					changes: getPullRequestChangedFilesForOutputData(data),
-					skipIfDraft: true,
-					skipIfCommitsFromAuthorsOtherThan: author.email,
-					skipIfNotBehindTargetBranch: true
+					changes: getPullRequestChangedFiles(data)
 				});
 				if (autoApprove && approverClient && pullRequestWasUpdated) await approverClient.approvePullRequest({
 					project,
 					repository,
-					pullRequestId: pullRequestToUpdate.id
+					pullRequestId: pullRequestToUpdate.pullRequestId
 				});
 				if (pullRequestWasUpdated) {
-					affectedPullRequestIds.get(id).updated.push(pullRequestToUpdate.id);
+					affectedPullRequestIds.get(id).updated.push(pullRequestToUpdate.pullRequestId);
 					return true;
 				}
 				return false;
@@ -133,11 +146,11 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 				if (await authorClient.abandonPullRequest({
 					project,
 					repository,
-					pullRequestId: pullRequestToClose.id,
-					comment: getPullRequestCloseReasonForOutputData(data),
+					pullRequestId: pullRequestToClose.pullRequestId,
+					comment: getPullRequestCloseReason(data),
 					deleteSourceBranch: true
 				})) {
-					affectedPullRequestIds.get(id).closed.push(pullRequestToClose.id);
+					affectedPullRequestIds.get(id).closed.push(pullRequestToClose.pullRequestId);
 					return true;
 				}
 				return false;
@@ -165,11 +178,11 @@ var AzureLocalDependabotServer = class extends LocalDependabotServer {
 			case "record_cooldown_meta":
 			case "record_metrics": return true;
 			case "record_update_job_error":
-				logger.error(`Update job error: ${data["error-type"]} ${JSON.stringify(data["error-details"])}`);
-				return true;
-			case "record_update_job_unknown_error":
-				logger.error(`Update job unknown error: ${data["error-type"]}, ${JSON.stringify(data["error-details"])}`);
+			case "record_update_job_unknown_error": {
+				const unknown = type === "record_update_job_unknown_error";
+				logger.error(`Update${unknown ? " unknown " : ""})job error: ${data["error-type"]} ${JSON.stringify(data["error-details"])}`);
 				return true;
+			}
 			default:
 				logger.warn(`Unknown dependabot request type '${type}', ignoring...`);
 				return true;
@@ -187,16 +200,23 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 		super({ ...options });
 		this.options = options;
 		const { url, gitToken, autoApprove, debug } = this.options;
-		this.authorClient = new AzureDevOpsWebApiClient(url, gitToken, debug);
-		this.approverClient = autoApprove ? new AzureDevOpsWebApiClient(url, options.autoApproveToken || gitToken, debug) : void 0;
+		this.authorClient = new AzureDevOpsClientWrapper(url, gitToken, debug);
+		this.approverClient = autoApprove ? new AzureDevOpsClientWrapper(url, options.autoApproveToken || gitToken, debug) : void 0;
 	}
 	async run() {
 		await super.run();
 		const { options: { url, port, config, targetUpdateIds, command }, authorClient, approverClient } = this;
 		if (config["multi-ecosystem-groups"] || config.updates?.some((u) => u["multi-ecosystem-group"])) logger.warn("Multi-ecosystem updates are not working yet. Only parsing and validation is supported at this time.");
 		if (config.updates?.some((u) => u["open-pull-requests-limit"] === 0)) logger.warn("Security-only updates incur a slight performance overhead due to limitations in Dependabot CLI. For more info, see: https://github.com/mburumaxwell/dependabot-azure-devops/blob/main/README.md#configuring-security-advisories-and-known-vulnerabilities");
-		const existingBranchNames = await authorClient.getBranchNames(url.project, url.repository);
-		const existingPullRequests = await authorClient.getActivePullRequestProperties(url.project, url.repository, await authorClient.getUserId());
+		const existingBranchNames = await authorClient.getBranchNames({
+			project: url.project,
+			repository: url.repository
+		});
+		const existingPullRequests = await authorClient.getActivePullRequestProperties({
+			project: url.project,
+			repository: url.repository,
+			creatorId: await authorClient.getUserId()
+		});
 		const server = new AzureLocalDependabotServer({
 			authorClient,
 			approverClient,
@@ -236,14 +256,14 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 		const { options: { url, dryRun }, authorClient } = this;
 		for (const pullRequestIndex in existingPullRequests) {
 			const pullRequest = existingPullRequests[pullRequestIndex];
-			const pullRequestSourceRefName = normalizeBranchName(pullRequest.properties?.find((x) => x.name === DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME)?.value);
+			const pullRequestSourceRefName = normalizeBranchName(pullRequest.properties?.find((x) => x.name === PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME)?.value);
 			if (pullRequestSourceRefName && !existingBranchNames.includes(pullRequestSourceRefName)) {
 				if (!dryRun) {
-					logger.warn(`Detected source branch for PR #${pullRequest.id} has been deleted; The pull request will be abandoned`);
+					logger.warn(`Detected source branch for PR #${pullRequest.pullRequestId} has been deleted; The pull request will be abandoned`);
 					await authorClient.abandonPullRequest({
 						project: url.project,
 						repository: url.repository,
-						pullRequestId: pullRequest.id,
+						pullRequestId: pullRequest.pullRequestId,
 						comment: "It might be a good idea to add an [`ignore` condition](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--) with the desired `update-types` to your config file."
 					});
 				}
@@ -297,9 +317,11 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 			let credentials;
 			let jobToken;
 			let credentialsToken;
-			let securityVulnerabilities = [];
-			let dependencyNamesToUpdate = [];
-			const securityUpdatesOnly = update["open-pull-requests-limit"] === 0;
+			const debug = this.options.debug;
+			const securityVulnerabilities = [];
+			const dependencyNamesToUpdate = [];
+			const openPullRequestsLimit = update["open-pull-requests-limit"];
+			const securityUpdatesOnly = openPullRequestsLimit === 0;
 			if (securityUpdatesOnly) {
 				const id = makeRandomJobId();
 				({job, credentials} = builder.forDependenciesList({
@@ -323,6 +345,7 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 					credentialsToken,
 					updaterImage,
 					secretMasker,
+					debug,
 					usage: makeUsageData(job)
 				});
 				const packagesToCheckForVulnerabilities = server.requests(id).find((o) => o.type === "update_dependency_list")?.data.dependencies?.map((d) => ({
@@ -335,15 +358,17 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 						const filePath = securityAdvisoriesFile;
 						if (existsSync(filePath)) {
 							const fileContents = await readFile(filePath, "utf-8");
-							securityVulnerabilities = await SecurityVulnerabilitySchema.array().parseAsync(JSON.parse(fileContents));
+							securityVulnerabilities.push(...await SecurityVulnerabilitySchema.array().parseAsync(JSON.parse(fileContents)));
 						} else logger.info(`Private security advisories file '${filePath}' does not exist`);
 					}
 					if (githubToken) {
 						const githubVulnerabilities = await new GitHubSecurityAdvisoryClient(githubToken).getSecurityVulnerabilitiesAsync(getGhsaPackageEcosystemFromDependabotPackageManager(packageManager), packagesToCheckForVulnerabilities || []);
 						securityVulnerabilities.push(...githubVulnerabilities);
 					} else logger.info("GitHub access token is not provided; Checking for vulnerabilities from GitHub is skipped. This is not an issue if you are using private security advisories file.");
-					securityVulnerabilities = filterVulnerabilities(securityVulnerabilities);
-					dependencyNamesToUpdate = Array.from(new Set(securityVulnerabilities.map((v) => v.package.name)));
+					const filtered = filterVulnerabilities(securityVulnerabilities);
+					securityVulnerabilities.splice(0);
+					securityVulnerabilities.push(...filtered);
+					dependencyNamesToUpdate.push(...Array.from(new Set(securityVulnerabilities.map((v) => v.package.name))));
 					logger.info(`Detected ${securityVulnerabilities.length} vulnerabilities affecting ${dependencyNamesToUpdate.length} dependencies`);
 					if (dependencyNamesToUpdate.length) logger.trace(dependencyNamesToUpdate);
 				} else {
@@ -353,7 +378,6 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 				}
 				server.clear(id);
 			}
-			const openPullRequestsLimit = update["open-pull-requests-limit"];
 			const openPullRequestsCount = Object.entries(existingPullRequestsForPackageManager).length;
 			if (!(openPullRequestsLimit > 0 && openPullRequestsCount >= openPullRequestsLimit)) {
 				const dependenciesHaveVulnerabilities = dependencyNamesToUpdate.length && securityVulnerabilities.length;
@@ -383,6 +407,7 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 						credentialsToken,
 						updaterImage,
 						secretMasker,
+						debug,
 						usage: makeUsageData(job)
 					});
 					const affectedPrs = server.allAffectedPrs(id);
@@ -422,6 +447,7 @@ var AzureLocalJobsRunner = class extends LocalJobsRunner {
 					credentialsToken,
 					updaterImage,
 					secretMasker,
+					debug,
 					usage: makeUsageData(job)
 				});
 				const affectedPrs = server.allAffectedPrs(id);

package/dist/local/azure/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["updates: DependabotUpdate[]","results: RunJobsResult","job: DependabotJobConfig | undefined","credentials: DependabotCredential[] | undefined","jobToken: string","credentialsToken: string","securityVulnerabilities: SecurityVulnerability[]","dependencyNamesToUpdate: string[]","packagesToCheckForVulnerabilities: Package[] | undefined"],"sources":["../../../src/local/azure/server.ts","../../../src/local/azure/runner.ts"],"sourcesContent":["import type { AzureDevOpsRepositoryUrl, AzureDevOpsWebApiClient, IPullRequestProperties } from '@paklo/core/azure';\nimport {\n  type AzdoPullRequestMergeStrategy,\n  buildPullRequestProperties,\n  getPullRequestChangedFilesForOutputData,\n  getPullRequestCloseReasonForOutputData,\n  getPullRequestDependenciesPropertyValueForOutputData,\n  getPullRequestDescription,\n  getPullRequestForDependencyNames,\n  parsePullRequestProperties,\n} from '@paklo/core/azure';\nimport { type DependabotRequest, getBranchNameForUpdate } from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport { LocalDependabotServer, type LocalDependabotServerOptions } from '../server';\n\nexport type AzureLocalDependabotServerOptions = LocalDependabotServerOptions & {\n  url: AzureDevOpsRepositoryUrl;\n  authorClient: AzureDevOpsWebApiClient;\n  autoApprove: boolean;\n  approverClient?: AzureDevOpsWebApiClient;\n  setAutoComplete: boolean;\n  mergeStrategy?: AzdoPullRequestMergeStrategy;\n  autoCompleteIgnoreConfigIds: number[];\n  existingBranchNames: string[] | undefined;\n  existingPullRequests: IPullRequestProperties[];\n};\n\nexport class AzureLocalDependabotServer extends LocalDependabotServer {\n  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: options is used\n  private readonly options: AzureLocalDependabotServerOptions;\n\n  constructor(options: AzureLocalDependabotServerOptions) {\n    super(options);\n    this.options = options;\n  }\n\n  protected override async handle(id: string, request: DependabotRequest): Promise<boolean> {\n    await super.handle(id, request); // common logic\n\n    const { options, affectedPullRequestIds } = this;\n    const {\n      url,\n      authorClient,\n      approverClient,\n      existingBranchNames,\n      existingPullRequests,\n      autoApprove,\n      mergeStrategy,\n      setAutoComplete,\n      autoCompleteIgnoreConfigIds,\n      author,\n      dryRun,\n    } = options;\n\n    const { type, data } = request;\n    const job = await this.job(id);\n    if (!job) {\n      logger.error(`No job found for ID '${id}', cannot process request of type '${type}'`);\n      return false;\n    }\n    const { 'package-manager': packageManager } = job;\n    logger.info(`Processing '${type}' for job ID '${id}'`);\n\n    const update = this.update(id)!; // exists because job exists\n    const { project, repository } = url;\n\n    switch (type) {\n      // Documentation on the 'data' model for each output type can be found here:\n      // See: https://github.com/dependabot/cli/blob/main/internal/model/update.go\n\n      case 'create_pull_request': {\n        const title = data['pr-title'];\n        if (dryRun) {\n          logger.warn(`Skipping pull request creation of '${title}' as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // Skip if active pull request limit reached.\n        const openPullRequestsLimit = update['open-pull-requests-limit']!;\n\n        // Parse the Dependabot metadata for the existing pull requests that are related to this update\n        // Dependabot will use this to determine if we need to create new pull requests or update/close existing ones\n        const existingPullRequestsForPackageManager = parsePullRequestProperties(existingPullRequests, packageManager);\n        const existingPullRequestsCount = Object.entries(existingPullRequestsForPackageManager).length;\n        const openPullRequestsCount = affectedPullRequestIds.get(id)!.created.length + existingPullRequestsCount;\n        const hasReachedOpenPullRequestLimit =\n          openPullRequestsLimit > 0 && openPullRequestsCount >= openPullRequestsLimit;\n\n        if (hasReachedOpenPullRequestLimit) {\n          logger.warn(\n            `Skipping pull request creation of '${title}' as the open pull requests limit (${openPullRequestsLimit}) has been reached`,\n          );\n          return true;\n        }\n\n        const changedFiles = getPullRequestChangedFilesForOutputData(data);\n        const dependencies = getPullRequestDependenciesPropertyValueForOutputData(data);\n        const targetBranch = update['target-branch'] || (await authorClient.getDefaultBranch(project, repository));\n        const sourceBranch = getBranchNameForUpdate(\n          update['package-ecosystem'],\n          targetBranch,\n          update.directory || update.directories?.find((dir) => changedFiles[0]?.path?.startsWith(dir)),\n          !Array.isArray(dependencies) ? dependencies['dependency-group-name'] : undefined,\n          !Array.isArray(dependencies) ? dependencies.dependencies : dependencies,\n          update['pull-request-branch-name']?.separator,\n        );\n\n        // Check if the source branch already exists or conflicts with an existing branch\n        const existingBranch = existingBranchNames?.find((branch) => sourceBranch === branch) || [];\n        if (existingBranch.length) {\n          logger.error(\n            `Unable to create pull request '${title}' as source branch '${sourceBranch}' already exists; Delete the existing branch and try again.`,\n          );\n          return false;\n        }\n        const conflictingBranches = existingBranchNames?.filter((branch) => sourceBranch.startsWith(branch)) || [];\n        if (conflictingBranches.length) {\n          logger.error(\n            `Unable to create pull request '${title}' as source branch '${sourceBranch}' would conflict with existing branch(es) '${conflictingBranches.join(', ')}'; Delete the conflicting branch(es) and try again.`,\n          );\n          return false;\n        }\n\n        // Create a new pull request\n        const newPullRequestId = await authorClient.createPullRequest({\n          project: project,\n          repository: repository,\n          source: {\n            commit: data['base-commit-sha'] || job.source.commit!,\n            branch: sourceBranch,\n          },\n          target: {\n            branch: targetBranch!,\n          },\n          author,\n          title,\n          description: getPullRequestDescription(packageManager, data['pr-body'], data.dependencies),\n          commitMessage: data['commit-message'],\n          autoComplete: setAutoComplete\n            ? {\n                ignorePolicyConfigIds: autoCompleteIgnoreConfigIds,\n                mergeStrategy: mergeStrategy ?? 'squash',\n              }\n            : undefined,\n          assignees: update.assignees,\n          labels: update.labels?.map((label) => label?.trim()) || [],\n          workItems: update.milestone ? [update.milestone] : [],\n          changes: changedFiles,\n          properties: buildPullRequestProperties(packageManager, dependencies),\n        });\n\n        // Auto-approve the pull request, if required\n        if (autoApprove && approverClient && newPullRequestId) {\n          await approverClient.approvePullRequest({\n            project: project,\n            repository: repository,\n            pullRequestId: newPullRequestId,\n          });\n        }\n\n        // Store the new pull request ID, so we can keep track of the total number of open pull requests\n        if (newPullRequestId && newPullRequestId > 0) {\n          affectedPullRequestIds.get(id)!.created.push(newPullRequestId);\n          return true;\n        } else {\n          return false;\n        }\n      }\n\n      case 'update_pull_request': {\n        if (dryRun) {\n          logger.warn(`Skipping pull request update as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // Find the pull request to update\n        const pullRequestToUpdate = getPullRequestForDependencyNames(\n          existingPullRequests,\n          packageManager,\n          data['dependency-names'],\n        );\n        if (!pullRequestToUpdate) {\n          logger.error(\n            `Could not find pull request to update for package manager '${packageManager}' with dependencies '${data['dependency-names'].join(', ')}'`,\n          );\n          return false;\n        }\n\n        // Update the pull request\n        const pullRequestWasUpdated = await authorClient.updatePullRequest({\n          project: project,\n          repository: repository,\n          pullRequestId: pullRequestToUpdate.id,\n          commit: data['base-commit-sha'] || job.source.commit!,\n          author,\n          changes: getPullRequestChangedFilesForOutputData(data),\n          skipIfDraft: true,\n          skipIfCommitsFromAuthorsOtherThan: author.email,\n          skipIfNotBehindTargetBranch: true,\n        });\n\n        // Re-approve the pull request, if required\n        if (autoApprove && approverClient && pullRequestWasUpdated) {\n          await approverClient.approvePullRequest({\n            project: project,\n            repository: repository,\n            pullRequestId: pullRequestToUpdate.id,\n          });\n        }\n\n        if (pullRequestWasUpdated) {\n          affectedPullRequestIds.get(id)!.updated.push(pullRequestToUpdate.id);\n          return true;\n        }\n        return false;\n      }\n\n      case 'close_pull_request': {\n        if (dryRun) {\n          logger.warn(`Skipping pull request closure as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // Find the pull request to close\n        const pullRequestToClose = getPullRequestForDependencyNames(\n          existingPullRequests,\n          packageManager,\n          data['dependency-names'],\n        );\n        if (!pullRequestToClose) {\n          logger.error(\n            `Could not find pull request to close for package manager '${packageManager}' with dependencies '${data['dependency-names'].join(', ')}'`,\n          );\n          return false;\n        }\n\n        // TODO: GitHub Dependabot will close with reason \"Superseded by ${new_pull_request_id}\" when another PR supersedes it.\n        //       How do we detect this? Do we need to?\n\n        // Close the pull request\n        const success = await authorClient.abandonPullRequest({\n          project: project,\n          repository: repository,\n          pullRequestId: pullRequestToClose.id,\n          comment: getPullRequestCloseReasonForOutputData(data),\n          deleteSourceBranch: true,\n        });\n        if (success) {\n          affectedPullRequestIds.get(id)!.closed.push(pullRequestToClose.id);\n          return true;\n        }\n        return false;\n      }\n\n      case 'record_update_job_warning': {\n        if (dryRun) {\n          logger.warn(`Skipping warning as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // add comment to each create/updated pull request\n        const ids = affectedPullRequestIds.get(id)!.created.concat(affectedPullRequestIds.get(id)!.updated);\n        for (const pullRequestId of ids) {\n          await authorClient.addCommentThread({\n            project: project,\n            repository: repository,\n            content: `### Dependabot Warning: ${data['warn-title']}\\n\\n${data['warn-description']}`,\n            pullRequestId,\n          });\n        }\n\n        return true;\n      }\n\n      // No action required\n      case 'update_dependency_list':\n      case 'create_dependency_submission':\n      case 'mark_as_processed':\n      case 'record_ecosystem_versions':\n      case 'increment_metric':\n      case 'record_ecosystem_meta':\n      case 'record_cooldown_meta':\n      case 'record_metrics': // from the runner\n        return true;\n\n      case 'record_update_job_error':\n        logger.error(`Update job error: ${data['error-type']} ${JSON.stringify(data['error-details'])}`);\n        return true;\n\n      case 'record_update_job_unknown_error':\n        logger.error(`Update job unknown error: ${data['error-type']}, ${JSON.stringify(data['error-details'])}`);\n        return true;\n\n      default:\n        logger.warn(`Unknown dependabot request type '${type}', ignoring...`);\n        return true;\n    }\n  }\n}\n","import { existsSync } from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport {\n  AzureDevOpsWebApiClient,\n  DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME,\n  type IPullRequestProperties,\n  normalizeBranchName,\n  parsePullRequestProperties,\n} from '@paklo/core/azure';\nimport {\n  type DependabotCredential,\n  DependabotJobBuilder,\n  type DependabotJobConfig,\n  type DependabotUpdate,\n  mapPackageEcosystemToPackageManager,\n} from '@paklo/core/dependabot';\nimport {\n  filterVulnerabilities,\n  GitHubSecurityAdvisoryClient,\n  getGhsaPackageEcosystemFromDependabotPackageManager,\n  type Package,\n  type SecurityVulnerability,\n  SecurityVulnerabilitySchema,\n} from '@paklo/core/github';\nimport { logger } from '@paklo/core/logger';\nimport { type RunJobOptions, runJob } from '../../run';\nimport { LocalJobsRunner, type LocalJobsRunnerOptions, type RunJobsResult } from '../runner';\nimport { AzureLocalDependabotServer, type AzureLocalDependabotServerOptions } from './server';\n\nexport type AzureLocalJobsRunnerOptions = LocalJobsRunnerOptions &\n  Omit<\n    AzureLocalDependabotServerOptions,\n    'authorClient' | 'approverClient' | 'existingBranchNames' | 'existingPullRequests'\n  > & {\n    port?: number;\n    securityAdvisoriesFile?: string;\n    gitToken: string;\n    githubToken?: string;\n    autoApproveToken?: string;\n  };\n\nexport class AzureLocalJobsRunner extends LocalJobsRunner {\n  // biome-ignore-start lint/correctness/noUnusedPrivateClassMembers: variables are used\n  private readonly options: AzureLocalJobsRunnerOptions;\n  private readonly authorClient: AzureDevOpsWebApiClient;\n  private readonly approverClient?: AzureDevOpsWebApiClient;\n  // biome-ignore-end lint/correctness/noUnusedPrivateClassMembers: variables are used\n\n  constructor(options: AzureLocalJobsRunnerOptions) {\n    super({ ...options });\n    this.options = options;\n    const { url, gitToken, autoApprove, debug } = this.options;\n\n    // Initialise the DevOps API clients (one for authoring the other for auto-approving (if configured))\n    this.authorClient = new AzureDevOpsWebApiClient(url, gitToken, debug);\n    this.approverClient = autoApprove\n      ? new AzureDevOpsWebApiClient(url, options.autoApproveToken || gitToken, debug)\n      : undefined;\n  }\n\n  public override async run(): Promise<RunJobsResult> {\n    await super.run(); // common logic\n\n    const {\n      options: { url, port, config, targetUpdateIds, command },\n      authorClient,\n      approverClient,\n    } = this;\n\n    // Print a warning about multi-ecosystem updates not being fully supported\n    // TODO: Implement full support for multi-ecosystem updates (not sure this will be possible on the local model)\n    if (config['multi-ecosystem-groups'] || config.updates?.some((u) => u['multi-ecosystem-group'])) {\n      logger.warn(\n        'Multi-ecosystem updates are not working yet. Only parsing and validation is supported at this time.',\n      );\n    }\n\n    // Print a warning about the required workarounds for security-only updates, if any update is configured as such\n    // TODO: If and when Dependabot supports a better way to do security-only updates, remove this.\n    if (config.updates?.some((u) => u['open-pull-requests-limit'] === 0)) {\n      logger.warn(\n        'Security-only updates incur a slight performance overhead due to limitations in Dependabot CLI. For more info, see: https://github.com/mburumaxwell/dependabot-azure-devops/blob/main/README.md#configuring-security-advisories-and-known-vulnerabilities',\n      );\n    }\n\n    // Fetch the active pull requests created by the author user\n    const existingBranchNames = await authorClient.getBranchNames(url.project, url.repository);\n    const existingPullRequests = await authorClient.getActivePullRequestProperties(\n      url.project,\n      url.repository,\n      await authorClient.getUserId(),\n    );\n\n    // Prepare local server\n    const serverOptions: AzureLocalDependabotServerOptions = {\n      authorClient,\n      approverClient,\n      existingBranchNames,\n      existingPullRequests,\n      ...this.options,\n    };\n    const server = new AzureLocalDependabotServer(serverOptions);\n    server.start(port);\n    // give the server a second to start\n    await new Promise((resolve) => setTimeout(resolve, 1000));\n\n    // The API urls is constant when working in this CLI. Asking people to setup NGROK or similar just to get\n    // HTTPS for the job token to be used is too much hassle.\n    // Using same value for dependabotApiUrl and dependabotApiDockerUrl so as to capture /record_metrics calls.\n    const dependabotApiUrl = `http://host.docker.internal:${server.port}/api`;\n    const dependabotApiDockerUrl = dependabotApiUrl;\n\n    // If update identifiers are specified, select them; otherwise handle all\n    let updates: DependabotUpdate[] = [];\n    if (targetUpdateIds && targetUpdateIds.length > 0) {\n      for (const id of targetUpdateIds) {\n        const upd = config.updates[id];\n        if (!upd) {\n          logger.warn(\n            `\n            Unable to find target update id '${id}'.\n            This value should be a zero based index of the update in your config file.\n            Expected range: 0-${config.updates.length - 1}\n            `,\n          );\n        } else {\n          updates.push(upd);\n        }\n      }\n    } else {\n      updates = config.updates;\n    }\n\n    try {\n      // Abandon all pull requests where the source branch has been deleted\n      await this.abandonPullRequestsWhereSourceRefIsDeleted(existingBranchNames, existingPullRequests);\n\n      // Perform updates for each of the [targeted] update blocks in dependabot.yaml\n      return await this.performUpdates(\n        server,\n        updates,\n        existingPullRequests,\n        dependabotApiUrl,\n        dependabotApiDockerUrl,\n        command,\n      );\n    } finally {\n      server.stop();\n    }\n  }\n\n  /**\n   * Abandon all pull requests where the source branch has been deleted.\n   * @param existingBranchNames The names of the existing branches.\n   * @param existingPullRequests The existing pull requests.\n   */\n  private async abandonPullRequestsWhereSourceRefIsDeleted(\n    existingBranchNames?: string[],\n    existingPullRequests?: IPullRequestProperties[],\n  ): Promise<void> {\n    if (!existingBranchNames || !existingPullRequests) return;\n\n    const {\n      options: { url, dryRun },\n      authorClient,\n    } = this;\n    for (const pullRequestIndex in existingPullRequests) {\n      const pullRequest = existingPullRequests[pullRequestIndex]!;\n      const pullRequestSourceRefName = normalizeBranchName(\n        pullRequest.properties?.find((x) => x.name === DEVOPS_PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME)?.value,\n      );\n      if (pullRequestSourceRefName && !existingBranchNames.includes(pullRequestSourceRefName)) {\n        // The source branch for the pull request has been deleted; abandon the pull request (if not dry run)\n        if (!dryRun) {\n          logger.warn(\n            `Detected source branch for PR #${pullRequest.id} has been deleted; The pull request will be abandoned`,\n          );\n          await authorClient.abandonPullRequest({\n            project: url.project,\n            repository: url.repository,\n            pullRequestId: pullRequest.id,\n            // comment:\n            //   'OK, I won't notify you again about this release, but will get in touch when a new version is available. ' +\n            //   'If you'd rather skip all updates until the next major or minor version, add an ' +\n            //   '[`ignore` condition](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--) ' +\n            //   'with the desired `update-types` to your config file.',\n            comment:\n              'It might be a good idea to add an ' +\n              '[`ignore` condition](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--) ' +\n              'with the desired `update-types` to your config file.',\n          });\n        }\n        // Remove the pull request from the list of existing pull requests to ensures that we don't attempt to update it later in the process.\n        existingPullRequests.splice(existingPullRequests.indexOf(pullRequest), 1);\n      }\n    }\n  }\n\n  /**\n   * Performs the updates.\n   * @param server The local Dependabot server.\n   * @param updates The updates to perform.\n   * @param existingPullRequests The existing pull requests.\n   */\n  private async performUpdates(\n    server: AzureLocalDependabotServer,\n    updates: DependabotUpdate[],\n    existingPullRequests: IPullRequestProperties[],\n    dependabotApiUrl: string,\n    dependabotApiDockerUrl?: string,\n    command?: DependabotJobConfig['command'],\n  ): Promise<RunJobsResult> {\n    const {\n      options: { url, gitToken, githubToken, experiments, config, dryRun, securityAdvisoriesFile, secretMasker },\n    } = this;\n\n    const results: RunJobsResult = [];\n\n    function makeRandomJobId(): string {\n      const array = new Uint32Array(1);\n      crypto.getRandomValues(array);\n      return `${array[0]! % 10000000000}`; // Limit to 10 digits to match GitHub's job IDs\n    }\n\n    function makeUsageData(job: DependabotJobConfig): RunJobOptions['usage'] {\n      return {\n        trigger: 'user',\n        provider: job.source.provider,\n        owner: url.value.toString(),\n        project: `${url.value.toString().replace(/\\/$/, '')}/${url.project}`,\n        'package-manager': job['package-manager'],\n      };\n    }\n\n    for (const update of updates) {\n      const packageEcosystem = update['package-ecosystem'];\n      const packageManager = mapPackageEcosystemToPackageManager(packageEcosystem);\n\n      // If there is an updater image, replace the placeholder in it\n      let { updaterImage } = this.options;\n      updaterImage = updaterImage?.replace(/\\{ecosystem\\}/i, packageEcosystem);\n\n      // Parse the Dependabot metadata for the existing pull requests that are related to this update\n      // Dependabot will use this to determine if we need to create new pull requests or update/close existing ones\n      const existingPullRequestsForPackageManager = parsePullRequestProperties(existingPullRequests, packageManager);\n      const existingPullRequestDependenciesForPackageManager = Object.values(existingPullRequestsForPackageManager);\n\n      const builder = new DependabotJobBuilder({\n        source: { provider: 'azure', ...url },\n        config,\n        update,\n        systemAccessToken: gitToken,\n        githubToken,\n        experiments,\n        debug: false,\n      });\n\n      let job: DependabotJobConfig | undefined;\n      let credentials: DependabotCredential[] | undefined;\n      let jobToken: string;\n      let credentialsToken: string;\n\n      // If this is a security-only update (i.e. 'open-pull-requests-limit: 0'), then we first need to discover the dependencies\n      // that need updating and check each one for vulnerabilities. This is because Dependabot requires the list of vulnerable dependencies\n      // to be supplied in the job definition of security-only update job, it will not automatically discover them like a versioned update does.\n      // https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#overriding-the-default-behavior-with-a-configuration-file\n      let securityVulnerabilities: SecurityVulnerability[] = [];\n      let dependencyNamesToUpdate: string[] = [];\n      const securityUpdatesOnly = update['open-pull-requests-limit'] === 0;\n      if (securityUpdatesOnly) {\n        // Run an update job to discover all dependencies\n        const id = makeRandomJobId();\n        ({ job, credentials } = builder.forDependenciesList({ id, command }));\n        ({ jobToken, credentialsToken } = this.makeTokens());\n        server.add({ id, update, job, jobToken, credentialsToken, credentials });\n        await runJob({\n          dependabotApiUrl,\n          dependabotApiDockerUrl,\n          jobId: id,\n          jobToken,\n          credentialsToken,\n          updaterImage,\n          secretMasker,\n          usage: makeUsageData(job),\n        });\n\n        const outputs = server.requests(id);\n        const packagesToCheckForVulnerabilities: Package[] | undefined = outputs!\n          .find((o) => o.type === 'update_dependency_list')\n          ?.data.dependencies?.map((d) => ({ name: d.name, version: d.version }));\n        if (packagesToCheckForVulnerabilities?.length) {\n          logger.info(\n            `Detected ${packagesToCheckForVulnerabilities.length} dependencies; Checking for vulnerabilities...`,\n          );\n\n          // parse security advisories from file (private)\n          if (securityAdvisoriesFile) {\n            const filePath = securityAdvisoriesFile;\n            if (existsSync(filePath)) {\n              const fileContents = await readFile(filePath, 'utf-8');\n              securityVulnerabilities = await SecurityVulnerabilitySchema.array().parseAsync(JSON.parse(fileContents));\n            } else {\n              logger.info(`Private security advisories file '${filePath}' does not exist`);\n            }\n          }\n          if (githubToken) {\n            const ghsaClient = new GitHubSecurityAdvisoryClient(githubToken);\n            const githubVulnerabilities = await ghsaClient.getSecurityVulnerabilitiesAsync(\n              getGhsaPackageEcosystemFromDependabotPackageManager(packageManager),\n              packagesToCheckForVulnerabilities || [],\n            );\n            securityVulnerabilities.push(...githubVulnerabilities);\n          } else {\n            logger.info(\n              'GitHub access token is not provided; Checking for vulnerabilities from GitHub is skipped. ' +\n                'This is not an issue if you are using private security advisories file.',\n            );\n          }\n\n          securityVulnerabilities = filterVulnerabilities(securityVulnerabilities);\n\n          // Only update dependencies that have vulnerabilities\n          dependencyNamesToUpdate = Array.from(new Set(securityVulnerabilities.map((v) => v.package.name)));\n          logger.info(\n            `Detected ${securityVulnerabilities.length} vulnerabilities affecting ${dependencyNamesToUpdate.length} dependencies`,\n          );\n          if (dependencyNamesToUpdate.length) {\n            logger.trace(dependencyNamesToUpdate);\n          }\n        } else {\n          logger.info(`No vulnerabilities detected for update ${update['package-ecosystem']} in ${update.directory}`);\n          server.clear(id);\n          continue; // nothing more to do for this update\n        }\n\n        server.clear(id);\n      }\n\n      // Run an update job for \"all dependencies\"; this will create new pull requests for dependencies that need updating\n      const openPullRequestsLimit = update['open-pull-requests-limit']!;\n      const openPullRequestsCount = Object.entries(existingPullRequestsForPackageManager).length;\n      const hasReachedOpenPullRequestLimit =\n        openPullRequestsLimit > 0 && openPullRequestsCount >= openPullRequestsLimit;\n      if (!hasReachedOpenPullRequestLimit) {\n        const dependenciesHaveVulnerabilities = dependencyNamesToUpdate.length && securityVulnerabilities.length;\n        if (!securityUpdatesOnly || dependenciesHaveVulnerabilities) {\n          const id = makeRandomJobId();\n          ({ job, credentials } = builder.forUpdate({\n            id,\n            command,\n            dependencyNamesToUpdate,\n            existingPullRequests: existingPullRequestDependenciesForPackageManager,\n            securityVulnerabilities,\n          }));\n          ({ jobToken, credentialsToken } = this.makeTokens());\n          server.add({ id, update, job, jobToken, credentialsToken, credentials });\n          const { success, message } = await runJob({\n            dependabotApiUrl,\n            dependabotApiDockerUrl,\n            jobId: id,\n            jobToken,\n            credentialsToken,\n            updaterImage,\n            secretMasker,\n            usage: makeUsageData(job),\n          });\n          const affectedPrs = server.allAffectedPrs(id);\n          server.clear(id);\n          results.push({ id, success, message, affectedPrs });\n        } else {\n          logger.info('Nothing to update; dependencies are not affected by any known vulnerability');\n        }\n      } else {\n        logger.warn(\n          `Skipping update for ${packageEcosystem} packages as the open pull requests limit (${openPullRequestsLimit}) has already been reached`,\n        );\n      }\n\n      // If there are existing pull requests, run an update job for each one; this will resolve merge conflicts and close pull requests that are no longer needed\n      const numberOfPullRequestsToUpdate = Object.keys(existingPullRequestsForPackageManager).length;\n      if (numberOfPullRequestsToUpdate > 0) {\n        if (!dryRun) {\n          for (const pullRequestId in existingPullRequestsForPackageManager) {\n            const id = makeRandomJobId();\n            ({ job, credentials } = builder.forUpdate({\n              id,\n              command,\n              existingPullRequests: existingPullRequestDependenciesForPackageManager,\n              pullRequestToUpdate: existingPullRequestsForPackageManager[pullRequestId]!,\n              securityVulnerabilities,\n            }));\n            ({ jobToken, credentialsToken } = this.makeTokens());\n            server.add({ id, update, job, jobToken, credentialsToken, credentials });\n            const { success, message } = await runJob({\n              dependabotApiUrl,\n              dependabotApiDockerUrl,\n              jobId: id,\n              jobToken,\n              credentialsToken,\n              updaterImage,\n              secretMasker,\n              usage: makeUsageData(job),\n            });\n            const affectedPrs = server.allAffectedPrs(id);\n            server.clear(id);\n            results.push({ id, success, message, affectedPrs });\n          }\n        } else {\n          logger.warn(\n            `Skipping update of ${numberOfPullRequestsToUpdate} existing ${packageEcosystem} package pull request(s) as 'dryRun' is set to 'true'`,\n          );\n        }\n      }\n    }\n\n    return results;\n  }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAa,6BAAb,cAAgD,sBAAsB;CAEpE,AAAiB;CAEjB,YAAY,SAA4C;AACtD,QAAM,QAAQ;AACd,OAAK,UAAU;;CAGjB,MAAyB,OAAO,IAAY,SAA8C;AACxF,QAAM,MAAM,OAAO,IAAI,QAAQ;EAE/B,MAAM,EAAE,SAAS,2BAA2B;EAC5C,MAAM,EACJ,KACA,cACA,gBACA,qBACA,sBACA,aACA,eACA,iBACA,6BACA,QACA,WACE;EAEJ,MAAM,EAAE,MAAM,SAAS;EACvB,MAAM,MAAM,MAAM,KAAK,IAAI,GAAG;AAC9B,MAAI,CAAC,KAAK;AACR,UAAO,MAAM,wBAAwB,GAAG,qCAAqC,KAAK,GAAG;AACrF,UAAO;;EAET,MAAM,EAAE,mBAAmB,mBAAmB;AAC9C,SAAO,KAAK,eAAe,KAAK,gBAAgB,GAAG,GAAG;EAEtD,MAAM,SAAS,KAAK,OAAO,GAAG;EAC9B,MAAM,EAAE,SAAS,eAAe;AAEhC,UAAQ,MAAR;GAIE,KAAK,uBAAuB;IAC1B,MAAM,QAAQ,KAAK;AACnB,QAAI,QAAQ;AACV,YAAO,KAAK,sCAAsC,MAAM,gCAAgC;AACxF,YAAO;;IAIT,MAAM,wBAAwB,OAAO;IAIrC,MAAM,wCAAwC,2BAA2B,sBAAsB,eAAe;IAC9G,MAAM,4BAA4B,OAAO,QAAQ,sCAAsC,CAAC;IACxF,MAAM,wBAAwB,uBAAuB,IAAI,GAAG,CAAE,QAAQ,SAAS;AAI/E,QAFE,wBAAwB,KAAK,yBAAyB,uBAEpB;AAClC,YAAO,KACL,sCAAsC,MAAM,qCAAqC,sBAAsB,oBACxG;AACD,YAAO;;IAGT,MAAM,eAAe,wCAAwC,KAAK;IAClE,MAAM,eAAe,qDAAqD,KAAK;IAC/E,MAAM,eAAe,OAAO,oBAAqB,MAAM,aAAa,iBAAiB,SAAS,WAAW;IACzG,MAAM,eAAe,uBACnB,OAAO,sBACP,cACA,OAAO,aAAa,OAAO,aAAa,MAAM,QAAQ,aAAa,IAAI,MAAM,WAAW,IAAI,CAAC,EAC7F,CAAC,MAAM,QAAQ,aAAa,GAAG,aAAa,2BAA2B,QACvE,CAAC,MAAM,QAAQ,aAAa,GAAG,aAAa,eAAe,cAC3D,OAAO,6BAA6B,UACrC;AAID,SADuB,qBAAqB,MAAM,WAAW,iBAAiB,OAAO,IAAI,EAAE,EACxE,QAAQ;AACzB,YAAO,MACL,kCAAkC,MAAM,sBAAsB,aAAa,6DAC5E;AACD,YAAO;;IAET,MAAM,sBAAsB,qBAAqB,QAAQ,WAAW,aAAa,WAAW,OAAO,CAAC,IAAI,EAAE;AAC1G,QAAI,oBAAoB,QAAQ;AAC9B,YAAO,MACL,kCAAkC,MAAM,sBAAsB,aAAa,6CAA6C,oBAAoB,KAAK,KAAK,CAAC,qDACxJ;AACD,YAAO;;IAIT,MAAM,mBAAmB,MAAM,aAAa,kBAAkB;KACnD;KACG;KACZ,QAAQ;MACN,QAAQ,KAAK,sBAAsB,IAAI,OAAO;MAC9C,QAAQ;MACT;KACD,QAAQ,EACN,QAAQ,cACT;KACD;KACA;KACA,aAAa,0BAA0B,gBAAgB,KAAK,YAAY,KAAK,aAAa;KAC1F,eAAe,KAAK;KACpB,cAAc,kBACV;MACE,uBAAuB;MACvB,eAAe,iBAAiB;MACjC,GACD;KACJ,WAAW,OAAO;KAClB,QAAQ,OAAO,QAAQ,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,EAAE;KAC1D,WAAW,OAAO,YAAY,CAAC,OAAO,UAAU,GAAG,EAAE;KACrD,SAAS;KACT,YAAY,2BAA2B,gBAAgB,aAAa;KACrE,CAAC;AAGF,QAAI,eAAe,kBAAkB,iBACnC,OAAM,eAAe,mBAAmB;KAC7B;KACG;KACZ,eAAe;KAChB,CAAC;AAIJ,QAAI,oBAAoB,mBAAmB,GAAG;AAC5C,4BAAuB,IAAI,GAAG,CAAE,QAAQ,KAAK,iBAAiB;AAC9D,YAAO;UAEP,QAAO;;GAIX,KAAK,uBAAuB;AAC1B,QAAI,QAAQ;AACV,YAAO,KAAK,4DAA4D;AACxE,YAAO;;IAIT,MAAM,sBAAsB,iCAC1B,sBACA,gBACA,KAAK,oBACN;AACD,QAAI,CAAC,qBAAqB;AACxB,YAAO,MACL,8DAA8D,eAAe,uBAAuB,KAAK,oBAAoB,KAAK,KAAK,CAAC,GACzI;AACD,YAAO;;IAIT,MAAM,wBAAwB,MAAM,aAAa,kBAAkB;KACxD;KACG;KACZ,eAAe,oBAAoB;KACnC,QAAQ,KAAK,sBAAsB,IAAI,OAAO;KAC9C;KACA,SAAS,wCAAwC,KAAK;KACtD,aAAa;KACb,mCAAmC,OAAO;KAC1C,6BAA6B;KAC9B,CAAC;AAGF,QAAI,eAAe,kBAAkB,sBACnC,OAAM,eAAe,mBAAmB;KAC7B;KACG;KACZ,eAAe,oBAAoB;KACpC,CAAC;AAGJ,QAAI,uBAAuB;AACzB,4BAAuB,IAAI,GAAG,CAAE,QAAQ,KAAK,oBAAoB,GAAG;AACpE,YAAO;;AAET,WAAO;;GAGT,KAAK,sBAAsB;AACzB,QAAI,QAAQ;AACV,YAAO,KAAK,6DAA6D;AACzE,YAAO;;IAIT,MAAM,qBAAqB,iCACzB,sBACA,gBACA,KAAK,oBACN;AACD,QAAI,CAAC,oBAAoB;AACvB,YAAO,MACL,6DAA6D,eAAe,uBAAuB,KAAK,oBAAoB,KAAK,KAAK,CAAC,GACxI;AACD,YAAO;;AAcT,QAPgB,MAAM,aAAa,mBAAmB;KAC3C;KACG;KACZ,eAAe,mBAAmB;KAClC,SAAS,uCAAuC,KAAK;KACrD,oBAAoB;KACrB,CAAC,EACW;AACX,4BAAuB,IAAI,GAAG,CAAE,OAAO,KAAK,mBAAmB,GAAG;AAClE,YAAO;;AAET,WAAO;;GAGT,KAAK,6BAA6B;AAChC,QAAI,QAAQ;AACV,YAAO,KAAK,gDAAgD;AAC5D,YAAO;;IAIT,MAAM,MAAM,uBAAuB,IAAI,GAAG,CAAE,QAAQ,OAAO,uBAAuB,IAAI,GAAG,CAAE,QAAQ;AACnG,SAAK,MAAM,iBAAiB,IAC1B,OAAM,aAAa,iBAAiB;KACzB;KACG;KACZ,SAAS,2BAA2B,KAAK,cAAc,MAAM,KAAK;KAClE;KACD,CAAC;AAGJ,WAAO;;GAIT,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,iBACH,QAAO;GAET,KAAK;AACH,WAAO,MAAM,qBAAqB,KAAK,cAAc,GAAG,KAAK,UAAU,KAAK,iBAAiB,GAAG;AAChG,WAAO;GAET,KAAK;AACH,WAAO,MAAM,6BAA6B,KAAK,cAAc,IAAI,KAAK,UAAU,KAAK,iBAAiB,GAAG;AACzG,WAAO;GAET;AACE,WAAO,KAAK,oCAAoC,KAAK,gBAAgB;AACrE,WAAO;;;;;;;AC9Pf,IAAa,uBAAb,cAA0C,gBAAgB;CAExD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,YAAY,SAAsC;AAChD,QAAM,EAAE,GAAG,SAAS,CAAC;AACrB,OAAK,UAAU;EACf,MAAM,EAAE,KAAK,UAAU,aAAa,UAAU,KAAK;AAGnD,OAAK,eAAe,IAAI,wBAAwB,KAAK,UAAU,MAAM;AACrE,OAAK,iBAAiB,cAClB,IAAI,wBAAwB,KAAK,QAAQ,oBAAoB,UAAU,MAAM,GAC7E;;CAGN,MAAsB,MAA8B;AAClD,QAAM,MAAM,KAAK;EAEjB,MAAM,EACJ,SAAS,EAAE,KAAK,MAAM,QAAQ,iBAAiB,WAC/C,cACA,mBACE;AAIJ,MAAI,OAAO,6BAA6B,OAAO,SAAS,MAAM,MAAM,EAAE,yBAAyB,CAC7F,QAAO,KACL,sGACD;AAKH,MAAI,OAAO,SAAS,MAAM,MAAM,EAAE,gCAAgC,EAAE,CAClE,QAAO,KACL,4PACD;EAIH,MAAM,sBAAsB,MAAM,aAAa,eAAe,IAAI,SAAS,IAAI,WAAW;EAC1F,MAAM,uBAAuB,MAAM,aAAa,+BAC9C,IAAI,SACJ,IAAI,YACJ,MAAM,aAAa,WAAW,CAC/B;EAUD,MAAM,SAAS,IAAI,2BAPsC;GACvD;GACA;GACA;GACA;GACA,GAAG,KAAK;GACT,CAC2D;AAC5D,SAAO,MAAM,KAAK;AAElB,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAK,CAAC;EAKzD,MAAM,mBAAmB,+BAA+B,OAAO,KAAK;EACpE,MAAM,yBAAyB;EAG/B,IAAIA,UAA8B,EAAE;AACpC,MAAI,mBAAmB,gBAAgB,SAAS,EAC9C,MAAK,MAAM,MAAM,iBAAiB;GAChC,MAAM,MAAM,OAAO,QAAQ;AAC3B,OAAI,CAAC,IACH,QAAO,KACL;+CACmC,GAAG;;gCAElB,OAAO,QAAQ,SAAS,EAAE;cAE/C;OAED,SAAQ,KAAK,IAAI;;MAIrB,WAAU,OAAO;AAGnB,MAAI;AAEF,SAAM,KAAK,2CAA2C,qBAAqB,qBAAqB;AAGhG,UAAO,MAAM,KAAK,eAChB,QACA,SACA,sBACA,kBACA,wBACA,QACD;YACO;AACR,UAAO,MAAM;;;;;;;;CASjB,MAAc,2CACZ,qBACA,sBACe;AACf,MAAI,CAAC,uBAAuB,CAAC,qBAAsB;EAEnD,MAAM,EACJ,SAAS,EAAE,KAAK,UAChB,iBACE;AACJ,OAAK,MAAM,oBAAoB,sBAAsB;GACnD,MAAM,cAAc,qBAAqB;GACzC,MAAM,2BAA2B,oBAC/B,YAAY,YAAY,MAAM,MAAM,EAAE,SAAS,iDAAiD,EAAE,MACnG;AACD,OAAI,4BAA4B,CAAC,oBAAoB,SAAS,yBAAyB,EAAE;AAEvF,QAAI,CAAC,QAAQ;AACX,YAAO,KACL,kCAAkC,YAAY,GAAG,uDAClD;AACD,WAAM,aAAa,mBAAmB;MACpC,SAAS,IAAI;MACb,YAAY,IAAI;MAChB,eAAe,YAAY;MAM3B,SACE;MAGH,CAAC;;AAGJ,yBAAqB,OAAO,qBAAqB,QAAQ,YAAY,EAAE,EAAE;;;;;;;;;;CAW/E,MAAc,eACZ,QACA,SACA,sBACA,kBACA,wBACA,SACwB;EACxB,MAAM,EACJ,SAAS,EAAE,KAAK,UAAU,aAAa,aAAa,QAAQ,QAAQ,wBAAwB,mBAC1F;EAEJ,MAAMC,UAAyB,EAAE;EAEjC,SAAS,kBAA0B;GACjC,MAAM,QAAQ,IAAI,YAAY,EAAE;AAChC,UAAO,gBAAgB,MAAM;AAC7B,UAAO,GAAG,MAAM,KAAM;;EAGxB,SAAS,cAAc,KAAkD;AACvE,UAAO;IACL,SAAS;IACT,UAAU,IAAI,OAAO;IACrB,OAAO,IAAI,MAAM,UAAU;IAC3B,SAAS,GAAG,IAAI,MAAM,UAAU,CAAC,QAAQ,OAAO,GAAG,CAAC,GAAG,IAAI;IAC3D,mBAAmB,IAAI;IACxB;;AAGH,OAAK,MAAM,UAAU,SAAS;GAC5B,MAAM,mBAAmB,OAAO;GAChC,MAAM,iBAAiB,oCAAoC,iBAAiB;GAG5E,IAAI,EAAE,iBAAiB,KAAK;AAC5B,kBAAe,cAAc,QAAQ,kBAAkB,iBAAiB;GAIxE,MAAM,wCAAwC,2BAA2B,sBAAsB,eAAe;GAC9G,MAAM,mDAAmD,OAAO,OAAO,sCAAsC;GAE7G,MAAM,UAAU,IAAI,qBAAqB;IACvC,QAAQ;KAAE,UAAU;KAAS,GAAG;KAAK;IACrC;IACA;IACA,mBAAmB;IACnB;IACA;IACA,OAAO;IACR,CAAC;GAEF,IAAIC;GACJ,IAAIC;GACJ,IAAIC;GACJ,IAAIC;GAMJ,IAAIC,0BAAmD,EAAE;GACzD,IAAIC,0BAAoC,EAAE;GAC1C,MAAM,sBAAsB,OAAO,gCAAgC;AACnE,OAAI,qBAAqB;IAEvB,MAAM,KAAK,iBAAiB;AAC5B,KAAC,CAAE,KAAK,eAAgB,QAAQ,oBAAoB;KAAE;KAAI;KAAS,CAAC;AACpE,KAAC,CAAE,UAAU,oBAAqB,KAAK,YAAY;AACnD,WAAO,IAAI;KAAE;KAAI;KAAQ;KAAK;KAAU;KAAkB;KAAa,CAAC;AACxE,UAAM,OAAO;KACX;KACA;KACA,OAAO;KACP;KACA;KACA;KACA;KACA,OAAO,cAAc,IAAI;KAC1B,CAAC;IAGF,MAAMC,oCADU,OAAO,SAAS,GAAG,CAEhC,MAAM,MAAM,EAAE,SAAS,yBAAyB,EAC/C,KAAK,cAAc,KAAK,OAAO;KAAE,MAAM,EAAE;KAAM,SAAS,EAAE;KAAS,EAAE;AACzE,QAAI,mCAAmC,QAAQ;AAC7C,YAAO,KACL,YAAY,kCAAkC,OAAO,gDACtD;AAGD,SAAI,wBAAwB;MAC1B,MAAM,WAAW;AACjB,UAAI,WAAW,SAAS,EAAE;OACxB,MAAM,eAAe,MAAM,SAAS,UAAU,QAAQ;AACtD,iCAA0B,MAAM,4BAA4B,OAAO,CAAC,WAAW,KAAK,MAAM,aAAa,CAAC;YAExG,QAAO,KAAK,qCAAqC,SAAS,kBAAkB;;AAGhF,SAAI,aAAa;MAEf,MAAM,wBAAwB,MADX,IAAI,6BAA6B,YAAY,CACjB,gCAC7C,oDAAoD,eAAe,EACnE,qCAAqC,EAAE,CACxC;AACD,8BAAwB,KAAK,GAAG,sBAAsB;WAEtD,QAAO,KACL,oKAED;AAGH,+BAA0B,sBAAsB,wBAAwB;AAGxE,+BAA0B,MAAM,KAAK,IAAI,IAAI,wBAAwB,KAAK,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC;AACjG,YAAO,KACL,YAAY,wBAAwB,OAAO,6BAA6B,wBAAwB,OAAO,eACxG;AACD,SAAI,wBAAwB,OAC1B,QAAO,MAAM,wBAAwB;WAElC;AACL,YAAO,KAAK,0CAA0C,OAAO,qBAAqB,MAAM,OAAO,YAAY;AAC3G,YAAO,MAAM,GAAG;AAChB;;AAGF,WAAO,MAAM,GAAG;;GAIlB,MAAM,wBAAwB,OAAO;GACrC,MAAM,wBAAwB,OAAO,QAAQ,sCAAsC,CAAC;AAGpF,OAAI,EADF,wBAAwB,KAAK,yBAAyB,wBACnB;IACnC,MAAM,kCAAkC,wBAAwB,UAAU,wBAAwB;AAClG,QAAI,CAAC,uBAAuB,iCAAiC;KAC3D,MAAM,KAAK,iBAAiB;AAC5B,MAAC,CAAE,KAAK,eAAgB,QAAQ,UAAU;MACxC;MACA;MACA;MACA,sBAAsB;MACtB;MACD,CAAC;AACF,MAAC,CAAE,UAAU,oBAAqB,KAAK,YAAY;AACnD,YAAO,IAAI;MAAE;MAAI;MAAQ;MAAK;MAAU;MAAkB;MAAa,CAAC;KACxE,MAAM,EAAE,SAAS,YAAY,MAAM,OAAO;MACxC;MACA;MACA,OAAO;MACP;MACA;MACA;MACA;MACA,OAAO,cAAc,IAAI;MAC1B,CAAC;KACF,MAAM,cAAc,OAAO,eAAe,GAAG;AAC7C,YAAO,MAAM,GAAG;AAChB,aAAQ,KAAK;MAAE;MAAI;MAAS;MAAS;MAAa,CAAC;UAEnD,QAAO,KAAK,8EAA8E;SAG5F,QAAO,KACL,uBAAuB,iBAAiB,6CAA6C,sBAAsB,4BAC5G;GAIH,MAAM,+BAA+B,OAAO,KAAK,sCAAsC,CAAC;AACxF,OAAI,+BAA+B,EACjC,KAAI,CAAC,OACH,MAAK,MAAM,iBAAiB,uCAAuC;IACjE,MAAM,KAAK,iBAAiB;AAC5B,KAAC,CAAE,KAAK,eAAgB,QAAQ,UAAU;KACxC;KACA;KACA,sBAAsB;KACtB,qBAAqB,sCAAsC;KAC3D;KACD,CAAC;AACF,KAAC,CAAE,UAAU,oBAAqB,KAAK,YAAY;AACnD,WAAO,IAAI;KAAE;KAAI;KAAQ;KAAK;KAAU;KAAkB;KAAa,CAAC;IACxE,MAAM,EAAE,SAAS,YAAY,MAAM,OAAO;KACxC;KACA;KACA,OAAO;KACP;KACA;KACA;KACA;KACA,OAAO,cAAc,IAAI;KAC1B,CAAC;IACF,MAAM,cAAc,OAAO,eAAe,GAAG;AAC7C,WAAO,MAAM,GAAG;AAChB,YAAQ,KAAK;KAAE;KAAI;KAAS;KAAS;KAAa,CAAC;;OAGrD,QAAO,KACL,sBAAsB,6BAA6B,YAAY,iBAAiB,uDACjF;;AAKP,SAAO"}
+{"version":3,"file":"index.mjs","names":["updates: DependabotUpdate[]","results: RunJobsResult","job: DependabotJobConfig | undefined","credentials: DependabotCredential[] | undefined","jobToken: string","credentialsToken: string","securityVulnerabilities: SecurityVulnerability[]","dependencyNamesToUpdate: string[]","packagesToCheckForVulnerabilities: Package[] | undefined"],"sources":["../../../src/local/azure/server.ts","../../../src/local/azure/runner.ts"],"sourcesContent":["import type {\n  AzdoPrExtractedWithProperties,\n  AzureDevOpsClientWrapper,\n  AzureDevOpsRepositoryUrl,\n} from '@paklo/core/azure';\nimport {\n  type AzdoPullRequestMergeStrategy,\n  buildPullRequestProperties,\n  getPullRequestChangedFiles,\n  getPullRequestForDependencyNames,\n  PR_DESCRIPTION_MAX_LENGTH,\n  parsePullRequestProperties,\n} from '@paklo/core/azure';\nimport {\n  type DependabotRequest,\n  getBranchNameForUpdate,\n  getPullRequestCloseReason,\n  getPullRequestDependencies,\n  getPullRequestDescription,\n} from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport { LocalDependabotServer, type LocalDependabotServerOptions } from '../server';\n\nexport type AzureLocalDependabotServerOptions = LocalDependabotServerOptions & {\n  url: AzureDevOpsRepositoryUrl;\n  authorClient: AzureDevOpsClientWrapper;\n  autoApprove: boolean;\n  approverClient?: AzureDevOpsClientWrapper;\n  setAutoComplete: boolean;\n  mergeStrategy?: AzdoPullRequestMergeStrategy;\n  autoCompleteIgnoreConfigIds: number[];\n  existingBranchNames: string[] | undefined;\n  existingPullRequests: AzdoPrExtractedWithProperties[];\n};\n\nexport class AzureLocalDependabotServer extends LocalDependabotServer {\n  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: options is used\n  private readonly options: AzureLocalDependabotServerOptions;\n\n  constructor(options: AzureLocalDependabotServerOptions) {\n    super(options);\n    this.options = options;\n  }\n\n  protected override async handle(id: string, request: DependabotRequest): Promise<boolean> {\n    await super.handle(id, request); // common logic\n\n    const { options, affectedPullRequestIds } = this;\n    const {\n      url,\n      authorClient,\n      approverClient,\n      existingBranchNames,\n      existingPullRequests,\n      autoApprove,\n      mergeStrategy,\n      setAutoComplete,\n      autoCompleteIgnoreConfigIds,\n      author,\n      dryRun,\n    } = options;\n\n    const { type, data } = request;\n    const job = await this.job(id);\n    if (!job) {\n      logger.error(`No job found for ID '${id}', cannot process request of type '${type}'`);\n      return false;\n    }\n    const { 'package-manager': packageManager } = job;\n    logger.info(`Processing '${type}' for job ID '${id}'`);\n\n    const update = this.update(id)!; // exists because job exists\n    const { project, repository } = url;\n\n    switch (type) {\n      // Documentation on the 'data' model for each output type can be found here:\n      // See: https://github.com/dependabot/cli/blob/main/internal/model/update.go\n\n      case 'create_pull_request': {\n        const title = data['pr-title'];\n        if (dryRun) {\n          logger.warn(`Skipping pull request creation of '${title}' as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // Skip if active pull request limit reached.\n        const openPullRequestsLimit = update['open-pull-requests-limit']!;\n\n        // Parse the Dependabot metadata for the existing pull requests that are related to this update\n        // Dependabot will use this to determine if we need to create new pull requests or update/close existing ones\n        const existingPullRequestsForPackageManager = parsePullRequestProperties(existingPullRequests, packageManager);\n        const existingPullRequestsCount = Object.entries(existingPullRequestsForPackageManager).length;\n        const openPullRequestsCount = affectedPullRequestIds.get(id)!.created.length + existingPullRequestsCount;\n        const hasReachedOpenPullRequestLimit =\n          openPullRequestsLimit > 0 && openPullRequestsCount >= openPullRequestsLimit;\n\n        if (hasReachedOpenPullRequestLimit) {\n          logger.warn(\n            `Skipping pull request creation of '${title}' as the open pull requests limit (${openPullRequestsLimit}) has been reached`,\n          );\n          return true;\n        }\n\n        const changedFiles = getPullRequestChangedFiles(data);\n        const dependencies = getPullRequestDependencies(data);\n        const targetBranch = update['target-branch'] || (await authorClient.getDefaultBranch({ project, repository }));\n        const sourceBranch = getBranchNameForUpdate({\n          packageEcosystem: update['package-ecosystem'],\n          targetBranchName: targetBranch,\n          directory: update.directory || update.directories?.find((dir) => changedFiles[0]?.path?.startsWith(dir)),\n          dependencyGroupName: !Array.isArray(dependencies) ? dependencies['dependency-group-name'] : undefined,\n          dependencies: !Array.isArray(dependencies) ? dependencies.dependencies : dependencies,\n          separator: update['pull-request-branch-name']?.separator,\n        });\n\n        // Check if the source branch already exists or conflicts with an existing branch\n        const existingBranch = existingBranchNames?.find((branch) => sourceBranch === branch) || [];\n        if (existingBranch.length) {\n          logger.error(\n            `Unable to create pull request '${title}' as source branch '${sourceBranch}' already exists; Delete the existing branch and try again.`,\n          );\n          return false;\n        }\n        const conflictingBranches = existingBranchNames?.filter((branch) => sourceBranch.startsWith(branch)) || [];\n        if (conflictingBranches.length) {\n          logger.error(\n            `Unable to create pull request '${title}' as source branch '${sourceBranch}' would conflict with existing branch(es) '${conflictingBranches.join(', ')}'; Delete the conflicting branch(es) and try again.`,\n          );\n          return false;\n        }\n\n        // Create a new pull request\n        const newPullRequestId = await authorClient.createPullRequest({\n          project: project,\n          repository: repository,\n          source: {\n            commit: data['base-commit-sha'] || job.source.commit!,\n            branch: sourceBranch,\n          },\n          target: {\n            branch: targetBranch!,\n          },\n          author,\n          title,\n          description: getPullRequestDescription({\n            packageManager,\n            body: data['pr-body'],\n            dependencies: data.dependencies,\n            maxDescriptionLength: PR_DESCRIPTION_MAX_LENGTH,\n          }),\n          commitMessage: data['commit-message'],\n          autoComplete: setAutoComplete\n            ? {\n                ignorePolicyConfigIds: autoCompleteIgnoreConfigIds,\n                mergeStrategy: mergeStrategy ?? 'squash',\n              }\n            : undefined,\n          assignees: update.assignees,\n          labels: update.labels?.map((label) => label?.trim()) || [],\n          workItems: update.milestone ? [update.milestone] : [],\n          changes: changedFiles,\n          properties: buildPullRequestProperties(packageManager, dependencies),\n        });\n\n        // Auto-approve the pull request, if required\n        if (autoApprove && approverClient && newPullRequestId) {\n          await approverClient.approvePullRequest({\n            project: project,\n            repository: repository,\n            pullRequestId: newPullRequestId,\n          });\n        }\n\n        // Store the new pull request ID, so we can keep track of the total number of open pull requests\n        if (newPullRequestId) {\n          affectedPullRequestIds.get(id)!.created.push(newPullRequestId);\n          return true;\n        }\n        return false;\n      }\n\n      case 'update_pull_request': {\n        if (dryRun) {\n          logger.warn(`Skipping pull request update as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // Find the pull request to update\n        const pullRequestToUpdate = getPullRequestForDependencyNames(\n          existingPullRequests,\n          packageManager,\n          data['dependency-names'],\n        );\n        if (!pullRequestToUpdate) {\n          logger.error(\n            `Could not find pull request to update for package manager '${packageManager}' with dependencies '${data['dependency-names'].join(', ')}'`,\n          );\n          return false;\n        }\n\n        // Update the pull request\n        const pullRequestWasUpdated = await authorClient.updatePullRequest({\n          project: project,\n          repository: repository,\n          pullRequestId: pullRequestToUpdate.pullRequestId,\n          commit: data['base-commit-sha'] || job.source.commit!,\n          author,\n          changes: getPullRequestChangedFiles(data),\n        });\n\n        // Re-approve the pull request, if required\n        if (autoApprove && approverClient && pullRequestWasUpdated) {\n          await approverClient.approvePullRequest({\n            project: project,\n            repository: repository,\n            pullRequestId: pullRequestToUpdate.pullRequestId,\n          });\n        }\n\n        if (pullRequestWasUpdated) {\n          affectedPullRequestIds.get(id)!.updated.push(pullRequestToUpdate.pullRequestId);\n          return true;\n        }\n        return false;\n      }\n\n      case 'close_pull_request': {\n        if (dryRun) {\n          logger.warn(`Skipping pull request closure as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // Find the pull request to close\n        const pullRequestToClose = getPullRequestForDependencyNames(\n          existingPullRequests,\n          packageManager,\n          data['dependency-names'],\n        );\n        if (!pullRequestToClose) {\n          logger.error(\n            `Could not find pull request to close for package manager '${packageManager}' with dependencies '${data['dependency-names'].join(', ')}'`,\n          );\n          return false;\n        }\n\n        // TODO: GitHub Dependabot will close with reason \"Superseded by ${new_pull_request_id}\" when another PR supersedes it.\n        //       How do we detect this? Do we need to?\n\n        // Close the pull request\n        const success = await authorClient.abandonPullRequest({\n          project: project,\n          repository: repository,\n          pullRequestId: pullRequestToClose.pullRequestId,\n          comment: getPullRequestCloseReason(data),\n          deleteSourceBranch: true,\n        });\n        if (success) {\n          affectedPullRequestIds.get(id)!.closed.push(pullRequestToClose.pullRequestId);\n          return true;\n        }\n        return false;\n      }\n\n      case 'record_update_job_warning': {\n        if (dryRun) {\n          logger.warn(`Skipping warning as 'dryRun' is set to 'true'`);\n          return true;\n        }\n\n        // add comment to each create/updated pull request\n        const ids = affectedPullRequestIds.get(id)!.created.concat(affectedPullRequestIds.get(id)!.updated);\n        for (const pullRequestId of ids) {\n          await authorClient.addCommentThread({\n            project: project,\n            repository: repository,\n            content: `### Dependabot Warning: ${data['warn-title']}\\n\\n${data['warn-description']}`,\n            pullRequestId,\n          });\n        }\n\n        return true;\n      }\n\n      // No action required\n      case 'update_dependency_list':\n      case 'create_dependency_submission':\n      case 'mark_as_processed':\n      case 'record_ecosystem_versions':\n      case 'increment_metric':\n      case 'record_ecosystem_meta':\n      case 'record_cooldown_meta':\n      case 'record_metrics': // from the runner\n        return true;\n\n      case 'record_update_job_error':\n      case 'record_update_job_unknown_error': {\n        const unknown = type === 'record_update_job_unknown_error';\n        logger.error(\n          `Update${unknown ? ' unknown ' : ''})job error: ${data['error-type']} ${JSON.stringify(data['error-details'])}`,\n        );\n        return true;\n      }\n\n      default:\n        logger.warn(`Unknown dependabot request type '${type}', ignoring...`);\n        return true;\n    }\n  }\n}\n","import { existsSync } from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport {\n  type AzdoPrExtractedWithProperties,\n  AzureDevOpsClientWrapper,\n  PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME,\n  parsePullRequestProperties,\n} from '@paklo/core/azure';\nimport {\n  type DependabotCredential,\n  DependabotJobBuilder,\n  type DependabotJobConfig,\n  type DependabotUpdate,\n  mapPackageEcosystemToPackageManager,\n  normalizeBranchName,\n} from '@paklo/core/dependabot';\nimport {\n  filterVulnerabilities,\n  GitHubSecurityAdvisoryClient,\n  getGhsaPackageEcosystemFromDependabotPackageManager,\n  type Package,\n  type SecurityVulnerability,\n  SecurityVulnerabilitySchema,\n} from '@paklo/core/github';\nimport { logger } from '@paklo/core/logger';\nimport { type RunJobOptions, runJob } from '../../run';\nimport { LocalJobsRunner, type LocalJobsRunnerOptions, type RunJobsResult } from '../runner';\nimport { AzureLocalDependabotServer, type AzureLocalDependabotServerOptions } from './server';\n\nexport type AzureLocalJobsRunnerOptions = LocalJobsRunnerOptions &\n  Omit<\n    AzureLocalDependabotServerOptions,\n    'authorClient' | 'approverClient' | 'existingBranchNames' | 'existingPullRequests'\n  > & {\n    port?: number;\n    securityAdvisoriesFile?: string;\n    gitToken: string;\n    githubToken?: string;\n    autoApproveToken?: string;\n  };\n\nexport class AzureLocalJobsRunner extends LocalJobsRunner {\n  // biome-ignore-start lint/correctness/noUnusedPrivateClassMembers: variables are used\n  private readonly options: AzureLocalJobsRunnerOptions;\n  private readonly authorClient: AzureDevOpsClientWrapper;\n  private readonly approverClient?: AzureDevOpsClientWrapper;\n  // biome-ignore-end lint/correctness/noUnusedPrivateClassMembers: variables are used\n\n  constructor(options: AzureLocalJobsRunnerOptions) {\n    super({ ...options });\n    this.options = options;\n    const { url, gitToken, autoApprove, debug } = this.options;\n\n    // Initialise the DevOps API clients (one for authoring the other for auto-approving (if configured))\n    this.authorClient = new AzureDevOpsClientWrapper(url, gitToken, debug);\n    this.approverClient = autoApprove\n      ? new AzureDevOpsClientWrapper(url, options.autoApproveToken || gitToken, debug)\n      : undefined;\n  }\n\n  public override async run(): Promise<RunJobsResult> {\n    await super.run(); // common logic\n\n    const {\n      options: { url, port, config, targetUpdateIds, command },\n      authorClient,\n      approverClient,\n    } = this;\n\n    // Print a warning about multi-ecosystem updates not being fully supported\n    // TODO: Implement full support for multi-ecosystem updates (not sure this will be possible on the local model)\n    if (config['multi-ecosystem-groups'] || config.updates?.some((u) => u['multi-ecosystem-group'])) {\n      logger.warn(\n        'Multi-ecosystem updates are not working yet. Only parsing and validation is supported at this time.',\n      );\n    }\n\n    // Print a warning about the required workarounds for security-only updates, if any update is configured as such\n    // TODO: If and when Dependabot supports a better way to do security-only updates, remove this.\n    if (config.updates?.some((u) => u['open-pull-requests-limit'] === 0)) {\n      logger.warn(\n        'Security-only updates incur a slight performance overhead due to limitations in Dependabot CLI. For more info, see: https://github.com/mburumaxwell/dependabot-azure-devops/blob/main/README.md#configuring-security-advisories-and-known-vulnerabilities',\n      );\n    }\n\n    // Fetch the active pull requests created by the author user\n    const existingBranchNames = await authorClient.getBranchNames({ project: url.project, repository: url.repository });\n    const existingPullRequests = await authorClient.getActivePullRequestProperties({\n      project: url.project,\n      repository: url.repository,\n      creatorId: await authorClient.getUserId(),\n    });\n\n    // Prepare local server\n    const serverOptions: AzureLocalDependabotServerOptions = {\n      authorClient,\n      approverClient,\n      existingBranchNames,\n      existingPullRequests,\n      ...this.options,\n    };\n    const server = new AzureLocalDependabotServer(serverOptions);\n    server.start(port);\n    // give the server a second to start\n    await new Promise((resolve) => setTimeout(resolve, 1000));\n\n    // The API urls is constant when working in this CLI. Asking people to setup NGROK or similar just to get\n    // HTTPS for the job token to be used is too much hassle.\n    // Using same value for dependabotApiUrl and dependabotApiDockerUrl so as to capture /record_metrics calls.\n    const dependabotApiUrl = `http://host.docker.internal:${server.port}/api`;\n    const dependabotApiDockerUrl = dependabotApiUrl;\n\n    // If update identifiers are specified, select them; otherwise handle all\n    let updates: DependabotUpdate[] = [];\n    if (targetUpdateIds && targetUpdateIds.length > 0) {\n      for (const id of targetUpdateIds) {\n        const upd = config.updates[id];\n        if (!upd) {\n          logger.warn(\n            `\n            Unable to find target update id '${id}'.\n            This value should be a zero based index of the update in your config file.\n            Expected range: 0-${config.updates.length - 1}\n            `,\n          );\n        } else {\n          updates.push(upd);\n        }\n      }\n    } else {\n      updates = config.updates;\n    }\n\n    try {\n      // Abandon all pull requests where the source branch has been deleted\n      await this.abandonPullRequestsWhereSourceRefIsDeleted(existingBranchNames, existingPullRequests);\n\n      // Perform updates for each of the [targeted] update blocks in dependabot.yaml\n      return await this.performUpdates(\n        server,\n        updates,\n        existingPullRequests,\n        dependabotApiUrl,\n        dependabotApiDockerUrl,\n        command,\n      );\n    } finally {\n      server.stop();\n    }\n  }\n\n  /**\n   * Abandon all pull requests where the source branch has been deleted.\n   * @param existingBranchNames The names of the existing branches.\n   * @param existingPullRequests The existing pull requests.\n   */\n  private async abandonPullRequestsWhereSourceRefIsDeleted(\n    existingBranchNames?: string[],\n    existingPullRequests?: AzdoPrExtractedWithProperties[],\n  ): Promise<void> {\n    if (!existingBranchNames || !existingPullRequests) return;\n\n    const {\n      options: { url, dryRun },\n      authorClient,\n    } = this;\n    for (const pullRequestIndex in existingPullRequests) {\n      const pullRequest = existingPullRequests[pullRequestIndex]!;\n      const pullRequestSourceRefName = normalizeBranchName(\n        pullRequest.properties?.find((x) => x.name === PR_PROPERTY_MICROSOFT_GIT_SOURCE_REF_NAME)?.value,\n      );\n      if (pullRequestSourceRefName && !existingBranchNames.includes(pullRequestSourceRefName)) {\n        // The source branch for the pull request has been deleted; abandon the pull request (if not dry run)\n        if (!dryRun) {\n          logger.warn(\n            `Detected source branch for PR #${pullRequest.pullRequestId} has been deleted; The pull request will be abandoned`,\n          );\n          await authorClient.abandonPullRequest({\n            project: url.project,\n            repository: url.repository,\n            pullRequestId: pullRequest.pullRequestId,\n            // comment:\n            //   'OK, I won't notify you again about this release, but will get in touch when a new version is available. ' +\n            //   'If you'd rather skip all updates until the next major or minor version, add an ' +\n            //   '[`ignore` condition](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--) ' +\n            //   'with the desired `update-types` to your config file.',\n            comment:\n              'It might be a good idea to add an ' +\n              '[`ignore` condition](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#ignore--) ' +\n              'with the desired `update-types` to your config file.',\n          });\n        }\n        // Remove the pull request from the list of existing pull requests to ensures that we don't attempt to update it later in the process.\n        existingPullRequests.splice(existingPullRequests.indexOf(pullRequest), 1);\n      }\n    }\n  }\n\n  /**\n   * Performs the updates.\n   * @param server The local Dependabot server.\n   * @param updates The updates to perform.\n   * @param existingPullRequests The existing pull requests.\n   */\n  private async performUpdates(\n    server: AzureLocalDependabotServer,\n    updates: DependabotUpdate[],\n    existingPullRequests: AzdoPrExtractedWithProperties[],\n    dependabotApiUrl: string,\n    dependabotApiDockerUrl?: string,\n    command?: DependabotJobConfig['command'],\n  ): Promise<RunJobsResult> {\n    const {\n      options: { url, gitToken, githubToken, experiments, config, dryRun, securityAdvisoriesFile, secretMasker },\n    } = this;\n\n    const results: RunJobsResult = [];\n\n    function makeRandomJobId(): string {\n      const array = new Uint32Array(1);\n      crypto.getRandomValues(array);\n      return `${array[0]! % 10000000000}`; // Limit to 10 digits to match GitHub's job IDs\n    }\n\n    function makeUsageData(job: DependabotJobConfig): RunJobOptions['usage'] {\n      return {\n        trigger: 'user',\n        provider: job.source.provider,\n        owner: url.value.toString(),\n        project: `${url.value.toString().replace(/\\/$/, '')}/${url.project}`,\n        'package-manager': job['package-manager'],\n      };\n    }\n\n    for (const update of updates) {\n      const packageEcosystem = update['package-ecosystem'];\n      const packageManager = mapPackageEcosystemToPackageManager(packageEcosystem);\n\n      // If there is an updater image, replace the placeholder in it\n      let { updaterImage } = this.options;\n      updaterImage = updaterImage?.replace(/\\{ecosystem\\}/i, packageEcosystem);\n\n      // Parse the Dependabot metadata for the existing pull requests that are related to this update\n      // Dependabot will use this to determine if we need to create new pull requests or update/close existing ones\n      const existingPullRequestsForPackageManager = parsePullRequestProperties(existingPullRequests, packageManager);\n      const existingPullRequestDependenciesForPackageManager = Object.values(existingPullRequestsForPackageManager);\n\n      const builder = new DependabotJobBuilder({\n        source: { provider: 'azure', ...url },\n        config,\n        update,\n        systemAccessToken: gitToken,\n        githubToken,\n        experiments,\n        debug: false,\n      });\n\n      let job: DependabotJobConfig | undefined;\n      let credentials: DependabotCredential[] | undefined;\n      let jobToken: string;\n      let credentialsToken: string;\n\n      const debug = this.options.debug;\n\n      // If this is a security-only update (i.e. 'open-pull-requests-limit: 0'), then we first need to discover the dependencies\n      // that need updating and check each one for vulnerabilities. This is because Dependabot requires the list of vulnerable dependencies\n      // to be supplied in the job definition of security-only update job, it will not automatically discover them like a versioned update does.\n      // https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#overriding-the-default-behavior-with-a-configuration-file\n      const securityVulnerabilities: SecurityVulnerability[] = [];\n      const dependencyNamesToUpdate: string[] = [];\n      const openPullRequestsLimit = update['open-pull-requests-limit']!;\n      const securityUpdatesOnly = openPullRequestsLimit === 0;\n      if (securityUpdatesOnly) {\n        // Run an update job to discover all dependencies\n        const id = makeRandomJobId();\n        ({ job, credentials } = builder.forDependenciesList({ id, command }));\n        ({ jobToken, credentialsToken } = this.makeTokens());\n        server.add({ id, update, job, jobToken, credentialsToken, credentials });\n        await runJob({\n          dependabotApiUrl,\n          dependabotApiDockerUrl,\n          jobId: id,\n          jobToken,\n          credentialsToken,\n          updaterImage,\n          secretMasker,\n          debug,\n          usage: makeUsageData(job),\n        });\n\n        const outputs = server.requests(id);\n        const packagesToCheckForVulnerabilities: Package[] | undefined = outputs!\n          .find((o) => o.type === 'update_dependency_list')\n          ?.data.dependencies?.map((d) => ({ name: d.name, version: d.version }));\n        if (packagesToCheckForVulnerabilities?.length) {\n          logger.info(\n            `Detected ${packagesToCheckForVulnerabilities.length} dependencies; Checking for vulnerabilities...`,\n          );\n\n          // parse security advisories from file (private)\n          if (securityAdvisoriesFile) {\n            const filePath = securityAdvisoriesFile;\n            if (existsSync(filePath)) {\n              const fileContents = await readFile(filePath, 'utf-8');\n              securityVulnerabilities.push(\n                ...(await SecurityVulnerabilitySchema.array().parseAsync(JSON.parse(fileContents))),\n              );\n            } else {\n              logger.info(`Private security advisories file '${filePath}' does not exist`);\n            }\n          }\n          if (githubToken) {\n            const ghsaClient = new GitHubSecurityAdvisoryClient(githubToken);\n            const githubVulnerabilities = await ghsaClient.getSecurityVulnerabilitiesAsync(\n              getGhsaPackageEcosystemFromDependabotPackageManager(packageManager),\n              packagesToCheckForVulnerabilities || [],\n            );\n            securityVulnerabilities.push(...githubVulnerabilities);\n          } else {\n            logger.info(\n              'GitHub access token is not provided; Checking for vulnerabilities from GitHub is skipped. ' +\n                'This is not an issue if you are using private security advisories file.',\n            );\n          }\n\n          const filtered = filterVulnerabilities(securityVulnerabilities);\n          securityVulnerabilities.splice(0); // clear array\n          securityVulnerabilities.push(...filtered);\n\n          // Only update dependencies that have vulnerabilities\n          dependencyNamesToUpdate.push(...Array.from(new Set(securityVulnerabilities.map((v) => v.package.name))));\n          logger.info(\n            `Detected ${securityVulnerabilities.length} vulnerabilities affecting ${dependencyNamesToUpdate.length} dependencies`,\n          );\n          if (dependencyNamesToUpdate.length) {\n            logger.trace(dependencyNamesToUpdate);\n          }\n        } else {\n          logger.info(`No vulnerabilities detected for update ${update['package-ecosystem']} in ${update.directory}`);\n          server.clear(id);\n          continue; // nothing more to do for this update\n        }\n\n        server.clear(id);\n      }\n\n      // Run an update job for \"all dependencies\"; this will create new pull requests for dependencies that need updating\n      const openPullRequestsCount = Object.entries(existingPullRequestsForPackageManager).length;\n      const hasReachedOpenPullRequestLimit =\n        openPullRequestsLimit > 0 && openPullRequestsCount >= openPullRequestsLimit;\n      if (!hasReachedOpenPullRequestLimit) {\n        const dependenciesHaveVulnerabilities = dependencyNamesToUpdate.length && securityVulnerabilities.length;\n        if (!securityUpdatesOnly || dependenciesHaveVulnerabilities) {\n          const id = makeRandomJobId();\n          ({ job, credentials } = builder.forUpdate({\n            id,\n            command,\n            dependencyNamesToUpdate,\n            existingPullRequests: existingPullRequestDependenciesForPackageManager,\n            securityVulnerabilities,\n          }));\n          ({ jobToken, credentialsToken } = this.makeTokens());\n          server.add({ id, update, job, jobToken, credentialsToken, credentials });\n          const { success, message } = await runJob({\n            dependabotApiUrl,\n            dependabotApiDockerUrl,\n            jobId: id,\n            jobToken,\n            credentialsToken,\n            updaterImage,\n            secretMasker,\n            debug,\n            usage: makeUsageData(job),\n          });\n          const affectedPrs = server.allAffectedPrs(id);\n          server.clear(id);\n          results.push({ id, success, message, affectedPrs });\n        } else {\n          logger.info('Nothing to update; dependencies are not affected by any known vulnerability');\n        }\n      } else {\n        logger.warn(\n          `Skipping update for ${packageEcosystem} packages as the open pull requests limit (${openPullRequestsLimit}) has already been reached`,\n        );\n      }\n\n      // If there are existing pull requests, run an update job for each one; this will resolve merge conflicts and close pull requests that are no longer needed\n      const numberOfPullRequestsToUpdate = Object.keys(existingPullRequestsForPackageManager).length;\n      if (numberOfPullRequestsToUpdate > 0) {\n        if (!dryRun) {\n          for (const pullRequestId in existingPullRequestsForPackageManager) {\n            const id = makeRandomJobId();\n            ({ job, credentials } = builder.forUpdate({\n              id,\n              command,\n              existingPullRequests: existingPullRequestDependenciesForPackageManager,\n              pullRequestToUpdate: existingPullRequestsForPackageManager[pullRequestId]!,\n              securityVulnerabilities,\n            }));\n            ({ jobToken, credentialsToken } = this.makeTokens());\n            server.add({ id, update, job, jobToken, credentialsToken, credentials });\n            const { success, message } = await runJob({\n              dependabotApiUrl,\n              dependabotApiDockerUrl,\n              jobId: id,\n              jobToken,\n              credentialsToken,\n              updaterImage,\n              secretMasker,\n              debug,\n              usage: makeUsageData(job),\n            });\n            const affectedPrs = server.allAffectedPrs(id);\n            server.clear(id);\n            results.push({ id, success, message, affectedPrs });\n          }\n        } else {\n          logger.warn(\n            `Skipping update of ${numberOfPullRequestsToUpdate} existing ${packageEcosystem} package pull request(s) as 'dryRun' is set to 'true'`,\n          );\n        }\n      }\n    }\n\n    return results;\n  }\n}\n"],"mappings":";;;;;;;;;;AAmCA,IAAa,6BAAb,cAAgD,sBAAsB;CAEpE,AAAiB;CAEjB,YAAY,SAA4C;AACtD,QAAM,QAAQ;AACd,OAAK,UAAU;;CAGjB,MAAyB,OAAO,IAAY,SAA8C;AACxF,QAAM,MAAM,OAAO,IAAI,QAAQ;EAE/B,MAAM,EAAE,SAAS,2BAA2B;EAC5C,MAAM,EACJ,KACA,cACA,gBACA,qBACA,sBACA,aACA,eACA,iBACA,6BACA,QACA,WACE;EAEJ,MAAM,EAAE,MAAM,SAAS;EACvB,MAAM,MAAM,MAAM,KAAK,IAAI,GAAG;AAC9B,MAAI,CAAC,KAAK;AACR,UAAO,MAAM,wBAAwB,GAAG,qCAAqC,KAAK,GAAG;AACrF,UAAO;;EAET,MAAM,EAAE,mBAAmB,mBAAmB;AAC9C,SAAO,KAAK,eAAe,KAAK,gBAAgB,GAAG,GAAG;EAEtD,MAAM,SAAS,KAAK,OAAO,GAAG;EAC9B,MAAM,EAAE,SAAS,eAAe;AAEhC,UAAQ,MAAR;GAIE,KAAK,uBAAuB;IAC1B,MAAM,QAAQ,KAAK;AACnB,QAAI,QAAQ;AACV,YAAO,KAAK,sCAAsC,MAAM,gCAAgC;AACxF,YAAO;;IAIT,MAAM,wBAAwB,OAAO;IAIrC,MAAM,wCAAwC,2BAA2B,sBAAsB,eAAe;IAC9G,MAAM,4BAA4B,OAAO,QAAQ,sCAAsC,CAAC;IACxF,MAAM,wBAAwB,uBAAuB,IAAI,GAAG,CAAE,QAAQ,SAAS;AAI/E,QAFE,wBAAwB,KAAK,yBAAyB,uBAEpB;AAClC,YAAO,KACL,sCAAsC,MAAM,qCAAqC,sBAAsB,oBACxG;AACD,YAAO;;IAGT,MAAM,eAAe,2BAA2B,KAAK;IACrD,MAAM,eAAe,2BAA2B,KAAK;IACrD,MAAM,eAAe,OAAO,oBAAqB,MAAM,aAAa,iBAAiB;KAAE;KAAS;KAAY,CAAC;IAC7G,MAAM,eAAe,uBAAuB;KAC1C,kBAAkB,OAAO;KACzB,kBAAkB;KAClB,WAAW,OAAO,aAAa,OAAO,aAAa,MAAM,QAAQ,aAAa,IAAI,MAAM,WAAW,IAAI,CAAC;KACxG,qBAAqB,CAAC,MAAM,QAAQ,aAAa,GAAG,aAAa,2BAA2B;KAC5F,cAAc,CAAC,MAAM,QAAQ,aAAa,GAAG,aAAa,eAAe;KACzE,WAAW,OAAO,6BAA6B;KAChD,CAAC;AAIF,SADuB,qBAAqB,MAAM,WAAW,iBAAiB,OAAO,IAAI,EAAE,EACxE,QAAQ;AACzB,YAAO,MACL,kCAAkC,MAAM,sBAAsB,aAAa,6DAC5E;AACD,YAAO;;IAET,MAAM,sBAAsB,qBAAqB,QAAQ,WAAW,aAAa,WAAW,OAAO,CAAC,IAAI,EAAE;AAC1G,QAAI,oBAAoB,QAAQ;AAC9B,YAAO,MACL,kCAAkC,MAAM,sBAAsB,aAAa,6CAA6C,oBAAoB,KAAK,KAAK,CAAC,qDACxJ;AACD,YAAO;;IAIT,MAAM,mBAAmB,MAAM,aAAa,kBAAkB;KACnD;KACG;KACZ,QAAQ;MACN,QAAQ,KAAK,sBAAsB,IAAI,OAAO;MAC9C,QAAQ;MACT;KACD,QAAQ,EACN,QAAQ,cACT;KACD;KACA;KACA,aAAa,0BAA0B;MACrC;MACA,MAAM,KAAK;MACX,cAAc,KAAK;MACnB,sBAAsB;MACvB,CAAC;KACF,eAAe,KAAK;KACpB,cAAc,kBACV;MACE,uBAAuB;MACvB,eAAe,iBAAiB;MACjC,GACD;KACJ,WAAW,OAAO;KAClB,QAAQ,OAAO,QAAQ,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,EAAE;KAC1D,WAAW,OAAO,YAAY,CAAC,OAAO,UAAU,GAAG,EAAE;KACrD,SAAS;KACT,YAAY,2BAA2B,gBAAgB,aAAa;KACrE,CAAC;AAGF,QAAI,eAAe,kBAAkB,iBACnC,OAAM,eAAe,mBAAmB;KAC7B;KACG;KACZ,eAAe;KAChB,CAAC;AAIJ,QAAI,kBAAkB;AACpB,4BAAuB,IAAI,GAAG,CAAE,QAAQ,KAAK,iBAAiB;AAC9D,YAAO;;AAET,WAAO;;GAGT,KAAK,uBAAuB;AAC1B,QAAI,QAAQ;AACV,YAAO,KAAK,4DAA4D;AACxE,YAAO;;IAIT,MAAM,sBAAsB,iCAC1B,sBACA,gBACA,KAAK,oBACN;AACD,QAAI,CAAC,qBAAqB;AACxB,YAAO,MACL,8DAA8D,eAAe,uBAAuB,KAAK,oBAAoB,KAAK,KAAK,CAAC,GACzI;AACD,YAAO;;IAIT,MAAM,wBAAwB,MAAM,aAAa,kBAAkB;KACxD;KACG;KACZ,eAAe,oBAAoB;KACnC,QAAQ,KAAK,sBAAsB,IAAI,OAAO;KAC9C;KACA,SAAS,2BAA2B,KAAK;KAC1C,CAAC;AAGF,QAAI,eAAe,kBAAkB,sBACnC,OAAM,eAAe,mBAAmB;KAC7B;KACG;KACZ,eAAe,oBAAoB;KACpC,CAAC;AAGJ,QAAI,uBAAuB;AACzB,4BAAuB,IAAI,GAAG,CAAE,QAAQ,KAAK,oBAAoB,cAAc;AAC/E,YAAO;;AAET,WAAO;;GAGT,KAAK,sBAAsB;AACzB,QAAI,QAAQ;AACV,YAAO,KAAK,6DAA6D;AACzE,YAAO;;IAIT,MAAM,qBAAqB,iCACzB,sBACA,gBACA,KAAK,oBACN;AACD,QAAI,CAAC,oBAAoB;AACvB,YAAO,MACL,6DAA6D,eAAe,uBAAuB,KAAK,oBAAoB,KAAK,KAAK,CAAC,GACxI;AACD,YAAO;;AAcT,QAPgB,MAAM,aAAa,mBAAmB;KAC3C;KACG;KACZ,eAAe,mBAAmB;KAClC,SAAS,0BAA0B,KAAK;KACxC,oBAAoB;KACrB,CAAC,EACW;AACX,4BAAuB,IAAI,GAAG,CAAE,OAAO,KAAK,mBAAmB,cAAc;AAC7E,YAAO;;AAET,WAAO;;GAGT,KAAK,6BAA6B;AAChC,QAAI,QAAQ;AACV,YAAO,KAAK,gDAAgD;AAC5D,YAAO;;IAIT,MAAM,MAAM,uBAAuB,IAAI,GAAG,CAAE,QAAQ,OAAO,uBAAuB,IAAI,GAAG,CAAE,QAAQ;AACnG,SAAK,MAAM,iBAAiB,IAC1B,OAAM,aAAa,iBAAiB;KACzB;KACG;KACZ,SAAS,2BAA2B,KAAK,cAAc,MAAM,KAAK;KAClE;KACD,CAAC;AAGJ,WAAO;;GAIT,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,iBACH,QAAO;GAET,KAAK;GACL,KAAK,mCAAmC;IACtC,MAAM,UAAU,SAAS;AACzB,WAAO,MACL,SAAS,UAAU,cAAc,GAAG,cAAc,KAAK,cAAc,GAAG,KAAK,UAAU,KAAK,iBAAiB,GAC9G;AACD,WAAO;;GAGT;AACE,WAAO,KAAK,oCAAoC,KAAK,gBAAgB;AACrE,WAAO;;;;;;;ACxQf,IAAa,uBAAb,cAA0C,gBAAgB;CAExD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,YAAY,SAAsC;AAChD,QAAM,EAAE,GAAG,SAAS,CAAC;AACrB,OAAK,UAAU;EACf,MAAM,EAAE,KAAK,UAAU,aAAa,UAAU,KAAK;AAGnD,OAAK,eAAe,IAAI,yBAAyB,KAAK,UAAU,MAAM;AACtE,OAAK,iBAAiB,cAClB,IAAI,yBAAyB,KAAK,QAAQ,oBAAoB,UAAU,MAAM,GAC9E;;CAGN,MAAsB,MAA8B;AAClD,QAAM,MAAM,KAAK;EAEjB,MAAM,EACJ,SAAS,EAAE,KAAK,MAAM,QAAQ,iBAAiB,WAC/C,cACA,mBACE;AAIJ,MAAI,OAAO,6BAA6B,OAAO,SAAS,MAAM,MAAM,EAAE,yBAAyB,CAC7F,QAAO,KACL,sGACD;AAKH,MAAI,OAAO,SAAS,MAAM,MAAM,EAAE,gCAAgC,EAAE,CAClE,QAAO,KACL,4PACD;EAIH,MAAM,sBAAsB,MAAM,aAAa,eAAe;GAAE,SAAS,IAAI;GAAS,YAAY,IAAI;GAAY,CAAC;EACnH,MAAM,uBAAuB,MAAM,aAAa,+BAA+B;GAC7E,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,WAAW,MAAM,aAAa,WAAW;GAC1C,CAAC;EAUF,MAAM,SAAS,IAAI,2BAPsC;GACvD;GACA;GACA;GACA;GACA,GAAG,KAAK;GACT,CAC2D;AAC5D,SAAO,MAAM,KAAK;AAElB,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAK,CAAC;EAKzD,MAAM,mBAAmB,+BAA+B,OAAO,KAAK;EACpE,MAAM,yBAAyB;EAG/B,IAAIA,UAA8B,EAAE;AACpC,MAAI,mBAAmB,gBAAgB,SAAS,EAC9C,MAAK,MAAM,MAAM,iBAAiB;GAChC,MAAM,MAAM,OAAO,QAAQ;AAC3B,OAAI,CAAC,IACH,QAAO,KACL;+CACmC,GAAG;;gCAElB,OAAO,QAAQ,SAAS,EAAE;cAE/C;OAED,SAAQ,KAAK,IAAI;;MAIrB,WAAU,OAAO;AAGnB,MAAI;AAEF,SAAM,KAAK,2CAA2C,qBAAqB,qBAAqB;AAGhG,UAAO,MAAM,KAAK,eAChB,QACA,SACA,sBACA,kBACA,wBACA,QACD;YACO;AACR,UAAO,MAAM;;;;;;;;CASjB,MAAc,2CACZ,qBACA,sBACe;AACf,MAAI,CAAC,uBAAuB,CAAC,qBAAsB;EAEnD,MAAM,EACJ,SAAS,EAAE,KAAK,UAChB,iBACE;AACJ,OAAK,MAAM,oBAAoB,sBAAsB;GACnD,MAAM,cAAc,qBAAqB;GACzC,MAAM,2BAA2B,oBAC/B,YAAY,YAAY,MAAM,MAAM,EAAE,SAAS,0CAA0C,EAAE,MAC5F;AACD,OAAI,4BAA4B,CAAC,oBAAoB,SAAS,yBAAyB,EAAE;AAEvF,QAAI,CAAC,QAAQ;AACX,YAAO,KACL,kCAAkC,YAAY,cAAc,uDAC7D;AACD,WAAM,aAAa,mBAAmB;MACpC,SAAS,IAAI;MACb,YAAY,IAAI;MAChB,eAAe,YAAY;MAM3B,SACE;MAGH,CAAC;;AAGJ,yBAAqB,OAAO,qBAAqB,QAAQ,YAAY,EAAE,EAAE;;;;;;;;;;CAW/E,MAAc,eACZ,QACA,SACA,sBACA,kBACA,wBACA,SACwB;EACxB,MAAM,EACJ,SAAS,EAAE,KAAK,UAAU,aAAa,aAAa,QAAQ,QAAQ,wBAAwB,mBAC1F;EAEJ,MAAMC,UAAyB,EAAE;EAEjC,SAAS,kBAA0B;GACjC,MAAM,QAAQ,IAAI,YAAY,EAAE;AAChC,UAAO,gBAAgB,MAAM;AAC7B,UAAO,GAAG,MAAM,KAAM;;EAGxB,SAAS,cAAc,KAAkD;AACvE,UAAO;IACL,SAAS;IACT,UAAU,IAAI,OAAO;IACrB,OAAO,IAAI,MAAM,UAAU;IAC3B,SAAS,GAAG,IAAI,MAAM,UAAU,CAAC,QAAQ,OAAO,GAAG,CAAC,GAAG,IAAI;IAC3D,mBAAmB,IAAI;IACxB;;AAGH,OAAK,MAAM,UAAU,SAAS;GAC5B,MAAM,mBAAmB,OAAO;GAChC,MAAM,iBAAiB,oCAAoC,iBAAiB;GAG5E,IAAI,EAAE,iBAAiB,KAAK;AAC5B,kBAAe,cAAc,QAAQ,kBAAkB,iBAAiB;GAIxE,MAAM,wCAAwC,2BAA2B,sBAAsB,eAAe;GAC9G,MAAM,mDAAmD,OAAO,OAAO,sCAAsC;GAE7G,MAAM,UAAU,IAAI,qBAAqB;IACvC,QAAQ;KAAE,UAAU;KAAS,GAAG;KAAK;IACrC;IACA;IACA,mBAAmB;IACnB;IACA;IACA,OAAO;IACR,CAAC;GAEF,IAAIC;GACJ,IAAIC;GACJ,IAAIC;GACJ,IAAIC;GAEJ,MAAM,QAAQ,KAAK,QAAQ;GAM3B,MAAMC,0BAAmD,EAAE;GAC3D,MAAMC,0BAAoC,EAAE;GAC5C,MAAM,wBAAwB,OAAO;GACrC,MAAM,sBAAsB,0BAA0B;AACtD,OAAI,qBAAqB;IAEvB,MAAM,KAAK,iBAAiB;AAC5B,KAAC,CAAE,KAAK,eAAgB,QAAQ,oBAAoB;KAAE;KAAI;KAAS,CAAC;AACpE,KAAC,CAAE,UAAU,oBAAqB,KAAK,YAAY;AACnD,WAAO,IAAI;KAAE;KAAI;KAAQ;KAAK;KAAU;KAAkB;KAAa,CAAC;AACxE,UAAM,OAAO;KACX;KACA;KACA,OAAO;KACP;KACA;KACA;KACA;KACA;KACA,OAAO,cAAc,IAAI;KAC1B,CAAC;IAGF,MAAMC,oCADU,OAAO,SAAS,GAAG,CAEhC,MAAM,MAAM,EAAE,SAAS,yBAAyB,EAC/C,KAAK,cAAc,KAAK,OAAO;KAAE,MAAM,EAAE;KAAM,SAAS,EAAE;KAAS,EAAE;AACzE,QAAI,mCAAmC,QAAQ;AAC7C,YAAO,KACL,YAAY,kCAAkC,OAAO,gDACtD;AAGD,SAAI,wBAAwB;MAC1B,MAAM,WAAW;AACjB,UAAI,WAAW,SAAS,EAAE;OACxB,MAAM,eAAe,MAAM,SAAS,UAAU,QAAQ;AACtD,+BAAwB,KACtB,GAAI,MAAM,4BAA4B,OAAO,CAAC,WAAW,KAAK,MAAM,aAAa,CAAC,CACnF;YAED,QAAO,KAAK,qCAAqC,SAAS,kBAAkB;;AAGhF,SAAI,aAAa;MAEf,MAAM,wBAAwB,MADX,IAAI,6BAA6B,YAAY,CACjB,gCAC7C,oDAAoD,eAAe,EACnE,qCAAqC,EAAE,CACxC;AACD,8BAAwB,KAAK,GAAG,sBAAsB;WAEtD,QAAO,KACL,oKAED;KAGH,MAAM,WAAW,sBAAsB,wBAAwB;AAC/D,6BAAwB,OAAO,EAAE;AACjC,6BAAwB,KAAK,GAAG,SAAS;AAGzC,6BAAwB,KAAK,GAAG,MAAM,KAAK,IAAI,IAAI,wBAAwB,KAAK,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC;AACxG,YAAO,KACL,YAAY,wBAAwB,OAAO,6BAA6B,wBAAwB,OAAO,eACxG;AACD,SAAI,wBAAwB,OAC1B,QAAO,MAAM,wBAAwB;WAElC;AACL,YAAO,KAAK,0CAA0C,OAAO,qBAAqB,MAAM,OAAO,YAAY;AAC3G,YAAO,MAAM,GAAG;AAChB;;AAGF,WAAO,MAAM,GAAG;;GAIlB,MAAM,wBAAwB,OAAO,QAAQ,sCAAsC,CAAC;AAGpF,OAAI,EADF,wBAAwB,KAAK,yBAAyB,wBACnB;IACnC,MAAM,kCAAkC,wBAAwB,UAAU,wBAAwB;AAClG,QAAI,CAAC,uBAAuB,iCAAiC;KAC3D,MAAM,KAAK,iBAAiB;AAC5B,MAAC,CAAE,KAAK,eAAgB,QAAQ,UAAU;MACxC;MACA;MACA;MACA,sBAAsB;MACtB;MACD,CAAC;AACF,MAAC,CAAE,UAAU,oBAAqB,KAAK,YAAY;AACnD,YAAO,IAAI;MAAE;MAAI;MAAQ;MAAK;MAAU;MAAkB;MAAa,CAAC;KACxE,MAAM,EAAE,SAAS,YAAY,MAAM,OAAO;MACxC;MACA;MACA,OAAO;MACP;MACA;MACA;MACA;MACA;MACA,OAAO,cAAc,IAAI;MAC1B,CAAC;KACF,MAAM,cAAc,OAAO,eAAe,GAAG;AAC7C,YAAO,MAAM,GAAG;AAChB,aAAQ,KAAK;MAAE;MAAI;MAAS;MAAS;MAAa,CAAC;UAEnD,QAAO,KAAK,8EAA8E;SAG5F,QAAO,KACL,uBAAuB,iBAAiB,6CAA6C,sBAAsB,4BAC5G;GAIH,MAAM,+BAA+B,OAAO,KAAK,sCAAsC,CAAC;AACxF,OAAI,+BAA+B,EACjC,KAAI,CAAC,OACH,MAAK,MAAM,iBAAiB,uCAAuC;IACjE,MAAM,KAAK,iBAAiB;AAC5B,KAAC,CAAE,KAAK,eAAgB,QAAQ,UAAU;KACxC;KACA;KACA,sBAAsB;KACtB,qBAAqB,sCAAsC;KAC3D;KACD,CAAC;AACF,KAAC,CAAE,UAAU,oBAAqB,KAAK,YAAY;AACnD,WAAO,IAAI;KAAE;KAAI;KAAQ;KAAK;KAAU;KAAkB;KAAa,CAAC;IACxE,MAAM,EAAE,SAAS,YAAY,MAAM,OAAO;KACxC;KACA;KACA,OAAO;KACP;KACA;KACA;KACA;KACA;KACA,OAAO,cAAc,IAAI;KAC1B,CAAC;IACF,MAAM,cAAc,OAAO,eAAe,GAAG;AAC7C,WAAO,MAAM,GAAG;AAChB,YAAQ,KAAK;KAAE;KAAI;KAAS;KAAS;KAAa,CAAC;;OAGrD,QAAO,KACL,sBAAsB,6BAA6B,YAAY,iBAAiB,uDACjF;;AAKP,SAAO"}

package/dist/local/index.d.mts

@@ -1,3 +1,3 @@
 import "../api-client-BoQ6jjRB.mjs";
-import { a as LocalJobsRunner, i as LocalDependabotServerOptions, n as LocalDependabotServer, o as LocalJobsRunnerOptions, r as LocalDependabotServerAddOptions, s as RunJobsResult, t as AffectedPullRequestIds } from "../server-89g3AXRY.mjs";
+import { a as LocalJobsRunner, i as LocalDependabotServerOptions, n as LocalDependabotServer, o as LocalJobsRunnerOptions, r as LocalDependabotServerAddOptions, s as RunJobsResult, t as AffectedPullRequestIds } from "../server-6BlJr2bw.mjs";
 export { AffectedPullRequestIds, LocalDependabotServer, LocalDependabotServerAddOptions, LocalDependabotServerOptions, LocalJobsRunner, LocalJobsRunnerOptions, RunJobsResult };

package/dist/{run-CJUFvK8K.mjs → run-BCnN-4vw.mjs}

@@ -116,38 +116,38 @@ var ApiClient = class {
 
 //#endregion
 //#region docker/containers.json
-var proxy = "ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy:v2.0.20251202213123@sha256:d1a8233acc123b15d3e05e30f27ccef8a77969a949e778f0625245d88e72f0e1";
+var proxy = "ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy:v2.0.20251212184225@sha256:cd436ba52ca956dfbf8beaf71a603d8ed99c4fc3a7232fee6f8c4a665533b0de";
 var containers_default = {
 	proxy,
-	bundler: "ghcr.io/dependabot/dependabot-updater-bundler:v2.0.20251207232046@sha256:535f7066f59ac0019291f99a8bec3dee635264dac32f72eef54ba135c92a4fdf",
-	cargo: "ghcr.io/dependabot/dependabot-updater-cargo:v2.0.20251207232046@sha256:2f3b6e32b79f9c062145eeab86672a49266dafdcc55ba428a6672150111503cf",
-	composer: "ghcr.io/dependabot/dependabot-updater-composer:v2.0.20251207232046@sha256:84850795fbf7ee130924f4d0145e88af85ea1f02691319fc9955a481d7a36215",
-	conda: "ghcr.io/dependabot/dependabot-updater-conda:v2.0.20251207232046@sha256:8f16ad0df2e154873372435841c01062ee2fab288af4f9657a9e44b39b8256e9",
-	pub: "ghcr.io/dependabot/dependabot-updater-pub:v2.0.20251207232046@sha256:abe764700e58ab87577096cbefde60e527c4537b97ae408de9836fdaed6b0c13",
-	docker: "ghcr.io/dependabot/dependabot-updater-docker:v2.0.20251207232046@sha256:62f4f8efefa7e19dff412d20fc52f3af32832dc1011f1d9162336df2c413e3d6",
-	elm: "ghcr.io/dependabot/dependabot-updater-elm:v2.0.20251207232046@sha256:d0a38f19b7d2a91e4b3d5fc22219ff97bd3cde7a2f22212e2e78b3dbc48be32a",
-	github_actions: "ghcr.io/dependabot/dependabot-updater-github-actions:v2.0.20251207232046@sha256:65238cbba99cf3986617ad0db8b4e2945669c79419aea2f48d9f918209d2fbff",
-	submodules: "ghcr.io/dependabot/dependabot-updater-gitsubmodule:v2.0.20251207232046@sha256:cecfbc4e099a315fcf85f7f7797f2c6c969ef09a48828dd1a12bb7e058e853ee",
-	go_modules: "ghcr.io/dependabot/dependabot-updater-gomod:v2.0.20251207232046@sha256:99f4e52b8d395aeb547aec5f087ce73bc0f5dcd34996e1f1090731179bbf7cd6",
-	gradle: "ghcr.io/dependabot/dependabot-updater-gradle:v2.0.20251207232046@sha256:2e99448ca6714a304a9489e1b430de9778b7e8fc59b3ef54006eea24dad500f3",
-	maven: "ghcr.io/dependabot/dependabot-updater-maven:v2.0.20251207232046@sha256:4706ec461230493af2e3591bbb05355c0e4bb027dc90c082ec35c1f5c16559df",
-	hex: "ghcr.io/dependabot/dependabot-updater-mix:v2.0.20251207232046@sha256:664a8cc9e71564f164a1b0935567f9a20a383ca1512b442dbfd9724b30298855",
-	nuget: "ghcr.io/dependabot/dependabot-updater-nuget:v2.0.20251207232046@sha256:e1aa1af1ebe1e0b37fc3d9994767df3e74dede38a0a4e6403a45583222a2c407",
-	npm_and_yarn: "ghcr.io/dependabot/dependabot-updater-npm:v2.0.20251207232046@sha256:92b1766cc4fc8c5198be41244eba46fad8fff98d8f654ac294383d1bacfae9ae",
-	pip: "ghcr.io/dependabot/dependabot-updater-pip:v2.0.20251207232046@sha256:9c29d05dbfa68bcd1de580bbeaa19828d3e7f0886994e504d6b08277d348d05b",
-	rust_toolchain: "ghcr.io/dependabot/dependabot-updater-rust-toolchain:v2.0.20251207232046@sha256:2639b65390474bbf87f6688bd1932a631bcdbc8f5435190dd0b5a6f033b98947",
-	swift: "ghcr.io/dependabot/dependabot-updater-swift:v2.0.20251207232046@sha256:b9213edde2244811d1d12905823e6fa5a593feb824017a675b0e4894fe8f67ea",
-	terraform: "ghcr.io/dependabot/dependabot-updater-terraform:v2.0.20251207232046@sha256:f2042674b03bf89fe8129a92c59c2a66861594a63c7a5b94335fe88887e94119",
-	devcontainers: "ghcr.io/dependabot/dependabot-updater-devcontainers:v2.0.20251207232046@sha256:befd2ea6d0168d3c4b2f8296b31e27e3b5a30cdbf77e9a17cc6f0637a6d54087",
-	dotnet_sdk: "ghcr.io/dependabot/dependabot-updater-dotnet-sdk:v2.0.20251207232046@sha256:b2dbaafa5e3e108bb65137ef8753fc385ad895ec7db76afb5de431981c1a1442",
-	bun: "ghcr.io/dependabot/dependabot-updater-bun:v2.0.20251207232046@sha256:3fb2caaf8b4ae771d86de5bc56c5ce7e919d88eeeea7eab78865784690ede6f8",
-	docker_compose: "ghcr.io/dependabot/dependabot-updater-docker-compose:v2.0.20251207232046@sha256:6662d9960d4c954e2cadcb5ac4803a149cfda4c29240ff7238420a547cdfb649",
-	uv: "ghcr.io/dependabot/dependabot-updater-uv:v2.0.20251207232046@sha256:2e867aba1104f8ce94da2646dd76a00e16851dfeca326ecc53a2a30caeb676c3",
-	vcpkg: "ghcr.io/dependabot/dependabot-updater-vcpkg:v2.0.20251207232046@sha256:d430246b7a19410c5d8aa865326c788ba647a17b7b1a64c72238cb5e93012b43",
-	helm: "ghcr.io/dependabot/dependabot-updater-helm:v2.0.20251207232046@sha256:c691d6547db106d5f410b778b743fefa83989c5a88ac606b51a7a7d46634bbe9",
-	julia: "ghcr.io/dependabot/dependabot-updater-julia:v2.0.20251207232046@sha256:f5a4ef00e536338154f6243c6ac1ca5fb4e25d04a9b2dba5b05307bfc7e92cde",
-	bazel: "ghcr.io/dependabot/dependabot-updater-bazel:v2.0.20251207232046@sha256:7f433201619c1e8bb95f7137cfb44af577f7814afb2a396e545d7dced88a8e30",
-	opentofu: "ghcr.io/dependabot/dependabot-updater-opentofu:v2.0.20251207232046@sha256:c690a868fdc273aa5182ca1a74e6811dcc880ce0663b6f3a72633098a2535d77"
+	bundler: "ghcr.io/dependabot/dependabot-updater-bundler:v2.0.20251212192154@sha256:1e4a8ea4fcd14b4db9c30d33a537edb96bd2460fc417cb887e94855d526728a9",
+	cargo: "ghcr.io/dependabot/dependabot-updater-cargo:v2.0.20251212192154@sha256:54c7b4aba856020baeaa93f4c519e3fc8b135fd4765e881dababe1cc7d983327",
+	composer: "ghcr.io/dependabot/dependabot-updater-composer:v2.0.20251212192154@sha256:433f16561014141e86d6d00b0a7107b52e6d14c42a71f3a695da059aae77b9d5",
+	conda: "ghcr.io/dependabot/dependabot-updater-conda:v2.0.20251212192154@sha256:4f6fba2e147c6ba9c0ee210e811f3224c5f788632d2f754bb4f414faadaa3cdc",
+	pub: "ghcr.io/dependabot/dependabot-updater-pub:v2.0.20251212192154@sha256:84ad8b0473f345df585115ddf85bb782a2c3c93166fc8ba953a505bb5031868e",
+	docker: "ghcr.io/dependabot/dependabot-updater-docker:v2.0.20251212192154@sha256:a6901a7bbf83f95e664ab8ad114df3588d6f1dd89b9820f787dfa62d601595b9",
+	elm: "ghcr.io/dependabot/dependabot-updater-elm:v2.0.20251212192154@sha256:f5583a34625aa24cffe380a848b29bca4405ec24bb48b71a983a71c1c4f6d759",
+	github_actions: "ghcr.io/dependabot/dependabot-updater-github-actions:v2.0.20251212192154@sha256:c82fb58fd6f808a4c06a2fe790109356f2f519dd66819d3195b3a1420c1c98f9",
+	submodules: "ghcr.io/dependabot/dependabot-updater-gitsubmodule:v2.0.20251212192154@sha256:a6f30d57805dd8659881ebc16288bfd2b258199c2f7d02cc4d66f7c88bbd8a87",
+	go_modules: "ghcr.io/dependabot/dependabot-updater-gomod:v2.0.20251212192154@sha256:748079a7bea5bf1e7d7893950ebb6fa0e3ded52cf4b4b0846fcc97e247d3c1ad",
+	gradle: "ghcr.io/dependabot/dependabot-updater-gradle:v2.0.20251212192154@sha256:7c6903145d02c573c22e5357c4cfed9ae70c08c057857740e9a516dc3d471554",
+	maven: "ghcr.io/dependabot/dependabot-updater-maven:v2.0.20251212192154@sha256:273d07b986d509fd23859c2c737170b351f1b0517e4d1acf12453171b13d69a3",
+	hex: "ghcr.io/dependabot/dependabot-updater-mix:v2.0.20251212192154@sha256:a01f70e14b995c8ac0d572fe342f8168a77f2860efc6162e033ca9d766c2aabd",
+	nuget: "ghcr.io/dependabot/dependabot-updater-nuget:v2.0.20251212192154@sha256:7a7a92721c5571cb700afd7c5020dd0f83a0cca14f7ebde73b1367919e82f1af",
+	npm_and_yarn: "ghcr.io/dependabot/dependabot-updater-npm:v2.0.20251212192154@sha256:8fb8615abae9f2d51a330af676f83059ab39cf33d03b9850184e579a2c0a796e",
+	pip: "ghcr.io/dependabot/dependabot-updater-pip:v2.0.20251212192154@sha256:25a8099530502669207803834bf60f75f51aa7c9521132f9d63322f90129ca8f",
+	rust_toolchain: "ghcr.io/dependabot/dependabot-updater-rust-toolchain:v2.0.20251212192154@sha256:80e84192c652f7b84b558bd342888d0039947945c4815d77e67cb12d27fedc87",
+	swift: "ghcr.io/dependabot/dependabot-updater-swift:v2.0.20251212192154@sha256:7d2868c887b09f3c85fedbce5312c6d3516910499e1acaed73134c1b5cbb9b48",
+	terraform: "ghcr.io/dependabot/dependabot-updater-terraform:v2.0.20251212192154@sha256:287ceb85283279cfa9a08b4c342198ebd9344f036a02aa42a390f5d3ddde3362",
+	devcontainers: "ghcr.io/dependabot/dependabot-updater-devcontainers:v2.0.20251212192154@sha256:05648e7f35629917fb7733312acf4d2a9db4fd068abe7d2281df25b4c9615365",
+	dotnet_sdk: "ghcr.io/dependabot/dependabot-updater-dotnet-sdk:v2.0.20251212192154@sha256:01e521c8b5e7de9a7617d84eec655a94bbb844ccbf1403743165ecc6295329e3",
+	bun: "ghcr.io/dependabot/dependabot-updater-bun:v2.0.20251212192154@sha256:7c03e633930e9f1077c1a4b1d09eac693750b0729f1d78ea3384ed00212dc3ef",
+	docker_compose: "ghcr.io/dependabot/dependabot-updater-docker-compose:v2.0.20251212192154@sha256:692da08db4c5477e0120a3acad79489e67f64f334d72719b1e4b4f5eade92920",
+	uv: "ghcr.io/dependabot/dependabot-updater-uv:v2.0.20251212192154@sha256:38428259542f24e3a6a8e53ebc10249b79029d0335f73ba2dad72b853eb86d58",
+	vcpkg: "ghcr.io/dependabot/dependabot-updater-vcpkg:v2.0.20251212192154@sha256:4ecb840e58d9c3a377901ae13e824496456e01e1a1da5ba516063110a9789b6c",
+	helm: "ghcr.io/dependabot/dependabot-updater-helm:v2.0.20251212192154@sha256:b6531a30ead9f6aeaf75e6706556b74096ae025dc6ff6c08e9f18b9b71300492",
+	julia: "ghcr.io/dependabot/dependabot-updater-julia:v2.0.20251212192154@sha256:0eab8ed2d557669d13b71fed94c4c879a400a7f396ba057d4c2194ac2b87434f",
+	bazel: "ghcr.io/dependabot/dependabot-updater-bazel:v2.0.20251212192154@sha256:c7fa5b63963a9915bcdb1c4917de33012ac2f0fcae797cd42596ae5cec1c02fd",
+	opentofu: "ghcr.io/dependabot/dependabot-updater-opentofu:v2.0.20251212192154@sha256:3e770cde5e17b19d984fb0f1f205454f16eb6ebb7e342710249858842affa12e"
 };
 
 //#endregion
@@ -181,6 +181,7 @@ function digestName(imageName) {
 
 //#endregion
 //#region src/utils.ts
+const nullStream = new stream.Writable({ write: (__, _, next) => next() });
 const outStream = (prefix) => {
 	return new stream.Writable({ write(chunk, _, next) {
 		process.stdout.write(`${prefix} | ${chunk.toString()}`);
@@ -283,7 +284,7 @@ const ContainerService = {
 //#endregion
 //#region src/image-service.ts
 const MAX_RETRIES = 5;
-const INITIAL_DELAY_MS = 2e3;
+const INITIAL_DELAY_MS = 5e3;
 const sleep = async (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const endOfStream = async (docker$1, stream$1) => {
 	return new Promise((resolve, reject) => {
@@ -393,10 +394,11 @@ const CERT_SUBJECT = [
 	}
 ];
 var ProxyBuilder = class ProxyBuilder {
-	constructor(docker$1, proxyImage, cachedMode) {
+	constructor(docker$1, proxyImage, cachedMode, debug) {
 		this.docker = docker$1;
 		this.proxyImage = proxyImage;
 		this.cachedMode = cachedMode;
+		this.debug = debug;
 	}
 	async run(jobId, jobToken, dependabotApiUrl, credentials) {
 		const name = `dependabot-job-${jobId}-proxy`;
@@ -419,7 +421,7 @@ var ProxyBuilder = class ProxyBuilder {
 			stdout: true,
 			stderr: true
 		});
-		container.modem.demuxStream(stream$1, outStream("  proxy"), errStream("  proxy"));
+		container.modem.demuxStream(stream$1, this.debug ? outStream("  proxy") : nullStream, this.debug ? errStream("  proxy") : nullStream);
 		const url = async () => {
 			const containerInfo = await container.inspect();
 			if (containerInfo.State.Running === true) return `http://${containerInfo.NetworkSettings.Networks[`${internalNetworkName}`].IPAddress}:1080`;
@@ -535,7 +537,7 @@ var ProxyBuilder = class ProxyBuilder {
 
 //#endregion
 //#region package.json
-var version = "0.7.0";
+var version = "0.8.1";
 
 //#endregion
 //#region src/updater-builder.ts
@@ -602,12 +604,13 @@ var UpdaterBuilder = class {
 //#region src/updater.ts
 var Updater = class {
 	docker;
-	constructor(updaterImage, proxyImage, params, job, credentials) {
+	constructor(updaterImage, proxyImage, params, job, credentials, debug) {
 		this.updaterImage = updaterImage;
 		this.proxyImage = proxyImage;
 		this.params = params;
 		this.job = job;
 		this.credentials = credentials;
+		this.debug = debug;
 		this.docker = new Docker();
 		this.job["credentials-metadata"] = this.generateCredentialsMetadata();
 	}
@@ -616,7 +619,7 @@ var Updater = class {
 	*/
 	async runUpdater() {
 		const cachedMode = Object.hasOwn(this.job.experiments, "proxy-cached") === true;
-		const proxy$1 = await new ProxyBuilder(this.docker, this.proxyImage, cachedMode).run(this.params.jobId, this.params.jobToken, this.params.dependabotApiUrl, this.credentials);
+		const proxy$1 = await new ProxyBuilder(this.docker, this.proxyImage, cachedMode, this.debug).run(this.params.jobId, this.params.jobToken, this.params.dependabotApiUrl, this.credentials);
 		await proxy$1.container.start();
 		try {
 			await this.runUpdate(proxy$1);
@@ -687,7 +690,7 @@ var Updater = class {
 var JobRunnerImagingError = class extends Error {};
 var JobRunnerUpdaterError = class extends Error {};
 async function runJob(options) {
-	const { jobId, dependabotApiUrl, dependabotApiDockerUrl, jobToken, credentialsToken, secretMasker, usage } = options;
+	const { jobId, dependabotApiUrl, dependabotApiDockerUrl, jobToken, credentialsToken, secretMasker, debug, usage } = options;
 	const started = /* @__PURE__ */ new Date();
 	let success = false;
 	let message;
@@ -713,7 +716,7 @@ async function runJob(options) {
 				logger.warn(`Metric sending failed for ${name}: ${error.message}`);
 			}
 		};
-		const updater = new Updater(updaterImage, PROXY_IMAGE_NAME, params, job, await apiClient.getCredentials() || []);
+		const updater = new Updater(updaterImage, PROXY_IMAGE_NAME, params, job, await apiClient.getCredentials() || [], debug);
 		try {
 			await ImageService.pull(updaterImage, sendMetricsWithPackageManager);
 			await ImageService.pull(PROXY_IMAGE_NAME, sendMetricsWithPackageManager);
@@ -784,4 +787,4 @@ async function isRunningInDocker() {
 
 //#endregion
 export { CredentialFetchingError as A, PROXY_IMAGE_NAME as C, updaterImageName as D, repositoryName as E, updaterImages as O, extractUpdaterSha as S, hasDigest as T, getJobParameters as _, Updater as a, ContainerRuntimeError as b, JOB_INPUT_FILENAME as c, JOB_OUTPUT_PATH as d, REPO_CONTENTS_PATH as f, JobParameters as g, ProxyBuilder as h, runJob as i, JobDetailsFetchingError as j, ApiClient as k, JOB_INPUT_PATH as l, CONFIG_FILE_NAME as m, JobRunnerUpdaterError as n, CA_CERT_FILENAME as o, UpdaterBuilder as p, isRunningInDocker as r, CA_CERT_INPUT_PATH as s, JobRunnerImagingError as t, JOB_OUTPUT_FILENAME as u, ImageService as v, digestName as w, ContainerService as x, getOrgFromImage as y };
-//# sourceMappingURL=run-CJUFvK8K.mjs.map
+//# sourceMappingURL=run-BCnN-4vw.mjs.map

package/dist/run-BCnN-4vw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-BCnN-4vw.mjs","names":["client: KyInstance","params: JobParameters","credentialsToken: string","secretMasker: SecretMasker","error: unknown","dockerContainerConfig.proxy","dockerContainerConfig","nullStream: Writable","stream","stream","docker","e: unknown","jobId: string","jobToken: string","credentialsToken: string","dependabotApiUrl: string","dependabotApiDockerUrl: string","updaterImage: string","CA_CERT_INPUT_PATH","docker: Docker","proxyImage: string","cachedMode: boolean","debug: boolean","stream","docker: Docker","jobParams: JobParameters","input: FileFetcherInput | FileUpdaterInput","proxy: Proxy","updaterImage: string","updaterImage: string","proxyImage: string","params: JobParameters","job: DependabotJobConfig","credentials: DependabotCredential[]","debug: boolean","proxy","unique: Set<string>","result: DependabotCredential[]","obj: any","message: string | undefined","packageJson.version","sendMetricsWithPackageManager: MetricReporter","err: unknown","data: UsageTelemetryRequestData"],"sources":["../src/api-client.ts","../docker/containers.json","../src/docker-tags.ts","../src/utils.ts","../src/container-service.ts","../src/image-service.ts","../src/params.ts","../src/proxy.ts","../package.json","../src/updater-builder.ts","../src/updater.ts","../src/run.ts"],"sourcesContent":["import type {\n  DependabotCredential,\n  DependabotJobConfig,\n  DependabotMetric,\n  DependabotRecordUpdateJobError,\n} from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport { isHTTPError, type KyInstance, type KyResponse } from 'ky';\nimport type { JobParameters } from './params';\n\nexport class JobDetailsFetchingError extends Error {}\nexport class CredentialFetchingError extends Error {}\nexport type SecretMasker = (value: string) => void;\n\nexport class ApiClient {\n  private dependabotApiUrl: string;\n  private jobToken: string;\n  constructor(\n    private readonly client: KyInstance,\n    readonly params: JobParameters,\n    jobToken: string,\n    private readonly credentialsToken: string,\n    private readonly secretMasker: SecretMasker,\n  ) {\n    // if dependabotApiUrl contains \"host.docker.internal\", we need to replace it with \"localhost\" for local calls\n    const baseUrl = params.dependabotApiUrl.replace('host.docker.internal', 'localhost');\n    this.dependabotApiUrl = baseUrl;\n    this.jobToken = jobToken;\n  }\n\n  // We use a static unknown SHA when marking a job as complete from the action\n  // to remain in parity with the existing runner.\n  UnknownSha = {\n    'base-commit-sha': 'unknown',\n  };\n\n  // Getter for jobToken\n  getJobToken(): string {\n    return this.jobToken;\n  }\n\n  async getJobDetails(): Promise<DependabotJobConfig> {\n    const detailsURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/details`;\n    try {\n      const res = await this.getWithRetry<DependabotJobConfig>(detailsURL, this.jobToken);\n      if (res.status !== 200) {\n        throw new JobDetailsFetchingError(\n          `fetching job details: unexpected status code: ${res.status}: ${JSON.stringify(await res.json())}`,\n        );\n      }\n      const data = await res.json();\n      if (!data) {\n        throw new JobDetailsFetchingError(`fetching job details: missing response`);\n      }\n\n      return data;\n    } catch (error) {\n      if (error instanceof JobDetailsFetchingError) {\n        throw error;\n      } else if (isHTTPError(error)) {\n        throw new JobDetailsFetchingError(\n          `fetching job details: unexpected status code: ${error.response.status}: ${error.message}`,\n        );\n      } else if (error instanceof Error) {\n        throw new JobDetailsFetchingError(`fetching job details: ${error.name}: ${error.message}`);\n      }\n      throw error;\n    }\n  }\n\n  async getCredentials(): Promise<DependabotCredential[]> {\n    const credentialsURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/credentials`;\n    try {\n      const res = await this.getWithRetry<DependabotCredential[]>(credentialsURL, this.credentialsToken);\n\n      if (res.status !== 200) {\n        throw new CredentialFetchingError(\n          `fetching credentials: unexpected status code: ${res.status}: ${JSON.stringify(await res.json())}`,\n        );\n      }\n      const data = await res.json();\n      if (!data) {\n        throw new CredentialFetchingError(`fetching credentials: missing response`);\n      }\n\n      // Mask any secrets we've just retrieved from environment logs\n      for (const credential of data) {\n        if (credential.password) {\n          this.secretMasker(credential.password);\n        }\n        if (credential.token) {\n          this.secretMasker(credential.token);\n        }\n        if (credential['auth-key']) {\n          this.secretMasker(credential['auth-key']);\n        }\n      }\n\n      return data;\n    } catch (error: unknown) {\n      if (error instanceof CredentialFetchingError) {\n        throw error;\n      } else if (isHTTPError(error)) {\n        throw new CredentialFetchingError(\n          `fetching credentials: unexpected status code: ${error.response.status}: ${error.message}`,\n        );\n      } else if (error instanceof Error) {\n        throw new CredentialFetchingError(`fetching credentials: ${error.name}: ${error.message}`);\n      }\n      throw error;\n    }\n  }\n\n  async reportJobError(error: DependabotRecordUpdateJobError): Promise<void> {\n    const recordErrorURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/record_update_job_error`;\n    const res = await this.client.post(recordErrorURL, {\n      json: error,\n      headers: { Authorization: this.jobToken },\n    });\n    if (res.status !== 204) {\n      throw new Error(`Unexpected status code: ${res.status}`);\n    }\n  }\n\n  async markJobAsProcessed(): Promise<void> {\n    const markAsProcessedURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/mark_as_processed`;\n    const res = await this.client.patch(markAsProcessedURL, {\n      json: this.UnknownSha,\n      headers: { Authorization: this.jobToken },\n    });\n    if (res.status !== 204) {\n      throw new Error(`Unexpected status code: ${res.status}`);\n    }\n  }\n\n  async sendMetrics(\n    name: string,\n    metricType: 'increment' | 'gauge',\n    value: number,\n    additionalTags: Record<string, string> = {},\n  ): Promise<void> {\n    try {\n      await this.reportMetrics([\n        {\n          metric: `dependabot.action.${name}`,\n          type: metricType,\n          value,\n          tags: additionalTags,\n        },\n      ]);\n      logger.info(`Successfully sent metric (dependabot.action.${name}) to remote API endpoint`);\n    } catch (error) {\n      // metrics should typically not cause critical path failure so we log the\n      // failure and continue with the job\n      logger.warn(`Metrics reporting failed: ${(error as Error).message}`);\n    }\n  }\n\n  async reportMetrics(metrics: DependabotMetric[]): Promise<void> {\n    const metricsURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/record_metrics`;\n    const res = await this.client.post(metricsURL, {\n      json: { data: metrics },\n      headers: { Authorization: this.jobToken },\n    });\n\n    if (res.status !== 204) {\n      throw new Error(`Unexpected status code: ${res.status}`);\n    }\n  }\n\n  private async getWithRetry<T>(url: string, token: string, options?: RequestInit): Promise<KyResponse<T>> {\n    const execute = async (): Promise<KyResponse<T>> => {\n      const res = await this.client.get<T>(url, {\n        headers: { Authorization: token },\n        retry: {\n          limit: 3,\n          // other default options are sufficient:\n          // https://github.com/sindresorhus/ky#retry\n          // delay: attemptCount => 0.3 * (2 ** (attemptCount - 1)) * 1000\n          // statusCodes: 408 413 429 500 502 503 504\n          // afterStatusCodes: 413, 429, 503\n        },\n        hooks: {\n          beforeRetry: [\n            async ({ request, options, error, retryCount }) => {\n              if (isHTTPError(error)) {\n                logger.warn(`Retrying failed request with status code: ${error.response.status}`);\n              }\n            },\n          ],\n        },\n        ...options,\n      });\n\n      return res;\n    };\n\n    return execute();\n  }\n}\n","","import dockerContainerConfig from '../docker/containers.json';\n\nexport const PROXY_IMAGE_NAME = dockerContainerConfig.proxy;\n\nexport function updaterImageName(packageManager: string): string {\n  return dockerContainerConfig[packageManager as keyof typeof dockerContainerConfig];\n}\n\nconst updaterRegex = /ghcr.io\\/dependabot\\/dependabot-updater-([\\w+])/;\n\nexport function updaterImages(): string[] {\n  return Object.values(dockerContainerConfig).filter((image) => image.match(updaterRegex));\n}\n\nconst imageNamePattern =\n  '^(?<repository>(([a-zA-Z0-9._-]+([:[0-9]+[^/]))?([a-zA-Z0-9._/-]+)?))(:[a-zA-Z0-9._/-]+)?(?<digest>@sha256:[a-zA-Z0-9]{64})?$';\n\nexport function repositoryName(imageName: string): string {\n  const match = imageName.match(imageNamePattern);\n\n  if (match?.groups) {\n    return match.groups.repository!;\n  } else {\n    throw Error('invalid image name');\n  }\n}\n\nexport function hasDigest(imageName: string): boolean {\n  const match = imageName.match(imageNamePattern);\n\n  if (match?.groups) {\n    if (match?.groups.digest) {\n      return true;\n    }\n    return false;\n  } else {\n    throw Error('invalid image name');\n  }\n}\n\nexport function digestName(imageName: string): string {\n  const match = imageName.match(imageNamePattern);\n\n  if (match?.groups) {\n    return match.groups.repository! + match.groups.digest;\n  } else {\n    throw Error('invalid image name');\n  }\n}\n","import stream, { type Writable } from 'node:stream';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport const nullStream: Writable = new stream.Writable({ write: (__, _, next) => next() });\n\nexport const outStream = (prefix: string): Writable => {\n  return new stream.Writable({\n    write(chunk, _, next) {\n      process.stdout.write(`${prefix} | ${chunk.toString()}`);\n      next();\n    },\n  });\n};\n\nexport const errStream = (prefix: string): Writable => {\n  return new stream.Writable({\n    write(chunk, _, next) {\n      process.stderr.write(`${prefix} | ${chunk.toString()}`);\n      next();\n    },\n  });\n};\n\n/**\n * Extracts the SHA from an updater image string.\n * @param updaterImage - Image string in the format \"image:sha\" or \"registry/image:sha\"\n * @returns The SHA part after the last colon, or null if no colon is found\n */\nexport const extractUpdaterSha = (updaterImage: string): string | null => {\n  const match = updaterImage.match(/:([^:]*)$/);\n  return match ? match[1]! : null;\n};\n","import type { DependabotProxyConfig, FileFetcherInput, FileUpdaterInput } from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport type { Container } from 'dockerode';\nimport { pack } from 'tar-stream';\nimport { errStream, outStream } from './utils';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport class ContainerRuntimeError extends Error {}\n\nconst RWX_ALL = 0o777;\n\nexport const ContainerService = {\n  async storeInput(\n    name: string,\n    path: string,\n    container: Container,\n    input: FileFetcherInput | FileUpdaterInput | DependabotProxyConfig,\n  ): Promise<void> {\n    const tar = pack();\n    tar.entry({ name, mode: RWX_ALL }, JSON.stringify(input));\n    tar.finalize();\n    await container.putArchive(tar, { path });\n  },\n\n  async storeCert(name: string, path: string, container: Container, cert: string): Promise<void> {\n    const tar = pack();\n    tar.entry({ name }, cert);\n    tar.finalize();\n    await container.putArchive(tar, { path });\n  },\n\n  async run(container: Container, command?: string): Promise<boolean> {\n    try {\n      // Start the container\n      await container.start();\n      logger.info(`Started container ${container.id}`);\n\n      // Check if this is a dependabot container (has the expected structure)\n      const containerInfo = await container.inspect();\n      const isDependabotContainer = containerInfo.Config?.Env?.some((env) => env.startsWith('DEPENDABOT_JOB_ID='));\n\n      if (isDependabotContainer) {\n        // For dependabot containers, run CA certificates update as root first\n        await this.execCommand(container, ['/usr/sbin/update-ca-certificates'], 'root');\n\n        // Then run the dependabot commands as dependabot user\n        const dependabotCommands = [\n          'mkdir -p /home/dependabot/dependabot-updater/output',\n          '$DEPENDABOT_HOME/dependabot-updater/bin/run fetch_files',\n        ];\n\n        if (command === 'graph') {\n          dependabotCommands.push('$DEPENDABOT_HOME/dependabot-updater/bin/run update_graph');\n        } else {\n          dependabotCommands.push('$DEPENDABOT_HOME/dependabot-updater/bin/run update_files');\n        }\n\n        for (const cmd of dependabotCommands) {\n          await this.execCommand(container, ['/bin/sh', '-c', cmd], 'dependabot');\n        }\n      } else {\n        // For test containers and other containers, just wait for completion\n        const outcome = await container.wait();\n        if (outcome.StatusCode !== 0) {\n          throw new Error(`Container exited with code ${outcome.StatusCode}`);\n        }\n      }\n\n      return true;\n    } catch (error) {\n      logger.info(`Failure running container ${container.id}: ${error}`);\n      throw new ContainerRuntimeError('The updater encountered one or more errors.');\n    } finally {\n      try {\n        await container.remove({ v: true, force: true });\n        logger.info(`Cleaned up container ${container.id}`);\n      } catch (error) {\n        logger.info(`Failed to clean up container ${container.id}: ${error}`);\n      }\n    }\n  },\n\n  async execCommand(container: Container, cmd: string[], user: string): Promise<void> {\n    const exec = await container.exec({\n      Cmd: cmd,\n      User: user,\n      AttachStdout: true,\n      AttachStderr: true,\n    });\n\n    const stream = await exec.start({});\n\n    // Wait for the stream to end\n    await new Promise<void>((resolve, reject) => {\n      container.modem.demuxStream(stream, outStream('updater'), errStream('updater'));\n\n      stream.on('end', () => {\n        resolve();\n      });\n\n      stream.on('error', (error) => {\n        reject(error);\n      });\n    });\n\n    // Wait a bit for the exec to complete properly\n    await new Promise((resolve) => setTimeout(resolve, 100));\n\n    const inspection = await exec.inspect();\n    if (inspection.ExitCode !== 0) {\n      throw new Error(`Command failed with exit code ${inspection.ExitCode}: ${cmd.join(' ')}`);\n    }\n  },\n};\n","import { Readable } from 'node:stream';\nimport { logger } from '@paklo/core/logger';\nimport Docker from 'dockerode';\n\nconst MAX_RETRIES = 5; // Maximum number of retries\nconst INITIAL_DELAY_MS = 5000; // Initial delay in milliseconds for backoff\n\n// Code below is borrowed and adapted from dependabot-action\n\nconst sleep = async (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst endOfStream = async (docker: Docker, stream: Readable): Promise<void> => {\n  return new Promise((resolve, reject) => {\n    docker.modem.followProgress(stream, (err: Error | null) => (err ? reject(err) : resolve(undefined)));\n  });\n};\n\nexport function getOrgFromImage(imageName: string): string {\n  const parts = imageName.split('/');\n  if (parts.length >= 3 && parts[0] === 'ghcr.io') {\n    return parts[1]!; // The domain is always the second part\n  }\n  return 'unknown'; // Fallback case if structure is unexpected\n}\n\nexport type MetricReporter = (\n  metricName: string,\n  metricType: 'increment' | 'gauge',\n  value: number,\n  additionalTags?: Record<string, string>,\n) => Promise<void>;\n\n/** Fetch the configured updater image, if it isn't already available. */\nexport const ImageService = {\n  async pull(imageName: string, sendMetric?: MetricReporter, force = false): Promise<void> {\n    /*\n      This method fetches images hosts on GitHub infrastructure.\n\n      We expose the `fetch_image` utility method to allow us to pull in arbitrary images for unit tests.\n    */\n    if (!(imageName.startsWith('ghcr.io/') || imageName.startsWith('docker.pkg.github.com/'))) {\n      throw new Error('Only images distributed via docker.pkg.github.com or ghcr.io can be fetched');\n    }\n\n    const docker = new Docker();\n    const org = getOrgFromImage(imageName);\n    try {\n      const image = await docker.getImage(imageName).inspect();\n      if (!force) {\n        logger.info(`Resolved ${imageName} to existing ${image.RepoDigests}`);\n        return;\n      } // else fallthrough to pull\n    } catch (e: unknown) {\n      if (e instanceof Error && !e.message.includes('no such image')) {\n        throw e;\n      } // else fallthrough to pull\n    }\n\n    const auth = {}; // Images are public so not authentication info is required\n    await this.fetchImageWithRetry(imageName, auth, docker, sendMetric, org);\n  },\n\n  /* Retrieve the image using the auth details provided, if any with retry and backoff */\n  async fetchImageWithRetry(\n    imageName: string,\n    auth = {},\n    docker = new Docker(),\n    sendMetric: MetricReporter | undefined,\n    org: string,\n  ): Promise<void> {\n    let attempt = 0;\n\n    while (attempt < MAX_RETRIES) {\n      try {\n        logger.info(`Pulling image ${imageName} (attempt ${attempt + 1})...`);\n        /* To avoid sending metrics during unit tests (fetch_image) */\n        if (sendMetric) {\n          await sendMetric('ghcr_image_pull', 'increment', 1, {\n            org,\n          });\n        }\n        const stream = await docker.pull(imageName, { authconfig: auth });\n        await endOfStream(docker, new Readable().wrap(stream));\n        logger.info(`Pulled image ${imageName}`);\n        return; // Exit on success\n      } catch (error) {\n        if (!(error instanceof Error)) throw error; // Ensure error is an instance of Error\n\n        // Handle 429 Too Many Requests separately\n        if (\n          error.message.includes('429 Too Many Requests') ||\n          error.message.toLowerCase().includes('too many requests')\n        ) {\n          attempt++; // Only increment attempt on 429\n          if (attempt >= MAX_RETRIES) {\n            logger.error(`Failed to pull image ${imageName} after ${MAX_RETRIES} attempts.`);\n            throw error;\n          }\n\n          // Add jitter to avoid synchronization issues\n          // biome-ignore lint/style/useExponentiationOperator: This is clearer for now\n          const baseDelay = INITIAL_DELAY_MS * Math.pow(2, attempt);\n          const jitter = Math.random() * baseDelay;\n          const delay = baseDelay / 2 + jitter;\n\n          logger.warn(`Received Too Many Requests error. Retrying in ${(delay / 1000).toFixed(2)} seconds...`);\n          await sleep(delay);\n        } else {\n          // Non-429 errors should NOT be retried\n          logger.error(`Fatal error pulling image ${imageName}: ${error.message}`);\n          throw error; // Exit immediately\n        }\n      }\n    }\n  },\n};\n","// Code below is borrowed and adapted from dependabot-action\n\n/*\n `jobId` is intentionally a string even though we copied from code that used number\n We generate the job identifiers using Snowflake which produces bigint\n and bigint cannot be serialized to JSON, so we use string everywhere instead.\n The hosted dependabot possible uses auto-incrementing numbers for jobIds in their database,\n but not all databases support this.\n*/\n\nexport class JobParameters {\n  constructor(\n    readonly jobId: string,\n    readonly jobToken: string,\n    readonly credentialsToken: string,\n    readonly dependabotApiUrl: string,\n    readonly dependabotApiDockerUrl: string,\n    readonly updaterImage: string,\n  ) {}\n}\n\nexport function getJobParameters(input: {\n  jobId?: string;\n  jobToken?: string;\n  credentialsToken?: string;\n  dependabotApiUrl?: string;\n  dependabotApiDockerUrl?: string;\n  updaterImage?: string;\n}): JobParameters | null {\n  return new JobParameters(\n    input.jobId as string,\n    input.jobToken as string,\n    input.credentialsToken as string,\n    input.dependabotApiUrl as string,\n    input.dependabotApiDockerUrl as string,\n    input.updaterImage as string,\n  );\n}\n","import { readFile } from 'node:fs/promises';\nimport type { CertificateAuthority, DependabotCredential, DependabotProxyConfig } from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport type Docker from 'dockerode';\nimport type { Container, Network } from 'dockerode';\nimport { ContainerService } from './container-service';\nimport { errStream, nullStream, outStream } from './utils';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport type Proxy = {\n  container: Container;\n  network: Network;\n  networkName: string;\n  url: () => Promise<string>;\n  cert: string;\n  shutdown: () => Promise<void>;\n};\n\nconst KEY_SIZE = 2048;\nconst KEY_EXPIRY_YEARS = 2;\nconst CONFIG_FILE_PATH = '/';\nexport const CONFIG_FILE_NAME = 'config.json';\nconst CA_CERT_INPUT_PATH = '/usr/local/share/ca-certificates';\nconst CUSTOM_CA_CERT_NAME = 'custom-ca-cert.crt';\nconst CERT_SUBJECT = [\n  { name: 'commonName', value: 'Dependabot Internal CA' },\n  { name: 'organizationName', value: 'GitHub Inc.' },\n  { shortName: 'OU', value: 'Dependabot' },\n  { name: 'countryName', value: 'US' },\n  { shortName: 'ST', value: 'California' },\n  { name: 'localityName', value: 'San Francisco' },\n];\n\nexport class ProxyBuilder {\n  constructor(\n    private readonly docker: Docker,\n    private readonly proxyImage: string,\n    private readonly cachedMode: boolean,\n    private readonly debug: boolean,\n  ) {}\n\n  async run(\n    jobId: string,\n    jobToken: string,\n    dependabotApiUrl: string,\n    credentials: DependabotCredential[],\n  ): Promise<Proxy> {\n    const name = `dependabot-job-${jobId}-proxy`;\n    const config = await this.buildProxyConfig(credentials);\n    const cert = config.ca.cert;\n\n    const externalNetworkName = `dependabot-job-${jobId}-external-network`;\n    const externalNetwork = await this.ensureNetwork(externalNetworkName, false);\n\n    const internalNetworkName = `dependabot-job-${jobId}-internal-network`;\n    const internalNetwork = await this.ensureNetwork(internalNetworkName, true);\n\n    const container = await this.createContainer(\n      jobId,\n      jobToken,\n      dependabotApiUrl,\n      name,\n      externalNetwork,\n      internalNetwork,\n      internalNetworkName,\n    );\n\n    await ContainerService.storeInput(CONFIG_FILE_NAME, CONFIG_FILE_PATH, container, config);\n\n    const customCAPath = this.customCAPath();\n    if (customCAPath) {\n      logger.info('Detected custom CA certificate, adding to proxy');\n\n      const customCert = (await readFile(customCAPath, 'utf8')).toString();\n      await ContainerService.storeCert(CUSTOM_CA_CERT_NAME, CA_CERT_INPUT_PATH, container, customCert);\n    }\n\n    const stream = await container.attach({\n      stream: true,\n      stdout: true,\n      stderr: true,\n    });\n    container.modem.demuxStream(\n      stream,\n      // proxy generates lots of logs that we do not need unless debugging\n      // this should save on disk space in agents running Azure pipelines\n      this.debug ? outStream('  proxy') : nullStream,\n      this.debug ? errStream('  proxy') : nullStream,\n    );\n\n    const url = async (): Promise<string> => {\n      const containerInfo = await container.inspect();\n\n      if (containerInfo.State.Running === true) {\n        const ipAddress = containerInfo.NetworkSettings.Networks[`${internalNetworkName}`]!.IPAddress;\n        return `http://${ipAddress}:1080`;\n      } else {\n        throw new Error(\"proxy container isn't running\");\n      }\n    };\n\n    return {\n      container,\n      network: internalNetwork,\n      networkName: internalNetworkName,\n      url,\n      cert,\n      shutdown: async () => {\n        await container.stop();\n        await container.remove();\n        await Promise.all([externalNetwork.remove(), internalNetwork.remove()]);\n      },\n    };\n  }\n\n  private async ensureNetwork(name: string, internal = true): Promise<Network> {\n    const networks = await this.docker.listNetworks({\n      filters: JSON.stringify({ name: [name] }),\n    });\n    if (networks.length > 0) {\n      return this.docker.getNetwork(networks[0]!.Id);\n    } else {\n      return await this.docker.createNetwork({ Name: name, Internal: internal });\n    }\n  }\n\n  private async buildProxyConfig(credentials: DependabotCredential[]): Promise<DependabotProxyConfig> {\n    const ca = await ProxyBuilder.generateCertificateAuthority();\n\n    const config: DependabotProxyConfig = { all_credentials: credentials, ca };\n\n    return config;\n  }\n\n  public static async generateCertificateAuthority(): Promise<CertificateAuthority> {\n    // node-forge is a CommonJS module, so we need to import it dynamically\n    const {\n      default: { md, pki },\n    } = await import('node-forge');\n    const keys = pki.rsa.generateKeyPair(KEY_SIZE);\n    const cert = pki.createCertificate();\n\n    cert.publicKey = keys.publicKey;\n    cert.serialNumber = '01';\n    cert.validity.notBefore = new Date();\n    cert.validity.notAfter = new Date();\n    cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + KEY_EXPIRY_YEARS);\n\n    cert.setSubject(CERT_SUBJECT);\n    cert.setIssuer(CERT_SUBJECT);\n\n    cert.setExtensions([\n      {\n        name: 'basicConstraints',\n        cA: true,\n        critical: true,\n      },\n      {\n        name: 'keyUsage',\n        digitalSignature: true,\n        keyEncipherment: true,\n        keyCertSign: true,\n        cRLSign: true,\n        critical: true,\n      },\n      {\n        name: 'extKeyUsage',\n        serverAuth: true,\n        clientAuth: true,\n      },\n      {\n        name: 'subjectKeyIdentifier',\n      },\n      {\n        name: 'authorityKeyIdentifier',\n        keyIdentifier: true,\n        authorityCertIssuer: true,\n        authorityCertSerialNumber: cert.serialNumber,\n      },\n    ]);\n\n    cert.sign(keys.privateKey, md.sha256.create());\n\n    const pem = pki.certificateToPem(cert);\n    const key = pki.privateKeyToPem(keys.privateKey);\n    return { cert: pem, key };\n  }\n\n  private async createContainer(\n    jobId: string,\n    jobToken: string,\n    dependabotApiUrl: string,\n    containerName: string,\n    externalNetwork: Network,\n    internalNetwork: Network,\n    internalNetworkName: string,\n  ): Promise<Container> {\n    const container = await this.docker.createContainer({\n      Image: this.proxyImage,\n      name: containerName,\n      AttachStdout: true,\n      AttachStderr: true,\n      Env: [\n        `http_proxy=${process.env.http_proxy || process.env.HTTP_PROXY || ''}`,\n        `https_proxy=${process.env.https_proxy || process.env.HTTPS_PROXY || ''}`,\n        `no_proxy=${process.env.no_proxy || process.env.NO_PROXY || ''}`,\n        `JOB_ID=${jobId}`,\n        `JOB_TOKEN=${jobToken}`,\n        `PROXY_CACHE=${this.cachedMode ? 'true' : 'false'}`,\n        `DEPENDABOT_API_URL=${dependabotApiUrl}`,\n        `ACTIONS_ID_TOKEN_REQUEST_TOKEN=${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN || ''}`,\n        `ACTIONS_ID_TOKEN_REQUEST_URL=${process.env.ACTIONS_ID_TOKEN_REQUEST_URL || ''}`,\n      ],\n      Entrypoint: ['sh', '-c', '/usr/sbin/update-ca-certificates && /update-job-proxy'],\n\n      HostConfig: {\n        NetworkMode: internalNetworkName,\n        ExtraHosts: ['host.docker.internal:host-gateway'], // needed for Docker on Linux\n      },\n    });\n\n    await externalNetwork.connect({ Container: container.id });\n\n    logger.info(`Created proxy container: ${container.id}`);\n    return container;\n  }\n\n  private customCAPath(): string | undefined {\n    if ('CUSTOM_CA_PATH' in process.env) {\n      return process.env.CUSTOM_CA_PATH;\n    }\n    // default to node.js configuration\n    return process.env.NODE_EXTRA_CA_CERTS;\n  }\n}\n","","// biome-ignore-all lint/suspicious/noShadowRestrictedNames: Proxy is okay\n\nimport type { FileFetcherInput, FileUpdaterInput } from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport type Docker from 'dockerode';\nimport type { Container } from 'dockerode';\nimport { ContainerService } from './container-service';\nimport type { JobParameters } from './params';\nimport type { Proxy } from './proxy';\nimport { extractUpdaterSha } from './utils';\n\nexport const JOB_OUTPUT_FILENAME = 'output.json';\nexport const JOB_OUTPUT_PATH = '/home/dependabot/dependabot-updater/output';\nexport const JOB_INPUT_FILENAME = 'job.json';\nexport const JOB_INPUT_PATH = `/home/dependabot/dependabot-updater`;\nexport const REPO_CONTENTS_PATH = '/home/dependabot/dependabot-updater/repo';\nexport const CA_CERT_INPUT_PATH = '/usr/local/share/ca-certificates';\nexport const CA_CERT_FILENAME = 'dbot-ca.crt';\nconst UPDATER_MAX_MEMORY = 8 * 1024 * 1024 * 1024; // 8GB in bytes\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport class UpdaterBuilder {\n  constructor(\n    private readonly docker: Docker,\n    private readonly jobParams: JobParameters,\n    private readonly input: FileFetcherInput | FileUpdaterInput,\n    private readonly proxy: Proxy,\n\n    private readonly updaterImage: string,\n  ) {}\n\n  async run(containerName: string): Promise<Container> {\n    const proxyUrl = await this.proxy.url();\n    const updaterSha = extractUpdaterSha(this.updaterImage);\n\n    const envVars = [\n      `GITHUB_ACTIONS=${process.env.GITHUB_ACTIONS}`,\n      `DEPENDABOT_JOB_ID=${this.jobParams.jobId}`,\n      `DEPENDABOT_JOB_TOKEN=`,\n      `DEPENDABOT_JOB_PATH=${JOB_INPUT_PATH}/${JOB_INPUT_FILENAME}`,\n      `DEPENDABOT_OPEN_TIMEOUT_IN_SECONDS=15`,\n      `DEPENDABOT_OUTPUT_PATH=${JOB_OUTPUT_PATH}/${JOB_OUTPUT_FILENAME}`,\n      `DEPENDABOT_REPO_CONTENTS_PATH=${REPO_CONTENTS_PATH}`,\n      `DEPENDABOT_API_URL=${this.jobParams.dependabotApiDockerUrl}`,\n      `SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt`,\n      `http_proxy=${proxyUrl}`,\n      `HTTP_PROXY=${proxyUrl}`,\n      `https_proxy=${proxyUrl}`,\n      `HTTPS_PROXY=${proxyUrl}`,\n      `UPDATER_ONE_CONTAINER=1`,\n      `ENABLE_CONNECTIVITY_CHECK=${process.env.DEPENDABOT_ENABLE_CONNECTIVITY_CHECK || '1'}`,\n\n      // for updates relying on .NET (e.g. NuGet) and running on macOS (e.g. dev laptop or local MacMini),\n      // we need to disable WriteXorExecute to avoid issues with emulation of Linux containers on macOS hosts\n      // with Apple Silicon (M1/M2) chips\n      // See - https://github.com/dotnet/runtime/issues/103063#issuecomment-2149599940\n      //     - https://github.com/dependabot/dependabot-core/issues/5037\n      ...(process.platform === 'darwin' ? [`DOTNET_EnableWriteXorExecute=0`] : []),\n    ];\n\n    // Add DEPENDABOT_UPDATER_SHA if we successfully extracted a SHA\n    if (updaterSha !== null) {\n      envVars.push(`DEPENDABOT_UPDATER_SHA=${updaterSha}`);\n    }\n\n    const container = await this.docker.createContainer({\n      Image: this.updaterImage,\n      name: containerName,\n      AttachStdout: true,\n      AttachStderr: true,\n      User: 'dependabot',\n      Env: envVars,\n      Cmd: ['/bin/sh'],\n      Tty: true,\n      HostConfig: {\n        Memory: UPDATER_MAX_MEMORY,\n        NetworkMode: this.proxy.networkName,\n      },\n    });\n\n    await ContainerService.storeCert(CA_CERT_FILENAME, CA_CERT_INPUT_PATH, container, this.proxy.cert);\n\n    await ContainerService.storeInput(JOB_INPUT_FILENAME, JOB_INPUT_PATH, container, this.input);\n\n    logger.info(`Created container: ${container.id}`);\n    return container;\n  }\n}\n","// biome-ignore-all lint/suspicious/noShadowRestrictedNames: Proxy is okay\n\nimport type {\n  DependabotCredential,\n  DependabotJobConfig,\n  FileFetcherInput,\n  FileUpdaterInput,\n} from '@paklo/core/dependabot';\nimport Docker, { type Container } from 'dockerode';\nimport { ContainerService } from './container-service';\nimport type { JobParameters } from './params';\nimport { type Proxy, ProxyBuilder } from './proxy';\nimport { UpdaterBuilder } from './updater-builder';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport class Updater {\n  docker: Docker;\n\n  constructor(\n    private readonly updaterImage: string,\n    private readonly proxyImage: string,\n    private readonly params: JobParameters,\n    private readonly job: DependabotJobConfig,\n    private readonly credentials: DependabotCredential[],\n    private readonly debug: boolean,\n  ) {\n    this.docker = new Docker();\n    this.job['credentials-metadata'] = this.generateCredentialsMetadata();\n  }\n\n  /**\n   * Execute an update job and report the result to Dependabot API.\n   */\n  async runUpdater(): Promise<boolean> {\n    const cachedMode = Object.hasOwn(this.job.experiments, 'proxy-cached') === true;\n\n    const proxyBuilder = new ProxyBuilder(this.docker, this.proxyImage, cachedMode, this.debug);\n\n    const proxy = await proxyBuilder.run(\n      this.params.jobId,\n      this.params.jobToken,\n      this.params.dependabotApiUrl,\n      this.credentials,\n    );\n    await proxy.container.start();\n\n    try {\n      await this.runUpdate(proxy);\n      return true;\n    } finally {\n      await this.cleanup(proxy);\n    }\n  }\n\n  private generateCredentialsMetadata(): DependabotCredential[] {\n    const unique: Set<string> = new Set();\n    const result: DependabotCredential[] = [];\n    for (const credential of this.credentials) {\n      if (credential.type === 'jit_access') {\n        continue;\n      }\n\n      // biome-ignore lint/suspicious/noExplicitAny: necessary\n      const obj: any = { type: credential.type };\n      if (credential.host !== undefined) {\n        obj.host = credential.host;\n      }\n      if (credential.registry !== undefined) {\n        obj.registry = credential.registry;\n      }\n      if (credential.url !== undefined) {\n        obj.url = credential.url;\n      }\n      this.setRegistryFromUrl(obj, credential);\n      if (credential['index-url'] !== undefined) {\n        obj['index-url'] = credential['index-url'];\n      }\n      this.setIndexUrlFromUrl(obj, credential);\n      if (credential['env-key'] !== undefined) {\n        obj['env-key'] = credential['env-key'];\n      }\n      if (credential.organization !== undefined) {\n        obj.organization = credential.organization;\n      }\n      if (credential['replaces-base'] !== undefined) {\n        obj['replaces-base'] = credential['replaces-base'];\n      }\n      if (credential['public-key-fingerprint'] !== undefined) {\n        obj['public-key-fingerprint'] = credential['public-key-fingerprint'];\n      }\n      if (credential.repo !== undefined) {\n        obj.repo = credential.repo;\n      }\n      const key = JSON.stringify(obj);\n      if (!unique.has(key)) {\n        unique.add(key);\n        result.push(obj as DependabotCredential);\n      }\n    }\n    return result;\n  }\n\n  private setRegistryFromUrl(obj: DependabotCredential, credential: DependabotCredential): void {\n    const typesThatUseRegistryAsHost = ['npm_registry', 'composer_repository', 'docker_registry'];\n\n    if (!typesThatUseRegistryAsHost.includes(credential.type)) {\n      return;\n    }\n\n    if (!credential.registry && credential.url) {\n      try {\n        const parsedURL = new URL(credential.url);\n        obj.registry = parsedURL.hostname;\n        if (credential.type === 'npm_registry') {\n          obj.registry += parsedURL.pathname;\n        }\n      } catch {\n        // If the URL is invalid, we skip setting the registry\n        // as it will fall back to the default registry for the given type (e.g., npm, Docker, or Composer).\n      }\n    }\n  }\n\n  private setIndexUrlFromUrl(obj: DependabotCredential, credential: DependabotCredential): void {\n    if (credential.type !== 'python_index') {\n      return;\n    }\n    if (credential['index-url']) {\n      return;\n    }\n    if (credential.url) {\n      try {\n        obj['index-url'] = credential.url;\n      } catch {\n        // If the URL is invalid, we skip setting the index-url\n        // as it will fall back to the default index URL for pip.\n      }\n    }\n  }\n\n  private async runUpdate(proxy: Proxy): Promise<void> {\n    const name = `dependabot-job-${this.params.jobId}`;\n    const container = await this.createContainer(proxy, name, {\n      job: this.job,\n    });\n\n    await ContainerService.run(container, this.job.command);\n  }\n\n  private async createContainer(\n    proxy: Proxy,\n    containerName: string,\n    input: FileFetcherInput | FileUpdaterInput,\n  ): Promise<Container> {\n    const builder = new UpdaterBuilder(this.docker, this.params, input, proxy, this.updaterImage);\n    return builder.run(containerName);\n  }\n\n  private async cleanup(proxy: Proxy): Promise<void> {\n    await proxy.shutdown();\n  }\n}\n","import crypto from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport os from 'node:os';\nimport { logger } from '@paklo/core/logger';\nimport type { UsageTelemetryRequestData } from '@paklo/core/usage';\nimport ky from 'ky';\nimport { z } from 'zod';\n\nimport packageJson from '../package.json';\nimport { ApiClient, CredentialFetchingError, type SecretMasker } from './api-client';\nimport { PROXY_IMAGE_NAME, updaterImageName } from './docker-tags';\nimport { ImageService, type MetricReporter } from './image-service';\nimport { getJobParameters } from './params';\nimport { Updater } from './updater';\n\nexport class JobRunnerImagingError extends Error {}\nexport class JobRunnerUpdaterError extends Error {}\n\nexport type RunJobOptions = {\n  dependabotApiUrl: string;\n  dependabotApiDockerUrl?: string;\n  jobId: string;\n  jobToken: string;\n  credentialsToken: string;\n  updaterImage?: string;\n  secretMasker: SecretMasker;\n  debug: boolean;\n  usage: Pick<UsageTelemetryRequestData, 'trigger' | 'provider' | 'owner' | 'project' | 'package-manager'>;\n};\nexport type RunJobResult = { success: true; message?: string } | { success: false; message: string };\n\nexport async function runJob(options: RunJobOptions): Promise<RunJobResult> {\n  const { jobId, dependabotApiUrl, dependabotApiDockerUrl, jobToken, credentialsToken, secretMasker, debug, usage } =\n    options;\n\n  const started = new Date();\n  let success = false;\n  let message: string | undefined;\n  try {\n    const params = getJobParameters({\n      jobId,\n      jobToken,\n      credentialsToken,\n      dependabotApiUrl,\n      dependabotApiDockerUrl: dependabotApiDockerUrl ?? dependabotApiUrl,\n      updaterImage: options.updaterImage,\n    })!;\n\n    const client = ky.create({ headers: { 'User-Agent': `paklo-runner/${packageJson.version}` } });\n    const apiClient = new ApiClient(client, params, jobToken, credentialsToken, secretMasker);\n\n    // If we fail to succeed in fetching the job details, we cannot be sure the job has entered a 'processing' state,\n    // so we do not try attempt to report back an exception if this fails and instead rely on the workflow run\n    // webhook as it anticipates scenarios where jobs have failed while 'enqueued'.\n    const job = await apiClient.getJobDetails();\n\n    // The params can specify which updater image to use. If it doesn't, fall back to the pinned version.\n    const updaterImage = params.updaterImage || updaterImageName(job['package-manager']);\n\n    // The sendMetrics function is used to send metrics to the API client.\n    // It uses the package manager as a tag to identify the metric.\n    const sendMetricsWithPackageManager: MetricReporter = async (name, metricType, value, additionalTags = {}) => {\n      try {\n        await apiClient.sendMetrics(name, metricType, value, {\n          package_manager: job['package-manager'],\n          ...additionalTags,\n        });\n      } catch (error) {\n        logger.warn(`Metric sending failed for ${name}: ${(error as Error).message}`);\n      }\n    };\n\n    const credentials = (await apiClient.getCredentials()) || [];\n\n    const updater = new Updater(updaterImage, PROXY_IMAGE_NAME, params, job, credentials, debug);\n\n    try {\n      // Using sendMetricsWithPackageManager wrapper to inject package manager tag to\n      // avoid passing additional parameters to ImageService.pull method\n      await ImageService.pull(updaterImage, sendMetricsWithPackageManager);\n      await ImageService.pull(PROXY_IMAGE_NAME, sendMetricsWithPackageManager);\n    } catch (err: unknown) {\n      if (err instanceof Error) {\n        throw new JobRunnerImagingError(err.message);\n      }\n    }\n\n    try {\n      await updater.runUpdater();\n    } catch (err: unknown) {\n      if (err instanceof Error) {\n        throw new JobRunnerUpdaterError(err.message);\n      }\n    }\n    success = true;\n  } catch (err) {\n    if (err instanceof JobRunnerImagingError) {\n      message = `Error fetching updater images: ${err.message}`;\n    } else if (err instanceof JobRunnerUpdaterError) {\n      message = `Error running updater: ${err.message}`;\n    } else if (err instanceof CredentialFetchingError) {\n      message = `Dependabot was unable to retrieve job credentials: ${err.message}`;\n    } else {\n      message = `Unknown error: ${(err as Error).message}`;\n    }\n  }\n\n  // send usage telemetry, unless explicitly disabled\n  const telemetryDisabled = z.stringbool().optional().parse(process.env.PAKLO_TELEMETRY_DISABLED);\n  if (!telemetryDisabled) {\n    // detect if we are running inside a Docker container\n    const inDocker = await isRunningInDocker();\n    const duration = Date.now() - started.getTime();\n    const data: UsageTelemetryRequestData = {\n      ...usage,\n      host: {\n        platform: os.platform(),\n        release: os.release(),\n        arch: os.arch(),\n        'machine-hash': crypto.createHash('sha256').update(os.hostname()).digest('hex'),\n        'docker-container': inDocker,\n      },\n      version: packageJson.version,\n      id: jobId,\n      started,\n      duration,\n      success,\n      // error message but truncate to first 1000 characters to avoid sending too much data\n      error: message ? { message: message.substring(0, 1000) } : undefined,\n    };\n    try {\n      const json = JSON.stringify(data);\n      logger.debug(`Usage telemetry data: ${json}`);\n      const resp = await ky.post('https://www.paklo.app/api/usage-telemetry', {\n        headers: { 'Content-Type': 'application/json' },\n        body: json,\n      });\n      if (!resp.ok) {\n        logger.debug(`Failed to send usage telemetry data: ${resp.status} ${resp.statusText}`);\n      }\n    } catch (err) {\n      logger.debug(`Failed to send usage telemetry data: ${(err as Error).message}`);\n      // ignore\n    }\n  } else {\n    logger.debug('Telemetry disabled, not sending usage telemetry data');\n  }\n\n  logger.info(`Update job ${jobId} completed`);\n  return { success, message: message! };\n}\n\n/**\n * Detects if the current process is running inside a Docker container.\n */\nexport async function isRunningInDocker(): Promise<boolean> {\n  // Check for .dockerenv file\n  if (existsSync('/.dockerenv')) return true;\n\n  // Check cgroup\n  try {\n    const cgroup = await readFile('/proc/self/cgroup', 'utf8');\n    return cgroup.includes('docker') || cgroup.includes('kubepods');\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAUA,IAAa,0BAAb,cAA6C,MAAM;AACnD,IAAa,0BAAb,cAA6C,MAAM;AAGnD,IAAa,YAAb,MAAuB;CACrB,AAAQ;CACR,AAAQ;CACR,YACE,AAAiBA,QACjB,AAASC,QACT,UACA,AAAiBC,kBACjB,AAAiBC,cACjB;EALiB;EACR;EAEQ;EACA;AAIjB,OAAK,mBADW,OAAO,iBAAiB,QAAQ,wBAAwB,YAAY;AAEpF,OAAK,WAAW;;CAKlB,aAAa,EACX,mBAAmB,WACpB;CAGD,cAAsB;AACpB,SAAO,KAAK;;CAGd,MAAM,gBAA8C;EAClD,MAAM,aAAa,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;AAC7E,MAAI;GACF,MAAM,MAAM,MAAM,KAAK,aAAkC,YAAY,KAAK,SAAS;AACnF,OAAI,IAAI,WAAW,IACjB,OAAM,IAAI,wBACR,iDAAiD,IAAI,OAAO,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,CAAC,GACjG;GAEH,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,OAAI,CAAC,KACH,OAAM,IAAI,wBAAwB,yCAAyC;AAG7E,UAAO;WACA,OAAO;AACd,OAAI,iBAAiB,wBACnB,OAAM;YACG,YAAY,MAAM,CAC3B,OAAM,IAAI,wBACR,iDAAiD,MAAM,SAAS,OAAO,IAAI,MAAM,UAClF;YACQ,iBAAiB,MAC1B,OAAM,IAAI,wBAAwB,yBAAyB,MAAM,KAAK,IAAI,MAAM,UAAU;AAE5F,SAAM;;;CAIV,MAAM,iBAAkD;EACtD,MAAM,iBAAiB,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;AACjF,MAAI;GACF,MAAM,MAAM,MAAM,KAAK,aAAqC,gBAAgB,KAAK,iBAAiB;AAElG,OAAI,IAAI,WAAW,IACjB,OAAM,IAAI,wBACR,iDAAiD,IAAI,OAAO,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,CAAC,GACjG;GAEH,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,OAAI,CAAC,KACH,OAAM,IAAI,wBAAwB,yCAAyC;AAI7E,QAAK,MAAM,cAAc,MAAM;AAC7B,QAAI,WAAW,SACb,MAAK,aAAa,WAAW,SAAS;AAExC,QAAI,WAAW,MACb,MAAK,aAAa,WAAW,MAAM;AAErC,QAAI,WAAW,YACb,MAAK,aAAa,WAAW,YAAY;;AAI7C,UAAO;WACAC,OAAgB;AACvB,OAAI,iBAAiB,wBACnB,OAAM;YACG,YAAY,MAAM,CAC3B,OAAM,IAAI,wBACR,iDAAiD,MAAM,SAAS,OAAO,IAAI,MAAM,UAClF;YACQ,iBAAiB,MAC1B,OAAM,IAAI,wBAAwB,yBAAyB,MAAM,KAAK,IAAI,MAAM,UAAU;AAE5F,SAAM;;;CAIV,MAAM,eAAe,OAAsD;EACzE,MAAM,iBAAiB,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;EACjF,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK,gBAAgB;GACjD,MAAM;GACN,SAAS,EAAE,eAAe,KAAK,UAAU;GAC1C,CAAC;AACF,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MAAM,2BAA2B,IAAI,SAAS;;CAI5D,MAAM,qBAAoC;EACxC,MAAM,qBAAqB,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;EACrF,MAAM,MAAM,MAAM,KAAK,OAAO,MAAM,oBAAoB;GACtD,MAAM,KAAK;GACX,SAAS,EAAE,eAAe,KAAK,UAAU;GAC1C,CAAC;AACF,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MAAM,2BAA2B,IAAI,SAAS;;CAI5D,MAAM,YACJ,MACA,YACA,OACA,iBAAyC,EAAE,EAC5B;AACf,MAAI;AACF,SAAM,KAAK,cAAc,CACvB;IACE,QAAQ,qBAAqB;IAC7B,MAAM;IACN;IACA,MAAM;IACP,CACF,CAAC;AACF,UAAO,KAAK,+CAA+C,KAAK,0BAA0B;WACnF,OAAO;AAGd,UAAO,KAAK,6BAA8B,MAAgB,UAAU;;;CAIxE,MAAM,cAAc,SAA4C;EAC9D,MAAM,aAAa,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;EAC7E,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK,YAAY;GAC7C,MAAM,EAAE,MAAM,SAAS;GACvB,SAAS,EAAE,eAAe,KAAK,UAAU;GAC1C,CAAC;AAEF,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MAAM,2BAA2B,IAAI,SAAS;;CAI5D,MAAc,aAAgB,KAAa,OAAe,SAA+C;EACvG,MAAM,UAAU,YAAoC;AAuBlD,UAtBY,MAAM,KAAK,OAAO,IAAO,KAAK;IACxC,SAAS,EAAE,eAAe,OAAO;IACjC,OAAO,EACL,OAAO,GAMR;IACD,OAAO,EACL,aAAa,CACX,OAAO,EAAE,SAAS,oBAAS,OAAO,iBAAiB;AACjD,SAAI,YAAY,MAAM,CACpB,QAAO,KAAK,6CAA6C,MAAM,SAAS,SAAS;MAGtF,EACF;IACD,GAAG;IACJ,CAAC;;AAKJ,SAAO,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AEnMpB,MAAa,mBAAmBC;AAEhC,SAAgB,iBAAiB,gBAAgC;AAC/D,QAAOC,mBAAsB;;AAG/B,MAAM,eAAe;AAErB,SAAgB,gBAA0B;AACxC,QAAO,OAAO,OAAOA,mBAAsB,CAAC,QAAQ,UAAU,MAAM,MAAM,aAAa,CAAC;;AAG1F,MAAM,mBACJ;AAEF,SAAgB,eAAe,WAA2B;CACxD,MAAM,QAAQ,UAAU,MAAM,iBAAiB;AAE/C,KAAI,OAAO,OACT,QAAO,MAAM,OAAO;KAEpB,OAAM,MAAM,qBAAqB;;AAIrC,SAAgB,UAAU,WAA4B;CACpD,MAAM,QAAQ,UAAU,MAAM,iBAAiB;AAE/C,KAAI,OAAO,QAAQ;AACjB,MAAI,OAAO,OAAO,OAChB,QAAO;AAET,SAAO;OAEP,OAAM,MAAM,qBAAqB;;AAIrC,SAAgB,WAAW,WAA2B;CACpD,MAAM,QAAQ,UAAU,MAAM,iBAAiB;AAE/C,KAAI,OAAO,OACT,QAAO,MAAM,OAAO,aAAc,MAAM,OAAO;KAE/C,OAAM,MAAM,qBAAqB;;;;;AC1CrC,MAAaC,aAAuB,IAAI,OAAO,SAAS,EAAE,QAAQ,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC;AAE3F,MAAa,aAAa,WAA6B;AACrD,QAAO,IAAI,OAAO,SAAS,EACzB,MAAM,OAAO,GAAG,MAAM;AACpB,UAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,MAAM,UAAU,GAAG;AACvD,QAAM;IAET,CAAC;;AAGJ,MAAa,aAAa,WAA6B;AACrD,QAAO,IAAI,OAAO,SAAS,EACzB,MAAM,OAAO,GAAG,MAAM;AACpB,UAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,MAAM,UAAU,GAAG;AACvD,QAAM;IAET,CAAC;;;;;;;AAQJ,MAAa,qBAAqB,iBAAwC;CACxE,MAAM,QAAQ,aAAa,MAAM,YAAY;AAC7C,QAAO,QAAQ,MAAM,KAAM;;;;;ACvB7B,IAAa,wBAAb,cAA2C,MAAM;AAEjD,MAAM,UAAU;AAEhB,MAAa,mBAAmB;CAC9B,MAAM,WACJ,MACA,MACA,WACA,OACe;EACf,MAAM,MAAM,MAAM;AAClB,MAAI,MAAM;GAAE;GAAM,MAAM;GAAS,EAAE,KAAK,UAAU,MAAM,CAAC;AACzD,MAAI,UAAU;AACd,QAAM,UAAU,WAAW,KAAK,EAAE,MAAM,CAAC;;CAG3C,MAAM,UAAU,MAAc,MAAc,WAAsB,MAA6B;EAC7F,MAAM,MAAM,MAAM;AAClB,MAAI,MAAM,EAAE,MAAM,EAAE,KAAK;AACzB,MAAI,UAAU;AACd,QAAM,UAAU,WAAW,KAAK,EAAE,MAAM,CAAC;;CAG3C,MAAM,IAAI,WAAsB,SAAoC;AAClE,MAAI;AAEF,SAAM,UAAU,OAAO;AACvB,UAAO,KAAK,qBAAqB,UAAU,KAAK;AAMhD,QAHsB,MAAM,UAAU,SAAS,EACH,QAAQ,KAAK,MAAM,QAAQ,IAAI,WAAW,qBAAqB,CAAC,EAEjF;AAEzB,UAAM,KAAK,YAAY,WAAW,CAAC,mCAAmC,EAAE,OAAO;IAG/E,MAAM,qBAAqB,CACzB,uDACA,0DACD;AAED,QAAI,YAAY,QACd,oBAAmB,KAAK,2DAA2D;QAEnF,oBAAmB,KAAK,2DAA2D;AAGrF,SAAK,MAAM,OAAO,mBAChB,OAAM,KAAK,YAAY,WAAW;KAAC;KAAW;KAAM;KAAI,EAAE,aAAa;UAEpE;IAEL,MAAM,UAAU,MAAM,UAAU,MAAM;AACtC,QAAI,QAAQ,eAAe,EACzB,OAAM,IAAI,MAAM,8BAA8B,QAAQ,aAAa;;AAIvE,UAAO;WACA,OAAO;AACd,UAAO,KAAK,6BAA6B,UAAU,GAAG,IAAI,QAAQ;AAClE,SAAM,IAAI,sBAAsB,8CAA8C;YACtE;AACR,OAAI;AACF,UAAM,UAAU,OAAO;KAAE,GAAG;KAAM,OAAO;KAAM,CAAC;AAChD,WAAO,KAAK,wBAAwB,UAAU,KAAK;YAC5C,OAAO;AACd,WAAO,KAAK,gCAAgC,UAAU,GAAG,IAAI,QAAQ;;;;CAK3E,MAAM,YAAY,WAAsB,KAAe,MAA6B;EAClF,MAAM,OAAO,MAAM,UAAU,KAAK;GAChC,KAAK;GACL,MAAM;GACN,cAAc;GACd,cAAc;GACf,CAAC;EAEF,MAAMC,WAAS,MAAM,KAAK,MAAM,EAAE,CAAC;AAGnC,QAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,aAAU,MAAM,YAAYA,UAAQ,UAAU,UAAU,EAAE,UAAU,UAAU,CAAC;AAE/E,YAAO,GAAG,aAAa;AACrB,aAAS;KACT;AAEF,YAAO,GAAG,UAAU,UAAU;AAC5B,WAAO,MAAM;KACb;IACF;AAGF,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAI,CAAC;EAExD,MAAM,aAAa,MAAM,KAAK,SAAS;AACvC,MAAI,WAAW,aAAa,EAC1B,OAAM,IAAI,MAAM,iCAAiC,WAAW,SAAS,IAAI,IAAI,KAAK,IAAI,GAAG;;CAG9F;;;;AC9GD,MAAM,cAAc;AACpB,MAAM,mBAAmB;AAIzB,MAAM,QAAQ,OAAO,OAA8B,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;AAEpG,MAAM,cAAc,OAAO,UAAgB,aAAoC;AAC7E,QAAO,IAAI,SAAS,SAAS,WAAW;AACtC,WAAO,MAAM,eAAeC,WAAS,QAAuB,MAAM,OAAO,IAAI,GAAG,QAAQ,OAAU,CAAE;GACpG;;AAGJ,SAAgB,gBAAgB,WAA2B;CACzD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,KAAI,MAAM,UAAU,KAAK,MAAM,OAAO,UACpC,QAAO,MAAM;AAEf,QAAO;;;AAWT,MAAa,eAAe;CAC1B,MAAM,KAAK,WAAmB,YAA6B,QAAQ,OAAsB;AAMvF,MAAI,EAAE,UAAU,WAAW,WAAW,IAAI,UAAU,WAAW,yBAAyB,EACtF,OAAM,IAAI,MAAM,8EAA8E;EAGhG,MAAMC,WAAS,IAAI,QAAQ;EAC3B,MAAM,MAAM,gBAAgB,UAAU;AACtC,MAAI;GACF,MAAM,QAAQ,MAAMA,SAAO,SAAS,UAAU,CAAC,SAAS;AACxD,OAAI,CAAC,OAAO;AACV,WAAO,KAAK,YAAY,UAAU,eAAe,MAAM,cAAc;AACrE;;WAEKC,GAAY;AACnB,OAAI,aAAa,SAAS,CAAC,EAAE,QAAQ,SAAS,gBAAgB,CAC5D,OAAM;;AAKV,QAAM,KAAK,oBAAoB,WADlB,EAAE,EACiCD,UAAQ,YAAY,IAAI;;CAI1E,MAAM,oBACJ,WACA,OAAO,EAAE,EACT,WAAS,IAAI,QAAQ,EACrB,YACA,KACe;EACf,IAAI,UAAU;AAEd,SAAO,UAAU,YACf,KAAI;AACF,UAAO,KAAK,iBAAiB,UAAU,YAAY,UAAU,EAAE,MAAM;AAErE,OAAI,WACF,OAAM,WAAW,mBAAmB,aAAa,GAAG,EAClD,KACD,CAAC;GAEJ,MAAMD,WAAS,MAAMC,SAAO,KAAK,WAAW,EAAE,YAAY,MAAM,CAAC;AACjE,SAAM,YAAYA,UAAQ,IAAI,UAAU,CAAC,KAAKD,SAAO,CAAC;AACtD,UAAO,KAAK,gBAAgB,YAAY;AACxC;WACO,OAAO;AACd,OAAI,EAAE,iBAAiB,OAAQ,OAAM;AAGrC,OACE,MAAM,QAAQ,SAAS,wBAAwB,IAC/C,MAAM,QAAQ,aAAa,CAAC,SAAS,oBAAoB,EACzD;AACA;AACA,QAAI,WAAW,aAAa;AAC1B,YAAO,MAAM,wBAAwB,UAAU,SAAS,YAAY,YAAY;AAChF,WAAM;;IAKR,MAAM,YAAY,mBAAmB,KAAK,IAAI,GAAG,QAAQ;IACzD,MAAM,SAAS,KAAK,QAAQ,GAAG;IAC/B,MAAM,QAAQ,YAAY,IAAI;AAE9B,WAAO,KAAK,kDAAkD,QAAQ,KAAM,QAAQ,EAAE,CAAC,aAAa;AACpG,UAAM,MAAM,MAAM;UACb;AAEL,WAAO,MAAM,6BAA6B,UAAU,IAAI,MAAM,UAAU;AACxE,UAAM;;;;CAKf;;;;ACzGD,IAAa,gBAAb,MAA2B;CACzB,YACE,AAASG,OACT,AAASC,UACT,AAASC,kBACT,AAASC,kBACT,AAASC,wBACT,AAASC,cACT;EANS;EACA;EACA;EACA;EACA;EACA;;;AAIb,SAAgB,iBAAiB,OAOR;AACvB,QAAO,IAAI,cACT,MAAM,OACN,MAAM,UACN,MAAM,kBACN,MAAM,kBACN,MAAM,wBACN,MAAM,aACP;;;;;ACjBH,MAAM,WAAW;AACjB,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AACzB,MAAa,mBAAmB;AAChC,MAAMC,uBAAqB;AAC3B,MAAM,sBAAsB;AAC5B,MAAM,eAAe;CACnB;EAAE,MAAM;EAAc,OAAO;EAA0B;CACvD;EAAE,MAAM;EAAoB,OAAO;EAAe;CAClD;EAAE,WAAW;EAAM,OAAO;EAAc;CACxC;EAAE,MAAM;EAAe,OAAO;EAAM;CACpC;EAAE,WAAW;EAAM,OAAO;EAAc;CACxC;EAAE,MAAM;EAAgB,OAAO;EAAiB;CACjD;AAED,IAAa,eAAb,MAAa,aAAa;CACxB,YACE,AAAiBC,UACjB,AAAiBC,YACjB,AAAiBC,YACjB,AAAiBC,OACjB;EAJiB;EACA;EACA;EACA;;CAGnB,MAAM,IACJ,OACA,UACA,kBACA,aACgB;EAChB,MAAM,OAAO,kBAAkB,MAAM;EACrC,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY;EACvD,MAAM,OAAO,OAAO,GAAG;EAEvB,MAAM,sBAAsB,kBAAkB,MAAM;EACpD,MAAM,kBAAkB,MAAM,KAAK,cAAc,qBAAqB,MAAM;EAE5E,MAAM,sBAAsB,kBAAkB,MAAM;EACpD,MAAM,kBAAkB,MAAM,KAAK,cAAc,qBAAqB,KAAK;EAE3E,MAAM,YAAY,MAAM,KAAK,gBAC3B,OACA,UACA,kBACA,MACA,iBACA,iBACA,oBACD;AAED,QAAM,iBAAiB,WAAW,kBAAkB,kBAAkB,WAAW,OAAO;EAExF,MAAM,eAAe,KAAK,cAAc;AACxC,MAAI,cAAc;AAChB,UAAO,KAAK,kDAAkD;GAE9D,MAAM,cAAc,MAAM,SAAS,cAAc,OAAO,EAAE,UAAU;AACpE,SAAM,iBAAiB,UAAU,qBAAqBJ,sBAAoB,WAAW,WAAW;;EAGlG,MAAMK,WAAS,MAAM,UAAU,OAAO;GACpC,QAAQ;GACR,QAAQ;GACR,QAAQ;GACT,CAAC;AACF,YAAU,MAAM,YACdA,UAGA,KAAK,QAAQ,UAAU,UAAU,GAAG,YACpC,KAAK,QAAQ,UAAU,UAAU,GAAG,WACrC;EAED,MAAM,MAAM,YAA6B;GACvC,MAAM,gBAAgB,MAAM,UAAU,SAAS;AAE/C,OAAI,cAAc,MAAM,YAAY,KAElC,QAAO,UADW,cAAc,gBAAgB,SAAS,GAAG,uBAAwB,UACzD;OAE3B,OAAM,IAAI,MAAM,gCAAgC;;AAIpD,SAAO;GACL;GACA,SAAS;GACT,aAAa;GACb;GACA;GACA,UAAU,YAAY;AACpB,UAAM,UAAU,MAAM;AACtB,UAAM,UAAU,QAAQ;AACxB,UAAM,QAAQ,IAAI,CAAC,gBAAgB,QAAQ,EAAE,gBAAgB,QAAQ,CAAC,CAAC;;GAE1E;;CAGH,MAAc,cAAc,MAAc,WAAW,MAAwB;EAC3E,MAAM,WAAW,MAAM,KAAK,OAAO,aAAa,EAC9C,SAAS,KAAK,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAC1C,CAAC;AACF,MAAI,SAAS,SAAS,EACpB,QAAO,KAAK,OAAO,WAAW,SAAS,GAAI,GAAG;MAE9C,QAAO,MAAM,KAAK,OAAO,cAAc;GAAE,MAAM;GAAM,UAAU;GAAU,CAAC;;CAI9E,MAAc,iBAAiB,aAAqE;AAKlG,SAFsC;GAAE,iBAAiB;GAAa,IAF3D,MAAM,aAAa,8BAA8B;GAEc;;CAK5E,aAAoB,+BAA8D;EAEhF,MAAM,EACJ,SAAS,EAAE,IAAI,UACb,MAAM,OAAO;EACjB,MAAM,OAAO,IAAI,IAAI,gBAAgB,SAAS;EAC9C,MAAM,OAAO,IAAI,mBAAmB;AAEpC,OAAK,YAAY,KAAK;AACtB,OAAK,eAAe;AACpB,OAAK,SAAS,4BAAY,IAAI,MAAM;AACpC,OAAK,SAAS,2BAAW,IAAI,MAAM;AACnC,OAAK,SAAS,SAAS,YAAY,KAAK,SAAS,UAAU,aAAa,GAAG,iBAAiB;AAE5F,OAAK,WAAW,aAAa;AAC7B,OAAK,UAAU,aAAa;AAE5B,OAAK,cAAc;GACjB;IACE,MAAM;IACN,IAAI;IACJ,UAAU;IACX;GACD;IACE,MAAM;IACN,kBAAkB;IAClB,iBAAiB;IACjB,aAAa;IACb,SAAS;IACT,UAAU;IACX;GACD;IACE,MAAM;IACN,YAAY;IACZ,YAAY;IACb;GACD,EACE,MAAM,wBACP;GACD;IACE,MAAM;IACN,eAAe;IACf,qBAAqB;IACrB,2BAA2B,KAAK;IACjC;GACF,CAAC;AAEF,OAAK,KAAK,KAAK,YAAY,GAAG,OAAO,QAAQ,CAAC;AAI9C,SAAO;GAAE,MAFG,IAAI,iBAAiB,KAAK;GAElB,KADR,IAAI,gBAAgB,KAAK,WAAW;GACvB;;CAG3B,MAAc,gBACZ,OACA,UACA,kBACA,eACA,iBACA,iBACA,qBACoB;EACpB,MAAM,YAAY,MAAM,KAAK,OAAO,gBAAgB;GAClD,OAAO,KAAK;GACZ,MAAM;GACN,cAAc;GACd,cAAc;GACd,KAAK;IACH,cAAc,QAAQ,IAAI,cAAc,QAAQ,IAAI,cAAc;IAClE,eAAe,QAAQ,IAAI,eAAe,QAAQ,IAAI,eAAe;IACrE,YAAY,QAAQ,IAAI,YAAY,QAAQ,IAAI,YAAY;IAC5D,UAAU;IACV,aAAa;IACb,eAAe,KAAK,aAAa,SAAS;IAC1C,sBAAsB;IACtB,kCAAkC,QAAQ,IAAI,kCAAkC;IAChF,gCAAgC,QAAQ,IAAI,gCAAgC;IAC7E;GACD,YAAY;IAAC;IAAM;IAAM;IAAwD;GAEjF,YAAY;IACV,aAAa;IACb,YAAY,CAAC,oCAAoC;IAClD;GACF,CAAC;AAEF,QAAM,gBAAgB,QAAQ,EAAE,WAAW,UAAU,IAAI,CAAC;AAE1D,SAAO,KAAK,4BAA4B,UAAU,KAAK;AACvD,SAAO;;CAGT,AAAQ,eAAmC;AACzC,MAAI,oBAAoB,QAAQ,IAC9B,QAAO,QAAQ,IAAI;AAGrB,SAAO,QAAQ,IAAI;;;;;;;;;;AE9NvB,MAAa,sBAAsB;AACnC,MAAa,kBAAkB;AAC/B,MAAa,qBAAqB;AAClC,MAAa,iBAAiB;AAC9B,MAAa,qBAAqB;AAClC,MAAa,qBAAqB;AAClC,MAAa,mBAAmB;AAChC,MAAM,qBAAqB,IAAI,OAAO,OAAO;AAI7C,IAAa,iBAAb,MAA4B;CAC1B,YACE,AAAiBC,UACjB,AAAiBC,WACjB,AAAiBC,OACjB,AAAiBC,SAEjB,AAAiBC,cACjB;EANiB;EACA;EACA;EACA;EAEA;;CAGnB,MAAM,IAAI,eAA2C;EACnD,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK;EACvC,MAAM,aAAa,kBAAkB,KAAK,aAAa;EAEvD,MAAM,UAAU;GACd,kBAAkB,QAAQ,IAAI;GAC9B,qBAAqB,KAAK,UAAU;GACpC;GACA,uBAAuB,eAAe,GAAG;GACzC;GACA,0BAA0B,gBAAgB,GAAG;GAC7C,iCAAiC;GACjC,sBAAsB,KAAK,UAAU;GACrC;GACA,cAAc;GACd,cAAc;GACd,eAAe;GACf,eAAe;GACf;GACA,6BAA6B,QAAQ,IAAI,wCAAwC;GAOjF,GAAI,QAAQ,aAAa,WAAW,CAAC,iCAAiC,GAAG,EAAE;GAC5E;AAGD,MAAI,eAAe,KACjB,SAAQ,KAAK,0BAA0B,aAAa;EAGtD,MAAM,YAAY,MAAM,KAAK,OAAO,gBAAgB;GAClD,OAAO,KAAK;GACZ,MAAM;GACN,cAAc;GACd,cAAc;GACd,MAAM;GACN,KAAK;GACL,KAAK,CAAC,UAAU;GAChB,KAAK;GACL,YAAY;IACV,QAAQ;IACR,aAAa,KAAK,MAAM;IACzB;GACF,CAAC;AAEF,QAAM,iBAAiB,UAAU,kBAAkB,oBAAoB,WAAW,KAAK,MAAM,KAAK;AAElG,QAAM,iBAAiB,WAAW,oBAAoB,gBAAgB,WAAW,KAAK,MAAM;AAE5F,SAAO,KAAK,sBAAsB,UAAU,KAAK;AACjD,SAAO;;;;;;ACtEX,IAAa,UAAb,MAAqB;CACnB;CAEA,YACE,AAAiBC,cACjB,AAAiBC,YACjB,AAAiBC,QACjB,AAAiBC,KACjB,AAAiBC,aACjB,AAAiBC,OACjB;EANiB;EACA;EACA;EACA;EACA;EACA;AAEjB,OAAK,SAAS,IAAI,QAAQ;AAC1B,OAAK,IAAI,0BAA0B,KAAK,6BAA6B;;;;;CAMvE,MAAM,aAA+B;EACnC,MAAM,aAAa,OAAO,OAAO,KAAK,IAAI,aAAa,eAAe,KAAK;EAI3E,MAAMC,UAAQ,MAFO,IAAI,aAAa,KAAK,QAAQ,KAAK,YAAY,YAAY,KAAK,MAAM,CAE1D,IAC/B,KAAK,OAAO,OACZ,KAAK,OAAO,UACZ,KAAK,OAAO,kBACZ,KAAK,YACN;AACD,QAAMA,QAAM,UAAU,OAAO;AAE7B,MAAI;AACF,SAAM,KAAK,UAAUA,QAAM;AAC3B,UAAO;YACC;AACR,SAAM,KAAK,QAAQA,QAAM;;;CAI7B,AAAQ,8BAAsD;EAC5D,MAAMC,yBAAsB,IAAI,KAAK;EACrC,MAAMC,SAAiC,EAAE;AACzC,OAAK,MAAM,cAAc,KAAK,aAAa;AACzC,OAAI,WAAW,SAAS,aACtB;GAIF,MAAMC,MAAW,EAAE,MAAM,WAAW,MAAM;AAC1C,OAAI,WAAW,SAAS,OACtB,KAAI,OAAO,WAAW;AAExB,OAAI,WAAW,aAAa,OAC1B,KAAI,WAAW,WAAW;AAE5B,OAAI,WAAW,QAAQ,OACrB,KAAI,MAAM,WAAW;AAEvB,QAAK,mBAAmB,KAAK,WAAW;AACxC,OAAI,WAAW,iBAAiB,OAC9B,KAAI,eAAe,WAAW;AAEhC,QAAK,mBAAmB,KAAK,WAAW;AACxC,OAAI,WAAW,eAAe,OAC5B,KAAI,aAAa,WAAW;AAE9B,OAAI,WAAW,iBAAiB,OAC9B,KAAI,eAAe,WAAW;AAEhC,OAAI,WAAW,qBAAqB,OAClC,KAAI,mBAAmB,WAAW;AAEpC,OAAI,WAAW,8BAA8B,OAC3C,KAAI,4BAA4B,WAAW;AAE7C,OAAI,WAAW,SAAS,OACtB,KAAI,OAAO,WAAW;GAExB,MAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,OAAI,CAAC,OAAO,IAAI,IAAI,EAAE;AACpB,WAAO,IAAI,IAAI;AACf,WAAO,KAAK,IAA4B;;;AAG5C,SAAO;;CAGT,AAAQ,mBAAmB,KAA2B,YAAwC;AAG5F,MAAI,CAF+B;GAAC;GAAgB;GAAuB;GAAkB,CAE7D,SAAS,WAAW,KAAK,CACvD;AAGF,MAAI,CAAC,WAAW,YAAY,WAAW,IACrC,KAAI;GACF,MAAM,YAAY,IAAI,IAAI,WAAW,IAAI;AACzC,OAAI,WAAW,UAAU;AACzB,OAAI,WAAW,SAAS,eACtB,KAAI,YAAY,UAAU;UAEtB;;CAOZ,AAAQ,mBAAmB,KAA2B,YAAwC;AAC5F,MAAI,WAAW,SAAS,eACtB;AAEF,MAAI,WAAW,aACb;AAEF,MAAI,WAAW,IACb,KAAI;AACF,OAAI,eAAe,WAAW;UACxB;;CAOZ,MAAc,UAAU,SAA6B;EACnD,MAAM,OAAO,kBAAkB,KAAK,OAAO;EAC3C,MAAM,YAAY,MAAM,KAAK,gBAAgBH,SAAO,MAAM,EACxD,KAAK,KAAK,KACX,CAAC;AAEF,QAAM,iBAAiB,IAAI,WAAW,KAAK,IAAI,QAAQ;;CAGzD,MAAc,gBACZ,SACA,eACA,OACoB;AAEpB,SADgB,IAAI,eAAe,KAAK,QAAQ,KAAK,QAAQ,OAAOA,SAAO,KAAK,aAAa,CAC9E,IAAI,cAAc;;CAGnC,MAAc,QAAQ,SAA6B;AACjD,QAAMA,QAAM,UAAU;;;;;;AChJ1B,IAAa,wBAAb,cAA2C,MAAM;AACjD,IAAa,wBAAb,cAA2C,MAAM;AAejD,eAAsB,OAAO,SAA+C;CAC1E,MAAM,EAAE,OAAO,kBAAkB,wBAAwB,UAAU,kBAAkB,cAAc,OAAO,UACxG;CAEF,MAAM,0BAAU,IAAI,MAAM;CAC1B,IAAI,UAAU;CACd,IAAII;AACJ,KAAI;EACF,MAAM,SAAS,iBAAiB;GAC9B;GACA;GACA;GACA;GACA,wBAAwB,0BAA0B;GAClD,cAAc,QAAQ;GACvB,CAAC;EAGF,MAAM,YAAY,IAAI,UADP,GAAG,OAAO,EAAE,SAAS,EAAE,cAAc,gBAAgBC,WAAuB,EAAE,CAAC,EACtD,QAAQ,UAAU,kBAAkB,aAAa;EAKzF,MAAM,MAAM,MAAM,UAAU,eAAe;EAG3C,MAAM,eAAe,OAAO,gBAAgB,iBAAiB,IAAI,mBAAmB;EAIpF,MAAMC,gCAAgD,OAAO,MAAM,YAAY,OAAO,iBAAiB,EAAE,KAAK;AAC5G,OAAI;AACF,UAAM,UAAU,YAAY,MAAM,YAAY,OAAO;KACnD,iBAAiB,IAAI;KACrB,GAAG;KACJ,CAAC;YACK,OAAO;AACd,WAAO,KAAK,6BAA6B,KAAK,IAAK,MAAgB,UAAU;;;EAMjF,MAAM,UAAU,IAAI,QAAQ,cAAc,kBAAkB,QAAQ,KAF/C,MAAM,UAAU,gBAAgB,IAAK,EAAE,EAE0B,MAAM;AAE5F,MAAI;AAGF,SAAM,aAAa,KAAK,cAAc,8BAA8B;AACpE,SAAM,aAAa,KAAK,kBAAkB,8BAA8B;WACjEC,KAAc;AACrB,OAAI,eAAe,MACjB,OAAM,IAAI,sBAAsB,IAAI,QAAQ;;AAIhD,MAAI;AACF,SAAM,QAAQ,YAAY;WACnBA,KAAc;AACrB,OAAI,eAAe,MACjB,OAAM,IAAI,sBAAsB,IAAI,QAAQ;;AAGhD,YAAU;UACH,KAAK;AACZ,MAAI,eAAe,sBACjB,WAAU,kCAAkC,IAAI;WACvC,eAAe,sBACxB,WAAU,0BAA0B,IAAI;WAC/B,eAAe,wBACxB,WAAU,sDAAsD,IAAI;MAEpE,WAAU,kBAAmB,IAAc;;AAM/C,KAAI,CADsB,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM,QAAQ,IAAI,yBAAyB,EACvE;EAEtB,MAAM,WAAW,MAAM,mBAAmB;EAC1C,MAAM,WAAW,KAAK,KAAK,GAAG,QAAQ,SAAS;EAC/C,MAAMC,OAAkC;GACtC,GAAG;GACH,MAAM;IACJ,UAAU,GAAG,UAAU;IACvB,SAAS,GAAG,SAAS;IACrB,MAAM,GAAG,MAAM;IACf,gBAAgB,OAAO,WAAW,SAAS,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC,OAAO,MAAM;IAC/E,oBAAoB;IACrB;GACQH;GACT,IAAI;GACJ;GACA;GACA;GAEA,OAAO,UAAU,EAAE,SAAS,QAAQ,UAAU,GAAG,IAAK,EAAE,GAAG;GAC5D;AACD,MAAI;GACF,MAAM,OAAO,KAAK,UAAU,KAAK;AACjC,UAAO,MAAM,yBAAyB,OAAO;GAC7C,MAAM,OAAO,MAAM,GAAG,KAAK,6CAA6C;IACtE,SAAS,EAAE,gBAAgB,oBAAoB;IAC/C,MAAM;IACP,CAAC;AACF,OAAI,CAAC,KAAK,GACR,QAAO,MAAM,wCAAwC,KAAK,OAAO,GAAG,KAAK,aAAa;WAEjF,KAAK;AACZ,UAAO,MAAM,wCAAyC,IAAc,UAAU;;OAIhF,QAAO,MAAM,uDAAuD;AAGtE,QAAO,KAAK,cAAc,MAAM,YAAY;AAC5C,QAAO;EAAE;EAAkB;EAAU;;;;;AAMvC,eAAsB,oBAAsC;AAE1D,KAAI,WAAW,cAAc,CAAE,QAAO;AAGtC,KAAI;EACF,MAAM,SAAS,MAAM,SAAS,qBAAqB,OAAO;AAC1D,SAAO,OAAO,SAAS,SAAS,IAAI,OAAO,SAAS,WAAW;SACzD;AACN,SAAO"}

package/dist/{server-89g3AXRY.d.mts → server-6BlJr2bw.d.mts}

@@ -111,7 +111,7 @@ declare abstract class LocalDependabotServer {
     }[];
     'security-updates-only': boolean;
     source: {
-      provider: "azure" | "gitlab" | "bitbucket";
+      provider: "azure" | "bitbucket" | "gitlab";
       repo: string;
       directory?: string | null | undefined;
       directories?: string[] | null | undefined;
@@ -227,4 +227,4 @@ declare abstract class LocalDependabotServer {
 }
 //#endregion
 export { LocalJobsRunner as a, LocalDependabotServerOptions as i, LocalDependabotServer as n, LocalJobsRunnerOptions as o, LocalDependabotServerAddOptions as r, RunJobsResult as s, AffectedPullRequestIds as t };
-//# sourceMappingURL=server-89g3AXRY.d.mts.map
+//# sourceMappingURL=server-6BlJr2bw.d.mts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paklo/runner",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "sideEffects": false,
   "type": "module",
   "author": "mburumaxwell",
@@ -39,20 +39,20 @@
   },
   "homepage": "https://github.com/mburumaxwell/dependabot-azure-devops#readme",
   "dependencies": {
-    "@hono/node-server": "1.19.6",
+    "@hono/node-server": "1.19.7",
     "dockerode": "4.0.9",
     "ky": "1.14.1",
     "node-forge": "1.3.3",
     "tar-stream": "3.1.7",
-    "zod": "4.1.13",
-    "@paklo/core": "0.9.0"
+    "zod": "4.2.1",
+    "@paklo/core": "0.11.0"
   },
   "devDependencies": {
     "@types/dockerode": "3.3.47",
-    "@types/node": "24.10.1",
+    "@types/node": "25.0.3",
     "@types/node-forge": "1.3.14",
     "@types/tar-stream": "3.1.4",
-    "tsdown": "0.17.1",
+    "tsdown": "0.18.1",
     "tsx": "4.21.0"
   },
   "publishConfig": {

package/dist/run-CJUFvK8K.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-CJUFvK8K.mjs","names":["client: KyInstance","params: JobParameters","credentialsToken: string","secretMasker: SecretMasker","error: unknown","dockerContainerConfig.proxy","dockerContainerConfig","stream","stream","docker","e: unknown","jobId: string","jobToken: string","credentialsToken: string","dependabotApiUrl: string","dependabotApiDockerUrl: string","updaterImage: string","CA_CERT_INPUT_PATH","docker: Docker","proxyImage: string","cachedMode: boolean","stream","docker: Docker","jobParams: JobParameters","input: FileFetcherInput | FileUpdaterInput","proxy: Proxy","updaterImage: string","updaterImage: string","proxyImage: string","params: JobParameters","job: DependabotJobConfig","credentials: DependabotCredential[]","proxy","unique: Set<string>","result: DependabotCredential[]","obj: any","message: string | undefined","packageJson.version","sendMetricsWithPackageManager: MetricReporter","err: unknown","data: UsageTelemetryRequestData"],"sources":["../src/api-client.ts","../docker/containers.json","../src/docker-tags.ts","../src/utils.ts","../src/container-service.ts","../src/image-service.ts","../src/params.ts","../src/proxy.ts","../package.json","../src/updater-builder.ts","../src/updater.ts","../src/run.ts"],"sourcesContent":["import type {\n  DependabotCredential,\n  DependabotJobConfig,\n  DependabotMetric,\n  DependabotRecordUpdateJobError,\n} from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport { isHTTPError, type KyInstance, type KyResponse } from 'ky';\nimport type { JobParameters } from './params';\n\nexport class JobDetailsFetchingError extends Error {}\nexport class CredentialFetchingError extends Error {}\nexport type SecretMasker = (value: string) => void;\n\nexport class ApiClient {\n  private dependabotApiUrl: string;\n  private jobToken: string;\n  constructor(\n    private readonly client: KyInstance,\n    readonly params: JobParameters,\n    jobToken: string,\n    private readonly credentialsToken: string,\n    private readonly secretMasker: SecretMasker,\n  ) {\n    // if dependabotApiUrl contains \"host.docker.internal\", we need to replace it with \"localhost\" for local calls\n    const baseUrl = params.dependabotApiUrl.replace('host.docker.internal', 'localhost');\n    this.dependabotApiUrl = baseUrl;\n    this.jobToken = jobToken;\n  }\n\n  // We use a static unknown SHA when marking a job as complete from the action\n  // to remain in parity with the existing runner.\n  UnknownSha = {\n    'base-commit-sha': 'unknown',\n  };\n\n  // Getter for jobToken\n  getJobToken(): string {\n    return this.jobToken;\n  }\n\n  async getJobDetails(): Promise<DependabotJobConfig> {\n    const detailsURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/details`;\n    try {\n      const res = await this.getWithRetry<DependabotJobConfig>(detailsURL, this.jobToken);\n      if (res.status !== 200) {\n        throw new JobDetailsFetchingError(\n          `fetching job details: unexpected status code: ${res.status}: ${JSON.stringify(await res.json())}`,\n        );\n      }\n      const data = await res.json();\n      if (!data) {\n        throw new JobDetailsFetchingError(`fetching job details: missing response`);\n      }\n\n      return data;\n    } catch (error) {\n      if (error instanceof JobDetailsFetchingError) {\n        throw error;\n      } else if (isHTTPError(error)) {\n        throw new JobDetailsFetchingError(\n          `fetching job details: unexpected status code: ${error.response.status}: ${error.message}`,\n        );\n      } else if (error instanceof Error) {\n        throw new JobDetailsFetchingError(`fetching job details: ${error.name}: ${error.message}`);\n      }\n      throw error;\n    }\n  }\n\n  async getCredentials(): Promise<DependabotCredential[]> {\n    const credentialsURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/credentials`;\n    try {\n      const res = await this.getWithRetry<DependabotCredential[]>(credentialsURL, this.credentialsToken);\n\n      if (res.status !== 200) {\n        throw new CredentialFetchingError(\n          `fetching credentials: unexpected status code: ${res.status}: ${JSON.stringify(await res.json())}`,\n        );\n      }\n      const data = await res.json();\n      if (!data) {\n        throw new CredentialFetchingError(`fetching credentials: missing response`);\n      }\n\n      // Mask any secrets we've just retrieved from environment logs\n      for (const credential of data) {\n        if (credential.password) {\n          this.secretMasker(credential.password);\n        }\n        if (credential.token) {\n          this.secretMasker(credential.token);\n        }\n        if (credential['auth-key']) {\n          this.secretMasker(credential['auth-key']);\n        }\n      }\n\n      return data;\n    } catch (error: unknown) {\n      if (error instanceof CredentialFetchingError) {\n        throw error;\n      } else if (isHTTPError(error)) {\n        throw new CredentialFetchingError(\n          `fetching credentials: unexpected status code: ${error.response.status}: ${error.message}`,\n        );\n      } else if (error instanceof Error) {\n        throw new CredentialFetchingError(`fetching credentials: ${error.name}: ${error.message}`);\n      }\n      throw error;\n    }\n  }\n\n  async reportJobError(error: DependabotRecordUpdateJobError): Promise<void> {\n    const recordErrorURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/record_update_job_error`;\n    const res = await this.client.post(recordErrorURL, {\n      json: error,\n      headers: { Authorization: this.jobToken },\n    });\n    if (res.status !== 204) {\n      throw new Error(`Unexpected status code: ${res.status}`);\n    }\n  }\n\n  async markJobAsProcessed(): Promise<void> {\n    const markAsProcessedURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/mark_as_processed`;\n    const res = await this.client.patch(markAsProcessedURL, {\n      json: this.UnknownSha,\n      headers: { Authorization: this.jobToken },\n    });\n    if (res.status !== 204) {\n      throw new Error(`Unexpected status code: ${res.status}`);\n    }\n  }\n\n  async sendMetrics(\n    name: string,\n    metricType: 'increment' | 'gauge',\n    value: number,\n    additionalTags: Record<string, string> = {},\n  ): Promise<void> {\n    try {\n      await this.reportMetrics([\n        {\n          metric: `dependabot.action.${name}`,\n          type: metricType,\n          value,\n          tags: additionalTags,\n        },\n      ]);\n      logger.info(`Successfully sent metric (dependabot.action.${name}) to remote API endpoint`);\n    } catch (error) {\n      // metrics should typically not cause critical path failure so we log the\n      // failure and continue with the job\n      logger.warn(`Metrics reporting failed: ${(error as Error).message}`);\n    }\n  }\n\n  async reportMetrics(metrics: DependabotMetric[]): Promise<void> {\n    const metricsURL = `${this.dependabotApiUrl}/update_jobs/${this.params.jobId}/record_metrics`;\n    const res = await this.client.post(metricsURL, {\n      json: { data: metrics },\n      headers: { Authorization: this.jobToken },\n    });\n\n    if (res.status !== 204) {\n      throw new Error(`Unexpected status code: ${res.status}`);\n    }\n  }\n\n  private async getWithRetry<T>(url: string, token: string, options?: RequestInit): Promise<KyResponse<T>> {\n    const execute = async (): Promise<KyResponse<T>> => {\n      const res = await this.client.get<T>(url, {\n        headers: { Authorization: token },\n        retry: {\n          limit: 3,\n          // other default options are sufficient:\n          // https://github.com/sindresorhus/ky#retry\n          // delay: attemptCount => 0.3 * (2 ** (attemptCount - 1)) * 1000\n          // statusCodes: 408 413 429 500 502 503 504\n          // afterStatusCodes: 413, 429, 503\n        },\n        hooks: {\n          beforeRetry: [\n            async ({ request, options, error, retryCount }) => {\n              if (isHTTPError(error)) {\n                logger.warn(`Retrying failed request with status code: ${error.response.status}`);\n              }\n            },\n          ],\n        },\n        ...options,\n      });\n\n      return res;\n    };\n\n    return execute();\n  }\n}\n","{\n  \"proxy\": \"ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy:v2.0.20251202213123@sha256:d1a8233acc123b15d3e05e30f27ccef8a77969a949e778f0625245d88e72f0e1\",\n  \"bundler\": \"ghcr.io/dependabot/dependabot-updater-bundler:v2.0.20251207232046@sha256:535f7066f59ac0019291f99a8bec3dee635264dac32f72eef54ba135c92a4fdf\",\n  \"cargo\": \"ghcr.io/dependabot/dependabot-updater-cargo:v2.0.20251207232046@sha256:2f3b6e32b79f9c062145eeab86672a49266dafdcc55ba428a6672150111503cf\",\n  \"composer\": \"ghcr.io/dependabot/dependabot-updater-composer:v2.0.20251207232046@sha256:84850795fbf7ee130924f4d0145e88af85ea1f02691319fc9955a481d7a36215\",\n  \"conda\": \"ghcr.io/dependabot/dependabot-updater-conda:v2.0.20251207232046@sha256:8f16ad0df2e154873372435841c01062ee2fab288af4f9657a9e44b39b8256e9\",\n  \"pub\": \"ghcr.io/dependabot/dependabot-updater-pub:v2.0.20251207232046@sha256:abe764700e58ab87577096cbefde60e527c4537b97ae408de9836fdaed6b0c13\",\n  \"docker\": \"ghcr.io/dependabot/dependabot-updater-docker:v2.0.20251207232046@sha256:62f4f8efefa7e19dff412d20fc52f3af32832dc1011f1d9162336df2c413e3d6\",\n  \"elm\": \"ghcr.io/dependabot/dependabot-updater-elm:v2.0.20251207232046@sha256:d0a38f19b7d2a91e4b3d5fc22219ff97bd3cde7a2f22212e2e78b3dbc48be32a\",\n  \"github_actions\": \"ghcr.io/dependabot/dependabot-updater-github-actions:v2.0.20251207232046@sha256:65238cbba99cf3986617ad0db8b4e2945669c79419aea2f48d9f918209d2fbff\",\n  \"submodules\": \"ghcr.io/dependabot/dependabot-updater-gitsubmodule:v2.0.20251207232046@sha256:cecfbc4e099a315fcf85f7f7797f2c6c969ef09a48828dd1a12bb7e058e853ee\",\n  \"go_modules\": \"ghcr.io/dependabot/dependabot-updater-gomod:v2.0.20251207232046@sha256:99f4e52b8d395aeb547aec5f087ce73bc0f5dcd34996e1f1090731179bbf7cd6\",\n  \"gradle\": \"ghcr.io/dependabot/dependabot-updater-gradle:v2.0.20251207232046@sha256:2e99448ca6714a304a9489e1b430de9778b7e8fc59b3ef54006eea24dad500f3\",\n  \"maven\": \"ghcr.io/dependabot/dependabot-updater-maven:v2.0.20251207232046@sha256:4706ec461230493af2e3591bbb05355c0e4bb027dc90c082ec35c1f5c16559df\",\n  \"hex\": \"ghcr.io/dependabot/dependabot-updater-mix:v2.0.20251207232046@sha256:664a8cc9e71564f164a1b0935567f9a20a383ca1512b442dbfd9724b30298855\",\n  \"nuget\": \"ghcr.io/dependabot/dependabot-updater-nuget:v2.0.20251207232046@sha256:e1aa1af1ebe1e0b37fc3d9994767df3e74dede38a0a4e6403a45583222a2c407\",\n  \"npm_and_yarn\": \"ghcr.io/dependabot/dependabot-updater-npm:v2.0.20251207232046@sha256:92b1766cc4fc8c5198be41244eba46fad8fff98d8f654ac294383d1bacfae9ae\",\n  \"pip\": \"ghcr.io/dependabot/dependabot-updater-pip:v2.0.20251207232046@sha256:9c29d05dbfa68bcd1de580bbeaa19828d3e7f0886994e504d6b08277d348d05b\",\n  \"rust_toolchain\": \"ghcr.io/dependabot/dependabot-updater-rust-toolchain:v2.0.20251207232046@sha256:2639b65390474bbf87f6688bd1932a631bcdbc8f5435190dd0b5a6f033b98947\",\n  \"swift\": \"ghcr.io/dependabot/dependabot-updater-swift:v2.0.20251207232046@sha256:b9213edde2244811d1d12905823e6fa5a593feb824017a675b0e4894fe8f67ea\",\n  \"terraform\": \"ghcr.io/dependabot/dependabot-updater-terraform:v2.0.20251207232046@sha256:f2042674b03bf89fe8129a92c59c2a66861594a63c7a5b94335fe88887e94119\",\n  \"devcontainers\": \"ghcr.io/dependabot/dependabot-updater-devcontainers:v2.0.20251207232046@sha256:befd2ea6d0168d3c4b2f8296b31e27e3b5a30cdbf77e9a17cc6f0637a6d54087\",\n  \"dotnet_sdk\": \"ghcr.io/dependabot/dependabot-updater-dotnet-sdk:v2.0.20251207232046@sha256:b2dbaafa5e3e108bb65137ef8753fc385ad895ec7db76afb5de431981c1a1442\",\n  \"bun\": \"ghcr.io/dependabot/dependabot-updater-bun:v2.0.20251207232046@sha256:3fb2caaf8b4ae771d86de5bc56c5ce7e919d88eeeea7eab78865784690ede6f8\",\n  \"docker_compose\": \"ghcr.io/dependabot/dependabot-updater-docker-compose:v2.0.20251207232046@sha256:6662d9960d4c954e2cadcb5ac4803a149cfda4c29240ff7238420a547cdfb649\",\n  \"uv\": \"ghcr.io/dependabot/dependabot-updater-uv:v2.0.20251207232046@sha256:2e867aba1104f8ce94da2646dd76a00e16851dfeca326ecc53a2a30caeb676c3\",\n  \"vcpkg\": \"ghcr.io/dependabot/dependabot-updater-vcpkg:v2.0.20251207232046@sha256:d430246b7a19410c5d8aa865326c788ba647a17b7b1a64c72238cb5e93012b43\",\n  \"helm\": \"ghcr.io/dependabot/dependabot-updater-helm:v2.0.20251207232046@sha256:c691d6547db106d5f410b778b743fefa83989c5a88ac606b51a7a7d46634bbe9\",\n  \"julia\": \"ghcr.io/dependabot/dependabot-updater-julia:v2.0.20251207232046@sha256:f5a4ef00e536338154f6243c6ac1ca5fb4e25d04a9b2dba5b05307bfc7e92cde\",\n  \"bazel\": \"ghcr.io/dependabot/dependabot-updater-bazel:v2.0.20251207232046@sha256:7f433201619c1e8bb95f7137cfb44af577f7814afb2a396e545d7dced88a8e30\",\n  \"opentofu\": \"ghcr.io/dependabot/dependabot-updater-opentofu:v2.0.20251207232046@sha256:c690a868fdc273aa5182ca1a74e6811dcc880ce0663b6f3a72633098a2535d77\"\n}","import dockerContainerConfig from '../docker/containers.json';\n\nexport const PROXY_IMAGE_NAME = dockerContainerConfig.proxy;\n\nexport function updaterImageName(packageManager: string): string {\n  return dockerContainerConfig[packageManager as keyof typeof dockerContainerConfig];\n}\n\nconst updaterRegex = /ghcr.io\\/dependabot\\/dependabot-updater-([\\w+])/;\n\nexport function updaterImages(): string[] {\n  return Object.values(dockerContainerConfig).filter((image) => image.match(updaterRegex));\n}\n\nconst imageNamePattern =\n  '^(?<repository>(([a-zA-Z0-9._-]+([:[0-9]+[^/]))?([a-zA-Z0-9._/-]+)?))(:[a-zA-Z0-9._/-]+)?(?<digest>@sha256:[a-zA-Z0-9]{64})?$';\n\nexport function repositoryName(imageName: string): string {\n  const match = imageName.match(imageNamePattern);\n\n  if (match?.groups) {\n    return match.groups.repository!;\n  } else {\n    throw Error('invalid image name');\n  }\n}\n\nexport function hasDigest(imageName: string): boolean {\n  const match = imageName.match(imageNamePattern);\n\n  if (match?.groups) {\n    if (match?.groups.digest) {\n      return true;\n    }\n    return false;\n  } else {\n    throw Error('invalid image name');\n  }\n}\n\nexport function digestName(imageName: string): string {\n  const match = imageName.match(imageNamePattern);\n\n  if (match?.groups) {\n    return match.groups.repository! + match.groups.digest;\n  } else {\n    throw Error('invalid image name');\n  }\n}\n","import stream, { type Writable } from 'node:stream';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport const outStream = (prefix: string): Writable => {\n  return new stream.Writable({\n    write(chunk, _, next) {\n      process.stdout.write(`${prefix} | ${chunk.toString()}`);\n      next();\n    },\n  });\n};\n\nexport const errStream = (prefix: string): Writable => {\n  return new stream.Writable({\n    write(chunk, _, next) {\n      process.stderr.write(`${prefix} | ${chunk.toString()}`);\n      next();\n    },\n  });\n};\n\n/**\n * Extracts the SHA from an updater image string.\n * @param updaterImage - Image string in the format \"image:sha\" or \"registry/image:sha\"\n * @returns The SHA part after the last colon, or null if no colon is found\n */\nexport const extractUpdaterSha = (updaterImage: string): string | null => {\n  const match = updaterImage.match(/:([^:]*)$/);\n  return match ? match[1]! : null;\n};\n","import type { DependabotProxyConfig, FileFetcherInput, FileUpdaterInput } from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport type { Container } from 'dockerode';\nimport { pack } from 'tar-stream';\nimport { errStream, outStream } from './utils';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport class ContainerRuntimeError extends Error {}\n\nconst RWX_ALL = 0o777;\n\nexport const ContainerService = {\n  async storeInput(\n    name: string,\n    path: string,\n    container: Container,\n    input: FileFetcherInput | FileUpdaterInput | DependabotProxyConfig,\n  ): Promise<void> {\n    const tar = pack();\n    tar.entry({ name, mode: RWX_ALL }, JSON.stringify(input));\n    tar.finalize();\n    await container.putArchive(tar, { path });\n  },\n\n  async storeCert(name: string, path: string, container: Container, cert: string): Promise<void> {\n    const tar = pack();\n    tar.entry({ name }, cert);\n    tar.finalize();\n    await container.putArchive(tar, { path });\n  },\n\n  async run(container: Container, command?: string): Promise<boolean> {\n    try {\n      // Start the container\n      await container.start();\n      logger.info(`Started container ${container.id}`);\n\n      // Check if this is a dependabot container (has the expected structure)\n      const containerInfo = await container.inspect();\n      const isDependabotContainer = containerInfo.Config?.Env?.some((env) => env.startsWith('DEPENDABOT_JOB_ID='));\n\n      if (isDependabotContainer) {\n        // For dependabot containers, run CA certificates update as root first\n        await this.execCommand(container, ['/usr/sbin/update-ca-certificates'], 'root');\n\n        // Then run the dependabot commands as dependabot user\n        const dependabotCommands = [\n          'mkdir -p /home/dependabot/dependabot-updater/output',\n          '$DEPENDABOT_HOME/dependabot-updater/bin/run fetch_files',\n        ];\n\n        if (command === 'graph') {\n          dependabotCommands.push('$DEPENDABOT_HOME/dependabot-updater/bin/run update_graph');\n        } else {\n          dependabotCommands.push('$DEPENDABOT_HOME/dependabot-updater/bin/run update_files');\n        }\n\n        for (const cmd of dependabotCommands) {\n          await this.execCommand(container, ['/bin/sh', '-c', cmd], 'dependabot');\n        }\n      } else {\n        // For test containers and other containers, just wait for completion\n        const outcome = await container.wait();\n        if (outcome.StatusCode !== 0) {\n          throw new Error(`Container exited with code ${outcome.StatusCode}`);\n        }\n      }\n\n      return true;\n    } catch (error) {\n      logger.info(`Failure running container ${container.id}: ${error}`);\n      throw new ContainerRuntimeError('The updater encountered one or more errors.');\n    } finally {\n      try {\n        await container.remove({ v: true, force: true });\n        logger.info(`Cleaned up container ${container.id}`);\n      } catch (error) {\n        logger.info(`Failed to clean up container ${container.id}: ${error}`);\n      }\n    }\n  },\n\n  async execCommand(container: Container, cmd: string[], user: string): Promise<void> {\n    const exec = await container.exec({\n      Cmd: cmd,\n      User: user,\n      AttachStdout: true,\n      AttachStderr: true,\n    });\n\n    const stream = await exec.start({});\n\n    // Wait for the stream to end\n    await new Promise<void>((resolve, reject) => {\n      container.modem.demuxStream(stream, outStream('updater'), errStream('updater'));\n\n      stream.on('end', () => {\n        resolve();\n      });\n\n      stream.on('error', (error) => {\n        reject(error);\n      });\n    });\n\n    // Wait a bit for the exec to complete properly\n    await new Promise((resolve) => setTimeout(resolve, 100));\n\n    const inspection = await exec.inspect();\n    if (inspection.ExitCode !== 0) {\n      throw new Error(`Command failed with exit code ${inspection.ExitCode}: ${cmd.join(' ')}`);\n    }\n  },\n};\n","import { Readable } from 'node:stream';\nimport { logger } from '@paklo/core/logger';\nimport Docker from 'dockerode';\n\nconst MAX_RETRIES = 5; // Maximum number of retries\nconst INITIAL_DELAY_MS = 2000; // Initial delay in milliseconds for backoff\n\n// Code below is borrowed and adapted from dependabot-action\n\nconst sleep = async (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));\n\nconst endOfStream = async (docker: Docker, stream: Readable): Promise<void> => {\n  return new Promise((resolve, reject) => {\n    docker.modem.followProgress(stream, (err: Error | null) => (err ? reject(err) : resolve(undefined)));\n  });\n};\n\nexport function getOrgFromImage(imageName: string): string {\n  const parts = imageName.split('/');\n  if (parts.length >= 3 && parts[0] === 'ghcr.io') {\n    return parts[1]!; // The domain is always the second part\n  }\n  return 'unknown'; // Fallback case if structure is unexpected\n}\n\nexport type MetricReporter = (\n  metricName: string,\n  metricType: 'increment' | 'gauge',\n  value: number,\n  additionalTags?: Record<string, string>,\n) => Promise<void>;\n\n/** Fetch the configured updater image, if it isn't already available. */\nexport const ImageService = {\n  async pull(imageName: string, sendMetric?: MetricReporter, force = false): Promise<void> {\n    /*\n      This method fetches images hosts on GitHub infrastructure.\n\n      We expose the `fetch_image` utility method to allow us to pull in arbitrary images for unit tests.\n    */\n    if (!(imageName.startsWith('ghcr.io/') || imageName.startsWith('docker.pkg.github.com/'))) {\n      throw new Error('Only images distributed via docker.pkg.github.com or ghcr.io can be fetched');\n    }\n\n    const docker = new Docker();\n    const org = getOrgFromImage(imageName);\n    try {\n      const image = await docker.getImage(imageName).inspect();\n      if (!force) {\n        logger.info(`Resolved ${imageName} to existing ${image.RepoDigests}`);\n        return;\n      } // else fallthrough to pull\n    } catch (e: unknown) {\n      if (e instanceof Error && !e.message.includes('no such image')) {\n        throw e;\n      } // else fallthrough to pull\n    }\n\n    const auth = {}; // Images are public so not authentication info is required\n    await this.fetchImageWithRetry(imageName, auth, docker, sendMetric, org);\n  },\n\n  /* Retrieve the image using the auth details provided, if any with retry and backoff */\n  async fetchImageWithRetry(\n    imageName: string,\n    auth = {},\n    docker = new Docker(),\n    sendMetric: MetricReporter | undefined,\n    org: string,\n  ): Promise<void> {\n    let attempt = 0;\n\n    while (attempt < MAX_RETRIES) {\n      try {\n        logger.info(`Pulling image ${imageName} (attempt ${attempt + 1})...`);\n        /* To avoid sending metrics during unit tests (fetch_image) */\n        if (sendMetric) {\n          await sendMetric('ghcr_image_pull', 'increment', 1, {\n            org,\n          });\n        }\n        const stream = await docker.pull(imageName, { authconfig: auth });\n        await endOfStream(docker, new Readable().wrap(stream));\n        logger.info(`Pulled image ${imageName}`);\n        return; // Exit on success\n      } catch (error) {\n        if (!(error instanceof Error)) throw error; // Ensure error is an instance of Error\n\n        // Handle 429 Too Many Requests separately\n        if (\n          error.message.includes('429 Too Many Requests') ||\n          error.message.toLowerCase().includes('too many requests')\n        ) {\n          attempt++; // Only increment attempt on 429\n          if (attempt >= MAX_RETRIES) {\n            logger.error(`Failed to pull image ${imageName} after ${MAX_RETRIES} attempts.`);\n            throw error;\n          }\n\n          // Add jitter to avoid synchronization issues\n          // biome-ignore lint/style/useExponentiationOperator: This is clearer for now\n          const baseDelay = INITIAL_DELAY_MS * Math.pow(2, attempt);\n          const jitter = Math.random() * baseDelay;\n          const delay = baseDelay / 2 + jitter;\n\n          logger.warn(`Received Too Many Requests error. Retrying in ${(delay / 1000).toFixed(2)} seconds...`);\n          await sleep(delay);\n        } else {\n          // Non-429 errors should NOT be retried\n          logger.error(`Fatal error pulling image ${imageName}: ${error.message}`);\n          throw error; // Exit immediately\n        }\n      }\n    }\n  },\n};\n","// Code below is borrowed and adapted from dependabot-action\n\n/*\n `jobId` is intentionally a string even though we copied from code that used number\n We generate the job identifiers using Snowflake which produces bigint\n and bigint cannot be serialized to JSON, so we use string everywhere instead.\n The hosted dependabot possible uses auto-incrementing numbers for jobIds in their database,\n but not all databases support this.\n*/\n\nexport class JobParameters {\n  constructor(\n    readonly jobId: string,\n    readonly jobToken: string,\n    readonly credentialsToken: string,\n    readonly dependabotApiUrl: string,\n    readonly dependabotApiDockerUrl: string,\n    readonly updaterImage: string,\n  ) {}\n}\n\nexport function getJobParameters(input: {\n  jobId?: string;\n  jobToken?: string;\n  credentialsToken?: string;\n  dependabotApiUrl?: string;\n  dependabotApiDockerUrl?: string;\n  updaterImage?: string;\n}): JobParameters | null {\n  return new JobParameters(\n    input.jobId as string,\n    input.jobToken as string,\n    input.credentialsToken as string,\n    input.dependabotApiUrl as string,\n    input.dependabotApiDockerUrl as string,\n    input.updaterImage as string,\n  );\n}\n","import { readFile } from 'node:fs/promises';\nimport type { CertificateAuthority, DependabotCredential, DependabotProxyConfig } from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport type Docker from 'dockerode';\nimport type { Container, Network } from 'dockerode';\nimport { ContainerService } from './container-service';\nimport { errStream, outStream } from './utils';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport type Proxy = {\n  container: Container;\n  network: Network;\n  networkName: string;\n  url: () => Promise<string>;\n  cert: string;\n  shutdown: () => Promise<void>;\n};\n\nconst KEY_SIZE = 2048;\nconst KEY_EXPIRY_YEARS = 2;\nconst CONFIG_FILE_PATH = '/';\nexport const CONFIG_FILE_NAME = 'config.json';\nconst CA_CERT_INPUT_PATH = '/usr/local/share/ca-certificates';\nconst CUSTOM_CA_CERT_NAME = 'custom-ca-cert.crt';\nconst CERT_SUBJECT = [\n  { name: 'commonName', value: 'Dependabot Internal CA' },\n  { name: 'organizationName', value: 'GitHub Inc.' },\n  { shortName: 'OU', value: 'Dependabot' },\n  { name: 'countryName', value: 'US' },\n  { shortName: 'ST', value: 'California' },\n  { name: 'localityName', value: 'San Francisco' },\n];\n\nexport class ProxyBuilder {\n  constructor(\n    private readonly docker: Docker,\n    private readonly proxyImage: string,\n    private readonly cachedMode: boolean,\n  ) {}\n\n  async run(\n    jobId: string,\n    jobToken: string,\n    dependabotApiUrl: string,\n    credentials: DependabotCredential[],\n  ): Promise<Proxy> {\n    const name = `dependabot-job-${jobId}-proxy`;\n    const config = await this.buildProxyConfig(credentials);\n    const cert = config.ca.cert;\n\n    const externalNetworkName = `dependabot-job-${jobId}-external-network`;\n    const externalNetwork = await this.ensureNetwork(externalNetworkName, false);\n\n    const internalNetworkName = `dependabot-job-${jobId}-internal-network`;\n    const internalNetwork = await this.ensureNetwork(internalNetworkName, true);\n\n    const container = await this.createContainer(\n      jobId,\n      jobToken,\n      dependabotApiUrl,\n      name,\n      externalNetwork,\n      internalNetwork,\n      internalNetworkName,\n    );\n\n    await ContainerService.storeInput(CONFIG_FILE_NAME, CONFIG_FILE_PATH, container, config);\n\n    const customCAPath = this.customCAPath();\n    if (customCAPath) {\n      logger.info('Detected custom CA certificate, adding to proxy');\n\n      const customCert = (await readFile(customCAPath, 'utf8')).toString();\n      await ContainerService.storeCert(CUSTOM_CA_CERT_NAME, CA_CERT_INPUT_PATH, container, customCert);\n    }\n\n    const stream = await container.attach({\n      stream: true,\n      stdout: true,\n      stderr: true,\n    });\n    container.modem.demuxStream(stream, outStream('  proxy'), errStream('  proxy'));\n\n    const url = async (): Promise<string> => {\n      const containerInfo = await container.inspect();\n\n      if (containerInfo.State.Running === true) {\n        const ipAddress = containerInfo.NetworkSettings.Networks[`${internalNetworkName}`]!.IPAddress;\n        return `http://${ipAddress}:1080`;\n      } else {\n        throw new Error(\"proxy container isn't running\");\n      }\n    };\n\n    return {\n      container,\n      network: internalNetwork,\n      networkName: internalNetworkName,\n      url,\n      cert,\n      shutdown: async () => {\n        await container.stop();\n        await container.remove();\n        await Promise.all([externalNetwork.remove(), internalNetwork.remove()]);\n      },\n    };\n  }\n\n  private async ensureNetwork(name: string, internal = true): Promise<Network> {\n    const networks = await this.docker.listNetworks({\n      filters: JSON.stringify({ name: [name] }),\n    });\n    if (networks.length > 0) {\n      return this.docker.getNetwork(networks[0]!.Id);\n    } else {\n      return await this.docker.createNetwork({ Name: name, Internal: internal });\n    }\n  }\n\n  private async buildProxyConfig(credentials: DependabotCredential[]): Promise<DependabotProxyConfig> {\n    const ca = await ProxyBuilder.generateCertificateAuthority();\n\n    const config: DependabotProxyConfig = { all_credentials: credentials, ca };\n\n    return config;\n  }\n\n  public static async generateCertificateAuthority(): Promise<CertificateAuthority> {\n    // node-forge is a CommonJS module, so we need to import it dynamically\n    const {\n      default: { md, pki },\n    } = await import('node-forge');\n    const keys = pki.rsa.generateKeyPair(KEY_SIZE);\n    const cert = pki.createCertificate();\n\n    cert.publicKey = keys.publicKey;\n    cert.serialNumber = '01';\n    cert.validity.notBefore = new Date();\n    cert.validity.notAfter = new Date();\n    cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + KEY_EXPIRY_YEARS);\n\n    cert.setSubject(CERT_SUBJECT);\n    cert.setIssuer(CERT_SUBJECT);\n\n    cert.setExtensions([\n      {\n        name: 'basicConstraints',\n        cA: true,\n        critical: true,\n      },\n      {\n        name: 'keyUsage',\n        digitalSignature: true,\n        keyEncipherment: true,\n        keyCertSign: true,\n        cRLSign: true,\n        critical: true,\n      },\n      {\n        name: 'extKeyUsage',\n        serverAuth: true,\n        clientAuth: true,\n      },\n      {\n        name: 'subjectKeyIdentifier',\n      },\n      {\n        name: 'authorityKeyIdentifier',\n        keyIdentifier: true,\n        authorityCertIssuer: true,\n        authorityCertSerialNumber: cert.serialNumber,\n      },\n    ]);\n\n    cert.sign(keys.privateKey, md.sha256.create());\n\n    const pem = pki.certificateToPem(cert);\n    const key = pki.privateKeyToPem(keys.privateKey);\n    return { cert: pem, key };\n  }\n\n  private async createContainer(\n    jobId: string,\n    jobToken: string,\n    dependabotApiUrl: string,\n    containerName: string,\n    externalNetwork: Network,\n    internalNetwork: Network,\n    internalNetworkName: string,\n  ): Promise<Container> {\n    const container = await this.docker.createContainer({\n      Image: this.proxyImage,\n      name: containerName,\n      AttachStdout: true,\n      AttachStderr: true,\n      Env: [\n        `http_proxy=${process.env.http_proxy || process.env.HTTP_PROXY || ''}`,\n        `https_proxy=${process.env.https_proxy || process.env.HTTPS_PROXY || ''}`,\n        `no_proxy=${process.env.no_proxy || process.env.NO_PROXY || ''}`,\n        `JOB_ID=${jobId}`,\n        `JOB_TOKEN=${jobToken}`,\n        `PROXY_CACHE=${this.cachedMode ? 'true' : 'false'}`,\n        `DEPENDABOT_API_URL=${dependabotApiUrl}`,\n        `ACTIONS_ID_TOKEN_REQUEST_TOKEN=${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN || ''}`,\n        `ACTIONS_ID_TOKEN_REQUEST_URL=${process.env.ACTIONS_ID_TOKEN_REQUEST_URL || ''}`,\n      ],\n      Entrypoint: ['sh', '-c', '/usr/sbin/update-ca-certificates && /update-job-proxy'],\n\n      HostConfig: {\n        NetworkMode: internalNetworkName,\n        ExtraHosts: ['host.docker.internal:host-gateway'], // needed for Docker on Linux\n      },\n    });\n\n    await externalNetwork.connect({ Container: container.id });\n\n    logger.info(`Created proxy container: ${container.id}`);\n    return container;\n  }\n\n  private customCAPath(): string | undefined {\n    if ('CUSTOM_CA_PATH' in process.env) {\n      return process.env.CUSTOM_CA_PATH;\n    }\n    // default to node.js configuration\n    return process.env.NODE_EXTRA_CA_CERTS;\n  }\n}\n","{\n  \"name\": \"@paklo/runner\",\n  \"version\": \"0.7.0\",\n  \"sideEffects\": false,\n  \"type\": \"module\",\n  \"author\": \"mburumaxwell\",\n  \"license\": \"AGPL-3.0-later\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.mts\",\n      \"import\": \"./dist/index.mjs\"\n    },\n    \"./local\": {\n      \"types\": \"./dist/local/index.d.mts\",\n      \"import\": \"./dist/local/index.mjs\"\n    },\n    \"./local/azure\": {\n      \"types\": \"./dist/local/azure/index.d.mts\",\n      \"import\": \"./dist/local/azure/index.mjs\"\n    }\n  },\n  \"files\": [\n    \"dist\",\n    \"package.json\"\n  ],\n  \"scripts\": {\n    \"postinstall\": \"tsdown\",\n    \"dev\": \"tsdown --watch\",\n    \"prebuild\": \"tsc\",\n    \"build\": \"tsdown\",\n    \"lint\": \"biome check\",\n    \"test\": \"vitest\",\n    \"scripts:fetch-images\": \"tsx src/fetch-images.ts\",\n    \"scripts:cleanup-docker\": \"tsx src/cleanup-docker.ts\",\n    \"scripts:update-container-manifest\": \"tsx src/update-containers.ts\",\n    \"clean\": \"rimraf .turbo dist\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/mburumaxwell/dependabot-azure-devops.git\",\n    \"directory\": \"packages/runner\"\n  },\n  \"keywords\": [\n    \"dependabot\",\n    \"azure\",\n    \"devops\",\n    \"paklo\"\n  ],\n  \"bugs\": {\n    \"url\": \"https://github.com/mburumaxwell/dependabot-azure-devops/issues\"\n  },\n  \"homepage\": \"https://github.com/mburumaxwell/dependabot-azure-devops#readme\",\n  \"dependencies\": {\n    \"@hono/node-server\": \"1.19.6\",\n    \"@paklo/core\": \"workspace:*\",\n    \"dockerode\": \"4.0.9\",\n    \"ky\": \"1.14.1\",\n    \"node-forge\": \"1.3.3\",\n    \"tar-stream\": \"3.1.7\",\n    \"zod\": \"4.1.13\"\n  },\n  \"devDependencies\": {\n    \"@types/dockerode\": \"3.3.47\",\n    \"@types/node\": \"24.10.1\",\n    \"@types/node-forge\": \"1.3.14\",\n    \"@types/tar-stream\": \"3.1.4\",\n    \"tsdown\": \"0.17.1\",\n    \"tsx\": \"4.21.0\"\n  },\n  \"publishConfig\": {\n    \"access\": \"public\"\n  }\n}\n","// biome-ignore-all lint/suspicious/noShadowRestrictedNames: Proxy is okay\n\nimport type { FileFetcherInput, FileUpdaterInput } from '@paklo/core/dependabot';\nimport { logger } from '@paklo/core/logger';\nimport type Docker from 'dockerode';\nimport type { Container } from 'dockerode';\nimport { ContainerService } from './container-service';\nimport type { JobParameters } from './params';\nimport type { Proxy } from './proxy';\nimport { extractUpdaterSha } from './utils';\n\nexport const JOB_OUTPUT_FILENAME = 'output.json';\nexport const JOB_OUTPUT_PATH = '/home/dependabot/dependabot-updater/output';\nexport const JOB_INPUT_FILENAME = 'job.json';\nexport const JOB_INPUT_PATH = `/home/dependabot/dependabot-updater`;\nexport const REPO_CONTENTS_PATH = '/home/dependabot/dependabot-updater/repo';\nexport const CA_CERT_INPUT_PATH = '/usr/local/share/ca-certificates';\nexport const CA_CERT_FILENAME = 'dbot-ca.crt';\nconst UPDATER_MAX_MEMORY = 8 * 1024 * 1024 * 1024; // 8GB in bytes\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport class UpdaterBuilder {\n  constructor(\n    private readonly docker: Docker,\n    private readonly jobParams: JobParameters,\n    private readonly input: FileFetcherInput | FileUpdaterInput,\n    private readonly proxy: Proxy,\n\n    private readonly updaterImage: string,\n  ) {}\n\n  async run(containerName: string): Promise<Container> {\n    const proxyUrl = await this.proxy.url();\n    const updaterSha = extractUpdaterSha(this.updaterImage);\n\n    const envVars = [\n      `GITHUB_ACTIONS=${process.env.GITHUB_ACTIONS}`,\n      `DEPENDABOT_JOB_ID=${this.jobParams.jobId}`,\n      `DEPENDABOT_JOB_TOKEN=`,\n      `DEPENDABOT_JOB_PATH=${JOB_INPUT_PATH}/${JOB_INPUT_FILENAME}`,\n      `DEPENDABOT_OPEN_TIMEOUT_IN_SECONDS=15`,\n      `DEPENDABOT_OUTPUT_PATH=${JOB_OUTPUT_PATH}/${JOB_OUTPUT_FILENAME}`,\n      `DEPENDABOT_REPO_CONTENTS_PATH=${REPO_CONTENTS_PATH}`,\n      `DEPENDABOT_API_URL=${this.jobParams.dependabotApiDockerUrl}`,\n      `SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt`,\n      `http_proxy=${proxyUrl}`,\n      `HTTP_PROXY=${proxyUrl}`,\n      `https_proxy=${proxyUrl}`,\n      `HTTPS_PROXY=${proxyUrl}`,\n      `UPDATER_ONE_CONTAINER=1`,\n      `ENABLE_CONNECTIVITY_CHECK=${process.env.DEPENDABOT_ENABLE_CONNECTIVITY_CHECK || '1'}`,\n\n      // for updates relying on .NET (e.g. NuGet) and running on macOS (e.g. dev laptop or local MacMini),\n      // we need to disable WriteXorExecute to avoid issues with emulation of Linux containers on macOS hosts\n      // with Apple Silicon (M1/M2) chips\n      // See - https://github.com/dotnet/runtime/issues/103063#issuecomment-2149599940\n      //     - https://github.com/dependabot/dependabot-core/issues/5037\n      ...(process.platform === 'darwin' ? [`DOTNET_EnableWriteXorExecute=0`] : []),\n    ];\n\n    // Add DEPENDABOT_UPDATER_SHA if we successfully extracted a SHA\n    if (updaterSha !== null) {\n      envVars.push(`DEPENDABOT_UPDATER_SHA=${updaterSha}`);\n    }\n\n    const container = await this.docker.createContainer({\n      Image: this.updaterImage,\n      name: containerName,\n      AttachStdout: true,\n      AttachStderr: true,\n      User: 'dependabot',\n      Env: envVars,\n      Cmd: ['/bin/sh'],\n      Tty: true,\n      HostConfig: {\n        Memory: UPDATER_MAX_MEMORY,\n        NetworkMode: this.proxy.networkName,\n      },\n    });\n\n    await ContainerService.storeCert(CA_CERT_FILENAME, CA_CERT_INPUT_PATH, container, this.proxy.cert);\n\n    await ContainerService.storeInput(JOB_INPUT_FILENAME, JOB_INPUT_PATH, container, this.input);\n\n    logger.info(`Created container: ${container.id}`);\n    return container;\n  }\n}\n","// biome-ignore-all lint/suspicious/noShadowRestrictedNames: Proxy is okay\n\nimport type {\n  DependabotCredential,\n  DependabotJobConfig,\n  FileFetcherInput,\n  FileUpdaterInput,\n} from '@paklo/core/dependabot';\nimport Docker, { type Container } from 'dockerode';\nimport { ContainerService } from './container-service';\nimport type { JobParameters } from './params';\nimport { type Proxy, ProxyBuilder } from './proxy';\nimport { UpdaterBuilder } from './updater-builder';\n\n// Code below is borrowed and adapted from dependabot-action\n\nexport class Updater {\n  docker: Docker;\n\n  constructor(\n    private readonly updaterImage: string,\n    private readonly proxyImage: string,\n    private readonly params: JobParameters,\n    private readonly job: DependabotJobConfig,\n    private readonly credentials: DependabotCredential[],\n  ) {\n    this.docker = new Docker();\n    this.job['credentials-metadata'] = this.generateCredentialsMetadata();\n  }\n\n  /**\n   * Execute an update job and report the result to Dependabot API.\n   */\n  async runUpdater(): Promise<boolean> {\n    const cachedMode = Object.hasOwn(this.job.experiments, 'proxy-cached') === true;\n\n    const proxyBuilder = new ProxyBuilder(this.docker, this.proxyImage, cachedMode);\n\n    const proxy = await proxyBuilder.run(\n      this.params.jobId,\n      this.params.jobToken,\n      this.params.dependabotApiUrl,\n      this.credentials,\n    );\n    await proxy.container.start();\n\n    try {\n      await this.runUpdate(proxy);\n      return true;\n    } finally {\n      await this.cleanup(proxy);\n    }\n  }\n\n  private generateCredentialsMetadata(): DependabotCredential[] {\n    const unique: Set<string> = new Set();\n    const result: DependabotCredential[] = [];\n    for (const credential of this.credentials) {\n      if (credential.type === 'jit_access') {\n        continue;\n      }\n\n      // biome-ignore lint/suspicious/noExplicitAny: necessary\n      const obj: any = { type: credential.type };\n      if (credential.host !== undefined) {\n        obj.host = credential.host;\n      }\n      if (credential.registry !== undefined) {\n        obj.registry = credential.registry;\n      }\n      if (credential.url !== undefined) {\n        obj.url = credential.url;\n      }\n      this.setRegistryFromUrl(obj, credential);\n      if (credential['index-url'] !== undefined) {\n        obj['index-url'] = credential['index-url'];\n      }\n      this.setIndexUrlFromUrl(obj, credential);\n      if (credential['env-key'] !== undefined) {\n        obj['env-key'] = credential['env-key'];\n      }\n      if (credential.organization !== undefined) {\n        obj.organization = credential.organization;\n      }\n      if (credential['replaces-base'] !== undefined) {\n        obj['replaces-base'] = credential['replaces-base'];\n      }\n      if (credential['public-key-fingerprint'] !== undefined) {\n        obj['public-key-fingerprint'] = credential['public-key-fingerprint'];\n      }\n      if (credential.repo !== undefined) {\n        obj.repo = credential.repo;\n      }\n      const key = JSON.stringify(obj);\n      if (!unique.has(key)) {\n        unique.add(key);\n        result.push(obj as DependabotCredential);\n      }\n    }\n    return result;\n  }\n\n  private setRegistryFromUrl(obj: DependabotCredential, credential: DependabotCredential): void {\n    const typesThatUseRegistryAsHost = ['npm_registry', 'composer_repository', 'docker_registry'];\n\n    if (!typesThatUseRegistryAsHost.includes(credential.type)) {\n      return;\n    }\n\n    if (!credential.registry && credential.url) {\n      try {\n        const parsedURL = new URL(credential.url);\n        obj.registry = parsedURL.hostname;\n        if (credential.type === 'npm_registry') {\n          obj.registry += parsedURL.pathname;\n        }\n      } catch {\n        // If the URL is invalid, we skip setting the registry\n        // as it will fall back to the default registry for the given type (e.g., npm, Docker, or Composer).\n      }\n    }\n  }\n\n  private setIndexUrlFromUrl(obj: DependabotCredential, credential: DependabotCredential): void {\n    if (credential.type !== 'python_index') {\n      return;\n    }\n    if (credential['index-url']) {\n      return;\n    }\n    if (credential.url) {\n      try {\n        obj['index-url'] = credential.url;\n      } catch {\n        // If the URL is invalid, we skip setting the index-url\n        // as it will fall back to the default index URL for pip.\n      }\n    }\n  }\n\n  private async runUpdate(proxy: Proxy): Promise<void> {\n    const name = `dependabot-job-${this.params.jobId}`;\n    const container = await this.createContainer(proxy, name, {\n      job: this.job,\n    });\n\n    await ContainerService.run(container, this.job.command);\n  }\n\n  private async createContainer(\n    proxy: Proxy,\n    containerName: string,\n    input: FileFetcherInput | FileUpdaterInput,\n  ): Promise<Container> {\n    const builder = new UpdaterBuilder(this.docker, this.params, input, proxy, this.updaterImage);\n    return builder.run(containerName);\n  }\n\n  private async cleanup(proxy: Proxy): Promise<void> {\n    await proxy.shutdown();\n  }\n}\n","import crypto from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport os from 'node:os';\nimport { logger } from '@paklo/core/logger';\nimport type { UsageTelemetryRequestData } from '@paklo/core/usage';\nimport ky from 'ky';\nimport { z } from 'zod';\n\nimport packageJson from '../package.json';\nimport { ApiClient, CredentialFetchingError, type SecretMasker } from './api-client';\nimport { PROXY_IMAGE_NAME, updaterImageName } from './docker-tags';\nimport { ImageService, type MetricReporter } from './image-service';\nimport { getJobParameters } from './params';\nimport { Updater } from './updater';\n\nexport class JobRunnerImagingError extends Error {}\nexport class JobRunnerUpdaterError extends Error {}\n\nexport type RunJobOptions = {\n  dependabotApiUrl: string;\n  dependabotApiDockerUrl?: string;\n  jobId: string;\n  jobToken: string;\n  credentialsToken: string;\n  updaterImage?: string;\n  secretMasker: SecretMasker;\n  usage: Pick<UsageTelemetryRequestData, 'trigger' | 'provider' | 'owner' | 'project' | 'package-manager'>;\n};\nexport type RunJobResult = { success: true; message?: string } | { success: false; message: string };\n\nexport async function runJob(options: RunJobOptions): Promise<RunJobResult> {\n  const { jobId, dependabotApiUrl, dependabotApiDockerUrl, jobToken, credentialsToken, secretMasker, usage } = options;\n\n  const started = new Date();\n  let success = false;\n  let message: string | undefined;\n  try {\n    const params = getJobParameters({\n      jobId,\n      jobToken,\n      credentialsToken,\n      dependabotApiUrl,\n      dependabotApiDockerUrl: dependabotApiDockerUrl ?? dependabotApiUrl,\n      updaterImage: options.updaterImage,\n    })!;\n\n    const client = ky.create({ headers: { 'User-Agent': `paklo-runner/${packageJson.version}` } });\n    const apiClient = new ApiClient(client, params, jobToken, credentialsToken, secretMasker);\n\n    // If we fail to succeed in fetching the job details, we cannot be sure the job has entered a 'processing' state,\n    // so we do not try attempt to report back an exception if this fails and instead rely on the workflow run\n    // webhook as it anticipates scenarios where jobs have failed while 'enqueued'.\n    const job = await apiClient.getJobDetails();\n\n    // The params can specify which updater image to use. If it doesn't, fall back to the pinned version.\n    const updaterImage = params.updaterImage || updaterImageName(job['package-manager']);\n\n    // The sendMetrics function is used to send metrics to the API client.\n    // It uses the package manager as a tag to identify the metric.\n    const sendMetricsWithPackageManager: MetricReporter = async (name, metricType, value, additionalTags = {}) => {\n      try {\n        await apiClient.sendMetrics(name, metricType, value, {\n          package_manager: job['package-manager'],\n          ...additionalTags,\n        });\n      } catch (error) {\n        logger.warn(`Metric sending failed for ${name}: ${(error as Error).message}`);\n      }\n    };\n\n    const credentials = (await apiClient.getCredentials()) || [];\n\n    const updater = new Updater(updaterImage, PROXY_IMAGE_NAME, params, job, credentials);\n\n    try {\n      // Using sendMetricsWithPackageManager wrapper to inject package manager tag to\n      // avoid passing additional parameters to ImageService.pull method\n      await ImageService.pull(updaterImage, sendMetricsWithPackageManager);\n      await ImageService.pull(PROXY_IMAGE_NAME, sendMetricsWithPackageManager);\n    } catch (err: unknown) {\n      if (err instanceof Error) {\n        throw new JobRunnerImagingError(err.message);\n      }\n    }\n\n    try {\n      await updater.runUpdater();\n    } catch (err: unknown) {\n      if (err instanceof Error) {\n        throw new JobRunnerUpdaterError(err.message);\n      }\n    }\n    success = true;\n  } catch (err) {\n    if (err instanceof JobRunnerImagingError) {\n      message = `Error fetching updater images: ${err.message}`;\n    } else if (err instanceof JobRunnerUpdaterError) {\n      message = `Error running updater: ${err.message}`;\n    } else if (err instanceof CredentialFetchingError) {\n      message = `Dependabot was unable to retrieve job credentials: ${err.message}`;\n    } else {\n      message = `Unknown error: ${(err as Error).message}`;\n    }\n  }\n\n  // send usage telemetry, unless explicitly disabled\n  const telemetryDisabled = z.stringbool().optional().parse(process.env.PAKLO_TELEMETRY_DISABLED);\n  if (!telemetryDisabled) {\n    // detect if we are running inside a Docker container\n    const inDocker = await isRunningInDocker();\n    const duration = Date.now() - started.getTime();\n    const data: UsageTelemetryRequestData = {\n      ...usage,\n      host: {\n        platform: os.platform(),\n        release: os.release(),\n        arch: os.arch(),\n        'machine-hash': crypto.createHash('sha256').update(os.hostname()).digest('hex'),\n        'docker-container': inDocker,\n      },\n      version: packageJson.version,\n      id: jobId,\n      started,\n      duration,\n      success,\n      // error message but truncate to first 1000 characters to avoid sending too much data\n      error: message ? { message: message.substring(0, 1000) } : undefined,\n    };\n    try {\n      const json = JSON.stringify(data);\n      logger.debug(`Usage telemetry data: ${json}`);\n      const resp = await ky.post('https://www.paklo.app/api/usage-telemetry', {\n        headers: { 'Content-Type': 'application/json' },\n        body: json,\n      });\n      if (!resp.ok) {\n        logger.debug(`Failed to send usage telemetry data: ${resp.status} ${resp.statusText}`);\n      }\n    } catch (err) {\n      logger.debug(`Failed to send usage telemetry data: ${(err as Error).message}`);\n      // ignore\n    }\n  } else {\n    logger.debug('Telemetry disabled, not sending usage telemetry data');\n  }\n\n  logger.info(`Update job ${jobId} completed`);\n  return { success, message: message! };\n}\n\n/**\n * Detects if the current process is running inside a Docker container.\n */\nexport async function isRunningInDocker(): Promise<boolean> {\n  // Check for .dockerenv file\n  if (existsSync('/.dockerenv')) return true;\n\n  // Check cgroup\n  try {\n    const cgroup = await readFile('/proc/self/cgroup', 'utf8');\n    return cgroup.includes('docker') || cgroup.includes('kubepods');\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAUA,IAAa,0BAAb,cAA6C,MAAM;AACnD,IAAa,0BAAb,cAA6C,MAAM;AAGnD,IAAa,YAAb,MAAuB;CACrB,AAAQ;CACR,AAAQ;CACR,YACE,AAAiBA,QACjB,AAASC,QACT,UACA,AAAiBC,kBACjB,AAAiBC,cACjB;EALiB;EACR;EAEQ;EACA;AAIjB,OAAK,mBADW,OAAO,iBAAiB,QAAQ,wBAAwB,YAAY;AAEpF,OAAK,WAAW;;CAKlB,aAAa,EACX,mBAAmB,WACpB;CAGD,cAAsB;AACpB,SAAO,KAAK;;CAGd,MAAM,gBAA8C;EAClD,MAAM,aAAa,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;AAC7E,MAAI;GACF,MAAM,MAAM,MAAM,KAAK,aAAkC,YAAY,KAAK,SAAS;AACnF,OAAI,IAAI,WAAW,IACjB,OAAM,IAAI,wBACR,iDAAiD,IAAI,OAAO,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,CAAC,GACjG;GAEH,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,OAAI,CAAC,KACH,OAAM,IAAI,wBAAwB,yCAAyC;AAG7E,UAAO;WACA,OAAO;AACd,OAAI,iBAAiB,wBACnB,OAAM;YACG,YAAY,MAAM,CAC3B,OAAM,IAAI,wBACR,iDAAiD,MAAM,SAAS,OAAO,IAAI,MAAM,UAClF;YACQ,iBAAiB,MAC1B,OAAM,IAAI,wBAAwB,yBAAyB,MAAM,KAAK,IAAI,MAAM,UAAU;AAE5F,SAAM;;;CAIV,MAAM,iBAAkD;EACtD,MAAM,iBAAiB,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;AACjF,MAAI;GACF,MAAM,MAAM,MAAM,KAAK,aAAqC,gBAAgB,KAAK,iBAAiB;AAElG,OAAI,IAAI,WAAW,IACjB,OAAM,IAAI,wBACR,iDAAiD,IAAI,OAAO,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,CAAC,GACjG;GAEH,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,OAAI,CAAC,KACH,OAAM,IAAI,wBAAwB,yCAAyC;AAI7E,QAAK,MAAM,cAAc,MAAM;AAC7B,QAAI,WAAW,SACb,MAAK,aAAa,WAAW,SAAS;AAExC,QAAI,WAAW,MACb,MAAK,aAAa,WAAW,MAAM;AAErC,QAAI,WAAW,YACb,MAAK,aAAa,WAAW,YAAY;;AAI7C,UAAO;WACAC,OAAgB;AACvB,OAAI,iBAAiB,wBACnB,OAAM;YACG,YAAY,MAAM,CAC3B,OAAM,IAAI,wBACR,iDAAiD,MAAM,SAAS,OAAO,IAAI,MAAM,UAClF;YACQ,iBAAiB,MAC1B,OAAM,IAAI,wBAAwB,yBAAyB,MAAM,KAAK,IAAI,MAAM,UAAU;AAE5F,SAAM;;;CAIV,MAAM,eAAe,OAAsD;EACzE,MAAM,iBAAiB,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;EACjF,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK,gBAAgB;GACjD,MAAM;GACN,SAAS,EAAE,eAAe,KAAK,UAAU;GAC1C,CAAC;AACF,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MAAM,2BAA2B,IAAI,SAAS;;CAI5D,MAAM,qBAAoC;EACxC,MAAM,qBAAqB,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;EACrF,MAAM,MAAM,MAAM,KAAK,OAAO,MAAM,oBAAoB;GACtD,MAAM,KAAK;GACX,SAAS,EAAE,eAAe,KAAK,UAAU;GAC1C,CAAC;AACF,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MAAM,2BAA2B,IAAI,SAAS;;CAI5D,MAAM,YACJ,MACA,YACA,OACA,iBAAyC,EAAE,EAC5B;AACf,MAAI;AACF,SAAM,KAAK,cAAc,CACvB;IACE,QAAQ,qBAAqB;IAC7B,MAAM;IACN;IACA,MAAM;IACP,CACF,CAAC;AACF,UAAO,KAAK,+CAA+C,KAAK,0BAA0B;WACnF,OAAO;AAGd,UAAO,KAAK,6BAA8B,MAAgB,UAAU;;;CAIxE,MAAM,cAAc,SAA4C;EAC9D,MAAM,aAAa,GAAG,KAAK,iBAAiB,eAAe,KAAK,OAAO,MAAM;EAC7E,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK,YAAY;GAC7C,MAAM,EAAE,MAAM,SAAS;GACvB,SAAS,EAAE,eAAe,KAAK,UAAU;GAC1C,CAAC;AAEF,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MAAM,2BAA2B,IAAI,SAAS;;CAI5D,MAAc,aAAgB,KAAa,OAAe,SAA+C;EACvG,MAAM,UAAU,YAAoC;AAuBlD,UAtBY,MAAM,KAAK,OAAO,IAAO,KAAK;IACxC,SAAS,EAAE,eAAe,OAAO;IACjC,OAAO,EACL,OAAO,GAMR;IACD,OAAO,EACL,aAAa,CACX,OAAO,EAAE,SAAS,oBAAS,OAAO,iBAAiB;AACjD,SAAI,YAAY,MAAM,CACpB,QAAO,KAAK,6CAA6C,MAAM,SAAS,SAAS;MAGtF,EACF;IACD,GAAG;IACJ,CAAC;;AAKJ,SAAO,SAAS;;;;;;YCpMT;yBADX;;UAEa;QACF;WACG;QACH;MACF;SACG;MACH;iBACW;aACJ;aACA;SACJ;QACD;MACF;QACE;eACO;MACT;iBACW;QACT;YACI;gBACI;aACH;MACP;iBACW;KACZ;QACG;OACD;QACC;QACA;WACG;;;;;AC5Bd,MAAa,mBAAmBC;AAEhC,SAAgB,iBAAiB,gBAAgC;AAC/D,QAAOC,mBAAsB;;AAG/B,MAAM,eAAe;AAErB,SAAgB,gBAA0B;AACxC,QAAO,OAAO,OAAOA,mBAAsB,CAAC,QAAQ,UAAU,MAAM,MAAM,aAAa,CAAC;;AAG1F,MAAM,mBACJ;AAEF,SAAgB,eAAe,WAA2B;CACxD,MAAM,QAAQ,UAAU,MAAM,iBAAiB;AAE/C,KAAI,OAAO,OACT,QAAO,MAAM,OAAO;KAEpB,OAAM,MAAM,qBAAqB;;AAIrC,SAAgB,UAAU,WAA4B;CACpD,MAAM,QAAQ,UAAU,MAAM,iBAAiB;AAE/C,KAAI,OAAO,QAAQ;AACjB,MAAI,OAAO,OAAO,OAChB,QAAO;AAET,SAAO;OAEP,OAAM,MAAM,qBAAqB;;AAIrC,SAAgB,WAAW,WAA2B;CACpD,MAAM,QAAQ,UAAU,MAAM,iBAAiB;AAE/C,KAAI,OAAO,OACT,QAAO,MAAM,OAAO,aAAc,MAAM,OAAO;KAE/C,OAAM,MAAM,qBAAqB;;;;;AC1CrC,MAAa,aAAa,WAA6B;AACrD,QAAO,IAAI,OAAO,SAAS,EACzB,MAAM,OAAO,GAAG,MAAM;AACpB,UAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,MAAM,UAAU,GAAG;AACvD,QAAM;IAET,CAAC;;AAGJ,MAAa,aAAa,WAA6B;AACrD,QAAO,IAAI,OAAO,SAAS,EACzB,MAAM,OAAO,GAAG,MAAM;AACpB,UAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,MAAM,UAAU,GAAG;AACvD,QAAM;IAET,CAAC;;;;;;;AAQJ,MAAa,qBAAqB,iBAAwC;CACxE,MAAM,QAAQ,aAAa,MAAM,YAAY;AAC7C,QAAO,QAAQ,MAAM,KAAM;;;;;ACrB7B,IAAa,wBAAb,cAA2C,MAAM;AAEjD,MAAM,UAAU;AAEhB,MAAa,mBAAmB;CAC9B,MAAM,WACJ,MACA,MACA,WACA,OACe;EACf,MAAM,MAAM,MAAM;AAClB,MAAI,MAAM;GAAE;GAAM,MAAM;GAAS,EAAE,KAAK,UAAU,MAAM,CAAC;AACzD,MAAI,UAAU;AACd,QAAM,UAAU,WAAW,KAAK,EAAE,MAAM,CAAC;;CAG3C,MAAM,UAAU,MAAc,MAAc,WAAsB,MAA6B;EAC7F,MAAM,MAAM,MAAM;AAClB,MAAI,MAAM,EAAE,MAAM,EAAE,KAAK;AACzB,MAAI,UAAU;AACd,QAAM,UAAU,WAAW,KAAK,EAAE,MAAM,CAAC;;CAG3C,MAAM,IAAI,WAAsB,SAAoC;AAClE,MAAI;AAEF,SAAM,UAAU,OAAO;AACvB,UAAO,KAAK,qBAAqB,UAAU,KAAK;AAMhD,QAHsB,MAAM,UAAU,SAAS,EACH,QAAQ,KAAK,MAAM,QAAQ,IAAI,WAAW,qBAAqB,CAAC,EAEjF;AAEzB,UAAM,KAAK,YAAY,WAAW,CAAC,mCAAmC,EAAE,OAAO;IAG/E,MAAM,qBAAqB,CACzB,uDACA,0DACD;AAED,QAAI,YAAY,QACd,oBAAmB,KAAK,2DAA2D;QAEnF,oBAAmB,KAAK,2DAA2D;AAGrF,SAAK,MAAM,OAAO,mBAChB,OAAM,KAAK,YAAY,WAAW;KAAC;KAAW;KAAM;KAAI,EAAE,aAAa;UAEpE;IAEL,MAAM,UAAU,MAAM,UAAU,MAAM;AACtC,QAAI,QAAQ,eAAe,EACzB,OAAM,IAAI,MAAM,8BAA8B,QAAQ,aAAa;;AAIvE,UAAO;WACA,OAAO;AACd,UAAO,KAAK,6BAA6B,UAAU,GAAG,IAAI,QAAQ;AAClE,SAAM,IAAI,sBAAsB,8CAA8C;YACtE;AACR,OAAI;AACF,UAAM,UAAU,OAAO;KAAE,GAAG;KAAM,OAAO;KAAM,CAAC;AAChD,WAAO,KAAK,wBAAwB,UAAU,KAAK;YAC5C,OAAO;AACd,WAAO,KAAK,gCAAgC,UAAU,GAAG,IAAI,QAAQ;;;;CAK3E,MAAM,YAAY,WAAsB,KAAe,MAA6B;EAClF,MAAM,OAAO,MAAM,UAAU,KAAK;GAChC,KAAK;GACL,MAAM;GACN,cAAc;GACd,cAAc;GACf,CAAC;EAEF,MAAMC,WAAS,MAAM,KAAK,MAAM,EAAE,CAAC;AAGnC,QAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,aAAU,MAAM,YAAYA,UAAQ,UAAU,UAAU,EAAE,UAAU,UAAU,CAAC;AAE/E,YAAO,GAAG,aAAa;AACrB,aAAS;KACT;AAEF,YAAO,GAAG,UAAU,UAAU;AAC5B,WAAO,MAAM;KACb;IACF;AAGF,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAI,CAAC;EAExD,MAAM,aAAa,MAAM,KAAK,SAAS;AACvC,MAAI,WAAW,aAAa,EAC1B,OAAM,IAAI,MAAM,iCAAiC,WAAW,SAAS,IAAI,IAAI,KAAK,IAAI,GAAG;;CAG9F;;;;AC9GD,MAAM,cAAc;AACpB,MAAM,mBAAmB;AAIzB,MAAM,QAAQ,OAAO,OAA8B,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;AAEpG,MAAM,cAAc,OAAO,UAAgB,aAAoC;AAC7E,QAAO,IAAI,SAAS,SAAS,WAAW;AACtC,WAAO,MAAM,eAAeC,WAAS,QAAuB,MAAM,OAAO,IAAI,GAAG,QAAQ,OAAU,CAAE;GACpG;;AAGJ,SAAgB,gBAAgB,WAA2B;CACzD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,KAAI,MAAM,UAAU,KAAK,MAAM,OAAO,UACpC,QAAO,MAAM;AAEf,QAAO;;;AAWT,MAAa,eAAe;CAC1B,MAAM,KAAK,WAAmB,YAA6B,QAAQ,OAAsB;AAMvF,MAAI,EAAE,UAAU,WAAW,WAAW,IAAI,UAAU,WAAW,yBAAyB,EACtF,OAAM,IAAI,MAAM,8EAA8E;EAGhG,MAAMC,WAAS,IAAI,QAAQ;EAC3B,MAAM,MAAM,gBAAgB,UAAU;AACtC,MAAI;GACF,MAAM,QAAQ,MAAMA,SAAO,SAAS,UAAU,CAAC,SAAS;AACxD,OAAI,CAAC,OAAO;AACV,WAAO,KAAK,YAAY,UAAU,eAAe,MAAM,cAAc;AACrE;;WAEKC,GAAY;AACnB,OAAI,aAAa,SAAS,CAAC,EAAE,QAAQ,SAAS,gBAAgB,CAC5D,OAAM;;AAKV,QAAM,KAAK,oBAAoB,WADlB,EAAE,EACiCD,UAAQ,YAAY,IAAI;;CAI1E,MAAM,oBACJ,WACA,OAAO,EAAE,EACT,WAAS,IAAI,QAAQ,EACrB,YACA,KACe;EACf,IAAI,UAAU;AAEd,SAAO,UAAU,YACf,KAAI;AACF,UAAO,KAAK,iBAAiB,UAAU,YAAY,UAAU,EAAE,MAAM;AAErE,OAAI,WACF,OAAM,WAAW,mBAAmB,aAAa,GAAG,EAClD,KACD,CAAC;GAEJ,MAAMD,WAAS,MAAMC,SAAO,KAAK,WAAW,EAAE,YAAY,MAAM,CAAC;AACjE,SAAM,YAAYA,UAAQ,IAAI,UAAU,CAAC,KAAKD,SAAO,CAAC;AACtD,UAAO,KAAK,gBAAgB,YAAY;AACxC;WACO,OAAO;AACd,OAAI,EAAE,iBAAiB,OAAQ,OAAM;AAGrC,OACE,MAAM,QAAQ,SAAS,wBAAwB,IAC/C,MAAM,QAAQ,aAAa,CAAC,SAAS,oBAAoB,EACzD;AACA;AACA,QAAI,WAAW,aAAa;AAC1B,YAAO,MAAM,wBAAwB,UAAU,SAAS,YAAY,YAAY;AAChF,WAAM;;IAKR,MAAM,YAAY,mBAAmB,KAAK,IAAI,GAAG,QAAQ;IACzD,MAAM,SAAS,KAAK,QAAQ,GAAG;IAC/B,MAAM,QAAQ,YAAY,IAAI;AAE9B,WAAO,KAAK,kDAAkD,QAAQ,KAAM,QAAQ,EAAE,CAAC,aAAa;AACpG,UAAM,MAAM,MAAM;UACb;AAEL,WAAO,MAAM,6BAA6B,UAAU,IAAI,MAAM,UAAU;AACxE,UAAM;;;;CAKf;;;;ACzGD,IAAa,gBAAb,MAA2B;CACzB,YACE,AAASG,OACT,AAASC,UACT,AAASC,kBACT,AAASC,kBACT,AAASC,wBACT,AAASC,cACT;EANS;EACA;EACA;EACA;EACA;EACA;;;AAIb,SAAgB,iBAAiB,OAOR;AACvB,QAAO,IAAI,cACT,MAAM,OACN,MAAM,UACN,MAAM,kBACN,MAAM,kBACN,MAAM,wBACN,MAAM,aACP;;;;;ACjBH,MAAM,WAAW;AACjB,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AACzB,MAAa,mBAAmB;AAChC,MAAMC,uBAAqB;AAC3B,MAAM,sBAAsB;AAC5B,MAAM,eAAe;CACnB;EAAE,MAAM;EAAc,OAAO;EAA0B;CACvD;EAAE,MAAM;EAAoB,OAAO;EAAe;CAClD;EAAE,WAAW;EAAM,OAAO;EAAc;CACxC;EAAE,MAAM;EAAe,OAAO;EAAM;CACpC;EAAE,WAAW;EAAM,OAAO;EAAc;CACxC;EAAE,MAAM;EAAgB,OAAO;EAAiB;CACjD;AAED,IAAa,eAAb,MAAa,aAAa;CACxB,YACE,AAAiBC,UACjB,AAAiBC,YACjB,AAAiBC,YACjB;EAHiB;EACA;EACA;;CAGnB,MAAM,IACJ,OACA,UACA,kBACA,aACgB;EAChB,MAAM,OAAO,kBAAkB,MAAM;EACrC,MAAM,SAAS,MAAM,KAAK,iBAAiB,YAAY;EACvD,MAAM,OAAO,OAAO,GAAG;EAEvB,MAAM,sBAAsB,kBAAkB,MAAM;EACpD,MAAM,kBAAkB,MAAM,KAAK,cAAc,qBAAqB,MAAM;EAE5E,MAAM,sBAAsB,kBAAkB,MAAM;EACpD,MAAM,kBAAkB,MAAM,KAAK,cAAc,qBAAqB,KAAK;EAE3E,MAAM,YAAY,MAAM,KAAK,gBAC3B,OACA,UACA,kBACA,MACA,iBACA,iBACA,oBACD;AAED,QAAM,iBAAiB,WAAW,kBAAkB,kBAAkB,WAAW,OAAO;EAExF,MAAM,eAAe,KAAK,cAAc;AACxC,MAAI,cAAc;AAChB,UAAO,KAAK,kDAAkD;GAE9D,MAAM,cAAc,MAAM,SAAS,cAAc,OAAO,EAAE,UAAU;AACpE,SAAM,iBAAiB,UAAU,qBAAqBH,sBAAoB,WAAW,WAAW;;EAGlG,MAAMI,WAAS,MAAM,UAAU,OAAO;GACpC,QAAQ;GACR,QAAQ;GACR,QAAQ;GACT,CAAC;AACF,YAAU,MAAM,YAAYA,UAAQ,UAAU,UAAU,EAAE,UAAU,UAAU,CAAC;EAE/E,MAAM,MAAM,YAA6B;GACvC,MAAM,gBAAgB,MAAM,UAAU,SAAS;AAE/C,OAAI,cAAc,MAAM,YAAY,KAElC,QAAO,UADW,cAAc,gBAAgB,SAAS,GAAG,uBAAwB,UACzD;OAE3B,OAAM,IAAI,MAAM,gCAAgC;;AAIpD,SAAO;GACL;GACA,SAAS;GACT,aAAa;GACb;GACA;GACA,UAAU,YAAY;AACpB,UAAM,UAAU,MAAM;AACtB,UAAM,UAAU,QAAQ;AACxB,UAAM,QAAQ,IAAI,CAAC,gBAAgB,QAAQ,EAAE,gBAAgB,QAAQ,CAAC,CAAC;;GAE1E;;CAGH,MAAc,cAAc,MAAc,WAAW,MAAwB;EAC3E,MAAM,WAAW,MAAM,KAAK,OAAO,aAAa,EAC9C,SAAS,KAAK,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAC1C,CAAC;AACF,MAAI,SAAS,SAAS,EACpB,QAAO,KAAK,OAAO,WAAW,SAAS,GAAI,GAAG;MAE9C,QAAO,MAAM,KAAK,OAAO,cAAc;GAAE,MAAM;GAAM,UAAU;GAAU,CAAC;;CAI9E,MAAc,iBAAiB,aAAqE;AAKlG,SAFsC;GAAE,iBAAiB;GAAa,IAF3D,MAAM,aAAa,8BAA8B;GAEc;;CAK5E,aAAoB,+BAA8D;EAEhF,MAAM,EACJ,SAAS,EAAE,IAAI,UACb,MAAM,OAAO;EACjB,MAAM,OAAO,IAAI,IAAI,gBAAgB,SAAS;EAC9C,MAAM,OAAO,IAAI,mBAAmB;AAEpC,OAAK,YAAY,KAAK;AACtB,OAAK,eAAe;AACpB,OAAK,SAAS,4BAAY,IAAI,MAAM;AACpC,OAAK,SAAS,2BAAW,IAAI,MAAM;AACnC,OAAK,SAAS,SAAS,YAAY,KAAK,SAAS,UAAU,aAAa,GAAG,iBAAiB;AAE5F,OAAK,WAAW,aAAa;AAC7B,OAAK,UAAU,aAAa;AAE5B,OAAK,cAAc;GACjB;IACE,MAAM;IACN,IAAI;IACJ,UAAU;IACX;GACD;IACE,MAAM;IACN,kBAAkB;IAClB,iBAAiB;IACjB,aAAa;IACb,SAAS;IACT,UAAU;IACX;GACD;IACE,MAAM;IACN,YAAY;IACZ,YAAY;IACb;GACD,EACE,MAAM,wBACP;GACD;IACE,MAAM;IACN,eAAe;IACf,qBAAqB;IACrB,2BAA2B,KAAK;IACjC;GACF,CAAC;AAEF,OAAK,KAAK,KAAK,YAAY,GAAG,OAAO,QAAQ,CAAC;AAI9C,SAAO;GAAE,MAFG,IAAI,iBAAiB,KAAK;GAElB,KADR,IAAI,gBAAgB,KAAK,WAAW;GACvB;;CAG3B,MAAc,gBACZ,OACA,UACA,kBACA,eACA,iBACA,iBACA,qBACoB;EACpB,MAAM,YAAY,MAAM,KAAK,OAAO,gBAAgB;GAClD,OAAO,KAAK;GACZ,MAAM;GACN,cAAc;GACd,cAAc;GACd,KAAK;IACH,cAAc,QAAQ,IAAI,cAAc,QAAQ,IAAI,cAAc;IAClE,eAAe,QAAQ,IAAI,eAAe,QAAQ,IAAI,eAAe;IACrE,YAAY,QAAQ,IAAI,YAAY,QAAQ,IAAI,YAAY;IAC5D,UAAU;IACV,aAAa;IACb,eAAe,KAAK,aAAa,SAAS;IAC1C,sBAAsB;IACtB,kCAAkC,QAAQ,IAAI,kCAAkC;IAChF,gCAAgC,QAAQ,IAAI,gCAAgC;IAC7E;GACD,YAAY;IAAC;IAAM;IAAM;IAAwD;GAEjF,YAAY;IACV,aAAa;IACb,YAAY,CAAC,oCAAoC;IAClD;GACF,CAAC;AAEF,QAAM,gBAAgB,QAAQ,EAAE,WAAW,UAAU,IAAI,CAAC;AAE1D,SAAO,KAAK,4BAA4B,UAAU,KAAK;AACvD,SAAO;;CAGT,AAAQ,eAAmC;AACzC,MAAI,oBAAoB,QAAQ,IAC9B,QAAO,QAAQ,IAAI;AAGrB,SAAO,QAAQ,IAAI;;;;;;cChOV;;;;ACSb,MAAa,sBAAsB;AACnC,MAAa,kBAAkB;AAC/B,MAAa,qBAAqB;AAClC,MAAa,iBAAiB;AAC9B,MAAa,qBAAqB;AAClC,MAAa,qBAAqB;AAClC,MAAa,mBAAmB;AAChC,MAAM,qBAAqB,IAAI,OAAO,OAAO;AAI7C,IAAa,iBAAb,MAA4B;CAC1B,YACE,AAAiBC,UACjB,AAAiBC,WACjB,AAAiBC,OACjB,AAAiBC,SAEjB,AAAiBC,cACjB;EANiB;EACA;EACA;EACA;EAEA;;CAGnB,MAAM,IAAI,eAA2C;EACnD,MAAM,WAAW,MAAM,KAAK,MAAM,KAAK;EACvC,MAAM,aAAa,kBAAkB,KAAK,aAAa;EAEvD,MAAM,UAAU;GACd,kBAAkB,QAAQ,IAAI;GAC9B,qBAAqB,KAAK,UAAU;GACpC;GACA,uBAAuB,eAAe,GAAG;GACzC;GACA,0BAA0B,gBAAgB,GAAG;GAC7C,iCAAiC;GACjC,sBAAsB,KAAK,UAAU;GACrC;GACA,cAAc;GACd,cAAc;GACd,eAAe;GACf,eAAe;GACf;GACA,6BAA6B,QAAQ,IAAI,wCAAwC;GAOjF,GAAI,QAAQ,aAAa,WAAW,CAAC,iCAAiC,GAAG,EAAE;GAC5E;AAGD,MAAI,eAAe,KACjB,SAAQ,KAAK,0BAA0B,aAAa;EAGtD,MAAM,YAAY,MAAM,KAAK,OAAO,gBAAgB;GAClD,OAAO,KAAK;GACZ,MAAM;GACN,cAAc;GACd,cAAc;GACd,MAAM;GACN,KAAK;GACL,KAAK,CAAC,UAAU;GAChB,KAAK;GACL,YAAY;IACV,QAAQ;IACR,aAAa,KAAK,MAAM;IACzB;GACF,CAAC;AAEF,QAAM,iBAAiB,UAAU,kBAAkB,oBAAoB,WAAW,KAAK,MAAM,KAAK;AAElG,QAAM,iBAAiB,WAAW,oBAAoB,gBAAgB,WAAW,KAAK,MAAM;AAE5F,SAAO,KAAK,sBAAsB,UAAU,KAAK;AACjD,SAAO;;;;;;ACtEX,IAAa,UAAb,MAAqB;CACnB;CAEA,YACE,AAAiBC,cACjB,AAAiBC,YACjB,AAAiBC,QACjB,AAAiBC,KACjB,AAAiBC,aACjB;EALiB;EACA;EACA;EACA;EACA;AAEjB,OAAK,SAAS,IAAI,QAAQ;AAC1B,OAAK,IAAI,0BAA0B,KAAK,6BAA6B;;;;;CAMvE,MAAM,aAA+B;EACnC,MAAM,aAAa,OAAO,OAAO,KAAK,IAAI,aAAa,eAAe,KAAK;EAI3E,MAAMC,UAAQ,MAFO,IAAI,aAAa,KAAK,QAAQ,KAAK,YAAY,WAAW,CAE9C,IAC/B,KAAK,OAAO,OACZ,KAAK,OAAO,UACZ,KAAK,OAAO,kBACZ,KAAK,YACN;AACD,QAAMA,QAAM,UAAU,OAAO;AAE7B,MAAI;AACF,SAAM,KAAK,UAAUA,QAAM;AAC3B,UAAO;YACC;AACR,SAAM,KAAK,QAAQA,QAAM;;;CAI7B,AAAQ,8BAAsD;EAC5D,MAAMC,yBAAsB,IAAI,KAAK;EACrC,MAAMC,SAAiC,EAAE;AACzC,OAAK,MAAM,cAAc,KAAK,aAAa;AACzC,OAAI,WAAW,SAAS,aACtB;GAIF,MAAMC,MAAW,EAAE,MAAM,WAAW,MAAM;AAC1C,OAAI,WAAW,SAAS,OACtB,KAAI,OAAO,WAAW;AAExB,OAAI,WAAW,aAAa,OAC1B,KAAI,WAAW,WAAW;AAE5B,OAAI,WAAW,QAAQ,OACrB,KAAI,MAAM,WAAW;AAEvB,QAAK,mBAAmB,KAAK,WAAW;AACxC,OAAI,WAAW,iBAAiB,OAC9B,KAAI,eAAe,WAAW;AAEhC,QAAK,mBAAmB,KAAK,WAAW;AACxC,OAAI,WAAW,eAAe,OAC5B,KAAI,aAAa,WAAW;AAE9B,OAAI,WAAW,iBAAiB,OAC9B,KAAI,eAAe,WAAW;AAEhC,OAAI,WAAW,qBAAqB,OAClC,KAAI,mBAAmB,WAAW;AAEpC,OAAI,WAAW,8BAA8B,OAC3C,KAAI,4BAA4B,WAAW;AAE7C,OAAI,WAAW,SAAS,OACtB,KAAI,OAAO,WAAW;GAExB,MAAM,MAAM,KAAK,UAAU,IAAI;AAC/B,OAAI,CAAC,OAAO,IAAI,IAAI,EAAE;AACpB,WAAO,IAAI,IAAI;AACf,WAAO,KAAK,IAA4B;;;AAG5C,SAAO;;CAGT,AAAQ,mBAAmB,KAA2B,YAAwC;AAG5F,MAAI,CAF+B;GAAC;GAAgB;GAAuB;GAAkB,CAE7D,SAAS,WAAW,KAAK,CACvD;AAGF,MAAI,CAAC,WAAW,YAAY,WAAW,IACrC,KAAI;GACF,MAAM,YAAY,IAAI,IAAI,WAAW,IAAI;AACzC,OAAI,WAAW,UAAU;AACzB,OAAI,WAAW,SAAS,eACtB,KAAI,YAAY,UAAU;UAEtB;;CAOZ,AAAQ,mBAAmB,KAA2B,YAAwC;AAC5F,MAAI,WAAW,SAAS,eACtB;AAEF,MAAI,WAAW,aACb;AAEF,MAAI,WAAW,IACb,KAAI;AACF,OAAI,eAAe,WAAW;UACxB;;CAOZ,MAAc,UAAU,SAA6B;EACnD,MAAM,OAAO,kBAAkB,KAAK,OAAO;EAC3C,MAAM,YAAY,MAAM,KAAK,gBAAgBH,SAAO,MAAM,EACxD,KAAK,KAAK,KACX,CAAC;AAEF,QAAM,iBAAiB,IAAI,WAAW,KAAK,IAAI,QAAQ;;CAGzD,MAAc,gBACZ,SACA,eACA,OACoB;AAEpB,SADgB,IAAI,eAAe,KAAK,QAAQ,KAAK,QAAQ,OAAOA,SAAO,KAAK,aAAa,CAC9E,IAAI,cAAc;;CAGnC,MAAc,QAAQ,SAA6B;AACjD,QAAMA,QAAM,UAAU;;;;;;AC/I1B,IAAa,wBAAb,cAA2C,MAAM;AACjD,IAAa,wBAAb,cAA2C,MAAM;AAcjD,eAAsB,OAAO,SAA+C;CAC1E,MAAM,EAAE,OAAO,kBAAkB,wBAAwB,UAAU,kBAAkB,cAAc,UAAU;CAE7G,MAAM,0BAAU,IAAI,MAAM;CAC1B,IAAI,UAAU;CACd,IAAII;AACJ,KAAI;EACF,MAAM,SAAS,iBAAiB;GAC9B;GACA;GACA;GACA;GACA,wBAAwB,0BAA0B;GAClD,cAAc,QAAQ;GACvB,CAAC;EAGF,MAAM,YAAY,IAAI,UADP,GAAG,OAAO,EAAE,SAAS,EAAE,cAAc,gBAAgBC,WAAuB,EAAE,CAAC,EACtD,QAAQ,UAAU,kBAAkB,aAAa;EAKzF,MAAM,MAAM,MAAM,UAAU,eAAe;EAG3C,MAAM,eAAe,OAAO,gBAAgB,iBAAiB,IAAI,mBAAmB;EAIpF,MAAMC,gCAAgD,OAAO,MAAM,YAAY,OAAO,iBAAiB,EAAE,KAAK;AAC5G,OAAI;AACF,UAAM,UAAU,YAAY,MAAM,YAAY,OAAO;KACnD,iBAAiB,IAAI;KACrB,GAAG;KACJ,CAAC;YACK,OAAO;AACd,WAAO,KAAK,6BAA6B,KAAK,IAAK,MAAgB,UAAU;;;EAMjF,MAAM,UAAU,IAAI,QAAQ,cAAc,kBAAkB,QAAQ,KAF/C,MAAM,UAAU,gBAAgB,IAAK,EAAE,CAEyB;AAErF,MAAI;AAGF,SAAM,aAAa,KAAK,cAAc,8BAA8B;AACpE,SAAM,aAAa,KAAK,kBAAkB,8BAA8B;WACjEC,KAAc;AACrB,OAAI,eAAe,MACjB,OAAM,IAAI,sBAAsB,IAAI,QAAQ;;AAIhD,MAAI;AACF,SAAM,QAAQ,YAAY;WACnBA,KAAc;AACrB,OAAI,eAAe,MACjB,OAAM,IAAI,sBAAsB,IAAI,QAAQ;;AAGhD,YAAU;UACH,KAAK;AACZ,MAAI,eAAe,sBACjB,WAAU,kCAAkC,IAAI;WACvC,eAAe,sBACxB,WAAU,0BAA0B,IAAI;WAC/B,eAAe,wBACxB,WAAU,sDAAsD,IAAI;MAEpE,WAAU,kBAAmB,IAAc;;AAM/C,KAAI,CADsB,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM,QAAQ,IAAI,yBAAyB,EACvE;EAEtB,MAAM,WAAW,MAAM,mBAAmB;EAC1C,MAAM,WAAW,KAAK,KAAK,GAAG,QAAQ,SAAS;EAC/C,MAAMC,OAAkC;GACtC,GAAG;GACH,MAAM;IACJ,UAAU,GAAG,UAAU;IACvB,SAAS,GAAG,SAAS;IACrB,MAAM,GAAG,MAAM;IACf,gBAAgB,OAAO,WAAW,SAAS,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC,OAAO,MAAM;IAC/E,oBAAoB;IACrB;GACQH;GACT,IAAI;GACJ;GACA;GACA;GAEA,OAAO,UAAU,EAAE,SAAS,QAAQ,UAAU,GAAG,IAAK,EAAE,GAAG;GAC5D;AACD,MAAI;GACF,MAAM,OAAO,KAAK,UAAU,KAAK;AACjC,UAAO,MAAM,yBAAyB,OAAO;GAC7C,MAAM,OAAO,MAAM,GAAG,KAAK,6CAA6C;IACtE,SAAS,EAAE,gBAAgB,oBAAoB;IAC/C,MAAM;IACP,CAAC;AACF,OAAI,CAAC,KAAK,GACR,QAAO,MAAM,wCAAwC,KAAK,OAAO,GAAG,KAAK,aAAa;WAEjF,KAAK;AACZ,UAAO,MAAM,wCAAyC,IAAc,UAAU;;OAIhF,QAAO,MAAM,uDAAuD;AAGtE,QAAO,KAAK,cAAc,MAAM,YAAY;AAC5C,QAAO;EAAE;EAAkB;EAAU;;;;;AAMvC,eAAsB,oBAAsC;AAE1D,KAAI,WAAW,cAAc,CAAE,QAAO;AAGtC,KAAI;EACF,MAAM,SAAS,MAAM,SAAS,qBAAqB,OAAO;AAC1D,SAAO,OAAO,SAAS,SAAS,IAAI,OAAO,SAAS,WAAW;SACzD;AACN,SAAO"}