@ploaness/governance 1.1.0 → 1.3.0

package/dist/terraform-policy.js

@@ -0,0 +1,261 @@
+// Infrastructure defects a text reader can decide on its own, and only those.
+//
+// Every rule here owns a question the analyzer beside it does not answer. Where checkov has a check,
+// checkov keeps it: one semantic rule has one owner, and a second opinion written as a regular
+// expression would be the weaker of the two. So `AdministratorAccess`, wildcard IAM actions and a
+// publicly reachable database are absent from this file deliberately - they are enabled as curated
+// checks instead, where the resource graph is understood rather than guessed at from one line.
+//
+// `0.0.0.0/0` is read in exactly one place: the standalone ingress rule resource, whose TYPE names its
+// direction. Everywhere else text cannot decide it. The same address is correct on egress and fatal on
+// ingress, and an `ingress` block or an `aws_security_group_rule` carries its direction in a nested
+// block or a sibling attribute that a line reader cannot tie to the address - so those forms stay
+// with the analyzer, which knows which side of the rule it is looking at. The standalone resource is
+// this file's because the analyzer does not read its idiomatic spelling at all, and its own SSH and RDP
+// checks read a rule naming another security group as its source as open to the world.
+import { stripComments } from './source-text.js';
+const FIRST_LINE = 1;
+// An argument assigned one literal value, bare or quoted, on its own line. Terraform accepts both
+// spellings of a boolean, and a quoted string is what the other values are.
+const assigned = (attribute, value) => new RegExp(String.raw `^[ \t]*${attribute}[ \t]*=[ \t]*"?${value}"?(?:[ \t]|$)`);
+// The Owner definition has one id in every Azure tenant, and a role assignment may name it by id
+// rather than by name.
+const AZURE_OWNER_DEFINITION = '8e3af657-a8ff-443c-a75c-2fe8c4bcb635';
+// Each rule refuses an explicit literal and never an absence, which is what keeps every one of them
+// free of false positives: a value that arrives through a variable or a reference never matches. The
+// first two arguments exist only where they destroy data, and checkov ships no check for either. The
+// last two stand in for checks that fail the rubric - `CKV_GCP_6` rejects the correct
+// `ENCRYPTED_ONLY`, `CKV_AZURE_3` and `CKV_AZURE_91` read only the argument names azurerm retired,
+// and every project-role check on Google Cloud also flags `viewer` or a documented deploy role,
+// while Azure has no check for an Owner assignment at all. A checkov check that fails the rubric
+// returns its question to text. The patterns are built once here rather than per line, so the scan
+// is one pass over the text.
+const FLAG_RULES = [
+    {
+        patterns: [assigned('force_destroy', 'true')],
+        rule: 'no-force-destroy',
+        reason: 'force_destroy lets a destroy remove a bucket or repository that still holds objects, so a ' +
+            'replacement-forcing edit deletes the data rather than failing - remove it, and empty the ' +
+            'store deliberately when it is genuinely meant to go',
+    },
+    {
+        patterns: [assigned('skip_final_snapshot', 'true')],
+        rule: 'no-skipped-final-snapshot',
+        reason: 'skip_final_snapshot leaves a deleted database with nothing to restore from, and a destroy ' +
+            'that was never meant to reach production is exactly when that snapshot is wanted - remove it ' +
+            'and let the final snapshot be taken',
+    },
+    {
+        patterns: [
+            assigned('role', 'roles/owner'),
+            assigned('role', 'roles/editor'),
+            assigned('role_definition_name', 'Owner'),
+            new RegExp(String.raw `^[ \t]*role_definition_id[ \t]*=[ \t]*"[^"]*${AZURE_OWNER_DEFINITION}"`),
+        ],
+        rule: 'no-administrative-role-grant',
+        reason: 'an administrative role is granted outright, which is every permission on everything in its ' +
+            'scope - grant the specific roles the principal needs, and no more',
+    },
+    {
+        patterns: [
+            assigned('ssl_mode', 'ALLOW_UNENCRYPTED_AND_ENCRYPTED'),
+            assigned('require_ssl', 'false'),
+            assigned('https_traffic_only_enabled', 'false'),
+            assigned('enable_https_traffic_only', 'false'),
+            assigned('non_ssl_port_enabled', 'true'),
+            assigned('enable_non_ssl_port', 'true'),
+        ],
+        rule: 'no-unencrypted-transport',
+        reason: 'the service explicitly accepts unencrypted connections - remove the argument or set its ' +
+            'encrypted-only value; every client the harness governs speaks TLS',
+    },
+];
+// A quoted assignment, whatever it names. WHICH names hold a credential is decided below rather than
+// inside the pattern: one alternation covering every spelling was unreadable and past the complexity
+// the lint budget allows, and it is the name's segments that carry the meaning anyway.
+const QUOTED_ASSIGNMENT = /^[ \t]*(?<name>\w+)[ \t]*=[ \t]*"(?<value>[^"]*)"/;
+// Read by the last `_`-segment of the name, the way the credential guard in `source-security.ts` reads
+// an identifier. `key` alone is excluded: an S3 object's `key` is a path, and reading it as a
+// credential would report every upload in the tree - so only a QUALIFIED key counts.
+const CREDENTIAL_WORDS = new Set([
+    'password',
+    'passphrase',
+    'secret',
+    'token',
+    'credential',
+    'credentials',
+]);
+const QUALIFIED_KEYS = new Set([
+    'api',
+    'access',
+    'secret',
+    'private',
+    'encryption',
+]);
+// A secret's CONTENT argument is named the other way round: `secret_string`, `secret_data` and
+// `secret_binary` are what a secret-store version holds, so the first segment carries the meaning and
+// the last says what shape the content takes. `secret_id` and `secret_arn` name a secret rather than
+// hold one, and stay outside.
+const SECRET_CONTENT = new Set(['string', 'data', 'binary', 'value']);
+const PENULTIMATE = -2;
+const isCredentialName = (name) => {
+    const segments = name.toLowerCase().split('_');
+    const first = segments.at(0) ?? '';
+    const last = segments.at(-1) ?? '';
+    if (last === 'key') {
+        return QUALIFIED_KEYS.has(segments.at(PENULTIMATE) ?? '');
+    }
+    return CREDENTIAL_WORDS.has(last) || (first === 'secret' && SECRET_CONTENT.has(last));
+};
+// What a placeholder looks like once punctuation and case stop mattering. An angle-bracketed value is
+// the other conventional spelling, and it needs no vocabulary.
+const PLACEHOLDER_VALUES = new Set([
+    'REPLACEME',
+    'CHANGEME',
+    'TODO',
+    'FIXME',
+    'XXX',
+    'PLACEHOLDER',
+    'TBD',
+    'YOURVALUEHERE',
+]);
+const isPlaceholder = (value) => {
+    if (value.startsWith('<') && value.endsWith('>')) {
+        return true;
+    }
+    return PLACEHOLDER_VALUES.has(value.toUpperCase().replaceAll(/[^A-Z0-9]/g, ''));
+};
+// An analyzer's own inline skip. Without this the curated checks are advisory: one comment turns the
+// flagship check off and the run still passes. gitleaks cannot see a placeholder either - it carries no
+// entropy - which is why the value rule above is here rather than left to the secret scan.
+const ANALYZER_SUPPRESSION = /#[ \t]*(?<analyzer>checkov:skip=|tfsec:ignore:|trivy:ignore:)/;
+const flagViolations = (code) => code.split('\n').flatMap((line, index) => FLAG_RULES.filter((flag) => flag.patterns.some((pattern) => pattern.test(line))).map((flag) => ({
+    line: index + FIRST_LINE,
+    rule: flag.rule,
+    reason: flag.reason,
+})));
+// The attribute a line leaves as a placeholder, or nothing. Separated from the walk below so each reads
+// as the one question it asks.
+const placeholderNameIn = (line) => {
+    const found = QUOTED_ASSIGNMENT.exec(line);
+    if (found === null) {
+        return undefined;
+    }
+    const name = found.groups?.['name'] ?? '';
+    const value = found.groups?.['value'] ?? '';
+    return isCredentialName(name) && isPlaceholder(value) ? name : undefined;
+};
+const placeholderViolations = (code) => code.split('\n').flatMap((line, index) => {
+    const name = placeholderNameIn(line);
+    return name === undefined
+        ? []
+        : [
+            {
+                line: index + FIRST_LINE,
+                rule: 'no-placeholder-secret',
+                reason: `${name} is set to a placeholder, so whatever it guards is guarded by a value written ` +
+                    'into the repository - supply it from a secret store, and let the configuration name ' +
+                    'the reference rather than the value',
+            },
+        ];
+});
+// Read from the RAW text, unlike every rule above: a comment is this rule's subject rather than
+// something to see past.
+const suppressionViolations = (source) => source.split('\n').flatMap((line, index) => {
+    const analyzer = ANALYZER_SUPPRESSION.exec(line)?.groups?.['analyzer'];
+    return analyzer === undefined
+        ? []
+        : [
+            {
+                line: index + FIRST_LINE,
+                rule: 'no-analyzer-suppression',
+                reason: `"${analyzer}" turns off a check this harness enabled, from inside the file the check ` +
+                    'judges - repair what the analyzer found, because a gate a project can switch off is ' +
+                    'not a gate',
+            },
+        ];
+});
+// The rule resource is read from its header to the next line that closes or opens a top-level block.
+// Formatted HCL closes a resource at column 0; unformatted HCL over-reads at worst the blank lines
+// before the next block, never the next block's attributes.
+const INGRESS_RULE_HEADER = /^[ \t]*resource[ \t]+"aws_vpc_security_group_ingress_rule"/;
+const BLOCK_BOUNDARY = /^(?:\}|(?:resource|data|module|variable|output|locals|provider|terraform)\b)/;
+const ANY_ADDRESS = /^[ \t]*cidr_ipv[46][ \t]*=[ \t]*"(?:0\.0\.0\.0\/0|::\/0)"/;
+const EVERY_PROTOCOL = /^[ \t]*ip_protocol[ \t]*=[ \t]*"?-1"?/;
+const PORT_EDGE = /^[ \t]*(?<edge>from_port|to_port)[ \t]*=[ \t]*(?<port>\d+)/;
+const SSH_PORT = 22;
+const RDP_PORT = 3389;
+const LAST_PORT = 65_535;
+const ingressRulesIn = (lines) => lines.flatMap((line, index) => {
+    if (!INGRESS_RULE_HEADER.test(line)) {
+        return [];
+    }
+    const rest = lines.slice(index + 1);
+    const end = rest.findIndex((candidate) => BLOCK_BOUNDARY.test(candidate));
+    return [{ line: index + FIRST_LINE, body: end === -1 ? rest : rest.slice(0, end) }];
+});
+const portRangeOf = (body) => {
+    const edges = new Map(body.flatMap((line) => {
+        const found = PORT_EDGE.exec(line);
+        return found === null
+            ? []
+            : [[found.groups?.['edge'] ?? '', Number(found.groups?.['port'] ?? '')]];
+    }));
+    const from = edges.get('from_port');
+    const to = edges.get('to_port');
+    return from === undefined || to === undefined ? undefined : { from, to };
+};
+const coversPort = (range, port) => range.from <= port && port <= range.to;
+// What a port range exposes when its source is every address, or nothing when its ports are ones a
+// public site legitimately opens.
+const exposureOfRange = (range) => {
+    if (range.from === 0 && range.to === LAST_PORT) {
+        return 'every port';
+    }
+    if (coversPort(range, SSH_PORT)) {
+        return 'SSH';
+    }
+    return coversPort(range, RDP_PORT) ? 'RDP' : undefined;
+};
+const exposureOf = (body) => {
+    if (!body.some((line) => ANY_ADDRESS.test(line))) {
+        return undefined;
+    }
+    if (body.some((line) => EVERY_PROTOCOL.test(line))) {
+        return 'every port';
+    }
+    const range = portRangeOf(body);
+    return range === undefined ? undefined : exposureOfRange(range);
+};
+const openIngressViolations = (code) => ingressRulesIn(code.split('\n')).flatMap((rule) => {
+    const exposure = exposureOf(rule.body);
+    return exposure === undefined
+        ? []
+        : [
+            {
+                line: rule.line,
+                rule: 'no-open-ingress',
+                reason: `an ingress rule admits ${exposure} from the whole internet - name the security ` +
+                    'group or address range that needs it as the source',
+            },
+        ];
+});
+/**
+ * Report every infrastructure defect a text reader can decide.
+ * @param source the file's text, as tracked.
+ * @returns one violation per defect, ordered by the line it sits on.
+ */
+export const findTerraformViolations = (source) => {
+    // `stripComments` covers the `//` and `/* */` forms HCL shares with the languages it was written
+    // for. It does NOT read `#`, which is HCL's own spelling - what keeps `# force_destroy = true` out
+    // of the value rules is that each pattern is anchored at the attribute, so a leading `#` cannot
+    // match. The suppression rule reads the raw text instead, because the comment is its subject.
+    const code = stripComments(source);
+    return [
+        ...flagViolations(code),
+        ...placeholderViolations(code),
+        ...openIngressViolations(code),
+        ...suppressionViolations(source),
+    ].toSorted((left, right) => left.line - right.line);
+};
+//# sourceMappingURL=terraform-policy.js.map

package/dist/terraform-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-policy.js","sourceRoot":"","sources":["../src/terraform-policy.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,qGAAqG;AACrG,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,EAAE;AACF,uGAAuG;AACvG,uGAAuG;AACvG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,wGAAwG;AACxG,uFAAuF;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAShD,MAAM,UAAU,GAAW,CAAC,CAAA;AAE5B,kGAAkG;AAClG,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,KAAa,EAAU,EAAE,CAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,UAAU,SAAS,kBAAkB,KAAK,eAAe,CAAC,CAAA;AAEjF,iGAAiG;AACjG,uBAAuB;AACvB,MAAM,sBAAsB,GAAW,sCAAsC,CAAA;AAS7E,oGAAoG;AACpG,qGAAqG;AACrG,qGAAqG;AACrG,sFAAsF;AACtF,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,6BAA6B;AAC7B,MAAM,UAAU,GAAwB;IACtC;QACE,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EACJ,4FAA4F;YAC5F,2FAA2F;YAC3F,qDAAqD;KACxD;IACD;QACE,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,EAAE,2BAA2B;QACjC,MAAM,EACJ,4FAA4F;YAC5F,+FAA+F;YAC/F,qCAAqC;KACxC;IACD;QACE,QAAQ,EAAE;YACR,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAC/B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;YAChC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;YACzC,IAAI,MAAM,CACR,MAAM,CAAC,GAAG,CAAA,+CAA+C,sBAAsB,GAAG,CACnF;SACF;QACD,IAAI,EAAE,8BAA8B;QACpC,MAAM,EACJ,6FAA6F;YAC7F,mEAAmE;KACtE;IACD;QACE,QAAQ,EAAE;YACR,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;YACvD,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;YAChC,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAC;YAC/C,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;YAC9C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;YACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACxC;QACD,IAAI,EAAE,0BAA0B;QAChC,MAAM,EACJ,0FAA0F;YAC1F,mEAAmE;KACtE;CACF,CAAA;AAED,qGAAqG;AACrG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,iBAAiB,GAAW,mDAAmD,CAAA;AAErF,uGAAuG;AACvG,8FAA8F;AAC9F,qFAAqF;AACrF,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,YAAY;CACb,CAAC,CAAA;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,qGAAqG;AACrG,8BAA8B;AAC9B,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;AAE1F,MAAM,WAAW,GAAW,CAAC,CAAC,CAAA;AAE9B,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE;IACjD,MAAM,QAAQ,GAAsB,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,MAAM,KAAK,GAAW,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAW,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACvF,CAAC,CAAA;AAED,sGAAsG;AACtG,+DAA+D;AAC/D,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,UAAU;IACV,MAAM;IACN,OAAO;IACP,KAAK;IACL,aAAa;IACb,KAAK;IACL,eAAe;CAChB,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,KAAa,EAAW,EAAE;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC,CAAA;AAED,qGAAqG;AACrG,wGAAwG;AACxG,2FAA2F;AAC3F,MAAM,oBAAoB,GAAW,+DAA+D,CAAA;AAEpG,MAAM,cAAc,GAAG,CAAC,IAAY,EAAiC,EAAE,CACrE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAAiC,EAAE,CACtF,UAAU,CAAC,MAAM,CAAC,CAAC,IAAc,EAAW,EAAE,CAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACrE,CAAC,GAAG,CACH,CAAC,IAAc,EAAsB,EAAE,CAAC,CAAC;IACvC,IAAI,EAAE,KAAK,GAAG,UAAU;IACxB,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,MAAM,EAAE,IAAI,CAAC,MAAM;CACpB,CAAC,CACH,CACF,CAAA;AAEH,wGAAwG;AACxG,+BAA+B;AAC/B,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC7D,MAAM,KAAK,GAA2B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAW,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,KAAK,GAAW,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAiC,EAAE,CAC5E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAAiC,EAAE;IACtF,MAAM,IAAI,GAAuB,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,GAAG,UAAU;gBACxB,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EACJ,GAAG,IAAI,gFAAgF;oBACvF,sFAAsF;oBACtF,qCAAqC;aACxC;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ,gGAAgG;AAChG,yBAAyB;AACzB,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAC9E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAAiC,EAAE;IACxF,MAAM,QAAQ,GAAuB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,CAAA;IAC1F,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,GAAG,UAAU;gBACxB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,IAAI,QAAQ,2EAA2E;oBACvF,sFAAsF;oBACtF,YAAY;aACf;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ,qGAAqG;AACrG,mGAAmG;AACnG,4DAA4D;AAC5D,MAAM,mBAAmB,GAAW,4DAA4D,CAAA;AAChG,MAAM,cAAc,GAClB,8EAA8E,CAAA;AAChF,MAAM,WAAW,GAAW,2DAA2D,CAAA;AACvF,MAAM,cAAc,GAAW,uCAAuC,CAAA;AACtE,MAAM,SAAS,GAAW,4DAA4D,CAAA;AAEtF,MAAM,QAAQ,GAAW,EAAE,CAAA;AAC3B,MAAM,QAAQ,GAAW,IAAI,CAAA;AAC7B,MAAM,SAAS,GAAW,MAAM,CAAA;AAYhC,MAAM,cAAc,GAAG,CAAC,KAAwB,EAA0B,EAAE,CAC1E,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAA0B,EAAE;IACpE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAsB,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACtD,MAAM,GAAG,GAAW,IAAI,CAAC,SAAS,CAAC,CAAC,SAAiB,EAAW,EAAE,CAChE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAC/B,CAAA;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AACrF,CAAC,CAAC,CAAA;AAEJ,MAAM,WAAW,GAAG,CAAC,IAAuB,EAAyB,EAAE;IACrE,MAAM,KAAK,GAAgC,IAAI,GAAG,CAChD,IAAI,CAAC,OAAO,CAAC,CAAC,IAAY,EAA0C,EAAE;QACpE,MAAM,KAAK,GAA2B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1D,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC,CAAC,CACH,CAAA;IACD,MAAM,IAAI,GAAuB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACvD,MAAM,EAAE,GAAuB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AAC1E,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAAgB,EAAE,IAAY,EAAW,EAAE,CAC7D,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,EAAE,CAAA;AAExC,mGAAmG;AACnG,kCAAkC;AAClC,MAAM,eAAe,GAAG,CAAC,KAAgB,EAAsB,EAAE;IAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACxD,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAsB,EAAE;IACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,MAAM,KAAK,GAA0B,WAAW,CAAC,IAAI,CAAC,CAAA;IACtD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAiC,EAAE,CAC5E,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAiB,EAAiC,EAAE;IAC5F,MAAM,QAAQ,GAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EACJ,0BAA0B,QAAQ,+CAA+C;oBACjF,oDAAoD;aACvD;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAiC,EAAE;IACvF,iGAAiG;IACjG,mGAAmG;IACnG,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,GAAG,cAAc,CAAC,IAAI,CAAC;QACvB,GAAG,qBAAqB,CAAC,IAAI,CAAC;QAC9B,GAAG,qBAAqB,CAAC,IAAI,CAAC;QAC9B,GAAG,qBAAqB,CAAC,MAAM,CAAC;KACjC,CAAC,QAAQ,CACR,CAAC,IAAwB,EAAE,KAAyB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CACxF,CAAA;AACH,CAAC,CAAA"}

package/dist/terraform-providers.d.ts

@@ -0,0 +1,28 @@
+/** One line that names a provider: a resource, a data source, or a provider block. */
+export interface ProviderDeclaration {
+    readonly line: number;
+    readonly provider: string;
+    /** What the line declares, as a finding names it: the resource type, or `provider "name"`. */
+    readonly subject: string;
+    readonly kind: 'resource' | 'data' | 'provider';
+}
+/**
+ * Every line of a source that names a provider.
+ * @param source the file's text, as tracked.
+ * @returns the declarations, ordered by the line they sit on.
+ */
+export declare const providerDeclarationsIn: (source: string) => readonly ProviderDeclaration[];
+/**
+ * The providers a set of declarations names.
+ * @param declarations declarations from one or many sources.
+ * @returns each provider once, ordered so a report reads the same on every machine.
+ */
+export declare const providersOf: (declarations: readonly ProviderDeclaration[]) => readonly string[];
+/**
+ * How many resources and data sources the declarations carry - what an analyzer has to judge. A
+ * provider block configures a provider and declares nothing it could check.
+ * @param declarations declarations from one or many sources.
+ * @returns the count of resource and data declarations.
+ */
+export declare const resourceCountOf: (declarations: readonly ProviderDeclaration[]) => number;
+//# sourceMappingURL=terraform-providers.d.ts.map

package/dist/terraform-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-providers.d.ts","sourceRoot":"","sources":["../src/terraform-providers.ts"],"names":[],"mappings":"AAUA,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;CAChD;AA6CD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,QAAQ,MAAM,KAAG,SAAS,mBAAmB,EAKnF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,cAAc,SAAS,mBAAmB,EAAE,KAAG,SAAS,MAAM,EAKV,CAAA;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,cAAc,SAAS,mBAAmB,EAAE,KAAG,MAGrE,CAAA"}

package/dist/terraform-providers.js

@@ -0,0 +1,68 @@
+// Which providers an OpenTofu or Terraform source declares, read from block headers alone.
+//
+// The resource type is the key, because it is what the analyzer's own catalogue binds a check to:
+// `aws_iam_role` belongs to `aws` whatever local name a `required_providers` block gives the provider.
+// That block is deliberately not read. Modules inherit it from their caller, so it sits in a minority
+// of files; its `source = "..."` line cannot be told from a module's without block parsing; and a
+// provider declared there with no resource in the tree leaves the analyzer nothing to judge anyway.
+// Nothing here parses HCL structure - this stays a line reader, like the policy beside it.
+import { lineOf, stripComments } from './source-text.js';
+// Anchored at the start of a line so HCL's own `#` comment, which `stripComments` does not read, cannot
+// match; a `//` or `/* */` comment is blanked before the scan (see terraform-policy.ts).
+const RESOURCE_HEADER = /^[ \t]*(?<kind>resource|data)[ \t]+"(?<type>[a-z][a-z0-9_]*)"/gm;
+const PROVIDER_HEADER = /^[ \t]*provider[ \t]+"(?<name>[a-z][a-z0-9-]*)"/gm;
+// A provider whose resources carry another provider's prefix. `google-beta` declares `google_*`
+// resources, so its block names the provider the resource types already name.
+const PROVIDER_ALIASES = new Map([['google-beta', 'google']]);
+const providerOfType = (type) => {
+    const separator = type.indexOf('_');
+    return separator === -1 ? type : type.slice(0, separator);
+};
+// A matched header always carries its groups; the fallback satisfies the type checker, not a case.
+const groupOf = (found, group) => found[group] ?? '';
+const KIND_GROUP = 1;
+const TYPE_GROUP = 2;
+const NAME_GROUP = 1;
+const resourceDeclarations = (code) => [...code.matchAll(RESOURCE_HEADER)].map((found) => {
+    const type = groupOf(found, TYPE_GROUP);
+    return {
+        line: lineOf(code, found.index),
+        provider: providerOfType(type),
+        subject: type,
+        kind: groupOf(found, KIND_GROUP) === 'data' ? 'data' : 'resource',
+    };
+});
+const providerBlocks = (code) => [...code.matchAll(PROVIDER_HEADER)].map((found) => {
+    const name = groupOf(found, NAME_GROUP);
+    return {
+        line: lineOf(code, found.index),
+        provider: PROVIDER_ALIASES.get(name) ?? name,
+        subject: `provider "${name}"`,
+        kind: 'provider',
+    };
+});
+/**
+ * Every line of a source that names a provider.
+ * @param source the file's text, as tracked.
+ * @returns the declarations, ordered by the line they sit on.
+ */
+export const providerDeclarationsIn = (source) => {
+    const code = stripComments(source);
+    return [...resourceDeclarations(code), ...providerBlocks(code)].toSorted((left, right) => left.line - right.line);
+};
+/**
+ * The providers a set of declarations names.
+ * @param declarations declarations from one or many sources.
+ * @returns each provider once, ordered so a report reads the same on every machine.
+ */
+export const providersOf = (declarations) => [
+    ...new Set(declarations.map((declaration) => declaration.provider)),
+].toSorted((left, right) => left.localeCompare(right));
+/**
+ * How many resources and data sources the declarations carry - what an analyzer has to judge. A
+ * provider block configures a provider and declares nothing it could check.
+ * @param declarations declarations from one or many sources.
+ * @returns the count of resource and data declarations.
+ */
+export const resourceCountOf = (declarations) => declarations.filter((declaration) => declaration.kind !== 'provider').length;
+//# sourceMappingURL=terraform-providers.js.map

package/dist/terraform-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-providers.js","sourceRoot":"","sources":["../src/terraform-providers.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,kGAAkG;AAClG,uGAAuG;AACvG,sGAAsG;AACtG,kGAAkG;AAClG,oGAAoG;AACpG,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAWxD,wGAAwG;AACxG,yFAAyF;AACzF,MAAM,eAAe,GAAW,iEAAiE,CAAA;AACjG,MAAM,eAAe,GAAW,mDAAmD,CAAA;AAEnF,gGAAgG;AAChG,8EAA8E;AAC9E,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;AAE1F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;IAC9C,MAAM,SAAS,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AAC3D,CAAC,CAAA;AAED,mGAAmG;AACnG,MAAM,OAAO,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;AAErF,MAAM,UAAU,GAAW,CAAC,CAAA;AAC5B,MAAM,UAAU,GAAW,CAAC,CAAA;AAC5B,MAAM,UAAU,GAAW,CAAC,CAAA;AAE5B,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAkC,EAAE,CAC5E,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAuB,EAAE;IACtF,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QAC/B,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC;QAC9B,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;KAClE,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,IAAY,EAAkC,EAAE,CACtE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAuB,EAAE;IACtF,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QAC/B,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;QAC5C,OAAO,EAAE,aAAa,IAAI,GAAG;QAC7B,IAAI,EAAE,UAAU;KACjB,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAAkC,EAAE;IACvF,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CACtE,CAAC,IAAyB,EAAE,KAA0B,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAC1F,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,YAA4C,EAAqB,EAAE,CAC7F;IACE,GAAG,IAAI,GAAG,CACR,YAAY,CAAC,GAAG,CAAC,CAAC,WAAgC,EAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CACrF;CACF,CAAC,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAA4C,EAAU,EAAE,CACtF,YAAY,CAAC,MAAM,CACjB,CAAC,WAAgC,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAC/E,CAAC,MAAM,CAAA"}

package/dist/toolchain-pins.d.ts

@@ -1,5 +1,5 @@
 /** An analyzer ploaness runs in a container rather than installing from the registry. */
-export type ContainerTool = 'gitleaks' | 'hadolint' | 'actionlint' | 'shellcheck';
+export type ContainerTool = 'gitleaks' | 'hadolint' | 'actionlint' | 'shellcheck' | 'checkov';
 /** The exact image each containerised analyzer runs, by digest. */
 export declare const CONTAINER_IMAGES: Readonly<Record<ContainerTool, string>>;
 /** Matches a reference that names image bytes AND the release they are, and only such a reference. */

package/dist/toolchain-pins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-pins.d.ts","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAoBA,yFAAyF;AACzF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,CAAA;AAEjF,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAWpE,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,aAAa,EAAE,MACsC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,SAAS,MAAM,EAOxF,CAAA;AAOL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG3E,CAAA;AAOD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,gBAAgB,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG/E,CAAA;AAMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACpC,WAAW,MAAM,GAAG,SAAS,EAC7B,UAAU,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAajB,CAAA"}
+{"version":3,"file":"toolchain-pins.d.ts","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAGA,yFAAyF;AACzF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,CAAA;AAE7F,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAmBpE,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,aAAa,EAAE,MACsC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,SAAS,MAAM,EAOxF,CAAA;AAOL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG3E,CAAA;AAOD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,gBAAgB,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG/E,CAAA;AAMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACpC,WAAW,MAAM,GAAG,SAAS,EAC7B,UAAU,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAajB,CAAA"}

package/dist/toolchain-pins.js

@@ -1,30 +1,20 @@
-// The container images the gates run their analyzers in.
-//
-// Pinned by digest rather than by tag. A tag - `latest` most obviously, but a version tag too - is a
-// mutable reference: the registry can repoint it at new bytes, and the same repository would then reach
-// a different verdict on a different day. A digest names the bytes, so it is the only form that makes
-// "an upstream release cannot change a verdict while the repository does not change" literally true.
-//
-// The tag is written too, and it is not decoration. A digest alone says nothing about which release it
-// is, so the version used to live in a comment beside it - unreadable to anything but a person, which
-// is why nothing reported when a newer image existed. `<repo>:<tag>@sha256:<digest>` states both: docker
-// resolves the digest and ignores the tag, and the freshness check reads the tag to ask the registry
-// what is newer. A bare tag is still rejected; the spec requires both halves.
-//
-// To move a pin, read the new digest with `docker buildx imagetools inspect <repo>:<tag>`.
-//
-// Two of the four tags below are not the versions their comments used to claim. The hadolint pin was
-// commented `2.14.0` and is the bytes of `v2.15.1`; the actionlint pin was commented `1.7.7` and is
-// `1.7.12`. Nothing could have caught that while the version was prose, which is the whole argument for
-// writing it where a check can read it.
+// Analyzer image tags support freshness reporting; immutable digests identify the bytes executed.
+// Update both with docker buildx imagetools inspect <repository>:<tag>.
 /** The exact image each containerised analyzer runs, by digest. */
 export const CONTAINER_IMAGES = {
     gitleaks: 'zricethezav/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f',
     hadolint: 'hadolint/hadolint:v2.15.1@sha256:32dac94127fd60b7b7e3fbfc65e1383b9b5e25c9bfd7b8536de7a539fe68a12d',
     actionlint: 'rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667',
-    // The standard makes a check a repository implements itself into its source code, and the ploaness
-    // verification command is a shell script that no analyzer read.
+    // A project's operational scripts are code it runs against its own database and its own deployments,
+    // and the standard makes a check a repository implements itself into its source code. The `shell`
+    // gate reads both: a consumer's scripts, and the ones this verification command is written in.
     shellcheck: 'koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d',
+    // The infrastructure gate enables named checks rather than a category, and a `--check` id that does
+    // not exist matches nothing and raises no error. The digest is what makes that audit durable: the
+    // catalogue cannot change underneath it, so the enabled ids stay the ones somebody confirmed with
+    // `--list`. The provider standings beside the catalogue rest on the same listing: which providers
+    // the image has no check for at all. Re-confirm both whenever this pin moves.
+    checkov: 'bridgecrew/checkov:3.3.17@sha256:41c4701c6a56d8952e5aba7a420f871c8b70b57da94eb4f142dcdf7295bb0be3',
 };
 /** Matches a reference that names image bytes AND the release they are, and only such a reference. */
 export const DIGEST_PINNED = /^[a-z0-9][a-z0-9._/-]*:[A-Za-z0-9][\w.-]*@sha256:[0-9a-f]{64}$/;

package/dist/toolchain-pins.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-pins.js","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,qGAAqG;AACrG,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,yGAAyG;AACzG,qGAAqG;AACrG,8EAA8E;AAC9E,EAAE;AACF,2FAA2F;AAC3F,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,wGAAwG;AACxG,wCAAwC;AAKxC,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,QAAQ,EACN,sGAAsG;IACxG,QAAQ,EACN,mGAAmG;IACrG,UAAU,EACR,iGAAiG;IACnG,mGAAmG;IACnG,gEAAgE;IAChE,UAAU,EACR,qGAAqG;CACxG,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GACxB,gEAAgE,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAwC,EAAqB,EAAE,CAChG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAA4B,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;KAC7F,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAU,EAAE,CACvD,GAAG,IAAI,UAAU,SAAS,yDAAyD;IACnF,wCAAwC,CAC3C,CAAA;AAEL,0FAA0F;AAC1F,wGAAwG;AACxG,sGAAsG;AACtG,MAAM,aAAa,GAAW,OAAO,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAA+B,EAAsB,EAAE;IACtF,MAAM,KAAK,GAA2B,aAAa,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC3E,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,oGAAoG;AACpG,iGAAiG;AACjG,0DAA0D;AAC1D,MAAM,cAAc,GAAW,4BAA4B,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAAkC,EAAsB,EAAE;IAC1F,MAAM,KAAK,GAA2B,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IAC/E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC,CAAA;AAED,qGAAqG;AACrG,oGAAoG;AACpG,MAAM,eAAe,GAAW,qBAAqB,CAAA;AAErD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,SAA6B,EAC7B,QAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAA2B,eAAe,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAuB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9C,gGAAgG;IAChG,oGAAoG;IACpG,8FAA8F;IAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO;QACL,QAAQ,OAAO,mDAAmD,QAAQ,IAAI;YAC5E,0FAA0F;KAC7F,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"toolchain-pins.js","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wEAAwE;AAKxE,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,QAAQ,EACN,sGAAsG;IACxG,QAAQ,EACN,mGAAmG;IACrG,UAAU,EACR,iGAAiG;IACnG,qGAAqG;IACrG,kGAAkG;IAClG,+FAA+F;IAC/F,UAAU,EACR,qGAAqG;IACvG,oGAAoG;IACpG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,8EAA8E;IAC9E,OAAO,EACL,mGAAmG;CACtG,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GACxB,gEAAgE,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAwC,EAAqB,EAAE,CAChG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAA4B,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;KAC7F,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAU,EAAE,CACvD,GAAG,IAAI,UAAU,SAAS,yDAAyD;IACnF,wCAAwC,CAC3C,CAAA;AAEL,0FAA0F;AAC1F,wGAAwG;AACxG,sGAAsG;AACtG,MAAM,aAAa,GAAW,OAAO,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAA+B,EAAsB,EAAE;IACtF,MAAM,KAAK,GAA2B,aAAa,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC3E,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,oGAAoG;AACpG,iGAAiG;AACjG,0DAA0D;AAC1D,MAAM,cAAc,GAAW,4BAA4B,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAAkC,EAAsB,EAAE;IAC1F,MAAM,KAAK,GAA2B,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IAC/E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC,CAAA;AAED,qGAAqG;AACrG,oGAAoG;AACpG,MAAM,eAAe,GAAW,qBAAqB,CAAA;AAErD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,SAA6B,EAC7B,QAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAA2B,eAAe,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAuB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9C,gGAAgG;IAChG,oGAAoG;IACpG,8FAA8F;IAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO;QACL,QAAQ,OAAO,mDAAmD,QAAQ,IAAI;YAC5E,0FAA0F;KAC7F,CAAA;AACH,CAAC,CAAA"}

package/dist/version-policy.d.ts

@@ -8,18 +8,17 @@ import type { WiringViolation } from './wiring-violation.js';
  * @returns `missing`, or the value in quotes.
  */
 export declare const describeFound: (found: string | undefined) => string;
-/** The meta package a governed project declares, and the root of everything it inherits from ploaness. */
-export declare const HARNESS_PACKAGE: string;
 /**
- * Whether a package name is one of ploaness's own.
+ * Whether a package is one Payload publishes alongside itself, and so must carry the pinned `payload`
+ * version.
  *
- * Exported because the `deps` gate asks the same question when it walks the manifests a project
- * inherits, and it had no way to ask it but a second copy of the two literals above - which is the
- * shape of drift this repository refuses everywhere else.
+ * Exported because the freshness report asks the same question from the other side: a `@payloadcms/*`
+ * update is not the project's to take, since this rule holds the declaration to the pin. Two copies of
+ * the scope literal would be two rules that stop agreeing about which packages that is.
  * @param packageName the declared name.
- * @returns true for `ploaness` and for anything under its scope.
+ * @returns true for anything under Payload's scope.
  */
-export declare const isHarnessPackage: (packageName: string) => boolean;
+export declare const isPayloadFamilyPackage: (packageName: string) => boolean;
 /**
  * The package whose presence makes a project a Payload application.
  *

package/dist/version-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-policy.d.ts","sourceRoot":"","sources":["../src/version-policy.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAc5D;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MACV,CAAA;AAWhD,0GAA0G;AAC1G,eAAO,MAAM,eAAe,EAAE,MAAmB,CAAA;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,KAAG,OACmB,CAAA;AA+M1E;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAkB,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,MAAe,CAAA;AAmG1C,gGAAgG;AAChG,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAA;IACnD,uDAAuD;IACvD,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACjE;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,mGAAmG;IACnG,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC1C,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,uBAAuB,KAC9B,SAAS,eAAe,EAc1B,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,oBAAoB,KAC3B,SAAS,eAAe,EAM1B,CAAA;AAED,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,aAAa,KACpB,SAAS,eAAe,EAa1B,CAAA"}
+{"version":3,"file":"version-policy.d.ts","sourceRoot":"","sources":["../src/version-policy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAc5D;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MACV,CAAA;AAiNhD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,GAAI,aAAa,MAAM,KAAG,OACtB,CAAA;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAkB,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,MAAe,CAAA;AAmG1C,gGAAgG;AAChG,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAA;IACnD,uDAAuD;IACvD,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACjE;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,mGAAmG;IACnG,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC1C,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,uBAAuB,KAC9B,SAAS,eAAe,EAc1B,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,oBAAoB,KAC3B,SAAS,eAAe,EAM1B,CAAA;AAED,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,aAAa,KACpB,SAAS,eAAe,EAa1B,CAAA"}

package/dist/version-policy.js

@@ -1,10 +1,6 @@
-// The versions a governed project declares, and every way it could change one without saying so.
-//
-// This is the wiring module's other half. `wiring-policy.ts` judges the files a project points at
-// ploaness with; this judges the numbers beside its dependencies. The two were one file until it passed
-// the size cap, which is the cap doing its job: they answer different questions and share only the
-// helpers below.
-import { findOverrides, OVERRIDE_KEYS } from './install-policy.js';
+// Hold declared package versions and install overrides to the harness-owned version policy.
+import { HARNESS_PACKAGE, isHarnessPackage } from './harness-package.js';
+import { findOverrides, OVERRIDE_KEYS, packageNameOf, } from './install-policy.js';
 import { asOptionalText, asRecord, asStringRecord, declaredDependencies } from './json-shapes.js';
 import { pinnedPnpmVersion } from './toolchain-pins.js';
 // Which block a package is actually declared in. A finding that named `devDependencies` for a package
@@ -35,18 +31,6 @@ export const describeFound = (found) => found === undefined ? 'missing' : `"${fo
 // finding, which is the right time to say what was actually intended.
 const HARNESS_SCOPE = '@ploaness/';
 const LOCAL_ARTEFACT = /^(?:file|link|workspace):/;
-/** The meta package a governed project declares, and the root of everything it inherits from ploaness. */
-export const HARNESS_PACKAGE = 'ploaness';
-/**
- * Whether a package name is one of ploaness's own.
- *
- * Exported because the `deps` gate asks the same question when it walks the manifests a project
- * inherits, and it had no way to ask it but a second copy of the two literals above - which is the
- * shape of drift this repository refuses everywhere else.
- * @param packageName the declared name.
- * @returns true for `ploaness` and for anything under its scope.
- */
-export const isHarnessPackage = (packageName) => packageName === HARNESS_PACKAGE || packageName.startsWith(HARNESS_SCOPE);
 const isHarnessTarball = (entry) => isHarnessPackage(entry.packageName) && LOCAL_ARTEFACT.test(entry.specifier);
 const overrideViolation = (entry, expected, declared) => {
     if (isHarnessTarball(entry)) {
@@ -127,12 +111,6 @@ const checkEngines = (packageJson, required) => {
 // version says otherwise; and a package extension, which rewrites a manifest the resolver then obeys.
 // None is visible in the dependency block a reader checks, which is what makes them worth naming - and
 // the list is imported rather than restated, because two copies of it in one gate will not stay equal.
-// A patch is keyed by `name@version`, and a scoped name begins with the same character, so the split is
-// on the last `@` rather than the first.
-const packageNameOf = (key) => {
-    const at = key.lastIndexOf('@');
-    return at > 0 ? key.slice(0, at) : key;
-};
 const escapeEntries = (packageJson) => OVERRIDE_KEYS.flatMap((key) => [packageJson, asRecord(packageJson['pnpm'])].flatMap((holder) => Object.keys(asRecord(holder[key])).map((entry) => [key, entry])));
 const checkVersionEscapes = (packageJson, expected) => escapeEntries(packageJson)
     .filter(([, entry]) => Object.hasOwn(expected, packageNameOf(entry ?? '')))
@@ -190,6 +168,17 @@ const checkExactVersions = (packageJson) => Object.entries(declaredDependencies(
 // list, so a project adding `@payloadcms/plugin-form-builder` is covered by the rule that already
 // exists instead of by an entry somebody has to remember.
 const PAYLOAD_SCOPE = '@payloadcms/';
+/**
+ * Whether a package is one Payload publishes alongside itself, and so must carry the pinned `payload`
+ * version.
+ *
+ * Exported because the freshness report asks the same question from the other side: a `@payloadcms/*`
+ * update is not the project's to take, since this rule holds the declaration to the pin. Two copies of
+ * the scope literal would be two rules that stop agreeing about which packages that is.
+ * @param packageName the declared name.
+ * @returns true for anything under Payload's scope.
+ */
+export const isPayloadFamilyPackage = (packageName) => packageName.startsWith(PAYLOAD_SCOPE);
 /**
  * The package whose presence makes a project a Payload application.
  *
@@ -211,7 +200,7 @@ const checkPayloadFamily = (packageJson, payloadVersion) => {
         return [];
     }
     return Object.entries(declaredDependencies(packageJson))
-        .filter(([name, version]) => name.startsWith(PAYLOAD_SCOPE) && version !== payloadVersion)
+        .filter(([name, version]) => isPayloadFamilyPackage(name) && version !== payloadVersion)
         .map(([name, version]) => ({
         location: `package.json ${name}`,
         reason: `is "${version}" but payload is pinned at "${payloadVersion}"; ` +

package/dist/version-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-policy.js","sourceRoot":"","sources":["../src/version-policy.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,EAAE;AACF,kGAAkG;AAClG,wGAAwG;AACxG,mGAAmG;AACnG,iBAAiB;AACjB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAGvD,sGAAsG;AACtG,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,OAAO,GAAG,CAAC,WAAoC,EAAE,IAAY,EAAsB,EAAE;IACzF,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC;QACxE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAU,EAAE,CACjE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAA;AAEhD,sGAAsG;AACtG,wGAAwG;AACxG,mGAAmG;AACnG,mGAAmG;AACnG,uGAAuG;AACvG,sEAAsE;AACtE,MAAM,aAAa,GAAW,YAAY,CAAA;AAC1C,MAAM,cAAc,GAAW,2BAA2B,CAAA;AAE1D,0GAA0G;AAC1G,MAAM,CAAC,MAAM,eAAe,GAAW,UAAU,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAC/D,WAAW,KAAK,eAAe,IAAI,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAE1E,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAW,EAAE,CACzD,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AAE7E,MAAM,iBAAiB,GAAG,CACxB,KAAoB,EACpB,QAA0C,EAC1C,QAAgC,EACJ,EAAE;IAC9B,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAW,uBAAuB,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAA;IAChF,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL;gBACE,QAAQ;gBACR,MAAM,EACJ,iFAAiF;oBACjF,mBAAmB;aACtB;SACF,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAuB,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC3D,OAAO,GAAG,KAAK,SAAS;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ;gBACR,MAAM,EACJ,gDAAgD,GAAG,4BAA4B;oBAC/E,2DAA2D;aAC9D;SACF,CAAA;AACP,CAAC,CAAA;AAED,oGAAoG;AACpG,qGAAqG;AACrG,uGAAuG;AACvG,oGAAoG;AACpG,qGAAqG;AACrG,+FAA+F;AAC/F,mGAAmG;AACnG,uGAAuG;AACvG,uBAAuB;AACvB,MAAM,0BAA0B,GAAG,CACjC,aAAqB,EACrB,QAA0C,EAC1C,qBAAuD,EAC3B,EAAE,CAC9B,aAAa,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,KAAoB,EAA8B,EAAE,CACxF,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACjE,CAAA;AAEH,sGAAsG;AACtG,gGAAgG;AAChG,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,CAC1B,WAAoC,EACpC,QAA4B,EACA,EAAE;IAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAY,WAAW,CAAC,gBAAgB,CAAC,CAAA;IACvD,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ,EAAE,6BAA6B;gBACvC,MAAM,EAAE,MAAM,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,2BAA2B,QAAQ,GAAG;aAC5F;SACF,CAAA;AACP,CAAC,CAAA;AAED,kGAAkG;AAClG,qGAAqG;AACrG,qGAAqG;AACrG,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CAAC,MAG1B,EAAoC,EAAE;IACrC,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;IACjF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,CAAA;AAC1F,CAAC,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAM,YAAY,GAAG,CACnB,WAAoC,EACpC,QAA0C,EACd,EAAE;IAC9B,MAAM,QAAQ,GAA2B,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CACrC,CAAC,CAAC,IAAI,EAAE,KAAK,CAA4B,EAA8B,EAAE,CACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ,EAAE,wBAAwB,IAAI,EAAE;gBACxC,MAAM,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,2BAA2B,KAAK,GAAG;aAC/E;SACF,CACR,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,uGAAuG;AACvG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AAEvG,wGAAwG;AACxG,yCAAyC;AACzC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAU,EAAE;IAC5C,MAAM,EAAE,GAAW,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACxC,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,WAAoC,EAAkC,EAAE,CAC7F,aAAa,CAAC,OAAO,CAAC,CAAC,GAAW,EAAkC,EAAE,CACpE,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAClD,CAAC,MAA+B,EAAkC,EAAE,CAClE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAa,EAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAC7F,CACF,CAAA;AAEH,MAAM,mBAAmB,GAAG,CAC1B,WAAoC,EACpC,QAA0C,EACd,EAAE,CAC9B,aAAa,CAAC,WAAW,CAAC;KACvB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAoB,EAAW,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CACpD;KACA,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAoB,EAAmB,EAAE,CAAC,CAAC;IACrD,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE;IACpD,MAAM,EACJ,oFAAoF;QACpF,sEAAsE;CACzE,CAAC,CACH,CAAA;AAEL,qGAAqG;AACrG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,YAAY,GAAW,qEAAqE,CAAA;AAElG,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,2DAA2D;AAC3D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AACpD,iGAAiG;AACjG,6FAA6F;AAC7F,mEAAmE;AACnE,MAAM,WAAW,GAAW,oCAAoC,CAAA;AAEhE,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,MAAM,aAAa,GAAW,KAAK,CAAA;AAEnC,mGAAmG;AACnG,wGAAwG;AACxG,+EAA+E;AAC/E,MAAM,SAAS,GAAW,MAAM,CAAA;AAEhC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAW,EAAE;IACpD,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAW,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACzD,MAAM,EAAE,GAAW,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,OAAO,EAAE,GAAG,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,WAAoC,EAA8B,EAAE,CAC9F,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;KAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAA4B,EAAW,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;KACzF,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAmB,EAAE,CAAC,CAAC;IAClE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;IAChC,MAAM,EACJ,OAAO,SAAS,kEAAkE;QAClF,4DAA4D;CAC/D,CAAC,CACH,CAAA;AAEL,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,0DAA0D;AAC1D,MAAM,aAAa,GAAW,cAAc,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAW,SAAS,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAW,MAAM,CAAA;AAE1C,MAAM,kBAAkB,GAAG,CACzB,WAAoC,EACpC,cAAkC,EACN,EAAE;IAC9B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;SACrD,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAW,EAAE,CACtD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,OAAO,KAAK,cAAc,CAC/D;SACA,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAmB,EAAE,CAAC,CAAC;QAChE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;QAChC,MAAM,EACJ,OAAO,OAAO,+BAA+B,cAAc,KAAK;YAChE,yDAAyD;KAC5D,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,qGAAqG;AACrG,uGAAuG;AACvG,0FAA0F;AAC1F,EAAE;AACF,uGAAuG;AACvG,iGAAiG;AACjG,qGAAqG;AACrG,OAAO;AACP,MAAM,kBAAkB,GAAG,CAAC,WAAoC,EAA8B,EAAE;IAC9F,MAAM,QAAQ,GAA2B,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAuB,QAAQ,CAAC,eAAe,CAAC,CAAA;IAC7D,iGAAiG;IACjG,gGAAgG;IAChG,qGAAqG;IACrG,mGAAmG;IACnG,wEAAwE;IACxE,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5B,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAW,EAAE,CACtD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,OAAO,CACvF;SACA,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAmB,EAAE,CAAC,CAAC;QAChE,QAAQ,EAAE,gBAAgB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE;QACpE,MAAM,EACJ,OAAO,OAAO,kCAAkC,OAAO,8BAA8B;YACrF,2EAA2E;KAC9E,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CACzB,WAAoC,EACpC,QAA0C,EAC1C,QAA6B,EACD,EAAE;IAC9B,MAAM,QAAQ,GAA2B,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC1E,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CACrC,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAA8B,EAAE;QACzE,MAAM,KAAK,GAAuB,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACvB,CAAC,CAAC;oBACE;wBACE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;wBAChC,MAAM,EAAE,gEAAgE,OAAO,EAAE;qBAClF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAA;QACR,CAAC;QACD,OAAO,KAAK,KAAK,OAAO;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,gBAAgB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE;oBACpE,MAAM,EACJ,OAAO,KAAK,8BAA8B,OAAO,KAAK;wBACtD,mDAAmD;iBACtD;aACF,CAAA;IACP,CAAC,CACF,CAAA;AACH,CAAC,CAAA;AAyBD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,WAAoC,EACpC,MAA+B,EACH,EAAE,CAAC;IAC/B,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,sBAAsB,CAAC;IAClE,GAAG,YAAY,CACb,WAAW,EACX,iBAAiB,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACtD,CAAC,CACH;IACD,GAAG,0BAA0B,CAC3B,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,qBAAqB,CAC7B;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,WAAoC,EACpC,MAA4B,EACA,EAAE,CAAC;IAC/B,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpE,GAAG,kBAAkB,CAAC,WAAW,CAAC;IAClC,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;IACzD,GAAG,kBAAkB,CAAC,WAAW,CAAC;IAClC,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;CACrD,CAAA;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,WAAoC,EACpC,MAAqB,EACO,EAAE,CAAC;IAC/B,GAAG,4BAA4B,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,GAAG,+BAA+B,CAAC,WAAW,EAAE;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,qBAAqB,EAAE,oBAAoB,CAAC,WAAW,CAAC;KACzD,CAAC;CACH,CAAA"}
+{"version":3,"file":"version-policy.js","sourceRoot":"","sources":["../src/version-policy.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAE5F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,EACL,aAAa,EACb,aAAa,EAEb,aAAa,GACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAGvD,sGAAsG;AACtG,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,OAAO,GAAG,CAAC,WAAoC,EAAE,IAAY,EAAsB,EAAE;IACzF,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC;QACxE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAU,EAAE,CACjE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAA;AAEhD,sGAAsG;AACtG,wGAAwG;AACxG,mGAAmG;AACnG,mGAAmG;AACnG,uGAAuG;AACvG,sEAAsE;AACtE,MAAM,aAAa,GAAW,YAAY,CAAA;AAC1C,MAAM,cAAc,GAAW,2BAA2B,CAAA;AAE1D,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAW,EAAE,CACzD,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AAE7E,MAAM,iBAAiB,GAAG,CACxB,KAAoB,EACpB,QAA0C,EAC1C,QAAgC,EACJ,EAAE;IAC9B,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAW,uBAAuB,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAA;IAChF,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL;gBACE,QAAQ;gBACR,MAAM,EACJ,iFAAiF;oBACjF,mBAAmB;aACtB;SACF,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAuB,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC3D,OAAO,GAAG,KAAK,SAAS;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ;gBACR,MAAM,EACJ,gDAAgD,GAAG,4BAA4B;oBAC/E,2DAA2D;aAC9D;SACF,CAAA;AACP,CAAC,CAAA;AAED,oGAAoG;AACpG,qGAAqG;AACrG,uGAAuG;AACvG,oGAAoG;AACpG,qGAAqG;AACrG,+FAA+F;AAC/F,mGAAmG;AACnG,uGAAuG;AACvG,uBAAuB;AACvB,MAAM,0BAA0B,GAAG,CACjC,aAAqB,EACrB,QAA0C,EAC1C,qBAAuD,EAC3B,EAAE,CAC9B,aAAa,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,KAAoB,EAA8B,EAAE,CACxF,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACjE,CAAA;AAEH,sGAAsG;AACtG,gGAAgG;AAChG,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,CAC1B,WAAoC,EACpC,QAA4B,EACA,EAAE;IAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAY,WAAW,CAAC,gBAAgB,CAAC,CAAA;IACvD,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ,EAAE,6BAA6B;gBACvC,MAAM,EAAE,MAAM,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,2BAA2B,QAAQ,GAAG;aAC5F;SACF,CAAA;AACP,CAAC,CAAA;AAED,kGAAkG;AAClG,qGAAqG;AACrG,qGAAqG;AACrG,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CAAC,MAG1B,EAAoC,EAAE;IACrC,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;IACjF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,CAAA;AAC1F,CAAC,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAM,YAAY,GAAG,CACnB,WAAoC,EACpC,QAA0C,EACd,EAAE;IAC9B,MAAM,QAAQ,GAA2B,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CACrC,CAAC,CAAC,IAAI,EAAE,KAAK,CAA4B,EAA8B,EAAE,CACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ,EAAE,wBAAwB,IAAI,EAAE;gBACxC,MAAM,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,2BAA2B,KAAK,GAAG;aAC/E;SACF,CACR,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,uGAAuG;AACvG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AAEvG,MAAM,aAAa,GAAG,CAAC,WAAoC,EAAkC,EAAE,CAC7F,aAAa,CAAC,OAAO,CAAC,CAAC,GAAW,EAAkC,EAAE,CACpE,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAClD,CAAC,MAA+B,EAAkC,EAAE,CAClE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAa,EAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAC7F,CACF,CAAA;AAEH,MAAM,mBAAmB,GAAG,CAC1B,WAAoC,EACpC,QAA0C,EACd,EAAE,CAC9B,aAAa,CAAC,WAAW,CAAC;KACvB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAoB,EAAW,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CACpD;KACA,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAoB,EAAmB,EAAE,CAAC,CAAC;IACrD,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE;IACpD,MAAM,EACJ,oFAAoF;QACpF,sEAAsE;CACzE,CAAC,CACH,CAAA;AAEL,qGAAqG;AACrG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,YAAY,GAAW,qEAAqE,CAAA;AAElG,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,2DAA2D;AAC3D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AACpD,iGAAiG;AACjG,6FAA6F;AAC7F,mEAAmE;AACnE,MAAM,WAAW,GAAW,oCAAoC,CAAA;AAEhE,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,MAAM,aAAa,GAAW,KAAK,CAAA;AAEnC,mGAAmG;AACnG,wGAAwG;AACxG,+EAA+E;AAC/E,MAAM,SAAS,GAAW,MAAM,CAAA;AAEhC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAW,EAAE;IACpD,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAW,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACzD,MAAM,EAAE,GAAW,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,OAAO,EAAE,GAAG,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,WAAoC,EAA8B,EAAE,CAC9F,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;KAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAA4B,EAAW,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;KACzF,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAmB,EAAE,CAAC,CAAC;IAClE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;IAChC,MAAM,EACJ,OAAO,SAAS,kEAAkE;QAClF,4DAA4D;CAC/D,CAAC,CACH,CAAA;AAEL,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,0DAA0D;AAC1D,MAAM,aAAa,GAAW,cAAc,CAAA;AAE5C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,WAAmB,EAAW,EAAE,CACrE,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAW,SAAS,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAW,MAAM,CAAA;AAE1C,MAAM,kBAAkB,GAAG,CACzB,WAAoC,EACpC,cAAkC,EACN,EAAE;IAC9B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;SACrD,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAW,EAAE,CACtD,sBAAsB,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,cAAc,CAC7D;SACA,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAmB,EAAE,CAAC,CAAC;QAChE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;QAChC,MAAM,EACJ,OAAO,OAAO,+BAA+B,cAAc,KAAK;YAChE,yDAAyD;KAC5D,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,qGAAqG;AACrG,uGAAuG;AACvG,0FAA0F;AAC1F,EAAE;AACF,uGAAuG;AACvG,iGAAiG;AACjG,qGAAqG;AACrG,OAAO;AACP,MAAM,kBAAkB,GAAG,CAAC,WAAoC,EAA8B,EAAE;IAC9F,MAAM,QAAQ,GAA2B,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAuB,QAAQ,CAAC,eAAe,CAAC,CAAA;IAC7D,iGAAiG;IACjG,gGAAgG;IAChG,qGAAqG;IACrG,mGAAmG;IACnG,wEAAwE;IACxE,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5B,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAW,EAAE,CACtD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,OAAO,CACvF;SACA,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAmB,EAAE,CAAC,CAAC;QAChE,QAAQ,EAAE,gBAAgB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE;QACpE,MAAM,EACJ,OAAO,OAAO,kCAAkC,OAAO,8BAA8B;YACrF,2EAA2E;KAC9E,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CACzB,WAAoC,EACpC,QAA0C,EAC1C,QAA6B,EACD,EAAE;IAC9B,MAAM,QAAQ,GAA2B,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC1E,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CACrC,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAA8B,EAAE;QACzE,MAAM,KAAK,GAAuB,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACvB,CAAC,CAAC;oBACE;wBACE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;wBAChC,MAAM,EAAE,gEAAgE,OAAO,EAAE;qBAClF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAA;QACR,CAAC;QACD,OAAO,KAAK,KAAK,OAAO;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,gBAAgB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE;oBACpE,MAAM,EACJ,OAAO,KAAK,8BAA8B,OAAO,KAAK;wBACtD,mDAAmD;iBACtD;aACF,CAAA;IACP,CAAC,CACF,CAAA;AACH,CAAC,CAAA;AAyBD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,WAAoC,EACpC,MAA+B,EACH,EAAE,CAAC;IAC/B,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,sBAAsB,CAAC;IAClE,GAAG,YAAY,CACb,WAAW,EACX,iBAAiB,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACtD,CAAC,CACH;IACD,GAAG,0BAA0B,CAC3B,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,qBAAqB,CAC7B;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,WAAoC,EACpC,MAA4B,EACA,EAAE,CAAC;IAC/B,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpE,GAAG,kBAAkB,CAAC,WAAW,CAAC;IAClC,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;IACzD,GAAG,kBAAkB,CAAC,WAAW,CAAC;IAClC,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;CACrD,CAAA;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,WAAoC,EACpC,MAAqB,EACO,EAAE,CAAC;IAC/B,GAAG,4BAA4B,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,GAAG,+BAA+B,CAAC,WAAW,EAAE;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,qBAAqB,EAAE,oBAAoB,CAAC,WAAW,CAAC;KACzD,CAAC;CACH,CAAA"}