@standards-kit/conform 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/artifactregistry-QQWBMEQN.js +38 -0
- package/dist/artifactregistry-QQWBMEQN.js.map +1 -0
- package/dist/chunk-J5S6GRGW.js +314 -0
- package/dist/chunk-J5S6GRGW.js.map +1 -0
- package/dist/chunk-KHO6NIAI.js +1367 -0
- package/dist/chunk-KHO6NIAI.js.map +1 -0
- package/dist/chunk-M7G73Q6P.js +662 -0
- package/dist/chunk-M7G73Q6P.js.map +1 -0
- package/dist/chunk-P7TIZJ4C.js +85 -0
- package/dist/chunk-P7TIZJ4C.js.map +1 -0
- package/dist/chunk-RXA4FO7L.js +279 -0
- package/dist/chunk-RXA4FO7L.js.map +1 -0
- package/dist/cli.js +7432 -0
- package/dist/cli.js.map +1 -0
- package/dist/cloudrun-O36R23SH.js +31 -0
- package/dist/cloudrun-O36R23SH.js.map +1 -0
- package/dist/cloudwatch-KSZ4A256.js +56 -0
- package/dist/cloudwatch-KSZ4A256.js.map +1 -0
- package/dist/dynamodb-5KVESCVJ.js +51 -0
- package/dist/dynamodb-5KVESCVJ.js.map +1 -0
- package/dist/ec2-HKPE6GZV.js +151 -0
- package/dist/ec2-HKPE6GZV.js.map +1 -0
- package/dist/ecs-OS3NJZTA.js +141 -0
- package/dist/ecs-OS3NJZTA.js.map +1 -0
- package/dist/elasticache-7TCRHYYM.js +151 -0
- package/dist/elasticache-7TCRHYYM.js.map +1 -0
- package/dist/elb-PEDLXW5R.js +151 -0
- package/dist/elb-PEDLXW5R.js.map +1 -0
- package/dist/generate-D4MFMOHP.js +28 -0
- package/dist/generate-D4MFMOHP.js.map +1 -0
- package/dist/iam-7H5HFWVQ.js +96 -0
- package/dist/iam-7H5HFWVQ.js.map +1 -0
- package/dist/iam-DJI64AGK.js +39 -0
- package/dist/iam-DJI64AGK.js.map +1 -0
- package/dist/index.js +7980 -0
- package/dist/index.js.map +1 -0
- package/dist/infra-UXM5XQX3.js +566 -0
- package/dist/infra-UXM5XQX3.js.map +1 -0
- package/dist/lambda-NFB5UILT.js +60 -0
- package/dist/lambda-NFB5UILT.js.map +1 -0
- package/dist/manifest-7AIL2FK2.js +23 -0
- package/dist/manifest-7AIL2FK2.js.map +1 -0
- package/dist/mcp-O5O7XVFG.js +204 -0
- package/dist/mcp-O5O7XVFG.js.map +1 -0
- package/dist/rds-KLG5O5SI.js +151 -0
- package/dist/rds-KLG5O5SI.js.map +1 -0
- package/dist/registry-V65CC7IN.js +15 -0
- package/dist/registry-V65CC7IN.js.map +1 -0
- package/dist/s3-2DH7PRVR.js +49 -0
- package/dist/s3-2DH7PRVR.js.map +1 -0
- package/dist/scan-EELS42BP.js +593 -0
- package/dist/scan-EELS42BP.js.map +1 -0
- package/dist/secretmanager-RDL62EFW.js +31 -0
- package/dist/secretmanager-RDL62EFW.js.map +1 -0
- package/dist/secretsmanager-MOOIHLAO.js +50 -0
- package/dist/secretsmanager-MOOIHLAO.js.map +1 -0
- package/dist/sns-Y36LVTWA.js +50 -0
- package/dist/sns-Y36LVTWA.js.map +1 -0
- package/dist/sqs-RRS3GRHK.js +61 -0
- package/dist/sqs-RRS3GRHK.js.map +1 -0
- package/dist/src-KZRTG3EU.js +45 -0
- package/dist/src-KZRTG3EU.js.map +1 -0
- package/dist/standards-RXK5G4IG.js +37 -0
- package/dist/standards-RXK5G4IG.js.map +1 -0
- package/dist/sync-RLYBGYNY.js +877 -0
- package/dist/sync-RLYBGYNY.js.map +1 -0
- package/dist/validate-AABLVQJS.js +327 -0
- package/dist/validate-AABLVQJS.js.map +1 -0
- package/dist/validator-6PL5I5EC.js +156 -0
- package/dist/validator-6PL5I5EC.js.map +1 -0
- package/package.json +91 -0
|
@@ -0,0 +1,593 @@
|
|
|
1
|
+
import {
|
|
2
|
+
ExitCode
|
|
3
|
+
} from "./chunk-P7TIZJ4C.js";
|
|
4
|
+
import {
|
|
5
|
+
loadConfigAsync
|
|
6
|
+
} from "./chunk-KHO6NIAI.js";
|
|
7
|
+
|
|
8
|
+
// src/process/scan/index.ts
|
|
9
|
+
import chalk from "chalk";
|
|
10
|
+
|
|
11
|
+
// src/process/scan/scanner.ts
|
|
12
|
+
import { execa as execa2 } from "execa";
|
|
13
|
+
|
|
14
|
+
// src/process/scan/remote-fetcher.ts
|
|
15
|
+
import { execa } from "execa";
|
|
16
|
+
var RemoteFetcherError = class extends Error {
|
|
17
|
+
constructor(message, code) {
|
|
18
|
+
super(message);
|
|
19
|
+
this.code = code;
|
|
20
|
+
this.name = "RemoteFetcherError";
|
|
21
|
+
}
|
|
22
|
+
};
|
|
23
|
+
function parseRepoString(repo) {
|
|
24
|
+
const parts = repo.split("/");
|
|
25
|
+
if (parts.length !== 2 || !parts[0] || !parts[1]) {
|
|
26
|
+
throw new RemoteFetcherError(
|
|
27
|
+
`Invalid repository format: "${repo}". Expected "owner/repo" format.`,
|
|
28
|
+
"INVALID_REPO"
|
|
29
|
+
);
|
|
30
|
+
}
|
|
31
|
+
return { owner: parts[0], repo: parts[1] };
|
|
32
|
+
}
|
|
33
|
+
async function isGhAvailable() {
|
|
34
|
+
try {
|
|
35
|
+
await execa("gh", ["--version"]);
|
|
36
|
+
return true;
|
|
37
|
+
} catch {
|
|
38
|
+
return false;
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
async function verifyRepoAccess(repoInfo) {
|
|
42
|
+
try {
|
|
43
|
+
await execa("gh", ["api", `repos/${repoInfo.owner}/${repoInfo.repo}`]);
|
|
44
|
+
return true;
|
|
45
|
+
} catch (error) {
|
|
46
|
+
const errorMessage = error instanceof Error ? error.message : String(error);
|
|
47
|
+
if (errorMessage.includes("404") || errorMessage.includes("Not Found")) {
|
|
48
|
+
throw new RemoteFetcherError(
|
|
49
|
+
`Repository not found: ${repoInfo.owner}/${repoInfo.repo}`,
|
|
50
|
+
"NO_REPO"
|
|
51
|
+
);
|
|
52
|
+
}
|
|
53
|
+
if (errorMessage.includes("403") || errorMessage.includes("401")) {
|
|
54
|
+
throw new RemoteFetcherError(
|
|
55
|
+
`Cannot access repository: ${repoInfo.owner}/${repoInfo.repo}. Check your GITHUB_TOKEN permissions.`,
|
|
56
|
+
"NO_PERMISSION"
|
|
57
|
+
);
|
|
58
|
+
}
|
|
59
|
+
throw new RemoteFetcherError(
|
|
60
|
+
`Failed to verify repository access: ${errorMessage}`,
|
|
61
|
+
"API_ERROR"
|
|
62
|
+
);
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
async function checkRemoteFileExists(repoInfo, filePath) {
|
|
66
|
+
try {
|
|
67
|
+
await execa("gh", [
|
|
68
|
+
"api",
|
|
69
|
+
`repos/${repoInfo.owner}/${repoInfo.repo}/contents/${filePath}`,
|
|
70
|
+
"--silent"
|
|
71
|
+
]);
|
|
72
|
+
return true;
|
|
73
|
+
} catch {
|
|
74
|
+
return false;
|
|
75
|
+
}
|
|
76
|
+
}
|
|
77
|
+
async function checkRemoteFileWithAlternatives(repoInfo, config) {
|
|
78
|
+
const allPaths = [config.path, ...config.alternativePaths ?? []];
|
|
79
|
+
for (const path of allPaths) {
|
|
80
|
+
const exists = await checkRemoteFileExists(repoInfo, path);
|
|
81
|
+
if (exists) {
|
|
82
|
+
return { path: config.path, exists: true, checkedPaths: allPaths };
|
|
83
|
+
}
|
|
84
|
+
}
|
|
85
|
+
return { path: config.path, exists: false, checkedPaths: allPaths };
|
|
86
|
+
}
|
|
87
|
+
async function checkRemoteFiles(repoInfo, configs) {
|
|
88
|
+
const results = await Promise.all(
|
|
89
|
+
configs.map((config) => checkRemoteFileWithAlternatives(repoInfo, config))
|
|
90
|
+
);
|
|
91
|
+
return results;
|
|
92
|
+
}
|
|
93
|
+
var standardFileChecks = [
|
|
94
|
+
{
|
|
95
|
+
path: "CODEOWNERS",
|
|
96
|
+
alternativePaths: [".github/CODEOWNERS", "docs/CODEOWNERS"],
|
|
97
|
+
required: false,
|
|
98
|
+
description: "CODEOWNERS file for code review assignment"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
path: ".github/PULL_REQUEST_TEMPLATE.md",
|
|
102
|
+
alternativePaths: [
|
|
103
|
+
".github/pull_request_template.md",
|
|
104
|
+
"PULL_REQUEST_TEMPLATE.md",
|
|
105
|
+
"pull_request_template.md"
|
|
106
|
+
],
|
|
107
|
+
required: false,
|
|
108
|
+
description: "Pull request template"
|
|
109
|
+
},
|
|
110
|
+
{
|
|
111
|
+
path: "README.md",
|
|
112
|
+
alternativePaths: ["readme.md", "README"],
|
|
113
|
+
required: false,
|
|
114
|
+
description: "Repository README"
|
|
115
|
+
},
|
|
116
|
+
{
|
|
117
|
+
path: ".github/workflows",
|
|
118
|
+
required: false,
|
|
119
|
+
description: "GitHub Actions workflows directory"
|
|
120
|
+
}
|
|
121
|
+
];
|
|
122
|
+
|
|
123
|
+
// src/process/scan/validators.ts
|
|
124
|
+
function matchesBranch(patterns, branch) {
|
|
125
|
+
for (const pattern of patterns) {
|
|
126
|
+
const cleanPattern = pattern.replace(/^refs\/heads\//, "");
|
|
127
|
+
if (cleanPattern === branch) {
|
|
128
|
+
return true;
|
|
129
|
+
}
|
|
130
|
+
if (cleanPattern === "~DEFAULT_BRANCH" && branch === "main") {
|
|
131
|
+
return true;
|
|
132
|
+
}
|
|
133
|
+
if (cleanPattern === "~ALL") {
|
|
134
|
+
return true;
|
|
135
|
+
}
|
|
136
|
+
if (cleanPattern.includes("*")) {
|
|
137
|
+
const regex = new RegExp(`^${cleanPattern.replace(/\*/g, ".*")}$`);
|
|
138
|
+
if (regex.test(branch)) {
|
|
139
|
+
return true;
|
|
140
|
+
}
|
|
141
|
+
}
|
|
142
|
+
}
|
|
143
|
+
return false;
|
|
144
|
+
}
|
|
145
|
+
function findBranchRuleset(rulesets, branch) {
|
|
146
|
+
return rulesets.find(
|
|
147
|
+
(r) => r.target === "branch" && r.enforcement === "active" && matchesBranch(r.conditions?.ref_name?.include ?? [], branch)
|
|
148
|
+
);
|
|
149
|
+
}
|
|
150
|
+
function validateRulesets(rulesets, repoConfig) {
|
|
151
|
+
if (!repoConfig) {
|
|
152
|
+
return [];
|
|
153
|
+
}
|
|
154
|
+
const violations = [];
|
|
155
|
+
const rulesetConfig = repoConfig.ruleset;
|
|
156
|
+
const branch = rulesetConfig?.branch ?? "main";
|
|
157
|
+
const branchRuleset = findBranchRuleset(rulesets, branch);
|
|
158
|
+
if (repoConfig.require_branch_protection && !branchRuleset) {
|
|
159
|
+
violations.push({
|
|
160
|
+
rule: "process.repo.branch_protection",
|
|
161
|
+
tool: "scan",
|
|
162
|
+
message: `Branch '${branch}' does not have a branch protection ruleset`,
|
|
163
|
+
severity: "error"
|
|
164
|
+
});
|
|
165
|
+
}
|
|
166
|
+
if (branchRuleset && rulesetConfig) {
|
|
167
|
+
violations.push(...validateBranchRuleset(branchRuleset, rulesetConfig, branch));
|
|
168
|
+
}
|
|
169
|
+
if (repoConfig.tag_protection?.patterns?.length) {
|
|
170
|
+
violations.push(...validateTagProtection(rulesets, repoConfig.tag_protection));
|
|
171
|
+
}
|
|
172
|
+
return violations;
|
|
173
|
+
}
|
|
174
|
+
function validateBranchRuleset(ruleset, config, branch) {
|
|
175
|
+
if (!config) {
|
|
176
|
+
return [];
|
|
177
|
+
}
|
|
178
|
+
const violations = [];
|
|
179
|
+
const rules = ruleset.rules ?? [];
|
|
180
|
+
const prRule = rules.find((r) => r.type === "pull_request");
|
|
181
|
+
const statusRule = rules.find((r) => r.type === "required_status_checks");
|
|
182
|
+
violations.push(...validatePullRequestRule(prRule, config, branch));
|
|
183
|
+
violations.push(...validateStatusChecksRule(statusRule, config, branch));
|
|
184
|
+
violations.push(...validateSignedCommits(rules, config, branch));
|
|
185
|
+
violations.push(...validateBypassActors(ruleset.bypass_actors ?? [], config, branch));
|
|
186
|
+
return violations;
|
|
187
|
+
}
|
|
188
|
+
function validatePullRequestRule(prRule, config, branch) {
|
|
189
|
+
if (!config) {
|
|
190
|
+
return [];
|
|
191
|
+
}
|
|
192
|
+
const violations = [];
|
|
193
|
+
const params = prRule?.parameters;
|
|
194
|
+
if (config.required_reviews !== void 0) {
|
|
195
|
+
const actualReviews = params?.required_approving_review_count ?? 0;
|
|
196
|
+
if (actualReviews < config.required_reviews) {
|
|
197
|
+
violations.push({
|
|
198
|
+
rule: "process.repo.branch_protection.required_reviews",
|
|
199
|
+
tool: "scan",
|
|
200
|
+
message: `Branch '${branch}' requires ${actualReviews} reviews, expected at least ${config.required_reviews}`,
|
|
201
|
+
severity: "error"
|
|
202
|
+
});
|
|
203
|
+
}
|
|
204
|
+
}
|
|
205
|
+
if (config.dismiss_stale_reviews === true && !(params?.dismiss_stale_reviews_on_push ?? false)) {
|
|
206
|
+
violations.push({
|
|
207
|
+
rule: "process.repo.branch_protection.dismiss_stale_reviews",
|
|
208
|
+
tool: "scan",
|
|
209
|
+
message: `Branch '${branch}' does not dismiss stale reviews on new commits`,
|
|
210
|
+
severity: "error"
|
|
211
|
+
});
|
|
212
|
+
}
|
|
213
|
+
if (config.require_code_owner_reviews === true && !(params?.require_code_owner_review ?? false)) {
|
|
214
|
+
violations.push({
|
|
215
|
+
rule: "process.repo.branch_protection.require_code_owner_reviews",
|
|
216
|
+
tool: "scan",
|
|
217
|
+
message: `Branch '${branch}' does not require code owner reviews`,
|
|
218
|
+
severity: "error"
|
|
219
|
+
});
|
|
220
|
+
}
|
|
221
|
+
return violations;
|
|
222
|
+
}
|
|
223
|
+
function validateStatusChecksRule(statusRule, config, branch) {
|
|
224
|
+
if (!config) {
|
|
225
|
+
return [];
|
|
226
|
+
}
|
|
227
|
+
const violations = [];
|
|
228
|
+
const params = statusRule?.parameters;
|
|
229
|
+
if (config.require_status_checks && config.require_status_checks.length > 0) {
|
|
230
|
+
const actualChecks = params?.required_status_checks?.map((c) => c.context) ?? [];
|
|
231
|
+
const missingChecks = config.require_status_checks.filter(
|
|
232
|
+
(check) => !actualChecks.includes(check)
|
|
233
|
+
);
|
|
234
|
+
if (missingChecks.length > 0) {
|
|
235
|
+
violations.push({
|
|
236
|
+
rule: "process.repo.branch_protection.require_status_checks",
|
|
237
|
+
tool: "scan",
|
|
238
|
+
message: `Branch '${branch}' missing required status checks: ${missingChecks.join(", ")}`,
|
|
239
|
+
severity: "error"
|
|
240
|
+
});
|
|
241
|
+
}
|
|
242
|
+
}
|
|
243
|
+
if (config.require_branches_up_to_date === true && !(params?.strict_required_status_checks_policy ?? false)) {
|
|
244
|
+
violations.push({
|
|
245
|
+
rule: "process.repo.branch_protection.require_branches_up_to_date",
|
|
246
|
+
tool: "scan",
|
|
247
|
+
message: `Branch '${branch}' does not require branches to be up to date before merging`,
|
|
248
|
+
severity: "error"
|
|
249
|
+
});
|
|
250
|
+
}
|
|
251
|
+
return violations;
|
|
252
|
+
}
|
|
253
|
+
function validateSignedCommits(rules, config, branch) {
|
|
254
|
+
if (config?.require_signed_commits !== true) {
|
|
255
|
+
return [];
|
|
256
|
+
}
|
|
257
|
+
if (!rules.some((r) => r.type === "required_signatures")) {
|
|
258
|
+
return [
|
|
259
|
+
{
|
|
260
|
+
rule: "process.repo.branch_protection.require_signed_commits",
|
|
261
|
+
tool: "scan",
|
|
262
|
+
message: `Branch '${branch}' does not require signed commits`,
|
|
263
|
+
severity: "error"
|
|
264
|
+
}
|
|
265
|
+
];
|
|
266
|
+
}
|
|
267
|
+
return [];
|
|
268
|
+
}
|
|
269
|
+
function validateBypassActors(actualBypass, config, branch) {
|
|
270
|
+
if (config?.enforce_admins !== true || actualBypass.length === 0) {
|
|
271
|
+
return [];
|
|
272
|
+
}
|
|
273
|
+
return [
|
|
274
|
+
{
|
|
275
|
+
rule: "process.repo.branch_protection.enforce_admins",
|
|
276
|
+
tool: "scan",
|
|
277
|
+
message: `Branch '${branch}' has bypass actors configured but enforce_admins requires no bypasses`,
|
|
278
|
+
severity: "error"
|
|
279
|
+
}
|
|
280
|
+
];
|
|
281
|
+
}
|
|
282
|
+
function validateTagProtection(rulesets, tagConfig) {
|
|
283
|
+
if (!tagConfig?.patterns?.length) {
|
|
284
|
+
return [];
|
|
285
|
+
}
|
|
286
|
+
const violations = [];
|
|
287
|
+
const tagRuleset = rulesets.find((r) => r.target === "tag" && r.enforcement === "active");
|
|
288
|
+
if (!tagRuleset) {
|
|
289
|
+
return [
|
|
290
|
+
{
|
|
291
|
+
rule: "process.repo.tag_protection",
|
|
292
|
+
tool: "scan",
|
|
293
|
+
message: "No active tag protection ruleset found",
|
|
294
|
+
severity: "error"
|
|
295
|
+
}
|
|
296
|
+
];
|
|
297
|
+
}
|
|
298
|
+
violations.push(...validateTagPatterns(tagConfig.patterns, tagRuleset));
|
|
299
|
+
violations.push(...validateTagRules(tagConfig, tagRuleset.rules ?? []));
|
|
300
|
+
return violations;
|
|
301
|
+
}
|
|
302
|
+
function validateTagPatterns(expectedPatterns, tagRuleset) {
|
|
303
|
+
const expected = expectedPatterns.map((p) => `refs/tags/${p}`).sort();
|
|
304
|
+
const actual = [...tagRuleset.conditions?.ref_name?.include ?? []].sort();
|
|
305
|
+
if (expected.length === actual.length && expected.every((v, i) => v === actual[i])) {
|
|
306
|
+
return [];
|
|
307
|
+
}
|
|
308
|
+
const found = actual.map((p) => p.replace(/^refs\/tags\//, "")).join(", ");
|
|
309
|
+
return [
|
|
310
|
+
{
|
|
311
|
+
rule: "process.repo.tag_protection.patterns",
|
|
312
|
+
tool: "scan",
|
|
313
|
+
message: `Tag protection patterns mismatch: expected [${expectedPatterns.join(", ")}], found [${found}]`,
|
|
314
|
+
severity: "error"
|
|
315
|
+
}
|
|
316
|
+
];
|
|
317
|
+
}
|
|
318
|
+
function validateTagRules(tagConfig, rules) {
|
|
319
|
+
if (!tagConfig) {
|
|
320
|
+
return [];
|
|
321
|
+
}
|
|
322
|
+
const violations = [];
|
|
323
|
+
if (tagConfig.prevent_deletion !== false && !rules.some((r) => r.type === "deletion")) {
|
|
324
|
+
violations.push({
|
|
325
|
+
rule: "process.repo.tag_protection.prevent_deletion",
|
|
326
|
+
tool: "scan",
|
|
327
|
+
message: "Tag protection does not prevent deletion",
|
|
328
|
+
severity: "error"
|
|
329
|
+
});
|
|
330
|
+
}
|
|
331
|
+
if (tagConfig.prevent_update !== false && !rules.some((r) => r.type === "update")) {
|
|
332
|
+
violations.push({
|
|
333
|
+
rule: "process.repo.tag_protection.prevent_update",
|
|
334
|
+
tool: "scan",
|
|
335
|
+
message: "Tag protection does not prevent updates (force-push)",
|
|
336
|
+
severity: "error"
|
|
337
|
+
});
|
|
338
|
+
}
|
|
339
|
+
return violations;
|
|
340
|
+
}
|
|
341
|
+
|
|
342
|
+
// src/process/scan/scanner.ts
|
|
343
|
+
async function fetchRulesets(repoInfo) {
|
|
344
|
+
const result = await execa2("gh", ["api", `repos/${repoInfo.owner}/${repoInfo.repo}/rulesets`]);
|
|
345
|
+
return JSON.parse(result.stdout);
|
|
346
|
+
}
|
|
347
|
+
function createSkippedResult(name, rule, reason, duration) {
|
|
348
|
+
return { name, rule, passed: true, violations: [], skipped: true, skipReason: reason, duration };
|
|
349
|
+
}
|
|
350
|
+
function createErrorResult(name, rule, message, duration) {
|
|
351
|
+
return {
|
|
352
|
+
name,
|
|
353
|
+
rule,
|
|
354
|
+
passed: false,
|
|
355
|
+
violations: [{ rule, tool: "scan", message, severity: "error" }],
|
|
356
|
+
skipped: false,
|
|
357
|
+
duration
|
|
358
|
+
};
|
|
359
|
+
}
|
|
360
|
+
function handleRulesetError(error, repoConfig, elapsed) {
|
|
361
|
+
const msg = error instanceof Error ? error.message : String(error);
|
|
362
|
+
if (msg.includes("403") || msg.includes("Must have admin rights")) {
|
|
363
|
+
return createSkippedResult(
|
|
364
|
+
"Repository Settings",
|
|
365
|
+
"process.repo",
|
|
366
|
+
"Cannot check rulesets: insufficient permissions (requires admin access)",
|
|
367
|
+
elapsed()
|
|
368
|
+
);
|
|
369
|
+
}
|
|
370
|
+
if (msg.includes("404")) {
|
|
371
|
+
const violations = [];
|
|
372
|
+
if (repoConfig?.require_branch_protection) {
|
|
373
|
+
violations.push({
|
|
374
|
+
rule: "process.repo.branch_protection",
|
|
375
|
+
tool: "scan",
|
|
376
|
+
message: "No branch protection rulesets configured",
|
|
377
|
+
severity: "error"
|
|
378
|
+
});
|
|
379
|
+
}
|
|
380
|
+
return {
|
|
381
|
+
name: "Repository Settings",
|
|
382
|
+
rule: "process.repo",
|
|
383
|
+
passed: violations.length === 0,
|
|
384
|
+
violations,
|
|
385
|
+
skipped: false,
|
|
386
|
+
duration: elapsed()
|
|
387
|
+
};
|
|
388
|
+
}
|
|
389
|
+
return createErrorResult(
|
|
390
|
+
"Repository Settings",
|
|
391
|
+
"process.repo",
|
|
392
|
+
`Failed to check rulesets: ${msg}`,
|
|
393
|
+
elapsed()
|
|
394
|
+
);
|
|
395
|
+
}
|
|
396
|
+
async function checkRulesets(repoInfo, config) {
|
|
397
|
+
const startTime = Date.now();
|
|
398
|
+
const elapsed = () => Date.now() - startTime;
|
|
399
|
+
const repoConfig = config.process?.repo;
|
|
400
|
+
if (!repoConfig?.enabled) {
|
|
401
|
+
return createSkippedResult(
|
|
402
|
+
"Repository Settings",
|
|
403
|
+
"process.repo",
|
|
404
|
+
"Repository settings check not enabled in config",
|
|
405
|
+
elapsed()
|
|
406
|
+
);
|
|
407
|
+
}
|
|
408
|
+
try {
|
|
409
|
+
const rulesets = await fetchRulesets(repoInfo);
|
|
410
|
+
const violations = validateRulesets(rulesets, repoConfig);
|
|
411
|
+
return {
|
|
412
|
+
name: "Repository Settings",
|
|
413
|
+
rule: "process.repo",
|
|
414
|
+
passed: violations.length === 0,
|
|
415
|
+
violations,
|
|
416
|
+
skipped: false,
|
|
417
|
+
duration: elapsed()
|
|
418
|
+
};
|
|
419
|
+
} catch (error) {
|
|
420
|
+
return handleRulesetError(error, repoConfig, elapsed);
|
|
421
|
+
}
|
|
422
|
+
}
|
|
423
|
+
function buildFileChecks(config) {
|
|
424
|
+
const fileChecks = [];
|
|
425
|
+
if (config.process?.repo?.require_codeowners) {
|
|
426
|
+
fileChecks.push({
|
|
427
|
+
path: "CODEOWNERS",
|
|
428
|
+
alternativePaths: [".github/CODEOWNERS", "docs/CODEOWNERS"],
|
|
429
|
+
required: true,
|
|
430
|
+
description: "CODEOWNERS file for code review assignment"
|
|
431
|
+
});
|
|
432
|
+
}
|
|
433
|
+
fileChecks.push(
|
|
434
|
+
...standardFileChecks.filter((check) => !fileChecks.some((fc) => fc.path === check.path))
|
|
435
|
+
);
|
|
436
|
+
return fileChecks;
|
|
437
|
+
}
|
|
438
|
+
function fileResultsToViolations(results, fileChecks) {
|
|
439
|
+
const violations = [];
|
|
440
|
+
for (const result of results) {
|
|
441
|
+
const checkConfig = fileChecks.find((fc) => fc.path === result.path);
|
|
442
|
+
if (!result.exists && checkConfig?.required) {
|
|
443
|
+
violations.push({
|
|
444
|
+
rule: `process.scan.files.${result.path.replace(/[./]/g, "_")}`,
|
|
445
|
+
tool: "scan",
|
|
446
|
+
message: `Required file not found: ${result.path} (checked: ${result.checkedPaths.join(", ")})`,
|
|
447
|
+
severity: "error"
|
|
448
|
+
});
|
|
449
|
+
}
|
|
450
|
+
}
|
|
451
|
+
return violations;
|
|
452
|
+
}
|
|
453
|
+
async function checkFiles(repoInfo, config) {
|
|
454
|
+
const startTime = Date.now();
|
|
455
|
+
const elapsed = () => Date.now() - startTime;
|
|
456
|
+
const fileChecks = buildFileChecks(config);
|
|
457
|
+
if (fileChecks.length === 0) {
|
|
458
|
+
return createSkippedResult(
|
|
459
|
+
"Repository Files",
|
|
460
|
+
"process.scan.files",
|
|
461
|
+
"No file checks configured",
|
|
462
|
+
elapsed()
|
|
463
|
+
);
|
|
464
|
+
}
|
|
465
|
+
try {
|
|
466
|
+
const results = await checkRemoteFiles(repoInfo, fileChecks);
|
|
467
|
+
const violations = fileResultsToViolations(results, fileChecks);
|
|
468
|
+
return {
|
|
469
|
+
name: "Repository Files",
|
|
470
|
+
rule: "process.scan.files",
|
|
471
|
+
passed: violations.length === 0,
|
|
472
|
+
violations,
|
|
473
|
+
skipped: false,
|
|
474
|
+
duration: elapsed()
|
|
475
|
+
};
|
|
476
|
+
} catch (error) {
|
|
477
|
+
const msg = error instanceof Error ? error.message : String(error);
|
|
478
|
+
return createErrorResult(
|
|
479
|
+
"Repository Files",
|
|
480
|
+
"process.scan.files",
|
|
481
|
+
`Failed to check files: ${msg}`,
|
|
482
|
+
elapsed()
|
|
483
|
+
);
|
|
484
|
+
}
|
|
485
|
+
}
|
|
486
|
+
function aggregateResults(repoInfo, checks) {
|
|
487
|
+
const violations = checks.flatMap((c) => c.violations);
|
|
488
|
+
const passedChecks = checks.filter((c) => c.passed && !c.skipped).length;
|
|
489
|
+
const failedChecks = checks.filter((c) => !c.passed && !c.skipped).length;
|
|
490
|
+
const skippedChecks = checks.filter((c) => c.skipped).length;
|
|
491
|
+
return {
|
|
492
|
+
repoInfo,
|
|
493
|
+
checks,
|
|
494
|
+
violations,
|
|
495
|
+
passed: failedChecks === 0,
|
|
496
|
+
summary: { totalChecks: checks.length, passedChecks, failedChecks, skippedChecks }
|
|
497
|
+
};
|
|
498
|
+
}
|
|
499
|
+
async function scanRepository(repo, config) {
|
|
500
|
+
const repoInfo = parseRepoString(repo);
|
|
501
|
+
if (!await isGhAvailable()) {
|
|
502
|
+
throw new RemoteFetcherError(
|
|
503
|
+
"GitHub CLI (gh) not available. Install it from https://cli.github.com/",
|
|
504
|
+
"NO_GH"
|
|
505
|
+
);
|
|
506
|
+
}
|
|
507
|
+
await verifyRepoAccess(repoInfo);
|
|
508
|
+
const [rulesetsResult, filesResult] = await Promise.all([
|
|
509
|
+
checkRulesets(repoInfo, config),
|
|
510
|
+
checkFiles(repoInfo, config)
|
|
511
|
+
]);
|
|
512
|
+
return aggregateResults(repoInfo, [rulesetsResult, filesResult]);
|
|
513
|
+
}
|
|
514
|
+
async function validateProcess(options) {
|
|
515
|
+
const { loadConfigAsync: loadConfigAsync2 } = await import("./src-KZRTG3EU.js");
|
|
516
|
+
const { config } = await loadConfigAsync2(options.config);
|
|
517
|
+
const result = await scanRepository(options.repo, config);
|
|
518
|
+
const fs = await import("fs");
|
|
519
|
+
const path = await import("path");
|
|
520
|
+
const { fileURLToPath } = await import("url");
|
|
521
|
+
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
522
|
+
const packageJsonPath = path.resolve(__dirname, "..", "..", "..", "package.json");
|
|
523
|
+
const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
|
|
524
|
+
return {
|
|
525
|
+
version: packageJson.version,
|
|
526
|
+
repoInfo: result.repoInfo,
|
|
527
|
+
domain: "process",
|
|
528
|
+
checks: result.checks,
|
|
529
|
+
summary: {
|
|
530
|
+
totalChecks: result.summary.totalChecks,
|
|
531
|
+
passedChecks: result.summary.passedChecks,
|
|
532
|
+
failedChecks: result.summary.failedChecks,
|
|
533
|
+
totalViolations: result.violations.length,
|
|
534
|
+
exitCode: result.passed ? ExitCode.SUCCESS : ExitCode.VIOLATIONS_FOUND
|
|
535
|
+
}
|
|
536
|
+
};
|
|
537
|
+
}
|
|
538
|
+
|
|
539
|
+
// src/process/scan/index.ts
|
|
540
|
+
function formatScanText(result) {
|
|
541
|
+
const lines = [];
|
|
542
|
+
lines.push(`Repository: ${result.repoInfo.owner}/${result.repoInfo.repo}`);
|
|
543
|
+
lines.push("");
|
|
544
|
+
for (const check of result.checks) {
|
|
545
|
+
if (check.skipped) {
|
|
546
|
+
lines.push(chalk.yellow(`\u2298 ${check.name} (skipped: ${check.skipReason})`));
|
|
547
|
+
} else if (check.passed) {
|
|
548
|
+
lines.push(chalk.green(`\u2713 ${check.name}`));
|
|
549
|
+
} else {
|
|
550
|
+
lines.push(chalk.red(`\u2717 ${check.name}`));
|
|
551
|
+
for (const violation of check.violations) {
|
|
552
|
+
lines.push(chalk.red(` \u2022 ${violation.message}`));
|
|
553
|
+
}
|
|
554
|
+
}
|
|
555
|
+
}
|
|
556
|
+
lines.push("");
|
|
557
|
+
lines.push(
|
|
558
|
+
`Summary: ${result.summary.passedChecks} passed, ${result.summary.failedChecks} failed, ${result.summary.skippedChecks} skipped`
|
|
559
|
+
);
|
|
560
|
+
return lines.join("\n");
|
|
561
|
+
}
|
|
562
|
+
function formatScanJson(result) {
|
|
563
|
+
return JSON.stringify(result, null, 2);
|
|
564
|
+
}
|
|
565
|
+
async function runScan(options) {
|
|
566
|
+
try {
|
|
567
|
+
const { config } = await loadConfigAsync(options.config);
|
|
568
|
+
const result = await scanRepository(options.repo, config);
|
|
569
|
+
const output = options.format === "json" ? formatScanJson(result) : formatScanText(result);
|
|
570
|
+
process.stdout.write(`${output}
|
|
571
|
+
`);
|
|
572
|
+
process.exit(result.passed ? ExitCode.SUCCESS : ExitCode.VIOLATIONS_FOUND);
|
|
573
|
+
} catch (error) {
|
|
574
|
+
if (options.format === "json") {
|
|
575
|
+
const errorObj = {
|
|
576
|
+
error: true,
|
|
577
|
+
message: error instanceof Error ? error.message : String(error),
|
|
578
|
+
code: error.code ?? "UNKNOWN"
|
|
579
|
+
};
|
|
580
|
+
process.stdout.write(`${JSON.stringify(errorObj, null, 2)}
|
|
581
|
+
`);
|
|
582
|
+
} else {
|
|
583
|
+
console.error(chalk.red(`Error: ${error instanceof Error ? error.message : String(error)}`));
|
|
584
|
+
}
|
|
585
|
+
process.exit(ExitCode.RUNTIME_ERROR);
|
|
586
|
+
}
|
|
587
|
+
}
|
|
588
|
+
export {
|
|
589
|
+
runScan,
|
|
590
|
+
scanRepository,
|
|
591
|
+
validateProcess
|
|
592
|
+
};
|
|
593
|
+
//# sourceMappingURL=scan-EELS42BP.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"sources":["../src/process/scan/index.ts","../src/process/scan/scanner.ts","../src/process/scan/remote-fetcher.ts","../src/process/scan/validators.ts"],"sourcesContent":["import chalk from \"chalk\";\n\nimport { loadConfigAsync } from \"@standards-kit/core\";\nimport { ExitCode } from \"@standards-kit/core\";\nimport { scanRepository } from \"./scanner.js\";\nimport { type ScanOptions, type ScanResult } from \"./types.js\";\n\n// Re-export public API types\nexport {\n type RemoteRepoInfo,\n type ScanOptions,\n type ScanResult,\n type ValidateProcessOptions,\n type ValidateProcessResult,\n} from \"./types.js\";\n\n// Re-export scanner\nexport { scanRepository, validateProcess } from \"./scanner.js\";\n\n/** Format scan result as text */\nfunction formatScanText(result: ScanResult): string {\n const lines: string[] = [];\n\n lines.push(`Repository: ${result.repoInfo.owner}/${result.repoInfo.repo}`);\n lines.push(\"\");\n\n for (const check of result.checks) {\n if (check.skipped) {\n lines.push(chalk.yellow(`⊘ ${check.name} (skipped: ${check.skipReason})`));\n } else if (check.passed) {\n lines.push(chalk.green(`✓ ${check.name}`));\n } else {\n lines.push(chalk.red(`✗ ${check.name}`));\n for (const violation of check.violations) {\n lines.push(chalk.red(` • ${violation.message}`));\n }\n }\n }\n\n lines.push(\"\");\n lines.push(\n `Summary: ${result.summary.passedChecks} passed, ` +\n `${result.summary.failedChecks} failed, ` +\n `${result.summary.skippedChecks} skipped`\n );\n\n return lines.join(\"\\n\");\n}\n\n/** Format scan result as JSON */\nfunction formatScanJson(result: ScanResult): string {\n return JSON.stringify(result, null, 2);\n}\n\n/** Run the scan command */\nexport async function runScan(options: ScanOptions): Promise<void> {\n try {\n const { config } = await loadConfigAsync(options.config);\n const result = await scanRepository(options.repo, config);\n\n const output = options.format === \"json\" ? formatScanJson(result) : formatScanText(result);\n\n process.stdout.write(`${output}\\n`);\n process.exit(result.passed ? ExitCode.SUCCESS : ExitCode.VIOLATIONS_FOUND);\n } catch (error) {\n if (options.format === \"json\") {\n const errorObj = {\n error: true,\n message: error instanceof Error ? error.message : String(error),\n code: (error as { code?: string }).code ?? \"UNKNOWN\",\n };\n process.stdout.write(`${JSON.stringify(errorObj, null, 2)}\\n`);\n } else {\n console.error(chalk.red(`Error: ${error instanceof Error ? error.message : String(error)}`));\n }\n process.exit(ExitCode.RUNTIME_ERROR);\n }\n}\n","import { execa } from \"execa\";\n\nimport { type Config } from \"@standards-kit/core\";\nimport { type CheckResult, ExitCode, type Violation } from \"@standards-kit/core\";\nimport {\n checkRemoteFiles,\n isGhAvailable,\n parseRepoString,\n RemoteFetcherError,\n standardFileChecks,\n verifyRepoAccess,\n} from \"./remote-fetcher.js\";\nimport {\n type FileCheckConfig,\n type RemoteRepoInfo,\n type ScanResult,\n type ValidateProcessOptions,\n type ValidateProcessResult,\n} from \"./types.js\";\nimport { type RulesetResponse, validateRulesets } from \"./validators.js\";\n\n/** Fetch rulesets from GitHub API */\nasync function fetchRulesets(repoInfo: RemoteRepoInfo): Promise<RulesetResponse[]> {\n const result = await execa(\"gh\", [\"api\", `repos/${repoInfo.owner}/${repoInfo.repo}/rulesets`]);\n return JSON.parse(result.stdout) as RulesetResponse[];\n}\n\n/** Create a skipped check result */\nfunction createSkippedResult(\n name: string,\n rule: string,\n reason: string,\n duration: number\n): CheckResult {\n return { name, rule, passed: true, violations: [], skipped: true, skipReason: reason, duration };\n}\n\n/** Create an error check result */\nfunction createErrorResult(\n name: string,\n rule: string,\n message: string,\n duration: number\n): CheckResult {\n return {\n name,\n rule,\n passed: false,\n violations: [{ rule, tool: \"scan\", message, severity: \"error\" }],\n skipped: false,\n duration,\n };\n}\n\n/** Handle API errors for ruleset fetching */\nfunction handleRulesetError(\n error: unknown,\n repoConfig: NonNullable<Config[\"process\"]>[\"repo\"],\n elapsed: () => number\n): CheckResult {\n const msg = error instanceof Error ? error.message : String(error);\n\n if (msg.includes(\"403\") || msg.includes(\"Must have admin rights\")) {\n return createSkippedResult(\n \"Repository Settings\",\n \"process.repo\",\n \"Cannot check rulesets: insufficient permissions (requires admin access)\",\n elapsed()\n );\n }\n\n if (msg.includes(\"404\")) {\n const violations: Violation[] = [];\n if (repoConfig?.require_branch_protection) {\n violations.push({\n rule: \"process.repo.branch_protection\",\n tool: \"scan\",\n message: \"No branch protection rulesets configured\",\n severity: \"error\",\n });\n }\n return {\n name: \"Repository Settings\",\n rule: \"process.repo\",\n passed: violations.length === 0,\n violations,\n skipped: false,\n duration: elapsed(),\n };\n }\n\n return createErrorResult(\n \"Repository Settings\",\n \"process.repo\",\n `Failed to check rulesets: ${msg}`,\n elapsed()\n );\n}\n\n/** Check repository rulesets and branch protection */\nasync function checkRulesets(repoInfo: RemoteRepoInfo, config: Config): Promise<CheckResult> {\n const startTime = Date.now();\n const elapsed = (): number => Date.now() - startTime;\n const repoConfig = config.process?.repo;\n\n if (!repoConfig?.enabled) {\n return createSkippedResult(\n \"Repository Settings\",\n \"process.repo\",\n \"Repository settings check not enabled in config\",\n elapsed()\n );\n }\n\n try {\n const rulesets = await fetchRulesets(repoInfo);\n const violations = validateRulesets(rulesets, repoConfig);\n\n return {\n name: \"Repository Settings\",\n rule: \"process.repo\",\n passed: violations.length === 0,\n violations,\n skipped: false,\n duration: elapsed(),\n };\n } catch (error) {\n return handleRulesetError(error, repoConfig, elapsed);\n }\n}\n\n/** Build file checks configuration from config */\nfunction buildFileChecks(config: Config): FileCheckConfig[] {\n const fileChecks: FileCheckConfig[] = [];\n\n if (config.process?.repo?.require_codeowners) {\n fileChecks.push({\n path: \"CODEOWNERS\",\n alternativePaths: [\".github/CODEOWNERS\", \"docs/CODEOWNERS\"],\n required: true,\n description: \"CODEOWNERS file for code review assignment\",\n });\n }\n\n fileChecks.push(\n ...standardFileChecks.filter((check) => !fileChecks.some((fc) => fc.path === check.path))\n );\n\n return fileChecks;\n}\n\n/** Convert file check results to violations */\nfunction fileResultsToViolations(\n results: { path: string; exists: boolean; checkedPaths: string[] }[],\n fileChecks: FileCheckConfig[]\n): Violation[] {\n const violations: Violation[] = [];\n\n for (const result of results) {\n const checkConfig = fileChecks.find((fc) => fc.path === result.path);\n if (!result.exists && checkConfig?.required) {\n violations.push({\n rule: `process.scan.files.${result.path.replace(/[./]/g, \"_\")}`,\n tool: \"scan\",\n message: `Required file not found: ${result.path} (checked: ${result.checkedPaths.join(\", \")})`,\n severity: \"error\",\n });\n }\n }\n\n return violations;\n}\n\n/** Check remote files for existence */\nasync function checkFiles(repoInfo: RemoteRepoInfo, config: Config): Promise<CheckResult> {\n const startTime = Date.now();\n const elapsed = (): number => Date.now() - startTime;\n const fileChecks = buildFileChecks(config);\n\n if (fileChecks.length === 0) {\n return createSkippedResult(\n \"Repository Files\",\n \"process.scan.files\",\n \"No file checks configured\",\n elapsed()\n );\n }\n\n try {\n const results = await checkRemoteFiles(repoInfo, fileChecks);\n const violations = fileResultsToViolations(results, fileChecks);\n\n return {\n name: \"Repository Files\",\n rule: \"process.scan.files\",\n passed: violations.length === 0,\n violations,\n skipped: false,\n duration: elapsed(),\n };\n } catch (error) {\n const msg = error instanceof Error ? error.message : String(error);\n return createErrorResult(\n \"Repository Files\",\n \"process.scan.files\",\n `Failed to check files: ${msg}`,\n elapsed()\n );\n }\n}\n\n/** Aggregate check results into scan result */\nfunction aggregateResults(repoInfo: RemoteRepoInfo, checks: CheckResult[]): ScanResult {\n const violations = checks.flatMap((c) => c.violations);\n const passedChecks = checks.filter((c) => c.passed && !c.skipped).length;\n const failedChecks = checks.filter((c) => !c.passed && !c.skipped).length;\n const skippedChecks = checks.filter((c) => c.skipped).length;\n\n return {\n repoInfo,\n checks,\n violations,\n passed: failedChecks === 0,\n summary: { totalChecks: checks.length, passedChecks, failedChecks, skippedChecks },\n };\n}\n\n/** Run all remote scans for a repository */\nexport async function scanRepository(repo: string, config: Config): Promise<ScanResult> {\n const repoInfo = parseRepoString(repo);\n\n if (!(await isGhAvailable())) {\n throw new RemoteFetcherError(\n \"GitHub CLI (gh) not available. Install it from https://cli.github.com/\",\n \"NO_GH\"\n );\n }\n\n await verifyRepoAccess(repoInfo);\n\n const [rulesetsResult, filesResult] = await Promise.all([\n checkRulesets(repoInfo, config),\n checkFiles(repoInfo, config),\n ]);\n\n return aggregateResults(repoInfo, [rulesetsResult, filesResult]);\n}\n\n/** Programmatic API for validating remote process checks */\nexport async function validateProcess(\n options: ValidateProcessOptions\n): Promise<ValidateProcessResult> {\n const { loadConfigAsync } = await import(\"@standards-kit/core\");\n const { config } = await loadConfigAsync(options.config);\n const result = await scanRepository(options.repo, config);\n\n const fs = await import(\"node:fs\");\n const path = await import(\"node:path\");\n const { fileURLToPath } = await import(\"node:url\");\n\n const __dirname = path.dirname(fileURLToPath(import.meta.url));\n const packageJsonPath = path.resolve(__dirname, \"..\", \"..\", \"..\", \"package.json\");\n const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, \"utf-8\")) as { version: string };\n\n return {\n version: packageJson.version,\n repoInfo: result.repoInfo,\n domain: \"process\",\n checks: result.checks,\n summary: {\n totalChecks: result.summary.totalChecks,\n passedChecks: result.summary.passedChecks,\n failedChecks: result.summary.failedChecks,\n totalViolations: result.violations.length,\n exitCode: result.passed ? ExitCode.SUCCESS : ExitCode.VIOLATIONS_FOUND,\n },\n };\n}\n","import { execa } from \"execa\";\n\nimport { type FileCheckConfig, type FileCheckResult, type RemoteRepoInfo } from \"./types.js\";\n\n/** Error thrown when remote fetcher encounters an issue */\nexport class RemoteFetcherError extends Error {\n constructor(\n message: string,\n public readonly code: \"NO_GH\" | \"NO_REPO\" | \"NO_PERMISSION\" | \"API_ERROR\" | \"INVALID_REPO\"\n ) {\n super(message);\n this.name = \"RemoteFetcherError\";\n }\n}\n\n/** Parse owner/repo string into RemoteRepoInfo */\nexport function parseRepoString(repo: string): RemoteRepoInfo {\n const parts = repo.split(\"/\");\n if (parts.length !== 2 || !parts[0] || !parts[1]) {\n throw new RemoteFetcherError(\n `Invalid repository format: \"${repo}\". Expected \"owner/repo\" format.`,\n \"INVALID_REPO\"\n );\n }\n return { owner: parts[0], repo: parts[1] };\n}\n\n/** Check if gh CLI is available */\nexport async function isGhAvailable(): Promise<boolean> {\n try {\n await execa(\"gh\", [\"--version\"]);\n return true;\n } catch {\n return false;\n }\n}\n\n/** Verify the repository exists and user has access */\nexport async function verifyRepoAccess(repoInfo: RemoteRepoInfo): Promise<boolean> {\n try {\n await execa(\"gh\", [\"api\", `repos/${repoInfo.owner}/${repoInfo.repo}`]);\n return true;\n } catch (error) {\n const errorMessage = error instanceof Error ? error.message : String(error);\n\n if (errorMessage.includes(\"404\") || errorMessage.includes(\"Not Found\")) {\n throw new RemoteFetcherError(\n `Repository not found: ${repoInfo.owner}/${repoInfo.repo}`,\n \"NO_REPO\"\n );\n }\n\n if (errorMessage.includes(\"403\") || errorMessage.includes(\"401\")) {\n throw new RemoteFetcherError(\n `Cannot access repository: ${repoInfo.owner}/${repoInfo.repo}. Check your GITHUB_TOKEN permissions.`,\n \"NO_PERMISSION\"\n );\n }\n\n throw new RemoteFetcherError(\n `Failed to verify repository access: ${errorMessage}`,\n \"API_ERROR\"\n );\n }\n}\n\n/** Check if a file exists in the remote repository via GitHub Contents API */\nexport async function checkRemoteFileExists(\n repoInfo: RemoteRepoInfo,\n filePath: string\n): Promise<boolean> {\n try {\n await execa(\"gh\", [\n \"api\",\n `repos/${repoInfo.owner}/${repoInfo.repo}/contents/${filePath}`,\n \"--silent\",\n ]);\n return true;\n } catch {\n // File doesn't exist or no access - both return false\n return false;\n }\n}\n\n/** Check multiple alternative paths for a file */\nasync function checkRemoteFileWithAlternatives(\n repoInfo: RemoteRepoInfo,\n config: FileCheckConfig\n): Promise<FileCheckResult> {\n const allPaths = [config.path, ...(config.alternativePaths ?? [])];\n\n for (const path of allPaths) {\n // Sequential check needed - stop on first match\n const exists = await checkRemoteFileExists(repoInfo, path);\n if (exists) {\n return { path: config.path, exists: true, checkedPaths: allPaths };\n }\n }\n\n return { path: config.path, exists: false, checkedPaths: allPaths };\n}\n\n/** Batch check multiple files in a repository */\nexport async function checkRemoteFiles(\n repoInfo: RemoteRepoInfo,\n configs: FileCheckConfig[]\n): Promise<FileCheckResult[]> {\n // Run checks in parallel for efficiency\n const results = await Promise.all(\n configs.map((config) => checkRemoteFileWithAlternatives(repoInfo, config))\n );\n return results;\n}\n\n/** Standard file checks for remote validation */\nexport const standardFileChecks: FileCheckConfig[] = [\n {\n path: \"CODEOWNERS\",\n alternativePaths: [\".github/CODEOWNERS\", \"docs/CODEOWNERS\"],\n required: false,\n description: \"CODEOWNERS file for code review assignment\",\n },\n {\n path: \".github/PULL_REQUEST_TEMPLATE.md\",\n alternativePaths: [\n \".github/pull_request_template.md\",\n \"PULL_REQUEST_TEMPLATE.md\",\n \"pull_request_template.md\",\n ],\n required: false,\n description: \"Pull request template\",\n },\n {\n path: \"README.md\",\n alternativePaths: [\"readme.md\", \"README\"],\n required: false,\n description: \"Repository README\",\n },\n {\n path: \".github/workflows\",\n required: false,\n description: \"GitHub Actions workflows directory\",\n },\n];\n","import { type Config } from \"@standards-kit/core\";\nimport { type Violation } from \"@standards-kit/core\";\n\n/** GitHub Ruleset response types */\ninterface RulesetBypassActor {\n actor_id: number | null;\n actor_type: string;\n bypass_mode: string;\n}\n\ninterface RulesetRule {\n type: string;\n parameters?: {\n required_approving_review_count?: number;\n dismiss_stale_reviews_on_push?: boolean;\n require_code_owner_review?: boolean;\n required_status_checks?: { context: string }[];\n strict_required_status_checks_policy?: boolean;\n };\n}\n\nexport interface RulesetResponse {\n id: number;\n name: string;\n target: string;\n enforcement: string;\n conditions?: { ref_name?: { include?: string[]; exclude?: string[] } };\n bypass_actors?: RulesetBypassActor[];\n rules?: RulesetRule[];\n}\n\ntype RulesetConfig = NonNullable<NonNullable<Config[\"process\"]>[\"repo\"]>[\"ruleset\"];\ntype TagProtectionConfig = NonNullable<NonNullable<Config[\"process\"]>[\"repo\"]>[\"tag_protection\"];\n\n/** Check if branch matches any of the include patterns */\nfunction matchesBranch(patterns: string[], branch: string): boolean {\n for (const pattern of patterns) {\n const cleanPattern = pattern.replace(/^refs\\/heads\\//, \"\");\n if (cleanPattern === branch) {\n return true;\n }\n if (cleanPattern === \"~DEFAULT_BRANCH\" && branch === \"main\") {\n return true;\n }\n if (cleanPattern === \"~ALL\") {\n return true;\n }\n if (cleanPattern.includes(\"*\")) {\n const regex = new RegExp(`^${cleanPattern.replace(/\\*/g, \".*\")}$`);\n if (regex.test(branch)) {\n return true;\n }\n }\n }\n return false;\n}\n\n/** Find branch ruleset matching the target branch */\nfunction findBranchRuleset(\n rulesets: RulesetResponse[],\n branch: string\n): RulesetResponse | undefined {\n return rulesets.find(\n (r) =>\n r.target === \"branch\" &&\n r.enforcement === \"active\" &&\n matchesBranch(r.conditions?.ref_name?.include ?? [], branch)\n );\n}\n\n/** Validate rulesets against config */\n// eslint-disable-next-line complexity\nexport function validateRulesets(\n rulesets: RulesetResponse[],\n repoConfig: NonNullable<Config[\"process\"]>[\"repo\"]\n): Violation[] {\n if (!repoConfig) {\n return [];\n }\n\n const violations: Violation[] = [];\n const rulesetConfig = repoConfig.ruleset;\n const branch = rulesetConfig?.branch ?? \"main\";\n const branchRuleset = findBranchRuleset(rulesets, branch);\n\n if (repoConfig.require_branch_protection && !branchRuleset) {\n violations.push({\n rule: \"process.repo.branch_protection\",\n tool: \"scan\",\n message: `Branch '${branch}' does not have a branch protection ruleset`,\n severity: \"error\",\n });\n }\n\n if (branchRuleset && rulesetConfig) {\n violations.push(...validateBranchRuleset(branchRuleset, rulesetConfig, branch));\n }\n\n if (repoConfig.tag_protection?.patterns?.length) {\n violations.push(...validateTagProtection(rulesets, repoConfig.tag_protection));\n }\n\n return violations;\n}\n\n/** Validate branch ruleset settings against config */\nfunction validateBranchRuleset(\n ruleset: RulesetResponse,\n config: RulesetConfig,\n branch: string\n): Violation[] {\n if (!config) {\n return [];\n }\n\n const violations: Violation[] = [];\n const rules = ruleset.rules ?? [];\n const prRule = rules.find((r) => r.type === \"pull_request\");\n const statusRule = rules.find((r) => r.type === \"required_status_checks\");\n\n violations.push(...validatePullRequestRule(prRule, config, branch));\n violations.push(...validateStatusChecksRule(statusRule, config, branch));\n violations.push(...validateSignedCommits(rules, config, branch));\n violations.push(...validateBypassActors(ruleset.bypass_actors ?? [], config, branch));\n\n return violations;\n}\n\n/** Validate pull request rule settings */\n// eslint-disable-next-line complexity\nfunction validatePullRequestRule(\n prRule: RulesetRule | undefined,\n config: RulesetConfig,\n branch: string\n): Violation[] {\n if (!config) {\n return [];\n }\n\n const violations: Violation[] = [];\n const params = prRule?.parameters;\n\n if (config.required_reviews !== undefined) {\n const actualReviews = params?.required_approving_review_count ?? 0;\n if (actualReviews < config.required_reviews) {\n violations.push({\n rule: \"process.repo.branch_protection.required_reviews\",\n tool: \"scan\",\n message: `Branch '${branch}' requires ${actualReviews} reviews, expected at least ${config.required_reviews}`,\n severity: \"error\",\n });\n }\n }\n\n if (config.dismiss_stale_reviews === true && !(params?.dismiss_stale_reviews_on_push ?? false)) {\n violations.push({\n rule: \"process.repo.branch_protection.dismiss_stale_reviews\",\n tool: \"scan\",\n message: `Branch '${branch}' does not dismiss stale reviews on new commits`,\n severity: \"error\",\n });\n }\n\n if (config.require_code_owner_reviews === true && !(params?.require_code_owner_review ?? false)) {\n violations.push({\n rule: \"process.repo.branch_protection.require_code_owner_reviews\",\n tool: \"scan\",\n message: `Branch '${branch}' does not require code owner reviews`,\n severity: \"error\",\n });\n }\n\n return violations;\n}\n\n/** Validate status checks rule settings */\n// eslint-disable-next-line complexity\nfunction validateStatusChecksRule(\n statusRule: RulesetRule | undefined,\n config: RulesetConfig,\n branch: string\n): Violation[] {\n if (!config) {\n return [];\n }\n\n const violations: Violation[] = [];\n const params = statusRule?.parameters;\n\n if (config.require_status_checks && config.require_status_checks.length > 0) {\n const actualChecks = params?.required_status_checks?.map((c) => c.context) ?? [];\n const missingChecks = config.require_status_checks.filter(\n (check) => !actualChecks.includes(check)\n );\n if (missingChecks.length > 0) {\n violations.push({\n rule: \"process.repo.branch_protection.require_status_checks\",\n tool: \"scan\",\n message: `Branch '${branch}' missing required status checks: ${missingChecks.join(\", \")}`,\n severity: \"error\",\n });\n }\n }\n\n if (\n config.require_branches_up_to_date === true &&\n !(params?.strict_required_status_checks_policy ?? false)\n ) {\n violations.push({\n rule: \"process.repo.branch_protection.require_branches_up_to_date\",\n tool: \"scan\",\n message: `Branch '${branch}' does not require branches to be up to date before merging`,\n severity: \"error\",\n });\n }\n\n return violations;\n}\n\n/** Validate signed commits requirement */\nfunction validateSignedCommits(\n rules: RulesetRule[],\n config: RulesetConfig,\n branch: string\n): Violation[] {\n if (config?.require_signed_commits !== true) {\n return [];\n }\n\n if (!rules.some((r) => r.type === \"required_signatures\")) {\n return [\n {\n rule: \"process.repo.branch_protection.require_signed_commits\",\n tool: \"scan\",\n message: `Branch '${branch}' does not require signed commits`,\n severity: \"error\",\n },\n ];\n }\n\n return [];\n}\n\n/** Validate bypass actors configuration */\nfunction validateBypassActors(\n actualBypass: RulesetBypassActor[],\n config: RulesetConfig,\n branch: string\n): Violation[] {\n if (config?.enforce_admins !== true || actualBypass.length === 0) {\n return [];\n }\n\n return [\n {\n rule: \"process.repo.branch_protection.enforce_admins\",\n tool: \"scan\",\n message: `Branch '${branch}' has bypass actors configured but enforce_admins requires no bypasses`,\n severity: \"error\",\n },\n ];\n}\n\n/** Validate tag protection rulesets */\nfunction validateTagProtection(\n rulesets: RulesetResponse[],\n tagConfig: TagProtectionConfig\n): Violation[] {\n if (!tagConfig?.patterns?.length) {\n return [];\n }\n\n const violations: Violation[] = [];\n const tagRuleset = rulesets.find((r) => r.target === \"tag\" && r.enforcement === \"active\");\n\n if (!tagRuleset) {\n return [\n {\n rule: \"process.repo.tag_protection\",\n tool: \"scan\",\n message: \"No active tag protection ruleset found\",\n severity: \"error\",\n },\n ];\n }\n\n violations.push(...validateTagPatterns(tagConfig.patterns, tagRuleset));\n violations.push(...validateTagRules(tagConfig, tagRuleset.rules ?? []));\n\n return violations;\n}\n\n/** Validate tag patterns match */\nfunction validateTagPatterns(expectedPatterns: string[], tagRuleset: RulesetResponse): Violation[] {\n const expected = expectedPatterns.map((p) => `refs/tags/${p}`).sort();\n const actual = [...(tagRuleset.conditions?.ref_name?.include ?? [])].sort();\n\n if (expected.length === actual.length && expected.every((v, i) => v === actual[i])) {\n return [];\n }\n\n const found = actual.map((p) => p.replace(/^refs\\/tags\\//, \"\")).join(\", \");\n return [\n {\n rule: \"process.repo.tag_protection.patterns\",\n tool: \"scan\",\n message: `Tag protection patterns mismatch: expected [${expectedPatterns.join(\", \")}], found [${found}]`,\n severity: \"error\",\n },\n ];\n}\n\n/** Validate tag protection rules */\nfunction validateTagRules(tagConfig: TagProtectionConfig, rules: RulesetRule[]): Violation[] {\n if (!tagConfig) {\n return [];\n }\n\n const violations: Violation[] = [];\n\n if (tagConfig.prevent_deletion !== false && !rules.some((r) => r.type === \"deletion\")) {\n violations.push({\n rule: \"process.repo.tag_protection.prevent_deletion\",\n tool: \"scan\",\n message: \"Tag protection does not prevent deletion\",\n severity: \"error\",\n });\n }\n\n if (tagConfig.prevent_update !== false && !rules.some((r) => r.type === \"update\")) {\n violations.push({\n rule: \"process.repo.tag_protection.prevent_update\",\n tool: \"scan\",\n message: \"Tag protection does not prevent updates (force-push)\",\n severity: \"error\",\n });\n }\n\n return violations;\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,WAAW;;;ACAlB,SAAS,SAAAA,cAAa;;;ACAtB,SAAS,aAAa;AAKf,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YACE,SACgB,MAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,gBAAgB,MAA8B;AAC5D,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;AAChD,UAAM,IAAI;AAAA,MACR,+BAA+B,IAAI;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,OAAO,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE;AAC3C;AAGA,eAAsB,gBAAkC;AACtD,MAAI;AACF,UAAM,MAAM,MAAM,CAAC,WAAW,CAAC;AAC/B,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,iBAAiB,UAA4C;AACjF,MAAI;AACF,UAAM,MAAM,MAAM,CAAC,OAAO,SAAS,SAAS,KAAK,IAAI,SAAS,IAAI,EAAE,CAAC;AACrE,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAE1E,QAAI,aAAa,SAAS,KAAK,KAAK,aAAa,SAAS,WAAW,GAAG;AACtE,YAAM,IAAI;AAAA,QACR,yBAAyB,SAAS,KAAK,IAAI,SAAS,IAAI;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,SAAS,KAAK,KAAK,aAAa,SAAS,KAAK,GAAG;AAChE,YAAM,IAAI;AAAA,QACR,6BAA6B,SAAS,KAAK,IAAI,SAAS,IAAI;AAAA,QAC5D;AAAA,MACF;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,uCAAuC,YAAY;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACF;AAGA,eAAsB,sBACpB,UACA,UACkB;AAClB,MAAI;AACF,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,SAAS,SAAS,KAAK,IAAI,SAAS,IAAI,aAAa,QAAQ;AAAA,MAC7D;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,gCACb,UACA,QAC0B;AAC1B,QAAM,WAAW,CAAC,OAAO,MAAM,GAAI,OAAO,oBAAoB,CAAC,CAAE;AAEjE,aAAW,QAAQ,UAAU;AAE3B,UAAM,SAAS,MAAM,sBAAsB,UAAU,IAAI;AACzD,QAAI,QAAQ;AACV,aAAO,EAAE,MAAM,OAAO,MAAM,QAAQ,MAAM,cAAc,SAAS;AAAA,IACnE;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,OAAO,MAAM,QAAQ,OAAO,cAAc,SAAS;AACpE;AAGA,eAAsB,iBACpB,UACA,SAC4B;AAE5B,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,QAAQ,IAAI,CAAC,WAAW,gCAAgC,UAAU,MAAM,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAGO,IAAM,qBAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,kBAAkB,CAAC,sBAAsB,iBAAiB;AAAA,IAC1D,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,kBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,kBAAkB,CAAC,aAAa,QAAQ;AAAA,IACxC,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AACF;;;AC5GA,SAAS,cAAc,UAAoB,QAAyB;AAClE,aAAW,WAAW,UAAU;AAC9B,UAAM,eAAe,QAAQ,QAAQ,kBAAkB,EAAE;AACzD,QAAI,iBAAiB,QAAQ;AAC3B,aAAO;AAAA,IACT;AACA,QAAI,iBAAiB,qBAAqB,WAAW,QAAQ;AAC3D,aAAO;AAAA,IACT;AACA,QAAI,iBAAiB,QAAQ;AAC3B,aAAO;AAAA,IACT;AACA,QAAI,aAAa,SAAS,GAAG,GAAG;AAC9B,YAAM,QAAQ,IAAI,OAAO,IAAI,aAAa,QAAQ,OAAO,IAAI,CAAC,GAAG;AACjE,UAAI,MAAM,KAAK,MAAM,GAAG;AACtB,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,kBACP,UACA,QAC6B;AAC7B,SAAO,SAAS;AAAA,IACd,CAAC,MACC,EAAE,WAAW,YACb,EAAE,gBAAgB,YAClB,cAAc,EAAE,YAAY,UAAU,WAAW,CAAC,GAAG,MAAM;AAAA,EAC/D;AACF;AAIO,SAAS,iBACd,UACA,YACa;AACb,MAAI,CAAC,YAAY;AACf,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,aAA0B,CAAC;AACjC,QAAM,gBAAgB,WAAW;AACjC,QAAM,SAAS,eAAe,UAAU;AACxC,QAAM,gBAAgB,kBAAkB,UAAU,MAAM;AAExD,MAAI,WAAW,6BAA6B,CAAC,eAAe;AAC1D,eAAW,KAAK;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,WAAW,MAAM;AAAA,MAC1B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,MAAI,iBAAiB,eAAe;AAClC,eAAW,KAAK,GAAG,sBAAsB,eAAe,eAAe,MAAM,CAAC;AAAA,EAChF;AAEA,MAAI,WAAW,gBAAgB,UAAU,QAAQ;AAC/C,eAAW,KAAK,GAAG,sBAAsB,UAAU,WAAW,cAAc,CAAC;AAAA,EAC/E;AAEA,SAAO;AACT;AAGA,SAAS,sBACP,SACA,QACA,QACa;AACb,MAAI,CAAC,QAAQ;AACX,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,aAA0B,CAAC;AACjC,QAAM,QAAQ,QAAQ,SAAS,CAAC;AAChC,QAAM,SAAS,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;AAC1D,QAAM,aAAa,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,wBAAwB;AAExE,aAAW,KAAK,GAAG,wBAAwB,QAAQ,QAAQ,MAAM,CAAC;AAClE,aAAW,KAAK,GAAG,yBAAyB,YAAY,QAAQ,MAAM,CAAC;AACvE,aAAW,KAAK,GAAG,sBAAsB,OAAO,QAAQ,MAAM,CAAC;AAC/D,aAAW,KAAK,GAAG,qBAAqB,QAAQ,iBAAiB,CAAC,GAAG,QAAQ,MAAM,CAAC;AAEpF,SAAO;AACT;AAIA,SAAS,wBACP,QACA,QACA,QACa;AACb,MAAI,CAAC,QAAQ;AACX,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,aAA0B,CAAC;AACjC,QAAM,SAAS,QAAQ;AAEvB,MAAI,OAAO,qBAAqB,QAAW;AACzC,UAAM,gBAAgB,QAAQ,mCAAmC;AACjE,QAAI,gBAAgB,OAAO,kBAAkB;AAC3C,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,WAAW,MAAM,cAAc,aAAa,+BAA+B,OAAO,gBAAgB;AAAA,QAC3G,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,OAAO,0BAA0B,QAAQ,EAAE,QAAQ,iCAAiC,QAAQ;AAC9F,eAAW,KAAK;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,WAAW,MAAM;AAAA,MAC1B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,+BAA+B,QAAQ,EAAE,QAAQ,6BAA6B,QAAQ;AAC/F,eAAW,KAAK;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,WAAW,MAAM;AAAA,MAC1B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAIA,SAAS,yBACP,YACA,QACA,QACa;AACb,MAAI,CAAC,QAAQ;AACX,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,aAA0B,CAAC;AACjC,QAAM,SAAS,YAAY;AAE3B,MAAI,OAAO,yBAAyB,OAAO,sBAAsB,SAAS,GAAG;AAC3E,UAAM,eAAe,QAAQ,wBAAwB,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC;AAC/E,UAAM,gBAAgB,OAAO,sBAAsB;AAAA,MACjD,CAAC,UAAU,CAAC,aAAa,SAAS,KAAK;AAAA,IACzC;AACA,QAAI,cAAc,SAAS,GAAG;AAC5B,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,WAAW,MAAM,qCAAqC,cAAc,KAAK,IAAI,CAAC;AAAA,QACvF,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MACE,OAAO,gCAAgC,QACvC,EAAE,QAAQ,wCAAwC,QAClD;AACA,eAAW,KAAK;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,WAAW,MAAM;AAAA,MAC1B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAGA,SAAS,sBACP,OACA,QACA,QACa;AACb,MAAI,QAAQ,2BAA2B,MAAM;AAC3C,WAAO,CAAC;AAAA,EACV;AAEA,MAAI,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,qBAAqB,GAAG;AACxD,WAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,WAAW,MAAM;AAAA,QAC1B,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,SAAO,CAAC;AACV;AAGA,SAAS,qBACP,cACA,QACA,QACa;AACb,MAAI,QAAQ,mBAAmB,QAAQ,aAAa,WAAW,GAAG;AAChE,WAAO,CAAC;AAAA,EACV;AAEA,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,WAAW,MAAM;AAAA,MAC1B,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAGA,SAAS,sBACP,UACA,WACa;AACb,MAAI,CAAC,WAAW,UAAU,QAAQ;AAChC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,aAA0B,CAAC;AACjC,QAAM,aAAa,SAAS,KAAK,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE,gBAAgB,QAAQ;AAExF,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,MACL;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,aAAW,KAAK,GAAG,oBAAoB,UAAU,UAAU,UAAU,CAAC;AACtE,aAAW,KAAK,GAAG,iBAAiB,WAAW,WAAW,SAAS,CAAC,CAAC,CAAC;AAEtE,SAAO;AACT;AAGA,SAAS,oBAAoB,kBAA4B,YAA0C;AACjG,QAAM,WAAW,iBAAiB,IAAI,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK;AACpE,QAAM,SAAS,CAAC,GAAI,WAAW,YAAY,UAAU,WAAW,CAAC,CAAE,EAAE,KAAK;AAE1E,MAAI,SAAS,WAAW,OAAO,UAAU,SAAS,MAAM,CAAC,GAAG,MAAM,MAAM,OAAO,CAAC,CAAC,GAAG;AAClF,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,iBAAiB,EAAE,CAAC,EAAE,KAAK,IAAI;AACzE,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,+CAA+C,iBAAiB,KAAK,IAAI,CAAC,aAAa,KAAK;AAAA,MACrG,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAGA,SAAS,iBAAiB,WAAgC,OAAmC;AAC3F,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,aAA0B,CAAC;AAEjC,MAAI,UAAU,qBAAqB,SAAS,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU,GAAG;AACrF,eAAW,KAAK;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,MAAI,UAAU,mBAAmB,SAAS,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ,GAAG;AACjF,eAAW,KAAK;AAAA,MACd,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;;;AF7TA,eAAe,cAAc,UAAsD;AACjF,QAAM,SAAS,MAAMC,OAAM,MAAM,CAAC,OAAO,SAAS,SAAS,KAAK,IAAI,SAAS,IAAI,WAAW,CAAC;AAC7F,SAAO,KAAK,MAAM,OAAO,MAAM;AACjC;AAGA,SAAS,oBACP,MACA,MACA,QACA,UACa;AACb,SAAO,EAAE,MAAM,MAAM,QAAQ,MAAM,YAAY,CAAC,GAAG,SAAS,MAAM,YAAY,QAAQ,SAAS;AACjG;AAGA,SAAS,kBACP,MACA,MACA,SACA,UACa;AACb,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,YAAY,CAAC,EAAE,MAAM,MAAM,QAAQ,SAAS,UAAU,QAAQ,CAAC;AAAA,IAC/D,SAAS;AAAA,IACT;AAAA,EACF;AACF;AAGA,SAAS,mBACP,OACA,YACA,SACa;AACb,QAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAEjE,MAAI,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,wBAAwB,GAAG;AACjE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,KAAK,GAAG;AACvB,UAAM,aAA0B,CAAC;AACjC,QAAI,YAAY,2BAA2B;AACzC,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,QACT,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,WAAW,WAAW;AAAA,MAC9B;AAAA,MACA,SAAS;AAAA,MACT,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,6BAA6B,GAAG;AAAA,IAChC,QAAQ;AAAA,EACV;AACF;AAGA,eAAe,cAAc,UAA0B,QAAsC;AAC3F,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,UAAU,MAAc,KAAK,IAAI,IAAI;AAC3C,QAAM,aAAa,OAAO,SAAS;AAEnC,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,cAAc,QAAQ;AAC7C,UAAM,aAAa,iBAAiB,UAAU,UAAU;AAExD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,WAAW,WAAW;AAAA,MAC9B;AAAA,MACA,SAAS;AAAA,MACT,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,WAAO,mBAAmB,OAAO,YAAY,OAAO;AAAA,EACtD;AACF;AAGA,SAAS,gBAAgB,QAAmC;AAC1D,QAAM,aAAgC,CAAC;AAEvC,MAAI,OAAO,SAAS,MAAM,oBAAoB;AAC5C,eAAW,KAAK;AAAA,MACd,MAAM;AAAA,MACN,kBAAkB,CAAC,sBAAsB,iBAAiB;AAAA,MAC1D,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAEA,aAAW;AAAA,IACT,GAAG,mBAAmB,OAAO,CAAC,UAAU,CAAC,WAAW,KAAK,CAAC,OAAO,GAAG,SAAS,MAAM,IAAI,CAAC;AAAA,EAC1F;AAEA,SAAO;AACT;AAGA,SAAS,wBACP,SACA,YACa;AACb,QAAM,aAA0B,CAAC;AAEjC,aAAW,UAAU,SAAS;AAC5B,UAAM,cAAc,WAAW,KAAK,CAAC,OAAO,GAAG,SAAS,OAAO,IAAI;AACnE,QAAI,CAAC,OAAO,UAAU,aAAa,UAAU;AAC3C,iBAAW,KAAK;AAAA,QACd,MAAM,sBAAsB,OAAO,KAAK,QAAQ,SAAS,GAAG,CAAC;AAAA,QAC7D,MAAM;AAAA,QACN,SAAS,4BAA4B,OAAO,IAAI,cAAc,OAAO,aAAa,KAAK,IAAI,CAAC;AAAA,QAC5F,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAGA,eAAe,WAAW,UAA0B,QAAsC;AACxF,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAM,UAAU,MAAc,KAAK,IAAI,IAAI;AAC3C,QAAM,aAAa,gBAAgB,MAAM;AAEzC,MAAI,WAAW,WAAW,GAAG;AAC3B,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,iBAAiB,UAAU,UAAU;AAC3D,UAAM,aAAa,wBAAwB,SAAS,UAAU;AAE9D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,WAAW,WAAW;AAAA,MAC9B;AAAA,MACA,SAAS;AAAA,MACT,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,UAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,0BAA0B,GAAG;AAAA,MAC7B,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAGA,SAAS,iBAAiB,UAA0B,QAAmC;AACrF,QAAM,aAAa,OAAO,QAAQ,CAAC,MAAM,EAAE,UAAU;AACrD,QAAM,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE;AAClE,QAAM,eAAe,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE;AACnE,QAAM,gBAAgB,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AAEtD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,iBAAiB;AAAA,IACzB,SAAS,EAAE,aAAa,OAAO,QAAQ,cAAc,cAAc,cAAc;AAAA,EACnF;AACF;AAGA,eAAsB,eAAe,MAAc,QAAqC;AACtF,QAAM,WAAW,gBAAgB,IAAI;AAErC,MAAI,CAAE,MAAM,cAAc,GAAI;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,QAAQ;AAE/B,QAAM,CAAC,gBAAgB,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,IACtD,cAAc,UAAU,MAAM;AAAA,IAC9B,WAAW,UAAU,MAAM;AAAA,EAC7B,CAAC;AAED,SAAO,iBAAiB,UAAU,CAAC,gBAAgB,WAAW,CAAC;AACjE;AAGA,eAAsB,gBACpB,SACgC;AAChC,QAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,mBAAqB;AAC9D,QAAM,EAAE,OAAO,IAAI,MAAMA,iBAAgB,QAAQ,MAAM;AACvD,QAAM,SAAS,MAAM,eAAe,QAAQ,MAAM,MAAM;AAExD,QAAM,KAAK,MAAM,OAAO,IAAS;AACjC,QAAM,OAAO,MAAM,OAAO,MAAW;AACrC,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,KAAU;AAEjD,QAAM,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AAC7D,QAAM,kBAAkB,KAAK,QAAQ,WAAW,MAAM,MAAM,MAAM,cAAc;AAChF,QAAM,cAAc,KAAK,MAAM,GAAG,aAAa,iBAAiB,OAAO,CAAC;AAExE,SAAO;AAAA,IACL,SAAS,YAAY;AAAA,IACrB,UAAU,OAAO;AAAA,IACjB,QAAQ;AAAA,IACR,QAAQ,OAAO;AAAA,IACf,SAAS;AAAA,MACP,aAAa,OAAO,QAAQ;AAAA,MAC5B,cAAc,OAAO,QAAQ;AAAA,MAC7B,cAAc,OAAO,QAAQ;AAAA,MAC7B,iBAAiB,OAAO,WAAW;AAAA,MACnC,UAAU,OAAO,SAAS,SAAS,UAAU,SAAS;AAAA,IACxD;AAAA,EACF;AACF;;;ADjQA,SAAS,eAAe,QAA4B;AAClD,QAAM,QAAkB,CAAC;AAEzB,QAAM,KAAK,eAAe,OAAO,SAAS,KAAK,IAAI,OAAO,SAAS,IAAI,EAAE;AACzE,QAAM,KAAK,EAAE;AAEb,aAAW,SAAS,OAAO,QAAQ;AACjC,QAAI,MAAM,SAAS;AACjB,YAAM,KAAK,MAAM,OAAO,UAAK,MAAM,IAAI,cAAc,MAAM,UAAU,GAAG,CAAC;AAAA,IAC3E,WAAW,MAAM,QAAQ;AACvB,YAAM,KAAK,MAAM,MAAM,UAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,KAAK,MAAM,IAAI,UAAK,MAAM,IAAI,EAAE,CAAC;AACvC,iBAAW,aAAa,MAAM,YAAY;AACxC,cAAM,KAAK,MAAM,IAAI,YAAO,UAAU,OAAO,EAAE,CAAC;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK,EAAE;AACb,QAAM;AAAA,IACJ,YAAY,OAAO,QAAQ,YAAY,YAClC,OAAO,QAAQ,YAAY,YAC3B,OAAO,QAAQ,aAAa;AAAA,EACnC;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAGA,SAAS,eAAe,QAA4B;AAClD,SAAO,KAAK,UAAU,QAAQ,MAAM,CAAC;AACvC;AAGA,eAAsB,QAAQ,SAAqC;AACjE,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,gBAAgB,QAAQ,MAAM;AACvD,UAAM,SAAS,MAAM,eAAe,QAAQ,MAAM,MAAM;AAExD,UAAM,SAAS,QAAQ,WAAW,SAAS,eAAe,MAAM,IAAI,eAAe,MAAM;AAEzF,YAAQ,OAAO,MAAM,GAAG,MAAM;AAAA,CAAI;AAClC,YAAQ,KAAK,OAAO,SAAS,SAAS,UAAU,SAAS,gBAAgB;AAAA,EAC3E,SAAS,OAAO;AACd,QAAI,QAAQ,WAAW,QAAQ;AAC7B,YAAM,WAAW;AAAA,QACf,OAAO;AAAA,QACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,MAAO,MAA4B,QAAQ;AAAA,MAC7C;AACA,cAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,IAC/D,OAAO;AACL,cAAQ,MAAM,MAAM,IAAI,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE,CAAC;AAAA,IAC7F;AACA,YAAQ,KAAK,SAAS,aAAa;AAAA,EACrC;AACF;","names":["execa","execa","loadConfigAsync"]}
|