@stll/oxlint-config 1.3.0 → 1.4.0

package/dist/toolchain-dependabot.cjs

@@ -0,0 +1,455 @@
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+const require_toolchain_inputs = require("./toolchain-inputs.cjs");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let smol_toml = require("smol-toml");
+let yaml = require("yaml");
+let picomatch = require("picomatch");
+picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
+//#region src/toolchain-images.ts
+/** Docker Hub spellings accepted by the shared runtime policy. */
+const dockerHubRegistries = [
+	"docker.io",
+	"index.docker.io",
+	"registry-1.docker.io"
+];
+/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */
+const ownedDockerImageAliases = (images) => {
+	const aliases = /* @__PURE__ */ new Set();
+	for (const image of images) for (const repository of [image, `library/${image}`]) {
+		aliases.add(repository);
+		for (const registry of dockerHubRegistries) aliases.add(`${registry}/${repository}`);
+	}
+	return [...aliases].sort();
+};
+/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */
+const canonicalDockerRuntime = (image) => {
+	const registry = dockerHubRegistries.find((entry) => image.toLowerCase().startsWith(`${entry}/`));
+	return (registry === void 0 ? image : image.slice(registry.length + 1)).replace(/^library\//i, "");
+};
+/** Preserve Rust release identity across official Debian slim and Alpine variants. */
+const rustImageVersion = (tag) => tag.replace(/-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/, "");
+//#endregion
+//#region src/toolchain-dependabot.ts
+const dependabotRules = ["dependabot-policy"];
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const strings = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+const sameStrings = (value, expected) => {
+	if (!strings(value) || value.length !== expected.length) return false;
+	const sortedExpected = [...expected].sort();
+	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
+};
+const pinnedVersionUpdateTypes = [
+	"version-update:semver-major",
+	"version-update:semver-minor",
+	"version-update:semver-patch"
+];
+const versionOnlyIgnore = (entry) => record(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], pinnedVersionUpdateTypes);
+const directoryOf = (file) => {
+	const directory = node_path.default.posix.dirname(file);
+	return directory === "." ? "/" : `/${directory}`;
+};
+const workspaceManifests = {
+	npm: "package.json",
+	cargo: "Cargo.toml",
+	uv: "pyproject.toml"
+};
+const workspaceTable = (parsed, ecosystem) => {
+	switch (ecosystem) {
+		case "npm": return parsed["workspaces"];
+		case "cargo": return parsed["workspace"];
+		case "uv": {
+			const tool = parsed["tool"];
+			const uv = record(tool) ? tool["uv"] : void 0;
+			return record(uv) ? uv["workspace"] : void 0;
+		}
+		default: throw new Error("unknown workspace ecosystem", { cause: ecosystem });
+	}
+};
+const declaresJavascriptInstallation = (text) => {
+	try {
+		const manifest = JSON.parse(text ?? "");
+		if (!record(manifest)) return false;
+		if (typeof manifest["packageManager"] === "string") return true;
+		return [
+			"dependencies",
+			"devDependencies",
+			"optionalDependencies",
+			"peerDependencies"
+		].some((field) => {
+			const dependencies = manifest[field];
+			return record(dependencies) && Object.keys(dependencies).length > 0;
+		});
+	} catch {
+		return false;
+	}
+};
+/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */
+const workspaceRoots = (files, ecosystem) => {
+	const manifests = Object.keys(files).filter((file) => node_path.default.posix.basename(file) === workspaceManifests[ecosystem] || ecosystem === "npm" && node_path.default.posix.basename(file) === "pnpm-workspace.yaml");
+	const workspaces = /* @__PURE__ */ new Map();
+	const npmWorkspaceErrors = /* @__PURE__ */ new Map();
+	for (const file of manifests) {
+		if (ecosystem === "npm") {
+			const directory = node_path.default.posix.dirname(file);
+			const workspaceFile = node_path.default.posix.join(directory, "pnpm-workspace.yaml");
+			const text = files[workspaceFile];
+			if (text !== void 0) {
+				try {
+					const document = (0, yaml.parseDocument)(text);
+					if (document.errors.length > 0) throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);
+					const parsed = document.toJS({ maxAliasCount: 100 });
+					if (!record(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
+					const patterns = parsed["packages"] ?? [];
+					if (!strings(patterns)) throw new Error(`${workspaceFile}:1: pnpm packages must be a string array`);
+					workspaces.set(directory, patterns.map((pattern) => pattern.startsWith("!") ? `!${node_path.default.posix.normalize(pattern.slice(1))}` : node_path.default.posix.normalize(pattern)));
+				} catch (error) {
+					npmWorkspaceErrors.set(directory, error instanceof Error ? error : new Error(String(error)));
+				}
+				continue;
+			}
+		}
+		try {
+			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : (0, smol_toml.parse)(files[file] ?? "");
+			if (!record(parsed)) continue;
+			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
+			const value = workspaceTable(parsed, ecosystem);
+			const patterns = record(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
+			const members = ecosystem === "cargo" && record(value) && patterns === void 0 ? [] : patterns;
+			if (strings(members)) {
+				const excluded = ecosystem !== "npm" && record(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
+				workspaces.set(node_path.default.posix.dirname(file), [...members, ...excluded]);
+			}
+		} catch {}
+	}
+	const implicitCargoMembers = /* @__PURE__ */ new Map();
+	const declaredMember = (root, patterns, directory) => {
+		const relative = node_path.default.posix.relative(root, directory);
+		if (relative === "" || relative === ".." || relative.startsWith("../")) return false;
+		return require_toolchain_inputs.workspaceContains({
+			directory: root,
+			file: node_path.default.posix.join(directory, "package.json"),
+			patterns,
+			rootMembership: "patterns"
+		});
+	};
+	const installable = /* @__PURE__ */ new Set(["."]);
+	if (ecosystem === "npm") {
+		for (const file of manifests) {
+			const directory = node_path.default.posix.dirname(file);
+			if (declaresJavascriptInstallation(files[node_path.default.posix.join(directory, "package.json")]) || require_toolchain_inputs.javascriptDependencyLockfiles.some((name) => files[node_path.default.posix.join(directory, name)] !== void 0)) installable.add(directory);
+		}
+		let changed = true;
+		while (changed) {
+			changed = false;
+			for (const [root, patterns] of workspaces) {
+				if (!installable.has(root)) {
+					if (![...installable].some((directory) => declaredMember(root, patterns, directory))) continue;
+					installable.add(root);
+					changed = true;
+				}
+				for (const file of manifests) {
+					const directory = node_path.default.posix.dirname(file);
+					if (installable.has(directory) || !declaredMember(root, patterns, directory)) continue;
+					installable.add(directory);
+					changed = true;
+				}
+			}
+		}
+	}
+	if (ecosystem === "npm") {
+		for (const [directory, error] of npmWorkspaceErrors) if (installable.has(directory)) throw error;
+	}
+	if (ecosystem === "cargo") for (const [root, patterns] of workspaces) {
+		const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
+		const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
+		const memberDirectories = /* @__PURE__ */ new Set([root]);
+		for (const file of manifests) {
+			const directory = node_path.default.posix.dirname(file);
+			const relative = node_path.default.posix.relative(root, directory);
+			if (includes.some((pattern) => picomatch.default.isMatch(relative, pattern)) && !excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)))) memberDirectories.add(directory);
+		}
+		for (const directory of memberDirectories) try {
+			const parsed = (0, smol_toml.parse)(files[node_path.default.posix.join(directory, "Cargo.toml")] ?? "");
+			const workspace = (0, smol_toml.parse)(files[node_path.default.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
+			const inherited = record(workspace) ? workspace["dependencies"] : void 0;
+			const dependencyOwners = [parsed];
+			const targets = parsed["target"];
+			if (record(targets)) {
+				for (const target of Object.values(targets)) if (record(target)) dependencyOwners.push(target);
+			}
+			for (const owner of dependencyOwners) for (const key of [
+				"dependencies",
+				"dev-dependencies",
+				"build-dependencies"
+			]) {
+				const dependencies = owner[key];
+				if (!record(dependencies)) continue;
+				for (const [name, dependency] of Object.entries(dependencies)) {
+					if (!record(dependency)) continue;
+					const isInherited = dependency["workspace"] === true;
+					const resolved = isInherited && record(inherited) ? inherited[name] : dependency;
+					if (!record(resolved) || typeof resolved["path"] !== "string") continue;
+					if (node_path.default.posix.isAbsolute(resolved["path"]) || /\\|\$|^[A-Za-z]:/.test(resolved["path"])) continue;
+					const target = node_path.default.posix.normalize(node_path.default.posix.join(isInherited ? root : directory, resolved["path"]));
+					const relative = node_path.default.posix.relative(root, target);
+					if (relative.startsWith("../") || relative === ".." || files[node_path.default.posix.join(target, "Cargo.toml")] === void 0 || excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)))) continue;
+					memberDirectories.add(target);
+				}
+			}
+		} catch {}
+		implicitCargoMembers.set(root, memberDirectories);
+	}
+	return manifests.filter((file) => ecosystem !== "npm" || installable.has(node_path.default.posix.dirname(file))).filter((file) => {
+		const directory = node_path.default.posix.dirname(file);
+		return ![...workspaces].some(([root, patterns]) => {
+			if (ecosystem === "npm" && !installable.has(root)) return false;
+			const relative = node_path.default.posix.relative(root, directory);
+			if (relative === "" || relative.startsWith("../")) return false;
+			const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
+			const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
+			return (implicitCargoMembers.get(root)?.has(directory) === true || (ecosystem === "npm" ? declaredMember(root, patterns, directory) : includes.some((pattern) => picomatch.default.isMatch(relative, pattern)))) && !excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)));
+		});
+	}).map(directoryOf).filter((directory, index, values) => values.indexOf(directory) === index);
+};
+const javascriptEcosystem = (directory, files) => {
+	let root = directory === "/" ? "." : directory.slice(1);
+	for (;;) {
+		if (files[node_path.default.posix.join(root, "bun.lock")] !== void 0) return "bun";
+		try {
+			const manifest = JSON.parse(files[node_path.default.posix.join(root, "package.json")] ?? "{}");
+			if (record(manifest) && typeof manifest["packageManager"] === "string") return manifest["packageManager"].startsWith("bun@") ? "bun" : "npm";
+		} catch {}
+		for (const name of require_toolchain_inputs.javascriptDependencyLockfiles) if (files[node_path.default.posix.join(root, name)] !== void 0) return "npm";
+		if (root === ".") return "npm";
+		root = node_path.default.posix.dirname(root);
+	}
+};
+const pythonEcosystem = (file, files) => {
+	const manifestKind = require_toolchain_inputs.pythonDependencyManifestKind(file);
+	if (manifestKind === "pipfile" || manifestKind === "pipfile-lock" || manifestKind === "setup") return "pip";
+	const root = node_path.default.posix.dirname(file);
+	if (files[node_path.default.posix.join(root, "uv.lock")] !== void 0 || files[node_path.default.posix.join(root, "uv.toml")] !== void 0) return "uv";
+	const pyproject = files[node_path.default.posix.join(root, "pyproject.toml")];
+	if (pyproject !== void 0) try {
+		const tool = (0, smol_toml.parse)(pyproject)["tool"];
+		if (record(tool) && record(tool["uv"])) return "uv";
+	} catch {}
+	return "pip";
+};
+const ecosystemRoots = (files) => {
+	const roots = /* @__PURE__ */ new Map();
+	const requireRoot = (ecosystem, directory) => {
+		const directories = roots.get(ecosystem) ?? /* @__PURE__ */ new Set();
+		directories.add(directory);
+		roots.set(ecosystem, directories);
+	};
+	for (const directory of workspaceRoots(files, "npm")) requireRoot(javascriptEcosystem(directory, files), directory);
+	for (const directory of workspaceRoots(files, "cargo")) requireRoot("cargo", directory);
+	for (const directory of workspaceRoots(files, "uv")) {
+		const root = directory === "/" ? "." : directory.slice(1);
+		requireRoot(pythonEcosystem(node_path.default.posix.join(root, "pyproject.toml"), files), directory);
+	}
+	for (const file of Object.keys(files)) {
+		if (require_toolchain_inputs.isDependabotGithubActionsPath(file)) requireRoot("github-actions", "/");
+		const name = node_path.default.posix.basename(file);
+		const manifestEcosystem = require_toolchain_inputs.dependabotManifestEcosystem(file);
+		if (manifestEcosystem !== void 0) requireRoot(manifestEcosystem, directoryOf(file));
+		if (require_toolchain_inputs.isDockerDefinitionPath(file)) requireRoot("docker", directoryOf(file));
+		if (require_toolchain_inputs.isComposeDefinitionPath(file) || require_toolchain_inputs.isKubernetesDefinitionPath(file)) for (const document of (0, yaml.parseAllDocuments)(files[file] ?? "", { merge: true })) {
+			if (document.errors.length > 0) continue;
+			try {
+				const classified = require_toolchain_inputs.containerDocumentImages(document.toJS({ maxAliasCount: 100 }), file);
+				if (classified !== void 0) requireRoot(classified.ecosystem, directoryOf(file));
+			} catch {}
+		}
+		if (name === "uv.lock" || name === "uv.toml" || name !== "pyproject.toml" && require_toolchain_inputs.isPythonDependencyManifest(file)) requireRoot(pythonEcosystem(file, files), directoryOf(file));
+	}
+	return roots;
+};
+const ignoredFor = (ecosystem, policy) => {
+	if (ecosystem === "npm" || ecosystem === "bun") return policy.ignoredPackages;
+	if (ecosystem === "github-actions") return policy.ignoredActions;
+	if (ecosystem === "docker" || ecosystem === "docker-compose") return ownedDockerImageAliases(policy.ignoredImages);
+	return [];
+};
+/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */
+const generateDependabotConfig = ({ files, policy }) => {
+	const updates = [...ecosystemRoots(files)].sort(([left], [right]) => left.localeCompare(right)).map(([ecosystem, roots]) => {
+		const directories = [...roots].sort();
+		const ignored = ignoredFor(ecosystem, policy);
+		const time = new yaml.Scalar(policy.schedule.time);
+		time.type = yaml.Scalar.QUOTE_DOUBLE;
+		return {
+			"package-ecosystem": ecosystem,
+			directory: directories.length === 1 ? directories.at(0) : void 0,
+			directories: directories.length > 1 ? directories : void 0,
+			schedule: {
+				interval: policy.schedule.interval,
+				day: policy.schedule.day,
+				time,
+				timezone: policy.schedule.timezone
+			},
+			cooldown: { "default-days": policy.cooldown.defaultDays },
+			groups: Object.fromEntries(Object.entries(policy.groups).map(([name, group]) => [name, {
+				patterns: group.patterns,
+				"update-types": group.updateTypes
+			}])),
+			ignore: ignored.length > 0 ? ignored.map((name) => ({
+				"dependency-name": name,
+				"update-types": pinnedVersionUpdateTypes
+			})) : void 0
+		};
+	});
+	return (0, yaml.stringify)({
+		version: 2,
+		updates
+	}, { aliasDuplicateObjects: false });
+};
+/** Validate the shared update policy against a hermetic tracked-file snapshot. */
+const checkDependabot = ({ files, policy }) => {
+	const roots = ecosystemRoots(files);
+	const paths = [".github/dependabot.yml", ".github/dependabot.yaml"].filter((file) => files[file] !== void 0);
+	if (roots.size === 0 && paths.length === 0) return [];
+	const file = paths.at(0) ?? ".github/dependabot.yml";
+	const diagnostics = [];
+	const add = (message, line = 1) => {
+		diagnostics.push({
+			rule: "dependabot-policy",
+			path: file,
+			line,
+			message
+		});
+	};
+	if (paths.length === 0) {
+		add("add a Dependabot configuration for the repository's package ecosystems");
+		return diagnostics;
+	}
+	if (paths.length > 1) add("keep one Dependabot configuration file");
+	const lineCounter = new yaml.LineCounter();
+	const document = (0, yaml.parseDocument)(files[file] ?? "", { lineCounter });
+	if (document.errors.length > 0) {
+		for (const error of document.errors) add(`invalid Dependabot YAML: ${error.message}`, lineCounter.linePos(error.pos[0]).line);
+		return diagnostics;
+	}
+	let parsed;
+	try {
+		parsed = document.toJS({ maxAliasCount: 100 });
+	} catch {
+		add("cannot resolve Dependabot YAML aliases");
+		return diagnostics;
+	}
+	if (!record(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
+		add("Dependabot must declare version: 2 and an updates array");
+		return diagnostics;
+	}
+	const covered = /* @__PURE__ */ new Map();
+	let legacy;
+	try {
+		const legacyDocument = (0, yaml.parseDocument)(files[file] ?? "", {
+			version: "1.1",
+			schema: "yaml-1.1"
+		});
+		if (legacyDocument.errors.length === 0) legacy = legacyDocument.toJS({ maxAliasCount: 100 });
+	} catch {}
+	const legacyUpdates = record(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
+	const rootClaims = /* @__PURE__ */ new Map();
+	const directoryClaims = /* @__PURE__ */ new Map();
+	for (const [index, update] of parsed["updates"].entries()) {
+		const lineOf = (key) => {
+			const node = document.getIn([
+				"updates",
+				index,
+				key
+			], true);
+			const offset = (0, yaml.isNode)(node) ? node.range?.[0] : void 0;
+			return offset === void 0 ? 1 : lineCounter.linePos(offset).line;
+		};
+		const report = (key, message) => add(message, lineOf(key));
+		if (!record(update) || typeof update["package-ecosystem"] !== "string") {
+			report("package-ecosystem", "each Dependabot update must declare a package ecosystem");
+			continue;
+		}
+		const ecosystem = update["package-ecosystem"];
+		if (update["target-branch"] !== void 0) report("target-branch", `${ecosystem}: shared updates must target the default branch`);
+		if (update["open-pull-requests-limit"] === 0) report("open-pull-requests-limit", `${ecosystem}: version updates must remain enabled`);
+		const single = update["directory"];
+		const multiple = update["directories"];
+		let directories = [];
+		if (typeof single === "string" && multiple === void 0) directories = [single];
+		else if (single === void 0 && strings(multiple)) directories = multiple;
+		const validDirectories = directories.filter((directory) => directory.startsWith("/") && !directory.split("/").includes(".."));
+		if (directories.length === 0 || validDirectories.length !== directories.length) report("directory", `${ecosystem}: declare directory or nonempty directories with absolute repository paths`);
+		const normalizedDirectories = Array.from(new Set(validDirectories.map((value) => node_path.default.posix.normalize(value).replace(/\/+$/, "") || "/")));
+		const matches = covered.get(ecosystem) ?? /* @__PURE__ */ new Set();
+		const claimedDirectories = directoryClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
+		for (const directory of normalizedDirectories) {
+			const previous = claimedDirectories.get(directory);
+			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`);
+			else claimedDirectories.set(directory, index);
+		}
+		directoryClaims.set(ecosystem, claimedDirectories);
+		const claimedRoots = rootClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
+		for (const root of roots.get(ecosystem) ?? []) if (normalizedDirectories.some((directory) => directory === root || multiple !== void 0 && picomatch.default.isMatch(root, directory))) {
+			const previous = claimedRoots.get(root);
+			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`);
+			else claimedRoots.set(root, index);
+			matches.add(root);
+		}
+		rootClaims.set(ecosystem, claimedRoots);
+		covered.set(ecosystem, matches);
+		const schedule = update["schedule"];
+		const legacyUpdate = legacyUpdates.at(index);
+		const legacySchedule = record(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
+		if (record(schedule) && schedule["time"] === policy.schedule.time && (!record(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
+		if (!record(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
+		const cooldown = update["cooldown"];
+		if (!record(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
+		const groups = update["groups"];
+		if (!record(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
+			const group = groups[name];
+			return !record(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
+		})) report("groups", `${ecosystem}: groups must match the shared policy`);
+		const ignored = ignoredFor(ecosystem, policy);
+		const ignore = update["ignore"];
+		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !record(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
+		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record(entry) && entry["dependency-name"] === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
+	}
+	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
+	return diagnostics;
+};
+//#endregion
+Object.defineProperty(exports, "canonicalDockerRuntime", {
+	enumerable: true,
+	get: function() {
+		return canonicalDockerRuntime;
+	}
+});
+Object.defineProperty(exports, "checkDependabot", {
+	enumerable: true,
+	get: function() {
+		return checkDependabot;
+	}
+});
+Object.defineProperty(exports, "dependabotRules", {
+	enumerable: true,
+	get: function() {
+		return dependabotRules;
+	}
+});
+Object.defineProperty(exports, "generateDependabotConfig", {
+	enumerable: true,
+	get: function() {
+		return generateDependabotConfig;
+	}
+});
+Object.defineProperty(exports, "rustImageVersion", {
+	enumerable: true,
+	get: function() {
+		return rustImageVersion;
+	}
+});
+
+//# sourceMappingURL=toolchain-dependabot.cjs.map

package/dist/toolchain-dependabot.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolchain-dependabot.cjs","names":["path","unexpected","parseDocument","parseToml","workspaceContains","javascriptDependencyLockfiles","pythonDependencyManifestKind","isDependabotGithubActionsPath","dependabotManifestEcosystem","isDockerDefinitionPath","isComposeDefinitionPath","isKubernetesDefinitionPath","parseAllDocuments","containerDocumentImages","isPythonDependencyManifest","Scalar","stringify","LineCounter","isNode"],"sources":["../src/toolchain-images.ts","../src/toolchain-dependabot.ts"],"sourcesContent":["/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n\n/** Preserve Rust release identity across official Debian slim and Alpine variants. */\nexport const rustImageVersion = (tag: string) =>\n  tag.replace(\n    /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/,\n    \"\",\n  );\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n  dependabotManifestEcosystem,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\nconst pinnedVersionUpdateTypes = [\n  \"version-update:semver-major\",\n  \"version-update:semver-minor\",\n  \"version-update:semver-patch\",\n];\n\nconst versionOnlyIgnore = (entry: unknown) =>\n  record(entry) &&\n  Object.keys(entry).length === 2 &&\n  typeof entry[\"dependency-name\"] === \"string\" &&\n  sameStrings(entry[\"update-types\"], pinnedVersionUpdateTypes);\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\nconst declaresJavascriptInstallation = (text: string | undefined) => {\n  try {\n    const manifest: unknown = JSON.parse(text ?? \"\");\n    if (!record(manifest)) return false;\n    if (typeof manifest[\"packageManager\"] === \"string\") return true;\n    return [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ].some((field) => {\n      const dependencies = manifest[field];\n      return record(dependencies) && Object.keys(dependencies).length > 0;\n    });\n  } catch {\n    // Manifest validation reports invalid JSON independently.\n    return false;\n  }\n};\n\n/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        declaresJavascriptInstallation(\n          files[path.posix.join(directory, \"package.json\")],\n        ) ||\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) {\n          if (\n            ![...installable].some((directory) =>\n              declaredMember(root, patterns, directory),\n            )\n          )\n            continue;\n          installable.add(root);\n          changed = true;\n        }\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  let root = directory === \"/\" ? \".\" : directory.slice(1);\n  for (;;) {\n    if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n    try {\n      const manifest: unknown = JSON.parse(\n        files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n      );\n      if (record(manifest) && typeof manifest[\"packageManager\"] === \"string\")\n        return manifest[\"packageManager\"].startsWith(\"bun@\") ? \"bun\" : \"npm\";\n    } catch {\n      // Package rules diagnose malformed JSON; retain its update coverage.\n    }\n    for (const name of javascriptDependencyLockfiles)\n      if (files[path.posix.join(root, name)] !== undefined) return \"npm\";\n    if (root === \".\") return \"npm\";\n    root = path.posix.dirname(root);\n  }\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    const manifestEcosystem = dependabotManifestEcosystem(file);\n    if (manifestEcosystem !== undefined)\n      requireRoot(manifestEcosystem, directoryOf(file));\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n}: CheckDependabotOptions) => {\n  const updates = [...ecosystemRoots(files)]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, roots]) => {\n      const directories = [...roots].sort();\n      const ignored = ignoredFor(ecosystem, policy);\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore:\n          ignored.length > 0\n            ? ignored.map((name) => ({\n                \"dependency-name\": name,\n                \"update-types\": pinnedVersionUpdateTypes,\n              }))\n            : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    if (\n      Array.isArray(ignore) &&\n      ignore.some(\n        (entry: unknown) =>\n          !record(entry) ||\n          typeof entry[\"dependency-name\"] !== \"string\" ||\n          !ignored.includes(entry[\"dependency-name\"]),\n      )\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy`,\n      );\n    if (\n      Array.isArray(ignore) &&\n      ignore.some((entry: unknown) => !versionOnlyIgnore(entry))\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`,\n      );\n    for (const name of ignored) {\n      if (\n        !Array.isArray(ignore) ||\n        !ignore.some(\n          (entry: unknown) =>\n            record(entry) &&\n            entry[\"dependency-name\"] === name &&\n            versionOnlyIgnore(entry),\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all version updates for shared pin ${name}`,\n        );\n    }\n  }\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n"],"mappings":";;;;;;;;;;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;AAGA,MAAa,oBAAoB,QAC/B,IAAI,QACF,8HACA,EACF;;;ACPF,MAAa,kBAAkB,CAAC,mBAAmB;AAqBnD,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAEA,MAAM,2BAA2B;CAC/B;CACA;CACA;AACF;AAEA,MAAM,qBAAqB,UACzB,OAAO,KAAK,KACZ,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,OAAO,MAAM,uBAAuB,YACpC,YAAY,MAAM,iBAAiB,wBAAwB;AAE7D,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAO,OAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOC,UAAW,CAAC;CAExE;AACF;AAEA,MAAM,kCAAkC,SAA6B;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,QAAQ,EAAE;EAC/C,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAC9B,IAAI,OAAO,SAAS,sBAAsB,UAAU,OAAO;EAC3D,OAAO;GACL;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU;GAChB,MAAM,eAAe,SAAS;GAC9B,OAAO,OAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS;EACpE,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACCD,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACbA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgBA,UAAAA,QAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,YAAA,GAAWE,KAAAA,cAAAA,CAAc,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAAC,OAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAIF,UAAAA,QAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzCA,UAAAA,QAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,KAAA,GAC5BG,UAAAA,MAAAA,CAAU,MAAM,SAAS,EAAE;GACjC,IAAI,CAAC,OAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAW,OAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAW,OAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAIH,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAOI,yBAAAA,kBAAkB;GACvB,WAAW;GACX,MAAMJ,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,IACE,+BACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc,EACjD,KACAK,yBAAAA,8BAA8B,MAC3B,SAAS,MAAML,UAAAA,QAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;KAC1B,IACE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,cACtB,eAAe,MAAM,UAAU,SAAS,CAC1C,GAEA;KACF,YAAY,IAAI,IAAI;KACpB,UAAU;IACZ;IACA,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAA,QAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,UAAA,GAASG,UAAAA,MAAAA,CACb,MAAMH,UAAAA,QAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,aAAA,GAHaG,UAAAA,MAAAA,CACjB,MAAMH,UAAAA,QAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAY,OAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAI,OAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAI,OAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAAC,OAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAAC,OAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAe,OAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAAC,OAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACEA,UAAAA,QAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAASA,UAAAA,QAAK,MAAM,UACxBA,UAAAA,QAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAMA,UAAAA,QAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAIA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AAOA,MAAM,uBACJ,WACA,UACG;CACH,IAAI,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACtD,SAAS;EACP,IAAI,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;EACnE,IAAI;GACF,MAAM,WAAoB,KAAK,MAC7B,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;GACA,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,sBAAsB,UAC5D,OAAO,SAAS,iBAAiB,CAAC,WAAW,MAAM,IAAI,QAAQ;EACnE,QAAQ,CAER;EACA,KAAK,MAAM,QAAQK,yBAAAA,+BACjB,IAAI,MAAML,UAAAA,QAAK,MAAM,KAAK,MAAM,IAAI,OAAO,KAAA,GAAW,OAAO;EAC/D,IAAI,SAAS,KAAK,OAAO;EACzB,OAAOA,UAAAA,QAAK,MAAM,QAAQ,IAAI;CAChC;AACF;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAeM,yBAAAA,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAON,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,QAAA,GADSG,UAAAA,MAAAA,CAAU,SACP,CAAC,CAAC;EACpB,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgBH,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAIO,yBAAAA,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAOP,UAAAA,QAAK,MAAM,SAAS,IAAI;EACrC,MAAM,oBAAoBQ,yBAAAA,4BAA4B,IAAI;EAC1D,IAAI,sBAAsB,KAAA,GACxB,YAAY,mBAAmB,YAAY,IAAI,CAAC;EAClD,IAAIC,yBAAAA,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAIC,yBAAAA,wBAAwB,IAAI,KAAKC,yBAAAA,2BAA2B,IAAI,GAClE,KAAK,MAAM,aAAA,GAAYC,KAAAA,kBAAAA,CAAkB,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAaC,yBAAAA,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoBC,yBAAAA,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAGA,MAAa,4BAA4B,EACvC,OACA,aAC4B;CAC5B,MAAM,UAAU,CAAC,GAAG,eAAe,KAAK,CAAC,CAAC,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC,CAAC,CACpD,KAAK,CAAC,WAAW,WAAW;EAC3B,MAAM,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK;EACpC,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,OAAO,IAAIC,KAAAA,OAAO,OAAO,SAAS,IAAI;EAC5C,KAAK,OAAOA,KAAAA,OAAO;EACnB,OAAO;GACL,qBAAqB;GACrB,WAAW,YAAY,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,KAAA;GAC1D,aAAa,YAAY,SAAS,IAAI,cAAc,KAAA;GACpD,UAAU;IACR,UAAU,OAAO,SAAS;IAC1B,KAAK,OAAO,SAAS;IACrB;IACA,UAAU,OAAO,SAAS;GAC5B;GACA,UAAU,EAAE,gBAAgB,OAAO,SAAS,YAAY;GACxD,QAAQ,OAAO,YACb,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACnD,MACA;IAAE,UAAU,MAAM;IAAU,gBAAgB,MAAM;GAAY,CAChE,CAAC,CACH;GACA,QACE,QAAQ,SAAS,IACb,QAAQ,KAAK,UAAU;IACrB,mBAAmB;IACnB,gBAAgB;GAClB,EAAE,IACF,KAAA;EACR;CACF,CAAC;CACH,QAAA,GAAOC,KAAAA,UAAAA,CAAU;EAAE,SAAS;EAAG;CAAQ,GAAG,EAAE,uBAAuB,MAAM,CAAC;AAC5E;;AAGA,MAAa,mBAAmB,EAC9B,OACA,aAC0C;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,OAAO,CAAC;CACpD,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAIC,KAAAA,YAAY;CACpC,MAAM,YAAA,GAAWf,KAAAA,cAAAA,CAAc,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAAC,OAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,kBAAA,GAAiBA,KAAAA,cAAAA,CAAc,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJ,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,UAAA,GAASgB,KAAAA,OAAAA,CAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAUlB,UAAAA,QAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAA,QAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiB,OAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACE,OAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAAC,OAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAAC,OAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MACJ,UACC,CAAC,OAAO,KAAK,KACb,OAAO,MAAM,uBAAuB,YACpC,CAAC,QAAQ,SAAS,MAAM,kBAAkB,CAC9C,GAEA,OACE,UACA,GAAG,UAAU,kDACf;EACF,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MAAM,UAAmB,CAAC,kBAAkB,KAAK,CAAC,GAEzD,OACE,UACA,GAAG,UAAU,mLACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,CAAC,OAAO,MACL,UACC,OAAO,KAAK,KACZ,MAAM,uBAAuB,QAC7B,kBAAkB,KAAK,CAC3B,GAEA,OACE,UACA,GAAG,UAAU,8CAA8C,MAC7D;CAEN;CACA,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT"}