@stll/oxlint-config 1.4.0 → 1.5.0

package/dist/toolchain-dependabot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-dependabot.mjs","names":["unexpected","parseToml"],"sources":["../src/toolchain-images.ts","../src/toolchain-dependabot.ts"],"sourcesContent":["/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n\n/** Preserve Rust release identity across official Debian slim and Alpine variants. */\nexport const rustImageVersion = (tag: string) =>\n  tag.replace(\n    /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/,\n    \"\",\n  );\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n  dependabotManifestEcosystem,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\nconst pinnedVersionUpdateTypes = [\n  \"version-update:semver-major\",\n  \"version-update:semver-minor\",\n  \"version-update:semver-patch\",\n];\n\nconst versionOnlyIgnore = (entry: unknown) =>\n  record(entry) &&\n  Object.keys(entry).length === 2 &&\n  typeof entry[\"dependency-name\"] === \"string\" &&\n  sameStrings(entry[\"update-types\"], pinnedVersionUpdateTypes);\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\nconst declaresJavascriptInstallation = (text: string | undefined) => {\n  try {\n    const manifest: unknown = JSON.parse(text ?? \"\");\n    if (!record(manifest)) return false;\n    if (typeof manifest[\"packageManager\"] === \"string\") return true;\n    return [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ].some((field) => {\n      const dependencies = manifest[field];\n      return record(dependencies) && Object.keys(dependencies).length > 0;\n    });\n  } catch {\n    // Manifest validation reports invalid JSON independently.\n    return false;\n  }\n};\n\n/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        declaresJavascriptInstallation(\n          files[path.posix.join(directory, \"package.json\")],\n        ) ||\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) {\n          if (\n            ![...installable].some((directory) =>\n              declaredMember(root, patterns, directory),\n            )\n          )\n            continue;\n          installable.add(root);\n          changed = true;\n        }\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  let root = directory === \"/\" ? \".\" : directory.slice(1);\n  for (;;) {\n    if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n    try {\n      const manifest: unknown = JSON.parse(\n        files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n      );\n      if (record(manifest) && typeof manifest[\"packageManager\"] === \"string\")\n        return manifest[\"packageManager\"].startsWith(\"bun@\") ? \"bun\" : \"npm\";\n    } catch {\n      // Package rules diagnose malformed JSON; retain its update coverage.\n    }\n    for (const name of javascriptDependencyLockfiles)\n      if (files[path.posix.join(root, name)] !== undefined) return \"npm\";\n    if (root === \".\") return \"npm\";\n    root = path.posix.dirname(root);\n  }\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    const manifestEcosystem = dependabotManifestEcosystem(file);\n    if (manifestEcosystem !== undefined)\n      requireRoot(manifestEcosystem, directoryOf(file));\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n}: CheckDependabotOptions) => {\n  const updates = [...ecosystemRoots(files)]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, roots]) => {\n      const directories = [...roots].sort();\n      const ignored = ignoredFor(ecosystem, policy);\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore:\n          ignored.length > 0\n            ? ignored.map((name) => ({\n                \"dependency-name\": name,\n                \"update-types\": pinnedVersionUpdateTypes,\n              }))\n            : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    if (\n      Array.isArray(ignore) &&\n      ignore.some(\n        (entry: unknown) =>\n          !record(entry) ||\n          typeof entry[\"dependency-name\"] !== \"string\" ||\n          !ignored.includes(entry[\"dependency-name\"]),\n      )\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy`,\n      );\n    if (\n      Array.isArray(ignore) &&\n      ignore.some((entry: unknown) => !versionOnlyIgnore(entry))\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`,\n      );\n    for (const name of ignored) {\n      if (\n        !Array.isArray(ignore) ||\n        !ignore.some(\n          (entry: unknown) =>\n            record(entry) &&\n            entry[\"dependency-name\"] === name &&\n            versionOnlyIgnore(entry),\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all version updates for shared pin ${name}`,\n        );\n    }\n  }\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n"],"mappings":";;;;;;;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;AAGA,MAAa,oBAAoB,QAC/B,IAAI,QACF,8HACA,EACF;;;ACPF,MAAa,kBAAkB,CAAC,mBAAmB;AAqBnD,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAEA,MAAM,2BAA2B;CAC/B;CACA;CACA;AACF;AAEA,MAAM,qBAAqB,UACzB,OAAO,KAAK,KACZ,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,OAAO,MAAM,uBAAuB,YACpC,YAAY,MAAM,iBAAiB,wBAAwB;AAE7D,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAO,OAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOA,UAAW,CAAC;CAExE;AACF;AAEA,MAAM,kCAAkC,SAA6B;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,QAAQ,EAAE;EAC/C,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAC9B,IAAI,OAAO,SAAS,sBAAsB,UAAU,OAAO;EAC3D,OAAO;GACL;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU;GAChB,MAAM,eAAe,SAAS;GAC9B,OAAO,OAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS;EACpE,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACC,KAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACb,KAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgB,KAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,WAAW,cAAc,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAAC,OAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAI,KAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzC,KAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,IAC5BC,MAAU,MAAM,SAAS,EAAE;GACjC,IAAI,CAAC,OAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAW,OAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAW,OAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAI,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAO,kBAAkB;GACvB,WAAW;GACX,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,IACE,+BACE,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,EACjD,KACA,8BAA8B,MAC3B,SAAS,MAAM,KAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;KAC1B,IACE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,cACtB,eAAe,MAAM,UAAU,SAAS,CAC1C,GAEA;KACF,YAAY,IAAI,IAAI;KACpB,UAAU;IACZ;IACA,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,SAASA,MACb,MAAM,KAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,YAHaA,MACjB,MAAM,KAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAY,OAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAI,OAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAI,OAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAAC,OAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAAC,OAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAe,OAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAAC,OAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACE,KAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAAS,KAAK,MAAM,UACxB,KAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAM,KAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAI,KAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AAOA,MAAM,uBACJ,WACA,UACG;CACH,IAAI,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACtD,SAAS;EACP,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;EACnE,IAAI;GACF,MAAM,WAAoB,KAAK,MAC7B,MAAM,KAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;GACA,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,sBAAsB,UAC5D,OAAO,SAAS,iBAAiB,CAAC,WAAW,MAAM,IAAI,QAAQ;EACnE,QAAQ,CAER;EACA,KAAK,MAAM,QAAQ,+BACjB,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,OAAO,KAAA,GAAW,OAAO;EAC/D,IAAI,SAAS,KAAK,OAAO;EACzB,OAAO,KAAK,MAAM,QAAQ,IAAI;CAChC;AACF;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAe,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAO,KAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAM,KAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,OADSA,MAAU,SACP,CAAC,CAAC;EACpB,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgB,KAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAI,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,oBAAoB,4BAA4B,IAAI;EAC1D,IAAI,sBAAsB,KAAA,GACxB,YAAY,mBAAmB,YAAY,IAAI,CAAC;EAClD,IAAI,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAClE,KAAK,MAAM,YAAY,kBAAkB,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAa,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoB,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAGA,MAAa,4BAA4B,EACvC,OACA,aAC4B;CAC5B,MAAM,UAAU,CAAC,GAAG,eAAe,KAAK,CAAC,CAAC,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC,CAAC,CACpD,KAAK,CAAC,WAAW,WAAW;EAC3B,MAAM,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK;EACpC,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,OAAO,IAAI,OAAO,OAAO,SAAS,IAAI;EAC5C,KAAK,OAAO,OAAO;EACnB,OAAO;GACL,qBAAqB;GACrB,WAAW,YAAY,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,KAAA;GAC1D,aAAa,YAAY,SAAS,IAAI,cAAc,KAAA;GACpD,UAAU;IACR,UAAU,OAAO,SAAS;IAC1B,KAAK,OAAO,SAAS;IACrB;IACA,UAAU,OAAO,SAAS;GAC5B;GACA,UAAU,EAAE,gBAAgB,OAAO,SAAS,YAAY;GACxD,QAAQ,OAAO,YACb,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACnD,MACA;IAAE,UAAU,MAAM;IAAU,gBAAgB,MAAM;GAAY,CAChE,CAAC,CACH;GACA,QACE,QAAQ,SAAS,IACb,QAAQ,KAAK,UAAU;IACrB,mBAAmB;IACnB,gBAAgB;GAClB,EAAE,IACF,KAAA;EACR;CACF,CAAC;CACH,OAAO,UAAU;EAAE,SAAS;EAAG;CAAQ,GAAG,EAAE,uBAAuB,MAAM,CAAC;AAC5E;;AAGA,MAAa,mBAAmB,EAC9B,OACA,aAC0C;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,OAAO,CAAC;CACpD,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAI,YAAY;CACpC,MAAM,WAAW,cAAc,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAAC,OAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,iBAAiB,cAAc,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJ,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,SAAS,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAU,KAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiB,OAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACE,OAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAAC,OAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAAC,OAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MACJ,UACC,CAAC,OAAO,KAAK,KACb,OAAO,MAAM,uBAAuB,YACpC,CAAC,QAAQ,SAAS,MAAM,kBAAkB,CAC9C,GAEA,OACE,UACA,GAAG,UAAU,kDACf;EACF,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MAAM,UAAmB,CAAC,kBAAkB,KAAK,CAAC,GAEzD,OACE,UACA,GAAG,UAAU,mLACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,CAAC,OAAO,MACL,UACC,OAAO,KAAK,KACZ,MAAM,uBAAuB,QAC7B,kBAAkB,KAAK,CAC3B,GAEA,OACE,UACA,GAAG,UAAU,8CAA8C,MAC7D;CAEN;CACA,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT"}
+{"version":3,"file":"toolchain-dependabot.mjs","names":["unexpected","parseToml"],"sources":["../src/toolchain-images.ts","../src/toolchain-dependabot.ts"],"sourcesContent":["/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n\n/** Preserve Rust release identity across official Debian slim and Alpine variants. */\nexport const rustImageVersion = (tag: string) =>\n  tag.replace(\n    /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/,\n    \"\",\n  );\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n  dependabotManifestEcosystem,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\n// https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem\nexport const supportedDependabotEcosystems = [\n  \"bazel\",\n  \"bun\",\n  \"bundler\",\n  \"cargo\",\n  \"composer\",\n  \"conda\",\n  \"deno\",\n  \"devcontainers\",\n  \"docker\",\n  \"docker-compose\",\n  \"dotnet-sdk\",\n  \"elm\",\n  \"gitsubmodule\",\n  \"github-actions\",\n  \"gomod\",\n  \"gradle\",\n  \"helm\",\n  \"julia\",\n  \"maven\",\n  \"mix\",\n  \"nix\",\n  \"npm\",\n  \"nuget\",\n  \"opentofu\",\n  \"pip\",\n  \"pre-commit\",\n  \"pub\",\n  \"rust-toolchain\",\n  \"sbt\",\n  \"swift\",\n  \"terraform\",\n  \"uv\",\n  \"vcpkg\",\n] as const;\nexport type DependabotEcosystem =\n  (typeof supportedDependabotEcosystems)[number];\nconst isDependabotEcosystem = (value: string): value is DependabotEcosystem =>\n  supportedDependabotEcosystems.some((ecosystem) => ecosystem === value);\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\nconst pinnedVersionUpdateTypes = [\n  \"version-update:semver-major\",\n  \"version-update:semver-minor\",\n  \"version-update:semver-patch\",\n];\n\nconst versionOnlyIgnore = (entry: unknown) =>\n  record(entry) &&\n  Object.keys(entry).length === 2 &&\n  typeof entry[\"dependency-name\"] === \"string\" &&\n  sameStrings(entry[\"update-types\"], pinnedVersionUpdateTypes);\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\nconst declaresJavascriptInstallation = (text: string | undefined) => {\n  try {\n    const manifest: unknown = JSON.parse(text ?? \"\");\n    if (!record(manifest)) return false;\n    if (typeof manifest[\"packageManager\"] === \"string\") return true;\n    return [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ].some((field) => {\n      const dependencies = manifest[field];\n      return record(dependencies) && Object.keys(dependencies).length > 0;\n    });\n  } catch {\n    // Manifest validation reports invalid JSON independently.\n    return false;\n  }\n};\n\n/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        declaresJavascriptInstallation(\n          files[path.posix.join(directory, \"package.json\")],\n        ) ||\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) {\n          if (\n            ![...installable].some((directory) =>\n              declaredMember(root, patterns, directory),\n            )\n          )\n            continue;\n          installable.add(root);\n          changed = true;\n        }\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  let root = directory === \"/\" ? \".\" : directory.slice(1);\n  for (;;) {\n    if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n    try {\n      const manifest: unknown = JSON.parse(\n        files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n      );\n      if (record(manifest) && typeof manifest[\"packageManager\"] === \"string\")\n        return manifest[\"packageManager\"].startsWith(\"bun@\") ? \"bun\" : \"npm\";\n    } catch {\n      // Package rules diagnose malformed JSON; retain its update coverage.\n    }\n    for (const name of javascriptDependencyLockfiles)\n      if (files[path.posix.join(root, name)] !== undefined) return \"npm\";\n    if (root === \".\") return \"npm\";\n    root = path.posix.dirname(root);\n  }\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    const manifestEcosystem = dependabotManifestEcosystem(file);\n    if (manifestEcosystem !== undefined)\n      requireRoot(manifestEcosystem, directoryOf(file));\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\n/** Repository declarations own coverage only; shared policy owns every update option. */\nexport const parseDependabotInput = (input: unknown) => {\n  if (\n    !record(input) ||\n    Object.keys(input).some((key) => key !== \"updates\") ||\n    !Array.isArray(input[\"updates\"]) ||\n    input[\"updates\"].length === 0\n  )\n    throw new Error(\n      \"Dependabot input must contain a nonempty updates array only\",\n    );\n  const ecosystems = new Set<string>();\n  return input[\"updates\"].map((entry: unknown) => {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"ecosystem\", \"directories\"].includes(key),\n      ) ||\n      typeof entry[\"ecosystem\"] !== \"string\" ||\n      !strings(entry[\"directories\"]) ||\n      entry[\"directories\"].length === 0\n    )\n      throw new Error(\n        \"each Dependabot update must contain ecosystem and nonempty directories only\",\n      );\n    const ecosystem = entry[\"ecosystem\"];\n    if (!isDependabotEcosystem(ecosystem))\n      throw new Error(`unsupported Dependabot ecosystem: ${ecosystem}`);\n    const directories = entry[\"directories\"];\n    if (ecosystems.has(ecosystem))\n      throw new Error(`duplicate Dependabot ecosystem: ${ecosystem}`);\n    ecosystems.add(ecosystem);\n    const seen = new Set<string>();\n    for (const directory of directories) {\n      if (\n        !directory.startsWith(\"/\") ||\n        directory.includes(\"\\\\\") ||\n        directory.split(\"/\").some((part) => part === \".\" || part === \"..\") ||\n        path.posix.normalize(directory) !== directory ||\n        (directory !== \"/\" && directory.endsWith(\"/\")) ||\n        /[*?[\\]{}!]/.test(directory)\n      )\n        throw new Error(\n          `Dependabot directory must be a literal absolute repository path: ${directory}`,\n        );\n      if (seen.has(directory))\n        throw new Error(`duplicate Dependabot directory: ${directory}`);\n      seen.add(directory);\n    }\n    return { ecosystem, directories };\n  });\n};\n\ntype GenerateDependabotOptions = CheckDependabotOptions & {\n  updates?: ReturnType<typeof parseDependabotInput> | undefined;\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n  updates: declarations,\n}: GenerateDependabotOptions) => {\n  const detected = ecosystemRoots(files);\n  const roots =\n    declarations === undefined\n      ? detected\n      : new Map(\n          parseDependabotInput({ updates: declarations }).map(\n            ({ ecosystem, directories }) => [ecosystem, new Set(directories)],\n          ),\n        );\n  for (const [ecosystem, directories] of detected) {\n    for (const directory of directories) {\n      if (!roots.get(ecosystem)?.has(directory))\n        throw new Error(\n          `Dependabot input must cover ${ecosystem} directory ${directory}`,\n        );\n    }\n  }\n  const updates = [...roots]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, ecosystemDirectories]) => {\n      const directories = [...ecosystemDirectories].sort();\n      const ignored = ignoredFor(ecosystem, policy);\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore:\n          ignored.length > 0\n            ? ignored.map((name) => ({\n                \"dependency-name\": name,\n                \"update-types\": pinnedVersionUpdateTypes,\n              }))\n            : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    if (\n      Array.isArray(ignore) &&\n      ignore.some(\n        (entry: unknown) =>\n          !record(entry) ||\n          typeof entry[\"dependency-name\"] !== \"string\" ||\n          !ignored.includes(entry[\"dependency-name\"]),\n      )\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy`,\n      );\n    if (\n      Array.isArray(ignore) &&\n      ignore.some((entry: unknown) => !versionOnlyIgnore(entry))\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`,\n      );\n    for (const name of ignored) {\n      if (\n        !Array.isArray(ignore) ||\n        !ignore.some(\n          (entry: unknown) =>\n            record(entry) &&\n            entry[\"dependency-name\"] === name &&\n            versionOnlyIgnore(entry),\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all version updates for shared pin ${name}`,\n        );\n    }\n  }\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n"],"mappings":";;;;;;;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;AAGA,MAAa,oBAAoB,QAC/B,IAAI,QACF,8HACA,EACF;;;ACPF,MAAa,kBAAkB,CAAC,mBAAmB;AAGnD,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAGA,MAAM,yBAAyB,UAC7B,8BAA8B,MAAM,cAAc,cAAc,KAAK;AAqBvE,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAEA,MAAM,2BAA2B;CAC/B;CACA;CACA;AACF;AAEA,MAAM,qBAAqB,UACzB,OAAO,KAAK,KACZ,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,OAAO,MAAM,uBAAuB,YACpC,YAAY,MAAM,iBAAiB,wBAAwB;AAE7D,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAO,OAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOA,UAAW,CAAC;CAExE;AACF;AAEA,MAAM,kCAAkC,SAA6B;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,QAAQ,EAAE;EAC/C,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAC9B,IAAI,OAAO,SAAS,sBAAsB,UAAU,OAAO;EAC3D,OAAO;GACL;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU;GAChB,MAAM,eAAe,SAAS;GAC9B,OAAO,OAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS;EACpE,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACC,KAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACb,KAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgB,KAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,WAAW,cAAc,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAAC,OAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAI,KAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzC,KAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,IAC5BC,MAAU,MAAM,SAAS,EAAE;GACjC,IAAI,CAAC,OAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAW,OAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAW,OAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAI,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAO,kBAAkB;GACvB,WAAW;GACX,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,IACE,+BACE,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,EACjD,KACA,8BAA8B,MAC3B,SAAS,MAAM,KAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;KAC1B,IACE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,cACtB,eAAe,MAAM,UAAU,SAAS,CAC1C,GAEA;KACF,YAAY,IAAI,IAAI;KACpB,UAAU;IACZ;IACA,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,SAASA,MACb,MAAM,KAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,YAHaA,MACjB,MAAM,KAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAY,OAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAI,OAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAI,OAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAAC,OAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAAC,OAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAe,OAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAAC,OAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACE,KAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAAS,KAAK,MAAM,UACxB,KAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAM,KAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAI,KAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AAOA,MAAM,uBACJ,WACA,UACG;CACH,IAAI,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACtD,SAAS;EACP,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;EACnE,IAAI;GACF,MAAM,WAAoB,KAAK,MAC7B,MAAM,KAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;GACA,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,sBAAsB,UAC5D,OAAO,SAAS,iBAAiB,CAAC,WAAW,MAAM,IAAI,QAAQ;EACnE,QAAQ,CAER;EACA,KAAK,MAAM,QAAQ,+BACjB,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,OAAO,KAAA,GAAW,OAAO;EAC/D,IAAI,SAAS,KAAK,OAAO;EACzB,OAAO,KAAK,MAAM,QAAQ,IAAI;CAChC;AACF;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAe,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAO,KAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAM,KAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,OADSA,MAAU,SACP,CAAC,CAAC;EACpB,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgB,KAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAI,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,oBAAoB,4BAA4B,IAAI;EAC1D,IAAI,sBAAsB,KAAA,GACxB,YAAY,mBAAmB,YAAY,IAAI,CAAC;EAClD,IAAI,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAClE,KAAK,MAAM,YAAY,kBAAkB,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAa,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoB,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAGA,MAAa,wBAAwB,UAAmB;CACtD,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,QAAQ,SAAS,KAClD,CAAC,MAAM,QAAQ,MAAM,UAAU,KAC/B,MAAM,UAAU,CAAC,WAAW,GAE5B,MAAM,IAAI,MACR,6DACF;CACF,MAAM,6BAAa,IAAI,IAAY;CACnC,OAAO,MAAM,UAAU,CAAC,KAAK,UAAmB;EAC9C,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,SAAS,GAAG,CACrD,KACA,OAAO,MAAM,iBAAiB,YAC9B,CAAC,QAAQ,MAAM,cAAc,KAC7B,MAAM,cAAc,CAAC,WAAW,GAEhC,MAAM,IAAI,MACR,6EACF;EACF,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,sBAAsB,SAAS,GAClC,MAAM,IAAI,MAAM,qCAAqC,WAAW;EAClE,MAAM,cAAc,MAAM;EAC1B,IAAI,WAAW,IAAI,SAAS,GAC1B,MAAM,IAAI,MAAM,mCAAmC,WAAW;EAChE,WAAW,IAAI,SAAS;EACxB,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,aAAa,aAAa;GACnC,IACE,CAAC,UAAU,WAAW,GAAG,KACzB,UAAU,SAAS,IAAI,KACvB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,OAAO,SAAS,IAAI,KACjE,KAAK,MAAM,UAAU,SAAS,MAAM,aACnC,cAAc,OAAO,UAAU,SAAS,GAAG,KAC5C,aAAa,KAAK,SAAS,GAE3B,MAAM,IAAI,MACR,oEAAoE,WACtE;GACF,IAAI,KAAK,IAAI,SAAS,GACpB,MAAM,IAAI,MAAM,mCAAmC,WAAW;GAChE,KAAK,IAAI,SAAS;EACpB;EACA,OAAO;GAAE;GAAW;EAAY;CAClC,CAAC;AACH;;AAOA,MAAa,4BAA4B,EACvC,OACA,QACA,SAAS,mBACsB;CAC/B,MAAM,WAAW,eAAe,KAAK;CACrC,MAAM,QACJ,iBAAiB,KAAA,IACb,WACA,IAAI,IACF,qBAAqB,EAAE,SAAS,aAAa,CAAC,CAAC,CAAC,KAC7C,EAAE,WAAW,kBAAkB,CAAC,WAAW,IAAI,IAAI,WAAW,CAAC,CAClE,CACF;CACN,KAAK,MAAM,CAAC,WAAW,gBAAgB,UACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACtC,MAAM,IAAI,MACR,+BAA+B,UAAU,aAAa,WACxD;CAGN,MAAM,UAAU,CAAC,GAAG,KAAK,CAAC,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC,CAAC,CACpD,KAAK,CAAC,WAAW,0BAA0B;EAC1C,MAAM,cAAc,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK;EACnD,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,OAAO,IAAI,OAAO,OAAO,SAAS,IAAI;EAC5C,KAAK,OAAO,OAAO;EACnB,OAAO;GACL,qBAAqB;GACrB,WAAW,YAAY,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,KAAA;GAC1D,aAAa,YAAY,SAAS,IAAI,cAAc,KAAA;GACpD,UAAU;IACR,UAAU,OAAO,SAAS;IAC1B,KAAK,OAAO,SAAS;IACrB;IACA,UAAU,OAAO,SAAS;GAC5B;GACA,UAAU,EAAE,gBAAgB,OAAO,SAAS,YAAY;GACxD,QAAQ,OAAO,YACb,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACnD,MACA;IAAE,UAAU,MAAM;IAAU,gBAAgB,MAAM;GAAY,CAChE,CAAC,CACH;GACA,QACE,QAAQ,SAAS,IACb,QAAQ,KAAK,UAAU;IACrB,mBAAmB;IACnB,gBAAgB;GAClB,EAAE,IACF,KAAA;EACR;CACF,CAAC;CACH,OAAO,UAAU;EAAE,SAAS;EAAG;CAAQ,GAAG,EAAE,uBAAuB,MAAM,CAAC;AAC5E;;AAGA,MAAa,mBAAmB,EAC9B,OACA,aAC0C;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,OAAO,CAAC;CACpD,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAI,YAAY;CACpC,MAAM,WAAW,cAAc,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAAC,OAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,iBAAiB,cAAc,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJ,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,SAAS,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAU,KAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiB,OAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACE,OAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAAC,OAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAAC,OAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MACJ,UACC,CAAC,OAAO,KAAK,KACb,OAAO,MAAM,uBAAuB,YACpC,CAAC,QAAQ,SAAS,MAAM,kBAAkB,CAC9C,GAEA,OACE,UACA,GAAG,UAAU,kDACf;EACF,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MAAM,UAAmB,CAAC,kBAAkB,KAAK,CAAC,GAEzD,OACE,UACA,GAAG,UAAU,mLACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,CAAC,OAAO,MACL,UACC,OAAO,KAAK,KACZ,MAAM,uBAAuB,QAC7B,kBAAkB,KAAK,CAC3B,GAEA,OACE,UACA,GAAG,UAAU,8CAA8C,MAC7D;CAEN;CACA,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT"}

package/dist/toolchain-guard.cjs

@@ -1,22 +1,23 @@
 const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+const require_quarantine_policy = require("./quarantine-policy2.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
 const require_git_tracked_output = require("./git-tracked-output.cjs");
 const require_consumer_node_support = require("./consumer-node-support.cjs");
 const require_toolchain_dependabot = require("./toolchain-dependabot.cjs");
 require("./toolchain-schema.cjs");
-let node_fs = require("node:fs");
-let node_child_process = require("node:child_process");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let semver = require("semver");
+let node_fs = require("node:fs");
 let smol_toml = require("smol-toml");
+let node_child_process = require("node:child_process");
+let semver = require("semver");
 let yaml = require("yaml");
 let picomatch = require("picomatch");
 picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 let node_module = require("node:module");
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.4.0";
+const consumerRunnerVersion = "1.5.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -3886,7 +3887,8 @@ const toolchainRules = [.../* @__PURE__ */ new Set([
 	...runtimeRules,
 	...require_toolchain_dependabot.dependabotRules,
 	nodeProjectRule,
-	"cloud-setup-drift"
+	"cloud-setup-drift",
+	"quarantine-policy"
 ])];
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const array = (value) => Array.isArray(value);
@@ -3898,6 +3900,7 @@ const parseToolchainConfiguration = (input) => {
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
 	for (const entry of optOuts) {
 		if (!record(entry) || Object.keys(entry).some((key) => key !== "rule" && key !== "reason") || typeof entry["rule"] !== "string" || !toolchainRules.some((rule) => rule === entry["rule"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || disabled.has(entry["rule"])) throw new Error("each opt-out requires a unique known rule and a nonempty reason");
+		if (entry["rule"] === "quarantine-policy") throw new Error("quarantine-policy cannot be opted out; temporary third-party exclusions require expiry");
 		if (entry["rule"] === "rust-version") throw new Error("rust-version requires expiring exact-pin rustExceptions, not an opt-out");
 		if (entry["rule"] === "node-engine") throw new Error("node-engine cannot be opted out; engines.node must support the shared Node series");
 		if (entry["rule"] === "workflow-trust") throw new Error("workflow-trust cannot be opted out; repository commands must follow the declared trust decision");
@@ -3914,8 +3917,8 @@ const parseToolchainConfiguration = (input) => {
 		consumerChecks: parseConsumerChecks(input["consumerChecks"])
 	};
 };
-/** Read one tracked configuration snapshot for guards and policy generation. */
-const readToolchainInputs = (root) => {
+/** Dependency graphs stay opaque unless a caller explicitly needs registry identities. */
+const readToolchainInputs = (root, { bunLock = "presence" } = {}) => {
 	const diagnostics = [];
 	const tracked = require_git_tracked_output.readGitTrackedOutput(root, "staged").split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
 	const files = {};
@@ -3927,7 +3930,7 @@ const readToolchainInputs = (root) => {
 		if (kind === void 0 && !shebangCandidate) continue;
 		try {
 			const inputPath = node_path.default.join(resolvedRoot, file);
-			if (kind === "presence") {
+			if (kind === "presence" && !(file === "bun.lock" && bunLock === "content")) {
 				(0, node_fs.lstatSync)(inputPath);
 				files[file] = "";
 				continue;
@@ -3969,8 +3972,8 @@ const readToolchainInputs = (root) => {
 		diagnostics
 	};
 };
-const checkToolchain = ({ root, policy, onDelegated }) => {
-	const { files, trackedFiles, diagnostics } = readToolchainInputs(root);
+const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
+	const { files, trackedFiles, diagnostics } = readToolchainInputs(root, { bunLock: "content" });
 	let repository;
 	try {
 		const origin = (0, node_child_process.execFileSync)("git", [
@@ -4060,6 +4063,42 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		files,
 		policy
 	}));
+	if (Object.entries(files).some(([file, text]) => {
+		if (node_path.default.posix.basename(file) === "bun.lock") return true;
+		if (node_path.default.posix.basename(file) !== "package.json") return false;
+		try {
+			const manifest = JSON.parse(text);
+			return record(manifest) && typeof manifest["packageManager"] === "string" && /^bun(?:@|$)/u.test(manifest["packageManager"]);
+		} catch {
+			return false;
+		}
+	}) || files["bunfig.toml"] !== void 0) try {
+		if (files["bunfig.toml"] === void 0) throw new Error("Bun repositories require a tracked root bunfig.toml with the five-day quarantine policy; use the documented pinned bunx stll-quarantine --sync bootstrap, then commit bunfig.toml");
+		const result = require_quarantine_policy.checkRepositoryQuarantine({
+			files,
+			now,
+			npmrcPresent: trackedFiles.has(".npmrc")
+		});
+		for (const message of result.errors) diagnostics.push({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message
+		});
+		for (const message of result.warnings) onWarning?.({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message
+		});
+	} catch (error) {
+		diagnostics.push({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
 	if (files["package.json"] !== void 0) {
 		let manifest;
 		try {