@stll/oxlint-config 1.4.0 → 1.5.1

package/README.md

@@ -300,8 +300,33 @@ deleted from the working tree. Conflicting indexed or existing spellings are
 rejected, and unrelated unreadable inputs still stop generation. Repeated runs
 produce identical bytes; linked output files and directories are rejected.
 
+Use `stll-dependabot --check` in CI to compare bytes without writing. Missing or
+stale output exits with status 1; current output exits with status 0. Pass the
+same `--config` argument to write and check commands when using explicit input.
+
+An optional `--config stll-dependabot.json` input declares only coverage:
+
+```json
+{
+  "updates": [
+    { "ecosystem": "bun", "directories": ["/"] },
+    { "ecosystem": "github-actions", "directories": ["/"] },
+    { "ecosystem": "cargo", "directories": ["/native"] }
+  ]
+}
+```
+
+Each ecosystem appears once, and directories must be unique literal absolute
+repository paths. Declarations must cover every detected update root; they may
+also declare ecosystems whose manifests are outside automatic discovery.
+Shared `toolchain.json` owns the schedule, cooldown, groups, and tooling-owned
+package/action/image ignores. The input rejects policy overrides. Without
+`--config`, the tracked manifest inventory supplies ecosystem roots.
+
 For programmatic generation, the `@stll/oxlint-config/dependabot` subpath exports
-`generateDependabotConfig({ files, policy })` and `parseToolchainPolicy`:
+`generateDependabotConfig({ files, policy, updates? })`, `parseDependabotInput`,
+and `parseToolchainPolicy`. `parseDependabotInput` validates the JSON shape above
+and returns the `updates` array:
 
 ```ts
 import {
@@ -359,6 +384,18 @@ repository-relative path; its existing parent must be safe at runtime. Track an
 bunx --no-install stll-cloud-setup
 ```
 
+When PostgreSQL is enabled, the selected environment file contains `DATABASE_URL`
+and `POSTGRES_HOST`, `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_DB_NAME`,
+and `POSTGRES_ADDITIONAL_CONNECTION_DATA`. `DATABASE_URL` retains the
+`postgresql://` spelling; the component values assemble the same endpoint with
+`postgres://`. Additional connection data is empty by default.
+Remote Claude sessions receive these generated values as quoted `export`
+assignments after service startup succeeds. SessionStart does not source the
+selected environment file, and it preserves the configured `envFile` path for
+tools that load that file directly. Settings generation migrates only exact
+SessionStart hooks from releases 1.1.0 and 1.3.1 and the prior main-branch form
+at 783bc97; edited or unknown hook forms fail with the canonical repair.
+
 Rust is optional. A tracked root `rust-toolchain.toml` enables it automatically;
 otherwise declare `cloud.rust` to enable it. `cloud.rust.toolchain`, when given,
 must be an exact stable Rust patch. The root toolchain file supplies the pin when
@@ -409,21 +446,26 @@ binary DEBs for the declared release and architecture, verifies the policy's
 SHA256 pins, and installs those local files with apt. It does not resolve Valkey
 from a mutable package index.
 The command writes `.agents/cloud-setup.sh` with executable permissions and
-merges a `SessionStart` hook into `.claude/settings.json`. The hook runs
-`bash "$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh" start` only when
-`CLAUDE_CODE_REMOTE=true`, including sessions that reuse cached filesystems and
-sessions started from a repository subdirectory. Generation replaces the exact hooks written by 1.1.0 and 1.3.1 in place.
-After successful startup, it appends the
-managed shell profile's literal exports to `CLAUDE_ENV_FILE` when available, so
-subsequent Claude commands select pinned runtimes and tools before preinstalled
-versions while retaining their inherited `PATH`. The settings also set
+merges a `SessionStart` hook into `.claude/settings.json`. Only when
+`CLAUDE_CODE_REMOTE=true`, the hook runs
+`bash "$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh" session` if `CLAUDE_ENV_FILE`
+is nonempty, and `start` otherwise. This includes sessions that reuse cached
+filesystems and sessions started from a repository subdirectory. Generation
+replaces the exact hooks written by 1.1.0 and 1.3.1 and the prior main-branch
+form in place.
+After successful startup, the hook copies existing `CLAUDE_ENV_FILE` content
+into a temporary file in the same directory, adds the generated service exports
+and managed shell profile's literal exports, then renames it over the destination.
+The resulting file has mode `0600`; an existing destination must be a regular,
+non-symlink file. Subsequent Claude commands select pinned runtimes and tools
+before preinstalled versions while retaining their inherited `PATH`. The settings also set
 `"attribution": {"commit": "", "pr": ""}`, so cloud sessions add no tool
 attribution to commits or pull requests. Existing environment-file
 content, unrelated settings, and hooks are preserved. Invalid JSON, disabled
 hooks, conflicting cloud startup entries, or a different `attribution` value stop
 generation with a repair instruction. Startup or environment persistence failures
 produce actionable session context and a stderr reason; SessionStart cannot block
-a session. Successful startup is silent on stdout. Commit both generated files.
+a session. Successful hook execution is silent on stdout. Commit both generated files.
 Generation refuses symlink parents or destinations and hard-linked destinations.
 Generation recreates its deleted tracked output files and requires unrelated
 tracked inputs to remain readable.
@@ -435,21 +477,26 @@ prints usage without reading repository configuration.
 
 | Environment phase       | Command                               |
 | ----------------------- | ------------------------------------- |
-| Networked install       | `bash .agents/cloud-setup.sh install` |
-| Offline session startup | `bash .agents/cloud-setup.sh start`   |
+| Networked install       | `bash .agents/cloud-setup.sh install`   |
+| Offline session startup | `bash .agents/cloud-setup.sh start`     |
+| Startup with exports    | `bash .agents/cloud-setup.sh session`   |
 
 Runtime installation repairs and verifies a missing or empty system CA bundle
 offline before any apt refresh or download, including when the certificate package
 is already current. If the certificate updater is unavailable or cannot restore
 trust, restore the base image offline before rerunning installation.
 
-Both commands can be rerun. Missing or unknown subcommands print usage and
+All three commands can be rerun. Passwordless sudo rules limited to specific
+script arguments must authorize `install`, `start`, and `session`.
+Missing or unknown subcommands print usage and
 exit 2; there is no implicit lifecycle mode. The script supports Ubuntu 24.04
 with root access or passwordless sudo and fails when required capabilities
 or pinned installations are unavailable. `install` provisions runtimes,
 dependencies, and declared services; `start` refreshes the managed shell environment
 and restores local services after
-cached environments lose running processes. Services bind only to localhost.
+cached environments lose running processes. `session` performs the same offline
+startup, sends startup output to stderr, and emits the declared service environment
+exports on stdout for the hook to capture. Services bind only to localhost.
 System provisioning runs as root; frozen dependencies run as the invoking user
 with that user's home and a private, user-owned Bun cache. Package installation
 does not permit automatic downgrades.
@@ -938,3 +985,32 @@ fail closed. This is an ownership check for ordinary authored package scripts,
 not a security boundary against deliberately obfuscated code or lint invocations
 hidden inside arbitrary program bodies. Unsupported forms require an explicit
 supported script invocation or a separately tested extension to the model.
+
+## Quarantine preset and expiry checks
+
+Run `bunx --no-install stll-quarantine --sync` before installation to create the
+five-day Bun preset and synchronize permanent exact-name `@stll/` exemptions.
+The command derives registry identities from dependency declarations and the
+root Bun lockfile, including transitive platform packages. Existing first-party
+creation timestamps remain stable across runs; they are not expiries.
+
+Third-party entries require `# quarantine-expires: YYYY-MM-DDTHH:mm:ss.sssZ`.
+`stll-toolchain-check` warns 48 hours before expiry; warnings continue through
+the existing 24-hour removal grace, after which expired entries fail. The
+quarantine rule cannot be opted out. `stll-quarantine --check` is read-only;
+`--prune` removes expired third-party entries without removing first-party ones.
+`--help` lists modes. Linked output files are rejected.
+
+`@stll/oxlint-config/quarantine` exports the Node-compatible repository helpers
+`checkRepositoryQuarantine`, `synchronizeRepositoryQuarantine`, and
+`pruneRepositoryQuarantine`, accepting a tracked `files` snapshot and optional
+`now`. The toolchain API reports advisory expiry messages through `onWarning`;
+its returned diagnostics remain failures. Snapshot readers keep lockfiles
+opaque by default; `{ bunLock: "content" }` explicitly requests the root graph
+when quarantine identity checks need it.
+
+The shared scheduled workflow imports the same dependency-free policy core
+from an exact tooling commit; it does not install consumer dependencies to
+perform enforcement or pruning. Its stable removal branch updates one PR per
+repository. See the [root guide](../../README.md#package-quarantine) for the
+inline annotation format and adoption boundary.

package/dist/cloud-setup-cli.cjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_file = require("./generated-file.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
 const require_toolchain_guard = require("./toolchain-guard.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
-const require_generated_file = require("./generated-file.cjs");
-let node_fs = require("node:fs");
-let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
 //#region src/cloud-setup-cli.ts
 const usage = "Usage: stll-cloud-setup (run from repository root)\n       stll-cloud-setup --help";
 const readClaudeSettings = async (destination) => {

package/dist/cloud-setup-cli.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
+import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
 import { S as generateCloudSetup, _ as cloudSessionStartFix, b as mergeCloudClaudeSettings, g as cloudClaudeSettingsPath, x as cloudSetupPath } from "./toolchain-inputs.mjs";
 import { n as parseToolchainConfiguration, r as readToolchainInputs } from "./toolchain-guard.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
-import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
-import { constants } from "node:fs";
-import { join } from "node:path";
 import { open, readFile, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { constants } from "node:fs";
 //#region src/cloud-setup-cli.ts
 const usage = "Usage: stll-cloud-setup (run from repository root)\n       stll-cloud-setup --help";
 const readClaudeSettings = async (destination) => {

package/dist/consumer-compat-cli.cjs

@@ -4,14 +4,14 @@ const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 const require_consumer_node_support = require("./consumer-node-support.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
 const require_publish_artifact_syntax = require("./publish-artifact-syntax.cjs");
-let node_child_process = require("node:child_process");
+let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_child_process = require("node:child_process");
 let node_crypto = require("node:crypto");
 let semver = require("semver");
 let yaml = require("yaml");
 let node_os = require("node:os");
-let node_fs_promises = require("node:fs/promises");
 //#region src/consumer-build-approvals.ts
 const consumerBuildApprovals = async ({ manifest, lock, manager, directory }) => {
 	if (!require_consumer_node_support.consumerRecord(lock)) throw new Error("invalid consumer dependency lock");

package/dist/consumer-compat-cli.mjs

@@ -2,13 +2,13 @@
 import { _ as bunCatalogState, a as assertConsumerFixtureSelection, c as consumerDependencyConfigFiles, d as consumerRecord, f as consumerRelativePath, g as parseConsumerFixtures, h as discoverConsumerPackages, i as assertConsumerFixtureManifest, l as consumerPackRootManifest, m as discoverConsumerManifests, p as consumerStagingPaths, r as assertConsumerFixtureKind, s as bindConsumerManifest, t as assertConsumerNodeSupport, u as consumerPackageClosure, v as catalogState, y as pnpmWorkspaceState } from "./consumer-node-support.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
 import { i as parsePublishContract, n as readPackedSyntaxFiles, o as consumerReleasePackArguments, r as checkPublishContract, s as resolveConsumerReleasePack, t as checkPackedJavaScriptWithNode } from "./publish-artifact-syntax.mjs";
-import { spawn } from "node:child_process";
+import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { compare, satisfies, valid, validRange } from "semver";
 import { parse as parse$1, stringify } from "yaml";
 import { tmpdir } from "node:os";
-import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from "node:fs/promises";
 //#region src/consumer-build-approvals.ts
 const consumerBuildApprovals = async ({ manifest, lock, manager, directory }) => {
 	if (!consumerRecord(lock)) throw new Error("invalid consumer dependency lock");

package/dist/dependabot-cli.cjs

@@ -1,21 +1,37 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_file = require("./generated-file.cjs");
 const require_toolchain_guard = require("./toolchain-guard.cjs");
 const require_toolchain_dependabot = require("./toolchain-dependabot.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
 require("./dependabot.cjs");
-const require_generated_file = require("./generated-file.cjs");
-let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
 //#region src/dependabot-cli.ts
-const usage = "Usage: stll-dependabot (run from repository root)\n       stll-dependabot --help";
+const usage = "Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\n       stll-dependabot --help";
 const main = async () => {
 	const args = process.argv.slice(2);
 	if (args.length === 1 && args.at(0) === "--help") {
 		process.stdout.write(`${usage}\n`);
 		return;
 	}
-	if (args.length !== 0) throw new Error(usage);
+	let mode = "write";
+	let config;
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index];
+		if (arg === "--check" && mode === "write") {
+			mode = "check";
+			continue;
+		}
+		if (arg === "--config" && config === void 0) {
+			const next = args.at(index + 1);
+			if (next === void 0 || next.startsWith("--")) throw new Error(usage);
+			config = next;
+			index++;
+			continue;
+		}
+		throw new Error(usage);
+	}
 	const root = await (0, node_fs_promises.realpath)(process.cwd());
 	const { files, trackedFiles, diagnostics } = require_toolchain_guard.readToolchainInputs(root);
 	const policy = require_toolchain_schema.parseToolchainPolicy(JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8")));
@@ -46,15 +62,23 @@ const main = async () => {
 		}]
 	});
 	if (remainingDiagnostics.length !== 0) throw new Error(remainingDiagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
+	const declarations = config === void 0 ? void 0 : require_toolchain_dependabot.parseDependabotInput(JSON.parse(await (0, node_fs_promises.readFile)((0, node_path.resolve)(root, config), "utf8")));
+	const text = require_toolchain_dependabot.generateDependabotConfig({
+		files,
+		policy: policy.dependabot,
+		updates: declarations
+	});
 	const destination = selected.path;
-	const mode = selected.stat?.mode;
+	if (mode === "check") {
+		if (selected.stat === void 0 || await (0, node_fs_promises.readFile)(destination, "utf8") !== text) throw new Error(`${selected.relative} has drifted; run stll-dependabot${config === void 0 ? "" : ` --config ${config}`}`);
+		process.stdout.write(`Verified ${selected.relative}\n`);
+		return;
+	}
+	const permissions = selected.stat?.mode;
 	await require_generated_file.writeGeneratedFile({
 		destination,
-		text: require_toolchain_dependabot.generateDependabotConfig({
-			files,
-			policy: policy.dependabot
-		}),
-		mode: mode === void 0 ? 420 : mode & 511
+		text,
+		mode: permissions === void 0 ? 420 : permissions & 511
 	});
 	process.stdout.write(`Generated ${selected.relative}\n`);
 };

package/dist/dependabot-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"dependabot-cli.cjs","names":["realpath","readToolchainInputs","parseToolchainPolicy","readFile","join","checkGeneratedOutput","generationDiagnostics","writeGeneratedFile","generateDependabotConfig"],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { generateDependabotConfig, parseToolchainPolicy } from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const destination = selected.path;\n  const mode = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text: generateDependabotConfig({ files, policy: policy.dependabot }),\n    mode: mode === undefined ? 0o644 : mode & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACrE,MAAM,SAASC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,QAAA,GAAOC,UAAAA,KAAAA,CAAK,MAAM,yBAAyB;CACjD,MAAM,OAAA,GAAMA,UAAAA,KAAAA,CAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAMC,uBAAAA,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAMA,uBAAAA,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAMC,uBAAAA,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,cAAc,SAAS;CAC7B,MAAM,OAAO,SAAS,MAAM;CAC5B,MAAMC,uBAAAA,mBAAmB;EACvB;EACA,MAAMC,6BAAAA,yBAAyB;GAAE;GAAO,QAAQ,OAAO;EAAW,CAAC;EACnE,MAAM,SAAS,KAAA,IAAY,MAAQ,OAAO;CAC5C,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"dependabot-cli.cjs","names":["realpath","readToolchainInputs","parseToolchainPolicy","readFile","join","checkGeneratedOutput","generationDiagnostics","parseDependabotInput","resolve","generateDependabotConfig","writeGeneratedFile"],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport {\n  generateDependabotConfig,\n  parseDependabotInput,\n  parseToolchainPolicy,\n} from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  let mode: \"write\" | \"check\" = \"write\";\n  let config: string | undefined;\n  for (let index = 0; index < args.length; index++) {\n    const arg = args[index];\n    if (arg === \"--check\" && mode === \"write\") {\n      mode = \"check\";\n      continue;\n    }\n    if (arg === \"--config\" && config === undefined) {\n      const next = args.at(index + 1);\n      if (next === undefined || next.startsWith(\"--\")) throw new Error(usage);\n      config = next;\n      index++;\n      continue;\n    }\n    throw new Error(usage);\n  }\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const declarations =\n    config === undefined\n      ? undefined\n      : parseDependabotInput(\n          JSON.parse(await readFile(resolve(root, config), \"utf8\")),\n        );\n  const text = generateDependabotConfig({\n    files,\n    policy: policy.dependabot,\n    updates: declarations,\n  });\n  const destination = selected.path;\n  if (mode === \"check\") {\n    if (\n      selected.stat === undefined ||\n      (await readFile(destination, \"utf8\")) !== text\n    )\n      throw new Error(\n        `${selected.relative} has drifted; run stll-dependabot${config === undefined ? \"\" : ` --config ${config}`}`,\n      );\n    process.stdout.write(`Verified ${selected.relative}\\n`);\n    return;\n  }\n  const permissions = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text,\n    mode: permissions === undefined ? 0o644 : permissions & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,OAA0B;CAC9B,IAAI;CACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,aAAa,SAAS,SAAS;GACzC,OAAO;GACP;EACF;EACA,IAAI,QAAQ,cAAc,WAAW,KAAA,GAAW;GAC9C,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;GACtE,SAAS;GACT;GACA;EACF;EACA,MAAM,IAAI,MAAM,KAAK;CACvB;CACA,MAAM,OAAO,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACrE,MAAM,SAASC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,QAAA,GAAOC,UAAAA,KAAAA,CAAK,MAAM,yBAAyB;CACjD,MAAM,OAAA,GAAMA,UAAAA,KAAAA,CAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAMC,uBAAAA,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAMA,uBAAAA,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAMC,uBAAAA,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,eACJ,WAAW,KAAA,IACP,KAAA,IACAC,6BAAAA,qBACE,KAAK,MAAM,OAAA,GAAMJ,iBAAAA,SAAAA,EAAAA,GAASK,UAAAA,QAAAA,CAAQ,MAAM,MAAM,GAAG,MAAM,CAAC,CAC1D;CACN,MAAM,OAAOC,6BAAAA,yBAAyB;EACpC;EACA,QAAQ,OAAO;EACf,SAAS;CACX,CAAC;CACD,MAAM,cAAc,SAAS;CAC7B,IAAI,SAAS,SAAS;EACpB,IACE,SAAS,SAAS,KAAA,KACjB,OAAA,GAAMN,iBAAAA,SAAAA,CAAS,aAAa,MAAM,MAAO,MAE1C,MAAM,IAAI,MACR,GAAG,SAAS,SAAS,mCAAmC,WAAW,KAAA,IAAY,KAAK,aAAa,UACnG;EACF,QAAQ,OAAO,MAAM,YAAY,SAAS,SAAS,GAAG;EACtD;CACF;CACA,MAAM,cAAc,SAAS,MAAM;CACnC,MAAMO,uBAAAA,mBAAmB;EACvB;EACA;EACA,MAAM,gBAAgB,KAAA,IAAY,MAAQ,cAAc;CAC1D,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/dependabot-cli.mjs

@@ -1,20 +1,36 @@
 #!/usr/bin/env node
+import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
 import { r as readToolchainInputs } from "./toolchain-guard.mjs";
-import { r as generateDependabotConfig } from "./toolchain-dependabot.mjs";
+import { i as parseDependabotInput, r as generateDependabotConfig } from "./toolchain-dependabot.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
 import "./dependabot.mjs";
-import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
-import { join } from "node:path";
 import { readFile, realpath } from "node:fs/promises";
+import { join, resolve } from "node:path";
 //#region src/dependabot-cli.ts
-const usage = "Usage: stll-dependabot (run from repository root)\n       stll-dependabot --help";
+const usage = "Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\n       stll-dependabot --help";
 const main = async () => {
 	const args = process.argv.slice(2);
 	if (args.length === 1 && args.at(0) === "--help") {
 		process.stdout.write(`${usage}\n`);
 		return;
 	}
-	if (args.length !== 0) throw new Error(usage);
+	let mode = "write";
+	let config;
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index];
+		if (arg === "--check" && mode === "write") {
+			mode = "check";
+			continue;
+		}
+		if (arg === "--config" && config === void 0) {
+			const next = args.at(index + 1);
+			if (next === void 0 || next.startsWith("--")) throw new Error(usage);
+			config = next;
+			index++;
+			continue;
+		}
+		throw new Error(usage);
+	}
 	const root = await realpath(process.cwd());
 	const { files, trackedFiles, diagnostics } = readToolchainInputs(root);
 	const policy = parseToolchainPolicy(JSON.parse(await readFile(new URL("../toolchain.json", import.meta.url), "utf8")));
@@ -45,15 +61,23 @@ const main = async () => {
 		}]
 	});
 	if (remainingDiagnostics.length !== 0) throw new Error(remainingDiagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
+	const declarations = config === void 0 ? void 0 : parseDependabotInput(JSON.parse(await readFile(resolve(root, config), "utf8")));
+	const text = generateDependabotConfig({
+		files,
+		policy: policy.dependabot,
+		updates: declarations
+	});
 	const destination = selected.path;
-	const mode = selected.stat?.mode;
+	if (mode === "check") {
+		if (selected.stat === void 0 || await readFile(destination, "utf8") !== text) throw new Error(`${selected.relative} has drifted; run stll-dependabot${config === void 0 ? "" : ` --config ${config}`}`);
+		process.stdout.write(`Verified ${selected.relative}\n`);
+		return;
+	}
+	const permissions = selected.stat?.mode;
 	await writeGeneratedFile({
 		destination,
-		text: generateDependabotConfig({
-			files,
-			policy: policy.dependabot
-		}),
-		mode: mode === void 0 ? 420 : mode & 511
+		text,
+		mode: permissions === void 0 ? 420 : permissions & 511
 	});
 	process.stdout.write(`Generated ${selected.relative}\n`);
 };

package/dist/dependabot-cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dependabot-cli.mjs","names":[],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { generateDependabotConfig, parseToolchainPolicy } from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const destination = selected.path;\n  const mode = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text: generateDependabotConfig({ files, policy: policy.dependabot }),\n    mode: mode === undefined ? 0o644 : mode & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,IAAI;CACrE,MAAM,SAAS,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,MAAM,CACtE,CACF;CACA,MAAM,OAAO,KAAK,MAAM,yBAAyB;CACjD,MAAM,MAAM,KAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAM,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAM,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAM,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,cAAc,SAAS;CAC7B,MAAM,OAAO,SAAS,MAAM;CAC5B,MAAM,mBAAmB;EACvB;EACA,MAAM,yBAAyB;GAAE;GAAO,QAAQ,OAAO;EAAW,CAAC;EACnE,MAAM,SAAS,KAAA,IAAY,MAAQ,OAAO;CAC5C,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"dependabot-cli.mjs","names":[],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport {\n  generateDependabotConfig,\n  parseDependabotInput,\n  parseToolchainPolicy,\n} from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  let mode: \"write\" | \"check\" = \"write\";\n  let config: string | undefined;\n  for (let index = 0; index < args.length; index++) {\n    const arg = args[index];\n    if (arg === \"--check\" && mode === \"write\") {\n      mode = \"check\";\n      continue;\n    }\n    if (arg === \"--config\" && config === undefined) {\n      const next = args.at(index + 1);\n      if (next === undefined || next.startsWith(\"--\")) throw new Error(usage);\n      config = next;\n      index++;\n      continue;\n    }\n    throw new Error(usage);\n  }\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const declarations =\n    config === undefined\n      ? undefined\n      : parseDependabotInput(\n          JSON.parse(await readFile(resolve(root, config), \"utf8\")),\n        );\n  const text = generateDependabotConfig({\n    files,\n    policy: policy.dependabot,\n    updates: declarations,\n  });\n  const destination = selected.path;\n  if (mode === \"check\") {\n    if (\n      selected.stat === undefined ||\n      (await readFile(destination, \"utf8\")) !== text\n    )\n      throw new Error(\n        `${selected.relative} has drifted; run stll-dependabot${config === undefined ? \"\" : ` --config ${config}`}`,\n      );\n    process.stdout.write(`Verified ${selected.relative}\\n`);\n    return;\n  }\n  const permissions = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text,\n    mode: permissions === undefined ? 0o644 : permissions & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAgBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,OAA0B;CAC9B,IAAI;CACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,aAAa,SAAS,SAAS;GACzC,OAAO;GACP;EACF;EACA,IAAI,QAAQ,cAAc,WAAW,KAAA,GAAW;GAC9C,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;GACtE,SAAS;GACT;GACA;EACF;EACA,MAAM,IAAI,MAAM,KAAK;CACvB;CACA,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,IAAI;CACrE,MAAM,SAAS,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,MAAM,CACtE,CACF;CACA,MAAM,OAAO,KAAK,MAAM,yBAAyB;CACjD,MAAM,MAAM,KAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAM,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAM,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAM,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,eACJ,WAAW,KAAA,IACP,KAAA,IACA,qBACE,KAAK,MAAM,MAAM,SAAS,QAAQ,MAAM,MAAM,GAAG,MAAM,CAAC,CAC1D;CACN,MAAM,OAAO,yBAAyB;EACpC;EACA,QAAQ,OAAO;EACf,SAAS;CACX,CAAC;CACD,MAAM,cAAc,SAAS;CAC7B,IAAI,SAAS,SAAS;EACpB,IACE,SAAS,SAAS,KAAA,KACjB,MAAM,SAAS,aAAa,MAAM,MAAO,MAE1C,MAAM,IAAI,MACR,GAAG,SAAS,SAAS,mCAAmC,WAAW,KAAA,IAAY,KAAK,aAAa,UACnG;EACF,QAAQ,OAAO,MAAM,YAAY,SAAS,SAAS,GAAG;EACtD;CACF;CACA,MAAM,cAAc,SAAS,MAAM;CACnC,MAAM,mBAAmB;EACvB;EACA;EACA,MAAM,gBAAgB,KAAA,IAAY,MAAQ,cAAc;CAC1D,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/dependabot.cjs

@@ -2,4 +2,6 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_toolchain_dependabot = require("./toolchain-dependabot.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
 exports.generateDependabotConfig = require_toolchain_dependabot.generateDependabotConfig;
+exports.parseDependabotInput = require_toolchain_dependabot.parseDependabotInput;
 exports.parseToolchainPolicy = require_toolchain_schema.parseToolchainPolicy;
+exports.supportedDependabotEcosystems = require_toolchain_dependabot.supportedDependabotEcosystems;

package/dist/dependabot.d.cts

@@ -1,4 +1,6 @@
 //#region src/toolchain-dependabot.d.ts
+declare const supportedDependabotEcosystems: readonly ["bazel", "bun", "bundler", "cargo", "composer", "conda", "deno", "devcontainers", "docker", "docker-compose", "dotnet-sdk", "elm", "gitsubmodule", "github-actions", "gomod", "gradle", "helm", "julia", "maven", "mix", "nix", "npm", "nuget", "opentofu", "pip", "pre-commit", "pub", "rust-toolchain", "sbt", "swift", "terraform", "uv", "vcpkg"];
+type DependabotEcosystem = (typeof supportedDependabotEcosystems)[number];
 type DependabotPolicy = {
   schedule: {
     interval: string;
@@ -21,8 +23,16 @@ type CheckDependabotOptions = {
   files: Record<string, string>;
   policy: DependabotPolicy;
 };
+/** Repository declarations own coverage only; shared policy owns every update option. */
+declare const parseDependabotInput: (input: unknown) => {
+  ecosystem: "bazel" | "bun" | "bundler" | "cargo" | "composer" | "conda" | "deno" | "devcontainers" | "docker" | "docker-compose" | "dotnet-sdk" | "elm" | "github-actions" | "gitsubmodule" | "gomod" | "gradle" | "helm" | "julia" | "maven" | "mix" | "nix" | "npm" | "nuget" | "opentofu" | "pip" | "pre-commit" | "pub" | "rust-toolchain" | "sbt" | "swift" | "terraform" | "uv" | "vcpkg";
+  directories: string[];
+}[];
+type GenerateDependabotOptions = CheckDependabotOptions & {
+  updates?: ReturnType<typeof parseDependabotInput> | undefined;
+};
 /** Generate canonical YAML from the same ecosystem enumeration used by the guard. */
-declare const generateDependabotConfig: ({ files, policy }: CheckDependabotOptions) => string;
+declare const generateDependabotConfig: ({ files, policy, updates: declarations }: GenerateDependabotOptions) => string;
 //#endregion
 //#region src/toolchain-schema.d.ts
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
@@ -104,5 +114,5 @@ declare const parseToolchainPolicy: (input: unknown) => {
   };
 };
 //#endregion
-export { generateDependabotConfig, parseToolchainPolicy };
+export { type DependabotEcosystem, generateDependabotConfig, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };
 //# sourceMappingURL=dependabot.d.cts.map

package/dist/dependabot.d.mts

@@ -1,4 +1,6 @@
 //#region src/toolchain-dependabot.d.ts
+declare const supportedDependabotEcosystems: readonly ["bazel", "bun", "bundler", "cargo", "composer", "conda", "deno", "devcontainers", "docker", "docker-compose", "dotnet-sdk", "elm", "gitsubmodule", "github-actions", "gomod", "gradle", "helm", "julia", "maven", "mix", "nix", "npm", "nuget", "opentofu", "pip", "pre-commit", "pub", "rust-toolchain", "sbt", "swift", "terraform", "uv", "vcpkg"];
+type DependabotEcosystem = (typeof supportedDependabotEcosystems)[number];
 type DependabotPolicy = {
   schedule: {
     interval: string;
@@ -21,8 +23,16 @@ type CheckDependabotOptions = {
   files: Record<string, string>;
   policy: DependabotPolicy;
 };
+/** Repository declarations own coverage only; shared policy owns every update option. */
+declare const parseDependabotInput: (input: unknown) => {
+  ecosystem: "bazel" | "bun" | "bundler" | "cargo" | "composer" | "conda" | "deno" | "devcontainers" | "docker" | "docker-compose" | "dotnet-sdk" | "elm" | "github-actions" | "gitsubmodule" | "gomod" | "gradle" | "helm" | "julia" | "maven" | "mix" | "nix" | "npm" | "nuget" | "opentofu" | "pip" | "pre-commit" | "pub" | "rust-toolchain" | "sbt" | "swift" | "terraform" | "uv" | "vcpkg";
+  directories: string[];
+}[];
+type GenerateDependabotOptions = CheckDependabotOptions & {
+  updates?: ReturnType<typeof parseDependabotInput> | undefined;
+};
 /** Generate canonical YAML from the same ecosystem enumeration used by the guard. */
-declare const generateDependabotConfig: ({ files, policy }: CheckDependabotOptions) => string;
+declare const generateDependabotConfig: ({ files, policy, updates: declarations }: GenerateDependabotOptions) => string;
 //#endregion
 //#region src/toolchain-schema.d.ts
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
@@ -104,5 +114,5 @@ declare const parseToolchainPolicy: (input: unknown) => {
   };
 };
 //#endregion
-export { generateDependabotConfig, parseToolchainPolicy };
+export { type DependabotEcosystem, generateDependabotConfig, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };
 //# sourceMappingURL=dependabot.d.mts.map

package/dist/dependabot.mjs

@@ -1,3 +1,3 @@
-import { r as generateDependabotConfig } from "./toolchain-dependabot.mjs";
+import { a as supportedDependabotEcosystems, i as parseDependabotInput, r as generateDependabotConfig } from "./toolchain-dependabot.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
-export { generateDependabotConfig, parseToolchainPolicy };
+export { generateDependabotConfig, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };

package/dist/generated-file.cjs

@@ -1,6 +1,6 @@
-let node_fs = require("node:fs");
-let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
 //#region src/generated-file.ts
 const optionalStat = async (path) => {
 	try {

package/dist/generated-file.mjs

@@ -1,6 +1,6 @@
-import { constants } from "node:fs";
-import { dirname } from "node:path";
 import { lstat, mkdir, open } from "node:fs/promises";
+import { dirname } from "node:path";
+import { constants } from "node:fs";
 //#region src/generated-file.ts
 const optionalStat = async (path) => {
 	try {

package/dist/git-tracked-output.cjs

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime.cjs");
-let node_fs = require("node:fs");
-let node_child_process = require("node:child_process");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 //#region src/git-tracked-output.ts
 /** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */

package/dist/git-tracked-output.mjs

@@ -1,6 +1,6 @@
+import path from "node:path";
 import { closeSync, mkdtempSync, openSync, readFileSync, rmSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import path from "node:path";
 import { tmpdir } from "node:os";
 //#region src/git-tracked-output.ts
 /** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */

package/dist/jsonc.cjs

@@ -0,0 +1,66 @@
+//#region src/jsonc.ts
+/** JSONC permits comments and trailing commas, never alterations inside strings. */
+const parseJsonc = (text) => {
+	let clean = "";
+	let quote = false;
+	for (let index = 0; index < text.length; index++) {
+		const char = text[index];
+		if (quote) {
+			clean += char;
+			if (char === "\\") {
+				index++;
+				clean += text[index] ?? "";
+			} else if (char === "\"") quote = false;
+			continue;
+		}
+		if (char === "\"") {
+			quote = true;
+			clean += char;
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "/") {
+			while (index < text.length && text[index] !== "\n") index++;
+			clean += "\n";
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "*") {
+			index += 2;
+			while (index < text.length && !(text[index] === "*" && text[index + 1] === "/")) index++;
+			if (index >= text.length) throw new Error("Unterminated JSONC comment");
+			index++;
+			clean += " ";
+			continue;
+		}
+		clean += char;
+	}
+	let result = "";
+	quote = false;
+	for (let index = 0; index < clean.length; index++) {
+		const char = clean[index];
+		if (quote) {
+			result += char;
+			if (char === "\\") {
+				index++;
+				result += clean[index] ?? "";
+			} else if (char === "\"") quote = false;
+			continue;
+		}
+		if (char === "\"") quote = true;
+		if (char === ",") {
+			let next = index + 1;
+			while (/\s/.test(clean[next] ?? "") && next < clean.length) next++;
+			if (clean[next] === "}" || clean[next] === "]") continue;
+		}
+		result += char;
+	}
+	return JSON.parse(result);
+};
+//#endregion
+Object.defineProperty(exports, "parseJsonc", {
+	enumerable: true,
+	get: function() {
+		return parseJsonc;
+	}
+});
+
+//# sourceMappingURL=jsonc.cjs.map

package/dist/jsonc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonc.cjs","names":[],"sources":["../src/jsonc.ts"],"sourcesContent":["/** JSONC permits comments and trailing commas, never alterations inside strings. */\nexport const parseJsonc = (text: string): unknown => {\n  let clean = \"\";\n  let quote = false;\n  for (let index = 0; index < text.length; index++) {\n    const char = text[index];\n    if (quote) {\n      clean += char;\n      if (char === \"\\\\\") {\n        index++;\n        clean += text[index] ?? \"\";\n      } else if (char === '\"') quote = false;\n      continue;\n    }\n    if (char === '\"') {\n      quote = true;\n      clean += char;\n      continue;\n    }\n    if (char === \"/\" && text[index + 1] === \"/\") {\n      while (index < text.length && text[index] !== \"\\n\") index++;\n      clean += \"\\n\";\n      continue;\n    }\n    if (char === \"/\" && text[index + 1] === \"*\") {\n      index += 2;\n      while (\n        index < text.length &&\n        !(text[index] === \"*\" && text[index + 1] === \"/\")\n      )\n        index++;\n      if (index >= text.length) throw new Error(\"Unterminated JSONC comment\");\n      index++;\n      clean += \" \";\n      continue;\n    }\n    clean += char;\n  }\n  let result = \"\";\n  quote = false;\n  for (let index = 0; index < clean.length; index++) {\n    const char = clean[index];\n    if (quote) {\n      result += char;\n      if (char === \"\\\\\") {\n        index++;\n        result += clean[index] ?? \"\";\n      } else if (char === '\"') quote = false;\n      continue;\n    }\n    if (char === '\"') quote = true;\n    if (char === \",\") {\n      let next = index + 1;\n      while (/\\s/.test(clean[next] ?? \"\") && next < clean.length) next++;\n      if (clean[next] === \"}\" || clean[next] === \"]\") continue;\n    }\n    result += char;\n  }\n  return JSON.parse(result);\n};\n"],"mappings":";;AACA,MAAa,cAAc,SAA0B;CACnD,IAAI,QAAQ;CACZ,IAAI,QAAQ;CACZ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,OAAO,KAAK;EAClB,IAAI,OAAO;GACT,SAAS;GACT,IAAI,SAAS,MAAM;IACjB;IACA,SAAS,KAAK,UAAU;GAC1B,OAAO,IAAI,SAAS,MAAK,QAAQ;GACjC;EACF;EACA,IAAI,SAAS,MAAK;GAChB,QAAQ;GACR,SAAS;GACT;EACF;EACA,IAAI,SAAS,OAAO,KAAK,QAAQ,OAAO,KAAK;GAC3C,OAAO,QAAQ,KAAK,UAAU,KAAK,WAAW,MAAM;GACpD,SAAS;GACT;EACF;EACA,IAAI,SAAS,OAAO,KAAK,QAAQ,OAAO,KAAK;GAC3C,SAAS;GACT,OACE,QAAQ,KAAK,UACb,EAAE,KAAK,WAAW,OAAO,KAAK,QAAQ,OAAO,MAE7C;GACF,IAAI,SAAS,KAAK,QAAQ,MAAM,IAAI,MAAM,4BAA4B;GACtE;GACA,SAAS;GACT;EACF;EACA,SAAS;CACX;CACA,IAAI,SAAS;CACb,QAAQ;CACR,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM;EACnB,IAAI,OAAO;GACT,UAAU;GACV,IAAI,SAAS,MAAM;IACjB;IACA,UAAU,MAAM,UAAU;GAC5B,OAAO,IAAI,SAAS,MAAK,QAAQ;GACjC;EACF;EACA,IAAI,SAAS,MAAK,QAAQ;EAC1B,IAAI,SAAS,KAAK;GAChB,IAAI,OAAO,QAAQ;GACnB,OAAO,KAAK,KAAK,MAAM,SAAS,EAAE,KAAK,OAAO,MAAM,QAAQ;GAC5D,IAAI,MAAM,UAAU,OAAO,MAAM,UAAU,KAAK;EAClD;EACA,UAAU;CACZ;CACA,OAAO,KAAK,MAAM,MAAM;AAC1B"}