@stll/oxlint-config 1.5.2 → 1.6.0

package/README.md

@@ -323,10 +323,47 @@ Shared `toolchain.json` owns the schedule, cooldown, groups, and tooling-owned
 package/action/image ignores. The input rejects policy overrides. Without
 `--config`, the tracked manifest inventory supplies ecosystem roots.
 
+A repository that deliberately holds a dependency declares the decision in
+tracked root `stll-toolchain.json`:
+
+```json
+{
+  "dependabotIgnores": [
+    {
+      "ecosystem": "bun",
+      "dependency": "graphql",
+      "updateTypes": ["version-update:semver-major"],
+      "reason": "Payload 3 requires graphql ^16."
+    },
+    {
+      "ecosystem": "github-actions",
+      "dependency": "owner/repo/.github/workflows/reusable.yml",
+      "updateTypes": [
+        "version-update:semver-major",
+        "version-update:semver-minor",
+        "version-update:semver-patch"
+      ],
+      "reason": "Newer commits no longer ship this reusable workflow."
+    }
+  ]
+}
+```
+
+`dependency` is Dependabot's `dependency-name`; `*` is the only wildcard
+(`@babel/*`). `updateTypes` is a nonempty set of version-update types, so
+security updates stay enabled. Each declaration needs a supported ecosystem with
+a generated update entry and a nonempty reason; duplicates fail. A declaration
+that names or matches a shared pin fails configuration validation: the shared
+policy owns those ignores. The generator appends declarations after the shared
+pins in code-unit order with canonical update types, so output stays
+byte-stable. `stll-toolchain-check` accepts exactly the shared pins plus these
+declarations; any other ignore fails.
+
 For programmatic generation, the `@stll/oxlint-config/dependabot` subpath exports
-`generateDependabotConfig({ files, policy, updates? })`, `parseDependabotInput`,
-and `parseToolchainPolicy`. `parseDependabotInput` validates the JSON shape above
-and returns the `updates` array:
+`generateDependabotConfig({ files, policy, updates?, ignores? })`,
+`parseDependabotInput`, `parseDependabotIgnores` and `parseToolchainPolicy`.
+`parseDependabotInput` validates the JSON shape above and returns the `updates`
+array; `parseDependabotIgnores` validates `dependabotIgnores` for `ignores`:
 
 ```ts
 import {
@@ -477,9 +514,9 @@ prints usage without reading repository configuration.
 
 | Environment phase       | Command                               |
 | ----------------------- | ------------------------------------- |
-| Networked install       | `bash .agents/cloud-setup.sh install`   |
-| Offline session startup | `bash .agents/cloud-setup.sh start`     |
-| Startup with exports    | `bash .agents/cloud-setup.sh session`   |
+| Networked install       | `bash .agents/cloud-setup.sh install` |
+| Offline session startup | `bash .agents/cloud-setup.sh start`   |
+| Startup with exports    | `bash .agents/cloud-setup.sh session` |
 
 Runtime installation repairs and verifies a missing or empty system CA bundle
 offline before any apt refresh or download, including when the certificate package
@@ -555,6 +592,19 @@ performs no downloads.
 
 ## Published package contracts
 
+### Engine support releases
+
+Run `stll-engine-support --base <git ref>` in pull request CI to require a major
+changeset when an existing published package narrows its `engines.node` range.
+Base engine ranges are read from the manifest at each HEAD package directory.
+Packages moved or renamed between the base and HEAD are therefore treated as new
+packages and skipped. A missing range means unrestricted Node support.
+
+Only published workspace packages managed by Changesets and absent from its
+`ignore` list are checked. Derived platform packages and ignored packages are
+not checked separately; their owner package carries the engine range users
+install against.
+
 Run `stll-publish-contract` in PR CI. Every published root or declared workspace
 package commits `publish-contract.json`, recording engines, peer support ranges,
 resolved JavaScript targets, and entry points. `stll-publish-contract --write`
@@ -1014,3 +1064,36 @@ from an exact tooling commit; it does not install consumer dependencies to
 perform enforcement or pruning. Its stable removal branch updates one PR per
 repository. See the [root guide](../../README.md#package-quarantine) for the
 inline annotation format and adoption boundary.
+
+## Normalize generated WASI loaders
+
+Run `stll-normalize-wasi-loaders <loader-1> <loader-2>` after `@napi-rs/cli`
+generates the two WASI loaders. Arguments may appear in either order: the
+`.wasi-browser.js` and `.wasi.cjs` suffixes select the loader kind, and any other
+suffix produces an unsupported-file error.
+
+The normalizer applies these exact transformations:
+
+- **cleanup handshake:** wraps the cleanup macrotask scheduler so synchronous
+  completion settles safely and thrown scheduler errors reject the promise.
+- **runtime poll promise:** adds the rejection path used by the scheduler wrapper.
+- **runtime poll timer:** runs the paced runtime timer through the scheduler wrapper.
+- **runtime poll macrotask:** runs the early runtime macrotask through the scheduler
+  wrapper.
+- **async work poll:** runs the async-work timer through the scheduler wrapper.
+- **worker construction:** builds named worker data and options objects; the browser
+  loader receives the add-on crash flag, while the CommonJS loader keeps its crash
+  data and retries invalid `execArgv` by updating the shared options.
+- **scheduler helper:** adds the wrapper that handles synchronous completion and
+  converts thrown scheduler errors into promise rejections.
+- **artifact metadata:** keeps napi-rs artifact metadata on line 1 when present.
+- **generated-file header:** removes leading generator directives and writes the
+  standard `@ts-nocheck` header immediately after metadata, or first when metadata
+  is absent.
+
+Each named transformation must have its exact expected count. The command fails
+closed and writes nothing unless both inputs normalize successfully.
+
+Use `stll-normalize-wasi-loaders --check <loader-1> <loader-2>` in CI. Check mode
+does not write files and exits non-zero if either loader differs from the normalized
+output.

package/dist/dependabot-cli.cjs

@@ -63,10 +63,12 @@ const main = async () => {
 	});
 	if (remainingDiagnostics.length !== 0) throw new Error(remainingDiagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
 	const declarations = config === void 0 ? void 0 : require_toolchain_dependabot.parseDependabotInput(JSON.parse(await (0, node_fs_promises.readFile)((0, node_path.resolve)(root, config), "utf8")));
+	const dependabotIgnores = require_toolchain_dependabot.readDependabotIgnores(files["stll-toolchain.json"]);
 	const text = require_toolchain_dependabot.generateDependabotConfig({
 		files,
 		policy: policy.dependabot,
-		updates: declarations
+		updates: declarations,
+		ignores: dependabotIgnores
 	});
 	const destination = selected.path;
 	if (mode === "check") {

package/dist/dependabot-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"dependabot-cli.cjs","names":["realpath","readToolchainInputs","parseToolchainPolicy","readFile","join","checkGeneratedOutput","generationDiagnostics","parseDependabotInput","resolve","generateDependabotConfig","writeGeneratedFile"],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport {\n  generateDependabotConfig,\n  parseDependabotInput,\n  parseToolchainPolicy,\n} from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  let mode: \"write\" | \"check\" = \"write\";\n  let config: string | undefined;\n  for (let index = 0; index < args.length; index++) {\n    const arg = args[index];\n    if (arg === \"--check\" && mode === \"write\") {\n      mode = \"check\";\n      continue;\n    }\n    if (arg === \"--config\" && config === undefined) {\n      const next = args.at(index + 1);\n      if (next === undefined || next.startsWith(\"--\")) throw new Error(usage);\n      config = next;\n      index++;\n      continue;\n    }\n    throw new Error(usage);\n  }\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const declarations =\n    config === undefined\n      ? undefined\n      : parseDependabotInput(\n          JSON.parse(await readFile(resolve(root, config), \"utf8\")),\n        );\n  const text = generateDependabotConfig({\n    files,\n    policy: policy.dependabot,\n    updates: declarations,\n  });\n  const destination = selected.path;\n  if (mode === \"check\") {\n    if (\n      selected.stat === undefined ||\n      (await readFile(destination, \"utf8\")) !== text\n    )\n      throw new Error(\n        `${selected.relative} has drifted; run stll-dependabot${config === undefined ? \"\" : ` --config ${config}`}`,\n      );\n    process.stdout.write(`Verified ${selected.relative}\\n`);\n    return;\n  }\n  const permissions = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text,\n    mode: permissions === undefined ? 0o644 : permissions & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,OAA0B;CAC9B,IAAI;CACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,aAAa,SAAS,SAAS;GACzC,OAAO;GACP;EACF;EACA,IAAI,QAAQ,cAAc,WAAW,KAAA,GAAW;GAC9C,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;GACtE,SAAS;GACT;GACA;EACF;EACA,MAAM,IAAI,MAAM,KAAK;CACvB;CACA,MAAM,OAAO,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACrE,MAAM,SAASC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,QAAA,GAAOC,UAAAA,KAAAA,CAAK,MAAM,yBAAyB;CACjD,MAAM,OAAA,GAAMA,UAAAA,KAAAA,CAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAMC,uBAAAA,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAMA,uBAAAA,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAMC,uBAAAA,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,eACJ,WAAW,KAAA,IACP,KAAA,IACAC,6BAAAA,qBACE,KAAK,MAAM,OAAA,GAAMJ,iBAAAA,SAAAA,EAAAA,GAASK,UAAAA,QAAAA,CAAQ,MAAM,MAAM,GAAG,MAAM,CAAC,CAC1D;CACN,MAAM,OAAOC,6BAAAA,yBAAyB;EACpC;EACA,QAAQ,OAAO;EACf,SAAS;CACX,CAAC;CACD,MAAM,cAAc,SAAS;CAC7B,IAAI,SAAS,SAAS;EACpB,IACE,SAAS,SAAS,KAAA,KACjB,OAAA,GAAMN,iBAAAA,SAAAA,CAAS,aAAa,MAAM,MAAO,MAE1C,MAAM,IAAI,MACR,GAAG,SAAS,SAAS,mCAAmC,WAAW,KAAA,IAAY,KAAK,aAAa,UACnG;EACF,QAAQ,OAAO,MAAM,YAAY,SAAS,SAAS,GAAG;EACtD;CACF;CACA,MAAM,cAAc,SAAS,MAAM;CACnC,MAAMO,uBAAAA,mBAAmB;EACvB;EACA;EACA,MAAM,gBAAgB,KAAA,IAAY,MAAQ,cAAc;CAC1D,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"dependabot-cli.cjs","names":["realpath","readToolchainInputs","parseToolchainPolicy","readFile","join","checkGeneratedOutput","generationDiagnostics","parseDependabotInput","resolve","readDependabotIgnores","generateDependabotConfig","writeGeneratedFile"],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport {\n  generateDependabotConfig,\n  parseDependabotInput,\n  parseToolchainPolicy,\n} from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readDependabotIgnores } from \"./toolchain-dependabot\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  let mode: \"write\" | \"check\" = \"write\";\n  let config: string | undefined;\n  for (let index = 0; index < args.length; index++) {\n    const arg = args[index];\n    if (arg === \"--check\" && mode === \"write\") {\n      mode = \"check\";\n      continue;\n    }\n    if (arg === \"--config\" && config === undefined) {\n      const next = args.at(index + 1);\n      if (next === undefined || next.startsWith(\"--\")) throw new Error(usage);\n      config = next;\n      index++;\n      continue;\n    }\n    throw new Error(usage);\n  }\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const declarations =\n    config === undefined\n      ? undefined\n      : parseDependabotInput(\n          JSON.parse(await readFile(resolve(root, config), \"utf8\")),\n        );\n  // Shared-pin conflicts and invalid declarations still throw in the generator and parser.\n  const dependabotIgnores = readDependabotIgnores(files[\"stll-toolchain.json\"]);\n  const text = generateDependabotConfig({\n    files,\n    policy: policy.dependabot,\n    updates: declarations,\n    ignores: dependabotIgnores,\n  });\n  const destination = selected.path;\n  if (mode === \"check\") {\n    if (\n      selected.stat === undefined ||\n      (await readFile(destination, \"utf8\")) !== text\n    )\n      throw new Error(\n        `${selected.relative} has drifted; run stll-dependabot${config === undefined ? \"\" : ` --config ${config}`}`,\n      );\n    process.stdout.write(`Verified ${selected.relative}\\n`);\n    return;\n  }\n  const permissions = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text,\n    mode: permissions === undefined ? 0o644 : permissions & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;AAiBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,OAA0B;CAC9B,IAAI;CACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,aAAa,SAAS,SAAS;GACzC,OAAO;GACP;EACF;EACA,IAAI,QAAQ,cAAc,WAAW,KAAA,GAAW;GAC9C,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;GACtE,SAAS;GACT;GACA;EACF;EACA,MAAM,IAAI,MAAM,KAAK;CACvB;CACA,MAAM,OAAO,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACrE,MAAM,SAASC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,QAAA,GAAOC,UAAAA,KAAAA,CAAK,MAAM,yBAAyB;CACjD,MAAM,OAAA,GAAMA,UAAAA,KAAAA,CAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAMC,uBAAAA,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAMA,uBAAAA,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAMC,uBAAAA,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,eACJ,WAAW,KAAA,IACP,KAAA,IACAC,6BAAAA,qBACE,KAAK,MAAM,OAAA,GAAMJ,iBAAAA,SAAAA,EAAAA,GAASK,UAAAA,QAAAA,CAAQ,MAAM,MAAM,GAAG,MAAM,CAAC,CAC1D;CAEN,MAAM,oBAAoBC,6BAAAA,sBAAsB,MAAM,sBAAsB;CAC5E,MAAM,OAAOC,6BAAAA,yBAAyB;EACpC;EACA,QAAQ,OAAO;EACf,SAAS;EACT,SAAS;CACX,CAAC;CACD,MAAM,cAAc,SAAS;CAC7B,IAAI,SAAS,SAAS;EACpB,IACE,SAAS,SAAS,KAAA,KACjB,OAAA,GAAMP,iBAAAA,SAAAA,CAAS,aAAa,MAAM,MAAO,MAE1C,MAAM,IAAI,MACR,GAAG,SAAS,SAAS,mCAAmC,WAAW,KAAA,IAAY,KAAK,aAAa,UACnG;EACF,QAAQ,OAAO,MAAM,YAAY,SAAS,SAAS,GAAG;EACtD;CACF;CACA,MAAM,cAAc,SAAS,MAAM;CACnC,MAAMQ,uBAAAA,mBAAmB;EACvB;EACA;EACA,MAAM,gBAAgB,KAAA,IAAY,MAAQ,cAAc;CAC1D,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/dependabot-cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
 import { r as readToolchainInputs } from "./toolchain-guard.mjs";
-import { i as parseDependabotInput, r as generateDependabotConfig } from "./toolchain-dependabot.mjs";
+import { a as generateDependabotConfig, c as readDependabotIgnores, s as parseDependabotInput } from "./toolchain-dependabot.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
 import "./dependabot.mjs";
 import { readFile, realpath } from "node:fs/promises";
@@ -62,10 +62,12 @@ const main = async () => {
 	});
 	if (remainingDiagnostics.length !== 0) throw new Error(remainingDiagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
 	const declarations = config === void 0 ? void 0 : parseDependabotInput(JSON.parse(await readFile(resolve(root, config), "utf8")));
+	const dependabotIgnores = readDependabotIgnores(files["stll-toolchain.json"]);
 	const text = generateDependabotConfig({
 		files,
 		policy: policy.dependabot,
-		updates: declarations
+		updates: declarations,
+		ignores: dependabotIgnores
 	});
 	const destination = selected.path;
 	if (mode === "check") {

package/dist/dependabot-cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dependabot-cli.mjs","names":[],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport {\n  generateDependabotConfig,\n  parseDependabotInput,\n  parseToolchainPolicy,\n} from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  let mode: \"write\" | \"check\" = \"write\";\n  let config: string | undefined;\n  for (let index = 0; index < args.length; index++) {\n    const arg = args[index];\n    if (arg === \"--check\" && mode === \"write\") {\n      mode = \"check\";\n      continue;\n    }\n    if (arg === \"--config\" && config === undefined) {\n      const next = args.at(index + 1);\n      if (next === undefined || next.startsWith(\"--\")) throw new Error(usage);\n      config = next;\n      index++;\n      continue;\n    }\n    throw new Error(usage);\n  }\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const declarations =\n    config === undefined\n      ? undefined\n      : parseDependabotInput(\n          JSON.parse(await readFile(resolve(root, config), \"utf8\")),\n        );\n  const text = generateDependabotConfig({\n    files,\n    policy: policy.dependabot,\n    updates: declarations,\n  });\n  const destination = selected.path;\n  if (mode === \"check\") {\n    if (\n      selected.stat === undefined ||\n      (await readFile(destination, \"utf8\")) !== text\n    )\n      throw new Error(\n        `${selected.relative} has drifted; run stll-dependabot${config === undefined ? \"\" : ` --config ${config}`}`,\n      );\n    process.stdout.write(`Verified ${selected.relative}\\n`);\n    return;\n  }\n  const permissions = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text,\n    mode: permissions === undefined ? 0o644 : permissions & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAgBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,OAA0B;CAC9B,IAAI;CACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,aAAa,SAAS,SAAS;GACzC,OAAO;GACP;EACF;EACA,IAAI,QAAQ,cAAc,WAAW,KAAA,GAAW;GAC9C,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;GACtE,SAAS;GACT;GACA;EACF;EACA,MAAM,IAAI,MAAM,KAAK;CACvB;CACA,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,IAAI;CACrE,MAAM,SAAS,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,MAAM,CACtE,CACF;CACA,MAAM,OAAO,KAAK,MAAM,yBAAyB;CACjD,MAAM,MAAM,KAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAM,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAM,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAM,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,eACJ,WAAW,KAAA,IACP,KAAA,IACA,qBACE,KAAK,MAAM,MAAM,SAAS,QAAQ,MAAM,MAAM,GAAG,MAAM,CAAC,CAC1D;CACN,MAAM,OAAO,yBAAyB;EACpC;EACA,QAAQ,OAAO;EACf,SAAS;CACX,CAAC;CACD,MAAM,cAAc,SAAS;CAC7B,IAAI,SAAS,SAAS;EACpB,IACE,SAAS,SAAS,KAAA,KACjB,MAAM,SAAS,aAAa,MAAM,MAAO,MAE1C,MAAM,IAAI,MACR,GAAG,SAAS,SAAS,mCAAmC,WAAW,KAAA,IAAY,KAAK,aAAa,UACnG;EACF,QAAQ,OAAO,MAAM,YAAY,SAAS,SAAS,GAAG;EACtD;CACF;CACA,MAAM,cAAc,SAAS,MAAM;CACnC,MAAM,mBAAmB;EACvB;EACA;EACA,MAAM,gBAAgB,KAAA,IAAY,MAAQ,cAAc;CAC1D,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"dependabot-cli.mjs","names":[],"sources":["../src/dependabot-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFile, realpath } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\n\nimport {\n  generateDependabotConfig,\n  parseDependabotInput,\n  parseToolchainPolicy,\n} from \"./dependabot\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { readDependabotIgnores } from \"./toolchain-dependabot\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-dependabot [--check] [--config <path>] (run from repository root)\\n       stll-dependabot --help\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  let mode: \"write\" | \"check\" = \"write\";\n  let config: string | undefined;\n  for (let index = 0; index < args.length; index++) {\n    const arg = args[index];\n    if (arg === \"--check\" && mode === \"write\") {\n      mode = \"check\";\n      continue;\n    }\n    if (arg === \"--config\" && config === undefined) {\n      const next = args.at(index + 1);\n      if (next === undefined || next.startsWith(\"--\")) throw new Error(usage);\n      config = next;\n      index++;\n      continue;\n    }\n    throw new Error(usage);\n  }\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root);\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const yaml = join(root, \".github/dependabot.yaml\");\n  const yml = join(root, \".github/dependabot.yml\");\n  const yamlStat = await checkGeneratedOutput(yaml);\n  const ymlStat = await checkGeneratedOutput(yml);\n  const candidates = [\n    { relative: \".github/dependabot.yaml\", path: yaml, stat: yamlStat },\n    { relative: \".github/dependabot.yml\", path: yml, stat: ymlStat },\n  ].filter(\n    ({ relative, stat }) => stat !== undefined || trackedFiles.has(relative),\n  );\n  if (candidates.length > 1)\n    throw new Error(\"keep exactly one Dependabot configuration: .yml or .yaml\");\n  const selected = candidates.at(0) ?? {\n    relative: \".github/dependabot.yml\",\n    path: yml,\n    stat: ymlStat,\n  };\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: selected.relative, destination: selected.path }],\n  });\n  if (remainingDiagnostics.length !== 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(({ path, message }) => `${path}: ${message}`)\n        .join(\"\\n\"),\n    );\n  const declarations =\n    config === undefined\n      ? undefined\n      : parseDependabotInput(\n          JSON.parse(await readFile(resolve(root, config), \"utf8\")),\n        );\n  // Shared-pin conflicts and invalid declarations still throw in the generator and parser.\n  const dependabotIgnores = readDependabotIgnores(files[\"stll-toolchain.json\"]);\n  const text = generateDependabotConfig({\n    files,\n    policy: policy.dependabot,\n    updates: declarations,\n    ignores: dependabotIgnores,\n  });\n  const destination = selected.path;\n  if (mode === \"check\") {\n    if (\n      selected.stat === undefined ||\n      (await readFile(destination, \"utf8\")) !== text\n    )\n      throw new Error(\n        `${selected.relative} has drifted; run stll-dependabot${config === undefined ? \"\" : ` --config ${config}`}`,\n      );\n    process.stdout.write(`Verified ${selected.relative}\\n`);\n    return;\n  }\n  const permissions = selected.stat?.mode;\n  await writeGeneratedFile({\n    destination,\n    text,\n    mode: permissions === undefined ? 0o644 : permissions & 0o777,\n  });\n  process.stdout.write(`Generated ${selected.relative}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `dependabot: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAiBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,OAA0B;CAC9B,IAAI;CACJ,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,aAAa,SAAS,SAAS;GACzC,OAAO;GACP;EACF;EACA,IAAI,QAAQ,cAAc,WAAW,KAAA,GAAW;GAC9C,MAAM,OAAO,KAAK,GAAG,QAAQ,CAAC;GAC9B,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;GACtE,SAAS;GACT;GACA;EACF;EACA,MAAM,IAAI,MAAM,KAAK;CACvB;CACA,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,IAAI;CACrE,MAAM,SAAS,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,MAAM,CACtE,CACF;CACA,MAAM,OAAO,KAAK,MAAM,yBAAyB;CACjD,MAAM,MAAM,KAAK,MAAM,wBAAwB;CAC/C,MAAM,WAAW,MAAM,qBAAqB,IAAI;CAChD,MAAM,UAAU,MAAM,qBAAqB,GAAG;CAC9C,MAAM,aAAa,CACjB;EAAE,UAAU;EAA2B,MAAM;EAAM,MAAM;CAAS,GAClE;EAAE,UAAU;EAA0B,MAAM;EAAK,MAAM;CAAQ,CACjE,CAAC,CAAC,QACC,EAAE,UAAU,WAAW,SAAS,KAAA,KAAa,aAAa,IAAI,QAAQ,CACzE;CACA,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MAAM,0DAA0D;CAC5E,MAAM,WAAW,WAAW,GAAG,CAAC,KAAK;EACnC,UAAU;EACV,MAAM;EACN,MAAM;CACR;CACA,MAAM,uBAAuB,MAAM,sBAAsB;EACvD;EACA,SAAS,CAAC;GAAE,UAAU,SAAS;GAAU,aAAa,SAAS;EAAK,CAAC;CACvE,CAAC;CACD,IAAI,qBAAqB,WAAW,GAClC,MAAM,IAAI,MACR,qBACG,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CACjD,KAAK,IAAI,CACd;CACF,MAAM,eACJ,WAAW,KAAA,IACP,KAAA,IACA,qBACE,KAAK,MAAM,MAAM,SAAS,QAAQ,MAAM,MAAM,GAAG,MAAM,CAAC,CAC1D;CAEN,MAAM,oBAAoB,sBAAsB,MAAM,sBAAsB;CAC5E,MAAM,OAAO,yBAAyB;EACpC;EACA,QAAQ,OAAO;EACf,SAAS;EACT,SAAS;CACX,CAAC;CACD,MAAM,cAAc,SAAS;CAC7B,IAAI,SAAS,SAAS;EACpB,IACE,SAAS,SAAS,KAAA,KACjB,MAAM,SAAS,aAAa,MAAM,MAAO,MAE1C,MAAM,IAAI,MACR,GAAG,SAAS,SAAS,mCAAmC,WAAW,KAAA,IAAY,KAAK,aAAa,UACnG;EACF,QAAQ,OAAO,MAAM,YAAY,SAAS,SAAS,GAAG;EACtD;CACF;CACA,MAAM,cAAc,SAAS,MAAM;CACnC,MAAM,mBAAmB;EACvB;EACA;EACA,MAAM,gBAAgB,KAAA,IAAY,MAAQ,cAAc;CAC1D,CAAC;CACD,QAAQ,OAAO,MAAM,aAAa,SAAS,SAAS,GAAG;AACzD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/dependabot.cjs

@@ -1,7 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_toolchain_dependabot = require("./toolchain-dependabot.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
+exports.dependabotIgnoreUpdateTypes = require_toolchain_dependabot.dependabotIgnoreUpdateTypes;
 exports.generateDependabotConfig = require_toolchain_dependabot.generateDependabotConfig;
+exports.parseDependabotIgnores = require_toolchain_dependabot.parseDependabotIgnores;
 exports.parseDependabotInput = require_toolchain_dependabot.parseDependabotInput;
 exports.parseToolchainPolicy = require_toolchain_schema.parseToolchainPolicy;
 exports.supportedDependabotEcosystems = require_toolchain_dependabot.supportedDependabotEcosystems;

package/dist/dependabot.d.cts

@@ -19,9 +19,24 @@ type DependabotPolicy = {
   ignoredActions: readonly string[];
   ignoredImages: readonly string[];
 };
+declare const dependabotIgnoreUpdateTypes: readonly ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"];
+type DependabotIgnoreUpdateType = (typeof dependabotIgnoreUpdateTypes)[number];
+/** A reviewed repository decision to skip some version updates of one dependency. */
+type DependabotIgnoreDeclaration = {
+  readonly ecosystem: DependabotEcosystem;
+  /** Dependabot `dependency-name`; `*` is the only wildcard. */
+  readonly dependency: string;
+  /** Nonempty, unique and in canonical major, minor, patch order. */
+  readonly updateTypes: readonly [DependabotIgnoreUpdateType, ...DependabotIgnoreUpdateType[]];
+  readonly reason: string;
+};
+/** Parse `dependabotIgnores` from stll-toolchain.json; malformed decisions fail closed. */
+declare const parseDependabotIgnores: (input: unknown) => DependabotIgnoreDeclaration[];
 type CheckDependabotOptions = {
   files: Record<string, string>;
   policy: DependabotPolicy;
+  /** Parsed stll-toolchain.json `dependabotIgnores`. */
+  ignores?: readonly DependabotIgnoreDeclaration[] | undefined;
 };
 /** Repository declarations own coverage only; shared policy owns every update option. */
 declare const parseDependabotInput: (input: unknown) => {
@@ -32,7 +47,7 @@ type GenerateDependabotOptions = CheckDependabotOptions & {
   updates?: ReturnType<typeof parseDependabotInput> | undefined;
 };
 /** Generate canonical YAML from the same ecosystem enumeration used by the guard. */
-declare const generateDependabotConfig: ({ files, policy, updates: declarations }: GenerateDependabotOptions) => string;
+declare const generateDependabotConfig: ({ files, policy, updates: declarations, ignores }: GenerateDependabotOptions) => string;
 //#endregion
 //#region src/toolchain-schema.d.ts
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
@@ -114,5 +129,5 @@ declare const parseToolchainPolicy: (input: unknown) => {
   };
 };
 //#endregion
-export { type DependabotEcosystem, generateDependabotConfig, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };
+export { type DependabotEcosystem, type DependabotIgnoreDeclaration, type DependabotIgnoreUpdateType, dependabotIgnoreUpdateTypes, generateDependabotConfig, parseDependabotIgnores, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };
 //# sourceMappingURL=dependabot.d.cts.map

package/dist/dependabot.d.mts

@@ -19,9 +19,24 @@ type DependabotPolicy = {
   ignoredActions: readonly string[];
   ignoredImages: readonly string[];
 };
+declare const dependabotIgnoreUpdateTypes: readonly ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"];
+type DependabotIgnoreUpdateType = (typeof dependabotIgnoreUpdateTypes)[number];
+/** A reviewed repository decision to skip some version updates of one dependency. */
+type DependabotIgnoreDeclaration = {
+  readonly ecosystem: DependabotEcosystem;
+  /** Dependabot `dependency-name`; `*` is the only wildcard. */
+  readonly dependency: string;
+  /** Nonempty, unique and in canonical major, minor, patch order. */
+  readonly updateTypes: readonly [DependabotIgnoreUpdateType, ...DependabotIgnoreUpdateType[]];
+  readonly reason: string;
+};
+/** Parse `dependabotIgnores` from stll-toolchain.json; malformed decisions fail closed. */
+declare const parseDependabotIgnores: (input: unknown) => DependabotIgnoreDeclaration[];
 type CheckDependabotOptions = {
   files: Record<string, string>;
   policy: DependabotPolicy;
+  /** Parsed stll-toolchain.json `dependabotIgnores`. */
+  ignores?: readonly DependabotIgnoreDeclaration[] | undefined;
 };
 /** Repository declarations own coverage only; shared policy owns every update option. */
 declare const parseDependabotInput: (input: unknown) => {
@@ -32,7 +47,7 @@ type GenerateDependabotOptions = CheckDependabotOptions & {
   updates?: ReturnType<typeof parseDependabotInput> | undefined;
 };
 /** Generate canonical YAML from the same ecosystem enumeration used by the guard. */
-declare const generateDependabotConfig: ({ files, policy, updates: declarations }: GenerateDependabotOptions) => string;
+declare const generateDependabotConfig: ({ files, policy, updates: declarations, ignores }: GenerateDependabotOptions) => string;
 //#endregion
 //#region src/toolchain-schema.d.ts
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
@@ -114,5 +129,5 @@ declare const parseToolchainPolicy: (input: unknown) => {
   };
 };
 //#endregion
-export { type DependabotEcosystem, generateDependabotConfig, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };
+export { type DependabotEcosystem, type DependabotIgnoreDeclaration, type DependabotIgnoreUpdateType, dependabotIgnoreUpdateTypes, generateDependabotConfig, parseDependabotIgnores, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };
 //# sourceMappingURL=dependabot.d.mts.map

package/dist/dependabot.mjs

@@ -1,3 +1,3 @@
-import { a as supportedDependabotEcosystems, i as parseDependabotInput, r as generateDependabotConfig } from "./toolchain-dependabot.mjs";
+import { a as generateDependabotConfig, l as supportedDependabotEcosystems, o as parseDependabotIgnores, r as dependabotIgnoreUpdateTypes, s as parseDependabotInput } from "./toolchain-dependabot.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
-export { generateDependabotConfig, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };
+export { dependabotIgnoreUpdateTypes, generateDependabotConfig, parseDependabotIgnores, parseDependabotInput, parseToolchainPolicy, supportedDependabotEcosystems };

package/dist/engine-support-cli.cjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+const require_engine_support = require("./engine-support.cjs");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_child_process = require("node:child_process");
+let _changesets_assemble_release_plan = require("@changesets/assemble-release-plan");
+let _changesets_config = require("@changesets/config");
+let _changesets_read = require("@changesets/read");
+let _manypkg_get_packages = require("@manypkg/get-packages");
+//#region src/engine-support-cli.ts
+const MAX_MANIFEST_BUFFER = 104857600;
+const git = (root, args) => (0, node_child_process.execFileSync)("git", args, {
+	cwd: root,
+	encoding: "utf8",
+	maxBuffer: MAX_MANIFEST_BUFFER
+});
+const parseBase = (args) => {
+	if (args.length === 1 && args.at(0) === "--help") return void 0;
+	if (args.length === 2 && args.at(0) === "--base" && args.at(1) !== "") return args.at(1);
+	throw new Error("Usage: stll-engine-support --base <git ref>");
+};
+const packageNodeRange = ({ packageJson }) => {
+	const engines = "engines" in packageJson ? packageJson.engines : void 0;
+	return typeof engines === "object" && engines !== null && "node" in engines && typeof engines.node === "string" ? engines.node : void 0;
+};
+const publishedPackages = (packages, ignored) => {
+	const collected = /* @__PURE__ */ new Map();
+	for (const pkg of packages) {
+		const { name, private: isPrivate } = pkg.packageJson;
+		if (isPrivate === true || typeof name !== "string") continue;
+		if (collected.has(name)) throw new Error(`Duplicate published package name: ${name}`);
+		const node = packageNodeRange(pkg);
+		collected.set(name, {
+			name,
+			...node === void 0 ? {} : { node },
+			changesetsManaged: !ignored.has(name)
+		});
+	}
+	return collected;
+};
+const basePackage = (root, base, pkg) => {
+	const relativeManifest = node_path.default.relative(root, node_path.default.join(pkg.dir, "package.json")).split(node_path.default.sep).join(node_path.default.posix.sep);
+	if (git(root, [
+		"ls-tree",
+		"--name-only",
+		base,
+		"--",
+		relativeManifest
+	]).trim() === "") return void 0;
+	const packageJson = JSON.parse(git(root, ["show", `${base}:${relativeManifest}`]));
+	if (typeof packageJson !== "object" || packageJson === null) throw new Error(`Invalid package manifest at ${base}:${relativeManifest}`);
+	return {
+		...pkg,
+		packageJson
+	};
+};
+const main = async () => {
+	const base = parseBase(process.argv.slice(2));
+	if (base === void 0) {
+		process.stdout.write("Usage: stll-engine-support --base <git ref>\n");
+		return;
+	}
+	const root = process.cwd();
+	git(root, [
+		"cat-file",
+		"-e",
+		`${base}^{commit}`
+	]);
+	const workspace = (0, _manypkg_get_packages.getPackagesSync)(root);
+	const discovered = workspace.packages;
+	const configResult = await (0, _changesets_config.readConfig)(root, workspace);
+	if (configResult.errors !== void 0) throw new Error(configResult.errors.join("\n"));
+	const config = configResult.config;
+	const ignored = new Set(config.ignore);
+	const releasePlan = (0, _changesets_assemble_release_plan.assembleReleasePlan)(await (0, _changesets_read.readChangesets)(root), workspace, config, void 0);
+	const basePackages = discovered.flatMap((pkg) => {
+		const found = basePackage(root, base, pkg);
+		return found === void 0 ? [] : [found];
+	});
+	const failures = require_engine_support.checkEngineSupport({
+		base: publishedPackages(basePackages, ignored),
+		head: publishedPackages(discovered, ignored),
+		majorReleases: new Set(releasePlan.releases.filter(({ type }) => type === "major").map(({ name }) => name))
+	});
+	for (const failure of failures) process.stderr.write(`[engine-support] ${failure.packageName} narrows Node support from ${failure.baseRange} to ${failure.headRange}; ${failure.packageName} requires a pending major changeset\n`);
+	if (failures.length > 0) process.exitCode = 1;
+};
+main().catch((error) => {
+	process.stderr.write(`engine-support: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+
+//# sourceMappingURL=engine-support-cli.cjs.map

package/dist/engine-support-cli.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-support-cli.cjs","names":["execFileSync","path","getPackagesSync","readConfig","assembleReleasePlan","readChangesets","checkEngineSupport"],"sources":["../src/engine-support-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { assembleReleasePlan } from \"@changesets/assemble-release-plan\";\nimport { readConfig } from \"@changesets/config\";\nimport { readChangesets } from \"@changesets/read\";\nimport { getPackagesSync, type Package } from \"@manypkg/get-packages\";\nimport { execFileSync } from \"node:child_process\";\nimport path from \"node:path\";\n\nimport { checkEngineSupport, type EnginePackage } from \"./engine-support\";\n\nconst MAX_MANIFEST_BUFFER = 100 * 1024 * 1024;\n\nconst git = (root: string, args: string[]) =>\n  execFileSync(\"git\", args, {\n    cwd: root,\n    encoding: \"utf8\",\n    maxBuffer: MAX_MANIFEST_BUFFER,\n  });\n\nconst parseBase = (args: string[]) => {\n  if (args.length === 1 && args.at(0) === \"--help\") return undefined;\n  if (args.length === 2 && args.at(0) === \"--base\" && args.at(1) !== \"\")\n    return args.at(1);\n  throw new Error(\"Usage: stll-engine-support --base <git ref>\");\n};\n\nconst packageNodeRange = ({ packageJson }: Package) => {\n  const engines = \"engines\" in packageJson ? packageJson.engines : undefined;\n  return typeof engines === \"object\" &&\n    engines !== null &&\n    \"node\" in engines &&\n    typeof engines.node === \"string\"\n    ? engines.node\n    : undefined;\n};\n\nconst publishedPackages = (packages: Package[], ignored: Set<string>) => {\n  const collected = new Map<string, EnginePackage>();\n  for (const pkg of packages) {\n    const { name, private: isPrivate } = pkg.packageJson;\n    if (isPrivate === true || typeof name !== \"string\") continue;\n    if (collected.has(name))\n      throw new Error(`Duplicate published package name: ${name}`);\n    const node = packageNodeRange(pkg);\n    collected.set(name, {\n      name,\n      ...(node === undefined ? {} : { node }),\n      changesetsManaged: !ignored.has(name),\n    });\n  }\n  return collected;\n};\n\nconst basePackage = (root: string, base: string, pkg: Package) => {\n  const relativeManifest = path\n    .relative(root, path.join(pkg.dir, \"package.json\"))\n    .split(path.sep)\n    .join(path.posix.sep);\n  if (\n    git(root, [\"ls-tree\", \"--name-only\", base, \"--\", relativeManifest]).trim() ===\n    \"\"\n  )\n    return undefined;\n  const packageJson = JSON.parse(\n    git(root, [\"show\", `${base}:${relativeManifest}`]),\n  );\n  if (typeof packageJson !== \"object\" || packageJson === null)\n    throw new Error(\n      `Invalid package manifest at ${base}:${relativeManifest}`,\n    );\n  return { ...pkg, packageJson };\n};\n\nconst main = async () => {\n  const base = parseBase(process.argv.slice(2));\n  if (base === undefined) {\n    process.stdout.write(\"Usage: stll-engine-support --base <git ref>\\n\");\n    return;\n  }\n  const root = process.cwd();\n  git(root, [\"cat-file\", \"-e\", `${base}^{commit}`]);\n  const workspace = getPackagesSync(root);\n  const discovered = workspace.packages;\n  const configResult = await readConfig(root, workspace);\n  if (configResult.errors !== undefined)\n    throw new Error(configResult.errors.join(\"\\n\"));\n  const config = configResult.config;\n  const ignored = new Set(config.ignore);\n  const releasePlan = assembleReleasePlan(\n    await readChangesets(root),\n    workspace,\n    config,\n    undefined,\n  );\n  const basePackages = discovered.flatMap((pkg) => {\n    const found = basePackage(root, base, pkg);\n    return found === undefined ? [] : [found];\n  });\n  const failures = checkEngineSupport({\n    base: publishedPackages(basePackages, ignored),\n    head: publishedPackages(discovered, ignored),\n    majorReleases: new Set(\n      releasePlan.releases\n        .filter(({ type }) => type === \"major\")\n        .map(({ name }) => name),\n    ),\n  });\n  for (const failure of failures)\n    process.stderr.write(\n      `[engine-support] ${failure.packageName} narrows Node support from ${failure.baseRange} to ${failure.headRange}; ${failure.packageName} requires a pending major changeset\\n`,\n    );\n  if (failures.length > 0) process.exitCode = 1;\n};\n\nvoid main().catch((error: unknown) => {\n  process.stderr.write(\n    `engine-support: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;;;AAUA,MAAM,sBAAsB;AAE5B,MAAM,OAAO,MAAc,UAAA,GACzBA,mBAAAA,aAAAA,CAAa,OAAO,MAAM;CACxB,KAAK;CACL,UAAU;CACV,WAAW;AACb,CAAC;AAEH,MAAM,aAAa,SAAmB;CACpC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU,OAAO,KAAA;CACzD,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,YAAY,KAAK,GAAG,CAAC,MAAM,IACjE,OAAO,KAAK,GAAG,CAAC;CAClB,MAAM,IAAI,MAAM,6CAA6C;AAC/D;AAEA,MAAM,oBAAoB,EAAE,kBAA2B;CACrD,MAAM,UAAU,aAAa,cAAc,YAAY,UAAU,KAAA;CACjE,OAAO,OAAO,YAAY,YACxB,YAAY,QACZ,UAAU,WACV,OAAO,QAAQ,SAAS,WACtB,QAAQ,OACR,KAAA;AACN;AAEA,MAAM,qBAAqB,UAAqB,YAAyB;CACvE,MAAM,4BAAY,IAAI,IAA2B;CACjD,KAAK,MAAM,OAAO,UAAU;EAC1B,MAAM,EAAE,MAAM,SAAS,cAAc,IAAI;EACzC,IAAI,cAAc,QAAQ,OAAO,SAAS,UAAU;EACpD,IAAI,UAAU,IAAI,IAAI,GACpB,MAAM,IAAI,MAAM,qCAAqC,MAAM;EAC7D,MAAM,OAAO,iBAAiB,GAAG;EACjC,UAAU,IAAI,MAAM;GAClB;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,mBAAmB,CAAC,QAAQ,IAAI,IAAI;EACtC,CAAC;CACH;CACA,OAAO;AACT;AAEA,MAAM,eAAe,MAAc,MAAc,QAAiB;CAChE,MAAM,mBAAmBC,UAAAA,QACtB,SAAS,MAAMA,UAAAA,QAAK,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC,CAClD,MAAMA,UAAAA,QAAK,GAAG,CAAC,CACf,KAAKA,UAAAA,QAAK,MAAM,GAAG;CACtB,IACE,IAAI,MAAM;EAAC;EAAW;EAAe;EAAM;EAAM;CAAgB,CAAC,CAAC,CAAC,KAAK,MACzE,IAEA,OAAO,KAAA;CACT,MAAM,cAAc,KAAK,MACvB,IAAI,MAAM,CAAC,QAAQ,GAAG,KAAK,GAAG,kBAAkB,CAAC,CACnD;CACA,IAAI,OAAO,gBAAgB,YAAY,gBAAgB,MACrD,MAAM,IAAI,MACR,+BAA+B,KAAK,GAAG,kBACzC;CACF,OAAO;EAAE,GAAG;EAAK;CAAY;AAC/B;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;CAC5C,IAAI,SAAS,KAAA,GAAW;EACtB,QAAQ,OAAO,MAAM,+CAA+C;EACpE;CACF;CACA,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,MAAM;EAAC;EAAY;EAAM,GAAG,KAAK;CAAU,CAAC;CAChD,MAAM,aAAA,GAAYC,sBAAAA,gBAAAA,CAAgB,IAAI;CACtC,MAAM,aAAa,UAAU;CAC7B,MAAM,eAAe,OAAA,GAAMC,mBAAAA,WAAAA,CAAW,MAAM,SAAS;CACrD,IAAI,aAAa,WAAW,KAAA,GAC1B,MAAM,IAAI,MAAM,aAAa,OAAO,KAAK,IAAI,CAAC;CAChD,MAAM,SAAS,aAAa;CAC5B,MAAM,UAAU,IAAI,IAAI,OAAO,MAAM;CACrC,MAAM,eAAA,GAAcC,kCAAAA,oBAAAA,CAClB,OAAA,GAAMC,iBAAAA,eAAAA,CAAe,IAAI,GACzB,WACA,QACA,KAAA,CACF;CACA,MAAM,eAAe,WAAW,SAAS,QAAQ;EAC/C,MAAM,QAAQ,YAAY,MAAM,MAAM,GAAG;EACzC,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,CAAC,KAAK;CAC1C,CAAC;CACD,MAAM,WAAWC,uBAAAA,mBAAmB;EAClC,MAAM,kBAAkB,cAAc,OAAO;EAC7C,MAAM,kBAAkB,YAAY,OAAO;EAC3C,eAAe,IAAI,IACjB,YAAY,SACT,QAAQ,EAAE,WAAW,SAAS,OAAO,CAAC,CACtC,KAAK,EAAE,WAAW,IAAI,CAC3B;CACF,CAAC;CACD,KAAK,MAAM,WAAW,UACpB,QAAQ,OAAO,MACb,oBAAoB,QAAQ,YAAY,6BAA6B,QAAQ,UAAU,MAAM,QAAQ,UAAU,IAAI,QAAQ,YAAY,sCACzI;CACF,IAAI,SAAS,SAAS,GAAG,QAAQ,WAAW;AAC9C;AAEK,KAAK,CAAC,CAAC,OAAO,UAAmB;CACpC,QAAQ,OAAO,MACb,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAC5E;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/engine-support-cli.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/engine-support-cli.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/engine-support-cli.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+import { checkEngineSupport } from "./engine-support.mjs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { assembleReleasePlan } from "@changesets/assemble-release-plan";
+import { readConfig } from "@changesets/config";
+import { readChangesets } from "@changesets/read";
+import { getPackagesSync } from "@manypkg/get-packages";
+//#region src/engine-support-cli.ts
+const MAX_MANIFEST_BUFFER = 104857600;
+const git = (root, args) => execFileSync("git", args, {
+	cwd: root,
+	encoding: "utf8",
+	maxBuffer: MAX_MANIFEST_BUFFER
+});
+const parseBase = (args) => {
+	if (args.length === 1 && args.at(0) === "--help") return void 0;
+	if (args.length === 2 && args.at(0) === "--base" && args.at(1) !== "") return args.at(1);
+	throw new Error("Usage: stll-engine-support --base <git ref>");
+};
+const packageNodeRange = ({ packageJson }) => {
+	const engines = "engines" in packageJson ? packageJson.engines : void 0;
+	return typeof engines === "object" && engines !== null && "node" in engines && typeof engines.node === "string" ? engines.node : void 0;
+};
+const publishedPackages = (packages, ignored) => {
+	const collected = /* @__PURE__ */ new Map();
+	for (const pkg of packages) {
+		const { name, private: isPrivate } = pkg.packageJson;
+		if (isPrivate === true || typeof name !== "string") continue;
+		if (collected.has(name)) throw new Error(`Duplicate published package name: ${name}`);
+		const node = packageNodeRange(pkg);
+		collected.set(name, {
+			name,
+			...node === void 0 ? {} : { node },
+			changesetsManaged: !ignored.has(name)
+		});
+	}
+	return collected;
+};
+const basePackage = (root, base, pkg) => {
+	const relativeManifest = path.relative(root, path.join(pkg.dir, "package.json")).split(path.sep).join(path.posix.sep);
+	if (git(root, [
+		"ls-tree",
+		"--name-only",
+		base,
+		"--",
+		relativeManifest
+	]).trim() === "") return void 0;
+	const packageJson = JSON.parse(git(root, ["show", `${base}:${relativeManifest}`]));
+	if (typeof packageJson !== "object" || packageJson === null) throw new Error(`Invalid package manifest at ${base}:${relativeManifest}`);
+	return {
+		...pkg,
+		packageJson
+	};
+};
+const main = async () => {
+	const base = parseBase(process.argv.slice(2));
+	if (base === void 0) {
+		process.stdout.write("Usage: stll-engine-support --base <git ref>\n");
+		return;
+	}
+	const root = process.cwd();
+	git(root, [
+		"cat-file",
+		"-e",
+		`${base}^{commit}`
+	]);
+	const workspace = getPackagesSync(root);
+	const discovered = workspace.packages;
+	const configResult = await readConfig(root, workspace);
+	if (configResult.errors !== void 0) throw new Error(configResult.errors.join("\n"));
+	const config = configResult.config;
+	const ignored = new Set(config.ignore);
+	const releasePlan = assembleReleasePlan(await readChangesets(root), workspace, config, void 0);
+	const basePackages = discovered.flatMap((pkg) => {
+		const found = basePackage(root, base, pkg);
+		return found === void 0 ? [] : [found];
+	});
+	const failures = checkEngineSupport({
+		base: publishedPackages(basePackages, ignored),
+		head: publishedPackages(discovered, ignored),
+		majorReleases: new Set(releasePlan.releases.filter(({ type }) => type === "major").map(({ name }) => name))
+	});
+	for (const failure of failures) process.stderr.write(`[engine-support] ${failure.packageName} narrows Node support from ${failure.baseRange} to ${failure.headRange}; ${failure.packageName} requires a pending major changeset\n`);
+	if (failures.length > 0) process.exitCode = 1;
+};
+main().catch((error) => {
+	process.stderr.write(`engine-support: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=engine-support-cli.mjs.map

package/dist/engine-support-cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-support-cli.mjs","names":[],"sources":["../src/engine-support-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { assembleReleasePlan } from \"@changesets/assemble-release-plan\";\nimport { readConfig } from \"@changesets/config\";\nimport { readChangesets } from \"@changesets/read\";\nimport { getPackagesSync, type Package } from \"@manypkg/get-packages\";\nimport { execFileSync } from \"node:child_process\";\nimport path from \"node:path\";\n\nimport { checkEngineSupport, type EnginePackage } from \"./engine-support\";\n\nconst MAX_MANIFEST_BUFFER = 100 * 1024 * 1024;\n\nconst git = (root: string, args: string[]) =>\n  execFileSync(\"git\", args, {\n    cwd: root,\n    encoding: \"utf8\",\n    maxBuffer: MAX_MANIFEST_BUFFER,\n  });\n\nconst parseBase = (args: string[]) => {\n  if (args.length === 1 && args.at(0) === \"--help\") return undefined;\n  if (args.length === 2 && args.at(0) === \"--base\" && args.at(1) !== \"\")\n    return args.at(1);\n  throw new Error(\"Usage: stll-engine-support --base <git ref>\");\n};\n\nconst packageNodeRange = ({ packageJson }: Package) => {\n  const engines = \"engines\" in packageJson ? packageJson.engines : undefined;\n  return typeof engines === \"object\" &&\n    engines !== null &&\n    \"node\" in engines &&\n    typeof engines.node === \"string\"\n    ? engines.node\n    : undefined;\n};\n\nconst publishedPackages = (packages: Package[], ignored: Set<string>) => {\n  const collected = new Map<string, EnginePackage>();\n  for (const pkg of packages) {\n    const { name, private: isPrivate } = pkg.packageJson;\n    if (isPrivate === true || typeof name !== \"string\") continue;\n    if (collected.has(name))\n      throw new Error(`Duplicate published package name: ${name}`);\n    const node = packageNodeRange(pkg);\n    collected.set(name, {\n      name,\n      ...(node === undefined ? {} : { node }),\n      changesetsManaged: !ignored.has(name),\n    });\n  }\n  return collected;\n};\n\nconst basePackage = (root: string, base: string, pkg: Package) => {\n  const relativeManifest = path\n    .relative(root, path.join(pkg.dir, \"package.json\"))\n    .split(path.sep)\n    .join(path.posix.sep);\n  if (\n    git(root, [\"ls-tree\", \"--name-only\", base, \"--\", relativeManifest]).trim() ===\n    \"\"\n  )\n    return undefined;\n  const packageJson = JSON.parse(\n    git(root, [\"show\", `${base}:${relativeManifest}`]),\n  );\n  if (typeof packageJson !== \"object\" || packageJson === null)\n    throw new Error(\n      `Invalid package manifest at ${base}:${relativeManifest}`,\n    );\n  return { ...pkg, packageJson };\n};\n\nconst main = async () => {\n  const base = parseBase(process.argv.slice(2));\n  if (base === undefined) {\n    process.stdout.write(\"Usage: stll-engine-support --base <git ref>\\n\");\n    return;\n  }\n  const root = process.cwd();\n  git(root, [\"cat-file\", \"-e\", `${base}^{commit}`]);\n  const workspace = getPackagesSync(root);\n  const discovered = workspace.packages;\n  const configResult = await readConfig(root, workspace);\n  if (configResult.errors !== undefined)\n    throw new Error(configResult.errors.join(\"\\n\"));\n  const config = configResult.config;\n  const ignored = new Set(config.ignore);\n  const releasePlan = assembleReleasePlan(\n    await readChangesets(root),\n    workspace,\n    config,\n    undefined,\n  );\n  const basePackages = discovered.flatMap((pkg) => {\n    const found = basePackage(root, base, pkg);\n    return found === undefined ? [] : [found];\n  });\n  const failures = checkEngineSupport({\n    base: publishedPackages(basePackages, ignored),\n    head: publishedPackages(discovered, ignored),\n    majorReleases: new Set(\n      releasePlan.releases\n        .filter(({ type }) => type === \"major\")\n        .map(({ name }) => name),\n    ),\n  });\n  for (const failure of failures)\n    process.stderr.write(\n      `[engine-support] ${failure.packageName} narrows Node support from ${failure.baseRange} to ${failure.headRange}; ${failure.packageName} requires a pending major changeset\\n`,\n    );\n  if (failures.length > 0) process.exitCode = 1;\n};\n\nvoid main().catch((error: unknown) => {\n  process.stderr.write(\n    `engine-support: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAUA,MAAM,sBAAsB;AAE5B,MAAM,OAAO,MAAc,SACzB,aAAa,OAAO,MAAM;CACxB,KAAK;CACL,UAAU;CACV,WAAW;AACb,CAAC;AAEH,MAAM,aAAa,SAAmB;CACpC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU,OAAO,KAAA;CACzD,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,YAAY,KAAK,GAAG,CAAC,MAAM,IACjE,OAAO,KAAK,GAAG,CAAC;CAClB,MAAM,IAAI,MAAM,6CAA6C;AAC/D;AAEA,MAAM,oBAAoB,EAAE,kBAA2B;CACrD,MAAM,UAAU,aAAa,cAAc,YAAY,UAAU,KAAA;CACjE,OAAO,OAAO,YAAY,YACxB,YAAY,QACZ,UAAU,WACV,OAAO,QAAQ,SAAS,WACtB,QAAQ,OACR,KAAA;AACN;AAEA,MAAM,qBAAqB,UAAqB,YAAyB;CACvE,MAAM,4BAAY,IAAI,IAA2B;CACjD,KAAK,MAAM,OAAO,UAAU;EAC1B,MAAM,EAAE,MAAM,SAAS,cAAc,IAAI;EACzC,IAAI,cAAc,QAAQ,OAAO,SAAS,UAAU;EACpD,IAAI,UAAU,IAAI,IAAI,GACpB,MAAM,IAAI,MAAM,qCAAqC,MAAM;EAC7D,MAAM,OAAO,iBAAiB,GAAG;EACjC,UAAU,IAAI,MAAM;GAClB;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,mBAAmB,CAAC,QAAQ,IAAI,IAAI;EACtC,CAAC;CACH;CACA,OAAO;AACT;AAEA,MAAM,eAAe,MAAc,MAAc,QAAiB;CAChE,MAAM,mBAAmB,KACtB,SAAS,MAAM,KAAK,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC,CAClD,MAAM,KAAK,GAAG,CAAC,CACf,KAAK,KAAK,MAAM,GAAG;CACtB,IACE,IAAI,MAAM;EAAC;EAAW;EAAe;EAAM;EAAM;CAAgB,CAAC,CAAC,CAAC,KAAK,MACzE,IAEA,OAAO,KAAA;CACT,MAAM,cAAc,KAAK,MACvB,IAAI,MAAM,CAAC,QAAQ,GAAG,KAAK,GAAG,kBAAkB,CAAC,CACnD;CACA,IAAI,OAAO,gBAAgB,YAAY,gBAAgB,MACrD,MAAM,IAAI,MACR,+BAA+B,KAAK,GAAG,kBACzC;CACF,OAAO;EAAE,GAAG;EAAK;CAAY;AAC/B;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;CAC5C,IAAI,SAAS,KAAA,GAAW;EACtB,QAAQ,OAAO,MAAM,+CAA+C;EACpE;CACF;CACA,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,MAAM;EAAC;EAAY;EAAM,GAAG,KAAK;CAAU,CAAC;CAChD,MAAM,YAAY,gBAAgB,IAAI;CACtC,MAAM,aAAa,UAAU;CAC7B,MAAM,eAAe,MAAM,WAAW,MAAM,SAAS;CACrD,IAAI,aAAa,WAAW,KAAA,GAC1B,MAAM,IAAI,MAAM,aAAa,OAAO,KAAK,IAAI,CAAC;CAChD,MAAM,SAAS,aAAa;CAC5B,MAAM,UAAU,IAAI,IAAI,OAAO,MAAM;CACrC,MAAM,cAAc,oBAClB,MAAM,eAAe,IAAI,GACzB,WACA,QACA,KAAA,CACF;CACA,MAAM,eAAe,WAAW,SAAS,QAAQ;EAC/C,MAAM,QAAQ,YAAY,MAAM,MAAM,GAAG;EACzC,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,CAAC,KAAK;CAC1C,CAAC;CACD,MAAM,WAAW,mBAAmB;EAClC,MAAM,kBAAkB,cAAc,OAAO;EAC7C,MAAM,kBAAkB,YAAY,OAAO;EAC3C,eAAe,IAAI,IACjB,YAAY,SACT,QAAQ,EAAE,WAAW,SAAS,OAAO,CAAC,CACtC,KAAK,EAAE,WAAW,IAAI,CAC3B;CACF,CAAC;CACD,KAAK,MAAM,WAAW,UACpB,QAAQ,OAAO,MACb,oBAAoB,QAAQ,YAAY,6BAA6B,QAAQ,UAAU,MAAM,QAAQ,UAAU,IAAI,QAAQ,YAAY,sCACzI;CACF,IAAI,SAAS,SAAS,GAAG,QAAQ,WAAW;AAC9C;AAEK,KAAK,CAAC,CAAC,OAAO,UAAmB;CACpC,QAAQ,OAAO,MACb,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAC5E;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/engine-support.cjs

@@ -0,0 +1,29 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+let semver = require("semver");
+semver = require_rolldown_runtime.__toESM(semver, 1);
+//#region src/engine-support.ts
+const displayedRange = (range) => range ?? "unrestricted";
+/** Returns engine-support changes that require a pending major release. */
+const checkEngineSupport = ({ base, head, majorReleases }) => {
+	const failures = [];
+	for (const [name, current] of head) {
+		if (!current.changesetsManaged) continue;
+		const previous = base.get(name);
+		if (previous === void 0) continue;
+		const baseRange = previous.node ?? "*";
+		const headRange = current.node ?? "*";
+		if (semver.default.subset(baseRange, headRange)) continue;
+		if (majorReleases.has(name)) continue;
+		failures.push({
+			packageName: name,
+			baseRange: displayedRange(previous.node),
+			headRange: displayedRange(current.node)
+		});
+	}
+	return failures;
+};
+//#endregion
+exports.checkEngineSupport = checkEngineSupport;
+
+//# sourceMappingURL=engine-support.cjs.map

package/dist/engine-support.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-support.cjs","names":[],"sources":["../src/engine-support.ts"],"sourcesContent":["import semver from \"semver\";\n\nexport type EnginePackage = {\n  name: string;\n  node?: string;\n  changesetsManaged: boolean;\n};\n\nexport type EngineSupportInput = {\n  base: ReadonlyMap<string, EnginePackage>;\n  head: ReadonlyMap<string, EnginePackage>;\n  majorReleases: ReadonlySet<string>;\n};\n\nexport type EngineSupportFailure = {\n  packageName: string;\n  baseRange: string;\n  headRange: string;\n};\n\nconst displayedRange = (range: string | undefined) => range ?? \"unrestricted\";\n\n/** Returns engine-support changes that require a pending major release. */\nexport const checkEngineSupport = ({\n  base,\n  head,\n  majorReleases,\n}: EngineSupportInput): EngineSupportFailure[] => {\n  const failures: EngineSupportFailure[] = [];\n  for (const [name, current] of head) {\n    if (!current.changesetsManaged) continue;\n    const previous = base.get(name);\n    if (previous === undefined) continue;\n    const baseRange = previous.node ?? \"*\";\n    const headRange = current.node ?? \"*\";\n    if (semver.subset(baseRange, headRange)) continue;\n\n    if (majorReleases.has(name)) continue;\n    failures.push({\n      packageName: name,\n      baseRange: displayedRange(previous.node),\n      headRange: displayedRange(current.node),\n    });\n  }\n  return failures;\n};\n"],"mappings":";;;;;AAoBA,MAAM,kBAAkB,UAA8B,SAAS;;AAG/D,MAAa,sBAAsB,EACjC,MACA,MACA,oBACgD;CAChD,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,MAAM,YAAY,MAAM;EAClC,IAAI,CAAC,QAAQ,mBAAmB;EAChC,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,IAAI,aAAa,KAAA,GAAW;EAC5B,MAAM,YAAY,SAAS,QAAQ;EACnC,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,OAAA,QAAO,OAAO,WAAW,SAAS,GAAG;EAEzC,IAAI,cAAc,IAAI,IAAI,GAAG;EAC7B,SAAS,KAAK;GACZ,aAAa;GACb,WAAW,eAAe,SAAS,IAAI;GACvC,WAAW,eAAe,QAAQ,IAAI;EACxC,CAAC;CACH;CACA,OAAO;AACT"}

package/dist/engine-support.d.cts

@@ -0,0 +1,21 @@
+//#region src/engine-support.d.ts
+type EnginePackage = {
+  name: string;
+  node?: string;
+  changesetsManaged: boolean;
+};
+type EngineSupportInput = {
+  base: ReadonlyMap<string, EnginePackage>;
+  head: ReadonlyMap<string, EnginePackage>;
+  majorReleases: ReadonlySet<string>;
+};
+type EngineSupportFailure = {
+  packageName: string;
+  baseRange: string;
+  headRange: string;
+};
+/** Returns engine-support changes that require a pending major release. */
+declare const checkEngineSupport: ({ base, head, majorReleases }: EngineSupportInput) => EngineSupportFailure[];
+//#endregion
+export { EnginePackage, EngineSupportFailure, EngineSupportInput, checkEngineSupport };
+//# sourceMappingURL=engine-support.d.cts.map