@stll/oxlint-config 1.5.2 → 1.6.0

package/dist/engine-support.d.mts

@@ -0,0 +1,21 @@
+//#region src/engine-support.d.ts
+type EnginePackage = {
+  name: string;
+  node?: string;
+  changesetsManaged: boolean;
+};
+type EngineSupportInput = {
+  base: ReadonlyMap<string, EnginePackage>;
+  head: ReadonlyMap<string, EnginePackage>;
+  majorReleases: ReadonlySet<string>;
+};
+type EngineSupportFailure = {
+  packageName: string;
+  baseRange: string;
+  headRange: string;
+};
+/** Returns engine-support changes that require a pending major release. */
+declare const checkEngineSupport: ({ base, head, majorReleases }: EngineSupportInput) => EngineSupportFailure[];
+//#endregion
+export { EnginePackage, EngineSupportFailure, EngineSupportInput, checkEngineSupport };
+//# sourceMappingURL=engine-support.d.mts.map

package/dist/engine-support.mjs

@@ -0,0 +1,26 @@
+import semver from "semver";
+//#region src/engine-support.ts
+const displayedRange = (range) => range ?? "unrestricted";
+/** Returns engine-support changes that require a pending major release. */
+const checkEngineSupport = ({ base, head, majorReleases }) => {
+	const failures = [];
+	for (const [name, current] of head) {
+		if (!current.changesetsManaged) continue;
+		const previous = base.get(name);
+		if (previous === void 0) continue;
+		const baseRange = previous.node ?? "*";
+		const headRange = current.node ?? "*";
+		if (semver.subset(baseRange, headRange)) continue;
+		if (majorReleases.has(name)) continue;
+		failures.push({
+			packageName: name,
+			baseRange: displayedRange(previous.node),
+			headRange: displayedRange(current.node)
+		});
+	}
+	return failures;
+};
+//#endregion
+export { checkEngineSupport };
+
+//# sourceMappingURL=engine-support.mjs.map

package/dist/engine-support.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-support.mjs","names":[],"sources":["../src/engine-support.ts"],"sourcesContent":["import semver from \"semver\";\n\nexport type EnginePackage = {\n  name: string;\n  node?: string;\n  changesetsManaged: boolean;\n};\n\nexport type EngineSupportInput = {\n  base: ReadonlyMap<string, EnginePackage>;\n  head: ReadonlyMap<string, EnginePackage>;\n  majorReleases: ReadonlySet<string>;\n};\n\nexport type EngineSupportFailure = {\n  packageName: string;\n  baseRange: string;\n  headRange: string;\n};\n\nconst displayedRange = (range: string | undefined) => range ?? \"unrestricted\";\n\n/** Returns engine-support changes that require a pending major release. */\nexport const checkEngineSupport = ({\n  base,\n  head,\n  majorReleases,\n}: EngineSupportInput): EngineSupportFailure[] => {\n  const failures: EngineSupportFailure[] = [];\n  for (const [name, current] of head) {\n    if (!current.changesetsManaged) continue;\n    const previous = base.get(name);\n    if (previous === undefined) continue;\n    const baseRange = previous.node ?? \"*\";\n    const headRange = current.node ?? \"*\";\n    if (semver.subset(baseRange, headRange)) continue;\n\n    if (majorReleases.has(name)) continue;\n    failures.push({\n      packageName: name,\n      baseRange: displayedRange(previous.node),\n      headRange: displayedRange(current.node),\n    });\n  }\n  return failures;\n};\n"],"mappings":";;AAoBA,MAAM,kBAAkB,UAA8B,SAAS;;AAG/D,MAAa,sBAAsB,EACjC,MACA,MACA,oBACgD;CAChD,MAAM,WAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,MAAM,YAAY,MAAM;EAClC,IAAI,CAAC,QAAQ,mBAAmB;EAChC,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,IAAI,aAAa,KAAA,GAAW;EAC5B,MAAM,YAAY,SAAS,QAAQ;EACnC,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,OAAO,OAAO,WAAW,SAAS,GAAG;EAEzC,IAAI,cAAc,IAAI,IAAI,GAAG;EAC7B,SAAS,KAAK;GACZ,aAAa;GACb,WAAW,eAAe,SAAS,IAAI;GACvC,WAAW,eAAe,QAAQ,IAAI;EACxC,CAAC;CACH;CACA,OAAO;AACT"}

package/dist/toolchain-dependabot.cjs

@@ -75,12 +75,64 @@ const sameStrings = (value, expected) => {
 	const sortedExpected = [...expected].sort();
 	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
 };
-const pinnedVersionUpdateTypes = [
+const dependabotIgnoreUpdateTypes = [
 	"version-update:semver-major",
 	"version-update:semver-minor",
 	"version-update:semver-patch"
 ];
-const versionOnlyIgnore = (entry) => record(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], pinnedVersionUpdateTypes);
+const isIgnoreUpdateType = (value) => dependabotIgnoreUpdateTypes.some((updateType) => updateType === value);
+const versionIgnore = (entry, updateTypes) => record(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], updateTypes);
+const versionOnlyIgnore = (entry) => versionIgnore(entry, dependabotIgnoreUpdateTypes);
+const ignoreDeclarationKeys = [
+	"ecosystem",
+	"dependency",
+	"updateTypes",
+	"reason"
+];
+/** Parse `dependabotIgnores` from stll-toolchain.json; malformed decisions fail closed. */
+const parseDependabotIgnores = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("dependabotIgnores must be an array");
+	const result = [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const entry of input) {
+		if (!record(entry) || Object.keys(entry).some((key) => !ignoreDeclarationKeys.some((known) => known === key)) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "") throw new Error("each Dependabot ignore requires ecosystem, dependency, updateTypes and a nonempty reason only");
+		const ecosystem = entry["ecosystem"];
+		if (typeof ecosystem !== "string" || !isDependabotEcosystem(ecosystem)) throw new Error(`unsupported Dependabot ignore ecosystem: ${String(ecosystem)}`);
+		const dependency = entry["dependency"];
+		if (typeof dependency !== "string" || !/^[^\s?[\]{}!]+$/.test(dependency) || /^\*+$/.test(dependency)) throw new Error(`Dependabot ignore dependency must name a dependency; * is the only wildcard: ${String(dependency)}`);
+		const updateTypes = entry["updateTypes"];
+		if (!Array.isArray(updateTypes) || !updateTypes.every(isIgnoreUpdateType) || new Set(updateTypes).size !== updateTypes.length) throw new Error(`Dependabot ignore ${dependency} requires unique update types from ${dependabotIgnoreUpdateTypes.join(", ")}`);
+		const [first, ...rest] = dependabotIgnoreUpdateTypes.filter((updateType) => updateTypes.includes(updateType));
+		if (first === void 0) throw new Error(`Dependabot ignore ${dependency} requires at least one update type`);
+		const key = JSON.stringify([ecosystem, dependency]);
+		if (keys.has(key)) throw new Error(`duplicate Dependabot ignore: ${ecosystem} ${dependency}`);
+		keys.add(key);
+		result.push({
+			ecosystem,
+			dependency,
+			updateTypes: [first, ...rest],
+			reason: entry["reason"]
+		});
+	}
+	return result;
+};
+/**
+* Read only `dependabotIgnores` from stll-toolchain.json text: stll-dependabot must not
+* fail on unrelated declarations, which stll-toolchain-check validates.
+*/
+const readDependabotIgnores = (toolchain) => {
+	if (toolchain === void 0) return [];
+	const parsed = JSON.parse(toolchain);
+	if (!record(parsed)) throw new Error("stll-toolchain.json must be an object");
+	return parseDependabotIgnores(parsed["dependabotIgnores"]);
+};
+const dependencyPattern = (dependency) => new RegExp(`^${dependency.split("*").map((part) => part.replace(/[.+^${}()|[\]\\/?]/g, "\\$&")).join(".*")}$`);
+/** Code-unit order keeps generated bytes independent of the host locale. */
+const byDependency = (left, right) => {
+	if (left.dependency === right.dependency) return 0;
+	return left.dependency < right.dependency ? -1 : 1;
+};
 const directoryOf = (file) => {
 	const directory = node_path.default.posix.dirname(file);
 	return directory === "." ? "/" : `/${directory}`;
@@ -309,6 +361,11 @@ const ignoredFor = (ecosystem, policy) => {
 	if (ecosystem === "docker" || ecosystem === "docker-compose") return ownedDockerImageAliases(policy.ignoredImages);
 	return [];
 };
+/** Shared pins stay owned by the shared policy; declarations cannot name or match them. */
+const declaredIgnoreConflicts = ({ ignores, policy }) => ignores.flatMap(({ ecosystem, dependency }) => {
+	const pattern = dependencyPattern(dependency);
+	return ignoredFor(ecosystem, policy).filter((pin) => pattern.test(pin)).map((pin) => `Dependabot ignore ${ecosystem} ${dependency} covers shared pin ${pin}; the shared policy owns its ignore`);
+});
 /** Repository declarations own coverage only; shared policy owns every update option. */
 const parseDependabotInput = (input) => {
 	if (!record(input) || Object.keys(input).some((key) => key !== "updates") || !Array.isArray(input["updates"]) || input["updates"].length === 0) throw new Error("Dependabot input must contain a nonempty updates array only");
@@ -333,13 +390,25 @@ const parseDependabotInput = (input) => {
 	});
 };
 /** Generate canonical YAML from the same ecosystem enumeration used by the guard. */
-const generateDependabotConfig = ({ files, policy, updates: declarations }) => {
+const generateDependabotConfig = ({ files, policy, updates: declarations, ignores = [] }) => {
+	const conflicts = declaredIgnoreConflicts({
+		ignores,
+		policy
+	});
+	if (conflicts.length > 0) throw new Error(conflicts.join("\n"));
 	const detected = ecosystemRoots(files);
 	const roots = declarations === void 0 ? detected : new Map(parseDependabotInput({ updates: declarations }).map(({ ecosystem, directories }) => [ecosystem, new Set(directories)]));
 	for (const [ecosystem, directories] of detected) for (const directory of directories) if (!roots.get(ecosystem)?.has(directory)) throw new Error(`Dependabot input must cover ${ecosystem} directory ${directory}`);
+	for (const { ecosystem, dependency } of ignores) if (!roots.has(ecosystem)) throw new Error(`Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`);
 	const updates = [...roots].sort(([left], [right]) => left.localeCompare(right)).map(([ecosystem, ecosystemDirectories]) => {
 		const directories = [...ecosystemDirectories].sort();
-		const ignored = ignoredFor(ecosystem, policy);
+		const ignore = [...ignoredFor(ecosystem, policy).map((name) => ({
+			"dependency-name": name,
+			"update-types": dependabotIgnoreUpdateTypes
+		})), ...ignores.filter((declared) => declared.ecosystem === ecosystem).sort(byDependency).map(({ dependency, updateTypes }) => ({
+			"dependency-name": dependency,
+			"update-types": updateTypes
+		}))];
 		const time = new yaml.Scalar(policy.schedule.time);
 		time.type = yaml.Scalar.QUOTE_DOUBLE;
 		return {
@@ -357,10 +426,7 @@ const generateDependabotConfig = ({ files, policy, updates: declarations }) => {
 				patterns: group.patterns,
 				"update-types": group.updateTypes
 			}])),
-			ignore: ignored.length > 0 ? ignored.map((name) => ({
-				"dependency-name": name,
-				"update-types": pinnedVersionUpdateTypes
-			})) : void 0
+			ignore: ignore.length > 0 ? ignore : void 0
 		};
 	});
 	return (0, yaml.stringify)({
@@ -369,10 +435,10 @@ const generateDependabotConfig = ({ files, policy, updates: declarations }) => {
 	}, { aliasDuplicateObjects: false });
 };
 /** Validate the shared update policy against a hermetic tracked-file snapshot. */
-const checkDependabot = ({ files, policy }) => {
+const checkDependabot = ({ files, policy, ignores = [] }) => {
 	const roots = ecosystemRoots(files);
 	const paths = [".github/dependabot.yml", ".github/dependabot.yaml"].filter((file) => files[file] !== void 0);
-	if (roots.size === 0 && paths.length === 0) return [];
+	if (roots.size === 0 && paths.length === 0 && ignores.length === 0) return [];
 	const file = paths.at(0) ?? ".github/dependabot.yml";
 	const diagnostics = [];
 	const add = (message, line = 1) => {
@@ -416,6 +482,7 @@ const checkDependabot = ({ files, policy }) => {
 	} catch {}
 	const legacyUpdates = record(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
 	const rootClaims = /* @__PURE__ */ new Map();
+	const updatedEcosystems = /* @__PURE__ */ new Set();
 	const directoryClaims = /* @__PURE__ */ new Map();
 	for (const [index, update] of parsed["updates"].entries()) {
 		const lineOf = (key) => {
@@ -473,12 +540,27 @@ const checkDependabot = ({ files, policy }) => {
 			return !record(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
 		})) report("groups", `${ecosystem}: groups must match the shared policy`);
 		const ignored = ignoredFor(ecosystem, policy);
+		const declared = ignores.filter((declaration) => declaration.ecosystem === ecosystem);
+		updatedEcosystems.add(ecosystem);
 		const ignore = update["ignore"];
 		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !record(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record(entry) && entry["dependency-name"] === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
+		const entries = Array.isArray(ignore) ? ignore : [];
+		const nameOf = (entry) => record(entry) && typeof entry["dependency-name"] === "string" ? entry["dependency-name"] : void 0;
+		if (entries.some((entry) => {
+			const name = nameOf(entry);
+			return name === void 0 || !ignored.includes(name) && !declared.some(({ dependency }) => dependency === name);
+		})) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy or declared in stll-toolchain.json dependabotIgnores`);
+		if (entries.some((entry) => {
+			const name = nameOf(entry);
+			return name !== void 0 && ignored.includes(name) && !versionOnlyIgnore(entry);
+		})) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
+		for (const name of ignored) if (!entries.some((entry) => nameOf(entry) === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
+		for (const { dependency, updateTypes } of declared) {
+			const matching = entries.filter((entry) => nameOf(entry) === dependency);
+			if (matching.length !== 1 || !matching.every((entry) => versionIgnore(entry, updateTypes))) report("ignore", `${ecosystem}: ignore ${dependency} exactly once with only update-types ${updateTypes.join(", ")} as declared in stll-toolchain.json`);
+		}
 	}
+	for (const { ecosystem, dependency } of ignores) if (!updatedEcosystems.has(ecosystem)) add(`Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`);
 	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
 	return diagnostics;
 };
@@ -495,6 +577,18 @@ Object.defineProperty(exports, "checkDependabot", {
 		return checkDependabot;
 	}
 });
+Object.defineProperty(exports, "declaredIgnoreConflicts", {
+	enumerable: true,
+	get: function() {
+		return declaredIgnoreConflicts;
+	}
+});
+Object.defineProperty(exports, "dependabotIgnoreUpdateTypes", {
+	enumerable: true,
+	get: function() {
+		return dependabotIgnoreUpdateTypes;
+	}
+});
 Object.defineProperty(exports, "dependabotRules", {
 	enumerable: true,
 	get: function() {
@@ -507,12 +601,24 @@ Object.defineProperty(exports, "generateDependabotConfig", {
 		return generateDependabotConfig;
 	}
 });
+Object.defineProperty(exports, "parseDependabotIgnores", {
+	enumerable: true,
+	get: function() {
+		return parseDependabotIgnores;
+	}
+});
 Object.defineProperty(exports, "parseDependabotInput", {
 	enumerable: true,
 	get: function() {
 		return parseDependabotInput;
 	}
 });
+Object.defineProperty(exports, "readDependabotIgnores", {
+	enumerable: true,
+	get: function() {
+		return readDependabotIgnores;
+	}
+});
 Object.defineProperty(exports, "rustImageVersion", {
 	enumerable: true,
 	get: function() {

package/dist/toolchain-dependabot.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-dependabot.cjs","names":["path","unexpected","parseDocument","parseToml","workspaceContains","javascriptDependencyLockfiles","pythonDependencyManifestKind","isDependabotGithubActionsPath","dependabotManifestEcosystem","isDockerDefinitionPath","isComposeDefinitionPath","isKubernetesDefinitionPath","parseAllDocuments","containerDocumentImages","isPythonDependencyManifest","Scalar","stringify","LineCounter","isNode"],"sources":["../src/toolchain-images.ts","../src/toolchain-dependabot.ts"],"sourcesContent":["/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n\n/** Preserve Rust release identity across official Debian slim and Alpine variants. */\nexport const rustImageVersion = (tag: string) =>\n  tag.replace(\n    /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/,\n    \"\",\n  );\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n  dependabotManifestEcosystem,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\n// https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem\nexport const supportedDependabotEcosystems = [\n  \"bazel\",\n  \"bun\",\n  \"bundler\",\n  \"cargo\",\n  \"composer\",\n  \"conda\",\n  \"deno\",\n  \"devcontainers\",\n  \"docker\",\n  \"docker-compose\",\n  \"dotnet-sdk\",\n  \"elm\",\n  \"gitsubmodule\",\n  \"github-actions\",\n  \"gomod\",\n  \"gradle\",\n  \"helm\",\n  \"julia\",\n  \"maven\",\n  \"mix\",\n  \"nix\",\n  \"npm\",\n  \"nuget\",\n  \"opentofu\",\n  \"pip\",\n  \"pre-commit\",\n  \"pub\",\n  \"rust-toolchain\",\n  \"sbt\",\n  \"swift\",\n  \"terraform\",\n  \"uv\",\n  \"vcpkg\",\n] as const;\nexport type DependabotEcosystem =\n  (typeof supportedDependabotEcosystems)[number];\nconst isDependabotEcosystem = (value: string): value is DependabotEcosystem =>\n  supportedDependabotEcosystems.some((ecosystem) => ecosystem === value);\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\nconst pinnedVersionUpdateTypes = [\n  \"version-update:semver-major\",\n  \"version-update:semver-minor\",\n  \"version-update:semver-patch\",\n];\n\nconst versionOnlyIgnore = (entry: unknown) =>\n  record(entry) &&\n  Object.keys(entry).length === 2 &&\n  typeof entry[\"dependency-name\"] === \"string\" &&\n  sameStrings(entry[\"update-types\"], pinnedVersionUpdateTypes);\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\nconst declaresJavascriptInstallation = (text: string | undefined) => {\n  try {\n    const manifest: unknown = JSON.parse(text ?? \"\");\n    if (!record(manifest)) return false;\n    if (typeof manifest[\"packageManager\"] === \"string\") return true;\n    return [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ].some((field) => {\n      const dependencies = manifest[field];\n      return record(dependencies) && Object.keys(dependencies).length > 0;\n    });\n  } catch {\n    // Manifest validation reports invalid JSON independently.\n    return false;\n  }\n};\n\n/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        declaresJavascriptInstallation(\n          files[path.posix.join(directory, \"package.json\")],\n        ) ||\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) {\n          if (\n            ![...installable].some((directory) =>\n              declaredMember(root, patterns, directory),\n            )\n          )\n            continue;\n          installable.add(root);\n          changed = true;\n        }\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  let root = directory === \"/\" ? \".\" : directory.slice(1);\n  for (;;) {\n    if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n    try {\n      const manifest: unknown = JSON.parse(\n        files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n      );\n      if (record(manifest) && typeof manifest[\"packageManager\"] === \"string\")\n        return manifest[\"packageManager\"].startsWith(\"bun@\") ? \"bun\" : \"npm\";\n    } catch {\n      // Package rules diagnose malformed JSON; retain its update coverage.\n    }\n    for (const name of javascriptDependencyLockfiles)\n      if (files[path.posix.join(root, name)] !== undefined) return \"npm\";\n    if (root === \".\") return \"npm\";\n    root = path.posix.dirname(root);\n  }\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    const manifestEcosystem = dependabotManifestEcosystem(file);\n    if (manifestEcosystem !== undefined)\n      requireRoot(manifestEcosystem, directoryOf(file));\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\n/** Repository declarations own coverage only; shared policy owns every update option. */\nexport const parseDependabotInput = (input: unknown) => {\n  if (\n    !record(input) ||\n    Object.keys(input).some((key) => key !== \"updates\") ||\n    !Array.isArray(input[\"updates\"]) ||\n    input[\"updates\"].length === 0\n  )\n    throw new Error(\n      \"Dependabot input must contain a nonempty updates array only\",\n    );\n  const ecosystems = new Set<string>();\n  return input[\"updates\"].map((entry: unknown) => {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"ecosystem\", \"directories\"].includes(key),\n      ) ||\n      typeof entry[\"ecosystem\"] !== \"string\" ||\n      !strings(entry[\"directories\"]) ||\n      entry[\"directories\"].length === 0\n    )\n      throw new Error(\n        \"each Dependabot update must contain ecosystem and nonempty directories only\",\n      );\n    const ecosystem = entry[\"ecosystem\"];\n    if (!isDependabotEcosystem(ecosystem))\n      throw new Error(`unsupported Dependabot ecosystem: ${ecosystem}`);\n    const directories = entry[\"directories\"];\n    if (ecosystems.has(ecosystem))\n      throw new Error(`duplicate Dependabot ecosystem: ${ecosystem}`);\n    ecosystems.add(ecosystem);\n    const seen = new Set<string>();\n    for (const directory of directories) {\n      if (\n        !directory.startsWith(\"/\") ||\n        directory.includes(\"\\\\\") ||\n        directory.split(\"/\").some((part) => part === \".\" || part === \"..\") ||\n        path.posix.normalize(directory) !== directory ||\n        (directory !== \"/\" && directory.endsWith(\"/\")) ||\n        /[*?[\\]{}!]/.test(directory)\n      )\n        throw new Error(\n          `Dependabot directory must be a literal absolute repository path: ${directory}`,\n        );\n      if (seen.has(directory))\n        throw new Error(`duplicate Dependabot directory: ${directory}`);\n      seen.add(directory);\n    }\n    return { ecosystem, directories };\n  });\n};\n\ntype GenerateDependabotOptions = CheckDependabotOptions & {\n  updates?: ReturnType<typeof parseDependabotInput> | undefined;\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n  updates: declarations,\n}: GenerateDependabotOptions) => {\n  const detected = ecosystemRoots(files);\n  const roots =\n    declarations === undefined\n      ? detected\n      : new Map(\n          parseDependabotInput({ updates: declarations }).map(\n            ({ ecosystem, directories }) => [ecosystem, new Set(directories)],\n          ),\n        );\n  for (const [ecosystem, directories] of detected) {\n    for (const directory of directories) {\n      if (!roots.get(ecosystem)?.has(directory))\n        throw new Error(\n          `Dependabot input must cover ${ecosystem} directory ${directory}`,\n        );\n    }\n  }\n  const updates = [...roots]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, ecosystemDirectories]) => {\n      const directories = [...ecosystemDirectories].sort();\n      const ignored = ignoredFor(ecosystem, policy);\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore:\n          ignored.length > 0\n            ? ignored.map((name) => ({\n                \"dependency-name\": name,\n                \"update-types\": pinnedVersionUpdateTypes,\n              }))\n            : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    if (\n      Array.isArray(ignore) &&\n      ignore.some(\n        (entry: unknown) =>\n          !record(entry) ||\n          typeof entry[\"dependency-name\"] !== \"string\" ||\n          !ignored.includes(entry[\"dependency-name\"]),\n      )\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy`,\n      );\n    if (\n      Array.isArray(ignore) &&\n      ignore.some((entry: unknown) => !versionOnlyIgnore(entry))\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`,\n      );\n    for (const name of ignored) {\n      if (\n        !Array.isArray(ignore) ||\n        !ignore.some(\n          (entry: unknown) =>\n            record(entry) &&\n            entry[\"dependency-name\"] === name &&\n            versionOnlyIgnore(entry),\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all version updates for shared pin ${name}`,\n        );\n    }\n  }\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n"],"mappings":";;;;;;;;;;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;AAGA,MAAa,oBAAoB,QAC/B,IAAI,QACF,8HACA,EACF;;;ACPF,MAAa,kBAAkB,CAAC,mBAAmB;AAGnD,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAGA,MAAM,yBAAyB,UAC7B,8BAA8B,MAAM,cAAc,cAAc,KAAK;AAqBvE,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAEA,MAAM,2BAA2B;CAC/B;CACA;CACA;AACF;AAEA,MAAM,qBAAqB,UACzB,OAAO,KAAK,KACZ,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,OAAO,MAAM,uBAAuB,YACpC,YAAY,MAAM,iBAAiB,wBAAwB;AAE7D,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAO,OAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOC,UAAW,CAAC;CAExE;AACF;AAEA,MAAM,kCAAkC,SAA6B;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,QAAQ,EAAE;EAC/C,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAC9B,IAAI,OAAO,SAAS,sBAAsB,UAAU,OAAO;EAC3D,OAAO;GACL;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU;GAChB,MAAM,eAAe,SAAS;GAC9B,OAAO,OAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS;EACpE,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACCD,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACbA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgBA,UAAAA,QAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,YAAA,GAAWE,KAAAA,cAAAA,CAAc,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAAC,OAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAIF,UAAAA,QAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzCA,UAAAA,QAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,KAAA,GAC5BG,UAAAA,MAAAA,CAAU,MAAM,SAAS,EAAE;GACjC,IAAI,CAAC,OAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAW,OAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAW,OAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAIH,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAOI,yBAAAA,kBAAkB;GACvB,WAAW;GACX,MAAMJ,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,IACE,+BACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc,EACjD,KACAK,yBAAAA,8BAA8B,MAC3B,SAAS,MAAML,UAAAA,QAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;KAC1B,IACE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,cACtB,eAAe,MAAM,UAAU,SAAS,CAC1C,GAEA;KACF,YAAY,IAAI,IAAI;KACpB,UAAU;IACZ;IACA,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAA,QAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,UAAA,GAASG,UAAAA,MAAAA,CACb,MAAMH,UAAAA,QAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,aAAA,GAHaG,UAAAA,MAAAA,CACjB,MAAMH,UAAAA,QAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAY,OAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAI,OAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAI,OAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAAC,OAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAAC,OAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAe,OAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAAC,OAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACEA,UAAAA,QAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAASA,UAAAA,QAAK,MAAM,UACxBA,UAAAA,QAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAMA,UAAAA,QAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAIA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AAOA,MAAM,uBACJ,WACA,UACG;CACH,IAAI,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACtD,SAAS;EACP,IAAI,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;EACnE,IAAI;GACF,MAAM,WAAoB,KAAK,MAC7B,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;GACA,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,sBAAsB,UAC5D,OAAO,SAAS,iBAAiB,CAAC,WAAW,MAAM,IAAI,QAAQ;EACnE,QAAQ,CAER;EACA,KAAK,MAAM,QAAQK,yBAAAA,+BACjB,IAAI,MAAML,UAAAA,QAAK,MAAM,KAAK,MAAM,IAAI,OAAO,KAAA,GAAW,OAAO;EAC/D,IAAI,SAAS,KAAK,OAAO;EACzB,OAAOA,UAAAA,QAAK,MAAM,QAAQ,IAAI;CAChC;AACF;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAeM,yBAAAA,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAON,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,QAAA,GADSG,UAAAA,MAAAA,CAAU,SACP,CAAC,CAAC;EACpB,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgBH,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAIO,yBAAAA,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAOP,UAAAA,QAAK,MAAM,SAAS,IAAI;EACrC,MAAM,oBAAoBQ,yBAAAA,4BAA4B,IAAI;EAC1D,IAAI,sBAAsB,KAAA,GACxB,YAAY,mBAAmB,YAAY,IAAI,CAAC;EAClD,IAAIC,yBAAAA,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAIC,yBAAAA,wBAAwB,IAAI,KAAKC,yBAAAA,2BAA2B,IAAI,GAClE,KAAK,MAAM,aAAA,GAAYC,KAAAA,kBAAAA,CAAkB,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAaC,yBAAAA,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoBC,yBAAAA,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAGA,MAAa,wBAAwB,UAAmB;CACtD,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,QAAQ,SAAS,KAClD,CAAC,MAAM,QAAQ,MAAM,UAAU,KAC/B,MAAM,UAAU,CAAC,WAAW,GAE5B,MAAM,IAAI,MACR,6DACF;CACF,MAAM,6BAAa,IAAI,IAAY;CACnC,OAAO,MAAM,UAAU,CAAC,KAAK,UAAmB;EAC9C,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,SAAS,GAAG,CACrD,KACA,OAAO,MAAM,iBAAiB,YAC9B,CAAC,QAAQ,MAAM,cAAc,KAC7B,MAAM,cAAc,CAAC,WAAW,GAEhC,MAAM,IAAI,MACR,6EACF;EACF,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,sBAAsB,SAAS,GAClC,MAAM,IAAI,MAAM,qCAAqC,WAAW;EAClE,MAAM,cAAc,MAAM;EAC1B,IAAI,WAAW,IAAI,SAAS,GAC1B,MAAM,IAAI,MAAM,mCAAmC,WAAW;EAChE,WAAW,IAAI,SAAS;EACxB,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,aAAa,aAAa;GACnC,IACE,CAAC,UAAU,WAAW,GAAG,KACzB,UAAU,SAAS,IAAI,KACvB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,OAAO,SAAS,IAAI,KACjEd,UAAAA,QAAK,MAAM,UAAU,SAAS,MAAM,aACnC,cAAc,OAAO,UAAU,SAAS,GAAG,KAC5C,aAAa,KAAK,SAAS,GAE3B,MAAM,IAAI,MACR,oEAAoE,WACtE;GACF,IAAI,KAAK,IAAI,SAAS,GACpB,MAAM,IAAI,MAAM,mCAAmC,WAAW;GAChE,KAAK,IAAI,SAAS;EACpB;EACA,OAAO;GAAE;GAAW;EAAY;CAClC,CAAC;AACH;;AAOA,MAAa,4BAA4B,EACvC,OACA,QACA,SAAS,mBACsB;CAC/B,MAAM,WAAW,eAAe,KAAK;CACrC,MAAM,QACJ,iBAAiB,KAAA,IACb,WACA,IAAI,IACF,qBAAqB,EAAE,SAAS,aAAa,CAAC,CAAC,CAAC,KAC7C,EAAE,WAAW,kBAAkB,CAAC,WAAW,IAAI,IAAI,WAAW,CAAC,CAClE,CACF;CACN,KAAK,MAAM,CAAC,WAAW,gBAAgB,UACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACtC,MAAM,IAAI,MACR,+BAA+B,UAAU,aAAa,WACxD;CAGN,MAAM,UAAU,CAAC,GAAG,KAAK,CAAC,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC,CAAC,CACpD,KAAK,CAAC,WAAW,0BAA0B;EAC1C,MAAM,cAAc,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK;EACnD,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,OAAO,IAAIe,KAAAA,OAAO,OAAO,SAAS,IAAI;EAC5C,KAAK,OAAOA,KAAAA,OAAO;EACnB,OAAO;GACL,qBAAqB;GACrB,WAAW,YAAY,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,KAAA;GAC1D,aAAa,YAAY,SAAS,IAAI,cAAc,KAAA;GACpD,UAAU;IACR,UAAU,OAAO,SAAS;IAC1B,KAAK,OAAO,SAAS;IACrB;IACA,UAAU,OAAO,SAAS;GAC5B;GACA,UAAU,EAAE,gBAAgB,OAAO,SAAS,YAAY;GACxD,QAAQ,OAAO,YACb,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACnD,MACA;IAAE,UAAU,MAAM;IAAU,gBAAgB,MAAM;GAAY,CAChE,CAAC,CACH;GACA,QACE,QAAQ,SAAS,IACb,QAAQ,KAAK,UAAU;IACrB,mBAAmB;IACnB,gBAAgB;GAClB,EAAE,IACF,KAAA;EACR;CACF,CAAC;CACH,QAAA,GAAOC,KAAAA,UAAAA,CAAU;EAAE,SAAS;EAAG;CAAQ,GAAG,EAAE,uBAAuB,MAAM,CAAC;AAC5E;;AAGA,MAAa,mBAAmB,EAC9B,OACA,aAC0C;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,OAAO,CAAC;CACpD,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAIC,KAAAA,YAAY;CACpC,MAAM,YAAA,GAAWf,KAAAA,cAAAA,CAAc,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAAC,OAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,kBAAA,GAAiBA,KAAAA,cAAAA,CAAc,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJ,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,UAAA,GAASgB,KAAAA,OAAAA,CAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAUlB,UAAAA,QAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAA,QAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiB,OAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACE,OAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAAC,OAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAAC,OAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MACJ,UACC,CAAC,OAAO,KAAK,KACb,OAAO,MAAM,uBAAuB,YACpC,CAAC,QAAQ,SAAS,MAAM,kBAAkB,CAC9C,GAEA,OACE,UACA,GAAG,UAAU,kDACf;EACF,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MAAM,UAAmB,CAAC,kBAAkB,KAAK,CAAC,GAEzD,OACE,UACA,GAAG,UAAU,mLACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,CAAC,OAAO,MACL,UACC,OAAO,KAAK,KACZ,MAAM,uBAAuB,QAC7B,kBAAkB,KAAK,CAC3B,GAEA,OACE,UACA,GAAG,UAAU,8CAA8C,MAC7D;CAEN;CACA,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT"}
+{"version":3,"file":"toolchain-dependabot.cjs","names":["path","unexpected","parseDocument","parseToml","workspaceContains","javascriptDependencyLockfiles","pythonDependencyManifestKind","isDependabotGithubActionsPath","dependabotManifestEcosystem","isDockerDefinitionPath","isComposeDefinitionPath","isKubernetesDefinitionPath","parseAllDocuments","containerDocumentImages","isPythonDependencyManifest","Scalar","stringify","LineCounter","isNode"],"sources":["../src/toolchain-images.ts","../src/toolchain-dependabot.ts"],"sourcesContent":["/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n\n/** Preserve Rust release identity across official Debian slim and Alpine variants. */\nexport const rustImageVersion = (tag: string) =>\n  tag.replace(\n    /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/,\n    \"\",\n  );\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n  dependabotManifestEcosystem,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\n// https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem\nexport const supportedDependabotEcosystems = [\n  \"bazel\",\n  \"bun\",\n  \"bundler\",\n  \"cargo\",\n  \"composer\",\n  \"conda\",\n  \"deno\",\n  \"devcontainers\",\n  \"docker\",\n  \"docker-compose\",\n  \"dotnet-sdk\",\n  \"elm\",\n  \"gitsubmodule\",\n  \"github-actions\",\n  \"gomod\",\n  \"gradle\",\n  \"helm\",\n  \"julia\",\n  \"maven\",\n  \"mix\",\n  \"nix\",\n  \"npm\",\n  \"nuget\",\n  \"opentofu\",\n  \"pip\",\n  \"pre-commit\",\n  \"pub\",\n  \"rust-toolchain\",\n  \"sbt\",\n  \"swift\",\n  \"terraform\",\n  \"uv\",\n  \"vcpkg\",\n] as const;\nexport type DependabotEcosystem =\n  (typeof supportedDependabotEcosystems)[number];\nconst isDependabotEcosystem = (value: string): value is DependabotEcosystem =>\n  supportedDependabotEcosystems.some((ecosystem) => ecosystem === value);\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\n// Version-update types only: security updates stay enabled for every ignore.\nexport const dependabotIgnoreUpdateTypes = [\n  \"version-update:semver-major\",\n  \"version-update:semver-minor\",\n  \"version-update:semver-patch\",\n] as const;\nexport type DependabotIgnoreUpdateType =\n  (typeof dependabotIgnoreUpdateTypes)[number];\nconst isIgnoreUpdateType = (\n  value: unknown,\n): value is DependabotIgnoreUpdateType =>\n  dependabotIgnoreUpdateTypes.some((updateType) => updateType === value);\n\nconst versionIgnore = (entry: unknown, updateTypes: readonly string[]) =>\n  record(entry) &&\n  Object.keys(entry).length === 2 &&\n  typeof entry[\"dependency-name\"] === \"string\" &&\n  sameStrings(entry[\"update-types\"], updateTypes);\n\nconst versionOnlyIgnore = (entry: unknown) =>\n  versionIgnore(entry, dependabotIgnoreUpdateTypes);\n\n/** A reviewed repository decision to skip some version updates of one dependency. */\nexport type DependabotIgnoreDeclaration = {\n  readonly ecosystem: DependabotEcosystem;\n  /** Dependabot `dependency-name`; `*` is the only wildcard. */\n  readonly dependency: string;\n  /** Nonempty, unique and in canonical major, minor, patch order. */\n  readonly updateTypes: readonly [\n    DependabotIgnoreUpdateType,\n    ...DependabotIgnoreUpdateType[],\n  ];\n  readonly reason: string;\n};\n\nconst ignoreDeclarationKeys = [\n  \"ecosystem\",\n  \"dependency\",\n  \"updateTypes\",\n  \"reason\",\n] as const;\n\n/** Parse `dependabotIgnores` from stll-toolchain.json; malformed decisions fail closed. */\nexport const parseDependabotIgnores = (\n  input: unknown,\n): DependabotIgnoreDeclaration[] => {\n  if (input === undefined) return [];\n  if (!Array.isArray(input))\n    throw new Error(\"dependabotIgnores must be an array\");\n  const result: DependabotIgnoreDeclaration[] = [];\n  const keys = new Set<string>();\n  for (const entry of input) {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => !ignoreDeclarationKeys.some((known) => known === key),\n      ) ||\n      typeof entry[\"reason\"] !== \"string\" ||\n      entry[\"reason\"].trim() === \"\"\n    )\n      throw new Error(\n        \"each Dependabot ignore requires ecosystem, dependency, updateTypes and a nonempty reason only\",\n      );\n    const ecosystem = entry[\"ecosystem\"];\n    if (typeof ecosystem !== \"string\" || !isDependabotEcosystem(ecosystem))\n      throw new Error(\n        `unsupported Dependabot ignore ecosystem: ${String(ecosystem)}`,\n      );\n    const dependency = entry[\"dependency\"];\n    if (\n      typeof dependency !== \"string\" ||\n      !/^[^\\s?[\\]{}!]+$/.test(dependency) ||\n      /^\\*+$/.test(dependency)\n    )\n      throw new Error(\n        `Dependabot ignore dependency must name a dependency; * is the only wildcard: ${String(dependency)}`,\n      );\n    const updateTypes = entry[\"updateTypes\"];\n    if (\n      !Array.isArray(updateTypes) ||\n      !updateTypes.every(isIgnoreUpdateType) ||\n      new Set(updateTypes).size !== updateTypes.length\n    )\n      throw new Error(\n        `Dependabot ignore ${dependency} requires unique update types from ${dependabotIgnoreUpdateTypes.join(\", \")}`,\n      );\n    const [first, ...rest] = dependabotIgnoreUpdateTypes.filter((updateType) =>\n      updateTypes.includes(updateType),\n    );\n    if (first === undefined)\n      throw new Error(\n        `Dependabot ignore ${dependency} requires at least one update type`,\n      );\n    const key = JSON.stringify([ecosystem, dependency]);\n    if (keys.has(key))\n      throw new Error(\n        `duplicate Dependabot ignore: ${ecosystem} ${dependency}`,\n      );\n    keys.add(key);\n    result.push({\n      ecosystem,\n      dependency,\n      updateTypes: [first, ...rest],\n      reason: entry[\"reason\"],\n    });\n  }\n  return result;\n};\n\n/**\n * Read only `dependabotIgnores` from stll-toolchain.json text: stll-dependabot must not\n * fail on unrelated declarations, which stll-toolchain-check validates.\n */\nexport const readDependabotIgnores = (toolchain: string | undefined) => {\n  if (toolchain === undefined) return [];\n  const parsed: unknown = JSON.parse(toolchain);\n  if (!record(parsed)) throw new Error(\"stll-toolchain.json must be an object\");\n  return parseDependabotIgnores(parsed[\"dependabotIgnores\"]);\n};\n\nconst dependencyPattern = (dependency: string) =>\n  new RegExp(\n    `^${dependency\n      .split(\"*\")\n      .map((part) => part.replace(/[.+^${}()|[\\]\\\\/?]/g, \"\\\\$&\"))\n      .join(\".*\")}$`,\n  );\n\n/** Code-unit order keeps generated bytes independent of the host locale. */\nconst byDependency = (\n  left: DependabotIgnoreDeclaration,\n  right: DependabotIgnoreDeclaration,\n) => {\n  if (left.dependency === right.dependency) return 0;\n  return left.dependency < right.dependency ? -1 : 1;\n};\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\nconst declaresJavascriptInstallation = (text: string | undefined) => {\n  try {\n    const manifest: unknown = JSON.parse(text ?? \"\");\n    if (!record(manifest)) return false;\n    if (typeof manifest[\"packageManager\"] === \"string\") return true;\n    return [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ].some((field) => {\n      const dependencies = manifest[field];\n      return record(dependencies) && Object.keys(dependencies).length > 0;\n    });\n  } catch {\n    // Manifest validation reports invalid JSON independently.\n    return false;\n  }\n};\n\n/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        declaresJavascriptInstallation(\n          files[path.posix.join(directory, \"package.json\")],\n        ) ||\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) {\n          if (\n            ![...installable].some((directory) =>\n              declaredMember(root, patterns, directory),\n            )\n          )\n            continue;\n          installable.add(root);\n          changed = true;\n        }\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n  /** Parsed stll-toolchain.json `dependabotIgnores`. */\n  ignores?: readonly DependabotIgnoreDeclaration[] | undefined;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  let root = directory === \"/\" ? \".\" : directory.slice(1);\n  for (;;) {\n    if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n    try {\n      const manifest: unknown = JSON.parse(\n        files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n      );\n      if (record(manifest) && typeof manifest[\"packageManager\"] === \"string\")\n        return manifest[\"packageManager\"].startsWith(\"bun@\") ? \"bun\" : \"npm\";\n    } catch {\n      // Package rules diagnose malformed JSON; retain its update coverage.\n    }\n    for (const name of javascriptDependencyLockfiles)\n      if (files[path.posix.join(root, name)] !== undefined) return \"npm\";\n    if (root === \".\") return \"npm\";\n    root = path.posix.dirname(root);\n  }\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    const manifestEcosystem = dependabotManifestEcosystem(file);\n    if (manifestEcosystem !== undefined)\n      requireRoot(manifestEcosystem, directoryOf(file));\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\ntype DeclaredIgnoreConflictsOptions = {\n  ignores: readonly DependabotIgnoreDeclaration[];\n  policy: DependabotPolicy;\n};\n\n/** Shared pins stay owned by the shared policy; declarations cannot name or match them. */\nexport const declaredIgnoreConflicts = ({\n  ignores,\n  policy,\n}: DeclaredIgnoreConflictsOptions) =>\n  ignores.flatMap(({ ecosystem, dependency }) => {\n    const pattern = dependencyPattern(dependency);\n    return ignoredFor(ecosystem, policy)\n      .filter((pin) => pattern.test(pin))\n      .map(\n        (pin) =>\n          `Dependabot ignore ${ecosystem} ${dependency} covers shared pin ${pin}; the shared policy owns its ignore`,\n      );\n  });\n\n/** Repository declarations own coverage only; shared policy owns every update option. */\nexport const parseDependabotInput = (input: unknown) => {\n  if (\n    !record(input) ||\n    Object.keys(input).some((key) => key !== \"updates\") ||\n    !Array.isArray(input[\"updates\"]) ||\n    input[\"updates\"].length === 0\n  )\n    throw new Error(\n      \"Dependabot input must contain a nonempty updates array only\",\n    );\n  const ecosystems = new Set<string>();\n  return input[\"updates\"].map((entry: unknown) => {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"ecosystem\", \"directories\"].includes(key),\n      ) ||\n      typeof entry[\"ecosystem\"] !== \"string\" ||\n      !strings(entry[\"directories\"]) ||\n      entry[\"directories\"].length === 0\n    )\n      throw new Error(\n        \"each Dependabot update must contain ecosystem and nonempty directories only\",\n      );\n    const ecosystem = entry[\"ecosystem\"];\n    if (!isDependabotEcosystem(ecosystem))\n      throw new Error(`unsupported Dependabot ecosystem: ${ecosystem}`);\n    const directories = entry[\"directories\"];\n    if (ecosystems.has(ecosystem))\n      throw new Error(`duplicate Dependabot ecosystem: ${ecosystem}`);\n    ecosystems.add(ecosystem);\n    const seen = new Set<string>();\n    for (const directory of directories) {\n      if (\n        !directory.startsWith(\"/\") ||\n        directory.includes(\"\\\\\") ||\n        directory.split(\"/\").some((part) => part === \".\" || part === \"..\") ||\n        path.posix.normalize(directory) !== directory ||\n        (directory !== \"/\" && directory.endsWith(\"/\")) ||\n        /[*?[\\]{}!]/.test(directory)\n      )\n        throw new Error(\n          `Dependabot directory must be a literal absolute repository path: ${directory}`,\n        );\n      if (seen.has(directory))\n        throw new Error(`duplicate Dependabot directory: ${directory}`);\n      seen.add(directory);\n    }\n    return { ecosystem, directories };\n  });\n};\n\ntype GenerateDependabotOptions = CheckDependabotOptions & {\n  updates?: ReturnType<typeof parseDependabotInput> | undefined;\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n  updates: declarations,\n  ignores = [],\n}: GenerateDependabotOptions) => {\n  const conflicts = declaredIgnoreConflicts({ ignores, policy });\n  if (conflicts.length > 0) throw new Error(conflicts.join(\"\\n\"));\n  const detected = ecosystemRoots(files);\n  const roots =\n    declarations === undefined\n      ? detected\n      : new Map(\n          parseDependabotInput({ updates: declarations }).map(\n            ({ ecosystem, directories }) => [ecosystem, new Set(directories)],\n          ),\n        );\n  for (const [ecosystem, directories] of detected) {\n    for (const directory of directories) {\n      if (!roots.get(ecosystem)?.has(directory))\n        throw new Error(\n          `Dependabot input must cover ${ecosystem} directory ${directory}`,\n        );\n    }\n  }\n  for (const { ecosystem, dependency } of ignores)\n    if (!roots.has(ecosystem))\n      throw new Error(\n        `Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`,\n      );\n  const updates = [...roots]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, ecosystemDirectories]) => {\n      const directories = [...ecosystemDirectories].sort();\n      const ignore = [\n        ...ignoredFor(ecosystem, policy).map((name) => ({\n          \"dependency-name\": name,\n          \"update-types\": dependabotIgnoreUpdateTypes,\n        })),\n        ...ignores\n          .filter((declared) => declared.ecosystem === ecosystem)\n          .sort(byDependency)\n          .map(({ dependency, updateTypes }) => ({\n            \"dependency-name\": dependency,\n            \"update-types\": updateTypes,\n          })),\n      ];\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore: ignore.length > 0 ? ignore : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n  ignores = [],\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0 && ignores.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const updatedEcosystems = new Set<string>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const declared = ignores.filter(\n      (declaration) => declaration.ecosystem === ecosystem,\n    );\n    updatedEcosystems.add(ecosystem);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    const entries: unknown[] = Array.isArray(ignore) ? ignore : [];\n    const nameOf = (entry: unknown) =>\n      record(entry) && typeof entry[\"dependency-name\"] === \"string\"\n        ? entry[\"dependency-name\"]\n        : undefined;\n    if (\n      entries.some((entry) => {\n        const name = nameOf(entry);\n        return (\n          name === undefined ||\n          (!ignored.includes(name) &&\n            !declared.some(({ dependency }) => dependency === name))\n        );\n      })\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy or declared in stll-toolchain.json dependabotIgnores`,\n      );\n    if (\n      entries.some((entry) => {\n        const name = nameOf(entry);\n        return (\n          name !== undefined &&\n          ignored.includes(name) &&\n          !versionOnlyIgnore(entry)\n        );\n      })\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`,\n      );\n    for (const name of ignored) {\n      if (\n        !entries.some(\n          (entry) => nameOf(entry) === name && versionOnlyIgnore(entry),\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all version updates for shared pin ${name}`,\n        );\n    }\n    for (const { dependency, updateTypes } of declared) {\n      const matching = entries.filter((entry) => nameOf(entry) === dependency);\n      if (\n        matching.length !== 1 ||\n        !matching.every((entry) => versionIgnore(entry, updateTypes))\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore ${dependency} exactly once with only update-types ${updateTypes.join(\", \")} as declared in stll-toolchain.json`,\n        );\n    }\n  }\n  for (const { ecosystem, dependency } of ignores)\n    if (!updatedEcosystems.has(ecosystem))\n      add(\n        `Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`,\n      );\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n"],"mappings":";;;;;;;;;;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;AAGA,MAAa,oBAAoB,QAC/B,IAAI,QACF,8HACA,EACF;;;ACPF,MAAa,kBAAkB,CAAC,mBAAmB;AAGnD,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAGA,MAAM,yBAAyB,UAC7B,8BAA8B,MAAM,cAAc,cAAc,KAAK;AAqBvE,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAGA,MAAa,8BAA8B;CACzC;CACA;CACA;AACF;AAGA,MAAM,sBACJ,UAEA,4BAA4B,MAAM,eAAe,eAAe,KAAK;AAEvE,MAAM,iBAAiB,OAAgB,gBACrC,OAAO,KAAK,KACZ,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,OAAO,MAAM,uBAAuB,YACpC,YAAY,MAAM,iBAAiB,WAAW;AAEhD,MAAM,qBAAqB,UACzB,cAAc,OAAO,2BAA2B;AAelD,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;AACF;;AAGA,MAAa,0BACX,UACkC;CAClC,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,oCAAoC;CACtD,MAAM,SAAwC,CAAC;CAC/C,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,SAAS,OAAO;EACzB,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC,sBAAsB,MAAM,UAAU,UAAU,GAAG,CAC/D,KACA,OAAO,MAAM,cAAc,YAC3B,MAAM,SAAS,CAAC,KAAK,MAAM,IAE3B,MAAM,IAAI,MACR,+FACF;EACF,MAAM,YAAY,MAAM;EACxB,IAAI,OAAO,cAAc,YAAY,CAAC,sBAAsB,SAAS,GACnE,MAAM,IAAI,MACR,4CAA4C,OAAO,SAAS,GAC9D;EACF,MAAM,aAAa,MAAM;EACzB,IACE,OAAO,eAAe,YACtB,CAAC,kBAAkB,KAAK,UAAU,KAClC,QAAQ,KAAK,UAAU,GAEvB,MAAM,IAAI,MACR,gFAAgF,OAAO,UAAU,GACnG;EACF,MAAM,cAAc,MAAM;EAC1B,IACE,CAAC,MAAM,QAAQ,WAAW,KAC1B,CAAC,YAAY,MAAM,kBAAkB,KACrC,IAAI,IAAI,WAAW,CAAC,CAAC,SAAS,YAAY,QAE1C,MAAM,IAAI,MACR,qBAAqB,WAAW,qCAAqC,4BAA4B,KAAK,IAAI,GAC5G;EACF,MAAM,CAAC,OAAO,GAAG,QAAQ,4BAA4B,QAAQ,eAC3D,YAAY,SAAS,UAAU,CACjC;EACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MACR,qBAAqB,WAAW,mCAClC;EACF,MAAM,MAAM,KAAK,UAAU,CAAC,WAAW,UAAU,CAAC;EAClD,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MACR,gCAAgC,UAAU,GAAG,YAC/C;EACF,KAAK,IAAI,GAAG;EACZ,OAAO,KAAK;GACV;GACA;GACA,aAAa,CAAC,OAAO,GAAG,IAAI;GAC5B,QAAQ,MAAM;EAChB,CAAC;CACH;CACA,OAAO;AACT;;;;;AAMA,MAAa,yBAAyB,cAAkC;CACtE,IAAI,cAAc,KAAA,GAAW,OAAO,CAAC;CACrC,MAAM,SAAkB,KAAK,MAAM,SAAS;CAC5C,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC5E,OAAO,uBAAuB,OAAO,oBAAoB;AAC3D;AAEA,MAAM,qBAAqB,eACzB,IAAI,OACF,IAAI,WACD,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,QAAQ,uBAAuB,MAAM,CAAC,CAAC,CAC1D,KAAK,IAAI,EAAE,EAChB;;AAGF,MAAM,gBACJ,MACA,UACG;CACH,IAAI,KAAK,eAAe,MAAM,YAAY,OAAO;CACjD,OAAO,KAAK,aAAa,MAAM,aAAa,KAAK;AACnD;AAEA,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAO,OAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOC,UAAW,CAAC;CAExE;AACF;AAEA,MAAM,kCAAkC,SAA6B;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,QAAQ,EAAE;EAC/C,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAC9B,IAAI,OAAO,SAAS,sBAAsB,UAAU,OAAO;EAC3D,OAAO;GACL;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU;GAChB,MAAM,eAAe,SAAS;GAC9B,OAAO,OAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS;EACpE,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACCD,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACbA,UAAAA,QAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgBA,UAAAA,QAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,YAAA,GAAWE,KAAAA,cAAAA,CAAc,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAAC,OAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAIF,UAAAA,QAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzCA,UAAAA,QAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,KAAA,GAC5BG,UAAAA,MAAAA,CAAU,MAAM,SAAS,EAAE;GACjC,IAAI,CAAC,OAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAW,OAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAW,OAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAIH,UAAAA,QAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAOI,yBAAAA,kBAAkB;GACvB,WAAW;GACX,MAAMJ,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,IACE,+BACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,WAAW,cAAc,EACjD,KACAK,yBAAAA,8BAA8B,MAC3B,SAAS,MAAML,UAAAA,QAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;KAC1B,IACE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,cACtB,eAAe,MAAM,UAAU,SAAS,CAC1C,GAEA;KACF,YAAY,IAAI,IAAI;KACpB,UAAU;IACZ;IACA,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAA,QAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,UAAA,GAASG,UAAAA,MAAAA,CACb,MAAMH,UAAAA,QAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,aAAA,GAHaG,UAAAA,MAAAA,CACjB,MAAMH,UAAAA,QAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAY,OAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAI,OAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAI,OAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAAC,OAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAAC,OAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAe,OAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAAC,OAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACEA,UAAAA,QAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAASA,UAAAA,QAAK,MAAM,UACxBA,UAAAA,QAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAMA,UAAAA,QAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAIA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAYA,UAAAA,QAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAWA,UAAAA,QAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAA,QAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAA,QAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AASA,MAAM,uBACJ,WACA,UACG;CACH,IAAI,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACtD,SAAS;EACP,IAAI,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;EACnE,IAAI;GACF,MAAM,WAAoB,KAAK,MAC7B,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;GACA,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,sBAAsB,UAC5D,OAAO,SAAS,iBAAiB,CAAC,WAAW,MAAM,IAAI,QAAQ;EACnE,QAAQ,CAER;EACA,KAAK,MAAM,QAAQK,yBAAAA,+BACjB,IAAI,MAAML,UAAAA,QAAK,MAAM,KAAK,MAAM,IAAI,OAAO,KAAA,GAAW,OAAO;EAC/D,IAAI,SAAS,KAAK,OAAO;EACzB,OAAOA,UAAAA,QAAK,MAAM,QAAQ,IAAI;CAChC;AACF;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAeM,yBAAAA,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAON,UAAAA,QAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAMA,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,QAAA,GADSG,UAAAA,MAAAA,CAAU,SACP,CAAC,CAAC;EACpB,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgBH,UAAAA,QAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAIO,yBAAAA,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAOP,UAAAA,QAAK,MAAM,SAAS,IAAI;EACrC,MAAM,oBAAoBQ,yBAAAA,4BAA4B,IAAI;EAC1D,IAAI,sBAAsB,KAAA,GACxB,YAAY,mBAAmB,YAAY,IAAI,CAAC;EAClD,IAAIC,yBAAAA,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAIC,yBAAAA,wBAAwB,IAAI,KAAKC,yBAAAA,2BAA2B,IAAI,GAClE,KAAK,MAAM,aAAA,GAAYC,KAAAA,kBAAAA,CAAkB,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAaC,yBAAAA,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoBC,yBAAAA,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAQA,MAAa,2BAA2B,EACtC,SACA,aAEA,QAAQ,SAAS,EAAE,WAAW,iBAAiB;CAC7C,MAAM,UAAU,kBAAkB,UAAU;CAC5C,OAAO,WAAW,WAAW,MAAM,CAAC,CACjC,QAAQ,QAAQ,QAAQ,KAAK,GAAG,CAAC,CAAC,CAClC,KACE,QACC,qBAAqB,UAAU,GAAG,WAAW,qBAAqB,IAAI,oCAC1E;AACJ,CAAC;;AAGH,MAAa,wBAAwB,UAAmB;CACtD,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,QAAQ,SAAS,KAClD,CAAC,MAAM,QAAQ,MAAM,UAAU,KAC/B,MAAM,UAAU,CAAC,WAAW,GAE5B,MAAM,IAAI,MACR,6DACF;CACF,MAAM,6BAAa,IAAI,IAAY;CACnC,OAAO,MAAM,UAAU,CAAC,KAAK,UAAmB;EAC9C,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,SAAS,GAAG,CACrD,KACA,OAAO,MAAM,iBAAiB,YAC9B,CAAC,QAAQ,MAAM,cAAc,KAC7B,MAAM,cAAc,CAAC,WAAW,GAEhC,MAAM,IAAI,MACR,6EACF;EACF,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,sBAAsB,SAAS,GAClC,MAAM,IAAI,MAAM,qCAAqC,WAAW;EAClE,MAAM,cAAc,MAAM;EAC1B,IAAI,WAAW,IAAI,SAAS,GAC1B,MAAM,IAAI,MAAM,mCAAmC,WAAW;EAChE,WAAW,IAAI,SAAS;EACxB,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,aAAa,aAAa;GACnC,IACE,CAAC,UAAU,WAAW,GAAG,KACzB,UAAU,SAAS,IAAI,KACvB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,OAAO,SAAS,IAAI,KACjEd,UAAAA,QAAK,MAAM,UAAU,SAAS,MAAM,aACnC,cAAc,OAAO,UAAU,SAAS,GAAG,KAC5C,aAAa,KAAK,SAAS,GAE3B,MAAM,IAAI,MACR,oEAAoE,WACtE;GACF,IAAI,KAAK,IAAI,SAAS,GACpB,MAAM,IAAI,MAAM,mCAAmC,WAAW;GAChE,KAAK,IAAI,SAAS;EACpB;EACA,OAAO;GAAE;GAAW;EAAY;CAClC,CAAC;AACH;;AAOA,MAAa,4BAA4B,EACvC,OACA,QACA,SAAS,cACT,UAAU,CAAC,QACoB;CAC/B,MAAM,YAAY,wBAAwB;EAAE;EAAS;CAAO,CAAC;CAC7D,IAAI,UAAU,SAAS,GAAG,MAAM,IAAI,MAAM,UAAU,KAAK,IAAI,CAAC;CAC9D,MAAM,WAAW,eAAe,KAAK;CACrC,MAAM,QACJ,iBAAiB,KAAA,IACb,WACA,IAAI,IACF,qBAAqB,EAAE,SAAS,aAAa,CAAC,CAAC,CAAC,KAC7C,EAAE,WAAW,kBAAkB,CAAC,WAAW,IAAI,IAAI,WAAW,CAAC,CAClE,CACF;CACN,KAAK,MAAM,CAAC,WAAW,gBAAgB,UACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACtC,MAAM,IAAI,MACR,+BAA+B,UAAU,aAAa,WACxD;CAGN,KAAK,MAAM,EAAE,WAAW,gBAAgB,SACtC,IAAI,CAAC,MAAM,IAAI,SAAS,GACtB,MAAM,IAAI,MACR,qBAAqB,UAAU,GAAG,WAAW,UAAU,UAAU,cACnE;CACJ,MAAM,UAAU,CAAC,GAAG,KAAK,CAAC,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC,CAAC,CACpD,KAAK,CAAC,WAAW,0BAA0B;EAC1C,MAAM,cAAc,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK;EACnD,MAAM,SAAS,CACb,GAAG,WAAW,WAAW,MAAM,CAAC,CAAC,KAAK,UAAU;GAC9C,mBAAmB;GACnB,gBAAgB;EAClB,EAAE,GACF,GAAG,QACA,QAAQ,aAAa,SAAS,cAAc,SAAS,CAAC,CACtD,KAAK,YAAY,CAAC,CAClB,KAAK,EAAE,YAAY,mBAAmB;GACrC,mBAAmB;GACnB,gBAAgB;EAClB,EAAE,CACN;EACA,MAAM,OAAO,IAAIe,KAAAA,OAAO,OAAO,SAAS,IAAI;EAC5C,KAAK,OAAOA,KAAAA,OAAO;EACnB,OAAO;GACL,qBAAqB;GACrB,WAAW,YAAY,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,KAAA;GAC1D,aAAa,YAAY,SAAS,IAAI,cAAc,KAAA;GACpD,UAAU;IACR,UAAU,OAAO,SAAS;IAC1B,KAAK,OAAO,SAAS;IACrB;IACA,UAAU,OAAO,SAAS;GAC5B;GACA,UAAU,EAAE,gBAAgB,OAAO,SAAS,YAAY;GACxD,QAAQ,OAAO,YACb,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACnD,MACA;IAAE,UAAU,MAAM;IAAU,gBAAgB,MAAM;GAAY,CAChE,CAAC,CACH;GACA,QAAQ,OAAO,SAAS,IAAI,SAAS,KAAA;EACvC;CACF,CAAC;CACH,QAAA,GAAOC,KAAAA,UAAAA,CAAU;EAAE,SAAS;EAAG;CAAQ,GAAG,EAAE,uBAAuB,MAAM,CAAC;AAC5E;;AAGA,MAAa,mBAAmB,EAC9B,OACA,QACA,UAAU,CAAC,QAC+B;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,KAAK,QAAQ,WAAW,GAAG,OAAO,CAAC;CAC5E,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAIC,KAAAA,YAAY;CACpC,MAAM,YAAA,GAAWf,KAAAA,cAAAA,CAAc,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAAC,OAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,kBAAA,GAAiBA,KAAAA,cAAAA,CAAc,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJ,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,oCAAoB,IAAI,IAAY;CAC1C,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,UAAA,GAASgB,KAAAA,OAAAA,CAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAUlB,UAAAA,QAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAA,QAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiB,OAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACE,OAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAAC,OAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAAC,OAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,WAAW,QAAQ,QACtB,gBAAgB,YAAY,cAAc,SAC7C;EACA,kBAAkB,IAAI,SAAS;EAC/B,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,MAAM,UAAqB,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC;EAC7D,MAAM,UAAU,UACd,OAAO,KAAK,KAAK,OAAO,MAAM,uBAAuB,WACjD,MAAM,qBACN,KAAA;EACN,IACE,QAAQ,MAAM,UAAU;GACtB,MAAM,OAAO,OAAO,KAAK;GACzB,OACE,SAAS,KAAA,KACR,CAAC,QAAQ,SAAS,IAAI,KACrB,CAAC,SAAS,MAAM,EAAE,iBAAiB,eAAe,IAAI;EAE5D,CAAC,GAED,OACE,UACA,GAAG,UAAU,uGACf;EACF,IACE,QAAQ,MAAM,UAAU;GACtB,MAAM,OAAO,OAAO,KAAK;GACzB,OACE,SAAS,KAAA,KACT,QAAQ,SAAS,IAAI,KACrB,CAAC,kBAAkB,KAAK;EAE5B,CAAC,GAED,OACE,UACA,GAAG,UAAU,mLACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,QAAQ,MACN,UAAU,OAAO,KAAK,MAAM,QAAQ,kBAAkB,KAAK,CAC9D,GAEA,OACE,UACA,GAAG,UAAU,8CAA8C,MAC7D;EAEJ,KAAK,MAAM,EAAE,YAAY,iBAAiB,UAAU;GAClD,MAAM,WAAW,QAAQ,QAAQ,UAAU,OAAO,KAAK,MAAM,UAAU;GACvE,IACE,SAAS,WAAW,KACpB,CAAC,SAAS,OAAO,UAAU,cAAc,OAAO,WAAW,CAAC,GAE5D,OACE,UACA,GAAG,UAAU,WAAW,WAAW,uCAAuC,YAAY,KAAK,IAAI,EAAE,oCACnG;EACJ;CACF;CACA,KAAK,MAAM,EAAE,WAAW,gBAAgB,SACtC,IAAI,CAAC,kBAAkB,IAAI,SAAS,GAClC,IACE,qBAAqB,UAAU,GAAG,WAAW,UAAU,UAAU,cACnE;CACJ,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT"}