@stll/oxlint-config 1.5.2 → 1.6.0

package/dist/toolchain-dependabot.mjs

@@ -72,12 +72,64 @@ const sameStrings = (value, expected) => {
 	const sortedExpected = [...expected].sort();
 	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
 };
-const pinnedVersionUpdateTypes = [
+const dependabotIgnoreUpdateTypes = [
 	"version-update:semver-major",
 	"version-update:semver-minor",
 	"version-update:semver-patch"
 ];
-const versionOnlyIgnore = (entry) => record(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], pinnedVersionUpdateTypes);
+const isIgnoreUpdateType = (value) => dependabotIgnoreUpdateTypes.some((updateType) => updateType === value);
+const versionIgnore = (entry, updateTypes) => record(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], updateTypes);
+const versionOnlyIgnore = (entry) => versionIgnore(entry, dependabotIgnoreUpdateTypes);
+const ignoreDeclarationKeys = [
+	"ecosystem",
+	"dependency",
+	"updateTypes",
+	"reason"
+];
+/** Parse `dependabotIgnores` from stll-toolchain.json; malformed decisions fail closed. */
+const parseDependabotIgnores = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("dependabotIgnores must be an array");
+	const result = [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const entry of input) {
+		if (!record(entry) || Object.keys(entry).some((key) => !ignoreDeclarationKeys.some((known) => known === key)) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "") throw new Error("each Dependabot ignore requires ecosystem, dependency, updateTypes and a nonempty reason only");
+		const ecosystem = entry["ecosystem"];
+		if (typeof ecosystem !== "string" || !isDependabotEcosystem(ecosystem)) throw new Error(`unsupported Dependabot ignore ecosystem: ${String(ecosystem)}`);
+		const dependency = entry["dependency"];
+		if (typeof dependency !== "string" || !/^[^\s?[\]{}!]+$/.test(dependency) || /^\*+$/.test(dependency)) throw new Error(`Dependabot ignore dependency must name a dependency; * is the only wildcard: ${String(dependency)}`);
+		const updateTypes = entry["updateTypes"];
+		if (!Array.isArray(updateTypes) || !updateTypes.every(isIgnoreUpdateType) || new Set(updateTypes).size !== updateTypes.length) throw new Error(`Dependabot ignore ${dependency} requires unique update types from ${dependabotIgnoreUpdateTypes.join(", ")}`);
+		const [first, ...rest] = dependabotIgnoreUpdateTypes.filter((updateType) => updateTypes.includes(updateType));
+		if (first === void 0) throw new Error(`Dependabot ignore ${dependency} requires at least one update type`);
+		const key = JSON.stringify([ecosystem, dependency]);
+		if (keys.has(key)) throw new Error(`duplicate Dependabot ignore: ${ecosystem} ${dependency}`);
+		keys.add(key);
+		result.push({
+			ecosystem,
+			dependency,
+			updateTypes: [first, ...rest],
+			reason: entry["reason"]
+		});
+	}
+	return result;
+};
+/**
+* Read only `dependabotIgnores` from stll-toolchain.json text: stll-dependabot must not
+* fail on unrelated declarations, which stll-toolchain-check validates.
+*/
+const readDependabotIgnores = (toolchain) => {
+	if (toolchain === void 0) return [];
+	const parsed = JSON.parse(toolchain);
+	if (!record(parsed)) throw new Error("stll-toolchain.json must be an object");
+	return parseDependabotIgnores(parsed["dependabotIgnores"]);
+};
+const dependencyPattern = (dependency) => new RegExp(`^${dependency.split("*").map((part) => part.replace(/[.+^${}()|[\]\\/?]/g, "\\$&")).join(".*")}$`);
+/** Code-unit order keeps generated bytes independent of the host locale. */
+const byDependency = (left, right) => {
+	if (left.dependency === right.dependency) return 0;
+	return left.dependency < right.dependency ? -1 : 1;
+};
 const directoryOf = (file) => {
 	const directory = path.posix.dirname(file);
 	return directory === "." ? "/" : `/${directory}`;
@@ -306,6 +358,11 @@ const ignoredFor = (ecosystem, policy) => {
 	if (ecosystem === "docker" || ecosystem === "docker-compose") return ownedDockerImageAliases(policy.ignoredImages);
 	return [];
 };
+/** Shared pins stay owned by the shared policy; declarations cannot name or match them. */
+const declaredIgnoreConflicts = ({ ignores, policy }) => ignores.flatMap(({ ecosystem, dependency }) => {
+	const pattern = dependencyPattern(dependency);
+	return ignoredFor(ecosystem, policy).filter((pin) => pattern.test(pin)).map((pin) => `Dependabot ignore ${ecosystem} ${dependency} covers shared pin ${pin}; the shared policy owns its ignore`);
+});
 /** Repository declarations own coverage only; shared policy owns every update option. */
 const parseDependabotInput = (input) => {
 	if (!record(input) || Object.keys(input).some((key) => key !== "updates") || !Array.isArray(input["updates"]) || input["updates"].length === 0) throw new Error("Dependabot input must contain a nonempty updates array only");
@@ -330,13 +387,25 @@ const parseDependabotInput = (input) => {
 	});
 };
 /** Generate canonical YAML from the same ecosystem enumeration used by the guard. */
-const generateDependabotConfig = ({ files, policy, updates: declarations }) => {
+const generateDependabotConfig = ({ files, policy, updates: declarations, ignores = [] }) => {
+	const conflicts = declaredIgnoreConflicts({
+		ignores,
+		policy
+	});
+	if (conflicts.length > 0) throw new Error(conflicts.join("\n"));
 	const detected = ecosystemRoots(files);
 	const roots = declarations === void 0 ? detected : new Map(parseDependabotInput({ updates: declarations }).map(({ ecosystem, directories }) => [ecosystem, new Set(directories)]));
 	for (const [ecosystem, directories] of detected) for (const directory of directories) if (!roots.get(ecosystem)?.has(directory)) throw new Error(`Dependabot input must cover ${ecosystem} directory ${directory}`);
+	for (const { ecosystem, dependency } of ignores) if (!roots.has(ecosystem)) throw new Error(`Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`);
 	const updates = [...roots].sort(([left], [right]) => left.localeCompare(right)).map(([ecosystem, ecosystemDirectories]) => {
 		const directories = [...ecosystemDirectories].sort();
-		const ignored = ignoredFor(ecosystem, policy);
+		const ignore = [...ignoredFor(ecosystem, policy).map((name) => ({
+			"dependency-name": name,
+			"update-types": dependabotIgnoreUpdateTypes
+		})), ...ignores.filter((declared) => declared.ecosystem === ecosystem).sort(byDependency).map(({ dependency, updateTypes }) => ({
+			"dependency-name": dependency,
+			"update-types": updateTypes
+		}))];
 		const time = new Scalar(policy.schedule.time);
 		time.type = Scalar.QUOTE_DOUBLE;
 		return {
@@ -354,10 +423,7 @@ const generateDependabotConfig = ({ files, policy, updates: declarations }) => {
 				patterns: group.patterns,
 				"update-types": group.updateTypes
 			}])),
-			ignore: ignored.length > 0 ? ignored.map((name) => ({
-				"dependency-name": name,
-				"update-types": pinnedVersionUpdateTypes
-			})) : void 0
+			ignore: ignore.length > 0 ? ignore : void 0
 		};
 	});
 	return stringify({
@@ -366,10 +432,10 @@ const generateDependabotConfig = ({ files, policy, updates: declarations }) => {
 	}, { aliasDuplicateObjects: false });
 };
 /** Validate the shared update policy against a hermetic tracked-file snapshot. */
-const checkDependabot = ({ files, policy }) => {
+const checkDependabot = ({ files, policy, ignores = [] }) => {
 	const roots = ecosystemRoots(files);
 	const paths = [".github/dependabot.yml", ".github/dependabot.yaml"].filter((file) => files[file] !== void 0);
-	if (roots.size === 0 && paths.length === 0) return [];
+	if (roots.size === 0 && paths.length === 0 && ignores.length === 0) return [];
 	const file = paths.at(0) ?? ".github/dependabot.yml";
 	const diagnostics = [];
 	const add = (message, line = 1) => {
@@ -413,6 +479,7 @@ const checkDependabot = ({ files, policy }) => {
 	} catch {}
 	const legacyUpdates = record(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
 	const rootClaims = /* @__PURE__ */ new Map();
+	const updatedEcosystems = /* @__PURE__ */ new Set();
 	const directoryClaims = /* @__PURE__ */ new Map();
 	for (const [index, update] of parsed["updates"].entries()) {
 		const lineOf = (key) => {
@@ -470,16 +537,31 @@ const checkDependabot = ({ files, policy }) => {
 			return !record(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
 		})) report("groups", `${ecosystem}: groups must match the shared policy`);
 		const ignored = ignoredFor(ecosystem, policy);
+		const declared = ignores.filter((declaration) => declaration.ecosystem === ecosystem);
+		updatedEcosystems.add(ecosystem);
 		const ignore = update["ignore"];
 		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !record(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record(entry) && entry["dependency-name"] === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
+		const entries = Array.isArray(ignore) ? ignore : [];
+		const nameOf = (entry) => record(entry) && typeof entry["dependency-name"] === "string" ? entry["dependency-name"] : void 0;
+		if (entries.some((entry) => {
+			const name = nameOf(entry);
+			return name === void 0 || !ignored.includes(name) && !declared.some(({ dependency }) => dependency === name);
+		})) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy or declared in stll-toolchain.json dependabotIgnores`);
+		if (entries.some((entry) => {
+			const name = nameOf(entry);
+			return name !== void 0 && ignored.includes(name) && !versionOnlyIgnore(entry);
+		})) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
+		for (const name of ignored) if (!entries.some((entry) => nameOf(entry) === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
+		for (const { dependency, updateTypes } of declared) {
+			const matching = entries.filter((entry) => nameOf(entry) === dependency);
+			if (matching.length !== 1 || !matching.every((entry) => versionIgnore(entry, updateTypes))) report("ignore", `${ecosystem}: ignore ${dependency} exactly once with only update-types ${updateTypes.join(", ")} as declared in stll-toolchain.json`);
+		}
 	}
+	for (const { ecosystem, dependency } of ignores) if (!updatedEcosystems.has(ecosystem)) add(`Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`);
 	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
 	return diagnostics;
 };
 //#endregion
-export { supportedDependabotEcosystems as a, parseDependabotInput as i, dependabotRules as n, canonicalDockerRuntime as o, generateDependabotConfig as r, rustImageVersion as s, checkDependabot as t };
+export { generateDependabotConfig as a, readDependabotIgnores as c, rustImageVersion as d, dependabotRules as i, supportedDependabotEcosystems as l, declaredIgnoreConflicts as n, parseDependabotIgnores as o, dependabotIgnoreUpdateTypes as r, parseDependabotInput as s, checkDependabot as t, canonicalDockerRuntime as u };
 
 //# sourceMappingURL=toolchain-dependabot.mjs.map

package/dist/toolchain-dependabot.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-dependabot.mjs","names":["unexpected","parseToml"],"sources":["../src/toolchain-images.ts","../src/toolchain-dependabot.ts"],"sourcesContent":["/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n\n/** Preserve Rust release identity across official Debian slim and Alpine variants. */\nexport const rustImageVersion = (tag: string) =>\n  tag.replace(\n    /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/,\n    \"\",\n  );\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n  dependabotManifestEcosystem,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\n// https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem\nexport const supportedDependabotEcosystems = [\n  \"bazel\",\n  \"bun\",\n  \"bundler\",\n  \"cargo\",\n  \"composer\",\n  \"conda\",\n  \"deno\",\n  \"devcontainers\",\n  \"docker\",\n  \"docker-compose\",\n  \"dotnet-sdk\",\n  \"elm\",\n  \"gitsubmodule\",\n  \"github-actions\",\n  \"gomod\",\n  \"gradle\",\n  \"helm\",\n  \"julia\",\n  \"maven\",\n  \"mix\",\n  \"nix\",\n  \"npm\",\n  \"nuget\",\n  \"opentofu\",\n  \"pip\",\n  \"pre-commit\",\n  \"pub\",\n  \"rust-toolchain\",\n  \"sbt\",\n  \"swift\",\n  \"terraform\",\n  \"uv\",\n  \"vcpkg\",\n] as const;\nexport type DependabotEcosystem =\n  (typeof supportedDependabotEcosystems)[number];\nconst isDependabotEcosystem = (value: string): value is DependabotEcosystem =>\n  supportedDependabotEcosystems.some((ecosystem) => ecosystem === value);\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\nconst pinnedVersionUpdateTypes = [\n  \"version-update:semver-major\",\n  \"version-update:semver-minor\",\n  \"version-update:semver-patch\",\n];\n\nconst versionOnlyIgnore = (entry: unknown) =>\n  record(entry) &&\n  Object.keys(entry).length === 2 &&\n  typeof entry[\"dependency-name\"] === \"string\" &&\n  sameStrings(entry[\"update-types\"], pinnedVersionUpdateTypes);\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\nconst declaresJavascriptInstallation = (text: string | undefined) => {\n  try {\n    const manifest: unknown = JSON.parse(text ?? \"\");\n    if (!record(manifest)) return false;\n    if (typeof manifest[\"packageManager\"] === \"string\") return true;\n    return [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ].some((field) => {\n      const dependencies = manifest[field];\n      return record(dependencies) && Object.keys(dependencies).length > 0;\n    });\n  } catch {\n    // Manifest validation reports invalid JSON independently.\n    return false;\n  }\n};\n\n/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        declaresJavascriptInstallation(\n          files[path.posix.join(directory, \"package.json\")],\n        ) ||\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) {\n          if (\n            ![...installable].some((directory) =>\n              declaredMember(root, patterns, directory),\n            )\n          )\n            continue;\n          installable.add(root);\n          changed = true;\n        }\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  let root = directory === \"/\" ? \".\" : directory.slice(1);\n  for (;;) {\n    if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n    try {\n      const manifest: unknown = JSON.parse(\n        files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n      );\n      if (record(manifest) && typeof manifest[\"packageManager\"] === \"string\")\n        return manifest[\"packageManager\"].startsWith(\"bun@\") ? \"bun\" : \"npm\";\n    } catch {\n      // Package rules diagnose malformed JSON; retain its update coverage.\n    }\n    for (const name of javascriptDependencyLockfiles)\n      if (files[path.posix.join(root, name)] !== undefined) return \"npm\";\n    if (root === \".\") return \"npm\";\n    root = path.posix.dirname(root);\n  }\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    const manifestEcosystem = dependabotManifestEcosystem(file);\n    if (manifestEcosystem !== undefined)\n      requireRoot(manifestEcosystem, directoryOf(file));\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\n/** Repository declarations own coverage only; shared policy owns every update option. */\nexport const parseDependabotInput = (input: unknown) => {\n  if (\n    !record(input) ||\n    Object.keys(input).some((key) => key !== \"updates\") ||\n    !Array.isArray(input[\"updates\"]) ||\n    input[\"updates\"].length === 0\n  )\n    throw new Error(\n      \"Dependabot input must contain a nonempty updates array only\",\n    );\n  const ecosystems = new Set<string>();\n  return input[\"updates\"].map((entry: unknown) => {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"ecosystem\", \"directories\"].includes(key),\n      ) ||\n      typeof entry[\"ecosystem\"] !== \"string\" ||\n      !strings(entry[\"directories\"]) ||\n      entry[\"directories\"].length === 0\n    )\n      throw new Error(\n        \"each Dependabot update must contain ecosystem and nonempty directories only\",\n      );\n    const ecosystem = entry[\"ecosystem\"];\n    if (!isDependabotEcosystem(ecosystem))\n      throw new Error(`unsupported Dependabot ecosystem: ${ecosystem}`);\n    const directories = entry[\"directories\"];\n    if (ecosystems.has(ecosystem))\n      throw new Error(`duplicate Dependabot ecosystem: ${ecosystem}`);\n    ecosystems.add(ecosystem);\n    const seen = new Set<string>();\n    for (const directory of directories) {\n      if (\n        !directory.startsWith(\"/\") ||\n        directory.includes(\"\\\\\") ||\n        directory.split(\"/\").some((part) => part === \".\" || part === \"..\") ||\n        path.posix.normalize(directory) !== directory ||\n        (directory !== \"/\" && directory.endsWith(\"/\")) ||\n        /[*?[\\]{}!]/.test(directory)\n      )\n        throw new Error(\n          `Dependabot directory must be a literal absolute repository path: ${directory}`,\n        );\n      if (seen.has(directory))\n        throw new Error(`duplicate Dependabot directory: ${directory}`);\n      seen.add(directory);\n    }\n    return { ecosystem, directories };\n  });\n};\n\ntype GenerateDependabotOptions = CheckDependabotOptions & {\n  updates?: ReturnType<typeof parseDependabotInput> | undefined;\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n  updates: declarations,\n}: GenerateDependabotOptions) => {\n  const detected = ecosystemRoots(files);\n  const roots =\n    declarations === undefined\n      ? detected\n      : new Map(\n          parseDependabotInput({ updates: declarations }).map(\n            ({ ecosystem, directories }) => [ecosystem, new Set(directories)],\n          ),\n        );\n  for (const [ecosystem, directories] of detected) {\n    for (const directory of directories) {\n      if (!roots.get(ecosystem)?.has(directory))\n        throw new Error(\n          `Dependabot input must cover ${ecosystem} directory ${directory}`,\n        );\n    }\n  }\n  const updates = [...roots]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, ecosystemDirectories]) => {\n      const directories = [...ecosystemDirectories].sort();\n      const ignored = ignoredFor(ecosystem, policy);\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore:\n          ignored.length > 0\n            ? ignored.map((name) => ({\n                \"dependency-name\": name,\n                \"update-types\": pinnedVersionUpdateTypes,\n              }))\n            : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    if (\n      Array.isArray(ignore) &&\n      ignore.some(\n        (entry: unknown) =>\n          !record(entry) ||\n          typeof entry[\"dependency-name\"] !== \"string\" ||\n          !ignored.includes(entry[\"dependency-name\"]),\n      )\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy`,\n      );\n    if (\n      Array.isArray(ignore) &&\n      ignore.some((entry: unknown) => !versionOnlyIgnore(entry))\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`,\n      );\n    for (const name of ignored) {\n      if (\n        !Array.isArray(ignore) ||\n        !ignore.some(\n          (entry: unknown) =>\n            record(entry) &&\n            entry[\"dependency-name\"] === name &&\n            versionOnlyIgnore(entry),\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all version updates for shared pin ${name}`,\n        );\n    }\n  }\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n"],"mappings":";;;;;;;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;AAGA,MAAa,oBAAoB,QAC/B,IAAI,QACF,8HACA,EACF;;;ACPF,MAAa,kBAAkB,CAAC,mBAAmB;AAGnD,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAGA,MAAM,yBAAyB,UAC7B,8BAA8B,MAAM,cAAc,cAAc,KAAK;AAqBvE,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAEA,MAAM,2BAA2B;CAC/B;CACA;CACA;AACF;AAEA,MAAM,qBAAqB,UACzB,OAAO,KAAK,KACZ,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,OAAO,MAAM,uBAAuB,YACpC,YAAY,MAAM,iBAAiB,wBAAwB;AAE7D,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAO,OAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOA,UAAW,CAAC;CAExE;AACF;AAEA,MAAM,kCAAkC,SAA6B;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,QAAQ,EAAE;EAC/C,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAC9B,IAAI,OAAO,SAAS,sBAAsB,UAAU,OAAO;EAC3D,OAAO;GACL;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU;GAChB,MAAM,eAAe,SAAS;GAC9B,OAAO,OAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS;EACpE,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACC,KAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACb,KAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgB,KAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,WAAW,cAAc,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAAC,OAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAI,KAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzC,KAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,IAC5BC,MAAU,MAAM,SAAS,EAAE;GACjC,IAAI,CAAC,OAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAW,OAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAW,OAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAI,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAO,kBAAkB;GACvB,WAAW;GACX,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,IACE,+BACE,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,EACjD,KACA,8BAA8B,MAC3B,SAAS,MAAM,KAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;KAC1B,IACE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,cACtB,eAAe,MAAM,UAAU,SAAS,CAC1C,GAEA;KACF,YAAY,IAAI,IAAI;KACpB,UAAU;IACZ;IACA,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,SAASA,MACb,MAAM,KAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,YAHaA,MACjB,MAAM,KAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAY,OAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAI,OAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAI,OAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAAC,OAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAAC,OAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAe,OAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAAC,OAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACE,KAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAAS,KAAK,MAAM,UACxB,KAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAM,KAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAI,KAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AAOA,MAAM,uBACJ,WACA,UACG;CACH,IAAI,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACtD,SAAS;EACP,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;EACnE,IAAI;GACF,MAAM,WAAoB,KAAK,MAC7B,MAAM,KAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;GACA,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,sBAAsB,UAC5D,OAAO,SAAS,iBAAiB,CAAC,WAAW,MAAM,IAAI,QAAQ;EACnE,QAAQ,CAER;EACA,KAAK,MAAM,QAAQ,+BACjB,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,OAAO,KAAA,GAAW,OAAO;EAC/D,IAAI,SAAS,KAAK,OAAO;EACzB,OAAO,KAAK,MAAM,QAAQ,IAAI;CAChC;AACF;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAe,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAO,KAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAM,KAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,OADSA,MAAU,SACP,CAAC,CAAC;EACpB,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgB,KAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAI,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,oBAAoB,4BAA4B,IAAI;EAC1D,IAAI,sBAAsB,KAAA,GACxB,YAAY,mBAAmB,YAAY,IAAI,CAAC;EAClD,IAAI,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAClE,KAAK,MAAM,YAAY,kBAAkB,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAa,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoB,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAGA,MAAa,wBAAwB,UAAmB;CACtD,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,QAAQ,SAAS,KAClD,CAAC,MAAM,QAAQ,MAAM,UAAU,KAC/B,MAAM,UAAU,CAAC,WAAW,GAE5B,MAAM,IAAI,MACR,6DACF;CACF,MAAM,6BAAa,IAAI,IAAY;CACnC,OAAO,MAAM,UAAU,CAAC,KAAK,UAAmB;EAC9C,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,SAAS,GAAG,CACrD,KACA,OAAO,MAAM,iBAAiB,YAC9B,CAAC,QAAQ,MAAM,cAAc,KAC7B,MAAM,cAAc,CAAC,WAAW,GAEhC,MAAM,IAAI,MACR,6EACF;EACF,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,sBAAsB,SAAS,GAClC,MAAM,IAAI,MAAM,qCAAqC,WAAW;EAClE,MAAM,cAAc,MAAM;EAC1B,IAAI,WAAW,IAAI,SAAS,GAC1B,MAAM,IAAI,MAAM,mCAAmC,WAAW;EAChE,WAAW,IAAI,SAAS;EACxB,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,aAAa,aAAa;GACnC,IACE,CAAC,UAAU,WAAW,GAAG,KACzB,UAAU,SAAS,IAAI,KACvB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,OAAO,SAAS,IAAI,KACjE,KAAK,MAAM,UAAU,SAAS,MAAM,aACnC,cAAc,OAAO,UAAU,SAAS,GAAG,KAC5C,aAAa,KAAK,SAAS,GAE3B,MAAM,IAAI,MACR,oEAAoE,WACtE;GACF,IAAI,KAAK,IAAI,SAAS,GACpB,MAAM,IAAI,MAAM,mCAAmC,WAAW;GAChE,KAAK,IAAI,SAAS;EACpB;EACA,OAAO;GAAE;GAAW;EAAY;CAClC,CAAC;AACH;;AAOA,MAAa,4BAA4B,EACvC,OACA,QACA,SAAS,mBACsB;CAC/B,MAAM,WAAW,eAAe,KAAK;CACrC,MAAM,QACJ,iBAAiB,KAAA,IACb,WACA,IAAI,IACF,qBAAqB,EAAE,SAAS,aAAa,CAAC,CAAC,CAAC,KAC7C,EAAE,WAAW,kBAAkB,CAAC,WAAW,IAAI,IAAI,WAAW,CAAC,CAClE,CACF;CACN,KAAK,MAAM,CAAC,WAAW,gBAAgB,UACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACtC,MAAM,IAAI,MACR,+BAA+B,UAAU,aAAa,WACxD;CAGN,MAAM,UAAU,CAAC,GAAG,KAAK,CAAC,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC,CAAC,CACpD,KAAK,CAAC,WAAW,0BAA0B;EAC1C,MAAM,cAAc,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK;EACnD,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,OAAO,IAAI,OAAO,OAAO,SAAS,IAAI;EAC5C,KAAK,OAAO,OAAO;EACnB,OAAO;GACL,qBAAqB;GACrB,WAAW,YAAY,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,KAAA;GAC1D,aAAa,YAAY,SAAS,IAAI,cAAc,KAAA;GACpD,UAAU;IACR,UAAU,OAAO,SAAS;IAC1B,KAAK,OAAO,SAAS;IACrB;IACA,UAAU,OAAO,SAAS;GAC5B;GACA,UAAU,EAAE,gBAAgB,OAAO,SAAS,YAAY;GACxD,QAAQ,OAAO,YACb,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACnD,MACA;IAAE,UAAU,MAAM;IAAU,gBAAgB,MAAM;GAAY,CAChE,CAAC,CACH;GACA,QACE,QAAQ,SAAS,IACb,QAAQ,KAAK,UAAU;IACrB,mBAAmB;IACnB,gBAAgB;GAClB,EAAE,IACF,KAAA;EACR;CACF,CAAC;CACH,OAAO,UAAU;EAAE,SAAS;EAAG;CAAQ,GAAG,EAAE,uBAAuB,MAAM,CAAC;AAC5E;;AAGA,MAAa,mBAAmB,EAC9B,OACA,aAC0C;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,GAAG,OAAO,CAAC;CACpD,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAI,YAAY;CACpC,MAAM,WAAW,cAAc,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAAC,OAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,iBAAiB,cAAc,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJ,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,SAAS,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAU,KAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiB,OAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACE,OAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAAC,OAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAAC,OAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MACJ,UACC,CAAC,OAAO,KAAK,KACb,OAAO,MAAM,uBAAuB,YACpC,CAAC,QAAQ,SAAS,MAAM,kBAAkB,CAC9C,GAEA,OACE,UACA,GAAG,UAAU,kDACf;EACF,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,MAAM,UAAmB,CAAC,kBAAkB,KAAK,CAAC,GAEzD,OACE,UACA,GAAG,UAAU,mLACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,CAAC,OAAO,MACL,UACC,OAAO,KAAK,KACZ,MAAM,uBAAuB,QAC7B,kBAAkB,KAAK,CAC3B,GAEA,OACE,UACA,GAAG,UAAU,8CAA8C,MAC7D;CAEN;CACA,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT"}
+{"version":3,"file":"toolchain-dependabot.mjs","names":["unexpected","parseToml"],"sources":["../src/toolchain-images.ts","../src/toolchain-dependabot.ts"],"sourcesContent":["/** Docker Hub spellings accepted by the shared runtime policy. */\nexport const dockerHubRegistries = [\n  \"docker.io\",\n  \"index.docker.io\",\n  \"registry-1.docker.io\",\n] as const;\n\n/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */\nexport const ownedDockerImageAliases = (images: readonly string[]) => {\n  const aliases = new Set<string>();\n  for (const image of images) {\n    for (const repository of [image, `library/${image}`]) {\n      aliases.add(repository);\n      for (const registry of dockerHubRegistries)\n        aliases.add(`${registry}/${repository}`);\n    }\n  }\n  return [...aliases].sort();\n};\n\n/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */\nexport const canonicalDockerRuntime = (image: string) => {\n  const registry = dockerHubRegistries.find((entry) =>\n    image.toLowerCase().startsWith(`${entry}/`),\n  );\n  const repository =\n    registry === undefined ? image : image.slice(registry.length + 1);\n  return repository.replace(/^library\\//i, \"\");\n};\n\n/** Preserve Rust release identity across official Debian slim and Alpine variants. */\nexport const rustImageVersion = (tag: string) =>\n  tag.replace(\n    /-(?:alpine(?:\\d+(?:\\.\\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/,\n    \"\",\n  );\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\nimport { parse as parseToml } from \"smol-toml\";\nimport {\n  isNode,\n  LineCounter,\n  parseAllDocuments,\n  parseDocument,\n  Scalar,\n  stringify,\n} from \"yaml\";\n\nimport {\n  containerDocumentImages,\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\nimport { ownedDockerImageAliases } from \"./toolchain-images\";\nimport {\n  isDependabotGithubActionsPath,\n  isDockerDefinitionPath,\n  pythonDependencyManifestKind,\n  isPythonDependencyManifest,\n  javascriptDependencyLockfiles,\n  dependabotManifestEcosystem,\n} from \"./toolchain-inputs\";\nimport { workspaceContains } from \"./toolchain-workspaces\";\n\nexport const dependabotRules = [\"dependabot-policy\"] as const;\n\n// https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem\nexport const supportedDependabotEcosystems = [\n  \"bazel\",\n  \"bun\",\n  \"bundler\",\n  \"cargo\",\n  \"composer\",\n  \"conda\",\n  \"deno\",\n  \"devcontainers\",\n  \"docker\",\n  \"docker-compose\",\n  \"dotnet-sdk\",\n  \"elm\",\n  \"gitsubmodule\",\n  \"github-actions\",\n  \"gomod\",\n  \"gradle\",\n  \"helm\",\n  \"julia\",\n  \"maven\",\n  \"mix\",\n  \"nix\",\n  \"npm\",\n  \"nuget\",\n  \"opentofu\",\n  \"pip\",\n  \"pre-commit\",\n  \"pub\",\n  \"rust-toolchain\",\n  \"sbt\",\n  \"swift\",\n  \"terraform\",\n  \"uv\",\n  \"vcpkg\",\n] as const;\nexport type DependabotEcosystem =\n  (typeof supportedDependabotEcosystems)[number];\nconst isDependabotEcosystem = (value: string): value is DependabotEcosystem =>\n  supportedDependabotEcosystems.some((ecosystem) => ecosystem === value);\n\ntype DependabotPolicy = {\n  schedule: { interval: string; day: string; time: string; timezone: string };\n  cooldown: { defaultDays: number };\n  groups: Record<\n    string,\n    { patterns: readonly string[]; updateTypes: readonly string[] }\n  >;\n  ignoredPackages: readonly string[];\n  ignoredActions: readonly string[];\n  ignoredImages: readonly string[];\n};\n\ntype Diagnostic = {\n  rule: (typeof dependabotRules)[number];\n  path: string;\n  line: number;\n  message: string;\n};\n\nconst record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst strings = (value: unknown): value is string[] =>\n  Array.isArray(value) &&\n  value.every((entry: unknown) => typeof entry === \"string\");\n\nconst sameStrings = (value: unknown, expected: readonly string[]) => {\n  if (!strings(value) || value.length !== expected.length) return false;\n  const sortedExpected = [...expected].sort();\n  return [...value]\n    .sort()\n    .every((entry, index) => entry === sortedExpected[index]);\n};\n\n// Version-update types only: security updates stay enabled for every ignore.\nexport const dependabotIgnoreUpdateTypes = [\n  \"version-update:semver-major\",\n  \"version-update:semver-minor\",\n  \"version-update:semver-patch\",\n] as const;\nexport type DependabotIgnoreUpdateType =\n  (typeof dependabotIgnoreUpdateTypes)[number];\nconst isIgnoreUpdateType = (\n  value: unknown,\n): value is DependabotIgnoreUpdateType =>\n  dependabotIgnoreUpdateTypes.some((updateType) => updateType === value);\n\nconst versionIgnore = (entry: unknown, updateTypes: readonly string[]) =>\n  record(entry) &&\n  Object.keys(entry).length === 2 &&\n  typeof entry[\"dependency-name\"] === \"string\" &&\n  sameStrings(entry[\"update-types\"], updateTypes);\n\nconst versionOnlyIgnore = (entry: unknown) =>\n  versionIgnore(entry, dependabotIgnoreUpdateTypes);\n\n/** A reviewed repository decision to skip some version updates of one dependency. */\nexport type DependabotIgnoreDeclaration = {\n  readonly ecosystem: DependabotEcosystem;\n  /** Dependabot `dependency-name`; `*` is the only wildcard. */\n  readonly dependency: string;\n  /** Nonempty, unique and in canonical major, minor, patch order. */\n  readonly updateTypes: readonly [\n    DependabotIgnoreUpdateType,\n    ...DependabotIgnoreUpdateType[],\n  ];\n  readonly reason: string;\n};\n\nconst ignoreDeclarationKeys = [\n  \"ecosystem\",\n  \"dependency\",\n  \"updateTypes\",\n  \"reason\",\n] as const;\n\n/** Parse `dependabotIgnores` from stll-toolchain.json; malformed decisions fail closed. */\nexport const parseDependabotIgnores = (\n  input: unknown,\n): DependabotIgnoreDeclaration[] => {\n  if (input === undefined) return [];\n  if (!Array.isArray(input))\n    throw new Error(\"dependabotIgnores must be an array\");\n  const result: DependabotIgnoreDeclaration[] = [];\n  const keys = new Set<string>();\n  for (const entry of input) {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => !ignoreDeclarationKeys.some((known) => known === key),\n      ) ||\n      typeof entry[\"reason\"] !== \"string\" ||\n      entry[\"reason\"].trim() === \"\"\n    )\n      throw new Error(\n        \"each Dependabot ignore requires ecosystem, dependency, updateTypes and a nonempty reason only\",\n      );\n    const ecosystem = entry[\"ecosystem\"];\n    if (typeof ecosystem !== \"string\" || !isDependabotEcosystem(ecosystem))\n      throw new Error(\n        `unsupported Dependabot ignore ecosystem: ${String(ecosystem)}`,\n      );\n    const dependency = entry[\"dependency\"];\n    if (\n      typeof dependency !== \"string\" ||\n      !/^[^\\s?[\\]{}!]+$/.test(dependency) ||\n      /^\\*+$/.test(dependency)\n    )\n      throw new Error(\n        `Dependabot ignore dependency must name a dependency; * is the only wildcard: ${String(dependency)}`,\n      );\n    const updateTypes = entry[\"updateTypes\"];\n    if (\n      !Array.isArray(updateTypes) ||\n      !updateTypes.every(isIgnoreUpdateType) ||\n      new Set(updateTypes).size !== updateTypes.length\n    )\n      throw new Error(\n        `Dependabot ignore ${dependency} requires unique update types from ${dependabotIgnoreUpdateTypes.join(\", \")}`,\n      );\n    const [first, ...rest] = dependabotIgnoreUpdateTypes.filter((updateType) =>\n      updateTypes.includes(updateType),\n    );\n    if (first === undefined)\n      throw new Error(\n        `Dependabot ignore ${dependency} requires at least one update type`,\n      );\n    const key = JSON.stringify([ecosystem, dependency]);\n    if (keys.has(key))\n      throw new Error(\n        `duplicate Dependabot ignore: ${ecosystem} ${dependency}`,\n      );\n    keys.add(key);\n    result.push({\n      ecosystem,\n      dependency,\n      updateTypes: [first, ...rest],\n      reason: entry[\"reason\"],\n    });\n  }\n  return result;\n};\n\n/**\n * Read only `dependabotIgnores` from stll-toolchain.json text: stll-dependabot must not\n * fail on unrelated declarations, which stll-toolchain-check validates.\n */\nexport const readDependabotIgnores = (toolchain: string | undefined) => {\n  if (toolchain === undefined) return [];\n  const parsed: unknown = JSON.parse(toolchain);\n  if (!record(parsed)) throw new Error(\"stll-toolchain.json must be an object\");\n  return parseDependabotIgnores(parsed[\"dependabotIgnores\"]);\n};\n\nconst dependencyPattern = (dependency: string) =>\n  new RegExp(\n    `^${dependency\n      .split(\"*\")\n      .map((part) => part.replace(/[.+^${}()|[\\]\\\\/?]/g, \"\\\\$&\"))\n      .join(\".*\")}$`,\n  );\n\n/** Code-unit order keeps generated bytes independent of the host locale. */\nconst byDependency = (\n  left: DependabotIgnoreDeclaration,\n  right: DependabotIgnoreDeclaration,\n) => {\n  if (left.dependency === right.dependency) return 0;\n  return left.dependency < right.dependency ? -1 : 1;\n};\n\nconst directoryOf = (file: string) => {\n  const directory = path.posix.dirname(file);\n  return directory === \".\" ? \"/\" : `/${directory}`;\n};\n\nconst workspaceManifests = {\n  npm: \"package.json\",\n  cargo: \"Cargo.toml\",\n  uv: \"pyproject.toml\",\n} as const;\n\nconst workspaceTable = (\n  parsed: Record<string, unknown>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  switch (ecosystem) {\n    case \"npm\":\n      return parsed[\"workspaces\"];\n    case \"cargo\":\n      return parsed[\"workspace\"];\n    case \"uv\": {\n      const tool = parsed[\"tool\"];\n      const uv = record(tool) ? tool[\"uv\"] : undefined;\n      return record(uv) ? uv[\"workspace\"] : undefined;\n    }\n    default: {\n      const unexpected: never = ecosystem;\n      throw new Error(\"unknown workspace ecosystem\", { cause: unexpected });\n    }\n  }\n};\n\nconst declaresJavascriptInstallation = (text: string | undefined) => {\n  try {\n    const manifest: unknown = JSON.parse(text ?? \"\");\n    if (!record(manifest)) return false;\n    if (typeof manifest[\"packageManager\"] === \"string\") return true;\n    return [\n      \"dependencies\",\n      \"devDependencies\",\n      \"optionalDependencies\",\n      \"peerDependencies\",\n    ].some((field) => {\n      const dependencies = manifest[field];\n      return record(dependencies) && Object.keys(dependencies).length > 0;\n    });\n  } catch {\n    // Manifest validation reports invalid JSON independently.\n    return false;\n  }\n};\n\n/** Dependency-bearing projects and workspace members need coverage without requiring a lock. */\nconst workspaceRoots = (\n  files: Record<string, string>,\n  ecosystem: keyof typeof workspaceManifests,\n) => {\n  const manifests = Object.keys(files).filter(\n    (file) =>\n      path.posix.basename(file) === workspaceManifests[ecosystem] ||\n      (ecosystem === \"npm\" &&\n        path.posix.basename(file) === \"pnpm-workspace.yaml\"),\n  );\n  const workspaces = new Map<string, string[]>();\n  const npmWorkspaceErrors = new Map<string, Error>();\n  for (const file of manifests) {\n    if (ecosystem === \"npm\") {\n      const directory = path.posix.dirname(file);\n      const workspaceFile = path.posix.join(directory, \"pnpm-workspace.yaml\");\n      const text = files[workspaceFile];\n      if (text !== undefined) {\n        try {\n          const document = parseDocument(text);\n          if (document.errors.length > 0)\n            throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);\n          const parsed: unknown = document.toJS({ maxAliasCount: 100 });\n          if (!record(parsed))\n            throw new Error(\n              `${workspaceFile}:1: pnpm workspace must contain an object`,\n            );\n          const patterns = parsed[\"packages\"] ?? [];\n          if (!strings(patterns))\n            throw new Error(\n              `${workspaceFile}:1: pnpm packages must be a string array`,\n            );\n          workspaces.set(\n            directory,\n            patterns.map((pattern) =>\n              pattern.startsWith(\"!\")\n                ? `!${path.posix.normalize(pattern.slice(1))}`\n                : path.posix.normalize(pattern),\n            ),\n          );\n        } catch (error) {\n          npmWorkspaceErrors.set(\n            directory,\n            error instanceof Error ? error : new Error(String(error)),\n          );\n        }\n        continue;\n      }\n    }\n    try {\n      const parsed: unknown =\n        ecosystem === \"npm\"\n          ? JSON.parse(files[file] ?? \"\")\n          : parseToml(files[file] ?? \"\");\n      if (!record(parsed)) continue;\n      if (\n        ecosystem === \"npm\" &&\n        typeof parsed[\"packageManager\"] === \"string\" &&\n        parsed[\"packageManager\"].startsWith(\"pnpm@\")\n      )\n        continue;\n      const value = workspaceTable(parsed, ecosystem);\n      const patterns = record(value)\n        ? value[ecosystem === \"npm\" ? \"packages\" : \"members\"]\n        : value;\n      const members =\n        ecosystem === \"cargo\" && record(value) && patterns === undefined\n          ? []\n          : patterns;\n      if (strings(members)) {\n        const excluded =\n          ecosystem !== \"npm\" && record(value) && strings(value[\"exclude\"])\n            ? value[\"exclude\"].map((pattern) => `!${pattern}`)\n            : [];\n        workspaces.set(path.posix.dirname(file), [...members, ...excluded]);\n      }\n    } catch {\n      // Other toolchain rules validate manifests; retain the update root here.\n    }\n  }\n  const implicitCargoMembers = new Map<string, Set<string>>();\n  const declaredMember = (\n    root: string,\n    patterns: string[],\n    directory: string,\n  ) => {\n    const relative = path.posix.relative(root, directory);\n    if (relative === \"\" || relative === \"..\" || relative.startsWith(\"../\"))\n      return false;\n    return workspaceContains({\n      directory: root,\n      file: path.posix.join(directory, \"package.json\"),\n      patterns,\n      rootMembership: \"patterns\",\n    });\n  };\n  const installable = new Set([\".\"]);\n  if (ecosystem === \"npm\") {\n    for (const file of manifests) {\n      const directory = path.posix.dirname(file);\n      if (\n        declaresJavascriptInstallation(\n          files[path.posix.join(directory, \"package.json\")],\n        ) ||\n        javascriptDependencyLockfiles.some(\n          (name) => files[path.posix.join(directory, name)] !== undefined,\n        )\n      )\n        installable.add(directory);\n    }\n    let changed = true;\n    while (changed) {\n      changed = false;\n      for (const [root, patterns] of workspaces) {\n        if (!installable.has(root)) {\n          if (\n            ![...installable].some((directory) =>\n              declaredMember(root, patterns, directory),\n            )\n          )\n            continue;\n          installable.add(root);\n          changed = true;\n        }\n        for (const file of manifests) {\n          const directory = path.posix.dirname(file);\n          if (\n            installable.has(directory) ||\n            !declaredMember(root, patterns, directory)\n          )\n            continue;\n          installable.add(directory);\n          changed = true;\n        }\n      }\n    }\n  }\n  if (ecosystem === \"npm\") {\n    for (const [directory, error] of npmWorkspaceErrors)\n      if (installable.has(directory)) throw error;\n  }\n  if (ecosystem === \"cargo\") {\n    for (const [root, patterns] of workspaces) {\n      const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n      const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n      const memberDirectories = new Set([root]);\n      for (const file of manifests) {\n        const directory = path.posix.dirname(file);\n        const relative = path.posix.relative(root, directory);\n        if (\n          includes.some((pattern) => picomatch.isMatch(relative, pattern)) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        )\n          memberDirectories.add(directory);\n      }\n      for (const directory of memberDirectories) {\n        try {\n          const parsed = parseToml(\n            files[path.posix.join(directory, \"Cargo.toml\")] ?? \"\",\n          );\n          const rootParsed = parseToml(\n            files[path.posix.join(root, \"Cargo.toml\")] ?? \"\",\n          );\n          const workspace = rootParsed[\"workspace\"];\n          const inherited = record(workspace)\n            ? workspace[\"dependencies\"]\n            : undefined;\n          const dependencyOwners = [parsed];\n          const targets = parsed[\"target\"];\n          if (record(targets)) {\n            for (const target of Object.values(targets))\n              if (record(target)) dependencyOwners.push(target);\n          }\n          for (const owner of dependencyOwners) {\n            for (const key of [\n              \"dependencies\",\n              \"dev-dependencies\",\n              \"build-dependencies\",\n            ]) {\n              const dependencies = owner[key];\n              if (!record(dependencies)) continue;\n              for (const [name, dependency] of Object.entries(dependencies)) {\n                if (!record(dependency)) continue;\n                const isInherited = dependency[\"workspace\"] === true;\n                const resolved =\n                  isInherited && record(inherited)\n                    ? inherited[name]\n                    : dependency;\n                if (!record(resolved) || typeof resolved[\"path\"] !== \"string\")\n                  continue;\n                if (\n                  path.posix.isAbsolute(resolved[\"path\"]) ||\n                  /\\\\|\\$|^[A-Za-z]:/.test(resolved[\"path\"])\n                )\n                  continue;\n                const target = path.posix.normalize(\n                  path.posix.join(\n                    isInherited ? root : directory,\n                    resolved[\"path\"],\n                  ),\n                );\n                const relative = path.posix.relative(root, target);\n                if (\n                  relative.startsWith(\"../\") ||\n                  relative === \"..\" ||\n                  files[path.posix.join(target, \"Cargo.toml\")] === undefined ||\n                  excludes.some((pattern) =>\n                    picomatch.isMatch(relative, pattern.slice(1)),\n                  )\n                )\n                  continue;\n                memberDirectories.add(target);\n              }\n            }\n          }\n        } catch {\n          // Manifest validation diagnoses malformed TOML independently.\n        }\n      }\n      implicitCargoMembers.set(root, memberDirectories);\n    }\n  }\n  return manifests\n    .filter(\n      (file) =>\n        ecosystem !== \"npm\" || installable.has(path.posix.dirname(file)),\n    )\n    .filter((file) => {\n      const directory = path.posix.dirname(file);\n      return ![...workspaces].some(([root, patterns]) => {\n        if (ecosystem === \"npm\" && !installable.has(root)) return false;\n        const relative = path.posix.relative(root, directory);\n        if (relative === \"\" || relative.startsWith(\"../\")) return false;\n        const includes = patterns.filter((pattern) => !pattern.startsWith(\"!\"));\n        const excludes = patterns.filter((pattern) => pattern.startsWith(\"!\"));\n        return (\n          (implicitCargoMembers.get(root)?.has(directory) === true ||\n            (ecosystem === \"npm\"\n              ? declaredMember(root, patterns, directory)\n              : includes.some((pattern) =>\n                  picomatch.isMatch(relative, pattern),\n                ))) &&\n          !excludes.some((pattern) =>\n            picomatch.isMatch(relative, pattern.slice(1)),\n          )\n        );\n      });\n    })\n    .map(directoryOf)\n    .filter((directory, index, values) => values.indexOf(directory) === index);\n};\n\ntype CheckDependabotOptions = {\n  files: Record<string, string>;\n  policy: DependabotPolicy;\n  /** Parsed stll-toolchain.json `dependabotIgnores`. */\n  ignores?: readonly DependabotIgnoreDeclaration[] | undefined;\n};\n\nconst javascriptEcosystem = (\n  directory: string,\n  files: Record<string, string>,\n) => {\n  let root = directory === \"/\" ? \".\" : directory.slice(1);\n  for (;;) {\n    if (files[path.posix.join(root, \"bun.lock\")] !== undefined) return \"bun\";\n    try {\n      const manifest: unknown = JSON.parse(\n        files[path.posix.join(root, \"package.json\")] ?? \"{}\",\n      );\n      if (record(manifest) && typeof manifest[\"packageManager\"] === \"string\")\n        return manifest[\"packageManager\"].startsWith(\"bun@\") ? \"bun\" : \"npm\";\n    } catch {\n      // Package rules diagnose malformed JSON; retain its update coverage.\n    }\n    for (const name of javascriptDependencyLockfiles)\n      if (files[path.posix.join(root, name)] !== undefined) return \"npm\";\n    if (root === \".\") return \"npm\";\n    root = path.posix.dirname(root);\n  }\n};\n\nconst pythonEcosystem = (file: string, files: Record<string, string>) => {\n  const manifestKind = pythonDependencyManifestKind(file);\n  if (\n    manifestKind === \"pipfile\" ||\n    manifestKind === \"pipfile-lock\" ||\n    manifestKind === \"setup\"\n  )\n    return \"pip\";\n  const root = path.posix.dirname(file);\n  if (\n    files[path.posix.join(root, \"uv.lock\")] !== undefined ||\n    files[path.posix.join(root, \"uv.toml\")] !== undefined\n  )\n    return \"uv\";\n  const pyproject = files[path.posix.join(root, \"pyproject.toml\")];\n  if (pyproject !== undefined) {\n    try {\n      const parsed = parseToml(pyproject);\n      const tool = parsed[\"tool\"];\n      if (record(tool) && record(tool[\"uv\"])) return \"uv\";\n    } catch {\n      // Runtime rules diagnose malformed TOML; retain its update coverage.\n    }\n  }\n  return \"pip\";\n};\n\nconst ecosystemRoots = (files: Record<string, string>) => {\n  const roots = new Map<string, Set<string>>();\n  const requireRoot = (ecosystem: string, directory: string) => {\n    const directories = roots.get(ecosystem) ?? new Set<string>();\n    directories.add(directory);\n    roots.set(ecosystem, directories);\n  };\n  for (const directory of workspaceRoots(files, \"npm\"))\n    requireRoot(javascriptEcosystem(directory, files), directory);\n  for (const directory of workspaceRoots(files, \"cargo\"))\n    requireRoot(\"cargo\", directory);\n  for (const directory of workspaceRoots(files, \"uv\")) {\n    const root = directory === \"/\" ? \".\" : directory.slice(1);\n    requireRoot(\n      pythonEcosystem(path.posix.join(root, \"pyproject.toml\"), files),\n      directory,\n    );\n  }\n  for (const file of Object.keys(files)) {\n    if (isDependabotGithubActionsPath(file)) requireRoot(\"github-actions\", \"/\");\n    const name = path.posix.basename(file);\n    const manifestEcosystem = dependabotManifestEcosystem(file);\n    if (manifestEcosystem !== undefined)\n      requireRoot(manifestEcosystem, directoryOf(file));\n    if (isDockerDefinitionPath(file)) requireRoot(\"docker\", directoryOf(file));\n    if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {\n      for (const document of parseAllDocuments(files[file] ?? \"\", {\n        merge: true,\n      })) {\n        if (document.errors.length > 0) continue;\n        try {\n          const classified = containerDocumentImages(\n            document.toJS({ maxAliasCount: 100 }),\n            file,\n          );\n          if (classified !== undefined)\n            requireRoot(classified.ecosystem, directoryOf(file));\n        } catch {\n          // Runtime validation reports malformed or excessive YAML aliases.\n        }\n      }\n    }\n    if (\n      name === \"uv.lock\" ||\n      name === \"uv.toml\" ||\n      (name !== \"pyproject.toml\" && isPythonDependencyManifest(file))\n    )\n      requireRoot(pythonEcosystem(file, files), directoryOf(file));\n  }\n  return roots;\n};\n\nconst ignoredFor = (ecosystem: string, policy: DependabotPolicy) => {\n  if (ecosystem === \"npm\" || ecosystem === \"bun\") return policy.ignoredPackages;\n  if (ecosystem === \"github-actions\") return policy.ignoredActions;\n  if (ecosystem === \"docker\" || ecosystem === \"docker-compose\")\n    return ownedDockerImageAliases(policy.ignoredImages);\n  return [];\n};\n\ntype DeclaredIgnoreConflictsOptions = {\n  ignores: readonly DependabotIgnoreDeclaration[];\n  policy: DependabotPolicy;\n};\n\n/** Shared pins stay owned by the shared policy; declarations cannot name or match them. */\nexport const declaredIgnoreConflicts = ({\n  ignores,\n  policy,\n}: DeclaredIgnoreConflictsOptions) =>\n  ignores.flatMap(({ ecosystem, dependency }) => {\n    const pattern = dependencyPattern(dependency);\n    return ignoredFor(ecosystem, policy)\n      .filter((pin) => pattern.test(pin))\n      .map(\n        (pin) =>\n          `Dependabot ignore ${ecosystem} ${dependency} covers shared pin ${pin}; the shared policy owns its ignore`,\n      );\n  });\n\n/** Repository declarations own coverage only; shared policy owns every update option. */\nexport const parseDependabotInput = (input: unknown) => {\n  if (\n    !record(input) ||\n    Object.keys(input).some((key) => key !== \"updates\") ||\n    !Array.isArray(input[\"updates\"]) ||\n    input[\"updates\"].length === 0\n  )\n    throw new Error(\n      \"Dependabot input must contain a nonempty updates array only\",\n    );\n  const ecosystems = new Set<string>();\n  return input[\"updates\"].map((entry: unknown) => {\n    if (\n      !record(entry) ||\n      Object.keys(entry).some(\n        (key) => ![\"ecosystem\", \"directories\"].includes(key),\n      ) ||\n      typeof entry[\"ecosystem\"] !== \"string\" ||\n      !strings(entry[\"directories\"]) ||\n      entry[\"directories\"].length === 0\n    )\n      throw new Error(\n        \"each Dependabot update must contain ecosystem and nonempty directories only\",\n      );\n    const ecosystem = entry[\"ecosystem\"];\n    if (!isDependabotEcosystem(ecosystem))\n      throw new Error(`unsupported Dependabot ecosystem: ${ecosystem}`);\n    const directories = entry[\"directories\"];\n    if (ecosystems.has(ecosystem))\n      throw new Error(`duplicate Dependabot ecosystem: ${ecosystem}`);\n    ecosystems.add(ecosystem);\n    const seen = new Set<string>();\n    for (const directory of directories) {\n      if (\n        !directory.startsWith(\"/\") ||\n        directory.includes(\"\\\\\") ||\n        directory.split(\"/\").some((part) => part === \".\" || part === \"..\") ||\n        path.posix.normalize(directory) !== directory ||\n        (directory !== \"/\" && directory.endsWith(\"/\")) ||\n        /[*?[\\]{}!]/.test(directory)\n      )\n        throw new Error(\n          `Dependabot directory must be a literal absolute repository path: ${directory}`,\n        );\n      if (seen.has(directory))\n        throw new Error(`duplicate Dependabot directory: ${directory}`);\n      seen.add(directory);\n    }\n    return { ecosystem, directories };\n  });\n};\n\ntype GenerateDependabotOptions = CheckDependabotOptions & {\n  updates?: ReturnType<typeof parseDependabotInput> | undefined;\n};\n\n/** Generate canonical YAML from the same ecosystem enumeration used by the guard. */\nexport const generateDependabotConfig = ({\n  files,\n  policy,\n  updates: declarations,\n  ignores = [],\n}: GenerateDependabotOptions) => {\n  const conflicts = declaredIgnoreConflicts({ ignores, policy });\n  if (conflicts.length > 0) throw new Error(conflicts.join(\"\\n\"));\n  const detected = ecosystemRoots(files);\n  const roots =\n    declarations === undefined\n      ? detected\n      : new Map(\n          parseDependabotInput({ updates: declarations }).map(\n            ({ ecosystem, directories }) => [ecosystem, new Set(directories)],\n          ),\n        );\n  for (const [ecosystem, directories] of detected) {\n    for (const directory of directories) {\n      if (!roots.get(ecosystem)?.has(directory))\n        throw new Error(\n          `Dependabot input must cover ${ecosystem} directory ${directory}`,\n        );\n    }\n  }\n  for (const { ecosystem, dependency } of ignores)\n    if (!roots.has(ecosystem))\n      throw new Error(\n        `Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`,\n      );\n  const updates = [...roots]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([ecosystem, ecosystemDirectories]) => {\n      const directories = [...ecosystemDirectories].sort();\n      const ignore = [\n        ...ignoredFor(ecosystem, policy).map((name) => ({\n          \"dependency-name\": name,\n          \"update-types\": dependabotIgnoreUpdateTypes,\n        })),\n        ...ignores\n          .filter((declared) => declared.ecosystem === ecosystem)\n          .sort(byDependency)\n          .map(({ dependency, updateTypes }) => ({\n            \"dependency-name\": dependency,\n            \"update-types\": updateTypes,\n          })),\n      ];\n      const time = new Scalar(policy.schedule.time);\n      time.type = Scalar.QUOTE_DOUBLE;\n      return {\n        \"package-ecosystem\": ecosystem,\n        directory: directories.length === 1 ? directories.at(0) : undefined,\n        directories: directories.length > 1 ? directories : undefined,\n        schedule: {\n          interval: policy.schedule.interval,\n          day: policy.schedule.day,\n          time,\n          timezone: policy.schedule.timezone,\n        },\n        cooldown: { \"default-days\": policy.cooldown.defaultDays },\n        groups: Object.fromEntries(\n          Object.entries(policy.groups).map(([name, group]) => [\n            name,\n            { patterns: group.patterns, \"update-types\": group.updateTypes },\n          ]),\n        ),\n        ignore: ignore.length > 0 ? ignore : undefined,\n      };\n    });\n  return stringify({ version: 2, updates }, { aliasDuplicateObjects: false });\n};\n\n/** Validate the shared update policy against a hermetic tracked-file snapshot. */\nexport const checkDependabot = ({\n  files,\n  policy,\n  ignores = [],\n}: CheckDependabotOptions): Diagnostic[] => {\n  const roots = ecosystemRoots(files);\n  const paths = [\".github/dependabot.yml\", \".github/dependabot.yaml\"].filter(\n    (file) => files[file] !== undefined,\n  );\n  if (roots.size === 0 && paths.length === 0 && ignores.length === 0) return [];\n  const file = paths.at(0) ?? \".github/dependabot.yml\";\n  const diagnostics: Diagnostic[] = [];\n  const add = (message: string, line = 1) => {\n    diagnostics.push({ rule: \"dependabot-policy\", path: file, line, message });\n  };\n  if (paths.length === 0) {\n    add(\n      \"add a Dependabot configuration for the repository's package ecosystems\",\n    );\n    return diagnostics;\n  }\n  if (paths.length > 1) add(\"keep one Dependabot configuration file\");\n  const lineCounter = new LineCounter();\n  const document = parseDocument(files[file] ?? \"\", {\n    lineCounter,\n  });\n  if (document.errors.length > 0) {\n    for (const error of document.errors)\n      add(\n        `invalid Dependabot YAML: ${error.message}`,\n        lineCounter.linePos(error.pos[0]).line,\n      );\n    return diagnostics;\n  }\n  let parsed: unknown;\n  try {\n    parsed = document.toJS({ maxAliasCount: 100 });\n  } catch {\n    add(\"cannot resolve Dependabot YAML aliases\");\n    return diagnostics;\n  }\n  if (\n    !record(parsed) ||\n    parsed[\"version\"] !== 2 ||\n    !Array.isArray(parsed[\"updates\"])\n  ) {\n    add(\"Dependabot must declare version: 2 and an updates array\");\n    return diagnostics;\n  }\n  const covered = new Map<string, Set<string>>();\n  let legacy: unknown;\n  try {\n    const legacyDocument = parseDocument(files[file] ?? \"\", {\n      version: \"1.1\",\n      schema: \"yaml-1.1\",\n    });\n    if (legacyDocument.errors.length === 0)\n      legacy = legacyDocument.toJS({ maxAliasCount: 100 });\n  } catch {\n    // The canonical parser reports invalid aliases; incompatible times fail below.\n  }\n  const legacyUpdates =\n    record(legacy) && Array.isArray(legacy[\"updates\"]) ? legacy[\"updates\"] : [];\n  const rootClaims = new Map<string, Map<string, number>>();\n  const updatedEcosystems = new Set<string>();\n  const directoryClaims = new Map<string, Map<string, number>>();\n  for (const [index, update] of parsed[\"updates\"].entries()) {\n    const lineOf = (key: string) => {\n      const node: unknown = document.getIn([\"updates\", index, key], true);\n      const offset = isNode(node) ? node.range?.[0] : undefined;\n      return offset === undefined ? 1 : lineCounter.linePos(offset).line;\n    };\n    const report = (key: string, message: string) => add(message, lineOf(key));\n    if (!record(update) || typeof update[\"package-ecosystem\"] !== \"string\") {\n      report(\n        \"package-ecosystem\",\n        \"each Dependabot update must declare a package ecosystem\",\n      );\n      continue;\n    }\n    const ecosystem = update[\"package-ecosystem\"];\n    if (update[\"target-branch\"] !== undefined)\n      report(\n        \"target-branch\",\n        `${ecosystem}: shared updates must target the default branch`,\n      );\n    if (update[\"open-pull-requests-limit\"] === 0)\n      report(\n        \"open-pull-requests-limit\",\n        `${ecosystem}: version updates must remain enabled`,\n      );\n    const single = update[\"directory\"];\n    const multiple = update[\"directories\"];\n    let directories: string[] = [];\n    if (typeof single === \"string\" && multiple === undefined)\n      directories = [single];\n    else if (single === undefined && strings(multiple)) directories = multiple;\n    const validDirectories = directories.filter(\n      (directory) =>\n        directory.startsWith(\"/\") && !directory.split(\"/\").includes(\"..\"),\n    );\n    if (\n      directories.length === 0 ||\n      validDirectories.length !== directories.length\n    ) {\n      report(\n        \"directory\",\n        `${ecosystem}: declare directory or nonempty directories with absolute repository paths`,\n      );\n    }\n    const normalizedDirectories = Array.from(\n      new Set(\n        validDirectories.map(\n          (value) => path.posix.normalize(value).replace(/\\/+$/, \"\") || \"/\",\n        ),\n      ),\n    );\n    const matches = covered.get(ecosystem) ?? new Set<string>();\n    const claimedDirectories =\n      directoryClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const directory of normalizedDirectories) {\n      const previous = claimedDirectories.get(directory);\n      if (previous !== undefined)\n        report(\n          multiple === undefined ? \"directory\" : \"directories\",\n          `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`,\n        );\n      else claimedDirectories.set(directory, index);\n    }\n    directoryClaims.set(ecosystem, claimedDirectories);\n    const claimedRoots = rootClaims.get(ecosystem) ?? new Map<string, number>();\n    for (const root of roots.get(ecosystem) ?? []) {\n      if (\n        normalizedDirectories.some(\n          (directory) =>\n            directory === root ||\n            (multiple !== undefined && picomatch.isMatch(root, directory)),\n        )\n      ) {\n        const previous = claimedRoots.get(root);\n        if (previous !== undefined)\n          report(\n            multiple === undefined ? \"directory\" : \"directories\",\n            `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`,\n          );\n        else claimedRoots.set(root, index);\n        matches.add(root);\n      }\n    }\n    rootClaims.set(ecosystem, claimedRoots);\n    covered.set(ecosystem, matches);\n    const schedule = update[\"schedule\"];\n    const legacyUpdate: unknown = legacyUpdates.at(index);\n    const legacySchedule = record(legacyUpdate)\n      ? legacyUpdate[\"schedule\"]\n      : undefined;\n    if (\n      record(schedule) &&\n      schedule[\"time\"] === policy.schedule.time &&\n      (!record(legacySchedule) ||\n        legacySchedule[\"time\"] !== policy.schedule.time)\n    )\n      report(\n        \"schedule\",\n        `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`,\n      );\n    if (\n      !record(schedule) ||\n      Object.keys(schedule).length !== Object.keys(policy.schedule).length ||\n      Object.entries(policy.schedule).some(\n        ([key, value]) => schedule[key] !== value,\n      )\n    )\n      report(\"schedule\", `${ecosystem}: schedule must match the shared policy`);\n    const cooldown = update[\"cooldown\"];\n    if (\n      !record(cooldown) ||\n      Object.keys(cooldown).length !== 1 ||\n      cooldown[\"default-days\"] !== policy.cooldown.defaultDays\n    )\n      report(\n        \"cooldown\",\n        `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`,\n      );\n    const groups = update[\"groups\"];\n    if (\n      !record(groups) ||\n      Object.keys(groups).length !== Object.keys(policy.groups).length ||\n      Object.entries(policy.groups).some(([name, expected]) => {\n        const group = groups[name];\n        return (\n          !record(group) ||\n          Object.keys(group).length !== 2 ||\n          !sameStrings(group[\"patterns\"], expected.patterns) ||\n          !sameStrings(group[\"update-types\"], expected.updateTypes)\n        );\n      })\n    )\n      report(\"groups\", `${ecosystem}: groups must match the shared policy`);\n    const ignored = ignoredFor(ecosystem, policy);\n    const declared = ignores.filter(\n      (declaration) => declaration.ecosystem === ecosystem,\n    );\n    updatedEcosystems.add(ecosystem);\n    const ignore = update[\"ignore\"];\n    if (ignore !== undefined && (!Array.isArray(ignore) || ignore.length === 0))\n      report(\"ignore\", `${ecosystem}: omit ignore or provide a nonempty array`);\n    const entries: unknown[] = Array.isArray(ignore) ? ignore : [];\n    const nameOf = (entry: unknown) =>\n      record(entry) && typeof entry[\"dependency-name\"] === \"string\"\n        ? entry[\"dependency-name\"]\n        : undefined;\n    if (\n      entries.some((entry) => {\n        const name = nameOf(entry);\n        return (\n          name === undefined ||\n          (!ignored.includes(name) &&\n            !declared.some(({ dependency }) => dependency === name))\n        );\n      })\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: ignore only packages owned by the shared policy or declared in stll-toolchain.json dependabotIgnores`,\n      );\n    if (\n      entries.some((entry) => {\n        const name = nameOf(entry);\n        return (\n          name !== undefined &&\n          ignored.includes(name) &&\n          !versionOnlyIgnore(entry)\n        );\n      })\n    )\n      report(\n        \"ignore\",\n        `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`,\n      );\n    for (const name of ignored) {\n      if (\n        !entries.some(\n          (entry) => nameOf(entry) === name && versionOnlyIgnore(entry),\n        )\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore all version updates for shared pin ${name}`,\n        );\n    }\n    for (const { dependency, updateTypes } of declared) {\n      const matching = entries.filter((entry) => nameOf(entry) === dependency);\n      if (\n        matching.length !== 1 ||\n        !matching.every((entry) => versionIgnore(entry, updateTypes))\n      )\n        report(\n          \"ignore\",\n          `${ecosystem}: ignore ${dependency} exactly once with only update-types ${updateTypes.join(\", \")} as declared in stll-toolchain.json`,\n        );\n    }\n  }\n  for (const { ecosystem, dependency } of ignores)\n    if (!updatedEcosystems.has(ecosystem))\n      add(\n        `Dependabot ignore ${ecosystem} ${dependency} has no ${ecosystem} update entry`,\n      );\n  for (const [ecosystem, directories] of roots) {\n    for (const directory of directories) {\n      if (!covered.get(ecosystem)?.has(directory))\n        add(`add a ${ecosystem} update entry covering ${directory}`);\n    }\n  }\n  return diagnostics;\n};\n"],"mappings":";;;;;;;AACA,MAAa,sBAAsB;CACjC;CACA;CACA;AACF;;AAGA,MAAa,2BAA2B,WAA8B;CACpE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,SAAS,QAClB,KAAK,MAAM,cAAc,CAAC,OAAO,WAAW,OAAO,GAAG;EACpD,QAAQ,IAAI,UAAU;EACtB,KAAK,MAAM,YAAY,qBACrB,QAAQ,IAAI,GAAG,SAAS,GAAG,YAAY;CAC3C;CAEF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;AAC3B;;AAGA,MAAa,0BAA0B,UAAkB;CACvD,MAAM,WAAW,oBAAoB,MAAM,UACzC,MAAM,YAAY,CAAC,CAAC,WAAW,GAAG,MAAM,EAAE,CAC5C;CAGA,QADE,aAAa,KAAA,IAAY,QAAQ,MAAM,MAAM,SAAS,SAAS,CAAC,EAAA,CAChD,QAAQ,eAAe,EAAE;AAC7C;;AAGA,MAAa,oBAAoB,QAC/B,IAAI,QACF,8HACA,EACF;;;ACPF,MAAa,kBAAkB,CAAC,mBAAmB;AAGnD,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAGA,MAAM,yBAAyB,UAC7B,8BAA8B,MAAM,cAAc,cAAc,KAAK;AAqBvE,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,WAAW,UACf,MAAM,QAAQ,KAAK,KACnB,MAAM,OAAO,UAAmB,OAAO,UAAU,QAAQ;AAE3D,MAAM,eAAe,OAAgB,aAAgC;CACnE,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,WAAW,SAAS,QAAQ,OAAO;CAChE,MAAM,iBAAiB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAC1C,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,KAAK,CAAC,CACN,OAAO,OAAO,UAAU,UAAU,eAAe,MAAM;AAC5D;AAGA,MAAa,8BAA8B;CACzC;CACA;CACA;AACF;AAGA,MAAM,sBACJ,UAEA,4BAA4B,MAAM,eAAe,eAAe,KAAK;AAEvE,MAAM,iBAAiB,OAAgB,gBACrC,OAAO,KAAK,KACZ,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,OAAO,MAAM,uBAAuB,YACpC,YAAY,MAAM,iBAAiB,WAAW;AAEhD,MAAM,qBAAqB,UACzB,cAAc,OAAO,2BAA2B;AAelD,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;AACF;;AAGA,MAAa,0BACX,UACkC;CAClC,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,oCAAoC;CACtD,MAAM,SAAwC,CAAC;CAC/C,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,SAAS,OAAO;EACzB,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC,sBAAsB,MAAM,UAAU,UAAU,GAAG,CAC/D,KACA,OAAO,MAAM,cAAc,YAC3B,MAAM,SAAS,CAAC,KAAK,MAAM,IAE3B,MAAM,IAAI,MACR,+FACF;EACF,MAAM,YAAY,MAAM;EACxB,IAAI,OAAO,cAAc,YAAY,CAAC,sBAAsB,SAAS,GACnE,MAAM,IAAI,MACR,4CAA4C,OAAO,SAAS,GAC9D;EACF,MAAM,aAAa,MAAM;EACzB,IACE,OAAO,eAAe,YACtB,CAAC,kBAAkB,KAAK,UAAU,KAClC,QAAQ,KAAK,UAAU,GAEvB,MAAM,IAAI,MACR,gFAAgF,OAAO,UAAU,GACnG;EACF,MAAM,cAAc,MAAM;EAC1B,IACE,CAAC,MAAM,QAAQ,WAAW,KAC1B,CAAC,YAAY,MAAM,kBAAkB,KACrC,IAAI,IAAI,WAAW,CAAC,CAAC,SAAS,YAAY,QAE1C,MAAM,IAAI,MACR,qBAAqB,WAAW,qCAAqC,4BAA4B,KAAK,IAAI,GAC5G;EACF,MAAM,CAAC,OAAO,GAAG,QAAQ,4BAA4B,QAAQ,eAC3D,YAAY,SAAS,UAAU,CACjC;EACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MACR,qBAAqB,WAAW,mCAClC;EACF,MAAM,MAAM,KAAK,UAAU,CAAC,WAAW,UAAU,CAAC;EAClD,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MACR,gCAAgC,UAAU,GAAG,YAC/C;EACF,KAAK,IAAI,GAAG;EACZ,OAAO,KAAK;GACV;GACA;GACA,aAAa,CAAC,OAAO,GAAG,IAAI;GAC5B,QAAQ,MAAM;EAChB,CAAC;CACH;CACA,OAAO;AACT;;;;;AAMA,MAAa,yBAAyB,cAAkC;CACtE,IAAI,cAAc,KAAA,GAAW,OAAO,CAAC;CACrC,MAAM,SAAkB,KAAK,MAAM,SAAS;CAC5C,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC5E,OAAO,uBAAuB,OAAO,oBAAoB;AAC3D;AAEA,MAAM,qBAAqB,eACzB,IAAI,OACF,IAAI,WACD,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,QAAQ,uBAAuB,MAAM,CAAC,CAAC,CAC1D,KAAK,IAAI,EAAE,EAChB;;AAGF,MAAM,gBACJ,MACA,UACG;CACH,IAAI,KAAK,eAAe,MAAM,YAAY,OAAO;CACjD,OAAO,KAAK,aAAa,MAAM,aAAa,KAAK;AACnD;AAEA,MAAM,eAAe,SAAiB;CACpC,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;CACzC,OAAO,cAAc,MAAM,MAAM,IAAI;AACvC;AAEA,MAAM,qBAAqB;CACzB,KAAK;CACL,OAAO;CACP,IAAI;AACN;AAEA,MAAM,kBACJ,QACA,cACG;CACH,QAAQ,WAAR;EACE,KAAK,OACH,OAAO,OAAO;EAChB,KAAK,SACH,OAAO,OAAO;EAChB,KAAK,MAAM;GACT,MAAM,OAAO,OAAO;GACpB,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAA;GACvC,OAAO,OAAO,EAAE,IAAI,GAAG,eAAe,KAAA;EACxC;EACA,SAEE,MAAM,IAAI,MAAM,+BAA+B,EAAE,OAAOA,UAAW,CAAC;CAExE;AACF;AAEA,MAAM,kCAAkC,SAA6B;CACnE,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,QAAQ,EAAE;EAC/C,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAC9B,IAAI,OAAO,SAAS,sBAAsB,UAAU,OAAO;EAC3D,OAAO;GACL;GACA;GACA;GACA;EACF,CAAC,CAAC,MAAM,UAAU;GAChB,MAAM,eAAe,SAAS;GAC9B,OAAO,OAAO,YAAY,KAAK,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS;EACpE,CAAC;CACH,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,kBACJ,OACA,cACG;CACH,MAAM,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,QAClC,SACC,KAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,cAChD,cAAc,SACb,KAAK,MAAM,SAAS,IAAI,MAAM,qBACpC;CACA,MAAM,6BAAa,IAAI,IAAsB;CAC7C,MAAM,qCAAqB,IAAI,IAAmB;CAClD,KAAK,MAAM,QAAQ,WAAW;EAC5B,IAAI,cAAc,OAAO;GACvB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,gBAAgB,KAAK,MAAM,KAAK,WAAW,qBAAqB;GACtE,MAAM,OAAO,MAAM;GACnB,IAAI,SAAS,KAAA,GAAW;IACtB,IAAI;KACF,MAAM,WAAW,cAAc,IAAI;KACnC,IAAI,SAAS,OAAO,SAAS,GAC3B,MAAM,IAAI,MAAM,GAAG,cAAc,gCAAgC;KACnE,MAAM,SAAkB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;KAC5D,IAAI,CAAC,OAAO,MAAM,GAChB,MAAM,IAAI,MACR,GAAG,cAAc,0CACnB;KACF,MAAM,WAAW,OAAO,eAAe,CAAC;KACxC,IAAI,CAAC,QAAQ,QAAQ,GACnB,MAAM,IAAI,MACR,GAAG,cAAc,yCACnB;KACF,WAAW,IACT,WACA,SAAS,KAAK,YACZ,QAAQ,WAAW,GAAG,IAClB,IAAI,KAAK,MAAM,UAAU,QAAQ,MAAM,CAAC,CAAC,MACzC,KAAK,MAAM,UAAU,OAAO,CAClC,CACF;IACF,SAAS,OAAO;KACd,mBAAmB,IACjB,WACA,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;IACF;IACA;GACF;EACF;EACA,IAAI;GACF,MAAM,SACJ,cAAc,QACV,KAAK,MAAM,MAAM,SAAS,EAAE,IAC5BC,MAAU,MAAM,SAAS,EAAE;GACjC,IAAI,CAAC,OAAO,MAAM,GAAG;GACrB,IACE,cAAc,SACd,OAAO,OAAO,sBAAsB,YACpC,OAAO,iBAAiB,CAAC,WAAW,OAAO,GAE3C;GACF,MAAM,QAAQ,eAAe,QAAQ,SAAS;GAC9C,MAAM,WAAW,OAAO,KAAK,IACzB,MAAM,cAAc,QAAQ,aAAa,aACzC;GACJ,MAAM,UACJ,cAAc,WAAW,OAAO,KAAK,KAAK,aAAa,KAAA,IACnD,CAAC,IACD;GACN,IAAI,QAAQ,OAAO,GAAG;IACpB,MAAM,WACJ,cAAc,SAAS,OAAO,KAAK,KAAK,QAAQ,MAAM,UAAU,IAC5D,MAAM,UAAU,CAAC,KAAK,YAAY,IAAI,SAAS,IAC/C,CAAC;IACP,WAAW,IAAI,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC;GACpE;EACF,QAAQ,CAER;CACF;CACA,MAAM,uCAAuB,IAAI,IAAyB;CAC1D,MAAM,kBACJ,MACA,UACA,cACG;EACH,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;EACpD,IAAI,aAAa,MAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,GACnE,OAAO;EACT,OAAO,kBAAkB;GACvB,WAAW;GACX,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc;GAC/C;GACA,gBAAgB;EAClB,CAAC;CACH;CACA,MAAM,8BAAc,IAAI,IAAI,CAAC,GAAG,CAAC;CACjC,IAAI,cAAc,OAAO;EACvB,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,IACE,+BACE,MAAM,KAAK,MAAM,KAAK,WAAW,cAAc,EACjD,KACA,8BAA8B,MAC3B,SAAS,MAAM,KAAK,MAAM,KAAK,WAAW,IAAI,OAAO,KAAA,CACxD,GAEA,YAAY,IAAI,SAAS;EAC7B;EACA,IAAI,UAAU;EACd,OAAO,SAAS;GACd,UAAU;GACV,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;IACzC,IAAI,CAAC,YAAY,IAAI,IAAI,GAAG;KAC1B,IACE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,cACtB,eAAe,MAAM,UAAU,SAAS,CAC1C,GAEA;KACF,YAAY,IAAI,IAAI;KACpB,UAAU;IACZ;IACA,KAAK,MAAM,QAAQ,WAAW;KAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;KACzC,IACE,YAAY,IAAI,SAAS,KACzB,CAAC,eAAe,MAAM,UAAU,SAAS,GAEzC;KACF,YAAY,IAAI,SAAS;KACzB,UAAU;IACZ;GACF;EACF;CACF;CACA,IAAI,cAAc,OACX;OAAA,MAAM,CAAC,WAAW,UAAU,oBAC/B,IAAI,YAAY,IAAI,SAAS,GAAG,MAAM;CAAA;CAE1C,IAAI,cAAc,SAChB,KAAK,MAAM,CAAC,MAAM,aAAa,YAAY;EACzC,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;EACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;EACrE,MAAM,oCAAoB,IAAI,IAAI,CAAC,IAAI,CAAC;EACxC,KAAK,MAAM,QAAQ,WAAW;GAC5B,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;GACzC,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IACE,SAAS,MAAM,YAAY,UAAU,QAAQ,UAAU,OAAO,CAAC,KAC/D,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA,kBAAkB,IAAI,SAAS;EACnC;EACA,KAAK,MAAM,aAAa,mBACtB,IAAI;GACF,MAAM,SAASA,MACb,MAAM,KAAK,MAAM,KAAK,WAAW,YAAY,MAAM,EACrD;GAIA,MAAM,YAHaA,MACjB,MAAM,KAAK,MAAM,KAAK,MAAM,YAAY,MAAM,EAErB,CAAC,CAAC;GAC7B,MAAM,YAAY,OAAO,SAAS,IAC9B,UAAU,kBACV,KAAA;GACJ,MAAM,mBAAmB,CAAC,MAAM;GAChC,MAAM,UAAU,OAAO;GACvB,IAAI,OAAO,OAAO,GACX;SAAA,MAAM,UAAU,OAAO,OAAO,OAAO,GACxC,IAAI,OAAO,MAAM,GAAG,iBAAiB,KAAK,MAAM;GAAA;GAEpD,KAAK,MAAM,SAAS,kBAClB,KAAK,MAAM,OAAO;IAChB;IACA;IACA;GACF,GAAG;IACD,MAAM,eAAe,MAAM;IAC3B,IAAI,CAAC,OAAO,YAAY,GAAG;IAC3B,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,YAAY,GAAG;KAC7D,IAAI,CAAC,OAAO,UAAU,GAAG;KACzB,MAAM,cAAc,WAAW,iBAAiB;KAChD,MAAM,WACJ,eAAe,OAAO,SAAS,IAC3B,UAAU,QACV;KACN,IAAI,CAAC,OAAO,QAAQ,KAAK,OAAO,SAAS,YAAY,UACnD;KACF,IACE,KAAK,MAAM,WAAW,SAAS,OAAO,KACtC,mBAAmB,KAAK,SAAS,OAAO,GAExC;KACF,MAAM,SAAS,KAAK,MAAM,UACxB,KAAK,MAAM,KACT,cAAc,OAAO,WACrB,SAAS,OACX,CACF;KACA,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,MAAM;KACjD,IACE,SAAS,WAAW,KAAK,KACzB,aAAa,QACb,MAAM,KAAK,MAAM,KAAK,QAAQ,YAAY,OAAO,KAAA,KACjD,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C,GAEA;KACF,kBAAkB,IAAI,MAAM;IAC9B;GACF;EAEJ,QAAQ,CAER;EAEF,qBAAqB,IAAI,MAAM,iBAAiB;CAClD;CAEF,OAAO,UACJ,QACE,SACC,cAAc,SAAS,YAAY,IAAI,KAAK,MAAM,QAAQ,IAAI,CAAC,CACnE,CAAC,CACA,QAAQ,SAAS;EAChB,MAAM,YAAY,KAAK,MAAM,QAAQ,IAAI;EACzC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACjD,IAAI,cAAc,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,OAAO;GAC1D,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,SAAS;GACpD,IAAI,aAAa,MAAM,SAAS,WAAW,KAAK,GAAG,OAAO;GAC1D,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;GACtE,MAAM,WAAW,SAAS,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC;GACrE,QACG,qBAAqB,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,MAAM,SACjD,cAAc,QACX,eAAe,MAAM,UAAU,SAAS,IACxC,SAAS,MAAM,YACb,UAAU,QAAQ,UAAU,OAAO,CACrC,OACN,CAAC,SAAS,MAAM,YACd,UAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC,CAAC,CAC9C;EAEJ,CAAC;CACH,CAAC,CAAC,CACD,IAAI,WAAW,CAAC,CAChB,QAAQ,WAAW,OAAO,WAAW,OAAO,QAAQ,SAAS,MAAM,KAAK;AAC7E;AASA,MAAM,uBACJ,WACA,UACG;CACH,IAAI,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;CACtD,SAAS;EACP,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,UAAU,OAAO,KAAA,GAAW,OAAO;EACnE,IAAI;GACF,MAAM,WAAoB,KAAK,MAC7B,MAAM,KAAK,MAAM,KAAK,MAAM,cAAc,MAAM,IAClD;GACA,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,sBAAsB,UAC5D,OAAO,SAAS,iBAAiB,CAAC,WAAW,MAAM,IAAI,QAAQ;EACnE,QAAQ,CAER;EACA,KAAK,MAAM,QAAQ,+BACjB,IAAI,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,OAAO,KAAA,GAAW,OAAO;EAC/D,IAAI,SAAS,KAAK,OAAO;EACzB,OAAO,KAAK,MAAM,QAAQ,IAAI;CAChC;AACF;AAEA,MAAM,mBAAmB,MAAc,UAAkC;CACvE,MAAM,eAAe,6BAA6B,IAAI;CACtD,IACE,iBAAiB,aACjB,iBAAiB,kBACjB,iBAAiB,SAEjB,OAAO;CACT,MAAM,OAAO,KAAK,MAAM,QAAQ,IAAI;CACpC,IACE,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,KAC5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,OAAO,KAAA,GAE5C,OAAO;CACT,MAAM,YAAY,MAAM,KAAK,MAAM,KAAK,MAAM,gBAAgB;CAC9D,IAAI,cAAc,KAAA,GAChB,IAAI;EAEF,MAAM,OADSA,MAAU,SACP,CAAC,CAAC;EACpB,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO;CACjD,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAkC;CACxD,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,MAAM,eAAe,WAAmB,cAAsB;EAC5D,MAAM,cAAc,MAAM,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC5D,YAAY,IAAI,SAAS;EACzB,MAAM,IAAI,WAAW,WAAW;CAClC;CACA,KAAK,MAAM,aAAa,eAAe,OAAO,KAAK,GACjD,YAAY,oBAAoB,WAAW,KAAK,GAAG,SAAS;CAC9D,KAAK,MAAM,aAAa,eAAe,OAAO,OAAO,GACnD,YAAY,SAAS,SAAS;CAChC,KAAK,MAAM,aAAa,eAAe,OAAO,IAAI,GAAG;EACnD,MAAM,OAAO,cAAc,MAAM,MAAM,UAAU,MAAM,CAAC;EACxD,YACE,gBAAgB,KAAK,MAAM,KAAK,MAAM,gBAAgB,GAAG,KAAK,GAC9D,SACF;CACF;CACA,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG;EACrC,IAAI,8BAA8B,IAAI,GAAG,YAAY,kBAAkB,GAAG;EAC1E,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,oBAAoB,4BAA4B,IAAI;EAC1D,IAAI,sBAAsB,KAAA,GACxB,YAAY,mBAAmB,YAAY,IAAI,CAAC;EAClD,IAAI,uBAAuB,IAAI,GAAG,YAAY,UAAU,YAAY,IAAI,CAAC;EACzE,IAAI,wBAAwB,IAAI,KAAK,2BAA2B,IAAI,GAClE,KAAK,MAAM,YAAY,kBAAkB,MAAM,SAAS,IAAI,EAC1D,OAAO,KACT,CAAC,GAAG;GACF,IAAI,SAAS,OAAO,SAAS,GAAG;GAChC,IAAI;IACF,MAAM,aAAa,wBACjB,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC,GACpC,IACF;IACA,IAAI,eAAe,KAAA,GACjB,YAAY,WAAW,WAAW,YAAY,IAAI,CAAC;GACvD,QAAQ,CAER;EACF;EAEF,IACE,SAAS,aACT,SAAS,aACR,SAAS,oBAAoB,2BAA2B,IAAI,GAE7D,YAAY,gBAAgB,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC;CAC/D;CACA,OAAO;AACT;AAEA,MAAM,cAAc,WAAmB,WAA6B;CAClE,IAAI,cAAc,SAAS,cAAc,OAAO,OAAO,OAAO;CAC9D,IAAI,cAAc,kBAAkB,OAAO,OAAO;CAClD,IAAI,cAAc,YAAY,cAAc,kBAC1C,OAAO,wBAAwB,OAAO,aAAa;CACrD,OAAO,CAAC;AACV;;AAQA,MAAa,2BAA2B,EACtC,SACA,aAEA,QAAQ,SAAS,EAAE,WAAW,iBAAiB;CAC7C,MAAM,UAAU,kBAAkB,UAAU;CAC5C,OAAO,WAAW,WAAW,MAAM,CAAC,CACjC,QAAQ,QAAQ,QAAQ,KAAK,GAAG,CAAC,CAAC,CAClC,KACE,QACC,qBAAqB,UAAU,GAAG,WAAW,qBAAqB,IAAI,oCAC1E;AACJ,CAAC;;AAGH,MAAa,wBAAwB,UAAmB;CACtD,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,QAAQ,SAAS,KAClD,CAAC,MAAM,QAAQ,MAAM,UAAU,KAC/B,MAAM,UAAU,CAAC,WAAW,GAE5B,MAAM,IAAI,MACR,6DACF;CACF,MAAM,6BAAa,IAAI,IAAY;CACnC,OAAO,MAAM,UAAU,CAAC,KAAK,UAAmB;EAC9C,IACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,MAChB,QAAQ,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,SAAS,GAAG,CACrD,KACA,OAAO,MAAM,iBAAiB,YAC9B,CAAC,QAAQ,MAAM,cAAc,KAC7B,MAAM,cAAc,CAAC,WAAW,GAEhC,MAAM,IAAI,MACR,6EACF;EACF,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,sBAAsB,SAAS,GAClC,MAAM,IAAI,MAAM,qCAAqC,WAAW;EAClE,MAAM,cAAc,MAAM;EAC1B,IAAI,WAAW,IAAI,SAAS,GAC1B,MAAM,IAAI,MAAM,mCAAmC,WAAW;EAChE,WAAW,IAAI,SAAS;EACxB,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,aAAa,aAAa;GACnC,IACE,CAAC,UAAU,WAAW,GAAG,KACzB,UAAU,SAAS,IAAI,KACvB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,OAAO,SAAS,IAAI,KACjE,KAAK,MAAM,UAAU,SAAS,MAAM,aACnC,cAAc,OAAO,UAAU,SAAS,GAAG,KAC5C,aAAa,KAAK,SAAS,GAE3B,MAAM,IAAI,MACR,oEAAoE,WACtE;GACF,IAAI,KAAK,IAAI,SAAS,GACpB,MAAM,IAAI,MAAM,mCAAmC,WAAW;GAChE,KAAK,IAAI,SAAS;EACpB;EACA,OAAO;GAAE;GAAW;EAAY;CAClC,CAAC;AACH;;AAOA,MAAa,4BAA4B,EACvC,OACA,QACA,SAAS,cACT,UAAU,CAAC,QACoB;CAC/B,MAAM,YAAY,wBAAwB;EAAE;EAAS;CAAO,CAAC;CAC7D,IAAI,UAAU,SAAS,GAAG,MAAM,IAAI,MAAM,UAAU,KAAK,IAAI,CAAC;CAC9D,MAAM,WAAW,eAAe,KAAK;CACrC,MAAM,QACJ,iBAAiB,KAAA,IACb,WACA,IAAI,IACF,qBAAqB,EAAE,SAAS,aAAa,CAAC,CAAC,CAAC,KAC7C,EAAE,WAAW,kBAAkB,CAAC,WAAW,IAAI,IAAI,WAAW,CAAC,CAClE,CACF;CACN,KAAK,MAAM,CAAC,WAAW,gBAAgB,UACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACtC,MAAM,IAAI,MACR,+BAA+B,UAAU,aAAa,WACxD;CAGN,KAAK,MAAM,EAAE,WAAW,gBAAgB,SACtC,IAAI,CAAC,MAAM,IAAI,SAAS,GACtB,MAAM,IAAI,MACR,qBAAqB,UAAU,GAAG,WAAW,UAAU,UAAU,cACnE;CACJ,MAAM,UAAU,CAAC,GAAG,KAAK,CAAC,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC,CAAC,CACpD,KAAK,CAAC,WAAW,0BAA0B;EAC1C,MAAM,cAAc,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK;EACnD,MAAM,SAAS,CACb,GAAG,WAAW,WAAW,MAAM,CAAC,CAAC,KAAK,UAAU;GAC9C,mBAAmB;GACnB,gBAAgB;EAClB,EAAE,GACF,GAAG,QACA,QAAQ,aAAa,SAAS,cAAc,SAAS,CAAC,CACtD,KAAK,YAAY,CAAC,CAClB,KAAK,EAAE,YAAY,mBAAmB;GACrC,mBAAmB;GACnB,gBAAgB;EAClB,EAAE,CACN;EACA,MAAM,OAAO,IAAI,OAAO,OAAO,SAAS,IAAI;EAC5C,KAAK,OAAO,OAAO;EACnB,OAAO;GACL,qBAAqB;GACrB,WAAW,YAAY,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,KAAA;GAC1D,aAAa,YAAY,SAAS,IAAI,cAAc,KAAA;GACpD,UAAU;IACR,UAAU,OAAO,SAAS;IAC1B,KAAK,OAAO,SAAS;IACrB;IACA,UAAU,OAAO,SAAS;GAC5B;GACA,UAAU,EAAE,gBAAgB,OAAO,SAAS,YAAY;GACxD,QAAQ,OAAO,YACb,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CACnD,MACA;IAAE,UAAU,MAAM;IAAU,gBAAgB,MAAM;GAAY,CAChE,CAAC,CACH;GACA,QAAQ,OAAO,SAAS,IAAI,SAAS,KAAA;EACvC;CACF,CAAC;CACH,OAAO,UAAU;EAAE,SAAS;EAAG;CAAQ,GAAG,EAAE,uBAAuB,MAAM,CAAC;AAC5E;;AAGA,MAAa,mBAAmB,EAC9B,OACA,QACA,UAAU,CAAC,QAC+B;CAC1C,MAAM,QAAQ,eAAe,KAAK;CAClC,MAAM,QAAQ,CAAC,0BAA0B,yBAAyB,CAAC,CAAC,QACjE,SAAS,MAAM,UAAU,KAAA,CAC5B;CACA,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW,KAAK,QAAQ,WAAW,GAAG,OAAO,CAAC;CAC5E,MAAM,OAAO,MAAM,GAAG,CAAC,KAAK;CAC5B,MAAM,cAA4B,CAAC;CACnC,MAAM,OAAO,SAAiB,OAAO,MAAM;EACzC,YAAY,KAAK;GAAE,MAAM;GAAqB,MAAM;GAAM;GAAM;EAAQ,CAAC;CAC3E;CACA,IAAI,MAAM,WAAW,GAAG;EACtB,IACE,wEACF;EACA,OAAO;CACT;CACA,IAAI,MAAM,SAAS,GAAG,IAAI,wCAAwC;CAClE,MAAM,cAAc,IAAI,YAAY;CACpC,MAAM,WAAW,cAAc,MAAM,SAAS,IAAI,EAChD,YACF,CAAC;CACD,IAAI,SAAS,OAAO,SAAS,GAAG;EAC9B,KAAK,MAAM,SAAS,SAAS,QAC3B,IACE,4BAA4B,MAAM,WAClC,YAAY,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,IACpC;EACF,OAAO;CACT;CACA,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,KAAK,EAAE,eAAe,IAAI,CAAC;CAC/C,QAAQ;EACN,IAAI,wCAAwC;EAC5C,OAAO;CACT;CACA,IACE,CAAC,OAAO,MAAM,KACd,OAAO,eAAe,KACtB,CAAC,MAAM,QAAQ,OAAO,UAAU,GAChC;EACA,IAAI,yDAAyD;EAC7D,OAAO;CACT;CACA,MAAM,0BAAU,IAAI,IAAyB;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,iBAAiB,cAAc,MAAM,SAAS,IAAI;GACtD,SAAS;GACT,QAAQ;EACV,CAAC;EACD,IAAI,eAAe,OAAO,WAAW,GACnC,SAAS,eAAe,KAAK,EAAE,eAAe,IAAI,CAAC;CACvD,QAAQ,CAER;CACA,MAAM,gBACJ,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,6BAAa,IAAI,IAAiC;CACxD,MAAM,oCAAoB,IAAI,IAAY;CAC1C,MAAM,kCAAkB,IAAI,IAAiC;CAC7D,KAAK,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,CAAC,QAAQ,GAAG;EACzD,MAAM,UAAU,QAAgB;GAC9B,MAAM,OAAgB,SAAS,MAAM;IAAC;IAAW;IAAO;GAAG,GAAG,IAAI;GAClE,MAAM,SAAS,OAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,KAAA;GAChD,OAAO,WAAW,KAAA,IAAY,IAAI,YAAY,QAAQ,MAAM,CAAC,CAAC;EAChE;EACA,MAAM,UAAU,KAAa,YAAoB,IAAI,SAAS,OAAO,GAAG,CAAC;EACzE,IAAI,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,yBAAyB,UAAU;GACtE,OACE,qBACA,yDACF;GACA;EACF;EACA,MAAM,YAAY,OAAO;EACzB,IAAI,OAAO,qBAAqB,KAAA,GAC9B,OACE,iBACA,GAAG,UAAU,gDACf;EACF,IAAI,OAAO,gCAAgC,GACzC,OACE,4BACA,GAAG,UAAU,sCACf;EACF,MAAM,SAAS,OAAO;EACtB,MAAM,WAAW,OAAO;EACxB,IAAI,cAAwB,CAAC;EAC7B,IAAI,OAAO,WAAW,YAAY,aAAa,KAAA,GAC7C,cAAc,CAAC,MAAM;OAClB,IAAI,WAAW,KAAA,KAAa,QAAQ,QAAQ,GAAG,cAAc;EAClE,MAAM,mBAAmB,YAAY,QAClC,cACC,UAAU,WAAW,GAAG,KAAK,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,CACpE;EACA,IACE,YAAY,WAAW,KACvB,iBAAiB,WAAW,YAAY,QAExC,OACE,aACA,GAAG,UAAU,2EACf;EAEF,MAAM,wBAAwB,MAAM,KAClC,IAAI,IACF,iBAAiB,KACd,UAAU,KAAK,MAAM,UAAU,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE,KAAK,GAChE,CACF,CACF;EACA,MAAM,UAAU,QAAQ,IAAI,SAAS,qBAAK,IAAI,IAAY;EAC1D,MAAM,qBACJ,gBAAgB,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC5D,KAAK,MAAM,aAAa,uBAAuB;GAC7C,MAAM,WAAW,mBAAmB,IAAI,SAAS;GACjD,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,cAAc,UAAU,yBAAyB,WAAW,GAC3E;QACG,mBAAmB,IAAI,WAAW,KAAK;EAC9C;EACA,gBAAgB,IAAI,WAAW,kBAAkB;EACjD,MAAM,eAAe,WAAW,IAAI,SAAS,qBAAK,IAAI,IAAoB;EAC1E,KAAK,MAAM,QAAQ,MAAM,IAAI,SAAS,KAAK,CAAC,GAC1C,IACE,sBAAsB,MACnB,cACC,cAAc,QACb,aAAa,KAAA,KAAa,UAAU,QAAQ,MAAM,SAAS,CAChE,GACA;GACA,MAAM,WAAW,aAAa,IAAI,IAAI;GACtC,IAAI,aAAa,KAAA,GACf,OACE,aAAa,KAAA,IAAY,cAAc,eACvC,GAAG,UAAU,gBAAgB,KAAK,yBAAyB,WAAW,GACxE;QACG,aAAa,IAAI,MAAM,KAAK;GACjC,QAAQ,IAAI,IAAI;EAClB;EAEF,WAAW,IAAI,WAAW,YAAY;EACtC,QAAQ,IAAI,WAAW,OAAO;EAC9B,MAAM,WAAW,OAAO;EACxB,MAAM,eAAwB,cAAc,GAAG,KAAK;EACpD,MAAM,iBAAiB,OAAO,YAAY,IACtC,aAAa,cACb,KAAA;EACJ,IACE,OAAO,QAAQ,KACf,SAAS,YAAY,OAAO,SAAS,SACpC,CAAC,OAAO,cAAc,KACrB,eAAe,YAAY,OAAO,SAAS,OAE7C,OACE,YACA,GAAG,UAAU,+DACf;EACF,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,CAAC,CAAC,UAC9D,OAAO,QAAQ,OAAO,QAAQ,CAAC,CAAC,MAC7B,CAAC,KAAK,WAAW,SAAS,SAAS,KACtC,GAEA,OAAO,YAAY,GAAG,UAAU,wCAAwC;EAC1E,MAAM,WAAW,OAAO;EACxB,IACE,CAAC,OAAO,QAAQ,KAChB,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KACjC,SAAS,oBAAoB,OAAO,SAAS,aAE7C,OACE,YACA,GAAG,UAAU,6CAA6C,OAAO,SAAS,aAC5E;EACF,MAAM,SAAS,OAAO;EACtB,IACE,CAAC,OAAO,MAAM,KACd,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,UAC1D,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc;GACvD,MAAM,QAAQ,OAAO;GACrB,OACE,CAAC,OAAO,KAAK,KACb,OAAO,KAAK,KAAK,CAAC,CAAC,WAAW,KAC9B,CAAC,YAAY,MAAM,aAAa,SAAS,QAAQ,KACjD,CAAC,YAAY,MAAM,iBAAiB,SAAS,WAAW;EAE5D,CAAC,GAED,OAAO,UAAU,GAAG,UAAU,sCAAsC;EACtE,MAAM,UAAU,WAAW,WAAW,MAAM;EAC5C,MAAM,WAAW,QAAQ,QACtB,gBAAgB,YAAY,cAAc,SAC7C;EACA,kBAAkB,IAAI,SAAS;EAC/B,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,IACvE,OAAO,UAAU,GAAG,UAAU,0CAA0C;EAC1E,MAAM,UAAqB,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC;EAC7D,MAAM,UAAU,UACd,OAAO,KAAK,KAAK,OAAO,MAAM,uBAAuB,WACjD,MAAM,qBACN,KAAA;EACN,IACE,QAAQ,MAAM,UAAU;GACtB,MAAM,OAAO,OAAO,KAAK;GACzB,OACE,SAAS,KAAA,KACR,CAAC,QAAQ,SAAS,IAAI,KACrB,CAAC,SAAS,MAAM,EAAE,iBAAiB,eAAe,IAAI;EAE5D,CAAC,GAED,OACE,UACA,GAAG,UAAU,uGACf;EACF,IACE,QAAQ,MAAM,UAAU;GACtB,MAAM,OAAO,OAAO,KAAK;GACzB,OACE,SAAS,KAAA,KACT,QAAQ,SAAS,IAAI,KACrB,CAAC,kBAAkB,KAAK;EAE5B,CAAC,GAED,OACE,UACA,GAAG,UAAU,mLACf;EACF,KAAK,MAAM,QAAQ,SACjB,IACE,CAAC,QAAQ,MACN,UAAU,OAAO,KAAK,MAAM,QAAQ,kBAAkB,KAAK,CAC9D,GAEA,OACE,UACA,GAAG,UAAU,8CAA8C,MAC7D;EAEJ,KAAK,MAAM,EAAE,YAAY,iBAAiB,UAAU;GAClD,MAAM,WAAW,QAAQ,QAAQ,UAAU,OAAO,KAAK,MAAM,UAAU;GACvE,IACE,SAAS,WAAW,KACpB,CAAC,SAAS,OAAO,UAAU,cAAc,OAAO,WAAW,CAAC,GAE5D,OACE,UACA,GAAG,UAAU,WAAW,WAAW,uCAAuC,YAAY,KAAK,IAAI,EAAE,oCACnG;EACJ;CACF;CACA,KAAK,MAAM,EAAE,WAAW,gBAAgB,SACtC,IAAI,CAAC,kBAAkB,IAAI,SAAS,GAClC,IACE,qBAAqB,UAAU,GAAG,WAAW,UAAU,UAAU,cACnE;CACJ,KAAK,MAAM,CAAC,WAAW,gBAAgB,OACrC,KAAK,MAAM,aAAa,aACtB,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,GACxC,IAAI,SAAS,UAAU,yBAAyB,WAAW;CAGjE,OAAO;AACT"}

package/dist/toolchain-guard.cjs

@@ -17,7 +17,7 @@ picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 let node_module = require("node:module");
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.5.2";
+const consumerRunnerVersion = "1.6.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -3894,7 +3894,7 @@ const record = (value) => typeof value === "object" && value !== null && !Array.
 const array = (value) => Array.isArray(value);
 /** Repository-owned declarations are explicit; malformed decisions fail closed. */
 const parseToolchainConfiguration = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks" && key !== "rustExceptions") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors consumerChecks and rustExceptions declarations");
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks" && key !== "rustExceptions" && key !== "dependabotIgnores") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors, consumerChecks, rustExceptions and dependabotIgnores declarations");
 	const disabled = /* @__PURE__ */ new Set();
 	const optOuts = input["optOuts"] ?? [];
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
@@ -3914,7 +3914,8 @@ const parseToolchainConfiguration = (input) => {
 		cloud: require_toolchain_inputs.parseCloudSetup(input["cloud"]),
 		engineFloors: parseEngineFloors(input["engineFloors"]),
 		dynamicSelectors: parseDynamicSelectors(input["dynamicSelectors"]),
-		consumerChecks: parseConsumerChecks(input["consumerChecks"])
+		consumerChecks: parseConsumerChecks(input["consumerChecks"]),
+		dependabotIgnores: require_toolchain_dependabot.parseDependabotIgnores(input["dependabotIgnores"])
 	};
 };
 /** Dependency graphs stay opaque unless a caller explicitly needs registry identities. */
@@ -4145,9 +4146,20 @@ const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
 		line: 1,
 		message: `dynamic selector ${entry.path}:${entry.at ?? entry.line} must match exactly one unresolved ${entry.kind} selector`
 	});
+	const dependabotIgnores = configuration.dependabotIgnores;
+	for (const message of require_toolchain_dependabot.declaredIgnoreConflicts({
+		ignores: dependabotIgnores,
+		policy: policy.dependabot
+	})) diagnostics.push({
+		rule: "configuration",
+		path: "stll-toolchain.json",
+		line: 1,
+		message
+	});
 	diagnostics.push(...require_toolchain_dependabot.checkDependabot({
 		files,
-		policy: policy.dependabot
+		policy: policy.dependabot,
+		ignores: dependabotIgnores
 	}));
 	return diagnostics.filter((diagnostic) => !configuration.disabled.has(diagnostic.rule));
 };