@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/runtime/dockerfile.js

@@ -0,0 +1,228 @@
+import { pinned } from './declaration.js';
+const DIRECTIVE = /^#\s*([a-z]+)\s*=\s*(\S+)\s*$/i;
+const HEREDOC_WORD = /^\d*<<-?(["']?)([^<"'\s]+)\1$/;
+const HEREDOC_KEYWORDS = new Set(['RUN', 'COPY', 'ADD']);
+/** The escape character, which a parser directive at the top may change to a backtick. */
+function escapeOf(lines) {
+    for (const line of lines) {
+        const directive = DIRECTIVE.exec(line);
+        if (directive === null)
+            return '\\';
+        if (directive[1]?.toLowerCase() === 'escape')
+            return directive[2] === '`' ? '`' : '\\';
+    }
+    return '\\';
+}
+function isSkippable(line) {
+    const trimmed = line.trim();
+    return trimmed === '' || trimmed.startsWith('#');
+}
+function toInstruction(parts, line, endLine) {
+    const joined = parts.join(' ').trim();
+    const space = joined.search(/\s/);
+    const keyword = space < 0 ? joined : joined.slice(0, space);
+    const args = space < 0 ? '' : joined.slice(space + 1).trim();
+    return { keyword: keyword.toUpperCase(), args, line, endLine };
+}
+/**
+ * The heredoc delimiters an instruction opens, in order: as BuildKit reads them, only in `RUN`,
+ * `COPY` and `ADD`, and only as a whole word (`<<EOF`, `<<-"EOF"`), so a here-string or a shift
+ * opens none.
+ */
+function delimitersOf(instruction) {
+    if (!HEREDOC_KEYWORDS.has(instruction.keyword))
+        return [];
+    return instruction.args
+        .split(/\s+/)
+        .map((word) => HEREDOC_WORD.exec(word)?.[2])
+        .filter((name) => name !== undefined);
+}
+function readLine(state, raw, line) {
+    if (state.delimiters.length > 0) {
+        if (raw.replace(/^\t+/, '') === state.delimiters[0])
+            state.delimiters.shift();
+        return;
+    }
+    if (isSkippable(raw))
+        return;
+    if (state.parts.length === 0)
+        state.start = line;
+    const trimmed = raw.trimEnd();
+    const continued = trimmed.endsWith(state.escape);
+    state.parts.push(continued ? trimmed.slice(0, -1) : trimmed);
+    if (continued)
+        return;
+    const instruction = toInstruction(state.parts, state.start, line);
+    state.found.push(instruction);
+    state.delimiters = delimitersOf(instruction);
+    state.parts = [];
+}
+/**
+ * The Dockerfile's instructions: continuation lines joined, comments, blank lines and heredoc
+ * bodies left out.
+ */
+export function instructions(text) {
+    const lines = text.split(/\r?\n/);
+    const state = {
+        escape: escapeOf(lines),
+        found: [],
+        parts: [],
+        start: 0,
+        delimiters: [],
+    };
+    for (const [index, raw] of lines.entries())
+        readLine(state, raw, index + 1);
+    if (state.parts.length > 0) {
+        state.found.push(toInstruction(state.parts, state.start, lines.length));
+    }
+    return state.found;
+}
+function unquote(value) {
+    return /^(["']).*\1$/.test(value) ? value.slice(1, -1) : value;
+}
+function argOf(token, line) {
+    const equals = token.indexOf('=');
+    if (equals < 0)
+        return [token, { line }];
+    return [token.slice(0, equals), { value: unquote(token.slice(equals + 1)), line }];
+}
+/** The build arguments declared before the first `FROM`, the only ones a `FROM` line may use. */
+export function globalArgs(list) {
+    const firstFrom = list.findIndex((instruction) => instruction.keyword === 'FROM');
+    const prelude = firstFrom < 0 ? list : list.slice(0, firstFrom);
+    return new Map(prelude
+        .filter((instruction) => instruction.keyword === 'ARG')
+        .flatMap((instruction) => instruction.args
+        .split(/\s+/)
+        .filter((token) => token !== '')
+        .map((token) => argOf(token, instruction.line))));
+}
+const VARIABLE = /\$\{([A-Za-z_]\w*)(?::?([-+])([^}]*))?\}|\$([A-Za-z_]\w*)/g;
+function expand(match, args, used) {
+    const [whole, braced, operator, word = '', bare] = match;
+    const name = braced ?? bare ?? '';
+    const value = args.get(name)?.value;
+    const set = value !== undefined && value !== '';
+    if (set)
+        used.push(name);
+    if (operator === '-')
+        return set ? value : word;
+    if (operator === '+')
+        return set ? word : '';
+    return value ?? whole;
+}
+/**
+ * Replaces `$NAME`, `${NAME}`, `${NAME:-default}` and `${NAME:+alternative}` as Docker does;
+ * a variable with no value and no default stays as written.
+ */
+export function substitute(text, args) {
+    const used = [];
+    let replaced = '';
+    let last = 0;
+    for (const match of text.matchAll(VARIABLE)) {
+        replaced += text.slice(last, match.index) + expand(match, args, used);
+        last = match.index + match[0].length;
+    }
+    return { text: replaced + text.slice(last), used };
+}
+/** `[registry/]path[:tag][@digest]`. */
+export function splitReference(reference) {
+    const at = reference.indexOf('@');
+    const named = at < 0 ? reference : reference.slice(0, at);
+    const digest = at < 0 ? undefined : reference.slice(at + 1);
+    const colon = named.lastIndexOf(':');
+    const hasTag = colon > named.lastIndexOf('/');
+    return {
+        path: hasTag ? named.slice(0, colon) : named,
+        ...(hasTag ? { tag: named.slice(colon + 1) } : {}),
+        ...(digest === undefined ? {} : { digest }),
+    };
+}
+/** The image's name on Docker Hub: no registry host, no `library/`. */
+export function officialName(path) {
+    const parts = path.toLowerCase().split('/');
+    const [first = '', ...rest] = parts;
+    const hosted = rest.length > 0 && (/[.:]/.test(first) || first === 'localhost');
+    let name = (hosted ? rest : parts).join('/');
+    for (const prefix of ['docker/library/', 'library/']) {
+        if (name.startsWith(prefix))
+            name = name.slice(prefix.length);
+    }
+    return name;
+}
+const IMAGES = new Map([
+    ['php', 'php'],
+    ['node', 'node'],
+    ['python', 'python'],
+    ['rust', 'rust'],
+    ['golang', 'go'],
+    ['ruby', 'ruby'],
+    ['oven/bun', 'bun'],
+    ['denoland/deno', 'deno'],
+]);
+/** The release a tag names: its first dash-separated part that starts with a digit. */
+export function tagVersion(tag) {
+    return tag.split('-').find((segment) => /^\d/.test(segment));
+}
+function written(reference) {
+    const tag = reference.tag === undefined ? '' : `:${reference.tag}`;
+    const digest = reference.digest === undefined ? '' : `@${reference.digest.slice(0, 15)}…`;
+    return `${reference.path}${tag}${digest}`;
+}
+/** `FROM [--platform=…] image [AS stage]`. */
+export function parseFrom(args) {
+    const tokens = args.split(/\s+/).filter((token) => token !== '' && !token.startsWith('--'));
+    const [image, as, stage] = tokens;
+    return {
+        ...(image === undefined ? {} : { image }),
+        ...(as?.toLowerCase() === 'as' && stage !== undefined ? { stage: stage.toLowerCase() } : {}),
+    };
+}
+/** The line that sets the version: the build argument that carries it, else the `FROM` line. */
+function placeOf(scope, from, used, version) {
+    const carrier = version === undefined
+        ? undefined
+        : used.map((name) => scope.args.get(name)).find((arg) => arg?.value?.includes(version));
+    if (carrier !== undefined)
+        return { file: scope.file, line: carrier.line };
+    const span = from.endLine > from.line ? { endLine: from.endLine } : {};
+    return { file: scope.file, line: from.line, ...span };
+}
+function fromDeclaration(scope, from) {
+    const { image } = parseFrom(from.args);
+    if (image === undefined || image === 'scratch' || scope.stages.has(image.toLowerCase())) {
+        return undefined;
+    }
+    const resolved = substitute(image, scope.args);
+    const reference = splitReference(resolved.text);
+    if (reference.path.includes('$'))
+        return undefined;
+    const runtime = IMAGES.get(officialName(reference.path));
+    if (runtime === undefined)
+        return undefined;
+    const tag = reference.tag;
+    const version = tag === undefined || tag.includes('$') ? undefined : tagVersion(tag);
+    const place = placeOf(scope, from, resolved.used, version);
+    return pinned(runtime, place, written(reference), version);
+}
+/**
+ * The runtimes a Dockerfile's `FROM` lines build on, every stage: official images of a runtime
+ * (`php`, `node`, `python`, `rust`, `golang`, `ruby`, `oven/bun`, `denoland/deno`) from any
+ * registry, build arguments resolved where they have a value.
+ */
+export function dockerfileDeclarations(file, text) {
+    const list = instructions(text);
+    const stages = new Set();
+    const scope = { file, args: globalArgs(list), stages };
+    const found = [];
+    for (const instruction of list.filter((i) => i.keyword === 'FROM')) {
+        const declaration = fromDeclaration(scope, instruction);
+        if (declaration !== undefined)
+            found.push(declaration);
+        const { stage } = parseFrom(instruction.args);
+        if (stage !== undefined)
+            stages.add(stage);
+    }
+    return found;
+}
+//# sourceMappingURL=dockerfile.js.map

package/dist/checks/runtime/dockerfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile.js","sourceRoot":"","sources":["../../../src/checks/runtime/dockerfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAWxE,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,YAAY,GAAG,+BAA+B,CAAC;AACrD,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E,0FAA0F;AAC1F,SAAS,QAAQ,CAAC,KAAwB;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB,EAAE,IAAY,EAAE,OAAe;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,WAAwB;IAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,OAAO,WAAW,CAAC,IAAI;SACpB,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC3C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AAC1D,CAAC;AAUD,SAAS,QAAQ,CAAC,KAAc,EAAE,GAAW,EAAE,IAAY;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,SAAS;QAAE,OAAO;IACtB,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,KAAK,CAAC,UAAU,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC7C,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAY;QACrB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;QACvB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,CAAC;QACR,UAAU,EAAE,EAAE;KACf,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAID,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,IAAY;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,IAA4B;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,IAAI,GAAG,CACZ,OAAO;SACJ,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,KAAK,KAAK,CAAC;SACtD,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CACvB,WAAW,CAAC,IAAI;SACb,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;SAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAClD,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,4DAA4D,CAAC;AAQ9E,SAAS,MAAM,CAAC,KAAsB,EAAE,IAA8B,EAAE,IAAc;IACpF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACpC,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;IAChD,IAAI,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,OAAO,KAAK,IAAI,KAAK,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAA8B;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtE,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAID,wCAAwC;AACxC,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;QAC5C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC;IAChF,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,MAAM,GAAiC,IAAI,GAAG,CAAkB;IACpE,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,QAAQ,EAAE,IAAI,CAAC;IAChB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,eAAe,EAAE,MAAM,CAAC;CAC1B,CAAC,CAAC;AAEH,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,OAAO,CAAC,SAAoB;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IAC1F,OAAO,GAAG,SAAS,CAAC,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;AAC5C,CAAC;AAID,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC;IAClC,OAAO;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC;AACJ,CAAC;AAQD,gGAAgG;AAChG,SAAS,OAAO,CACd,KAAY,EACZ,IAAiB,EACjB,IAAuB,EACvB,OAAgB;IAEhB,MAAM,OAAO,GACX,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,KAAY,EAAE,IAAiB;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,IAAY;IAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/checks/runtime/feeds.js

@@ -0,0 +1,120 @@
+import { z } from 'zod';
+import { RUNTIMES } from './runtimes.js';
+import { cycleOf, isRelease, leadingRelease } from './versions.js';
+import { EngineError } from '../../core/check.js';
+const ENDOFLIFE = 'https://endoflife.date/api/v1/products';
+export function endOfLifeRequest(product) {
+    return { name: `endoflife-${product}`, url: `${ENDOFLIFE}/${encodeURIComponent(product)}` };
+}
+export function phpReleasesRequest(cycle) {
+    return {
+        name: `php-releases-${cycle}`,
+        url: `https://www.php.net/releases/index.php?json&version=${encodeURIComponent(cycle)}&max=1000`,
+    };
+}
+export const NODE_INDEX = {
+    name: 'node-index',
+    url: 'https://nodejs.org/dist/index.json',
+};
+function json(name, text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new EngineError(`the ${name} feed isn't JSON`);
+    }
+}
+function shaped(name, schema, text) {
+    const parsed = schema.safeParse(json(name, text));
+    if (!parsed.success)
+        throw new EngineError(`the ${name} feed has an unexpected shape`);
+    return parsed.data;
+}
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+/** A date, or `undefined` for anything else the feed puts there (`null`, `true`). */
+const date = z
+    .union([z.string(), z.boolean()])
+    .nullish()
+    .transform((value) => (typeof value === 'string' && DATE.test(value) ? value : undefined));
+const productSchema = z.object({
+    result: z.object({
+        releases: z.array(z.object({
+            name: z.string(),
+            isEol: z.boolean().nullish(),
+            eolFrom: date,
+            eoasFrom: date,
+            latest: z.object({ name: z.string(), date }).nullish(),
+        })),
+    }),
+});
+/** endoflife.date's product: each cycle's newest release and end of life. */
+export function parseEndOfLife(text, product = 'endoflife.date') {
+    return shaped(product, productSchema, text).result.releases.map((release) => {
+        const latest = release.latest?.name;
+        return {
+            name: release.name,
+            ...(latest !== undefined && isRelease(latest) ? { latest } : {}),
+            ...(release.latest?.date === undefined ? {} : { latestDate: release.latest.date }),
+            ...(release.eolFrom === undefined ? {} : { eol: release.eolFrom }),
+            isEol: release.isEol === true,
+            ...(release.eoasFrom === undefined ? {} : { activeUntil: release.eoasFrom }),
+        };
+    });
+}
+const phpUnknownSchema = z.object({ error: z.string() });
+const phpSchema = z.record(z.string(), z.object({ tags: z.array(z.string()).nullish() }));
+/** php.net's releases of one cycle: those tagged `security`. An unknown cycle has none. */
+export function parsePhpReleases(text) {
+    if (phpUnknownSchema.safeParse(json('php.net', text)).success)
+        return [];
+    return Object.entries(shaped('php.net', phpSchema, text))
+        .filter(([version, release]) => release.tags?.includes('security') === true && isRelease(version))
+        .map(([version]) => version);
+}
+const nodeSchema = z.array(z.object({ version: z.string(), security: z.boolean().nullish() }));
+/** nodejs.org's `index.json`: the releases marked `security: true`. */
+export function parseNodeIndex(text) {
+    return shaped('nodejs.org', nodeSchema, text)
+        .filter((release) => release.security === true)
+        .map((release) => release.version.replace(/^v/, ''))
+        .filter((version) => isRelease(version));
+}
+async function fetchCycles(fetcher, runtime) {
+    const { product } = RUNTIMES[runtime];
+    return parseEndOfLife(await fetcher(endOfLifeRequest(product)), product);
+}
+/** The cycles of the exact declarations of one runtime. */
+function exactCycles(declarations, runtime, cycles) {
+    const names = cycles.map((cycle) => cycle.name);
+    const found = declarations
+        .filter((d) => d.runtime === runtime && d.exactness === 'exact' && d.version !== undefined)
+        .map((d) => cycleOf(leadingRelease(d.version ?? '') ?? '', names))
+        .filter((cycle) => cycle !== undefined);
+    return [...new Set(found)];
+}
+async function fetchSecurity(fetcher, runtime, cycles) {
+    const source = RUNTIMES[runtime].security;
+    if (cycles.length === 0)
+        return undefined;
+    if (source === 'php.net') {
+        const texts = await Promise.all(cycles.map((cycle) => fetcher(phpReleasesRequest(cycle))));
+        return new Set(texts.flatMap((text) => parsePhpReleases(text)));
+    }
+    if (source === 'nodejs')
+        return new Set(parseNodeIndex(await fetcher(NODE_INDEX)));
+    return undefined;
+}
+/**
+ * The feeds the declarations need: endoflife.date for every runtime declared, and the vendor's
+ * security flags for the cycles that an exact declaration pins.
+ */
+export async function loadFeeds(declarations, fetcher) {
+    const runtimes = [...new Set(declarations.map((d) => d.runtime))];
+    const entries = await Promise.all(runtimes.map(async (runtime) => {
+        const cycles = await fetchCycles(fetcher, runtime);
+        const security = await fetchSecurity(fetcher, runtime, exactCycles(declarations, runtime, cycles));
+        return [runtime, { cycles, ...(security === undefined ? {} : { security }) }];
+    }));
+    return new Map(entries);
+}
+//# sourceMappingURL=feeds.js.map

package/dist/checks/runtime/feeds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feeds.js","sourceRoot":"","sources":["../../../src/checks/runtime/feeds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAgB,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAwBlD,MAAM,SAAS,GAAG,wCAAwC,CAAC;AAE3D,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,EAAE,IAAI,EAAE,aAAa,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO;QACL,IAAI,EAAE,gBAAgB,KAAK,EAAE;QAC7B,GAAG,EAAE,uDAAuD,kBAAkB,CAAC,KAAK,CAAC,WAAW;KACjG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,oCAAoC;CAC1C,CAAC;AAEF,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,OAAO,IAAI,kBAAkB,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAI,IAAY,EAAE,MAAoB,EAAE,IAAY;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,IAAI,GAAG,qBAAqB,CAAC;AAEnC,qFAAqF;AACrF,MAAM,IAAI,GAAG,CAAC;KACX,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KAChC,OAAO,EAAE;KACT,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAE7F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE;YAC5B,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;SACvD,CAAC,CACH;KACF,CAAC;CACH,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAO,GAAG,gBAAgB;IACrE,OAAO,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;QACpC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YAClE,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;YAC7B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1F,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;SACtD,MAAM,CACL,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,CAC1F;SACA,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE/F,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC;SAC1C,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;SAC9C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACnD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,OAAgB;IAC3D,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,cAAc,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,2DAA2D;AAC3D,SAAS,WAAW,CAClB,YAAoC,EACpC,OAAgB,EAChB,MAAwB;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,YAAY;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;SAC1F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,OAAgB,EAChB,MAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,YAAoC,EACpC,OAAgB;IAEhB,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAmC,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,OAAO,EACP,OAAO,EACP,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAC3C,CAAC;QACF,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CACH,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC"}

package/dist/checks/runtime/fetchers.js

@@ -0,0 +1,72 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { EngineError } from '../../core/check.js';
+/** Setting it to a directory of recorded feeds (`<name>.json`) keeps the check off the network. */
+export const FEEDS_VARIABLE = 'TALOS_RUNTIME_FEEDS';
+const TIMEOUT_MS = 30_000;
+/**
+ * The live feeds, through `fetchImpl`. Node's `fetch` uses `HTTPS_PROXY` only when
+ * `NODE_USE_ENV_PROXY=1` is set, as it must be behind a proxy.
+ */
+export function httpFetcher(fetchImpl = fetch) {
+    return async ({ name, url }) => {
+        const response = await fetchImpl(url, {
+            headers: { accept: 'application/json', 'user-agent': 'talos-runtime-check' },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        }).catch(() => undefined);
+        if (response === undefined)
+            throw new EngineError(`the ${name} feed could not be reached`);
+        if (!response.ok)
+            throw new EngineError(`the ${name} feed answered HTTP ${response.status}`);
+        return response.text().catch(() => {
+            throw new EngineError(`the ${name} feed was cut off`);
+        });
+    };
+}
+export const networkFetcher = httpFetcher();
+/** Recorded feeds: `<dir>/<name>.json`. */
+export function fixtureFetcher(dir) {
+    return async ({ name }) => {
+        try {
+            return await readFile(join(dir, `${name}.json`), 'utf8');
+        }
+        catch {
+            throw new EngineError(`${FEEDS_VARIABLE} has no recorded ${name}.json`);
+        }
+    };
+}
+const TTL_MS = 10 * 60 * 1000;
+/**
+ * Shares one fetch of each feed for `ttlMs`, across every check and repository a process
+ * judges; a failed fetch is forgotten, so the next caller tries again.
+ */
+export function cachedFetcher(fetcher, ttlMs = TTL_MS, now = Date.now) {
+    const cache = new Map();
+    return (request) => {
+        const known = cache.get(request.url);
+        if (known !== undefined && now() - known.at < ttlMs)
+            return known.body;
+        const body = fetcher(request);
+        cache.set(request.url, { at: now(), body });
+        void body.catch(() => {
+            if (cache.get(request.url)?.body === body)
+                cache.delete(request.url);
+        });
+        return body;
+    };
+}
+/** The fetcher the environment asks for: recorded feeds when the variable is set, else live. */
+export function fetcherFor(env) {
+    const dir = env[FEEDS_VARIABLE];
+    return dir === undefined || dir === '' ? networkFetcher : fixtureFetcher(dir);
+}
+let shared;
+/** The process's cached fetcher, per `fetcherFor(process.env)`. */
+export function defaultFetcher() {
+    const dir = process.env[FEEDS_VARIABLE];
+    if (shared === undefined || shared.dir !== dir) {
+        shared = { dir, fetcher: cachedFetcher(fetcherFor(process.env)) };
+    }
+    return shared.fetcher;
+}
+//# sourceMappingURL=fetchers.js.map

package/dist/checks/runtime/fetchers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchers.js","sourceRoot":"","sources":["../../../src/checks/runtime/fetchers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQlD,mGAAmG;AACnG,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,MAAM,UAAU,GAAG,MAAM,CAAC;AAK1B;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,YAAuB,KAAK;IACtD,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,qBAAqB,EAAE;YAC5E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,WAAW,CAAC,OAAO,IAAI,4BAA4B,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,OAAO,IAAI,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAU,EAAE;YACvC,MAAM,IAAI,WAAW,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAY,WAAW,EAAE,CAAC;AAErD,2CAA2C;AAC3C,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,GAAG,cAAc,oBAAoB,IAAI,OAAO,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,KAAK,GAAG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmE,CAAC;IACzF,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACnB,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,IAAI;gBAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,GAAiD;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED,IAAI,MAAmF,CAAC;AAExF,mEAAmE;AACnE,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAC/C,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC"}

package/dist/checks/runtime/index.js

@@ -0,0 +1,7 @@
+import { runtimesCheck } from './check.js';
+/** Runtimes against their vendors' feeds; `README.md` beside this file describes the check. */
+export const runtimePack = {
+    name: 'runtime',
+    checks: [runtimesCheck()],
+};
+//# sourceMappingURL=index.js.map

package/dist/checks/runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,+FAA+F;AAC/F,MAAM,CAAC,MAAM,WAAW,GAAS;IAC/B,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC;CAC1B,CAAC"}

package/dist/checks/runtime/runtimes.js

@@ -0,0 +1,30 @@
+export const RUNTIMES = {
+    php: { product: 'php', label: 'PHP', security: 'php.net' },
+    node: { product: 'nodejs', label: 'Node.js', security: 'nodejs' },
+    python: { product: 'python', label: 'Python', security: 'phase' },
+    rust: { product: 'rust', label: 'Rust', security: 'none' },
+    go: { product: 'go', label: 'Go', security: 'none' },
+    ruby: { product: 'ruby', label: 'Ruby', security: 'none' },
+    bun: { product: 'bun', label: 'Bun', security: 'none' },
+    deno: { product: 'deno', label: 'Deno', security: 'none' },
+    lua: { product: 'lua', label: 'Lua', security: 'none' },
+};
+const NAMES = new Map([
+    ['php', 'php'],
+    ['node', 'node'],
+    ['nodejs', 'node'],
+    ['python', 'python'],
+    ['cpython', 'python'],
+    ['rust', 'rust'],
+    ['go', 'go'],
+    ['golang', 'go'],
+    ['ruby', 'ruby'],
+    ['bun', 'bun'],
+    ['deno', 'deno'],
+    ['lua', 'lua'],
+]);
+/** A runtime by its name or a common alias (`nodejs`, `golang`), or `undefined`. */
+export function runtimeNamed(name) {
+    return NAMES.get(name.toLowerCase());
+}
+//# sourceMappingURL=runtimes.js.map

package/dist/checks/runtime/runtimes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimes.js","sourceRoot":"","sources":["../../../src/checks/runtime/runtimes.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,QAAQ,GAA2C;IAC9D,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC1D,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACjE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC1D,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpD,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC1D,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;IACvD,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC1D,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;CACxD,CAAC;AAEF,MAAM,KAAK,GAAiC,IAAI,GAAG,CAAkB;IACnE,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,IAAI,EAAE,IAAI,CAAC;IACZ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAChB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,KAAK,EAAE,KAAK,CAAC;CACf,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/checks/runtime/tools-lock.js

@@ -0,0 +1,40 @@
+import { parse as parseYaml } from 'yaml';
+import { z } from 'zod';
+import { pinned } from './declaration.js';
+import { runtimeNamed } from './runtimes.js';
+import { EngineError } from '../../core/check.js';
+import { setsKey } from '../../core/literal.js';
+/** Talos's own lockfile of outside tools, at the repository root. */
+export const TOOLS_LOCK = 'tools.lock';
+/** `runtimes` maps each interpreter Talos installs tools into to its version. */
+const lockSchema = z.object({ runtimes: z.record(z.string(), z.string().min(1)) });
+/** The line of `name`'s key after the `runtimes` key, so a tool of the same name can't match. */
+function entryLine(text, name) {
+    const lines = text.split(/\r?\n/);
+    const section = lines.findIndex((line) => setsKey(line, 'runtimes', ':'));
+    const index = lines.findIndex((line, at) => at > section && setsKey(line, name, ':'));
+    return index < 0 ? 1 : index + 1;
+}
+function readLock(text) {
+    try {
+        return lockSchema.safeParse(parseYaml(text)).data?.runtimes ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * The runtimes `tools.lock` pins under `runtimes`. A file of another shape declares nothing; a
+ * runtime Talos doesn't know is an engine error, since only Talos writes this file.
+ */
+export function toolsLockDeclarations(file, text) {
+    return Object.entries(readLock(text)).map(([name, written]) => {
+        const runtime = runtimeNamed(name);
+        if (runtime === undefined) {
+            throw new EngineError(`${file} pins the runtime "${name}", which Talos doesn't know`);
+        }
+        const version = written.replace(/^v(?=\d)/, '');
+        return pinned(runtime, { file, line: entryLine(text, name) }, written, version);
+    });
+}
+//# sourceMappingURL=tools-lock.js.map

package/dist/checks/runtime/tools-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-lock.js","sourceRoot":"","sources":["../../../src/checks/runtime/tools-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoB,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,qEAAqE;AACrE,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AAEvC,iFAAiF;AACjF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEnF,iGAAiG;AACjG,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY;IAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,sBAAsB,IAAI,6BAA6B,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/runtime/version-files.js

@@ -0,0 +1,95 @@
+import { parse as parseToml } from 'smol-toml';
+import { z } from 'zod';
+import { lineAt, meaningfulLines, pinned } from './declaration.js';
+import { isRelease, leadingRelease } from './versions.js';
+/**
+ * `.nvmrc` and `.node-version`: the first line that isn't a comment. `v22.12.0` and `22.12.0` pin
+ * one release; `22`, `lts/*`, `node` and ranges float.
+ */
+export function nodeVersionFile(file, text) {
+    const [first] = meaningfulLines(text);
+    if (first === undefined)
+        return [];
+    const bare = first.text.replace(/^v(?=\d)/, '');
+    const version = isRelease(bare) ? bare : undefined;
+    return [pinned('node', { file, line: first.line }, first.text, version)];
+}
+const PYTHON_LINE = /^(?:cpython[-@]|python)?(\d\S*)$/i;
+function pythonLine(file, entry) {
+    const place = { file, line: entry.line };
+    if (entry.text.toLowerCase() === 'system') {
+        return [pinned('python', place, entry.text, undefined)];
+    }
+    const match = PYTHON_LINE.exec(entry.text);
+    if (match?.[1] === undefined)
+        return [];
+    return [pinned('python', place, entry.text, match[1].replace(/t$/, ''))];
+}
+/**
+ * `.python-version`: one interpreter per line. CPython releases (`3.13.1`, `cpython@3.13`) and
+ * `system` count; other interpreters are left alone.
+ */
+export function pythonVersionFile(file, text) {
+    return meaningfulLines(text).flatMap((entry) => pythonLine(file, entry));
+}
+const toolchainSchema = z.object({ toolchain: z.object({ channel: z.string().optional() }) });
+function channelOf(text) {
+    const trimmed = text.trim();
+    if (/^[\w.-]+$/.test(trimmed))
+        return trimmed;
+    try {
+        return toolchainSchema.safeParse(parseToml(text)).data?.toolchain.channel;
+    }
+    catch {
+        return undefined;
+    }
+}
+function firstLine(text, pattern) {
+    const index = text.split(/\r?\n/).findIndex((line) => pattern.test(line));
+    return index < 0 ? undefined : index + 1;
+}
+/**
+ * `rust-toolchain.toml`, or the legacy `rust-toolchain`: its channel. `1.83.0` pins a release;
+ * `1.83`, `stable`, a dated nightly or no channel at all float.
+ */
+export function rustToolchainFile(file, text) {
+    const channel = channelOf(text);
+    const line = firstLine(text, /^\s*channel\s*=/) ?? firstLine(text, /\S/) ?? 1;
+    const version = channel !== undefined && isRelease(channel) ? channel : undefined;
+    return [pinned('rust', { file, line }, channel ?? 'no channel', version)];
+}
+/** `go.mod`'s `toolchain` line (`toolchain go1.23.4`); its `go` line is a language version. */
+export function goModFile(file, text) {
+    const lines = text.split(/\r?\n/);
+    const index = lines.findIndex((line) => /^\s*toolchain\s+\S/.test(line));
+    const name = lines[index]?.trim().split(/\s+/)[1];
+    if (name === undefined)
+        return [];
+    const release = /^go(\d\S*)$/.exec(name)?.[1];
+    return [pinned('go', { file, line: index + 1 }, name, release)];
+}
+const composerSchema = z.object({
+    config: z.object({ platform: z.object({ php: z.string() }) }),
+});
+/**
+ * `composer.json`'s `config.platform.php`: the PHP that Composer resolves dependencies against,
+ * often the lowest patch the project supports. It is a minimum, not the PHP the project ships.
+ */
+export function composerFile(file, text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    const php = composerSchema.safeParse(parsed).data?.config.platform.php;
+    const version = php === undefined ? undefined : leadingRelease(php.trim());
+    if (php === undefined || version === undefined)
+        return [];
+    const platform = text.indexOf('"platform"');
+    const key = text.slice(Math.max(platform, 0)).search(/"php"\s*:/);
+    const line = lineAt(text, key < 0 ? Math.max(platform, 0) : Math.max(platform, 0) + key);
+    return [{ runtime: 'php', file, line, written: php, version, exactness: 'minimum' }];
+}
+//# sourceMappingURL=version-files.js.map