@svp-labs/talos 0.0.0 → 0.1.0

package/dist/adopt/rust.js

@@ -0,0 +1,250 @@
+import { posix } from 'node:path';
+import picomatch from 'picomatch';
+import { z } from 'zod';
+import { bodyEnd, eolOf, insertLines, joinToml, keyLine, parsedToml, replaceLine, sameToml, splitToml, } from './toml-text.js';
+import { BASE_LINTS, isLevel, lintsBlock, weakerThan, } from '../langs/rust/lints.js';
+import { RUST_CHANNEL, toolchainFile } from '../langs/rust/toolchain.js';
+/**
+ * A Rust component as Talos wants it: the lint levels the gate holds it to written into its
+ * manifests, so the editor shows what the gate reports, and its toolchain pinned to an exact
+ * release with the components the checks use.
+ */
+const COMPONENTS = ['clippy', 'rustfmt', 'llvm-tools'];
+const isTable = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+function tableIn(parsed, path) {
+    let at = parsed;
+    for (const key of path)
+        at = isTable(at) ? at[key] : undefined;
+    return isTable(at) ? at : undefined;
+}
+function levelOf(value) {
+    if (isLevel(value))
+        return value;
+    return isTable(value) && isLevel(value.level) ? value.level : undefined;
+}
+function entryValue(lint) {
+    return lint.priority === undefined ? lint.level : { level: lint.level, priority: lint.priority };
+}
+/** Each base lint's line as the lint table Talos writes has it, by the lint's name. */
+const LINES = new Map(lintsBlock('lints')
+    .split('\n')
+    .filter((line) => line.includes(' = '))
+    .map((line) => [line.slice(0, line.indexOf(' = ')), line]));
+function entryLine(lint) {
+    return LINES.get(lint.name) ?? `${lint.name} = ${JSON.stringify(lint.level)}`;
+}
+function appended(sections, lines) {
+    const last = sections.at(-1)?.lines.at(-1);
+    const all = [...(last === undefined || last.trim() === '' ? [] : ['']), ...lines];
+    return [...sections, { name: undefined, array: false, lines: all, top: all.map(() => true) }];
+}
+function needed(current) {
+    return ['rust', 'clippy'].flatMap((tool) => {
+        const have = tableIn(current, [tool]);
+        const lints = BASE_LINTS.filter((lint) => lint.tool === tool).filter((lint) => {
+            const level = levelOf(have?.[lint.name]);
+            return level === undefined || weakerThan(level, lint.level);
+        });
+        return lints.length === 0 ? [] : [{ tool, lints }];
+    });
+}
+/** The sections with one tool's missing or weaker lints written into its table. */
+function withTool(sections, name, needs, exists) {
+    const index = sections.findIndex((s) => s.name === name && !s.array);
+    const found = sections[index];
+    if (found === undefined) {
+        return exists ? undefined : appended(sections, [`[${name}]`, ...needs.lints.map(entryLine)]);
+    }
+    let section = found;
+    for (const lint of needs.lints) {
+        const at = keyLine(section, lint.name);
+        section =
+            at === -1
+                ? insertLines(section, bodyEnd(section), [entryLine(lint)])
+                : replaceLine(section, at, entryLine(lint));
+    }
+    return sections.map((s, i) => (i === index ? section : s));
+}
+function expected(parsed, path, all) {
+    const copy = structuredClone(parsed);
+    let at = copy;
+    for (const key of path) {
+        const value = at[key];
+        const inner = isTable(value) ? value : {};
+        at[key] = inner;
+        at = inner;
+    }
+    for (const needs of all) {
+        const value = at[needs.tool];
+        const tool = isTable(value) ? value : {};
+        for (const lint of needs.lints)
+            tool[lint.name] = entryValue(lint);
+        at[needs.tool] = tool;
+    }
+    return copy;
+}
+/**
+ * The manifest with Talos's lint levels in `table` (`lints`, or `workspace.lints` in a
+ * workspace's root): a missing lint is added, a weaker level raised, and anything else the
+ * project set, stricter levels included, stays.
+ */
+export function withLints(text, table) {
+    const parsed = parsedToml(text);
+    if (parsed === undefined)
+        return { manual: 'Cargo.toml is not valid TOML' };
+    const path = table.split('.');
+    const current = tableIn(parsed, path);
+    const all = needed(current);
+    if (all.length === 0)
+        return {};
+    let next;
+    if (current === undefined) {
+        next = joinToml(appended(splitToml(text), lintsBlock(table).trimEnd().split('\n')), eolOf(text));
+    }
+    else {
+        let sections = splitToml(text);
+        for (const needs of all) {
+            const exists = tableIn(current, [needs.tool]) !== undefined;
+            sections = sections && withTool(sections, `${table}.${needs.tool}`, needs, exists);
+        }
+        if (sections === undefined)
+            return { manual: `its [${table}] is laid out unusually` };
+        next = joinToml(sections, eolOf(text));
+    }
+    const reparsed = parsedToml(next);
+    return reparsed !== undefined && sameToml(reparsed, expected(parsed, path, all))
+        ? { text: next }
+        : { manual: `its [${table}] could not be edited safely` };
+}
+/** `[lints] workspace = true`, so a workspace member takes the workspace's levels. */
+function withWorkspaceLints(text) {
+    const parsed = parsedToml(text);
+    if (parsed === undefined)
+        return { manual: 'Cargo.toml is not valid TOML' };
+    const lints = tableIn(parsed, ['lints']);
+    if (lints?.workspace === true)
+        return {};
+    if (lints !== undefined)
+        return withLints(text, 'lints');
+    const next = joinToml(appended(splitToml(text), ['[lints]', 'workspace = true']), eolOf(text));
+    return { text: next };
+}
+const strings = (value) => z
+    .array(z.unknown())
+    .catch([])
+    .parse(value)
+    .filter((item) => typeof item === 'string');
+/** The manifests of a workspace's members, from its `members` and `exclude` globs. */
+function members(root, workspace, files) {
+    const included = picomatch(strings(workspace.members), { dot: true });
+    const excluded = picomatch(strings(workspace.exclude), { dot: true });
+    return files.filter((file) => {
+        if (posix.basename(file) !== 'Cargo.toml')
+            return false;
+        const dir = posix.relative(root, posix.dirname(file));
+        return dir !== '' && !dir.startsWith('..') && included(dir) && !excluded(dir);
+    });
+}
+function apply(draft, path, edit, root) {
+    if (edit.text !== undefined)
+        draft.write(path, edit.text, 'lints');
+    if (edit.manual !== undefined) {
+        draft.next(`in ${root}: write Talos's lint levels into ${path} by hand: ${edit.manual}`);
+    }
+}
+/** Every manifest of the component gets the lint levels, the workspace's way or its own. */
+export function rustLints(draft, component) {
+    const manifest = posix.join(component.root, 'Cargo.toml');
+    const text = draft.read(manifest);
+    if (text === undefined)
+        return;
+    const workspace = tableIn(parsedToml(text), ['workspace']);
+    if (workspace === undefined) {
+        apply(draft, manifest, withLints(text, 'lints'), component.root);
+        return;
+    }
+    apply(draft, manifest, withLints(text, 'workspace.lints'), component.root);
+    const rootText = draft.read(manifest) ?? text;
+    if (tableIn(parsedToml(rootText), ['package']) !== undefined) {
+        apply(draft, manifest, withWorkspaceLints(rootText), component.root);
+    }
+    for (const member of members(component.root, workspace, draft.files())) {
+        const memberText = draft.read(member);
+        if (memberText !== undefined) {
+            apply(draft, member, withWorkspaceLints(memberText), component.root);
+        }
+    }
+}
+function toolchainText(channel, components) {
+    return [
+        '[toolchain]',
+        `channel = ${JSON.stringify(channel)}`,
+        `components = [${components.map((c) => JSON.stringify(c)).join(', ')}]`,
+        'profile = "minimal"',
+        '',
+    ].join('\n');
+}
+const EXACT = /^\d+\.\d+\.\d+$/;
+/** The toolchain file with an exact channel and every component the checks use. */
+export function pinToolchain(text) {
+    const parsed = parsedToml(text);
+    const table = tableIn(parsed, ['toolchain']);
+    if (parsed === undefined || table === undefined) {
+        return { manual: 'its rust-toolchain.toml has no [toolchain] table' };
+    }
+    const channel = typeof table.channel === 'string' && EXACT.test(table.channel) ? table.channel : RUST_CHANNEL;
+    const have = strings(table.components);
+    const components = [...have, ...COMPONENTS.filter((c) => !have.includes(c))];
+    if (channel === table.channel && components.length === have.length)
+        return {};
+    const lines = {
+        channel: `channel = ${JSON.stringify(channel)}`,
+        components: `components = [${components.map((c) => JSON.stringify(c)).join(', ')}]`,
+    };
+    const sections = splitToml(text).map((section) => {
+        if (section.name !== 'toolchain')
+            return section;
+        let out = section;
+        for (const key of ['channel', 'components']) {
+            const at = keyLine(out, key);
+            const header = out.lines.findIndex((line, i) => out.top[i] && /^\s*\[/.test(line));
+            out =
+                at === -1 ? insertLines(out, header + 1, [lines[key]]) : replaceLine(out, at, lines[key]);
+        }
+        return out;
+    });
+    const next = joinToml(sections, eolOf(text));
+    const wanted = { ...parsed, toolchain: { ...table, channel, components } };
+    const reparsed = parsedToml(next);
+    return reparsed !== undefined && sameToml(reparsed, wanted)
+        ? { text: next }
+        : { manual: 'its rust-toolchain.toml could not be edited safely' };
+}
+/**
+ * The toolchain file rustup reads for the component: its own or the nearest above it, written
+ * at its root when there is none. The legacy one-line `rust-toolchain` becomes the TOML file.
+ */
+export function rustToolchain(draft, component) {
+    const found = toolchainFile(component.root, new Set(draft.files()));
+    const at = posix.join(component.root, 'rust-toolchain.toml');
+    if (found === undefined) {
+        draft.write(at, toolchainText(RUST_CHANNEL, COMPONENTS), 'toolchain');
+        return;
+    }
+    const text = draft.read(found) ?? '';
+    if (posix.basename(found) === 'rust-toolchain') {
+        const legacy = text.trim();
+        const toml = legacy.includes('[') ? (pinToolchain(text).text ?? text) : undefined;
+        const channel = EXACT.test(legacy) ? legacy : RUST_CHANNEL;
+        draft.remove(found, 'migrated');
+        draft.write(`${found}.toml`, toml ?? toolchainText(channel, COMPONENTS), 'toolchain');
+        return;
+    }
+    const edit = pinToolchain(text);
+    if (edit.text !== undefined)
+        draft.write(found, edit.text, 'toolchain');
+    if (edit.manual !== undefined) {
+        draft.next(`in ${component.root}: pin the toolchain by hand: ${edit.manual}`);
+    }
+}
+//# sourceMappingURL=rust.js.map

package/dist/adopt/rust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.js","sourceRoot":"","sources":["../../src/adopt/rust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,OAAO,EACP,KAAK,EACL,WAAW,EACX,QAAQ,EACR,OAAO,EACP,UAAU,EACV,WAAW,EACX,QAAQ,EACR,SAAS,GAEV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,UAAU,EAEV,OAAO,EAEP,UAAU,EACV,UAAU,GACX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEzE;;;;GAIG;AAEH,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAKvD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAkB,EAAE,CACjD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,SAAS,OAAO,CAAC,MAAe,EAAE,IAAuB;IACvD,IAAI,EAAE,GAAY,MAAM,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AACnG,CAAC;AAED,uFAAuF;AACvF,MAAM,KAAK,GAAgC,IAAI,GAAG,CAChD,UAAU,CAAC,OAAO,CAAC;KAChB,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;KACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAC7D,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgC,EAAE,KAAwB;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAID,SAAS,MAAM,CAAC,OAA0B;IACxC,OAAQ,CAAC,MAAM,EAAE,QAAQ,CAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,OAAO,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CACf,QAAgC,EAChC,IAAY,EACZ,KAAY,EACZ,MAAe;IAEf,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,EAAE,KAAK,CAAC,CAAC;gBACP,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,MAAa,EAAE,IAAuB,EAAE,GAAqB;IAC7E,MAAM,IAAI,GAAU,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,EAAE,GAAU,IAAI,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,KAAK,GAAU,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAChB,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAU,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACnE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAkC;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,GAAG,QAAQ,CACb,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAClE,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,GAA8B,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;YAC5D,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,yBAAyB,EAAE,CAAC;QACtF,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAChB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,KAAK,8BAA8B,EAAE,CAAC;AAC9D,CAAC;AAED,sFAAsF;AACtF,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,KAAc,EAAY,EAAE,CAC3C,CAAC;KACE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KAClB,KAAK,CAAC,EAAE,CAAC;KACT,KAAK,CAAC,KAAK,CAAC;KACZ,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAEhE,sFAAsF;AACtF,SAAS,OAAO,CAAC,IAAY,EAAE,SAAgB,EAAE,KAAwB;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,KAAY,EAAE,IAAY,EAAE,IAAU,EAAE,IAAY;IACjE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,oCAAoC,IAAI,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,KAAY,EAAE,SAAoB;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7D,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,UAA6B;IACnE,OAAO;QACL,aAAa;QACb,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACtC,iBAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACvE,qBAAqB;QACrB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAEhC,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;IAChG,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QAC/C,UAAU,EAAE,iBAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACpF,CAAC;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;QACjD,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAU,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnF,GAAG;gBACD,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QACzD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAChB,CAAC,CAAC,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,SAAoB;IAC9D,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QAC3D,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAChC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,EAAE,IAAI,IAAI,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/adopt/scaffold.js

@@ -0,0 +1,76 @@
+/**
+ * What Scaffold left in the repositories generated from it, which Talos replaces: its callers of
+ * the old shared workflows, its scripts, justfile, language folders, git hooks and project file.
+ * Only Scaffold's own files go; a project's own scripts beside them stay.
+ */
+const FILES = new Set([
+    'justfile',
+    'lefthook.yml',
+    'project.yml',
+    'scripts/audit.sh',
+    'scripts/commit-msg.sh',
+    'scripts/copy-config.sh',
+    'scripts/require.sh',
+    'scripts/sources.sh',
+    'scripts/ticket',
+    'scripts/with-sources.sh',
+    '.github/labels.yml',
+    '.github/scripts/apply-labels.sh',
+    '.github/scripts/apply-rulesets.sh',
+    '.github/rulesets/main.json',
+    '.github/rulesets/main-review.json',
+]);
+const FOLDERS = ['.lang/', '.github/scaffold/'];
+const OLD_KIT = /SVP-Labs\/Workflows|\.github\/scripts\/apply-|\.github\/scaffold\//;
+/** Whether the repository was generated from Scaffold. */
+export function fromScaffold(files, read) {
+    if (files.some((file) => /^\.lang\/[^/]+\/lang\.just$/.test(file)))
+        return true;
+    if (files.includes('.github/scaffold/managed'))
+        return true;
+    return files.includes('project.yml') && /^scaffold:/m.test(read('project.yml') ?? '');
+}
+function scaffoldsOwn(file, read) {
+    if (file === 'ENGINEERING.md') {
+        return (read(file) ?? '').startsWith('# Engineering Standards & Workflow');
+    }
+    if (file === '.claude/hooks/session-start.sh')
+        return OLD_KIT.test(read(file) ?? '');
+    if (file === '.claude/settings.json')
+        return onlyScaffoldsHook(read(file) ?? '');
+    return false;
+}
+function onlyScaffoldsHook(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed !== 'object' || parsed === null)
+            return false;
+        return Object.keys(parsed).join(',') === 'hooks' && text.includes('session-start.sh');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The tracked files Scaffold put there, to delete, when the repository came from Scaffold. The
+ * workflow callers are not among them: no App may write workflow files, so `talos govern`
+ * removes those with the owner's login.
+ */
+export function scaffoldLeftovers(files, read) {
+    if (!fromScaffold(files, read))
+        return [];
+    return files.filter((file) => FILES.has(file) ||
+        FOLDERS.some((folder) => file.startsWith(folder)) ||
+        scaffoldsOwn(file, read));
+}
+/** Whether a `CLAUDE.md` is Scaffold's, whose instructions (`just gates`, its ticket script) go. */
+export function isScaffoldClaude(text) {
+    return /`just gates`|scripts\/ticket|SVP-Labs\/Workflows/.test(text);
+}
+/** The workflow files that call the old kit: the shared workflows, or Scaffold's own scripts. */
+export function oldKitCallers(workflows) {
+    return workflows
+        .filter((workflow) => /\.ya?ml$/.test(workflow.path) && OLD_KIT.test(workflow.text))
+        .map((workflow) => workflow.path);
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/adopt/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/adopt/scaffold.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,cAAc;IACd,aAAa;IACb,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxB,oBAAoB;IACpB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,oBAAoB;IACpB,iCAAiC;IACjC,mCAAmC;IACnC,4BAA4B;IAC5B,mCAAmC;CACpC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAsB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;AAEnE,MAAM,OAAO,GAAG,oEAAoE,CAAC;AAErF,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,IAAY;IACjE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,oCAAoC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,KAAK,gCAAgC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,IAAI,IAAI,KAAK,uBAAuB;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB,EAAE,IAAY;IACtE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,IAAI,EAAE,EAAE,CACP,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,SAAoD;IAChF,OAAO,SAAS;SACb,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACnF,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/adopt/security.js

@@ -0,0 +1,153 @@
+import { posix } from 'node:path';
+import { z } from 'zod';
+import { joinToml, parsedToml, sameToml, spaced, splitToml, } from './toml-text.js';
+import { carriesGeneratedMarker } from '../configs/header.js';
+const OSV = 'osv-scanner.toml';
+const GITLEAKS = '.gitleaks.toml';
+const osvSchema = z.looseObject({
+    IgnoredVulns: z
+        .array(z.looseObject({
+        id: z.string(),
+        ignoreUntil: z.unknown().optional(),
+        reason: z.string().optional(),
+    }))
+        .default([]),
+    PackageOverrides: z
+        .array(z.looseObject({
+        name: z.string().optional(),
+        license: z.looseObject({ ignore: z.boolean().optional() }).optional(),
+        reason: z.string().optional(),
+    }))
+        .default([]),
+});
+function dateOf(value) {
+    if (value instanceof Date)
+        return /^\d{4}-\d{2}-\d{2}/.exec(value.toISOString())?.[0];
+    return typeof value === 'string' ? /^\d{4}-\d{2}-\d{2}/.exec(value)?.[0] : undefined;
+}
+const DEPRECATED_GNU = /^(A?GPL|LGPL|GFDL)-(\d\.\d)(\+?)$/;
+/** An SPDX id as deps.dev reports it: the deprecated GNU ids say `-only` or `-or-later`. */
+export function spdx(id) {
+    const gnu = DEPRECATED_GNU.exec(id);
+    if (gnu === null)
+        return id;
+    return `${gnu[1] ?? ''}-${gnu[2] ?? ''}-${gnu[3] === '+' ? 'or-later' : 'only'}`;
+}
+/** The licence a reason starts with (`LGPL-3.0, a lint plugin…`), and the rest of it. */
+export function licenceOf(reason) {
+    const cut = reason.search(/[,:;]/);
+    if (cut === -1)
+        return undefined;
+    const head = reason.slice(0, cut).trim();
+    if (!/^[A-Za-z][\w.+-]*$/.test(head) || !/\d/.test(head))
+        return undefined;
+    return { licence: spdx(head), rest: reason.slice(cut + 1).trim() };
+}
+function collectVulns(file, osv, into) {
+    let whole = true;
+    for (const vuln of osv.IgnoredVulns) {
+        const expires = dateOf(vuln.ignoreUntil);
+        const reason = vuln.reason?.trim() ?? '';
+        if (expires === undefined || reason === '') {
+            into.next.push(`${file} ignores ${vuln.id} without a reason or an expiry: give it both under ` +
+                "talos.yml's supply_chain.exceptions");
+            whole = false;
+        }
+        else {
+            into.exceptions[vuln.id] ??= { reason, expires };
+        }
+    }
+    return whole;
+}
+function collectOverrides(file, osv, into) {
+    let whole = true;
+    for (const override of osv.PackageOverrides) {
+        const name = override.name ?? 'a package';
+        const found = override.license?.ignore === true ? licenceOf(override.reason ?? '') : undefined;
+        if (found === undefined) {
+            into.next.push(`${file} overrides ${name}, which talos.yml can't say: add its licence under licences ` +
+                'with a reason, or drop it');
+            whole = false;
+            continue;
+        }
+        const why = found.rest === '' ? name : `${name}: ${found.rest}`;
+        into.licences[found.licence] = [...(into.licences[found.licence] ?? []), why];
+    }
+    return whole;
+}
+function osvMigration(files, read, into) {
+    const moved = [];
+    for (const file of files.filter((f) => posix.basename(f) === OSV)) {
+        const text = read(file);
+        if (text === undefined || carriesGeneratedMarker(text))
+            continue;
+        const parsed = osvSchema.safeParse(parsedToml(text));
+        if (!parsed.success) {
+            into.next.push(`${file} can't be read: move its exceptions into talos.yml by hand`);
+            continue;
+        }
+        const vulns = collectVulns(file, parsed.data, into);
+        const overrides = collectOverrides(file, parsed.data, into);
+        if (vulns && overrides)
+            moved.push(file);
+    }
+    return moved;
+}
+const gitleaksSchema = z.looseObject({ extend: z.looseObject({}).optional() });
+const rootOf = (sections) => sections.filter((s) => s.name === undefined);
+const tablesOf = (sections) => sections.filter((s) => s.name !== undefined);
+/** The `[extend]` table without its header and settings: only the comments above it stay. */
+function extendComments(section) {
+    const header = section.lines.findIndex((line, i) => section.top[i] && /^\s*\[/.test(line));
+    const lines = header <= 0 ? [] : [...section.lines.slice(0, header), ''];
+    return { name: undefined, array: false, lines, top: lines.map(() => true) };
+}
+function gitleaksSeed(text) {
+    const raw = parsedToml(text);
+    const parsed = gitleaksSchema.safeParse(raw);
+    if (raw === undefined || !parsed.success) {
+        return { note: `${GITLEAKS} can't be read: move its own rules by hand` };
+    }
+    const { extend: _ours, ...own } = raw;
+    if (Object.keys(own).length === 0)
+        return {};
+    const sections = splitToml(text);
+    const kept = sections.flatMap((s) => (s.name === 'extend' ? [extendComments(s)] : [s]));
+    const seed = (current) => {
+        const into = splitToml(current);
+        return joinToml(spaced([...rootOf(into), ...rootOf(kept), ...tablesOf(into), ...tablesOf(kept)]));
+    };
+    const result = parsedToml(seed('[extend]\nuseDefault = true\n'));
+    const { extend: _, ...moved } = result ?? {};
+    if (result === undefined || !sameToml(moved, own)) {
+        return { note: `${GITLEAKS}'s own rules could not be moved safely: move them by hand` };
+    }
+    const extra = Object.keys(parsed.data.extend ?? {}).filter((key) => key !== 'useDefault');
+    return {
+        seed,
+        ...(extra.length === 0
+            ? {}
+            : {
+                note: `${GITLEAKS}'s [extend] ${extra.join(', ')} did not move: the base keeps every default rule`,
+            }),
+    };
+}
+/** Everything a repository's own security settings hold that Talos keeps elsewhere. */
+export function securityMigration(files, read) {
+    const into = { exceptions: {}, licences: {}, next: [] };
+    const moved = osvMigration(files, read, into);
+    const gitleaksText = files.includes(GITLEAKS) ? read(GITLEAKS) : undefined;
+    const gitleaks = gitleaksText === undefined || carriesGeneratedMarker(gitleaksText)
+        ? {}
+        : gitleaksSeed(gitleaksText);
+    if (gitleaks.note !== undefined)
+        into.next.push(gitleaks.note);
+    const licences = Object.fromEntries(Object.entries(into.licences).map(([licence, why]) => [licence, why.join('; ')]));
+    return {
+        additions: { exceptions: into.exceptions, licences },
+        moved,
+        ...(gitleaks.seed === undefined ? {} : { gitleaks: gitleaks.seed }),
+        next: into.next,
+    };
+}
+//# sourceMappingURL=security.js.map

package/dist/adopt/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/adopt/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,MAAM,EACN,SAAS,GAEV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAwB9D,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC;IAC9B,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC;QACZ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,gBAAgB,EAAE,CAAC;SAChB,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAIH,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAE3D,4FAA4F;AAC5F,MAAM,UAAU,IAAI,CAAC,EAAU;IAC7B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACnF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAQD,SAAS,YAAY,CAAC,IAAY,EAAE,GAAQ,EAAE,IAAe;IAC3D,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CACZ,GAAG,IAAI,YAAY,IAAI,CAAC,EAAE,qDAAqD;gBAC7E,qCAAqC,CACxC,CAAC;YACF,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,GAAQ,EAAE,IAAe;IAC/D,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CACZ,GAAG,IAAI,cAAc,IAAI,8DAA8D;gBACrF,2BAA2B,CAC9B,CAAC;YACF,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB,EAAE,IAAY,EAAE,IAAe;IAC3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC;YAAE,SAAS;QACjE,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,KAAK,IAAI,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE/E,MAAM,MAAM,GAAG,CAAC,QAAgC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AAClG,MAAM,QAAQ,GAAG,CAAC,QAAgC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AAEpG,6FAA6F;AAC7F,SAAS,cAAc,CAAC,OAAoB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,4CAA4C,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAS,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,QAAQ,CACb,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CACjF,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,2DAA2D,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;IAC1F,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,IAAI,EAAE,GAAG,QAAQ,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;aACnG,CAAC;KACP,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,KAAwB,EAAE,IAAY;IACtE,MAAM,IAAI,GAAc,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,QAAQ,GACZ,YAAY,KAAK,SAAS,IAAI,sBAAsB,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACjF,CAAC;IACF,OAAO;QACL,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE;QACpD,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC"}