@svp-labs/talos 0.0.0 → 0.1.1

package/dist/central/sweep-job.js

@@ -0,0 +1,62 @@
+import { z } from 'zod';
+import { isGoverned, openTalosIssues, soleRepository } from './repos.js';
+import { groupAlerts, isRuntimeFile, SECURITY_LABEL, securityIssue, sweepPaths, unfiled, } from './sweep.js';
+import { readFileAt } from '../github/contents.js';
+import { fileIssue } from '../jobs/talos-issues.js';
+const treeSchema = z.object({
+    truncated: z.boolean().default(false),
+    tree: z.array(z.object({ path: z.string(), type: z.string() })),
+});
+/** The default branch's files that can declare a runtime, through the trees API. */
+async function runtimePaths(gh, repo, branch) {
+    const raw = await gh.request('GET', `repos/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`);
+    const tree = treeSchema.parse(raw);
+    const paths = tree.tree
+        .filter((entry) => entry.type === 'blob' && isRuntimeFile(entry.path))
+        .map((entry) => entry.path);
+    return { ...sweepPaths(paths), truncated: tree.truncated };
+}
+const NONE = {
+    governed: 0,
+    files: 0,
+    alerts: 0,
+    filed: 0,
+    open: 0,
+    errors: 0,
+    skipped: 0,
+};
+/**
+ * One repository's sweep: read its runtime declarations, ask the runtime pack, and file one p0
+ * `security` issue per vulnerable runtime that no open Talos issue already covers.
+ */
+export async function runSweep(deps) {
+    const repository = await soleRepository(deps.gh);
+    if (!isGoverned(repository))
+        return NONE;
+    const repo = repository.fullName;
+    const branch = repository.defaultBranch;
+    const { read: paths, skipped, truncated } = await runtimePaths(deps.gh, repo, branch);
+    const texts = await Promise.all(paths.map((path) => readFileAt(deps.gh, repo, path, branch)));
+    const files = new Map();
+    for (const [index, path] of paths.entries()) {
+        const text = texts[index];
+        if (text !== undefined)
+            files.set(path, text);
+    }
+    const assessment = await deps.assess(files);
+    const groups = groupAlerts(assessment.alerts);
+    const open = await openTalosIssues(deps.gh, { repo, who: deps.who }, SECURITY_LABEL);
+    const fresh = unfiled(groups, open);
+    for (const group of fresh)
+        await fileIssue(deps.gh, repo, securityIssue(group));
+    return {
+        governed: 1,
+        files: files.size,
+        alerts: groups.length,
+        filed: fresh.length,
+        open: open.length,
+        errors: assessment.errors + (truncated ? 1 : 0),
+        skipped,
+    };
+}
+//# sourceMappingURL=sweep-job.js.map

package/dist/central/sweep-job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep-job.js","sourceRoot":"","sources":["../../src/central/sweep-job.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzE,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,UAAU,EACV,OAAO,GACR,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAsBpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;CAChE,CAAC,CAAC;AAEH,oFAAoF;AACpF,KAAK,UAAU,YAAY,CACzB,EAAU,EACV,IAAY,EACZ,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,KAAK,EACL,SAAS,IAAI,cAAc,kBAAkB,CAAC,MAAM,CAAC,cAAc,CACpE,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI;SACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,IAAI,GAAgB;IACxB,QAAQ,EAAE,CAAC;IACX,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;CACX,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAe;IAC5C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK;QAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/central/sweep.js

@@ -0,0 +1,182 @@
+import { isDeclaringFile } from '../checks/runtime/declarations.js';
+import { markerFields } from '../status/markers.js';
+import { LABEL } from '../ticket/labels.js';
+/**
+ * The hourly runtime sweep's decisions: which files to read, which findings are security
+ * releases, and the one issue per vulnerable runtime that reaches Thea as an event. Pure; the
+ * effects live in `sweep-job.ts`.
+ */
+const SECURITY_RULE = 'runtime/security';
+const SECURITY_MARKER = 'talos-security/1';
+export const SECURITY_LABEL = 'security';
+const P0_LABEL = 'priority/p0';
+const TOOLS_LOCK = 'tools.lock';
+const CONFIG = 'talos.yml';
+/** At most this many files are read from one repository per sweep. */
+const MAX_FILES = 60;
+/**
+ * Whether the sweep reads a path: every file the gate's runtime check reads, and the root
+ * `talos.yml`, whose `exclude` and exceptions that check honours.
+ */
+export function isRuntimeFile(path) {
+    return path === CONFIG || isDeclaringFile(path);
+}
+/** The rank a path is read in: the configuration, then what pins a runtime, then the floors. */
+function rank(path) {
+    if (path === CONFIG)
+        return 0;
+    return path.split('/').at(-1) === 'composer.json' ? 2 : 1;
+}
+/**
+ * The paths a sweep reads, at most {@link MAX_FILES}: `talos.yml` first, then the files that pin
+ * a runtime (Dockerfiles, version files, `tools.lock`), and `composer.json`, whose platform PHP
+ * is only a floor, last; `skipped` counts the ones left over.
+ */
+export function sweepPaths(paths) {
+    const ordered = paths
+        .map((path, index) => ({ path, index }))
+        .sort((a, b) => rank(a.path) - rank(b.path) || a.index - b.index)
+        .map((entry) => entry.path);
+    return { read: ordered.slice(0, MAX_FILES), skipped: Math.max(0, ordered.length - MAX_FILES) };
+}
+const WORD = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,39}$/;
+const VERSION = /^\d+(?:\.\d+)+$/;
+const VERSIONS_IN_TEXT = /\b\d+(?:\.\d+)+\b/g;
+function parts(version) {
+    return version.split('.').map(Number);
+}
+/** Numeric order of dotted versions; a shorter one sorts first on a tie. */
+export function compareVersions(a, b) {
+    const [x, y] = [parts(a), parts(b)];
+    for (let i = 0; i < Math.max(x.length, y.length); i += 1) {
+        const diff = (x[i] ?? -1) - (y[i] ?? -1);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+/** The newest version a message names beside `version`, with as many parts. */
+function fixedIn(message, version) {
+    const width = parts(version).length;
+    return [...message.matchAll(VERSIONS_IN_TEXT)]
+        .map((match) => match[0])
+        .filter((v) => v !== version && parts(v).length === width)
+        .sort(compareVersions)
+        .at(-1);
+}
+/**
+ * A `runtime/security` finding as an alert. Its key is `<runtime> <version>`, optionally followed
+ * by the fixed version; otherwise the fixed version is the newest one its message names.
+ */
+export function alertOf(finding) {
+    if (finding.rule !== SECURITY_RULE)
+        return undefined;
+    const [runtime = '', version = '', ...rest] = (finding.key ?? '').trim().split(/\s+/);
+    if (!WORD.test(runtime) || !VERSION.test(version))
+        return undefined;
+    const named = rest.find((word) => VERSION.test(word));
+    const fixed = named ?? fixedIn(finding.message, version) ?? 'unknown';
+    return { runtime: runtime.toLowerCase(), version, fixed, file: finding.location?.file ?? null };
+}
+/** Code-point order, the same on every machine whatever its locale. */
+function byCodePoint(a, b) {
+    if (a === b)
+        return 0;
+    return a < b ? -1 : 1;
+}
+function newer(a, b) {
+    if (a === 'unknown')
+        return b;
+    if (b === 'unknown')
+        return a;
+    return compareVersions(a, b) >= 0 ? a : b;
+}
+/** One group per runtime and declared version, naming every file that declares it. */
+export function groupAlerts(alerts) {
+    const groups = new Map();
+    for (const alert of alerts) {
+        const key = `${alert.runtime} ${alert.version}`;
+        const group = groups.get(key) ?? { fixed: alert.fixed, files: new Set(), alert };
+        group.fixed = newer(group.fixed, alert.fixed);
+        if (alert.file !== null)
+            group.files.add(alert.file);
+        groups.set(key, group);
+    }
+    return [...groups.values()]
+        .map(({ fixed, files, alert }) => ({
+        runtime: alert.runtime,
+        version: alert.version,
+        fixed,
+        files: [...files].sort(byCodePoint),
+    }))
+        .sort((a, b) => byCodePoint(`${a.runtime} ${a.version}`, `${b.runtime} ${b.version}`));
+}
+/** The issue's first line, which Thea's hub turns into an event: a p0 jumps her budget. */
+export function securityLine(group) {
+    const { runtime, version, fixed } = group;
+    return `${SECURITY_MARKER} kind=runtime runtime=${runtime} version=${version} fixed=${fixed} priority=p0`;
+}
+/** The fields of a body's `talos-security/1` first line, or `undefined` without one. */
+export function readSecurityLine(body) {
+    return markerFields(body, SECURITY_MARKER);
+}
+/** The groups no open security issue of Talos's covers yet: same runtime, same version. */
+export function unfiled(groups, open) {
+    const filed = new Set(open.flatMap((issue) => {
+        const fields = readSecurityLine(issue.body);
+        return fields?.kind === 'runtime' ? [`${fields.runtime ?? ''} ${fields.version ?? ''}`] : [];
+    }));
+    return groups.filter((group) => !filed.has(`${group.runtime} ${group.version}`));
+}
+function pathItem(path) {
+    return /^[^\s`]+$/.test(path) ? `- \`${path}\`` : '- (a file whose name needs quoting)';
+}
+/** The security issue for one runtime: ready to claim, its first line machine-readable. */
+export function securityIssue(group) {
+    const { runtime, version, fixed } = group;
+    const target = fixed === 'unknown' ? 'its cycle’s latest security release' : fixed;
+    const locked = group.files.includes(TOOLS_LOCK);
+    const body = [
+        securityLine(group),
+        '',
+        '### Goal',
+        '',
+        `Move ${runtime} ${version} to ${target}, wherever this repository declares it: a newer ` +
+            'patch of its cycle is a security release.',
+        '',
+        '### Acceptance criteria',
+        '',
+        `- [ ] Every file below declares ${runtime} ${target} or later in the same cycle`,
+        '- [ ] `talos check` reports no `runtime/security` finding',
+        '',
+        '### Out of scope',
+        '',
+        'Other runtimes, dependency updates and every other finding.',
+        '',
+        '### Affected areas',
+        '',
+        ...(group.files.length > 0 ? group.files.map(pathItem) : ['- the runtime declarations']),
+        '',
+        '### Repro',
+        '',
+        "Talos's hourly runtime sweep compared these declarations with the vendor's release feed.",
+        '',
+        '### Expected / Actual',
+        '',
+        `Expected: ${runtime} ${target}. Actual: ${runtime} ${version}.`,
+        ...(locked
+            ? [
+                '',
+                '`tools.lock` pins this runtime for every repository Talos governs: the fix ships in a ' +
+                    'Talos release, which the owner promotes through the urgent path.',
+            ]
+            : []),
+        '',
+    ].join('\n');
+    return {
+        title: `Security release: ${runtime} ${version} needs ${fixed === 'unknown' ? 'a patch' : fixed}`,
+        body,
+        labels: [LABEL.bug, SECURITY_LABEL, P0_LABEL, LABEL.ready, LABEL.eligible],
+    };
+}
+//# sourceMappingURL=sweep.js.map

package/dist/central/sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep.js","sourceRoot":"","sources":["../../src/central/sweep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C;;;;GAIG;AAEH,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B,sEAAsE;AACtE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,KAAK,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,gGAAgG;AAChG,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAwB;IACjD,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAChE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;AACjG,CAAC;AAUD,MAAM,IAAI,GAAG,oCAAoC,CAAC;AAClD,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAClC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CAAC,OAAe,EAAE,OAAe;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;SACzD,IAAI,CAAC,eAAe,CAAC;SACrB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAgB;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC;IACtE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AAClG,CAAC;AASD,uEAAuE;AACvE,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,MAA+B;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsE,CAAC;IAC7F,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;QACjF,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;SACxB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;KACpC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC1C,OAAO,GAAG,eAAe,yBAAyB,OAAO,YAAY,OAAO,UAAU,KAAK,cAAc,CAAC;AAC5G,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,YAAY,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC7C,CAAC;AAID,2FAA2F;AAC3F,MAAM,UAAU,OAAO,CACrB,MAA6B,EAC7B,IAAkC;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC,CAAC,CACH,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,qCAAqC,CAAC;AAC1F,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG;QACX,YAAY,CAAC,KAAK,CAAC;QACnB,EAAE;QACF,UAAU;QACV,EAAE;QACF,QAAQ,OAAO,IAAI,OAAO,OAAO,MAAM,kDAAkD;YACvF,2CAA2C;QAC7C,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,mCAAmC,OAAO,IAAI,MAAM,6BAA6B;QACjF,2DAA2D;QAC3D,EAAE;QACF,kBAAkB;QAClB,EAAE;QACF,6DAA6D;QAC7D,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;QACxF,EAAE;QACF,WAAW;QACX,EAAE;QACF,0FAA0F;QAC1F,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,aAAa,OAAO,IAAI,MAAM,aAAa,OAAO,IAAI,OAAO,GAAG;QAChE,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,EAAE;gBACF,wFAAwF;oBACtF,kEAAkE;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACL,KAAK,EAAE,qBAAqB,OAAO,IAAI,OAAO,UAAU,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE;QACjG,IAAI;QACJ,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/checks/common/code-files.js

@@ -0,0 +1,59 @@
+import picomatch from 'picomatch';
+/**
+ * The programming languages jscpd compares, as jscpd names them and by the extensions it reads
+ * for each: the languages Talos governs, scripts, and any other language a repository carries.
+ * Markup, styles, docs and data are left out: repeating them is layout, not logic.
+ */
+const LANGUAGES = [
+    ['typescript', ['ts', 'mts', 'cts']],
+    ['tsx', ['tsx']],
+    ['javascript', ['js', 'mjs', 'cjs']],
+    ['jsx', ['jsx']],
+    ['vue', ['vue']],
+    ['svelte', ['svelte']],
+    ['astro', ['astro']],
+    ['python', ['py', 'pyi']],
+    ['php', ['php']],
+    ['lua', ['lua']],
+    ['rust', ['rs']],
+    ['bash', ['sh', 'bash']],
+    ['powershell', ['ps1', 'psm1']],
+    ['go', ['go']],
+    ['java', ['java']],
+    ['kotlin', ['kt', 'kts']],
+    ['scala', ['scala']],
+    ['csharp', ['cs']],
+    ['c', ['c']],
+    ['c-header', ['h']],
+    ['cpp', ['cc', 'cpp', 'cxx']],
+    ['cpp-header', ['hpp', 'hh']],
+    ['ruby', ['rb']],
+    ['swift', ['swift']],
+    ['dart', ['dart']],
+];
+/** jscpd's names for the languages it compares. */
+export const JSCPD_FORMATS = LANGUAGES.map(([format]) => format);
+/** Every file of a language jscpd compares. */
+const CODE_GLOBS = [
+    `**/*.{${LANGUAGES.flatMap(([, extensions]) => extensions).join(',')}}`,
+];
+/** Tests and what only tests use, by each language's conventions; repeating them is allowed. */
+const TEST_GLOBS = [
+    '**/{test,tests,spec,specs,e2e,testing,__tests__,__mocks__,fixtures}/**',
+    '**/*.{test,spec}.*',
+    '**/test_*.py',
+    '**/*_test.{py,go,lua}',
+    '**/conftest.py',
+    '**/*Test.php',
+    '**/*_spec.lua',
+];
+/** Blade views: markup in PHP files, whose repetition is layout. */
+const TEMPLATE_GLOBS = ['**/*.blade.php'];
+/** What the duplication check never compares, beside `talos.yml`'s `exclude`. */
+export const NOT_COMPARED = [...TEST_GLOBS, ...TEMPLATE_GLOBS];
+/** The tracked code the duplication check compares: every language's, minus tests. */
+export function comparedFiles(facts) {
+    const skipped = picomatch([...NOT_COMPARED], { dot: true });
+    return facts.matching(...CODE_GLOBS).filter((file) => !skipped(file));
+}
+//# sourceMappingURL=code-files.js.map

package/dist/checks/common/code-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-files.js","sourceRoot":"","sources":["../../../src/checks/common/code-files.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAGlC;;;;GAIG;AACH,MAAM,SAAS,GAA0E;IACvF,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IACd,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;CACnB,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAsB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AAEpF,+CAA+C;AAC/C,MAAM,UAAU,GAAsB;IACpC,SAAS,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;CACxE,CAAC;AAEF,gGAAgG;AAChG,MAAM,UAAU,GAAsB;IACpC,wEAAwE;IACxE,oBAAoB;IACpB,cAAc;IACd,uBAAuB;IACvB,gBAAgB;IAChB,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,oEAAoE;AACpE,MAAM,cAAc,GAAsB,CAAC,gBAAgB,CAAC,CAAC;AAE7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAsB,CAAC,GAAG,UAAU,EAAE,GAAG,cAAc,CAAC,CAAC;AAElF,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/checks/common/custom.js

@@ -0,0 +1,123 @@
+import { access } from 'node:fs/promises';
+import { isAbsolute, posix, relative, win32 } from 'node:path';
+import { z } from 'zod';
+import { APPLIES, EngineError, skip, } from '../../core/check.js';
+/** One line of a custom check's output (`talos.yml`'s `checks.<id>`): one finding. */
+const reported = z.object({
+    rule: z.string().regex(/^\w[\w.:/-]*$/, 'must be a rule id: letters, digits, _ . : / -'),
+    file: z.string().min(1),
+    line: z.number().int().positive(),
+    message: z.string().trim().min(1),
+});
+const MAX_QUOTED = 200;
+function quoted(text) {
+    return text.length <= MAX_QUOTED ? text : `${text.slice(0, MAX_QUOTED - 1)}…`;
+}
+/** A reported path made repository-relative, or undefined when it lies outside the repository. */
+export function insideRepo(root, file) {
+    const local = isAbsolute(file) ? relative(root, file) : file;
+    const normal = posix.normalize(local.replaceAll('\\', '/')).replace(/^\.\//, '');
+    const outside = normal === '..' ||
+        normal.startsWith('../') ||
+        posix.isAbsolute(normal) ||
+        win32.isAbsolute(normal);
+    return outside || normal === '.' ? undefined : normal;
+}
+function parseLine(id, root, text, number) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new EngineError(`custom check ${id}: output line ${number} is not JSON: ${quoted(text)}`);
+    }
+    const parsed = reported.safeParse(raw);
+    if (!parsed.success) {
+        const problem = z.prettifyError(parsed.error);
+        const expected = '{rule, file, line, message}';
+        throw new EngineError(`custom check ${id}: output line ${number} is not ${expected}: ${problem}`);
+    }
+    const file = insideRepo(root, parsed.data.file);
+    if (file === undefined) {
+        throw new EngineError(`custom check ${id}: ${quoted(parsed.data.file)} is not a file in the repository`);
+    }
+    return {
+        rule: `custom/${id}/${parsed.data.rule}`,
+        message: parsed.data.message,
+        location: { file, line: parsed.data.line },
+    };
+}
+/**
+ * A custom check's findings: one JSON object `{rule, file, line, message}` per non-blank line
+ * of its output. Anything else is an engine error naming the check, so a broken script never
+ * passes for a clean one.
+ */
+export function customFindings(id, root, stdout) {
+    return stdout
+        .split('\n')
+        .map((text, index) => ({ text: text.trim(), number: index + 1 }))
+        .filter(({ text }) => text !== '')
+        .map(({ text, number }) => parseLine(id, root, text, number));
+}
+async function exists(path) {
+    return access(path).then(() => true, () => false);
+}
+/**
+ * The bash that runs a custom check: Git Bash on Windows, found where Git for Windows installs
+ * it, since the `bash.exe` Windows itself ships starts WSL instead.
+ */
+export async function bashFor(os, env, present = exists) {
+    if (os !== 'windows')
+        return 'bash';
+    const programs = env.ProgramFiles ?? String.raw `C:\Program Files`;
+    const gitBash = win32.join(programs, 'Git', 'bin', 'bash.exe');
+    return (await present(gitBash)) ? gitBash : 'bash.exe';
+}
+function tail(result) {
+    return `${result.stderr}\n${result.stdout}`.trim().split('\n').slice(-15).join('\n');
+}
+async function runOne(ctx, id, command) {
+    const bash = await bashFor(ctx.os, process.env);
+    let result;
+    try {
+        result = await ctx.exec(bash, ['-c', command], { cwd: ctx.root });
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new EngineError(`custom check ${id} could not run: ${reason}`);
+    }
+    const findings = customFindings(id, ctx.root, result.stdout);
+    if (result.code !== 0 && findings.length === 0) {
+        throw new EngineError(`custom check ${id} exited ${result.code} with no findings:\n${tail(result)}`);
+    }
+    return findings;
+}
+function declaredFor(ctx, tier) {
+    return Object.entries(ctx.config.checks)
+        .filter(([, check]) => check.scope === tier)
+        .map(([id, check]) => [id, check.run]);
+}
+async function runDeclared(ctx, tier) {
+    const findings = [];
+    for (const [id, command] of declaredFor(ctx, tier)) {
+        findings.push(...(await runOne(ctx, id, command)));
+    }
+    return findings;
+}
+function customCheck(tier) {
+    return {
+        id: `common/custom-${tier}`,
+        tier,
+        scope: 'repo',
+        title: `the project's own ${tier}-tier checks from talos.yml`,
+        applies: (ctx) => declaredFor(ctx, tier).length > 0
+            ? APPLIES
+            : skip(`talos.yml declares no custom check with scope ${tier}`),
+        run: (ctx) => runDeclared(ctx, tier),
+    };
+}
+/** `talos.yml`'s `checks` with `scope: commit`, run on every commit, from the repository root. */
+export const customCommitCheck = customCheck('commit');
+/** `talos.yml`'s `checks` with `scope: head`, run at a PR's head and its base, from the root. */
+export const customHeadCheck = customCheck('head');
+//# sourceMappingURL=custom.js.map

package/dist/checks/common/custom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../src/checks/common/custom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EAGP,WAAW,EAEX,IAAI,GAEL,MAAM,qBAAqB,CAAC;AAI7B,sFAAsF;AACtF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,+CAA+C,CAAC;IACxF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC;AAChF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GACX,MAAM,KAAK,IAAI;QACf,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QACxB,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QACxB,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,OAAO,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,MAAc;IACvE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,iBAAiB,MAAM,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;QAC/C,MAAM,IAAI,WAAW,CACnB,gBAAgB,EAAE,iBAAiB,MAAM,WAAW,QAAQ,KAAK,OAAO,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,WAAW,CACnB,gBAAgB,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QACxC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;QAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;KAC3C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,IAAY,EAAE,MAAc;IACrE,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;SAChE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CACtB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAM,EACN,GAAiD,EACjD,UAA8C,MAAM;IAEpD,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,GAAG,CAAA,kBAAkB,CAAC;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AACzD,CAAC;AAED,SAAS,IAAI,CAAC,MAAkB;IAC9B,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAiB,EAAE,EAAU,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CACnB,gBAAgB,EAAE,WAAW,MAAM,CAAC,IAAI,uBAAuB,IAAI,CAAC,MAAM,CAAC,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAClB,GAAgD,EAChD,IAAU;IAEV,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAiB,EAAE,IAAU;IACtD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAU;IAC7B,OAAO;QACL,EAAE,EAAE,iBAAiB,IAAI,EAAE;QAC3B,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,qBAAqB,IAAI,6BAA6B;QAC7D,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,iDAAiD,IAAI,EAAE,CAAC;QACnE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;AAEvD,iGAAiG;AACjG,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC"}

package/dist/checks/common/duplication.js

@@ -0,0 +1,96 @@
+import { readFile, realpath, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { z } from 'zod';
+import { comparedFiles } from './code-files.js';
+import { gateSettings } from './jscpd-config.js';
+import { cloneFindings } from './jscpd-report.js';
+import { ownTexts } from './texts.js';
+import { APPLIES, EngineError, skip } from '../../core/check.js';
+const resolveFromTalos = createRequire(import.meta.url);
+const manifest = z.object({
+    bin: z.union([z.string(), z.object({ jscpd: z.string() })]),
+});
+/** jscpd ships with Talos as a dependency: its launcher script, run with Talos's own Node. */
+async function jscpdScript() {
+    let path;
+    try {
+        path = resolveFromTalos.resolve('jscpd/package.json');
+    }
+    catch {
+        throw new EngineError("jscpd is missing from Talos's installation");
+    }
+    const text = await readFile(path, 'utf8');
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        raw = undefined;
+    }
+    const parsed = manifest.safeParse(raw);
+    if (!parsed.success)
+        throw new EngineError("jscpd's package.json names no program");
+    const bin = typeof parsed.data.bin === 'string' ? parsed.data.bin : parsed.data.bin.jscpd;
+    return join(dirname(path), bin);
+}
+function tail(result) {
+    return `${result.stderr}\n${result.stdout}`.trim().split('\n').slice(-15).join('\n');
+}
+/**
+ * Runs jscpd over the files, absolute, listed in its config rather than on its command line,
+ * which a large repository would overflow. jscpd reads an empty list as the working directory,
+ * so the caller never passes one.
+ */
+async function runJscpd(ctx, root, files) {
+    const config = join(ctx.scratch, 'jscpd.json');
+    await writeFile(config, gateSettings(files.map((file) => join(root, file))));
+    const args = [
+        await jscpdScript(),
+        '--config',
+        config,
+        '--reporters',
+        'json',
+        '--output',
+        ctx.scratch,
+        '--absolute',
+        '--silent',
+        '--no-gitignore',
+        '--no-colors',
+        '--no-tips',
+    ];
+    try {
+        return await ctx.exec(process.execPath, args, {
+            cwd: root,
+            env: { NO_COLOR: '1', JSCPD_NO_TIPS: '1' },
+        });
+    }
+    catch (error) {
+        throw new EngineError(`jscpd could not run: ${error instanceof Error ? error.message : ''}`);
+    }
+}
+/** jscpd over every language's code at once, tests and `exclude` left out. */
+async function duplication(ctx) {
+    const files = (await ownTexts(ctx.root, comparedFiles(ctx.facts))).map((text) => text.file);
+    if (files.length < 1)
+        return [];
+    // jscpd reports paths with links resolved, so the checkout's own path is resolved too.
+    const root = await realpath(ctx.root);
+    const result = await runJscpd(ctx, root, files);
+    if (result.code !== 0) {
+        throw new EngineError(`jscpd exited ${result.code}:\n${tail(result)}`);
+    }
+    const report = await readFile(join(ctx.scratch, 'jscpd-report.json'), 'utf8').catch(() => undefined);
+    if (report === undefined)
+        throw new EngineError(`jscpd wrote no report:\n${tail(result)}`);
+    return cloneFindings(report, root);
+}
+export const duplicationCheck = {
+    id: 'common/duplication',
+    tier: 'head',
+    scope: 'repo',
+    title: 'jscpd: no repeated code of 50 tokens or 5 lines',
+    applies: (ctx) => comparedFiles(ctx.facts).length > 0 ? APPLIES : skip('the repository has no code to compare'),
+    run: duplication,
+};
+//# sourceMappingURL=duplication.js.map

package/dist/checks/common/duplication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duplication.js","sourceRoot":"","sources":["../../../src/checks/common/duplication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,OAAO,EAAiC,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAIhG,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAExD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;CAC5D,CAAC,CAAC;AAEH,8FAA8F;AAC9F,KAAK,UAAU,WAAW;IACxB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,4CAA4C,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;IAC1F,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,MAAkB;IAC9B,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAiB,EACjB,IAAY,EACZ,KAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG;QACX,MAAM,WAAW,EAAE;QACnB,UAAU;QACV,MAAM;QACN,aAAa;QACb,MAAM;QACN,UAAU;QACV,GAAG,CAAC,OAAO;QACX,YAAY;QACZ,UAAU;QACV,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;YAC5C,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,WAAW,CAAC,GAAiB;IAC1C,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,uFAAuF;IACvF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,gBAAgB,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CACjF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,2BAA2B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAU;IACrC,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,iDAAiD;IACxD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;IAC/F,GAAG,EAAE,WAAW;CACjB,CAAC"}

package/dist/checks/common/index.js

@@ -0,0 +1,14 @@
+import { customCommitCheck, customHeadCheck } from './custom.js';
+import { duplicationCheck } from './duplication.js';
+import { jscpdBase } from './jscpd-config.js';
+import { suppressionsCheck } from './suppressions.js';
+/**
+ * The checks every repository gets whatever its languages: no suppressions per commit, the
+ * project's own checks from `talos.yml`, and no repeated code across every language at the head.
+ */
+export const commonPack = {
+    name: 'common',
+    checks: [suppressionsCheck, customCommitCheck, duplicationCheck, customHeadCheck],
+    generated: [jscpdBase],
+};
+//# sourceMappingURL=index.js.map

package/dist/checks/common/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAS;IAC9B,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,CAAC;IACjF,SAAS,EAAE,CAAC,SAAS,CAAC;CACvB,CAAC"}

package/dist/checks/common/jscpd-config.js

@@ -0,0 +1,50 @@
+import { comparedFiles, JSCPD_FORMATS, NOT_COMPARED } from './code-files.js';
+import { generatedJsonNote } from '../../configs/header.js';
+import { renderFlatJson } from '../../configs/json.js';
+const JSCPD_CONFIG = '.jscpd.json';
+/** The smallest repetition that counts: 50 tokens spanning at least 5 lines. */
+const MIN_TOKENS = 50;
+const MIN_LINES = 5;
+function trimSlashes(entry) {
+    let end = entry.length;
+    while (end > 0 && entry[end - 1] === '/')
+        end -= 1;
+    return entry.slice(0, end);
+}
+/** `talos.yml`'s `exclude` entries as globs: each names a file, a directory or a glob. */
+export function excludeGlobs(exclude) {
+    return exclude.flatMap((entry) => {
+        const trimmed = trimSlashes(entry);
+        return [trimmed, `${trimmed}/**`];
+    });
+}
+/**
+ * The base for editors and a local `jscpd` run, with the gate's thresholds and what it leaves
+ * out. jscpd reads one config file and extends none, and the only thing a project could want to
+ * change is what is compared, which `talos.yml`'s `exclude` already says; so there is no
+ * extension file.
+ */
+export function renderJscpdBase(version, exclude) {
+    return renderFlatJson({
+        '//': generatedJsonNote(version),
+        minTokens: MIN_TOKENS,
+        minLines: MIN_LINES,
+        threshold: 0,
+        gitignore: true,
+        absolute: false,
+        reporters: ['console'],
+        format: JSCPD_FORMATS,
+        ignore: ['**/node_modules/**', ...NOT_COMPARED, ...excludeGlobs(exclude)],
+    });
+}
+/** What the gate passes jscpd: the thresholds and every file to compare, by absolute path. */
+export function gateSettings(paths) {
+    return JSON.stringify({ minTokens: MIN_TOKENS, minLines: MIN_LINES, path: paths });
+}
+export const jscpdBase = {
+    path: JSCPD_CONFIG,
+    scope: 'repo',
+    applies: (ctx) => comparedFiles(ctx.facts).length > 0,
+    render: (ctx) => renderJscpdBase(ctx.version, ctx.config.exclude),
+};
+//# sourceMappingURL=jscpd-config.js.map

package/dist/checks/common/jscpd-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jscpd-config.js","sourceRoot":"","sources":["../../../src/checks/common/jscpd-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,gFAAgF;AAChF,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,OAA0B;IACrD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAA0B;IACzE,OAAO,cAAc,CAAC;QACpB,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC;QAChC,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC,SAAS,CAAC;QACtB,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,CAAC,oBAAoB,EAAE,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;KAC1E,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAc;IAClC,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;IACrD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;CAClE,CAAC"}