@uknows/setup 0.1.0 → 0.2.0

package/lib/locks.mjs

@@ -0,0 +1,353 @@
+/*
+ * The packages that 1 service installs, read from its lockfiles: name -> {version, via, file, line}. It reads,
+ * in this order: uv.lock, poetry.lock, pinned requirements files, packages.lock.json (every target framework),
+ * obj/project.assets.json, and package-lock.json v2 and v3. It reads text only and runs nothing.
+ *
+ * direct: the service or 1 of its first-party members lists the package. via: for the other packages, the direct
+ * dependencies they arrive through. requires: what the package needs, with the version limit when the lock has it.
+ */
+import { posix } from 'node:path'
+import { upFrom } from './workspace.mjs'
+import { pythonProjectName } from './members.mjs'
+import { pyName, tomlArray, tomlEntries, tomlInline, tomlTable } from './toml.mjs'
+
+/**
+ * @typedef {Object} Installed
+ * @property {string} name          As the lockfile writes it.
+ * @property {string|null} version
+ * @property {string} file          The lockfile.
+ * @property {number} [line]        1-based line of its entry.
+ * @property {boolean} direct
+ * @property {string[]} via         Keys of the direct dependencies it arrives through. Empty when it is direct.
+ * @property {{name: string, spec: string|null, line?: number}[]} requires
+ * @property {string|null} source   registry, editable, virtual, directory, path, git, url, project, link or file. null when unknown.
+ */
+/** @typedef {{packages: Map<string, Installed>, files: string[]}} InstalledSet  Keys are packageKey() names. */
+
+const MAX_LOCK = 16_000_000
+const MAX_VISITS = 50_000
+const join = (dir, file) => (dir === '.' ? file : `${dir}/${file}`)
+const dirOf = (path) => posix.dirname(path)
+const read = (view, path) => {
+  try { return (view.stat?.(path)?.size ?? 0) > MAX_LOCK ? null : view.read(path) } catch { return null }
+}
+const json = (text) => { try { const v = JSON.parse(text ?? ''); return v && typeof v === 'object' && !Array.isArray(v) ? v : null } catch { return null } }
+const entry = (name, version, file, line, source = null) => ({ name, version, file, line, direct: false, via: [], requires: [], source })
+
+/** The key of a package name: PEP 503 for Python, lower case for NuGet, exact for npm. */
+export const packageKey = (lang, name) => (lang === 'python' ? pyName(name) : lang === 'dotnet' ? String(name).toLowerCase() : String(name))
+
+/** An empty set, for services that have no lockfile. */
+export const noPackages = () => ({ packages: new Map(), files: [] })
+
+/**
+ * @param {import('./types.mjs').Service} service
+ * @param {import('./workspace.mjs').RepoView} view
+ * @param {import('./members.mjs').Member[]} [members]
+ * @returns {InstalledSet}
+ */
+export function installedPackages(service, view, members = []) {
+  const out = noPackages()
+  const merge = (set) => {
+    if (!set) return
+    out.files.push(set.file)
+    for (const [key, item] of set.packages) if (!out.packages.has(key)) out.packages.set(key, item)
+  }
+  const dirs = [service.dir, ...members.map((m) => m.dir)]
+  if (service.lang === 'python') {
+    const roots = [pythonProjectName(view, service.dir), ...members.map((m) => m.name && pyName(m.name))].filter(Boolean)
+    const uv = nearest(view, service.dir, 'uv.lock')
+    if (uv) merge(uvLock(uv, read(view, uv), roots))
+    const poetry = nearest(view, service.dir, 'poetry.lock')
+    if (poetry) merge(poetryLock(poetry, read(view, poetry), pythonDirectNames(view, dirs)))
+    for (const dir of dirs) {
+      for (const name of list(view, dir).filter((n) => /^requirements[\w.-]*\.txt$/.test(n))) merge(requirementPins(join(dir, name), read(view, join(dir, name))))
+    }
+  } else if (service.lang === 'dotnet') {
+    for (const csproj of [...service.manifests, ...members.flatMap((m) => m.manifests)].filter((m) => m.endsWith('.csproj'))) {
+      const lock = join(dirOf(csproj), 'packages.lock.json')
+      merge(nugetLock(lock, read(view, lock)))
+      const assets = join(dirOf(csproj), 'obj/project.assets.json')
+      merge(nugetAssets(assets, read(view, assets)))
+    }
+  } else if (service.lang === 'node') {
+    const lock = nearest(view, service.dir, 'package-lock.json') ?? nearest(view, service.dir, 'npm-shrinkwrap.json')
+    if (lock) {
+      const base = dirOf(lock)
+      const rel = (dir) => (dir === base ? '' : base === '.' ? (dir === '.' ? '' : dir) : posix.relative(base, dir))
+      merge(npmLock(lock, read(view, lock), [rel(service.dir), ...members.map((m) => rel(m.dir))]))
+    }
+  }
+  return out
+}
+
+/** The nearest file with this name, from dir up to the top of the git repo. */
+export function nearest(view, dir, name) {
+  for (const d of upFrom(dir, view.top ?? '.')) if (read(view, join(d, name)) !== null) return join(d, name)
+  return null
+}
+
+function list(view, dir) {
+  try { return view.list ? view.list(dir) : [] } catch { return [] }
+}
+
+/**
+ * Set direct and via from a graph. graph: key -> dependency keys. firstParty: the service and its members. Their
+ * dependencies are direct, and the walk goes through them without a via.
+ */
+function walk(packages, graph, firstParty) {
+  const queue = [...firstParty].filter((k) => graph.has(k)).map((k) => [k, null])
+  const seen = new Set()
+  for (let visits = 0; queue.length && visits < MAX_VISITS; visits++) {
+    const [key, via] = queue.shift()
+    const tag = `${key}\u0000${via ?? ''}`
+    if (seen.has(tag)) continue
+    seen.add(tag)
+    for (const dep of graph.get(key) ?? []) {
+      const item = packages.get(dep)
+      if (!item) continue
+      if (firstParty.has(dep)) { queue.push([dep, null]); continue }
+      if (via === null) item.direct = true
+      else if (!item.via.includes(via)) item.via.push(via)
+      queue.push([dep, via ?? dep])
+    }
+  }
+  for (const item of packages.values()) if (item.direct) item.via = []
+}
+
+// --- Python ----------------------------------------------------------------------------
+
+/** uv.lock: the [[package]] blocks, their dependencies, and [package.metadata] requires-dist (local packages have it). */
+export function uvLock(file, text, roots) {
+  if (typeof text !== 'string') return null
+  const blocks = []
+  let b = null, section = '', array = null
+  const items = (line, i) => [...line.matchAll(/\{\s*name\s*=\s*"([^"]+)"([^}]*)\}/g)].map((m) => ({ name: m[1], rest: m[2], line: i + 1 }))
+  text.split(/\r?\n/).forEach((raw, i) => {
+    const line = raw.trim()
+    if (line === '[[package]]') { b = { name: null, version: null, source: null, deps: [], requires: [], line: i + 1 }; blocks.push(b); section = 'package'; array = null; return }
+    if (/^\[\[/.test(line)) { section = line; array = null; return }
+    const header = /^\[([^\]]+)\]$/.exec(line)
+    if (header) { section = header[1]; array = null; return }
+    if (!b || !section.startsWith('package')) return
+    if (array) {
+      array.push(...items(line, i))
+      if (/^\]/.test(line)) array = null
+      return
+    }
+    const kv = /^([A-Za-z0-9_-]+)\s*=\s*(.*)$/.exec(line)
+    if (!kv) return
+    const open = (target) => { target.push(...items(kv[2], i)); if (/^\[/.test(kv[2]) && !/\]\s*$/.test(kv[2])) array = target }
+    if (section === 'package') {
+      if (kv[1] === 'name') { b.name = /^"([^"]+)"/.exec(kv[2])?.[1] ?? null; b.line = i + 1 }
+      else if (kv[1] === 'version') b.version = /^"([^"]+)"/.exec(kv[2])?.[1] ?? null
+      else if (kv[1] === 'source') b.source = Object.keys(tomlInline(kv[2]) ?? {})[0] ?? null
+      else if (kv[1] === 'dependencies') open(b.deps)
+    } else if (section === 'package.metadata' && kv[1] === 'requires-dist') open(b.requires)
+  })
+  const packages = new Map(), graph = new Map()
+  for (const block of blocks.filter((x) => x.name)) {
+    const key = pyName(block.name)
+    if (packages.has(key)) continue
+    const item = entry(block.name, block.version, file, block.line, block.source)
+    const specs = new Map(block.requires.map((r) => [pyName(r.name), { spec: /specifier\s*=\s*"([^"]*)"/.exec(r.rest)?.[1] ?? null, line: r.line }]))
+    const deps = [...new Set(block.deps.map((d) => pyName(d.name)))]
+    item.requires = deps.map((k) => ({ name: k, spec: specs.get(k)?.spec ?? null, line: specs.get(k)?.line ?? block.deps.find((d) => pyName(d.name) === k)?.line }))
+    for (const [k, s] of specs) if (!deps.includes(k)) item.requires.push({ name: k, spec: s.spec, line: s.line })
+    packages.set(key, item)
+    graph.set(key, deps)
+  }
+  const local = new Set(['editable', 'virtual', 'directory'])
+  walk(packages, graph, new Set(roots.filter((k) => local.has(packages.get(k)?.source ?? ''))))
+  return { file, packages }
+}
+
+/** poetry.lock: [[package]] blocks and their [package.dependencies]. Optional dependencies are left out. */
+export function poetryLock(file, text, direct) {
+  if (typeof text !== 'string') return null
+  const packages = new Map(), graph = new Map()
+  const lines = text.split(/\r?\n/)
+  const starts = lines.map((l, i) => (l.trim() === '[[package]]' ? i : -1)).filter((i) => i >= 0)
+  starts.forEach((start, n) => {
+    const body = lines.slice(start + 1, starts[n + 1] ?? lines.length).join('\n')
+    const name = /^name\s*=\s*"([^"]+)"/m.exec(body)?.[1]
+    if (!name || packages.has(pyName(name))) return
+    const nameLine = start + 1 + body.split('\n').findIndex((l) => /^name\s*=/.test(l)) + 1
+    const source = /^type\s*=\s*"([^"]+)"/m.exec(tomlTable(`[x]\n${body}`, 'package.source'))?.[1] ?? 'registry'
+    const item = entry(name, /^version\s*=\s*"([^"]+)"/m.exec(body)?.[1] ?? null, file, nameLine, source)
+    const offset = start + 1
+    for (const dep of tomlEntries(`[x]\n${body}`, 'package.dependencies')) {
+      const inline = tomlInline(dep.value)
+      if (inline?.optional === true) continue
+      const spec = inline ? (typeof inline.version === 'string' ? inline.version : null) : /^"([^"]*)"/.exec(dep.value)?.[1] ?? null
+      item.requires.push({ name: pyName(dep.key), spec, line: offset + dep.line - 1 })
+    }
+    packages.set(pyName(name), item)
+    graph.set(pyName(name), item.requires.map((r) => r.name))
+  })
+  // The project itself is not in poetry.lock: its direct dependencies start the walk.
+  graph.set('\u0000root', direct.filter((k) => packages.has(k)))
+  walk(packages, graph, new Set(['\u0000root']))
+  return { file, packages }
+}
+
+/** Direct dependency names of these Python folders: [project].dependencies and [tool.poetry.dependencies]. */
+function pythonDirectNames(view, dirs) {
+  const out = new Set()
+  for (const dir of dirs) {
+    const text = read(view, join(dir, 'pyproject.toml'))
+    if (!text) continue
+    for (const req of tomlArray(tomlTable(text, 'project'), 'dependencies')) { const m = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(req); if (m) out.add(pyName(m[1])) }
+    for (const { key } of tomlEntries(text, 'tool.poetry.dependencies')) if (key !== 'python') out.add(pyName(key))
+  }
+  return [...out]
+}
+
+/** Exact pins (name==1.2.3) in a requirements file. They are direct. */
+export function requirementPins(file, text) {
+  if (typeof text !== 'string') return null
+  const packages = new Map()
+  text.split(/\r?\n/).forEach((raw, i) => {
+    const m = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*===?\s*([A-Za-z0-9.+!-]+)\s*(?:[;#\\].*)?$/.exec(raw)
+    if (!m || packages.has(pyName(m[1]))) return
+    packages.set(pyName(m[1]), { ...entry(m[1], m[2], file, i + 1, 'registry'), direct: true })
+  })
+  return packages.size ? { file, packages } : null
+}
+
+// --- .NET ------------------------------------------------------------------------------
+
+/** First line of each "key": { in a JSON file. */
+function jsonLines(text) {
+  const lines = new Map()
+  text.split(/\r?\n/).forEach((l, i) => { const m = /^\s*"([^"]+)"\s*:\s*\{/.exec(l); if (m && !lines.has(m[1])) lines.set(m[1], i + 1) })
+  return lines
+}
+
+/** packages.lock.json: every target framework, Direct, Transitive, Project and CentralTransitive. */
+export function nugetLock(file, text) {
+  const data = json(text)
+  if (!data?.dependencies) return null
+  const lines = jsonLines(text), textLines = text.split(/\r?\n/)
+  const packages = new Map(), graph = new Map(), firstParty = new Set(['\u0000root'])
+  const roots = []
+  for (const deps of Object.values(data.dependencies)) {
+    for (const [name, info] of Object.entries(deps ?? {})) {
+      const key = name.toLowerCase()
+      if (info?.type === 'Project') { firstParty.add(key); roots.push(key) } else if (info?.type === 'Direct') roots.push(key)
+      if (!packages.has(key)) {
+        const item = entry(name, info?.resolved ?? null, file, lines.get(name), info?.type === 'Project' ? 'project' : 'registry')
+        packages.set(key, item)
+        graph.set(key, [])
+      }
+      const item = packages.get(key)
+      for (const [dep, spec] of Object.entries(info?.dependencies ?? {})) {
+        const dk = dep.toLowerCase()
+        if (!graph.get(key).includes(dk)) graph.get(key).push(dk)
+        if (!item.requires.some((r) => r.name.toLowerCase() === dk)) {
+          const needle = `"${dep}": ${JSON.stringify(spec)}`
+          item.requires.push({ name: dep, spec: String(spec), line: textLines.findIndex((l) => l.includes(needle)) + 1 || undefined })
+        }
+      }
+    }
+  }
+  graph.set('\u0000root', [...new Set(roots)])
+  walk(packages, graph, firstParty)
+  return { file, packages }
+}
+
+/** obj/project.assets.json: targets per framework, and the direct dependencies of the project. */
+export function nugetAssets(file, text) {
+  const data = json(text)
+  if (!data?.targets) return null
+  const lines = jsonLines(text)
+  const packages = new Map(), graph = new Map(), firstParty = new Set(['\u0000root'])
+  for (const libs of Object.values(data.targets)) {
+    for (const [id, info] of Object.entries(libs ?? {})) {
+      const [name, version] = id.split('/')
+      const key = name.toLowerCase()
+      if (info?.type === 'project') firstParty.add(key)
+      if (!packages.has(key)) { packages.set(key, entry(name, version ?? null, file, lines.get(id), info?.type === 'project' ? 'project' : 'registry')); graph.set(key, []) }
+      for (const [dep, spec] of Object.entries(info?.dependencies ?? {})) {
+        const dk = dep.toLowerCase()
+        if (!graph.get(key).includes(dk)) graph.get(key).push(dk)
+        if (!packages.get(key).requires.some((r) => r.name.toLowerCase() === dk)) packages.get(key).requires.push({ name: dep, spec: String(spec) })
+      }
+    }
+  }
+  const direct = Object.values(data.project?.frameworks ?? {}).flatMap((f) => Object.keys(f?.dependencies ?? {})).map((n) => n.toLowerCase())
+  graph.set('\u0000root', [...new Set([...direct, ...[...firstParty].filter((k) => k !== '\u0000root')])])
+  walk(packages, graph, firstParty)
+  return { file, packages }
+}
+
+// --- Node.js ---------------------------------------------------------------------------
+
+/** package-lock.json v2 and v3 (the packages map), with a v1 fallback (nested dependencies). roots: folders relative to the lock. */
+export function npmLock(file, text, roots) {
+  const data = json(text)
+  if (!data) return null
+  const lines = jsonLines(text)
+  const packages = new Map()
+  const depsOf = (info) => Object.keys({ ...(info?.dependencies ?? {}), ...(info?.optionalDependencies ?? {}), ...(info?.peerDependencies ?? {}) })
+  const specsOf = (info) => Object.entries({ ...(info?.peerDependencies ?? {}), ...(info?.optionalDependencies ?? {}), ...(info?.dependencies ?? {}) })
+    .map(([name, spec]) => ({ name, spec: String(spec) }))
+  if (data.packages && typeof data.packages === 'object') {
+    const pk = data.packages
+    const MARK = 'node_modules/'
+    const isPkg = (key) => key.includes(MARK)
+    const nameOf = (key) => key.slice(key.lastIndexOf(MARK) + MARK.length)
+    const depth = (key) => key.split(MARK).length
+    const real = (key) => (pk[key]?.link && typeof pk[key].resolved === 'string' && pk[pk[key].resolved] ? pk[key].resolved : key)
+    const parent = (key) => { const at = key.lastIndexOf(`/${MARK}`); return at >= 0 ? key.slice(0, at) : '' }
+    const resolve = (from, name) => {
+      for (let base = from; ; base = parent(base)) {
+        const key = `${base ? `${base}/` : ''}${MARK}${name}`
+        if (pk[key]) return real(key)
+        if (!base) return null
+      }
+    }
+    // 1 entry per name: the copy nearest the root.
+    for (const [key, info] of Object.entries(pk)) {
+      if (!isPkg(key) || info?.link) continue
+      const name = nameOf(key), old = packages.get(name)
+      if (old && old._depth <= depth(key)) continue
+      const item = entry(name, info?.version ?? null, file, lines.get(key), typeof info?.resolved === 'string' && info.resolved.startsWith('file:') ? 'file' : 'registry')
+      item.requires = specsOf(info)
+      packages.set(name, Object.assign(item, { _depth: depth(key) }))
+    }
+    // Walk the folders. Workspace folders (no node_modules in the key) are first-party.
+    const queue = roots.filter((k) => pk[k]).map((k) => [k, null])
+    const seen = new Set()
+    for (let visits = 0; queue.length && visits < MAX_VISITS; visits++) {
+      const [key, via] = queue.shift()
+      if (seen.has(`${key}\u0000${via ?? ''}`)) continue
+      seen.add(`${key}\u0000${via ?? ''}`)
+      for (const dep of depsOf(pk[key])) {
+        const target = resolve(key, dep)
+        if (target === null) continue
+        if (!isPkg(target)) { queue.push([target, null]); continue }
+        const item = packages.get(nameOf(target))
+        if (!item) continue
+        if (via === null) item.direct = true
+        else if (!item.via.includes(via)) item.via.push(via)
+        queue.push([target, via ?? nameOf(target)])
+      }
+    }
+    for (const item of packages.values()) { delete item._depth; if (item.direct) item.via = [] }
+    return { file, packages }
+  }
+  // lockfileVersion 1: nested dependencies with requires. Only the versions and requirements are read.
+  const walkV1 = (deps, level) => {
+    for (const [name, info] of Object.entries(deps ?? {})) {
+      if (!packages.has(name)) {
+        const item = entry(name, info?.version ?? null, file, lines.get(name), 'registry')
+        item.requires = Object.entries(info?.requires ?? {}).map(([dep, spec]) => ({ name: dep, spec: String(spec) }))
+        packages.set(name, item)
+      }
+      if (level < 20) walkV1(info?.dependencies, level + 1)
+    }
+  }
+  walkV1(data.dependencies, 0)
+  return { file, packages }
+}

package/lib/manifest.mjs

@@ -6,19 +6,23 @@
 import { createHash } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { CLI, PINS } from './contract.mjs'
+import { AGENT_CHANNELS, AGENT_REGISTRY, CLI, PINS } from './contract.mjs'
 import { hunks, reverseAt, reverseByContent, splitLines } from './diff.mjs'
 import { checkPath } from './workspace.mjs'
+import { HOOKS } from './hooks/pins.mjs'
 
 export const TOOL = '@uknows/setup'
 export const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version
 export const BOM = '\uFEFF'
 const NOTE = 'Written by npx @uknows/setup. To undo these changes, run npx @uknows/setup remove. This file has no secrets.'
 const STACKS = ['node', 'python', 'dotnet', 'java', 'go', 'php', 'ruby', 'otel']
+/** services[].mode, written since 0.2.0. A 0.1.0 manifest has none. channel: the agent channel (--channel). */
+const MODES = ['standard', 'otel', 'azure-monitor', 'channel']
 const UNDO = { npm: 'uninstall', pnpm: 'remove', yarn: 'remove' }
 /** The only flags an undo command may have: the ones setup itself writes. Everything else must be a package setup adds. */
-const UNDO_FLAGS = new Set(['-w', '--no-package-lock', '--package-lock-only', '--lockfile-only', '--ignore-scripts', '--mode=skip-build'])
-const PACKAGES = new Set([...PINS.node.packages, PINS.node.esmPackage])
+const UNDO_FLAGS = new Set(['-w', '--no-package-lock', '--package-lock-only', '--lockfile-only', '--ignore-scripts', '--mode=skip-build', '--no-audit', '--no-fund'])
+// The packages of the Node.js stack, and of the UKNOWS hooks for Azure Functions (stacks/functions-hooks.mjs).
+const PACKAGES = new Set([...PINS.node.packages, PINS.node.esmPackage, ...HOOKS.node.packages.map(([name]) => name)])
 const SHA = /^[0-9a-f]{64}$/
 
 /** @param {Buffer|null} bytes */
@@ -41,7 +45,16 @@ export function readManifest(root) {
 function valid(m) {
   try {
     if (m?.schema !== 1 || ![m.services, m.changes, m.packages].every(Array.isArray)) return false
-    for (const s of m.services) { checkPath(s.dir); if (!STACKS.includes(s.stack)) return false }
+    if (m.updates !== undefined && !RECORDED_BOTS.includes(m.updates)) return false
+    for (const s of m.services) {
+      checkPath(s.dir)
+      if (!STACKS.includes(s.stack) || (s.mode !== undefined && !MODES.includes(s.mode))) return false
+      // steps: the titles of the required steps in the repo that were left when setup ran (since 0.2.0). Optional.
+      if (s.steps !== undefined && !(Array.isArray(s.steps) && s.steps.every((t) => typeof t === 'string'))) return false
+      // channel: {name, registry} of a service in channel mode, and only there. A rerun reads them from here.
+      if ((s.mode === 'channel') !== (s.channel !== undefined)) return false
+      if (s.channel !== undefined && !(AGENT_CHANNELS.includes(s.channel?.name) && typeof s.channel?.registry === 'string' && AGENT_REGISTRY.test(s.channel.registry))) return false
+    }
     for (const c of m.changes) {
       checkPath(c.file)
       if (!c.hunks.every((h) => Number.isInteger(h.at) && [...h.before, ...h.after].every((l) => typeof l === 'string'))) return false
@@ -74,12 +87,19 @@ export function changeEntry({ file, before, after, bom }, beforeBytes, afterByte
     hunks: before === null ? [] : hunks(before, after) }
 }
 
-/** Add 1 run to a manifest (or start one). Services are merged by dir. */
-export function mergeManifest(old, { services, changes, packages }) {
+/** The update bots that a manifest can record (updates: since 0.2.0, optional): what setup chose for the package route. */
+export const RECORDED_BOTS = ['renovate', 'dependabot', 'none']
+
+/**
+ * Add 1 run to a manifest (or start one). Services are merged by dir. updates: the update bot of this run, kept by a
+ * rerun (updates.mjs). Without one, the manifest keeps what it had.
+ */
+export function mergeManifest(old, { services, changes, packages, updates }) {
   const kept = (old?.services ?? []).filter((s) => !services.some((n) => n.dir === s.dir))
+  const bot = RECORDED_BOTS.includes(updates) ? updates : RECORDED_BOTS.includes(old?.updates) ? old.updates : null
   return { schema: 1, tool: TOOL, version: VERSION, note: NOTE,
     services: [...kept, ...services].sort((a, b) => (a.dir < b.dir ? -1 : a.dir > b.dir ? 1 : 0)),
-    changes: [...(old?.changes ?? []), ...changes], packages: [...(old?.packages ?? []), ...packages] }
+    changes: [...(old?.changes ?? []), ...changes], packages: [...(old?.packages ?? []), ...packages], ...(bot ? { updates: bot } : {}) }
 }
 
 /** Paths the dirty-tree check ignores: the manifest and every path it lists. */