apphx 1.1.0 → 2.0.1

package/dist/dependencies.js

@@ -1,8 +1,9 @@
 import { canonicalPath, inside } from "./config.js";
-import { createHash } from "node:crypto";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
-import { existsSync, readFileSync } from "node:fs";
+import { goDependencyInputs } from "./go-dependencies.js";
+import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { createHash } from "node:crypto";
 import { parseDocument } from "yaml";
 // src/dependencies.ts
 const GENERATED_PATHS = /* @__PURE__ */ new Set([
@@ -19,8 +20,43 @@ const GENERATED_PATHS = /* @__PURE__ */ new Set([
 	"ios/Flutter/flutter_export_environment.sh",
 	"ios/Flutter/ephemeral"
 ]);
-function isGeneratedPath(path) {
+function isGeneratedPath(path, framework) {
 	let candidate = sep === "/" ? path : path.split(sep).join("/");
+	candidate = candidate.replace(/^\.\//, "").replace(/\/$/, "");
+	const parts = candidate.split("/");
+	if (framework === "mygo") return [
+		".git",
+		".idea",
+		".factory-input",
+		".factory-cache",
+		"build",
+		"dist"
+	].includes(parts[0]) || parts.includes(".mygo") || parts.includes("node_modules") || parts.some((part, index) => part === ".yarn" && [
+		"cache",
+		"unplugged",
+		"install-state.gz"
+	].includes(parts[index + 1] ?? ""));
+	if (framework === "flutter" && (parts.includes(".dart_tool") || parts.includes(".gradle"))) return true;
+	if ([
+		".git",
+		".idea",
+		".factory-input",
+		".factory-cache",
+		"build"
+	].includes(parts[0])) return true;
+	if (framework && framework !== "flutter") {
+		const javascript = framework === "react-native" || framework === "expo" || framework === "uni-app";
+		if (javascript && parts.includes("node_modules")) return true;
+		if (framework !== "swift" && parts.includes(".gradle")) return true;
+		if (framework !== "android-java" && parts.includes("Pods")) return true;
+		if (framework !== "android-java" && (parts.includes(".build") || parts[0] === "DerivedData")) return true;
+		if (framework !== "swift" && /^(?:android\/)?(?:app\/)?build(?:\/|$)/.test(candidate)) return true;
+		if (framework !== "android-java" && /^ios\/(?:build|DerivedData)(?:\/|$)/.test(candidate)) return true;
+		if (javascript && /^\.yarn\/(?:cache|unplugged|install-state\.gz)(?:\/|$)/.test(candidate)) return true;
+		if (framework === "expo" && /^\.expo(?:\/|$)/.test(candidate)) return true;
+		if (framework === "uni-app" && /^(?:unpackage|dist)(?:\/|$)/.test(candidate)) return true;
+		return false;
+	}
 	while (candidate) {
 		if (GENERATED_PATHS.has(candidate)) return true;
 		const slash = candidate.lastIndexOf("/");
@@ -29,6 +65,92 @@ function isGeneratedPath(path) {
 	}
 	return false;
 }
+function manifestCode(path, ruby = false) {
+	return readFileSync(path, "utf8").replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\*[\s\S]*?\*\/|\/\/[^\r\n]*|#[^\r\n]*/g, (token) => {
+		if (token.startsWith("\"") || token.startsWith("'") || token.startsWith("#") && !ruby) return token;
+		return " ";
+	});
+}
+const GRADLE_TOKENS = /"""[\s\S]*?"""|'''[\s\S]*?'''|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\*[\s\S]*?\*\/|\/\/[^\r\n]*/g;
+function gradleCode(path) {
+	return readFileSync(path, "utf8").replace(GRADLE_TOKENS, (token) => token.startsWith("/") ? token.replace(/[^\r\n]/g, " ") : token);
+}
+function gradlePattern(expression) {
+	return new RegExp(`${GRADLE_TOKENS.source}|${expression.source}`, "g");
+}
+/** Workspace-relative build outputs for statically declared, real Gradle modules. */
+function generatedModulePaths(root, framework, directory = ".") {
+	if (![
+		"android-java",
+		"react-native",
+		"expo",
+		"uni-app"
+	].includes(framework)) return /* @__PURE__ */ new Set();
+	const outputs = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	function underOutput(path) {
+		const portable = path.split(sep).join("/");
+		for (const output of outputs) if (portable === output || portable.startsWith(`${output}/`)) return true;
+		return false;
+	}
+	function registerBuildOutput(absolute) {
+		for (const build of ["build.gradle", "build.gradle.kts"]) {
+			const manifest = join(absolute, build);
+			const stat = lstatSync(manifest, { throwIfNoEntry: false });
+			if (stat?.isSymbolicLink()) throw new Error(`Gradle module manifest cannot be a symlink: ${manifest}`);
+			if (stat?.isFile()) outputs.add(relative(root, join(absolute, "build")).split(sep).join("/"));
+		}
+	}
+	function visit(current) {
+		current = resolve(current);
+		if (visited.has(current)) return;
+		if (current !== resolve(root)) inside(root, current);
+		const path = relative(root, current);
+		if (generatedInProject(path, framework, directory) || underOutput(path)) return;
+		if (path !== relative(canonicalPath(root), canonicalPath(current))) throw new Error(`Gradle build directory cannot be a source symlink: ${current}`);
+		visited.add(current);
+		registerBuildOutput(current);
+		for (const name of ["settings.gradle", "settings.gradle.kts"]) {
+			const settings = join(current, name);
+			const stat = lstatSync(settings, { throwIfNoEntry: false });
+			if (!stat) continue;
+			if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Gradle settings must be a regular source file: ${settings}`);
+			const text = gradleCode(settings);
+			const modules = /* @__PURE__ */ new Map();
+			for (const include of text.matchAll(gradlePattern(/\binclude\s*(?:\(([^)]*)\)|([^\r\n;]+))/))) {
+				const argumentsText = include[1] ?? include[2];
+				if (argumentsText === void 0 || !/^\s*(?:(?:"[:\w.-]+"|'[:\w.-]+')\s*,?\s*)+$/.test(argumentsText)) continue;
+				for (const match of argumentsText.matchAll(/["'](:?[\w.-]+(?::[\w.-]+)*)["']/g)) {
+					const id = match[1].replace(/^:/, "");
+					modules.set(id, id.split(":").join("/"));
+				}
+			}
+			for (const match of text.matchAll(gradlePattern(/\bproject\s*\(\s*["'](:?[\w.-]+(?::[\w.-]+)*)["']\s*\)\s*\.projectDir\s*=\s*file\s*\(\s*(?:"([^"\\$]+)"|'([^'\\]+)')\s*\)/))) {
+				if (match[1] === void 0) continue;
+				const id = match[1].replace(/^:/, "");
+				if (modules.has(id)) modules.set(id, match[2] ?? match[3]);
+			}
+			for (const module of modules.values()) {
+				if (isAbsolute(module)) throw new Error(`Gradle module requires a workspace-relative path: ${module}`);
+				const absolute = resolve(current, module);
+				inside(root, absolute);
+				if (relative(resolve(root), absolute) !== relative(canonicalPath(root), canonicalPath(absolute))) throw new Error(`Gradle module directory cannot be a source symlink: ${module}`);
+				registerBuildOutput(absolute);
+			}
+			for (const match of text.matchAll(gradlePattern(/\bincludeBuild\s*\(?\s*(?:"([^"\\$]+)"|'([^'\\]+)')/))) {
+				const included = match[1] ?? match[2];
+				if (included === void 0) continue;
+				if (isAbsolute(included)) throw new Error(`Included Gradle build requires a workspace-relative path: ${included}`);
+				visit(resolve(current, included));
+			}
+		}
+	}
+	visit(root);
+	const project = projectRoot(root, directory);
+	visit(project);
+	visit(join(project, "android"));
+	return outputs;
+}
 function mapping(value, path) {
 	if (value === void 0 || value === null) return {};
 	if (typeof value !== "object" || Array.isArray(value)) throw new Error(`Expected a YAML mapping in ${path}; run flutter pub get after repairing the dependency metadata`);
@@ -39,12 +161,12 @@ function yaml(path) {
 	if (document.errors.length) throw new Error(`Cannot parse dependency metadata at ${path}: ${document.errors.map((error) => error.message).join("; ")}`);
 	return mapping(document.toJS(), path);
 }
-function validateLocalDependencies(root) {
-	const manifest = join(root, "pubspec.yaml");
+function validateFlutterDependencies(root, project = root) {
+	const manifest = join(project, "pubspec.yaml");
 	if (!existsSync(manifest)) return;
 	const workspace = canonicalPath(root);
 	const rootSpec = yaml(manifest);
-	const overridesFile = join(root, "pubspec_overrides.yaml");
+	const overridesFile = join(project, "pubspec_overrides.yaml");
 	const overrides = {
 		...mapping(rootSpec.dependency_overrides, manifest),
 		...mapping(existsSync(overridesFile) ? yaml(overridesFile).dependency_overrides : void 0, overridesFile)
@@ -56,7 +178,7 @@ function validateLocalDependencies(root) {
 		const absolute = resolve(path);
 		const lexical = relative(resolve(root), absolute);
 		const actual = relative(workspace, canonicalPath(absolute));
-		if (isAbsolute(lexical) || lexical === ".." || lexical.startsWith(`..${sep}`) || isAbsolute(actual) || actual === ".." || actual.startsWith(`..${sep}`) || isGeneratedPath(lexical) || isGeneratedPath(actual)) throw new Error(`Local dependency ${path} is outside fingerprinted workspace source; move the package into a non-generated workspace directory and run flutter pub get`);
+		if (isAbsolute(lexical) || lexical === ".." || lexical.startsWith(`..${sep}`) || isAbsolute(actual) || actual === ".." || actual.startsWith(`..${sep}`) || lexical !== actual || generatedInProject(lexical, "flutter", relative(root, project)) || generatedInProject(actual, "flutter", relative(root, project))) throw new Error(`Local dependency ${path} is outside fingerprinted workspace source; move the package into a non-generated workspace directory and run flutter pub get`);
 		if (lexical) inside(root, absolute);
 		return absolute;
 	}
@@ -84,20 +206,20 @@ function validateLocalDependencies(root) {
 		};
 		for (const [name, dependency] of Object.entries(dependencies)) {
 			const overridden = Object.hasOwn(overrides, name);
-			pathDependency(name, overridden ? overrides[name] : dependency, overridden ? root : directory);
+			pathDependency(name, overridden ? overrides[name] : dependency, overridden ? project : directory);
 		}
 	}
-	visit(root, true);
-	const lockFile = join(root, "pubspec.lock");
+	visit(project, true);
+	const lockFile = join(project, "pubspec.lock");
 	if (existsSync(lockFile)) {
 		const packages = mapping(yaml(lockFile).packages, lockFile);
 		for (const [name, value] of Object.entries(packages)) {
 			const entry = mapping(value, lockFile);
-			if (entry.source === "path") pathDependency(name, { path: mapping(entry.description, lockFile).path }, root);
+			if (entry.source === "path") pathDependency(name, { path: mapping(entry.description, lockFile).path }, project);
 			else if (entry.source === "hosted" || entry.source === "sdk" || entry.source === "git") immutablePackages.add(name);
 		}
 	}
-	const packageConfig = join(root, ".dart_tool", "package_config.json");
+	const packageConfig = join(project, ".dart_tool", "package_config.json");
 	if (!existsSync(packageConfig)) return;
 	const packages = mapping(JSON.parse(readFileSync(packageConfig, "utf8")), packageConfig).packages;
 	if (!Array.isArray(packages)) throw new Error(`Invalid package resolution at ${packageConfig}; run flutter pub get before verification`);
@@ -110,10 +232,10 @@ function validateLocalDependencies(root) {
 		const packageRoot = owned(fileURLToPath(uri));
 		const declared = localPackages.get(entry.name);
 		if (declared && canonicalPath(declared) !== canonicalPath(packageRoot)) throw new Error(`Resolved local dependency ${entry.name} differs from its declared path; run flutter pub get before verification`);
-		visit(packageRoot, canonicalPath(packageRoot) === workspace);
+		visit(packageRoot, canonicalPath(packageRoot) === canonicalPath(project));
 	}
 }
-function dependencyDigest(root) {
+function flutterDependencyDigest(root) {
 	const path = join(root, ".dart_tool", "package_config.json");
 	const hash = createHash("sha256").update("factory-dependency-resolution-v1\0");
 	if (!existsSync(path)) return hash.update("missing").digest("hex");
@@ -152,6 +274,323 @@ function dependencyDigest(root) {
 		packages
 	})).digest("hex");
 }
-export { GENERATED_PATHS, dependencyDigest, isGeneratedPath, validateLocalDependencies };
+function projectRoot(root, directory = ".") {
+	if (isAbsolute(directory)) throw new Error("Project directory must be workspace-relative");
+	const project = resolve(root, directory);
+	if (project !== resolve(root)) inside(root, project);
+	return project;
+}
+function generatedInProject(path, framework, directory = ".") {
+	if (isGeneratedPath(path, framework)) return true;
+	const nested = relative(directory, path);
+	return nested !== ".." && !nested.startsWith(`..${sep}`) && !isAbsolute(nested) && isGeneratedPath(nested, framework);
+}
+function sourceFiles(root, framework, activeDirectory, resolutions, moduleOutputs) {
+	const files = [];
+	function visit(directory) {
+		for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			const absolute = join(directory, entry.name);
+			const path = relative(root, absolute);
+			const portable = path.split(sep).join("/");
+			if (generatedInProject(path, framework, activeDirectory) || moduleOutputs.some((output) => portable === output || portable.startsWith(`${output}/`))) {
+				if (entry.isDirectory()) {
+					const records = entry.name === "node_modules" ? [
+						".package-lock.json",
+						".modules.yaml",
+						".pnpm/lock.yaml"
+					] : entry.name === "Pods" ? ["Manifest.lock"] : entry.name === ".build" ? ["workspace-state.json"] : entry.name === "build" ? ["SourcePackages/workspace-state.json", "DerivedData/SourcePackages/workspace-state.json"] : entry.name === "DerivedData" ? ["SourcePackages/workspace-state.json"] : [];
+					for (const record of records) {
+						const metadata = join(absolute, record);
+						const stat = lstatSync(metadata, { throwIfNoEntry: false });
+						if (stat && relative(canonicalPath(root), canonicalPath(metadata)) !== relative(resolve(root), metadata)) throw new Error(`Dependency resolution metadata cannot traverse a source symlink: ${metadata}`);
+						if (stat?.isSymbolicLink()) throw new Error(`Dependency resolution metadata cannot be a symlink: ${metadata}`);
+						if (stat) resolutions.push(join(path, record));
+					}
+				}
+				if (entry.isFile() && entry.name === "install-state.gz") resolutions.push(path);
+				continue;
+			}
+			const stat = lstatSync(absolute);
+			if (stat.isSymbolicLink()) throw new Error(`Source symlinks are not trusted dependency inputs: ${path}`);
+			if (stat.isDirectory()) visit(absolute);
+			else if (stat.isFile()) files.push(path);
+			else throw new Error(`Dependency input must be a regular source file: ${path}`);
+		}
+	}
+	visit(root);
+	return files;
+}
+function object(value, path) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Invalid dependency metadata at ${path}`);
+	return value;
+}
+function dependencyInputs(root, framework, activeDirectory = ".") {
+	projectRoot(root, activeDirectory);
+	const resolutions = [];
+	const moduleOutputs = [...generatedModulePaths(root, framework, activeDirectory)];
+	const files = sourceFiles(root, framework, activeDirectory, resolutions, moduleOutputs);
+	const go = framework === "mygo" ? goDependencyInputs(root, activeDirectory, (path) => generatedInProject(path, framework, activeDirectory)) : void 0;
+	const javascriptActive = framework !== "mygo" || ["package.json", "frontend/package.json"].some((path) => existsSync(join(root, activeDirectory, path)));
+	const local = new Set(go?.local);
+	const packages = /* @__PURE__ */ new Map();
+	for (const path of files.filter((path) => javascriptActive && basename(path) === "package.json")) {
+		const pkg = object(JSON.parse(readFileSync(join(root, path), "utf8")), path);
+		if (typeof pkg.name === "string") packages.set(pkg.name, dirname(path));
+	}
+	function owned(value, directory, native = false) {
+		if (!value || isAbsolute(value) || /^[a-z]:[\\/]/i.test(value)) throw new Error(`Local dependency requires a workspace-relative path: ${value}`);
+		const absolute = resolve(root, directory, value);
+		const path = relative(resolve(root), absolute);
+		if (path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) throw new Error(`Local dependency escapes fingerprinted workspace source: ${value}`);
+		if (path) inside(root, absolute);
+		const portable = path.split(sep).join("/");
+		if (generatedInProject(path, framework, activeDirectory) || moduleOutputs.some((output) => portable === output || portable.startsWith(`${output}/`))) {
+			if (native && path.split(sep).includes("node_modules")) return;
+			throw new Error(`Local dependency is outside fingerprinted workspace source: ${value}`);
+		}
+		if (!existsSync(absolute)) {
+			if (native) return;
+			throw new Error(`Local dependency does not exist: ${value}`);
+		}
+		if (path !== relative(canonicalPath(root), canonicalPath(absolute)) || lstatSync(absolute).isSymbolicLink()) throw new Error(`Local dependency source symlinks are not trusted: ${value}`);
+		local.add(path);
+	}
+	function reference(value, directory, name) {
+		if (typeof value !== "string") return;
+		const match = /^(?:file|link|portal):(.*)$/.exec(value);
+		if (match) owned(decodeURIComponent(match[1]), directory);
+		else if (value.startsWith(".") || isAbsolute(value) || /^[a-z]:[\\/]/i.test(value)) owned(value, directory);
+		else if (value.startsWith("workspace:")) {
+			const target = name ? packages.get(name) : void 0;
+			if (target === void 0) throw new Error(`Workspace dependency ${name ?? value} has no owned package manifest`);
+			owned(relative(resolve(root, directory), resolve(root, target)) || ".", directory);
+		}
+	}
+	function declarations(value, directory) {
+		if (!value || typeof value !== "object" || Array.isArray(value)) return;
+		for (const [name, child] of Object.entries(value)) if (typeof child === "object") declarations(child, directory);
+		else reference(child, directory, name);
+	}
+	function npmResolutions(value, directory) {
+		if (!value || typeof value !== "object") return;
+		const entry = value;
+		if (entry.link === true && typeof entry.resolved === "string") owned(entry.resolved.replace(/^(?:file|link):/, ""), directory);
+		for (const [key, child] of Object.entries(entry)) if (key === "resolved" || key === "version") reference(child, directory);
+		else if (child && typeof child === "object") npmResolutions(child, directory);
+	}
+	function pnpmResolutions(lock, directory, path) {
+		for (const [importer, value] of Object.entries(mapping(lock.importers, path))) {
+			const base = relative(root, resolve(root, directory, importer));
+			const spec = mapping(value, path);
+			for (const field of [
+				"dependencies",
+				"devDependencies",
+				"optionalDependencies"
+			]) for (const [dependency, value] of Object.entries(mapping(spec[field], path))) if (typeof value === "string") reference(value, base, dependency);
+			else {
+				const resolution = mapping(value, path);
+				reference(resolution.specifier, base, dependency);
+				reference(resolution.version, base, dependency);
+			}
+		}
+		for (const field of ["packages", "snapshots"]) for (const [key, value] of Object.entries(mapping(lock[field], path))) {
+			const local = /(?:file|link|portal):([^(:]+)/.exec(key);
+			if (local) owned(decodeURIComponent(local[1]), directory);
+			reference(mapping(mapping(value, path).resolution, path).tarball, directory);
+		}
+	}
+	for (const path of files) {
+		const name = basename(path);
+		const directory = dirname(path);
+		if (framework === "mygo" && (!javascriptActive || ![
+			"package.json",
+			"package-lock.json",
+			"npm-shrinkwrap.json",
+			"pnpm-lock.yaml",
+			"yarn.lock",
+			"bun.lock"
+		].includes(name))) continue;
+		if (name === "package.json") {
+			const pkg = object(JSON.parse(readFileSync(join(root, path), "utf8")), path);
+			for (const field of [
+				"dependencies",
+				"devDependencies",
+				"optionalDependencies",
+				"peerDependencies",
+				"overrides",
+				"resolutions"
+			]) declarations(pkg[field], directory);
+		} else if (name === "package-lock.json" || name === "npm-shrinkwrap.json") npmResolutions(object(JSON.parse(readFileSync(join(root, path), "utf8")), path), directory);
+		else if (name === "pnpm-lock.yaml") pnpmResolutions(yaml(join(root, path)), directory, path);
+		else if (["yarn.lock", "bun.lock"].includes(name)) {
+			const text = readFileSync(join(root, path), "utf8");
+			for (const match of text.matchAll(/(?:file|link|portal):([^\s"'`,}\]]+)/g)) owned(decodeURIComponent(match[1].split("::")[0]), directory);
+		} else if (name === "Package.swift") {
+			const text = manifestCode(join(root, path));
+			for (const match of text.matchAll(/\.package\s*\(\s*(?:name\s*:\s*"[^"]*"\s*,\s*)?path\s*:\s*"([^"]+)"/g)) owned(match[1], directory);
+			for (const match of text.matchAll(/\burl\s*:\s*"([^"]+)"/g)) reference(match[1], directory);
+		} else if (name === "Podfile" || name.endsWith(".podspec")) {
+			const text = manifestCode(join(root, path), true);
+			for (const match of text.matchAll(/(?::(?:path|podspec)\s*=>\s*|(?:path|podspec)\s*:\s*)["']([^"']+)["']/g)) owned(match[1], directory, true);
+			for (const match of text.matchAll(/(?::git\s*=>\s*|git\s*:\s*)["']([^"']+)["']/g)) reference(match[1], directory);
+		} else if (name === "Podfile.lock") {
+			const lock = yaml(join(root, path));
+			for (const value of Object.values(mapping(lock["EXTERNAL SOURCES"], path))) {
+				const external = mapping(value, path);
+				for (const field of [":path", ":podspec"]) if (typeof external[field] === "string") owned(external[field], directory, true);
+				reference(external[":git"], directory);
+			}
+		} else if (name === "project.pbxproj") {
+			const text = manifestCode(join(root, path));
+			for (const match of text.matchAll(/\brelativePath\s*=\s*"?([^;"\r\n]+)"?\s*;/g)) owned(match[1].trim(), dirname(directory));
+		} else if (/^(?:settings|build)\.gradle(?:\.kts)?$/.test(name)) {
+			const text = gradleCode(join(root, path));
+			for (const match of text.matchAll(gradlePattern(/\b(?:includeBuild\s*\(?\s*|projectDir\s*=\s*file\s*\(\s*|fileTree\s*\(\s*(?:dir\s*[:=]\s*)?)(?:"([^"\\$]+)"|'([^'\\]+)')/))) {
+				const value = match[1] ?? match[2];
+				if (value !== void 0) owned(value, directory, true);
+			}
+			const collections = gradlePattern(/\b(files|dirs)\b\s*(?:(\()|(?=["']))/);
+			const literalPath = /"([^"\\$]*)"|'([^'\\]*)'/y;
+			for (let match; match = collections.exec(text);) {
+				if (!match[1]) continue;
+				let offset = collections.lastIndex;
+				const parenthesized = Boolean(match[2]);
+				const whitespace = parenthesized ? /\s/ : /[ \t]/;
+				while (true) {
+					while (offset < text.length && whitespace.test(text[offset])) offset++;
+					if (parenthesized && text[offset] === ")") {
+						offset++;
+						break;
+					}
+					if (!parenthesized && (offset === text.length || /[\r\n;}]/.test(text[offset]))) break;
+					literalPath.lastIndex = offset;
+					const literal = literalPath.exec(text);
+					if (!literal) throw new Error(`Cannot prove Gradle ${match[1]} collection in ${path}: expected literal paths`);
+					owned(literal[1] ?? literal[2], directory, true);
+					offset = literalPath.lastIndex;
+					while (offset < text.length && whitespace.test(text[offset])) offset++;
+					if (text[offset] === ",") {
+						offset++;
+						while (offset < text.length && /\s/.test(text[offset])) offset++;
+						continue;
+					}
+					if (parenthesized && text[offset] === ")") {
+						offset++;
+						break;
+					}
+					if (!parenthesized && (offset === text.length || /[\r\n;}]/.test(text[offset]))) break;
+					throw new Error(`Cannot prove Gradle ${match[1]} collection in ${path}: expected literal paths`);
+				}
+				collections.lastIndex = offset;
+			}
+			for (const match of text.matchAll(gradlePattern(/\burl\s*(?:=\s*)?(?:uri\s*\(?\s*)?(?:"([^"\\$]+)"|'([^'\\]+)')/))) {
+				const value = match[1] ?? match[2];
+				if (value === void 0) continue;
+				if (/^[a-z][a-z0-9+.-]*:/i.test(value)) reference(value, directory);
+				else owned(value, directory, true);
+			}
+		}
+	}
+	for (const path of resolutions) {
+		const absolute = join(root, path);
+		if (!existsSync(absolute)) continue;
+		inside(root, absolute);
+		if (!lstatSync(absolute).isFile() || lstatSync(absolute).isSymbolicLink()) throw new Error(`Dependency resolution metadata must be a regular file: ${path}`);
+		if (basename(path) === ".package-lock.json") npmResolutions(object(JSON.parse(readFileSync(absolute, "utf8")), path), dirname(dirname(path)));
+		else if (path.endsWith(`${sep}.pnpm${sep}lock.yaml`)) pnpmResolutions(yaml(absolute), dirname(dirname(dirname(path))), path);
+		else if (basename(path) === "workspace-state.json") {
+			const metadata = object(JSON.parse(readFileSync(absolute, "utf8")), path);
+			const state = metadata.object === void 0 ? metadata : object(metadata.object, path);
+			if (Array.isArray(state.dependencies)) for (const value of state.dependencies) {
+				const reference = object(object(value, path).packageRef, path);
+				if ((reference.kind === "fileSystem" || reference.kind === "localSourceControl") && typeof reference.location === "string") owned((isAbsolute(reference.location) ? relative(resolve(root), reference.location) : join(activeDirectory, reference.location)) || ".", ".");
+			}
+		}
+	}
+	return {
+		files,
+		local,
+		resolutions,
+		...go ? { goFiles: go.files } : {}
+	};
+}
+/** Validate declarations before any source is granted verification authority. */
+function validateLocalDependencies(root, framework, directory = ".") {
+	if (framework === void 0 || framework === "flutter") {
+		validateFlutterDependencies(root, projectRoot(root, directory));
+		return;
+	}
+	dependencyInputs(root, framework, directory);
+}
+function resolutionMetadata(path, framework) {
+	const name = basename(path);
+	if (framework === "mygo") return [
+		"package.json",
+		"package-lock.json",
+		"npm-shrinkwrap.json",
+		"yarn.lock",
+		"pnpm-lock.yaml",
+		"bun.lock",
+		"bun.lockb",
+		".pnp.cjs"
+	].includes(name);
+	return [
+		"package.json",
+		"package-lock.json",
+		"npm-shrinkwrap.json",
+		"yarn.lock",
+		"pnpm-lock.yaml",
+		"bun.lock",
+		"bun.lockb",
+		"Podfile",
+		"Podfile.lock",
+		"Package.swift",
+		"Package.resolved",
+		"Cartfile",
+		"Cartfile.resolved",
+		"project.pbxproj",
+		"gradle.properties",
+		"gradle.lockfile",
+		"gradle-wrapper.properties",
+		"verification-metadata.xml",
+		"libs.versions.toml",
+		".pnp.cjs"
+	].includes(name) || /\.(?:gradle(?:\.kts)?|podspec)$/.test(name) || path.includes("dependency-locks/");
+}
+function dependencyDigest(root, framework, directory = ".") {
+	if (framework === void 0 || framework === "flutter") return flutterDependencyDigest(projectRoot(root, directory));
+	const { files, local, resolutions, goFiles } = dependencyInputs(root, framework, directory);
+	const hash = createHash("sha256").update(`factory-dependency-resolution-v2\0${framework}\0`);
+	function add(path) {
+		const content = readFileSync(join(root, path));
+		hash.update(`${path.split(sep).join("/")}\0${content.length}\0`).update(content).update("\0");
+	}
+	const localDirectories = [...local];
+	for (const path of files) if (goFiles?.has(path) || resolutionMetadata(path, framework) || localDirectories.some((directory) => !directory || path === directory || path.startsWith(`${directory}${sep}`))) add(path);
+	if (goFiles) {
+		const sourcePaths = new Set(files);
+		for (const path of [...goFiles].sort()) {
+			if (sourcePaths.has(path)) continue;
+			const absolute = inside(root, path);
+			const stat = lstatSync(absolute);
+			if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Generated frontend dependency must be a regular owned file: ${path}`);
+			add(path);
+		}
+	}
+	const installationRecords = [join(directory, ".yarn/install-state.gz"), join(directory, ".pnp.data.json")];
+	if (framework === "mygo") installationRecords.push(join(directory, "frontend/.yarn/install-state.gz"), join(directory, "frontend/.pnp.data.json"));
+	for (const path of [.../* @__PURE__ */ new Set([...resolutions, ...installationRecords])].sort()) {
+		const absolute = join(root, path);
+		if (!existsSync(absolute)) {
+			hash.update(`${path}\0missing\0`);
+			continue;
+		}
+		inside(root, absolute);
+		if (!lstatSync(absolute).isFile() || lstatSync(absolute).isSymbolicLink()) throw new Error(`Dependency resolution metadata must be a regular file: ${path}`);
+		add(path);
+	}
+	return hash.digest("hex");
+}
+export { GENERATED_PATHS, dependencyDigest, generatedModulePaths, isGeneratedPath, validateLocalDependencies };
 
 //# sourceMappingURL=dependencies.js.map