checkly 8.22.0 → 8.23.0

package/dist/services/embedded-packages/lockfile-packages.d.ts

@@ -5,7 +5,22 @@
 export interface LockfileRegistryPackage {
     name: string;
     version: string;
-    integrity: string;
+    /**
+     * SRI integrity of the registry tarball. Absent only for `yarn.lock`
+     * entries: Yarn Berry checksums hash yarn's own cache archive, not the
+     * registry tarball, so the tarball integrity is resolved from registry
+     * metadata at materialization time instead. Entries without either hash
+     * are excluded by the parsers, so `lockfileChecksum` is always present
+     * when this is absent.
+     */
+    integrity?: string;
+    /**
+     * The lockfile's own content pin when it is not an SRI tarball hash
+     * (Yarn Berry's `checksum` value). Used in place of `integrity` where a
+     * stable content identifier known at plan time is needed (the dependency
+     * cache hash).
+     */
+    lockfileChecksum?: string;
     /**
      * The full tarball URL when the lockfile records one (npm's `resolved`,
      * pnpm's `resolution.tarball`). When absent, the URL is derived from the
@@ -38,11 +53,25 @@ export interface LockfilePackages {
 export declare class UnsupportedLockfileError extends Error {
     constructor(message: string);
 }
+/**
+ * Whether a lockfile is pnpm's. Callers use this to decide which package
+ * manager's credential conventions apply to the project.
+ */
+export declare function isPnpmLockfile(lockfilePath: string): boolean;
 /**
  * Enumerates every package entry in a lockfile, classified into embeddable
  * registry packages and excluded (git/file/link/integrity-less) entries.
- * Supports `pnpm-lock.yaml` (v6/v9) and `package-lock.json` (v2/v3).
+ * Supports `pnpm-lock.yaml` (v6/v9), `package-lock.json` (v2/v3),
+ * `bun.lock` (v1) and Yarn Berry's `yarn.lock`.
  */
 export declare function loadLockfilePackages(lockfilePath: string): Promise<LockfilePackages>;
+/**
+ * Content-based variant of {@link loadLockfilePackages} for lockfiles that
+ * exist only in memory (e.g. a pruned copy of the bundled lockfile). The
+ * format is dispatched on the lockfile's filename.
+ */
+export declare function parseLockfilePackagesContent(content: string, lockfileName: string): LockfilePackages;
 export declare function parsePnpmLockfilePackages(content: string): LockfilePackages;
+export declare function parseBunLockfilePackages(content: string): LockfilePackages;
+export declare function parseYarnLockfilePackages(content: string): LockfilePackages;
 export declare function parseNpmLockfilePackages(content: string): LockfilePackages;

package/dist/services/embedded-packages/lockfile-packages.js

@@ -9,24 +9,58 @@ export class UnsupportedLockfileError extends Error {
         this.name = 'UnsupportedLockfileError';
     }
 }
+const PNPM_LOCKFILE = 'pnpm-lock.yaml';
+/**
+ * Whether a lockfile is pnpm's. Callers use this to decide which package
+ * manager's credential conventions apply to the project.
+ */
+export function isPnpmLockfile(lockfilePath) {
+    return path.basename(lockfilePath) === PNPM_LOCKFILE;
+}
 /**
  * Enumerates every package entry in a lockfile, classified into embeddable
  * registry packages and excluded (git/file/link/integrity-less) entries.
- * Supports `pnpm-lock.yaml` (v6/v9) and `package-lock.json` (v2/v3).
+ * Supports `pnpm-lock.yaml` (v6/v9), `package-lock.json` (v2/v3),
+ * `bun.lock` (v1) and Yarn Berry's `yarn.lock`.
  */
 export async function loadLockfilePackages(lockfilePath) {
     const basename = path.basename(lockfilePath);
     const content = await fs.readFile(lockfilePath, 'utf8');
-    switch (basename) {
-        case 'pnpm-lock.yaml':
+    return parseLockfilePackagesContent(content, basename);
+}
+/**
+ * Content-based variant of {@link loadLockfilePackages} for lockfiles that
+ * exist only in memory (e.g. a pruned copy of the bundled lockfile). The
+ * format is dispatched on the lockfile's filename.
+ */
+export function parseLockfilePackagesContent(content, lockfileName) {
+    switch (lockfileName) {
+        case PNPM_LOCKFILE:
             return parsePnpmLockfilePackages(content);
         case 'package-lock.json':
             return parseNpmLockfilePackages(content);
+        case 'bun.lock':
+            return parseBunLockfilePackages(content);
+        case 'yarn.lock':
+            return parseYarnLockfilePackages(content);
+        case 'bun.lockb':
+            throw new UnsupportedLockfileError(`Embedded packages are not supported for bun's binary lockfile (bun.lockb).`
+                + ` Regenerate a text lockfile with \`bun install --save-text-lockfile\`.`);
         default:
-            throw new UnsupportedLockfileError(`Embedded packages are not supported for '${basename}' lockfiles yet.`
-                + ` Only pnpm (pnpm-lock.yaml) and npm (package-lock.json) are currently supported.`);
+            throw new UnsupportedLockfileError(`Embedded packages are not supported for '${lockfileName}' lockfiles yet.`
+                + ` Only pnpm (pnpm-lock.yaml), npm (package-lock.json), bun (bun.lock)`
+                + ` and Yarn Berry (yarn.lock) are currently supported.`);
     }
 }
+/**
+ * Whether a directory-link target points outside the workspace the bundle
+ * carries. Shared by the parsers' link classification: an in-workspace link
+ * is part of the project (safe for a wildcard to skip silently), while an
+ * escaping one is not.
+ */
+function linkTargetEscapesWorkspace(target) {
+    return target === '..' || target.startsWith('../') || path.isAbsolute(target);
+}
 /**
  * Strips a pnpm peer-dependency suffix (`(react@18.2.0)`) from a package
  * key. The v9 `packages` section doesn't use them (they live in
@@ -36,6 +70,60 @@ function stripPeerSuffix(key) {
     const cut = key.indexOf('(');
     return cut === -1 ? key : key.slice(0, cut);
 }
+/**
+ * Splits a `name@ref` package key at the first `@` past the name. Searching
+ * from the front (after the scope, when present) keeps the name intact when
+ * the ref itself contains `@`, as git refs do
+ * (`foo@git+ssh://git@github.com/...`). Shared by the pnpm and bun parsers,
+ * whose keys use the same shape.
+ */
+function splitPackageKey(key) {
+    const searchFrom = key.startsWith('@') ? key.indexOf('/') + 1 : 1;
+    const separator = searchFrom > 0 ? key.indexOf('@', searchFrom) : -1;
+    if (separator <= 0) {
+        return undefined;
+    }
+    return { name: key.slice(0, separator), ref: key.slice(separator + 1) };
+}
+/**
+ * Classifies one `name@ref` entry into a registry package or an unfetchable
+ * exclusion, appending to `result`. Shared by the pnpm and bun parsers,
+ * which record the same information in different places (pnpm's
+ * `resolution.integrity`/`resolution.tarball` vs bun's tuple indices).
+ */
+function classifyRegistryEntry(result, name, ref, integrity, tarball) {
+    // Validate with semver but keep the ref as written: semver.valid()
+    // normalizes away build metadata (`1.0.0+sha.abc` → `1.0.0`), which
+    // would break both version-pin matching and the derived tarball URL.
+    const version = semver.valid(ref) !== null ? ref : null;
+    if (version === null) {
+        result.excluded.push({
+            name,
+            reason: `'${name}@${ref}' resolves to a git, file or URL dependency,`
+                + ` which cannot be embedded as a registry tarball`,
+            kind: 'unfetchable',
+        });
+        return;
+    }
+    if (typeof integrity !== 'string' || integrity === '') {
+        result.excluded.push({
+            name,
+            version,
+            reason: `the lockfile records no integrity hash for '${name}@${version}',`
+                + ` which is required to embed it`,
+            kind: 'unfetchable',
+        });
+        return;
+    }
+    result.registry.push({
+        name,
+        version,
+        integrity,
+        // Only absolute http(s) URLs are usable for downloading; anything
+        // else falls back to the registry-derived URL.
+        tarballUrl: typeof tarball === 'string' && /^https?:/.test(tarball) ? tarball : undefined,
+    });
+}
 export function parsePnpmLockfilePackages(content) {
     const data = parseYaml(content);
     // The version can arrive as a number: pnpm writes `lockfileVersion: '9.0'`
@@ -66,7 +154,7 @@ export function parsePnpmLockfilePackages(content) {
                         // target escapes the workspace is not part of the project the
                         // bundle carries.
                         const target = version.slice('link:'.length);
-                        const escapesWorkspace = target === '..' || target.startsWith('../') || path.isAbsolute(target);
+                        const escapesWorkspace = linkTargetEscapesWorkspace(target);
                         result.excluded.push({
                             name,
                             reason: escapesWorkspace
@@ -88,54 +176,170 @@ export function parsePnpmLockfilePackages(content) {
     for (const [rawKey, rawEntry] of Object.entries(packages)) {
         // v6 keys have a leading slash (`/name@1.2.3`), v9 keys do not.
         const key = stripPeerSuffix(rawKey.startsWith('/') ? rawKey.slice(1) : rawKey);
-        // The name/ref separator is the first `@` past the name. Searching from
-        // the front (after the scope, when present) keeps the name intact when
-        // the ref itself contains `@`, as git refs do
-        // (`foo@git+ssh://git@github.com/...`).
-        const searchFrom = key.startsWith('@') ? key.indexOf('/') + 1 : 1;
-        const separator = searchFrom > 0 ? key.indexOf('@', searchFrom) : -1;
-        if (separator <= 0) {
+        const split = splitPackageKey(key);
+        if (split === undefined) {
             continue;
         }
-        const name = key.slice(0, separator);
-        const ref = key.slice(separator + 1);
+        const { name, ref } = split;
         if (seen.has(`${name}@${ref}`)) {
             continue;
         }
         seen.add(`${name}@${ref}`);
-        // Validate with semver but keep the ref as written: semver.valid()
-        // normalizes away build metadata (`1.0.0+sha.abc` → `1.0.0`), which
-        // would break both version-pin matching and the derived tarball URL.
-        const version = semver.valid(ref) !== null ? ref : null;
+        const resolution = rawEntry?.resolution;
+        classifyRegistryEntry(result, name, ref, resolution?.integrity, resolution?.tarball);
+    }
+    return result;
+}
+export function parseBunLockfilePackages(content) {
+    // bun.lock is JSONC (bun writes trailing commas), hence JSON5.
+    const data = JSON5.parse(content);
+    const lockfileVersion = data?.lockfileVersion;
+    if (lockfileVersion !== 1) {
+        throw new UnsupportedLockfileError(`Embedded packages require bun lockfile version 1`
+            + ` (found '${lockfileVersion ?? 'unknown'}'). Regenerate the lockfile with a supported`
+            + ` bun version, or update the Checkly CLI if the lockfile is newer.`);
+    }
+    const packages = data?.packages;
+    const result = { registry: [], excluded: [] };
+    if (typeof packages !== 'object' || packages === null) {
+        return result;
+    }
+    const seen = new Set();
+    for (const tuple of Object.values(packages)) {
+        // Package values are tuples whose first element is `name@ref`; the rest
+        // varies by resolution kind (registry entries carry the tarball URL at
+        // index 1 — '' for the default registry — and the integrity hash at
+        // index 3). An unrecognizable value is skipped rather than guessed at,
+        // like unparseable pnpm keys. Aliased installs appear under the alias
+        // key but record the real package name in the tuple, so the split below
+        // always yields the real name.
+        if (!Array.isArray(tuple) || typeof tuple[0] !== 'string') {
+            continue;
+        }
+        const split = splitPackageKey(tuple[0]);
+        if (split === undefined) {
+            continue;
+        }
+        const { name, ref } = split;
+        if (seen.has(`${name}@${ref}`)) {
+            continue;
+        }
+        seen.add(`${name}@${ref}`);
+        if (ref.startsWith('workspace:')) {
+            result.excluded.push({
+                name,
+                reason: `'${name}' is a workspace package, which cannot be embedded as a registry tarball`,
+                kind: 'workspace',
+            });
+            continue;
+        }
+        classifyRegistryEntry(result, name, ref, tuple[3], tuple[1]);
+    }
+    return result;
+}
+export function parseYarnLockfilePackages(content) {
+    // Yarn Berry lockfiles are YAML; Yarn Classic's v1 format happens to
+    // YAML-parse too, so Berry is recognized by its __metadata section.
+    const data = parseYaml(content);
+    if (data === null || typeof data !== 'object') {
+        throw new UnsupportedLockfileError(`Embedded packages could not parse the yarn.lock file.`);
+    }
+    const metadata = data.__metadata;
+    if (metadata === null || typeof metadata !== 'object' || metadata.version === undefined) {
+        throw new UnsupportedLockfileError(`Embedded packages are not supported for Yarn Classic (v1) lockfiles.`
+            + ` Migrate to Yarn Berry, whose lockfile records the resolution data embedding needs.`);
+    }
+    const result = { registry: [], excluded: [] };
+    const seen = new Set();
+    for (const [key, entry] of Object.entries(data)) {
+        if (key === '__metadata') {
+            continue;
+        }
+        // Every entry records its resolved locator as `name@protocol:ref` in
+        // `resolution` — under an aliased or multi-descriptor key this is the
+        // REAL package locator, so names and refs are always taken from it. An
+        // unrecognizable entry is skipped rather than guessed at, like
+        // unparseable pnpm keys.
+        const resolution = entry?.resolution;
+        if (typeof resolution !== 'string') {
+            continue;
+        }
+        const split = splitPackageKey(resolution);
+        if (split === undefined) {
+            continue;
+        }
+        const { name, ref } = split;
+        if (seen.has(`${name}@${ref}`)) {
+            continue;
+        }
+        seen.add(`${name}@${ref}`);
+        if (ref.startsWith('workspace:')) {
+            result.excluded.push({
+                name,
+                reason: `'${name}' is a workspace package, which cannot be embedded as a registry tarball`,
+                kind: 'workspace',
+            });
+            continue;
+        }
+        // Directory links (`portal:`/`link:`) carry their target between the
+        // protocol and the `::locator=...` suffix. Same distinction as the
+        // pnpm/npm parsers: an in-workspace link is part of the project itself.
+        const linkPrefix = ['portal:', 'link:'].find(prefix => ref.startsWith(prefix));
+        if (linkPrefix !== undefined) {
+            const target = ref.slice(linkPrefix.length).split('::')[0];
+            const escapesWorkspace = linkTargetEscapesWorkspace(target);
+            result.excluded.push({
+                name,
+                reason: escapesWorkspace
+                    ? `'${name}' is a local directory link outside the workspace, which cannot be embedded`
+                        + ` as a registry tarball`
+                    : `'${name}' is a workspace package, which cannot be embedded as a registry tarball`,
+                kind: escapesWorkspace ? 'unfetchable' : 'workspace',
+            });
+            continue;
+        }
+        // Anything that is not a plain `npm:<semver>` locator cannot be a
+        // registry tarball: patch:, git, https:, file:, exec:, or an npm ref
+        // whose version is not valid semver (a range or tag yarn left
+        // unresolved). file: targets an archive the bundle does not carry, so
+        // unlike directory links it warrants the unfetchable warning; builtin
+        // and user patches always coexist with the underlying npm: entry,
+        // which shadows the exclusion for reporting purposes.
+        const rawVersion = ref.startsWith('npm:') ? ref.slice('npm:'.length) : null;
+        // As in the other parsers: validate with semver but keep the version as
+        // written, preserving build metadata.
+        const version = rawVersion !== null && semver.valid(rawVersion) !== null ? rawVersion : null;
         if (version === null) {
             result.excluded.push({
                 name,
-                reason: `'${name}@${ref}' resolves to a git, file or URL dependency,`
+                reason: `'${name}@${ref}' resolves to a git, file, URL or patched dependency,`
                     + ` which cannot be embedded as a registry tarball`,
                 kind: 'unfetchable',
             });
             continue;
         }
-        const resolution = rawEntry?.resolution;
-        const integrity = resolution?.integrity;
-        if (typeof integrity !== 'string' || integrity === '') {
+        // Berry's checksum hashes yarn's own cache archive rather than the
+        // registry tarball, so it cannot serve as SRI integrity — the
+        // materializer resolves the tarball integrity from registry metadata
+        // instead. It IS a stable content pin, recorded for the dependency
+        // cache hash. Without one (checksumBehavior: ignore) the lockfile pins
+        // nothing, and the entry is excluded like the other parsers'
+        // integrity-less entries.
+        const checksum = entry?.checksum;
+        if (typeof checksum !== 'string' || checksum === '') {
             result.excluded.push({
                 name,
                 version,
-                reason: `the lockfile records no integrity hash for '${name}@${version}',`
+                reason: `the lockfile records no checksum for '${name}@${version}',`
                     + ` which is required to embed it`,
                 kind: 'unfetchable',
             });
             continue;
         }
-        const tarball = resolution?.tarball;
         result.registry.push({
             name,
             version,
-            integrity,
-            // Only absolute http(s) URLs are usable for downloading; anything
-            // else falls back to the registry-derived URL.
-            tarballUrl: typeof tarball === 'string' && /^https?:/.test(tarball) ? tarball : undefined,
+            lockfileChecksum: checksum,
         });
     }
     return result;
@@ -171,7 +375,7 @@ export function parseNpmLockfilePackages(content) {
             // part of the project the bundle carries, so a wildcard must not
             // skip it silently.
             const target = typeof entry?.resolved === 'string' ? entry.resolved : '';
-            const escapesWorkspace = target === '..' || target.startsWith('../') || path.isAbsolute(target);
+            const escapesWorkspace = linkTargetEscapesWorkspace(target);
             result.excluded.push({
                 name: key.slice(lastNodeModules + 'node_modules/'.length),
                 reason: escapesWorkspace

package/dist/services/embedded-packages/lockfile-packages.js.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile-packages.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/lockfile-packages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,MAAM,MAAM,QAAQ,CAAA;AA0C3B,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAa,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAE,YAAoB;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAEvD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,gBAAgB;YACnB,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAA;QAC3C,KAAK,mBAAmB;YACtB,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAA;QAC1C;YACE,MAAM,IAAI,wBAAwB,CAChC,4CAA4C,QAAQ,kBAAkB;kBACpE,kFAAkF,CACrF,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAE,GAAW;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAE,OAAe;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE/B,2EAA2E;IAC3E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IAC1D,IAAI,aAAa,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,wDAAwD;cACtD,YAAY,eAAe,IAAI,SAAS,8CAA8C;cACtF,oEAAoE,CACvE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAE/D,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAM,SAAS,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBAChF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACvE,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAA;oBAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzF,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBACrB,+DAA+D;wBAC/D,8DAA8D;wBAC9D,kBAAkB;wBAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;wBAC5C,MAAM,gBAAgB,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;wBAC/F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;4BACnB,IAAI;4BACJ,MAAM,EAAE,gBAAgB;gCACtB,CAAC,CAAC,IAAI,IAAI,6EAA6E;sCACrF,wBAAwB;gCAC1B,CAAC,CAAC,IAAI,IAAI,0EAA0E;4BACtF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;yBACrD,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,CAAC,EAAE,CAAC;QAC/D,gEAAgE;QAChE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC9E,wEAAwE;QACxE,uEAAuE;QACvE,8CAA8C;QAC9C,wCAAwC;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjE,MAAM,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QAEpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QAE1B,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QACvD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,MAAM,EAAE,IAAI,IAAI,IAAI,GAAG,8CAA8C;sBACjE,iDAAiD;gBACrD,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,CAAA;QACvC,MAAM,SAAS,GAAG,UAAU,EAAE,SAAS,CAAA;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO;gBACP,MAAM,EAAE,+CAA+C,IAAI,IAAI,OAAO,IAAI;sBACtE,gCAAgC;gBACpC,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAA;QACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,OAAO;YACP,SAAS;YACT,kEAAkE;YAClE,+CAA+C;YAC/C,UAAU,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC1F,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAE,OAAe;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAA;IAC7C,IAAI,eAAe,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAwB,CAChC,uDAAuD;cACrD,YAAY,eAAe,IAAI,SAAS,6CAA6C,CACxF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,eAAe,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;QACxD,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3B,6DAA6D;YAC7D,kCAAkC;YAClC,SAAQ;QACV,CAAC;QACD,sEAAsE;QACtE,wBAAwB;QACxB,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QAEvD,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,oBAAoB;YACpB,MAAM,MAAM,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;YACxE,MAAM,gBAAgB,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC/F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC;gBACzD,MAAM,EAAE,gBAAgB;oBACtB,CAAC,CAAC,IAAI,GAAG,6EAA6E;0BACpF,wBAAwB;oBAC1B,CAAC,CAAC,IAAI,GAAG,uEAAuE;gBAClF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;aACrD,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,mEAAmE;QACnE,MAAM,OAAO,GAAG,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;YACxF,CAAC,CAAC,KAAK,CAAC,OAAiB;YACzB,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAEjF,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,SAAS;gBAC7B,MAAM,EAAE,IAAI,GAAG,8CAA8C;sBACzD,iDAAiD;gBACrD,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,qEAAqE;YACrE,iEAAiE;YACjE,6DAA6D;YAC7D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO;gBACP,MAAM,EAAE,+CAA+C,IAAI,IAAI,OAAO,GAAG;sBACrE,kEAAkE;gBACtE,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAA;QAE9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,OAAO;YACP,SAAS;YACT,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"lockfile-packages.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/lockfile-packages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAyD3B,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAa,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED,MAAM,aAAa,GAAG,gBAAgB,CAAA;AAEtC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAE,YAAoB;IAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,aAAa,CAAA;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAE,YAAoB;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAE,OAAe,EAAE,YAAoB;IACjF,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAA;QAC3C,KAAK,mBAAmB;YACtB,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAA;QAC1C,KAAK,UAAU;YACb,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAA;QAC1C,KAAK,WAAW;YACd,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAA;QAC3C,KAAK,WAAW;YACd,MAAM,IAAI,wBAAwB,CAChC,4EAA4E;kBAC1E,wEAAwE,CAC3E,CAAA;QACH;YACE,MAAM,IAAI,wBAAwB,CAChC,4CAA4C,YAAY,kBAAkB;kBACxE,sEAAsE;kBACtE,sDAAsD,CACzD,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAE,MAAc;IACjD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAE,GAAW;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAE,GAAW;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,MAAM,SAAS,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAA;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,MAAwB,EACxB,IAAY,EACZ,GAAW,EACX,SAAkB,EAClB,OAAgB;IAEhB,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACvD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,MAAM,EAAE,IAAI,IAAI,IAAI,GAAG,8CAA8C;kBACjE,iDAAiD;YACrD,IAAI,EAAE,aAAa;SACpB,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,+CAA+C,IAAI,IAAI,OAAO,IAAI;kBACtE,gCAAgC;YACpC,IAAI,EAAE,aAAa;SACpB,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,IAAI;QACJ,OAAO;QACP,SAAS;QACT,kEAAkE;QAClE,+CAA+C;QAC/C,UAAU,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KAC1F,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAE,OAAe;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE/B,2EAA2E;IAC3E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IAC1D,IAAI,aAAa,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,wDAAwD;cACtD,YAAY,eAAe,IAAI,SAAS,8CAA8C;cACtF,oEAAoE,CACvE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAE/D,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAM,SAAS,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBAChF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACvE,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAA;oBAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzF,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBACrB,+DAA+D;wBAC/D,8DAA8D;wBAC9D,kBAAkB;wBAClB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;wBAC5C,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;wBAC3D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;4BACnB,IAAI;4BACJ,MAAM,EAAE,gBAAgB;gCACtB,CAAC,CAAC,IAAI,IAAI,6EAA6E;sCACrF,wBAAwB;gCAC1B,CAAC,CAAC,IAAI,IAAI,0EAA0E;4BACtF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;yBACrD,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,CAAC,EAAE,CAAC;QAC/D,gEAAgE;QAChE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;QAE3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QAE1B,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,CAAA;QACvC,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAE,OAAe;IACvD,+DAA+D;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAA;IAC7C,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,wBAAwB,CAChC,kDAAkD;cAChD,YAAY,eAAe,IAAI,SAAS,8CAA8C;cACtF,mEAAmE,CACtE,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAM,QAAQ,CAAC,EAAE,CAAC;QACjD,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,+BAA+B;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1D,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;QAE3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QAE1B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,MAAM,EAAE,IAAI,IAAI,0EAA0E;gBAC1F,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAE,OAAe;IACxD,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAC/B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,wBAAwB,CAChC,uDAAuD,CACxD,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAI,IAA4B,CAAC,UAAU,CAAA;IACzD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,wBAAwB,CAChC,sEAAsE;cACpE,qFAAqF,CACxF,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAE/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,SAAQ;QACV,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,+DAA+D;QAC/D,yBAAyB;QACzB,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,CAAA;QACpC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;QAE3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QAE1B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,MAAM,EAAE,IAAI,IAAI,0EAA0E;gBAC1F,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,qEAAqE;QACrE,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC9E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC1D,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;YAC3D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,MAAM,EAAE,gBAAgB;oBACtB,CAAC,CAAC,IAAI,IAAI,6EAA6E;0BACrF,wBAAwB;oBAC1B,CAAC,CAAC,IAAI,IAAI,0EAA0E;gBACtF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;aACrD,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,sDAAsD;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3E,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,OAAO,GAAG,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5F,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,MAAM,EAAE,IAAI,IAAI,IAAI,GAAG,uDAAuD;sBAC1E,iDAAiD;gBACrD,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,mEAAmE;QACnE,8DAA8D;QAC9D,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,6DAA6D;QAC7D,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,CAAA;QAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO;gBACP,MAAM,EAAE,yCAAyC,IAAI,IAAI,OAAO,IAAI;sBAChE,gCAAgC;gBACpC,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,OAAO;YACP,gBAAgB,EAAE,QAAQ;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAE,OAAe;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAA;IAC7C,IAAI,eAAe,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAwB,CAChC,uDAAuD;cACrD,YAAY,eAAe,IAAI,SAAS,6CAA6C,CACxF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,eAAe,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;QACxD,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3B,6DAA6D;YAC7D,kCAAkC;YAClC,SAAQ;QACV,CAAC;QACD,sEAAsE;QACtE,wBAAwB;QACxB,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QAEvD,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,oBAAoB;YACpB,MAAM,MAAM,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;YACxE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;YAC3D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC;gBACzD,MAAM,EAAE,gBAAgB;oBACtB,CAAC,CAAC,IAAI,GAAG,6EAA6E;0BACpF,wBAAwB;oBAC1B,CAAC,CAAC,IAAI,GAAG,uEAAuE;gBAClF,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;aACrD,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,mEAAmE;QACnE,MAAM,OAAO,GAAG,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;YACxF,CAAC,CAAC,KAAK,CAAC,OAAiB;YACzB,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAEjF,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,SAAS;gBAC7B,MAAM,EAAE,IAAI,GAAG,8CAA8C;sBACzD,iDAAiD;gBACrD,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,EAAE,CAAC;YACnC,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,qEAAqE;YACrE,iEAAiE;YACjE,6DAA6D;YAC7D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,OAAO;gBACP,MAAM,EAAE,+CAA+C,IAAI,IAAI,OAAO,GAAG;sBACrE,kEAAkE;gBACtE,IAAI,EAAE,aAAa;aACpB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAA;QAE9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,OAAO;YACP,SAAS;YACT,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/services/embedded-packages/materializer.d.ts

@@ -47,6 +47,11 @@ export interface EmbeddedPackagesPlan {
  * to be added to the code bundle.
  */
 export interface MaterializedTarball extends PlannedTarball {
+    /**
+     * SRI integrity the tarball was verified against — the lockfile's, or for
+     * yarn.lock plans the one resolved from registry metadata.
+     */
+    integrity: string;
     /** Absolute path of the verified tarball in the CLI cache. */
     filePath: string;
     /** Bundle-root-relative archive path (POSIX). */
@@ -73,16 +78,25 @@ export interface EmbeddedPackagesMaterializerOptions {
 /**
  * Resolves the configured `bundle.packages.embed` specs against the
  * workspace lockfile (plan) and sources the selected tarballs into the CLI
- * cache (materialize), through a chain of CLI cache → npm cacache →
+ * cache (materializeTarballs), through a chain of CLI cache → npm cacache →
  * registry download, always verified against the lockfile integrity.
  *
- * Both stages memoize their in-flight promise: multiple Playwright checks
- * bundle concurrently, and validation and bundling share one instance per
- * parsed project, so the work runs exactly once.
+ * The plan memoizes its in-flight promise: validation and bundling share
+ * one instance per parsed project, so the (purely local) resolution runs
+ * exactly once. Materialization has a single caller — the Bundler, at
+ * finalize time, after the bundled lockfile has been pruned — which passes
+ * the subset of the plan the shipped lockfile still references, so
+ * pruned-away tarballs are never downloaded.
  */
 export declare class EmbeddedPackagesMaterializer {
     #private;
     constructor(options: EmbeddedPackagesMaterializerOptions);
     plan(): Promise<EmbeddedPackagesPlan>;
-    materialize(): Promise<MaterializedTarball[]>;
+    /**
+     * Sources the given subset of the planned tarballs (CLI cache → npm
+     * cacache → registry download, verified against the lockfile integrity).
+     * Lets the caller materialize only the tarballs a pruned bundled lockfile
+     * still references, so pruned-away packages are never downloaded.
+     */
+    materializeTarballs(tarballs: PlannedTarball[]): Promise<MaterializedTarball[]>;
 }