checkly 8.22.0 → 8.23.0

package/dist/services/embedded-packages/spec.d.ts

@@ -1,47 +1,119 @@
 /**
  * A parsed `bundle.packages.embed` entry: a package name — or a name
  * pattern with `*` wildcards — with an optional exact version pin
- * (`name` or `name@version`).
+ * (`name` or `name@version`), optionally prefixed with `!` to make it an
+ * exclusion.
  */
 export interface EmbeddedPackageSpec {
-    /** The raw config entry, kept for error messages. */
+    /** The raw config entry, `!` prefix included, kept for error messages. */
     raw: string;
     /**
      * The package name, e.g. `@acme/private-utils` — or, when
-     * {@link namePattern} is set, the raw name pattern, e.g. `@acme/*`.
+     * {@link wildcard} is set, the raw name pattern, e.g. `@acme/*`.
      */
     name: string;
     /** The exact pinned version, if the entry included one. */
     version?: string;
     /**
-     * Present when the name contains `*` wildcards: the compiled matcher.
-     * Each `*` matches any run of characters except `/`, so a wildcard
-     * never crosses the scope separator (`@acme/*` matches only packages in
-     * that scope; a bare `*` matches only unscoped names).
+     * True when the name contains `*` wildcards and matches as a pattern
+     * rather than by exact comparison. Each single `*` matches any run of
+     * characters except `/`, so it never crosses the scope separator
+     * (`@acme/*` matches only packages in that scope; a bare `*` matches
+     * only unscoped names). A run of two or more stars (`**`) matches any
+     * run of characters *including* `/`: `**` alone matches every package,
+     * and `**-foo` matches scoped and unscoped names alike. Directly before
+     * a `/`, a `**` may also match nothing together with that `/` — the
+     * glob habit, so `'**' + '/utils'` (one string; split here only because
+     * `*` followed by `/` would end this comment) matches both `utils` and
+     * `@acme/utils`.
      */
-    namePattern?: RegExp;
+    wildcard: boolean;
+    /**
+     * True when the entry was prefixed with `!`: instead of selecting
+     * packages, it removes the ones it matches from what the entries before
+     * it selected.
+     */
+    exclude: boolean;
+}
+/** The parts of a lockfile entry a spec is matched against. */
+export interface PackageRef {
+    name: string;
+    /**
+     * Absent on entries the lockfile records without one, e.g. git, file and
+     * URL resolutions and workspace links.
+     */
+    version?: string;
 }
 /**
  * Whether a spec selects the given package name: exact comparison for
  * plain specs, pattern match for wildcard specs.
  */
-export declare function specMatchesPackageName(spec: EmbeddedPackageSpec, packageName: string): boolean;
+export declare function specMatchesPackageName(spec: PackageNamePattern, packageName: string): boolean;
+/**
+ * Whether an ordered pattern list selects the given name: a matching
+ * plain entry selects it, a matching `!` exclusion deselects it, and the
+ * last matching entry wins. This is the canonical definition of the
+ * order-sensitive exclusion rule both `bundle.packages` options share
+ * (`['@acme/*', '!@acme/keep']` selects the scope except `@acme/keep`,
+ * while the reverse order selects the whole scope because the exclusion
+ * ran before anything was selected); the embed materializer applies the
+ * same rule per spec so it can attribute diagnostics to entries.
+ */
+export declare function patternsSelectName(patterns: PackageNamePattern[], name: string): boolean;
+/**
+ * Whether a spec selects the given package: the name must match, and so
+ * must an exact version pin. An entry the lockfile records without a
+ * version never satisfies a pin.
+ */
+export declare function specMatchesPackage(spec: EmbeddedPackageSpec, entry: PackageRef): boolean;
+/**
+ * As {@link specMatchesPackage}, except that a version-less entry matches
+ * any pin. Used where such an entry is still worth reporting against a
+ * pinned spec: a git resolution or a workspace link may well be the package
+ * the user meant, recorded in a form that has no version to compare.
+ */
+export declare function specLooselyMatchesPackage(spec: EmbeddedPackageSpec, entry: PackageRef): boolean;
 export declare class InvalidEmbeddedPackageSpecError extends Error {
     /** The failure alone, without the `Invalid embedded package '<spec>':` prefix. */
     readonly reason: string;
     constructor(spec: string, reason: string);
 }
 /**
- * Parses a `bundle.packages.embed` entry into a package name and an
- * optional exact version pin.
+ * Parses a `bundle.packages.embed` entry into a package name, an optional
+ * exact version pin and whether the entry excludes rather than selects.
  *
  * Accepts `name` (embed every lockfile version of the package) and
  * `name@version` with an exact semver version. The name may contain `*`
- * wildcards (`@acme/*`, `acme-*`, `@acme/*-utils`), each matching any run
- * of characters except `/`. Version ranges are rejected: the embedded
- * tarball must be the exact artifact the lockfile resolved, so a range has
- * nothing meaningful to select against. A leading `v` is stripped, but the
- * version is otherwise kept as written (including any build metadata) so
- * it compares exactly against lockfile versions.
+ * and `**` wildcards (`@acme/*`, `acme-*`, `**-foo`), matching as
+ * described on {@link EmbeddedPackageSpec.wildcard}. A `!`
+ * prefix (`!@acme/legacy`, `!@acme/*`,
+ * `!legacy@2.1.0`) marks the entry as an exclusion, subtracting from what
+ * the entries before it selected. Version ranges are rejected: the
+ * embedded tarball must be the exact artifact the lockfile resolved, so a
+ * range has nothing meaningful to select against. A leading `v` is
+ * stripped, but the version is otherwise kept as written (including any
+ * build metadata) so it compares exactly against lockfile versions.
  */
 export declare function parseEmbeddedPackageSpec(raw: string): EmbeddedPackageSpec;
+/**
+ * A parsed package name pattern: a plain package name, or a name pattern
+ * with `*` wildcards, optionally prefixed with `!` to make it an
+ * exclusion — the name-matching subset of {@link EmbeddedPackageSpec},
+ * without the version pin. See the spec's field docs for the wildcard
+ * and exclusion semantics.
+ */
+export type PackageNamePattern = Pick<EmbeddedPackageSpec, 'name' | 'wildcard' | 'exclude'>;
+export declare class InvalidPackageNamePatternError extends Error {
+    constructor(raw: string, reason: string);
+}
+/**
+ * Parses a package name pattern: a package name that may contain `*`
+ * and `**` wildcards (`@acme/*`, `acme-*`, `**-foo`), matching as
+ * described on {@link EmbeddedPackageSpec.wildcard}. A `!` prefix
+ * marks the entry as an exclusion, subtracting from what the entries
+ * before it selected, exactly as in `bundle.packages.embed`. Unlike
+ * {@link parseEmbeddedPackageSpec} there are no `name@version` pins;
+ * they are rejected with a pointed message so an embed-style pin fails
+ * loudly instead of silently matching nothing.
+ */
+export declare function parsePackageNamePattern(raw: string): PackageNamePattern;

package/dist/services/embedded-packages/spec.js

@@ -4,26 +4,142 @@ import semver from 'semver';
  * plain specs, pattern match for wildcard specs.
  */
 export function specMatchesPackageName(spec, packageName) {
-    if (spec.namePattern !== undefined) {
-        return spec.namePattern.test(packageName);
+    if (spec.wildcard) {
+        return matchesNamePattern(spec.name, packageName);
     }
     return spec.name === packageName;
 }
-function compileNamePattern(name) {
-    // Splitting on *runs* of `*` treats consecutive stars as one, keeping
-    // the compiled regex free of adjacent `[^/]*` runs, whose backtracking
-    // on a mismatch grows catastrophically with the number of stars.
-    const escaped = name
-        .split(/\*+/)
-        .map(part => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
-        .join('[^/]*');
-    return new RegExp(`^${escaped}$`);
+/**
+ * Whether an ordered pattern list selects the given name: a matching
+ * plain entry selects it, a matching `!` exclusion deselects it, and the
+ * last matching entry wins. This is the canonical definition of the
+ * order-sensitive exclusion rule both `bundle.packages` options share
+ * (`['@acme/*', '!@acme/keep']` selects the scope except `@acme/keep`,
+ * while the reverse order selects the whole scope because the exclusion
+ * ran before anything was selected); the embed materializer applies the
+ * same rule per spec so it can attribute diagnostics to entries.
+ */
+export function patternsSelectName(patterns, name) {
+    let selected = false;
+    for (const pattern of patterns) {
+        if (specMatchesPackageName(pattern, name)) {
+            selected = !pattern.exclude;
+        }
+    }
+    return selected;
+}
+/**
+ * Whether a spec selects the given package: the name must match, and so
+ * must an exact version pin. An entry the lockfile records without a
+ * version never satisfies a pin.
+ */
+export function specMatchesPackage(spec, entry) {
+    return specMatchesPackageName(spec, entry.name)
+        && (spec.version === undefined || entry.version === spec.version);
+}
+/**
+ * As {@link specMatchesPackage}, except that a version-less entry matches
+ * any pin. Used where such an entry is still worth reporting against a
+ * pinned spec: a git resolution or a workspace link may well be the package
+ * the user meant, recorded in a form that has no version to compare.
+ */
+export function specLooselyMatchesPackage(spec, entry) {
+    return specMatchesPackageName(spec, entry.name)
+        && (spec.version === undefined || entry.version === undefined || entry.version === spec.version);
+}
+/**
+ * Matches a wildcard name pattern against a package name, without a
+ * regex: a regex spelling each `*` as `[^/]*` backtracks catastrophically
+ * on a mismatch once several stars are separated by literals (measured in
+ * the minutes for a dozen stars against a 50-character name), and the
+ * pattern comes straight from the user's config. The tokenized pattern —
+ * with the wildcard semantics {@link EmbeddedPackageSpec.wildcard}
+ * documents — is applied token by token to a boolean row over the name,
+ * where entry `j` records whether the tokens so far can match the first
+ * `j` characters: a literal shifts the row by one matching character, a
+ * star extends every reachable position rightwards one character at a
+ * time (refusing `/` unless doubled), and the star-run-plus-`/` pair
+ * either leaves the row as it is or lands right past any reachable `/`.
+ * No backtracking, and O(pattern length × name length) like the greedy
+ * walk it replaced.
+ *
+ * These semantics are also a wire contract beyond this repository:
+ * `runner.registries` routing rules (`services/runner/registries.ts`)
+ * ship raw patterns inside the code bundle for Checkly runners to match
+ * with identical semantics. A semantic change here changes how deployed
+ * routing configs behave and requires a coordinated runner update plus a
+ * `REGISTRIES_FILE_VERSION` bump.
+ */
+function matchesNamePattern(pattern, packageName) {
+    const n = packageName.length;
+    let row = new Array(n + 1).fill(false);
+    row[0] = true;
+    for (const token of tokenizePattern(pattern)) {
+        const next = new Array(n + 1).fill(false);
+        if (token[0] === '*' && token.endsWith('/')) {
+            let reachable = false;
+            for (let j = 0; j <= n; j++) {
+                reachable = reachable || (j > 0 && row[j - 1]);
+                next[j] = row[j] || (j > 0 && reachable && packageName[j - 1] === '/');
+            }
+        }
+        else if (token[0] === '*') {
+            for (let j = 0; j <= n; j++) {
+                next[j] = row[j] || (j > 0 && next[j - 1] && (token.length > 1 || packageName[j - 1] !== '/'));
+            }
+        }
+        else {
+            for (let j = 1; j <= n; j++) {
+                next[j] = row[j - 1] && packageName[j - 1] === token;
+            }
+        }
+        row = next;
+    }
+    return row[n];
 }
 // npm's name rules for already-published packages: new publishes must be
 // lowercase, but plenty of legitimate older packages (JSONStream) contain
 // uppercase letters, so both cases are accepted. Leading `.` and `_` stay
 // disallowed, as npm has never permitted them.
 const PACKAGE_NAME_RE = /^(@[a-zA-Z0-9-~][a-zA-Z0-9-~._]*\/)?[a-zA-Z0-9-~][a-zA-Z0-9-._~]*$/;
+/**
+ * One pattern token per match: a maximal star run with a directly
+ * following `/` attached, or a single literal character. Shared by the
+ * matcher and the name-shape validation so the two agree on what a
+ * globstar-plus-`/` pair is.
+ */
+function tokenizePattern(pattern) {
+    return pattern.match(/\*{2,}\/?|\*|[^*]/g) ?? [];
+}
+/**
+ * Whether a wildcard pattern can produce a valid package name. Every star
+ * token is replaced with a default probe — `a` for a star run, nothing at
+ * all for a `**`-plus-`/` pair, mirroring its zero-segment match — and,
+ * since a valid name contains at most one scope (one leading `@` and one
+ * `/`), one globstar token at a time may additionally stand in for scope
+ * structure: a plain `**` probes as the scope's `@` (`@a`) or its `/`
+ * (`a/a`), and a `**`-plus-`/` pair as a segment (`a/`) or a whole scope
+ * prefix (`@a/`). The pattern is name-shaped when any substitution
+ * satisfies {@link PACKAGE_NAME_RE}. This is a deliberately conservative
+ * subset of what the matcher could match — a shape needing two tokens to
+ * take scope probes at once is rejected — and single `*` runs are never
+ * probed as scope structure, even though a lone star does match a leading
+ * `@` in the matcher: scope-crossing spellings must be written with `**`,
+ * so `'*' + '/utils'` stays rejected while `'**' + '/utils'` is accepted.
+ */
+function isNameShapedPattern(pattern) {
+    const tokens = tokenizePattern(pattern);
+    const filled = tokens.map(token => token[0] !== '*' ? token : token.endsWith('/') ? '' : 'a');
+    if (PACKAGE_NAME_RE.test(filled.join(''))) {
+        return true;
+    }
+    const withProbe = (index, probe) => filled
+        .map((token, i) => i === index ? probe : token)
+        .join('');
+    return tokens.some((token, i) => token[1] === '*'
+        && (token.endsWith('/') ? ['a/', '@a/'] : ['@a', 'a/a'])
+            .some(probe => PACKAGE_NAME_RE.test(withProbe(i, probe))));
+}
 export class InvalidEmbeddedPackageSpecError extends Error {
     /** The failure alone, without the `Invalid embedded package '<spec>':` prefix. */
     reason;
@@ -34,37 +150,54 @@ export class InvalidEmbeddedPackageSpecError extends Error {
     }
 }
 /**
- * Parses a `bundle.packages.embed` entry into a package name and an
- * optional exact version pin.
+ * Parses a `bundle.packages.embed` entry into a package name, an optional
+ * exact version pin and whether the entry excludes rather than selects.
  *
  * Accepts `name` (embed every lockfile version of the package) and
  * `name@version` with an exact semver version. The name may contain `*`
- * wildcards (`@acme/*`, `acme-*`, `@acme/*-utils`), each matching any run
- * of characters except `/`. Version ranges are rejected: the embedded
- * tarball must be the exact artifact the lockfile resolved, so a range has
- * nothing meaningful to select against. A leading `v` is stripped, but the
- * version is otherwise kept as written (including any build metadata) so
- * it compares exactly against lockfile versions.
+ * and `**` wildcards (`@acme/*`, `acme-*`, `**-foo`), matching as
+ * described on {@link EmbeddedPackageSpec.wildcard}. A `!`
+ * prefix (`!@acme/legacy`, `!@acme/*`,
+ * `!legacy@2.1.0`) marks the entry as an exclusion, subtracting from what
+ * the entries before it selected. Version ranges are rejected: the
+ * embedded tarball must be the exact artifact the lockfile resolved, so a
+ * range has nothing meaningful to select against. A leading `v` is
+ * stripped, but the version is otherwise kept as written (including any
+ * build metadata) so it compares exactly against lockfile versions.
  */
 export function parseEmbeddedPackageSpec(raw) {
     if (typeof raw !== 'string' || raw === '') {
         throw new InvalidEmbeddedPackageSpecError(String(raw), `must be a non-empty string`);
     }
+    // The `!` has to come off before anything else is read: on the raw
+    // `!@acme/foo` the version separator below would land on the scope marker
+    // at index 1 and parse the entry as name `!` at version `acme/foo`.
+    const exclude = raw.startsWith('!');
+    const pattern = exclude ? raw.slice(1) : raw;
+    if (pattern === '') {
+        throw new InvalidEmbeddedPackageSpecError(raw, `must name a package or pattern after '!'`);
+    }
     // A version separator is any `@` past the first character, which keeps the
     // scope marker of `@scope/name` intact.
-    const versionSeparator = raw.lastIndexOf('@');
-    const name = versionSeparator > 0 ? raw.slice(0, versionSeparator) : raw;
-    const rawVersion = versionSeparator > 0 ? raw.slice(versionSeparator + 1) : undefined;
-    // A wildcard name must still be name-shaped once every `*` stands in for
-    // name characters. (`*` itself appears in npm's legacy name charset, but
-    // no real-world package uses it; here it always means a wildcard.)
+    const versionSeparator = pattern.lastIndexOf('@');
+    const name = versionSeparator > 0 ? pattern.slice(0, versionSeparator) : pattern;
+    const rawVersion = versionSeparator > 0 ? pattern.slice(versionSeparator + 1) : undefined;
+    // A wildcard name must still be name-shaped once every star run stands in
+    // for name characters. (`*` itself appears in npm's legacy name charset,
+    // but no real-world package uses it; here it always means a wildcard.)
     const wildcard = name.includes('*');
-    if (!PACKAGE_NAME_RE.test(wildcard ? name.replace(/\*/g, 'a') : name)) {
-        throw new InvalidEmbeddedPackageSpecError(raw, `'${name}' is not a valid npm package name${wildcard ? ' pattern' : ''}`);
+    if (wildcard ? !isNameShapedPattern(name) : !PACKAGE_NAME_RE.test(name)) {
+        // A lone `*` next to `/` is the classic near-miss, since only `**`
+        // crosses the scope separator; point at the doubled spelling when
+        // promoting the star is all it takes to fix the pattern.
+        const promoted = name.replace(/(?<=^|[^*])\*(?=\/)/g, '**');
+        const hint = promoted !== name && isNameShapedPattern(promoted)
+            ? ` (a single '*' never crosses '/'; did you mean '${promoted}'?)`
+            : '';
+        throw new InvalidEmbeddedPackageSpecError(raw, `'${name}' is not a valid npm package name${wildcard ? ' pattern' : ''}${hint}`);
     }
-    const namePattern = wildcard ? compileNamePattern(name) : undefined;
     if (rawVersion === undefined) {
-        return { raw, name, namePattern };
+        return { raw, name, wildcard, exclude };
     }
     // Trim before validating: semver.valid() tolerates surrounding whitespace,
     // so an untrimmed version would pass validation yet never compare equal to
@@ -74,6 +207,42 @@ export function parseEmbeddedPackageSpec(raw) {
     if (semver.valid(version) === null) {
         throw new InvalidEmbeddedPackageSpecError(raw, `'${rawVersion}' is not an exact semver version (use 'name' or 'name@1.2.3')`);
     }
-    return { raw, name, version, namePattern };
+    return { raw, name, version, wildcard, exclude };
+}
+export class InvalidPackageNamePatternError extends Error {
+    constructor(raw, reason) {
+        super(`Invalid package name pattern '${raw}': ${reason}`);
+        this.name = 'InvalidPackageNamePatternError';
+    }
+}
+/**
+ * Parses a package name pattern: a package name that may contain `*`
+ * and `**` wildcards (`@acme/*`, `acme-*`, `**-foo`), matching as
+ * described on {@link EmbeddedPackageSpec.wildcard}. A `!` prefix
+ * marks the entry as an exclusion, subtracting from what the entries
+ * before it selected, exactly as in `bundle.packages.embed`. Unlike
+ * {@link parseEmbeddedPackageSpec} there are no `name@version` pins;
+ * they are rejected with a pointed message so an embed-style pin fails
+ * loudly instead of silently matching nothing.
+ */
+export function parsePackageNamePattern(raw) {
+    // The pin rejection must run before the delegation below, which would
+    // otherwise accept `name@version` the way embed does. The `!` comes off
+    // first so the scope marker of `!@scope/name` at index 1 is not read as
+    // a version separator; any `@` past the first character of what remains
+    // would be one.
+    if (typeof raw === 'string' && raw.replace(/^!/, '').lastIndexOf('@') > 0) {
+        throw new InvalidPackageNamePatternError(raw, `'name@version' pins are not supported here`);
+    }
+    try {
+        const { name, wildcard, exclude } = parseEmbeddedPackageSpec(raw);
+        return { name, wildcard, exclude };
+    }
+    catch (err) {
+        if (err instanceof InvalidEmbeddedPackageSpecError) {
+            throw new InvalidPackageNamePatternError(String(raw), err.reason);
+        }
+        throw err;
+    }
 }
 //# sourceMappingURL=spec.js.map

package/dist/services/embedded-packages/spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/spec.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AA0B3B;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAE,IAAyB,EAAE,WAAmB;IACpF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAA;AAClC,CAAC;AAED,SAAS,kBAAkB,CAAE,IAAY;IACvC,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SACxD,IAAI,CAAC,OAAO,CAAC,CAAA;IAChB,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAA;AACnC,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,+CAA+C;AAC/C,MAAM,eAAe,GAAG,oEAAoE,CAAA;AAE5F,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,kFAAkF;IACzE,MAAM,CAAQ;IAEvB,YAAa,IAAY,EAAE,MAAc;QACvC,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAA;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAE,GAAW;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,4BAA4B,CAAC,CAAA;IACtF,CAAC;IAED,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACxE,MAAM,UAAU,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAErF,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,+BAA+B,CACvC,GAAG,EACH,IAAI,IAAI,oCAAoC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEnE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACnC,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;IACzF,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,+BAA+B,CACvC,GAAG,EACH,IAAI,UAAU,+DAA+D,CAC9E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/spec.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAkD3B;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAwB,EACxB,WAAmB;IAEnB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAE,QAA8B,EAAE,IAAY;IAC9E,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,QAAQ,GAAG,CAAC,OAAO,CAAC,OAAO,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAE,IAAyB,EAAE,KAAiB;IAC9E,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;WAC1C,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAE,IAAyB,EAAE,KAAiB;IACrF,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;WAC1C,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;AACpG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,kBAAkB,CAAE,OAAe,EAAE,WAAmB;IAC/D,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAA;IAC5B,IAAI,GAAG,GAAc,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjD,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACb,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAc,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,SAAS,GAAG,KAAK,CAAA;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC9C,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,SAAS,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAA;YACxE,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAChG,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAA;YACtD,CAAC;QACH,CAAC;QACD,GAAG,GAAG,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;AACf,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,+CAA+C;AAC/C,MAAM,eAAe,GAAG,oEAAoE,CAAA;AAE5F;;;;;GAKG;AACH,SAAS,eAAe,CAAE,OAAe;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,mBAAmB,CAAE,OAAe;IAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7F,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,MAAM;SACvD,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;SAC9C,IAAI,CAAC,EAAE,CAAC,CAAA;IACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;WAC5C,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aACrD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,kFAAkF;IACzE,MAAM,CAAQ;IAEvB,YAAa,IAAY,EAAE,MAAc;QACvC,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAA;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAE,GAAW;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,4BAA4B,CAAC,CAAA;IACtF,CAAC;IAED,mEAAmE;IACnE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,+BAA+B,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAA;IAC5F,CAAC;IAED,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAChF,MAAM,UAAU,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEzF,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,mEAAmE;QACnE,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,IAAI,mBAAmB,CAAC,QAAQ,CAAC;YAC7D,CAAC,CAAC,mDAAmD,QAAQ,KAAK;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,IAAI,+BAA+B,CACvC,GAAG,EACH,IAAI,IAAI,oCAAoC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAChF,CAAA;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACzC,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;IACzF,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,+BAA+B,CACvC,GAAG,EACH,IAAI,UAAU,+DAA+D,CAC9E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAClD,CAAC;AAWD,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAa,GAAW,EAAE,MAAc;QACtC,KAAK,CAAC,iCAAiC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAA;QACzD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAA;IAC9C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAE,GAAW;IAClD,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,gBAAgB;IAChB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,8BAA8B,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAA;IAC7F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,+BAA+B,EAAE,CAAC;YACnD,MAAM,IAAI,8BAA8B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/services/embedded-packages/url.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Parses a URL that something is about to be fetched from, or returns
+ * undefined when nothing can be.
+ *
+ * The scheme has to be one this CLI actually fetches over: `ftp://host/x`
+ * parses and has a host, but axios cannot retrieve it, and tarball URLs
+ * read out of lockfiles and registry metadata are already held to the same
+ * http(s) rule. That also settles the shapes a bare parse lets through,
+ * such as `admin:s3cret@nexus.local/x` — the opaque scheme `admin:` with an
+ * empty host, and a credential sitting in what looks like a path. The host
+ * is checked as well, belt and braces: the WHATWG parser refuses a
+ * host-less `https://` today, and this rule means "a request can be made",
+ * which needs somewhere to send it.
+ *
+ * This decides both whether a request can be made and whether the value is
+ * safe to echo, which must be the same rule: a URL that reaches the network
+ * is one `redactUrl` can rebuild from parts that cannot carry a secret.
+ */
+export declare function parseFetchableUrl(url: string): URL | undefined;
+/**
+ * The rule `parseFetchableUrl` enforces, as a sentence for a message. Kept
+ * beside the check so the two cannot drift into describing different rules.
+ */
+export declare const FETCHABLE_URL_REQUIREMENT = "an absolute http or https URL with a host";
+/**
+ * Parses a URL that a path will be appended to, or returns undefined when
+ * appending would not do what it looks like.
+ *
+ * Everything `parseFetchableUrl` requires, plus no query and no fragment:
+ * those swallow whatever follows them. `https://host/npm/?token=abc` with
+ * `bar/-/bar-2.0.0.tgz` appended parses with its pathname still `/npm/` and
+ * the whole package path inside the query, so the request would go to the
+ * registry root and fail later as something that reads like the registry's
+ * fault. Excluding them is what makes "appending a path leaves the host and
+ * the path intact" true rather than nearly true.
+ */
+export declare function parseComposableUrl(url: string): URL | undefined;
+/** The rule `parseComposableUrl` enforces, as a sentence for a message. */
+export declare const COMPOSABLE_URL_REQUIREMENT = "an absolute http or https URL with a host, carrying no query or fragment";

package/dist/services/embedded-packages/url.js

@@ -0,0 +1,60 @@
+/**
+ * Parses a URL that something is about to be fetched from, or returns
+ * undefined when nothing can be.
+ *
+ * The scheme has to be one this CLI actually fetches over: `ftp://host/x`
+ * parses and has a host, but axios cannot retrieve it, and tarball URLs
+ * read out of lockfiles and registry metadata are already held to the same
+ * http(s) rule. That also settles the shapes a bare parse lets through,
+ * such as `admin:s3cret@nexus.local/x` — the opaque scheme `admin:` with an
+ * empty host, and a credential sitting in what looks like a path. The host
+ * is checked as well, belt and braces: the WHATWG parser refuses a
+ * host-less `https://` today, and this rule means "a request can be made",
+ * which needs somewhere to send it.
+ *
+ * This decides both whether a request can be made and whether the value is
+ * safe to echo, which must be the same rule: a URL that reaches the network
+ * is one `redactUrl` can rebuild from parts that cannot carry a secret.
+ */
+export function parseFetchableUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.host === '' || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')) {
+        return undefined;
+    }
+    return parsed;
+}
+/**
+ * The rule `parseFetchableUrl` enforces, as a sentence for a message. Kept
+ * beside the check so the two cannot drift into describing different rules.
+ */
+export const FETCHABLE_URL_REQUIREMENT = 'an absolute http or https URL with a host';
+/**
+ * Parses a URL that a path will be appended to, or returns undefined when
+ * appending would not do what it looks like.
+ *
+ * Everything `parseFetchableUrl` requires, plus no query and no fragment:
+ * those swallow whatever follows them. `https://host/npm/?token=abc` with
+ * `bar/-/bar-2.0.0.tgz` appended parses with its pathname still `/npm/` and
+ * the whole package path inside the query, so the request would go to the
+ * registry root and fail later as something that reads like the registry's
+ * fault. Excluding them is what makes "appending a path leaves the host and
+ * the path intact" true rather than nearly true.
+ */
+export function parseComposableUrl(url) {
+    // Tested on the raw string, not on `search` and `hash`: a URL ending in a
+    // bare `?` or `#` parses with both of those empty, yet still absorbs
+    // whatever is appended after the delimiter.
+    if (/[?#]/.test(url)) {
+        return undefined;
+    }
+    return parseFetchableUrl(url);
+}
+/** The rule `parseComposableUrl` enforces, as a sentence for a message. */
+export const COMPOSABLE_URL_REQUIREMENT = `${FETCHABLE_URL_REQUIREMENT}, carrying no query or fragment`;
+//# sourceMappingURL=url.js.map

package/dist/services/embedded-packages/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAE,GAAW;IAC5C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,2CAA2C,CAAA;AAEpF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAE,GAAW;IAC7C,0EAA0E;IAC1E,qEAAqE;IACrE,4CAA4C;IAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,yBAAyB,iCAAiC,CAAA"}

package/dist/services/playwright-project-bundler.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import semver from 'semver';
+import { PNPM_PATCHES_DIR } from './check-parser/patched-dependencies.js';
 import { detectNearestPackageJson } from './check-parser/package-files/package-manager.js';
 import { PackageJsonFile } from './check-parser/package-files/package-json-file.js';
 import { lineage } from './check-parser/package-files/walk.js';
@@ -108,23 +109,10 @@ export class PlaywrightProjectBundler {
                 workspaceMembers: workspaceInfo.members,
             }));
         }
-        // Embedded package tarballs live in the CLI cache, whose on-disk
-        // location (node_modules/.cache, a per-user dir, or CHECKLY_CACHE_DIR)
-        // never corresponds to the contract path the runner expects, so they
-        // carry an explicit archive path instead of relying on the strip
-        // prefix. The materializer memoizes, so concurrent bundles share one
-        // download run, and the Bundler dedupes registrations by archive path
-        // across checks.
-        const materializer = Session.getEmbeddedPackagesMaterializer();
-        if (materializer !== undefined) {
-            for (const tarball of await materializer.materialize()) {
-                files.push({
-                    filePath: tarball.filePath,
-                    physical: true,
-                    archivePath: tarball.archivePath,
-                });
-            }
-        }
+        // Embedded package tarballs are deliberately NOT part of a check's
+        // files: the Bundler materializes them once during finalize(), after
+        // the bundled lockfile has been pruned, so tarballs the shipped
+        // lockfile no longer references are never downloaded.
         return {
             browsers: pwConfigParsed.getBrowsers(),
             playwrightVersion,
@@ -141,12 +129,28 @@ export function normalizeVersion(v) {
 }
 export function getAutoIncludes(basePath, globCwd, packageManager, existingIncludes) {
     const autoIncludes = [];
-    if (packageManager.name === 'pnpm') {
-        const patchesDir = path.join(basePath, 'patches');
-        const alreadyIncluded = existingIncludes.some(p => path.resolve(globCwd, p).startsWith(patchesDir));
-        if (!alreadyIncluded) {
-            const patchesPattern = pathToPosix(path.join(path.relative(globCwd, basePath), 'patches', '*.patch'));
-            autoIncludes.push(patchesPattern);
+    // The prefix comparison appends a separator so a sibling directory whose
+    // name merely starts with the patches dir (e.g. `patches-archive`) does
+    // not suppress the auto-include.
+    const includesUnder = (dir) => existingIncludes.some(p => {
+        const resolved = path.resolve(globCwd, p);
+        return resolved === dir || resolved.startsWith(dir + path.sep);
+    });
+    // Dependency patches live in a conventional per-manager directory that
+    // the remote install (and the lockfile pruner's temp-dir install) needs
+    // alongside the manifests: `patches/` for pnpm and bun, `.yarn/patches`
+    // for Yarn Berry's patch: protocol. A patch kept at a nonconventional
+    // path makes the pruner fail closed with a warning instead.
+    const patchesDirByManager = {
+        pnpm: [PNPM_PATCHES_DIR],
+        bun: [PNPM_PATCHES_DIR],
+        yarn: ['.yarn', 'patches'],
+    };
+    const patchesSegments = patchesDirByManager[packageManager.name];
+    if (patchesSegments !== undefined) {
+        const patchesDir = path.join(basePath, ...patchesSegments);
+        if (!includesUnder(patchesDir)) {
+            autoIncludes.push(pathToPosix(path.join(path.relative(globCwd, basePath), ...patchesSegments, '*.patch')));
         }
     }
     return autoIncludes;