checkly 8.22.0 → 8.23.0

package/dist/services/check-parser/patched-dependencies.js

@@ -0,0 +1,428 @@
+import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import Debug from 'debug';
+import { isMap, parse as parseYaml, parseDocument } from 'yaml';
+import { pathToPosix } from '../util.js';
+const debug = Debug('checkly:cli:services:check-parser:patched-dependencies');
+/**
+ * Serialization options that make a `yaml` round trip of a pnpm lockfile
+ * byte-identical to what pnpm itself writes. `lineWidth: 0` disables the
+ * folding that would otherwise rewrap long `resolution:` lines, and
+ * `flowCollectionPadding: false` reproduces pnpm's unpadded `{integrity: ...}`
+ * spelling. Both are required; with either one at its default the serializer
+ * reformats lines it was not asked to touch.
+ */
+const YAML_STRINGIFY_OPTIONS = { lineWidth: 0, flowCollectionPadding: false };
+const PATCHED_DEPENDENCIES = 'patchedDependencies';
+/**
+ * The directory pnpm's own `pnpm patch-commit` writes patches to, relative to
+ * the workspace root. Shared so that the auto-include that bundles patches and
+ * the filtering that removes them cannot drift apart: widening one without the
+ * other would silently leave orphaned patch files in every bundle.
+ */
+export const PNPM_PATCHES_DIR = 'patches';
+/**
+ * Whether an archive path names a patch file the filtering may remove from a
+ * bundle: a `.patch` directly under {@link PNPM_PATCHES_DIR}. A declaration
+ * may point anywhere, including at a file bundled for an unrelated reason, so
+ * only the conventional location is removable.
+ */
+export function isRemovablePatchPath(archivePath) {
+    return new RegExp(`^${PNPM_PATCHES_DIR}/[^/]+\\.patch$`).test(archivePath);
+}
+/**
+ * Reads a config's `patchedDependencies` map. Returns an empty map when the
+ * config declares none, and `undefined` when the file cannot be parsed or the
+ * map is not shaped as expected — callers treat that as "do not filter".
+ */
+export function readPatchedDependencies(config) {
+    let parsed;
+    try {
+        parsed = config.kind === 'package.json'
+            ? JSON.parse(config.content)
+            // An empty or comment-only YAML document parses to null: an ordinary
+            // pnpm-workspace.yaml that declares no settings, not an unreadable file.
+            // JSON has no such spelling — JSON.parse throws on empty input.
+            : parseYaml(config.content) ?? {};
+    }
+    catch (err) {
+        debug(`Could not parse ${config.archivePath}: ${err}`);
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const container = config.kind === 'package.json'
+        ? parsed.pnpm
+        : parsed;
+    if (container === undefined || container === null) {
+        return [];
+    }
+    if (typeof container !== 'object' || Array.isArray(container)) {
+        return undefined;
+    }
+    const section = container[PATCHED_DEPENDENCIES];
+    if (section === undefined || section === null) {
+        return [];
+    }
+    if (typeof section !== 'object' || Array.isArray(section)) {
+        return undefined;
+    }
+    const declarations = [];
+    for (const [key, value] of Object.entries(section)) {
+        // pnpm only accepts a path string here. Anything else is a config this
+        // code does not understand, so it declines to touch the bundle at all.
+        if (typeof value !== 'string') {
+            return undefined;
+        }
+        declarations.push({ key, patchPath: value });
+    }
+    return declarations;
+}
+/**
+ * Reads a lockfile's `patchedDependencies` section as key → patch hash.
+ * pnpm 10 records `{ hash, path }` objects and pnpm 11 a bare hash string;
+ * both are accepted. Returns `undefined` when the lockfile cannot be parsed.
+ */
+export function readLockfilePatchHashes(lockfileContent) {
+    let parsed;
+    try {
+        parsed = parseYaml(lockfileContent);
+    }
+    catch (err) {
+        debug(`Could not parse the lockfile: ${err}`);
+        return undefined;
+    }
+    const hashes = new Map();
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const section = parsed[PATCHED_DEPENDENCIES];
+    if (section === undefined || section === null) {
+        return hashes;
+    }
+    if (typeof section !== 'object' || Array.isArray(section)) {
+        return undefined;
+    }
+    for (const [key, value] of Object.entries(section)) {
+        const hash = typeof value === 'string' ? value : value?.hash;
+        if (typeof hash !== 'string' || hash === '') {
+            return undefined;
+        }
+        hashes.set(key, hash);
+    }
+    return hashes;
+}
+/**
+ * Finds the single config whose `patchedDependencies` the bundle should be
+ * filtered against, or `undefined` when there is nothing to do or the configs
+ * cannot be used.
+ *
+ * Declining when more than one config declares a non-empty map is deliberate:
+ * pnpm picks ONE site and ignores the other wholesale, and which site wins
+ * depends on the pnpm major (10 prefers `package.json`, 11 ignores it
+ * entirely). Editing the losing site is not merely useless — emptying the
+ * winning one would promote the loser, changing which patches apply.
+ */
+function findDeclaringConfig(configs) {
+    const declaring = [];
+    for (const config of configs) {
+        const declarations = readPatchedDependencies(config);
+        if (declarations === undefined) {
+            return undefined;
+        }
+        if (declarations.length > 0) {
+            declaring.push({ config, declarations });
+        }
+    }
+    if (declaring.length > 1) {
+        debug('More than one config declares patchedDependencies; leaving the bundle alone');
+        return undefined;
+    }
+    return declaring[0];
+}
+/**
+ * Whether a patch declaration still applies to something in `lockfileContent`.
+ *
+ * pnpm records the applied patch by hash: the `patchedDependencies` section
+ * pins `key → hash`, and that hash reappears as `patch_hash=<hash>` in the
+ * importer, snapshot and package entries of every package the patch was
+ * applied to. A declaration that applies to nothing keeps its section entry —
+ * the section mirrors the config, not the dependency graph — but its hash
+ * appears nowhere else, which makes the marker the sole discriminator. A
+ * whole-file search is safe because the section's own value never contains
+ * the literal `patch_hash=`.
+ */
+function hasMarker(hash, lockfileContent) {
+    return hash !== undefined && lockfileContent.includes(`patch_hash=${hash}`);
+}
+/**
+ * Whether the prune is what stopped a patch from applying.
+ *
+ * Deliberately differential rather than a bare absence test on the pruned
+ * lockfile. Absence alone would mean that a lockfile this module cannot read
+ * markers out of — a future pnpm that keeps the `9` version string but spells
+ * them differently — reads as "nothing applies anywhere" and every declaration
+ * is stripped at once, which is the one outcome the module exists to prevent.
+ * Requiring the marker in the original first makes that case drop nothing.
+ *
+ * The pruned side falls back to the original's hash because a lockfile can
+ * lose the `patchedDependencies` section while keeping its markers; without
+ * the fallback such a patch would read as no longer applied.
+ */
+function droppedByPrune(key, prunedHashes, originalHashes, originalLockfileContent, prunedLockfileContent) {
+    const originalHash = originalHashes.get(key);
+    if (!hasMarker(originalHash, originalLockfileContent)) {
+        return false;
+    }
+    return !hasMarker(prunedHashes.get(key) ?? originalHash, prunedLockfileContent);
+}
+/**
+ * Resolves a declared patch path to its archive path, or `undefined` when it
+ * escapes the workspace root (the archive's own root) and therefore does not
+ * name a bundle entry this code may remove.
+ */
+function patchArchivePath(patchPath) {
+    // Traversal is judged on the path AS WRITTEN, before any normalization:
+    // pathToPosix normalizes internally, which collapses `..` segments and would
+    // hide a path that leaves the root and comes back
+    // (`patches/sub/../../package.json` collapses to `package.json`, naming a
+    // bundle file that is not a patch at all).
+    if (patchPath.split(/[/\\]/).includes('..')) {
+        return undefined;
+    }
+    const normalized = pathToPosix(patchPath);
+    if (path.posix.isAbsolute(normalized)) {
+        return undefined;
+    }
+    // `.` (what an empty path normalizes to) and a trailing slash name a
+    // directory, not a patch file, so they must never reach a caller that
+    // deletes bundle entries.
+    if (normalized === '.' || normalized.endsWith('/')) {
+        return undefined;
+    }
+    // pathToPosix only rewrites the platform's own separator and strips C:/D:
+    // drive prefixes, so a spelling from another platform can survive looking
+    // relative yet still denote a path this comparison cannot align with.
+    if (normalized.includes('\\') || /^[A-Za-z]:/.test(normalized)) {
+        return undefined;
+    }
+    return normalized;
+}
+/**
+ * Computes the patch declarations a bundle should stop shipping, together with
+ * the rewritten files that carry the removal. Returns `undefined` whenever the
+ * evidence is incomplete or an edit cannot be verified — the caller then ships
+ * the bundle unchanged, which is always safe.
+ */
+export function planPatchFilter(options) {
+    const { configs, originalLockfileContent, prunedLockfileContent } = options;
+    const declaring = findDeclaringConfig(configs);
+    if (declaring === undefined) {
+        return undefined;
+    }
+    const originalHashes = readLockfilePatchHashes(originalLockfileContent);
+    const prunedHashes = readLockfilePatchHashes(prunedLockfileContent);
+    if (originalHashes === undefined || prunedHashes === undefined) {
+        return undefined;
+    }
+    const unusedKeys = [];
+    // Both sets hold ARCHIVE paths, never the raw spelling: two declarations can
+    // point at one file with different spellings (`./patches/x.patch` and
+    // `patches/x.patch`), and comparing raw strings would drop a file a
+    // surviving declaration still needs.
+    const keptArchivePaths = new Set();
+    const candidateArchivePaths = new Set();
+    // A surviving declaration whose path resolves outside the bundle root cannot
+    // be compared against the in-root candidates at all, so no file is dropped
+    // in that case. The declarations and lockfile entries still go; an
+    // unreferenced patch file left in the bundle is inert.
+    let keptPathEscapesRoot = false;
+    for (const declaration of declaring.declarations) {
+        const archivePath = patchArchivePath(declaration.patchPath);
+        // A key the project's own lockfile never recorded is no evidence of
+        // anything: the pnpm that wrote it may simply not read the site the key
+        // was declared in. Removing it would silently unpatch a dependency that a
+        // different pnpm on the runner would patch.
+        const recorded = originalHashes.has(declaration.key);
+        if (!recorded) {
+            debug(`Patch '${declaration.key}' is not recorded in the project's lockfile; leaving it alone`);
+        }
+        const dropped = recorded && droppedByPrune(declaration.key, prunedHashes, originalHashes, originalLockfileContent, prunedLockfileContent);
+        if (!dropped) {
+            if (archivePath === undefined) {
+                keptPathEscapesRoot = true;
+            }
+            else {
+                keptArchivePaths.add(archivePath);
+            }
+            continue;
+        }
+        unusedKeys.push(declaration.key);
+        if (archivePath === undefined) {
+            debug(`Patch path '${declaration.patchPath}' resolves outside the bundle root; leaving it alone`);
+        }
+        else {
+            candidateArchivePaths.add(archivePath);
+        }
+    }
+    if (unusedKeys.length === 0) {
+        return undefined;
+    }
+    const removed = new Set(unusedKeys);
+    const configContent = rewriteConfig(declaring.config, removed);
+    if (configContent === undefined) {
+        return undefined;
+    }
+    const rewrittenConfig = {
+        archivePath: declaring.config.archivePath,
+        content: configContent,
+    };
+    const lockfileContent = rewriteYamlSection(prunedLockfileContent, removed);
+    if (lockfileContent === undefined) {
+        return undefined;
+    }
+    // Two declarations may share a patch file; keep it while any survivor still
+    // points at it.
+    const droppedPatchPaths = keptPathEscapesRoot
+        ? []
+        : Array.from(candidateArchivePaths).filter(archivePath => !keptArchivePaths.has(archivePath));
+    return { unusedKeys, rewrittenConfig, droppedPatchPaths, lockfileContent };
+}
+function rewriteConfig(config, removed) {
+    return config.kind === 'package.json'
+        ? rewritePackageJson(config.content, removed)
+        : rewriteYamlSection(config.content, removed);
+}
+/**
+ * Removes keys from a YAML document's top-level `patchedDependencies` map,
+ * dropping the map itself once it empties. Shared by `pnpm-workspace.yaml` and
+ * `pnpm-lock.yaml`, whose sections have the same shape.
+ *
+ * The result is verified structurally before it is returned: a serializer that
+ * reformatted or dropped anything else would ship silently, and for the
+ * lockfile it would also invalidate the verification the pruner already ran
+ * over the bytes it produced.
+ */
+export function rewriteYamlSection(content, removed) {
+    // parseDocument collects syntax errors on the document rather than throwing,
+    // so `errors` — not a try/catch — is what rejects malformed input here.
+    const doc = parseDocument(content);
+    if (doc.errors.length > 0) {
+        debug(`Could not parse YAML for rewriting: ${doc.errors[0].message}`);
+        return undefined;
+    }
+    const section = doc.get(PATCHED_DEPENDENCIES);
+    if (section === undefined || section === null) {
+        // Nothing to delete. The prune can legitimately return a lockfile that
+        // carries no section at all, in which case only the config needs editing.
+        return content;
+    }
+    if (!isMap(section)) {
+        return undefined;
+    }
+    for (const key of removed) {
+        doc.deleteIn([PATCHED_DEPENDENCIES, key]);
+    }
+    if (section.items.length === 0) {
+        doc.delete(PATCHED_DEPENDENCIES);
+    }
+    const rewritten = doc.toString(YAML_STRINGIFY_OPTIONS);
+    return verifyRewrite(content, rewritten, removed, parseYaml);
+}
+function rewritePackageJson(content, removed) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (err) {
+        debug(`Could not parse package.json for rewriting: ${err}`);
+        return undefined;
+    }
+    const section = parsed?.pnpm?.[PATCHED_DEPENDENCIES];
+    if (section === null || typeof section !== 'object') {
+        return undefined;
+    }
+    for (const key of removed) {
+        delete section[key];
+    }
+    if (Object.keys(section).length === 0) {
+        delete parsed.pnpm[PATCHED_DEPENDENCIES];
+    }
+    // Unlike the YAML path, which is byte-preserving, this reformats the whole
+    // manifest. The bundled copy is only ever an install input — nothing reads it
+    // back as text — and matching the original's formatting would mean carrying a
+    // JSON editor for no behavioral gain.
+    const rewritten = JSON.stringify(parsed, null, 2);
+    return verifyRewrite(content, rewritten, removed, JSON.parse);
+}
+/**
+ * Asserts that a rewrite changed nothing but the intended keys, by comparing
+ * the reparsed result against the reparsed original with those keys deleted.
+ * A config can carry anything else pnpm understands — `catalog:`, `overrides`,
+ * `onlyBuiltDependencies` — and nothing downstream would notice it being
+ * mangled, so the check is what makes the edit safe to ship.
+ *
+ * Exported so that the rejection path — which no legitimate serializer output
+ * reaches, and which therefore cannot be driven through the callers — is
+ * directly testable.
+ *
+ * Package pruning keeps an analogous fail-closed verifier in
+ * package-prune.ts (`verifyPrunedManifest`); hardening either against a
+ * manifest quirk likely applies to both.
+ */
+export function verifyRewrite(original, rewritten, removed, parse) {
+    let expected;
+    let actual;
+    try {
+        expected = parse(original);
+        actual = parse(rewritten);
+    }
+    catch (err) {
+        debug(`Could not reparse a rewritten file for verification: ${err}`);
+        return undefined;
+    }
+    for (const container of [expected, expected?.pnpm]) {
+        const section = container?.[PATCHED_DEPENDENCIES];
+        if (section === null || typeof section !== 'object') {
+            continue;
+        }
+        for (const key of removed) {
+            delete section[key];
+        }
+        if (Object.keys(section).length === 0) {
+            delete container[PATCHED_DEPENDENCIES];
+        }
+    }
+    if (!isDeepStrictEqual(expected, actual)) {
+        debug('A rewritten file did not match the expected structure; leaving the bundle alone');
+        return undefined;
+    }
+    return rewritten;
+}
+/**
+ * Reports declarations the shipped bundle still carries but its shipped
+ * lockfile no longer records — the precondition for the remote install failing
+ * with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`.
+ *
+ * Scoped to keys the project's original lockfile recorded, so a declaration
+ * the project's own pnpm never honoured is not reported as a bundling problem.
+ */
+export function findUnrepairedPatchKeys(options) {
+    const { configs, originalLockfileContent, shippedLockfileContent } = options;
+    const originalHashes = readLockfilePatchHashes(originalLockfileContent);
+    const shippedHashes = readLockfilePatchHashes(shippedLockfileContent);
+    if (originalHashes === undefined || shippedHashes === undefined) {
+        return [];
+    }
+    const unrepaired = new Set();
+    for (const config of configs) {
+        for (const declaration of readPatchedDependencies(config) ?? []) {
+            if (originalHashes.has(declaration.key) && !shippedHashes.has(declaration.key)) {
+                unrepaired.add(declaration.key);
+            }
+        }
+    }
+    return Array.from(unrepaired).sort();
+}
+//# sourceMappingURL=patched-dependencies.js.map

package/dist/services/check-parser/patched-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patched-dependencies.js","sourceRoot":"","sources":["../../../src/services/check-parser/patched-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,KAAK,GAAG,KAAK,CAAC,wDAAwD,CAAC,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAW,CAAA;AAEtF,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAE,WAAmB;IACvD,OAAO,IAAI,MAAM,CAAC,IAAI,gBAAgB,iBAAiB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAC5E,CAAC;AAiED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAE,MAAuB;IAC9D,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,cAAc;YACrC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5B,qEAAqE;YACrE,yEAAyE;YACzE,gEAAgE;YAChE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,mBAAmB,MAAM,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC,CAAA;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,cAAc;QAC9C,CAAC,CAAE,MAA8B,CAAC,IAAI;QACtC,CAAC,CAAC,MAAM,CAAA;IACV,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,OAAO,GAAI,SAAqC,CAAC,oBAAoB,CAAC,CAAA;IAC5E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,YAAY,GAAuB,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QAC9E,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAE,eAAuB;IAC9D,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAA;QAC7C,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,OAAO,GAAI,MAAkC,CAAC,oBAAoB,CAAC,CAAA;IACzE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAA8B,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAA;QAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,OAA0B;IAE1B,MAAM,SAAS,GAAyE,EAAE,CAAA;IAE1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;QACpD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,6EAA6E,CAAC,CAAA;QACpF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,SAAS,CAAC,CAAC,CAAC,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAE,IAAwB,EAAE,eAAuB;IACnE,OAAO,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CACrB,GAAW,EACX,YAAiC,EACjC,cAAmC,EACnC,uBAA+B,EAC/B,qBAA6B;IAE7B,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5C,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,EAAE,qBAAqB,CAAC,CAAA;AACjF,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAE,SAAiB;IAC1C,wEAAwE;IACxE,6EAA6E;IAC7E,kDAAkD;IAClD,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,qEAAqE;IACrE,sEAAsE;IACtE,0BAA0B;IAC1B,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAE,OAA+B;IAC9D,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAA;IAE3E,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,uBAAuB,CAAC,CAAA;IACvE,MAAM,YAAY,GAAG,uBAAuB,CAAC,qBAAqB,CAAC,CAAA;IACnE,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,6EAA6E;IAC7E,sEAAsE;IACtE,oEAAoE;IACpE,qCAAqC;IACrC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/C,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,uDAAuD;IACvD,IAAI,mBAAmB,GAAG,KAAK,CAAA;IAE/B,KAAK,MAAM,WAAW,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAE3D,oEAAoE;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,UAAU,WAAW,CAAC,GAAG,+DAA+D,CAAC,CAAA;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,IAAI,cAAc,CACxC,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,qBAAqB,CAC9F,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,mBAAmB,GAAG,IAAI,CAAA;YAC5B,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACnC,CAAC;YACD,SAAQ;QACV,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,eAAe,WAAW,CAAC,SAAS,sDAAsD,CAAC,CAAA;QACnG,CAAC;aAAM,CAAC;YACN,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAEnC,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,eAAe,GAAkB;QACrC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW;QACzC,OAAO,EAAE,aAAa;KACvB,CAAA;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;IAC1E,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,4EAA4E;IAC5E,gBAAgB;IAChB,MAAM,iBAAiB,GAAG,mBAAmB;QAC3C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IAE/F,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAA;AAC5E,CAAC;AAED,SAAS,aAAa,CAAE,MAAuB,EAAE,OAAoB;IACnE,OAAO,MAAM,CAAC,IAAI,KAAK,cAAc;QACnC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAE,OAAe,EAAE,OAAoB;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;QACrE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,uEAAuE;QACvE,0EAA0E;QAC1E,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAA;IACtD,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAE,OAAe,EAAE,OAAoB;IAChE,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAA;QAC3D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,CAAA;IACpD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC1C,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,sCAAsC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACjD,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,SAAiB,EACjB,OAAoB,EACpB,KAA+B;IAE/B,IAAI,QAAa,CAAA;IACjB,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC1B,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAA;QACpE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,oBAAoB,CAAC,CAAA;QACjD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,iFAAiF,CAAC,CAAA;QACxF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAE,OAAuC;IAC9E,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAA;IAE5E,MAAM,cAAc,GAAG,uBAAuB,CAAC,uBAAuB,CAAC,CAAA;IACvE,MAAM,aAAa,GAAG,uBAAuB,CAAC,sBAAsB,CAAC,CAAA;IACrE,IAAI,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,WAAW,IAAI,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/E,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;AACtC,CAAC"}

package/dist/services/checkly-config-loader.d.ts

@@ -5,6 +5,8 @@ import type { Region } from '../index.js';
 import { ReporterType } from '../reporters/reporter.js';
 import { PlaywrightConfig } from '../constructs/playwright-config.js';
 import { FileLoader } from '../loader/index.js';
+import { BundlePackagesPrune } from './check-parser/package-prune.js';
+import { Registries } from './runner/registries.js';
 export type CheckConfigDefaults = Pick<CheckProps, 'activated' | 'alertChannels' | 'alertEscalationPolicy' | 'doubleCheck' | 'frequency' | 'locations' | 'muted' | 'privateLocations' | 'retryStrategy' | 'shouldFail' | 'tags'> & Pick<RuntimeCheckProps, 'environmentVariables' | 'runtimeId'> & {
     playwrightConfig?: PlaywrightConfig;
 };
@@ -12,7 +14,7 @@ export type PlaywrightSlimmedProp = Pick<PlaywrightCheckProps, 'name' | 'activat
     logicalId: string;
     playwrightConfigPath?: string;
 };
-export type ChecklyConfig = {
+export type ChecklyConfig<UpstreamName extends string = string> = {
     /**
      * Friendly name for your project.
      */
@@ -86,19 +88,117 @@ export type ChecklyConfig = {
              * Each entry is a package name (`'@acme/private-utils'`), which embeds
              * every version of that package found in the workspace lockfile, or an
              * exact `name@version` pin (`'legacy-private-pkg@2.1.0'`). Names may
-             * contain `*` wildcards (`'@acme/*'`, `'acme-*'`); a wildcard never
-             * crosses the `/` scope separator. List every package the runner
+             * contain `*` wildcards (`'@acme/*'`, `'acme-*'`); a single `*` never
+             * crosses the `/` scope separator, while a `**` does — `'**'` matches
+             * every package, and `'**-foo'` matches names ending in `-foo` in any
+             * scope or none. Directly before a `/`, a `**` may together with that
+             * `/` also match nothing, glob-style: `'**' + '/utils'` (one string;
+             * split here only because `*` followed by `/` would end this comment)
+             * matches both `utils` and `@acme/utils`. (Earlier CLI releases
+             * treated a run of stars as a single `*`.) List every package the
+             * runner
              * cannot fetch, including private packages that only appear as
              * transitive dependencies of other private packages — dependencies of
              * listed packages are not embedded automatically.
              *
-             * Only npm and pnpm are supported at this time: packages are resolved
-             * against the workspace lockfile (`pnpm-lock.yaml` or
-             * `package-lock.json`) and always verified against its recorded
-             * integrity hashes. Changing the resolved set of embedded packages
-             * invalidates the runner's dependency cache.
+             * A `!` prefix turns an entry into an exclusion, which removes the
+             * packages it matches from what the entries *before* it selected.
+             * Entries therefore apply in order: `['@acme/*', '!@acme/legacy']`
+             * embeds the whole scope except `@acme/legacy`, while the reverse
+             * order embeds the whole scope, because the exclusion runs before
+             * anything has been selected. An exclusion that removes nothing is a
+             * no-op rather than an error. Removing every package an entry
+             * selected also silences that entry: no "not found" error, and no
+             * "cannot be embedded" warning even for packages it matched but did
+             * not exclude — run with `DEBUG='checkly:cli:services:embedded-packages'`
+             * to see what it reached. Since exclusions only subtract, a list of
+             * nothing but exclusions selects nothing; a configuration whose
+             * entries select no packages at all is reported as a warning.
+             *
+             * Only npm, pnpm, bun and Yarn Berry are supported at this time:
+             * packages are resolved against the workspace lockfile
+             * (`pnpm-lock.yaml`, `package-lock.json`, the text `bun.lock` —
+             * bun's binary `bun.lockb` is not supported — or a Yarn Berry
+             * `yarn.lock`; Yarn Classic v1 lockfiles are not) and always
+             * verified against its recorded integrity hashes. Yarn Berry
+             * lockfiles record no npm tarball integrity, so it is resolved from
+             * the registry's package metadata instead — one small metadata
+             * request per embedded package on every deploy, even with a warm
+             * cache. Downloads read registry credentials from `npm_config_*`
+             * environment variables, the project, workspace-root and user
+             * `.npmrc` files, and pnpm's global `auth.ini` (where `pnpm login`
+             * writes tokens on pnpm 11 and later), including the
+             * scope-qualified keys `pnpm login --scope` writes. bun or yarn
+             * users whose credentials live solely in `bunfig.toml` or
+             * `.yarnrc.yml` must duplicate them into `.npmrc` or set
+             * `npm_config_*` — referencing a token through an environment
+             * variable (`${NPM_TOKEN}`), never as plaintext, because `.npmrc`
+             * is uploaded with the code bundle. When the bundled lockfile is pruned to the code
+             * bundle's contents, the embedded set follows it: packages the pruned
+             * lockfile no longer references — dependencies of workspace members
+             * that are not part of the bundle — are neither embedded nor
+             * downloaded, even if an entry matches them. That usually means the
+             * runner does not need the package at all; if the checks genuinely
+             * need it, make the depending workspace member part of the bundle
+             * rather than disabling pruning (`CHECKLY_LOCKFILE_PRUNE=0` restores
+             * the unfiltered set, as a last resort). Changing the resolved set of
+             * embedded packages invalidates the runner's dependency cache.
              */
             embed?: string[];
+            /**
+             * Dependencies to remove from the `package.json` files shipped inside
+             * the code bundle — the workspace root's and every bundled workspace
+             * member's. Applies to Playwright Check Suites only. The files on
+             * disk are never modified; only the bundled copies are rewritten.
+             *
+             * The manifests are rewritten before the bundled lockfile is pruned
+             * to the code bundle's contents, so the removed dependencies fall out
+             * of the bundled lockfile too. This is the escape hatch for
+             * dependencies that lockfile pruning alone cannot drop: with pnpm's
+             * `auto-install-peers`, a bundled member's unused `peerDependencies`
+             * are resolved as real dependencies of the regenerated lockfile even
+             * though the bundled code never imports them. Because the rewritten
+             * manifests only make sense next to a matching lockfile, the option
+             * requires lockfile pruning: if the bundled lockfile cannot be pruned
+             * in the same run — an unsupported package manager, a failed
+             * regeneration, or `CHECKLY_LOCKFILE_PRUNE=0` — the original
+             * manifests ship unchanged, with a warning. A bundle that ships no
+             * lockfile has nothing to fall out of sync with, so the pruned
+             * manifests always ship there.
+             *
+             * Accepts either an array of package name patterns, removed from
+             * every dependency class (`dependencies`, `devDependencies`,
+             * `peerDependencies` and `optionalDependencies`), or an object keyed
+             * by dependency class whose values are `true` (remove the whole
+             * class) or a pattern array (remove matching entries from that class
+             * only). Names may contain `*` wildcards (`'@acme/*'`, `'acme-*'`);
+             * a single `*` never crosses the `/` scope separator, so a bare
+             * `'*'` matches only unscoped names, while a `**` does cross it —
+             * to remove a whole class, use `true` or `['**']`, not `['*']`.
+             * Wildcards follow `bundle.packages.embed`'s rules, including the
+             * glob-style zero-segment match of a `**` directly before a `/`.
+             * (Earlier CLI releases treated a run of stars as a single `*`.)
+             * A `!` prefix turns an entry into an exclusion that
+             * removes what it matches from the entries *before* it selected,
+             * with `bundle.packages.embed`'s order-sensitive semantics:
+             * `['@acme/*', '!@acme/keep']` removes the scope except
+             * `@acme/keep`, while the reverse order removes the whole scope
+             * because the exclusion runs before anything has been selected. To
+             * remove a whole class *except* some packages, select everything
+             * first: `['**', '!@acme/keep']`.
+             * `true` cannot be combined with exclusions. Unlike
+             * `bundle.packages.embed` there are no
+             * `name@version` pins; they are rejected at config load. Removed
+             * `peerDependencies` take their `peerDependenciesMeta` entries with
+             * them, and `peerDependencies: true` clears `peerDependenciesMeta`
+             * entirely.
+             *
+             * Pruning is not validated against the code: you are responsible for
+             * not removing anything the bundled code actually needs at runtime.
+             * A pattern that matches nothing is not an error. Changing the
+             * pruned output invalidates the runner's dependency cache.
+             */
+            prune?: BundlePackagesPrune;
         };
     };
     /**
@@ -113,8 +213,10 @@ export type ChecklyConfig = {
         dependencyCache?: {
             /**
              * Optional value mixed into the code bundle's cache hash in addition
-             * to its usual inputs (lockfile, package.json and .npmrc files, and
-             * the resolved `bundle.packages.embed` tarball set).
+             * to its usual inputs — the workspace's dependency-install inputs.
+             * The exhaustive input list lives with the hash itself; see
+             * `ComposeCacheHashInput` in
+             * `services/check-parser/cache-hash.ts`.
              * Change the value to force runners to reinstall the bundle's
              * dependencies. Setting it for the first time invalidates the cache
              * once. Numbers must be safe integers; unset and empty string leave
@@ -130,6 +232,58 @@ export type ChecklyConfig = {
             version?: string | number;
         };
     };
+    /**
+     * Configuration applied on the Checkly runner when it executes checks.
+     */
+    runner?: {
+        /**
+         * Registry routing for the dependency install of a Playwright Check
+         * Suite code bundle. Use this when the registries your `.npmrc` (or
+         * `pnpm-workspace.yaml` / `.yarnrc.yml`) points at resolve fine on
+         * the machine running the CLI but are unreachable from Checkly
+         * runners — e.g. a VPN-only mirror. When set, the runner installs
+         * packages through a local registry that selects upstreams according
+         * to these rules instead of the registries named in bundled config
+         * files; embedded packages (`bundle.packages.embed`) always take
+         * priority regardless of the rules. Applies to Playwright Check
+         * Suites only, and only on the runner: operations on the machine
+         * running the CLI — embedded-package downloads, lockfile pruning —
+         * still read `.npmrc` and `npm_config_*` credentials.
+         *
+         * `upstreams` names the registries the runner may fetch from. Each
+         * needs a base `url` (an absolute http(s) URL without query,
+         * fragment or inline credentials, since package paths are appended
+         * to it) and may carry bearer `auth`. An auth token must be exactly
+         * one environment variable reference in `${VAR}` syntax (e.g.
+         * `'${NPM_TOKEN}'`, in single quotes so the shell-like syntax is not
+         * expanded locally): the value is resolved from the check's
+         * environment variables on the runner, so the secret value appears
+         * in neither the config nor the uploaded code bundle. Any literal
+         * token content is rejected at config load.
+         *
+         * `packages` routes package names to upstreams, first match wins,
+         * top-down. Patterns use the same wildcard syntax as
+         * `bundle.packages.embed` (a single `*` never crosses the `/` scope
+         * separator, `**` does), but no `!` exclusions and no
+         * `name@version` pins. Each rule lists one or more upstream names
+         * tried in order — the first upstream that serves the package wins,
+         * and a 404 or unreachable upstream falls through to the next
+         * upstream in the same rule, never to a later rule (a broader rule
+         * as fallback would leak private package names to its upstreams).
+         * The last rule must be the match-all rule
+         * (`{ pattern: '**', ... }`) so every package has a route; a rule
+         * placed after a match-all could never apply and is rejected.
+         * Changing this configuration invalidates the runner's dependency
+         * cache.
+         *
+         * `defineConfig` type-checks that every upstream name used in
+         * `packages` is defined under `upstreams`; define the registries
+         * object inline in the config literal, since the check relies on
+         * type inference from the `upstreams` keys. The same rules are also
+         * enforced at config load for plain-JS configs.
+         */
+        registries?: Registries<UpstreamName>;
+    };
     /**
      * CLI default configuration properties.
      */