renovate 42.95.1 → 43.0.1

package/dist/_virtual/rolldown_runtime.js

@@ -1,11 +1,7 @@
+import { createRequire } from "node:module";
+
 //#region rolldown:runtime
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __exportAll = (all, symbols) => {
 	let target = {};
@@ -20,28 +16,7 @@ var __exportAll = (all, symbols) => {
 	}
 	return target;
 };
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") {
-		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-			key = keys[i];
-			if (!__hasOwnProp.call(to, key) && key !== except) {
-				__defProp(to, key, {
-					get: ((k) => from[k]).bind(null, key),
-					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-				});
-			}
-		}
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
-
-exports.__commonJSMin = __commonJSMin;
-exports.__esmMin = __esmMin;
-exports.__exportAll = __exportAll;
-exports.__toESM = __toESM;
+export { __commonJSMin, __exportAll, __require };

package/dist/config/app-strings.js

@@ -1,9 +1,7 @@
-const require_rolldown_runtime = require('../_virtual/rolldown_runtime.js');
-const require_regex = require('../util/regex.js');
-let _sindresorhus_is = require("@sindresorhus/is");
+import { regEx } from "../util/regex.js";
+import { isNonEmptyString } from "@sindresorhus/is";
 
 //#region lib/config/app-strings.ts
-require_regex.init_regex();
 const configFileNames = [
 	"renovate.json",
 	"renovate.json5",
@@ -22,8 +20,8 @@ function setUserConfigFileNames(fileNames) {
 }
 function getConfigFileNames(platform) {
 	let filteredConfigFileNames = [...configFileNames];
-	if ((0, _sindresorhus_is.isNonEmptyString)(platform)) {
-		const platfromRe = require_regex.regEx("\\.(?<platform>.*)\\/renovate\\.json[5]?$");
+	if (isNonEmptyString(platform)) {
+		const platfromRe = regEx("\\.(?<platform>.*)\\/renovate\\.json[5]?$");
 		filteredConfigFileNames = configFileNames.filter((filename) => {
 			const matchResult = platfromRe.exec(filename);
 			if (!matchResult) return true;
@@ -39,6 +37,5 @@ function getConfigFileNames(platform) {
 }
 
 //#endregion
-exports.getConfigFileNames = getConfigFileNames;
-exports.setUserConfigFileNames = setUserConfigFileNames;
+export { getConfigFileNames, setUserConfigFileNames };
 //# sourceMappingURL=app-strings.js.map

package/dist/config/app-strings.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-strings.js","names":["regEx"],"sources":["../../lib/config/app-strings.ts"],"sourcesContent":["import { isNonEmptyString } from '@sindresorhus/is';\nimport type { PlatformId } from '../constants/index.ts';\nimport { regEx } from '../util/regex.ts';\n\nconst configFileNames = [\n  'renovate.json',\n  'renovate.json5',\n  '.github/renovate.json',\n  '.github/renovate.json5',\n  '.gitlab/renovate.json',\n  '.gitlab/renovate.json5',\n  '.renovaterc',\n  '.renovaterc.json',\n  '.renovaterc.json5',\n  'package.json',\n];\n\nlet userAddedConfigFileNames: string[] = [];\n\nexport function setUserConfigFileNames(fileNames: string[]): void {\n  userAddedConfigFileNames = fileNames;\n}\n\nexport function getConfigFileNames(platform?: PlatformId): string[] {\n  let filteredConfigFileNames = [...configFileNames];\n\n  if (isNonEmptyString(platform)) {\n    const platfromRe = regEx('\\\\.(?<platform>.*)\\\\/renovate\\\\.json[5]?$');\n    filteredConfigFileNames = configFileNames.filter((filename) => {\n      const matchResult = platfromRe.exec(filename);\n      if (!matchResult) {\n        return true;\n      } else if (matchResult?.groups?.platform === platform) {\n        return true;\n      }\n\n      return false;\n    });\n\n    if (!['github', 'gitlab'].includes(platform)) {\n      filteredConfigFileNames.push(`.${platform}/renovate.json`);\n      filteredConfigFileNames.push(`.${platform}/renovate.json5`);\n    }\n  }\n  return [...userAddedConfigFileNames, ...filteredConfigFileNames];\n}\n"],"mappings":";;;;;0BAEyC;AAEzC,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,IAAI,2BAAqC,EAAE;AAE3C,SAAgB,uBAAuB,WAA2B;AAChE,4BAA2B;;AAG7B,SAAgB,mBAAmB,UAAiC;CAClE,IAAI,0BAA0B,CAAC,GAAG,gBAAgB;AAElD,4CAAqB,SAAS,EAAE;EAC9B,MAAM,aAAaA,oBAAM,4CAA4C;AACrE,4BAA0B,gBAAgB,QAAQ,aAAa;GAC7D,MAAM,cAAc,WAAW,KAAK,SAAS;AAC7C,OAAI,CAAC,YACH,QAAO;YACE,aAAa,QAAQ,aAAa,SAC3C,QAAO;AAGT,UAAO;IACP;AAEF,MAAI,CAAC,CAAC,UAAU,SAAS,CAAC,SAAS,SAAS,EAAE;AAC5C,2BAAwB,KAAK,IAAI,SAAS,gBAAgB;AAC1D,2BAAwB,KAAK,IAAI,SAAS,iBAAiB;;;AAG/D,QAAO,CAAC,GAAG,0BAA0B,GAAG,wBAAwB"}
+{"version":3,"file":"app-strings.js","names":[],"sources":["../../lib/config/app-strings.ts"],"sourcesContent":["import { isNonEmptyString } from '@sindresorhus/is';\nimport type { PlatformId } from '../constants/index.ts';\nimport { regEx } from '../util/regex.ts';\n\nconst configFileNames = [\n  'renovate.json',\n  'renovate.json5',\n  '.github/renovate.json',\n  '.github/renovate.json5',\n  '.gitlab/renovate.json',\n  '.gitlab/renovate.json5',\n  '.renovaterc',\n  '.renovaterc.json',\n  '.renovaterc.json5',\n  'package.json',\n];\n\nlet userAddedConfigFileNames: string[] = [];\n\nexport function setUserConfigFileNames(fileNames: string[]): void {\n  userAddedConfigFileNames = fileNames;\n}\n\nexport function getConfigFileNames(platform?: PlatformId): string[] {\n  let filteredConfigFileNames = [...configFileNames];\n\n  if (isNonEmptyString(platform)) {\n    const platfromRe = regEx('\\\\.(?<platform>.*)\\\\/renovate\\\\.json[5]?$');\n    filteredConfigFileNames = configFileNames.filter((filename) => {\n      const matchResult = platfromRe.exec(filename);\n      if (!matchResult) {\n        return true;\n      } else if (matchResult?.groups?.platform === platform) {\n        return true;\n      }\n\n      return false;\n    });\n\n    if (!['github', 'gitlab'].includes(platform)) {\n      filteredConfigFileNames.push(`.${platform}/renovate.json`);\n      filteredConfigFileNames.push(`.${platform}/renovate.json5`);\n    }\n  }\n  return [...userAddedConfigFileNames, ...filteredConfigFileNames];\n}\n"],"mappings":";;;;AAIA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,IAAI,2BAAqC,EAAE;AAE3C,SAAgB,uBAAuB,WAA2B;AAChE,4BAA2B;;AAG7B,SAAgB,mBAAmB,UAAiC;CAClE,IAAI,0BAA0B,CAAC,GAAG,gBAAgB;AAElD,KAAI,iBAAiB,SAAS,EAAE;EAC9B,MAAM,aAAa,MAAM,4CAA4C;AACrE,4BAA0B,gBAAgB,QAAQ,aAAa;GAC7D,MAAM,cAAc,WAAW,KAAK,SAAS;AAC7C,OAAI,CAAC,YACH,QAAO;YACE,aAAa,QAAQ,aAAa,SAC3C,QAAO;AAGT,UAAO;IACP;AAEF,MAAI,CAAC,CAAC,UAAU,SAAS,CAAC,SAAS,SAAS,EAAE;AAC5C,2BAAwB,KAAK,IAAI,SAAS,gBAAgB;AAC1D,2BAAwB,KAAK,IAAI,SAAS,iBAAiB;;;AAG/D,QAAO,CAAC,GAAG,0BAA0B,GAAG,wBAAwB"}

package/dist/config/decrypt/bcpgp.js

@@ -1,13 +1,9 @@
-const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.js');
-const require_env = require('../../util/env.js');
-const require_regex = require('../../util/regex.js');
-const require_index = require('../../logger/index.js');
-let _renovatebot_pgp = require("@renovatebot/pgp");
+import { getEnv } from "../../util/env.js";
+import { regEx } from "../../util/regex.js";
+import { logger } from "../../logger/index.js";
+import { decrypt, isSupportedRuntime } from "@renovatebot/pgp";
 
 //#region lib/config/decrypt/bcpgp.ts
-require_index.init_logger();
-require_env.init_env();
-require_regex.init_regex();
 async function tryDecryptBcPgp(privateKey, encryptedStr) {
 	try {
 		const startBlock = "-----BEGIN PGP MESSAGE-----\n\n";
@@ -16,31 +12,31 @@ async function tryDecryptBcPgp(privateKey, encryptedStr) {
 		const hasStartHeader = armoredMessage.startsWith(startBlock);
 		const hasEndHeader = armoredMessage.endsWith(endBlock);
 		if (!hasStartHeader && !hasEndHeader && !armoredMessage.includes("=") && !armoredMessage.includes("\n") && armoredMessage.length % 4 !== 0) {
-			require_index.logger.debug("Adding base64 padding to armored message");
+			logger.debug("Adding base64 padding to armored message");
 			armoredMessage += `=`.repeat(4 - armoredMessage.length % 4);
 		}
 		// v8 ignore else -- TODO: add test #40625
 		if (!hasStartHeader) armoredMessage = `${startBlock}${armoredMessage}`;
 		// v8 ignore else -- TODO: add test #40625
 		if (!hasEndHeader) armoredMessage = `${armoredMessage}${endBlock}`;
-		const data = await (0, _renovatebot_pgp.decrypt)(privateKey.replace(require_regex.regEx(/\n[ \t]+/g), "\n"), armoredMessage, { runtime: runtime() });
-		require_index.logger.debug("Decrypted config using bcpgp");
+		const data = await decrypt(privateKey.replace(regEx(/\n[ \t]+/g), "\n"), armoredMessage, { runtime: runtime() });
+		logger.debug("Decrypted config using bcpgp");
 		return data;
 	} catch (err) {
-		require_index.logger.debug({ err }, "Could not decrypt using bcpgp");
+		logger.debug({ err }, "Could not decrypt using bcpgp");
 		return null;
 	}
 }
 function runtime() {
-	const runtime = require_env.getEnv().RENOVATE_X_PGP_RUNTIME;
-	if (runtime) if ((0, _renovatebot_pgp.isSupportedRuntime)(runtime)) {
-		require_index.logger.trace({ runtime }, "Using configured PGP runtime");
+	const runtime = getEnv().RENOVATE_X_PGP_RUNTIME;
+	if (runtime) if (isSupportedRuntime(runtime)) {
+		logger.trace({ runtime }, "Using configured PGP runtime");
 		return runtime;
-	} else require_index.logger.once.warn({ runtime }, "Unknown PGP runtime, using wasm-dotnet");
-	require_index.logger.trace("Using default PGP runtime: wasm-dotnet");
-	return "wasm-dotnet";
+	} else logger.once.warn({ runtime }, "Unknown PGP runtime, using wasm-java");
+	logger.trace("Using default PGP runtime: wasm-java");
+	return "wasm-java";
 }
 
 //#endregion
-exports.tryDecryptBcPgp = tryDecryptBcPgp;
+export { tryDecryptBcPgp };
 //# sourceMappingURL=bcpgp.js.map

package/dist/config/decrypt/bcpgp.js.map

@@ -1 +1 @@
-{"version":3,"file":"bcpgp.js","names":["regEx","getEnv"],"sources":["../../../lib/config/decrypt/bcpgp.ts"],"sourcesContent":["import type { RuntimeType } from '@renovatebot/pgp';\nimport { decrypt, isSupportedRuntime } from '@renovatebot/pgp';\nimport { logger } from '../../logger/index.ts';\nimport { getEnv } from '../../util/env.ts';\nimport { regEx } from '../../util/regex.ts';\n\nexport async function tryDecryptBcPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  try {\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n\n    const hasStartHeader = armoredMessage.startsWith(startBlock);\n    const hasEndHeader = armoredMessage.endsWith(endBlock);\n\n    if (\n      !hasStartHeader &&\n      !hasEndHeader &&\n      !armoredMessage.includes('=') &&\n      !armoredMessage.includes('\\n') &&\n      armoredMessage.length % 4 !== 0\n    ) {\n      logger.debug('Adding base64 padding to armored message');\n      armoredMessage += `=`.repeat(4 - (armoredMessage.length % 4));\n    }\n\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasStartHeader) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasEndHeader) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n\n    const data = await decrypt(\n      privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n      armoredMessage,\n      {\n        runtime: runtime(),\n      },\n    );\n    logger.debug('Decrypted config using bcpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using bcpgp');\n    return null;\n  }\n}\n\n// TODO: use `wasm-java` as default when we require node v24+.\n// Node v22 hungs on exit https://github.com/nodejs/node/issues/60584\nfunction runtime(): RuntimeType {\n  const runtime = getEnv().RENOVATE_X_PGP_RUNTIME;\n  if (runtime) {\n    if (isSupportedRuntime(runtime)) {\n      logger.trace({ runtime }, 'Using configured PGP runtime');\n      return runtime;\n    } else {\n      logger.once.warn({ runtime }, 'Unknown PGP runtime, using wasm-dotnet');\n    }\n  }\n  logger.trace('Using default PGP runtime: wasm-dotnet');\n  return 'wasm-dotnet';\n}\n"],"mappings":";;;;;;;2BAE+C;sBACJ;0BACC;AAE5C,eAAsB,gBACpB,YACA,cACwB;AACxB,KAAI;EACF,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,MAAM;EAExC,MAAM,iBAAiB,eAAe,WAAW,WAAW;EAC5D,MAAM,eAAe,eAAe,SAAS,SAAS;AAEtD,MACE,CAAC,kBACD,CAAC,gBACD,CAAC,eAAe,SAAS,IAAI,IAC7B,CAAC,eAAe,SAAS,KAAK,IAC9B,eAAe,SAAS,MAAM,GAC9B;AACA,wBAAO,MAAM,2CAA2C;AACxD,qBAAkB,IAAI,OAAO,IAAK,eAAe,SAAS,EAAG;;;AAI/D,MAAI,CAAC,eACH,kBAAiB,GAAG,aAAa;;AAGnC,MAAI,CAAC,aACH,kBAAiB,GAAG,iBAAiB;EAGvC,MAAM,OAAO,oCACX,WAAW,QAAQA,oBAAM,YAAY,EAAE,KAAK,EAC5C,gBACA,EACE,SAAS,SAAS,EACnB,CACF;AACD,uBAAO,MAAM,+BAA+B;AAC5C,SAAO;UACA,KAAK;AACZ,uBAAO,MAAM,EAAE,KAAK,EAAE,gCAAgC;AACtD,SAAO;;;AAMX,SAAS,UAAuB;CAC9B,MAAM,UAAUC,oBAAQ,CAAC;AACzB,KAAI,QACF,8CAAuB,QAAQ,EAAE;AAC/B,uBAAO,MAAM,EAAE,SAAS,EAAE,+BAA+B;AACzD,SAAO;OAEP,sBAAO,KAAK,KAAK,EAAE,SAAS,EAAE,yCAAyC;AAG3E,sBAAO,MAAM,yCAAyC;AACtD,QAAO"}
+{"version":3,"file":"bcpgp.js","names":[],"sources":["../../../lib/config/decrypt/bcpgp.ts"],"sourcesContent":["import type { RuntimeType } from '@renovatebot/pgp';\nimport { decrypt, isSupportedRuntime } from '@renovatebot/pgp';\nimport { logger } from '../../logger/index.ts';\nimport { getEnv } from '../../util/env.ts';\nimport { regEx } from '../../util/regex.ts';\n\nexport async function tryDecryptBcPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  try {\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n\n    const hasStartHeader = armoredMessage.startsWith(startBlock);\n    const hasEndHeader = armoredMessage.endsWith(endBlock);\n\n    if (\n      !hasStartHeader &&\n      !hasEndHeader &&\n      !armoredMessage.includes('=') &&\n      !armoredMessage.includes('\\n') &&\n      armoredMessage.length % 4 !== 0\n    ) {\n      logger.debug('Adding base64 padding to armored message');\n      armoredMessage += `=`.repeat(4 - (armoredMessage.length % 4));\n    }\n\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasStartHeader) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasEndHeader) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n\n    const data = await decrypt(\n      privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n      armoredMessage,\n      {\n        runtime: runtime(),\n      },\n    );\n    logger.debug('Decrypted config using bcpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using bcpgp');\n    return null;\n  }\n}\n\nfunction runtime(): RuntimeType {\n  const runtime = getEnv().RENOVATE_X_PGP_RUNTIME;\n  if (runtime) {\n    if (isSupportedRuntime(runtime)) {\n      logger.trace({ runtime }, 'Using configured PGP runtime');\n      return runtime;\n    } else {\n      logger.once.warn({ runtime }, 'Unknown PGP runtime, using wasm-java');\n    }\n  }\n  logger.trace('Using default PGP runtime: wasm-java');\n  return 'wasm-java';\n}\n"],"mappings":";;;;;;AAMA,eAAsB,gBACpB,YACA,cACwB;AACxB,KAAI;EACF,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,MAAM;EAExC,MAAM,iBAAiB,eAAe,WAAW,WAAW;EAC5D,MAAM,eAAe,eAAe,SAAS,SAAS;AAEtD,MACE,CAAC,kBACD,CAAC,gBACD,CAAC,eAAe,SAAS,IAAI,IAC7B,CAAC,eAAe,SAAS,KAAK,IAC9B,eAAe,SAAS,MAAM,GAC9B;AACA,UAAO,MAAM,2CAA2C;AACxD,qBAAkB,IAAI,OAAO,IAAK,eAAe,SAAS,EAAG;;;AAI/D,MAAI,CAAC,eACH,kBAAiB,GAAG,aAAa;;AAGnC,MAAI,CAAC,aACH,kBAAiB,GAAG,iBAAiB;EAGvC,MAAM,OAAO,MAAM,QACjB,WAAW,QAAQ,MAAM,YAAY,EAAE,KAAK,EAC5C,gBACA,EACE,SAAS,SAAS,EACnB,CACF;AACD,SAAO,MAAM,+BAA+B;AAC5C,SAAO;UACA,KAAK;AACZ,SAAO,MAAM,EAAE,KAAK,EAAE,gCAAgC;AACtD,SAAO;;;AAIX,SAAS,UAAuB;CAC9B,MAAM,UAAU,QAAQ,CAAC;AACzB,KAAI,QACF,KAAI,mBAAmB,QAAQ,EAAE;AAC/B,SAAO,MAAM,EAAE,SAAS,EAAE,+BAA+B;AACzD,SAAO;OAEP,QAAO,KAAK,KAAK,EAAE,SAAS,EAAE,uCAAuC;AAGzE,QAAO,MAAM,uCAAuC;AACpD,QAAO"}

package/dist/config/decrypt/openpgp.js

@@ -1,25 +1,22 @@
-const require_expose$1 = require('../../expose.js');
-const require_regex = require('../../util/regex.js');
-const require_index = require('../../logger/index.js');
+import { openpgp } from "../../expose.js";
+import { regEx } from "../../util/regex.js";
+import { logger } from "../../logger/index.js";
 
 //#region lib/config/decrypt/openpgp.ts
-var import_expose = require_expose$1.default;
-require_index.init_logger();
-require_regex.init_regex();
 let pgp = void 0;
 async function tryDecryptOpenPgp(privateKey, encryptedStr) {
 	if (pgp === void 0) try {
-		pgp = (0, import_expose.openpgp)();
+		pgp = await openpgp();
 	} catch (err) {
-		require_index.logger.warn({ err }, "Could load openpgp");
+		logger.warn({ err }, "Could load openpgp");
 		pgp = null;
 	}
 	if (pgp === null) {
-		require_index.logger.once.warn("Cannot load openpgp, skipping decryption");
+		logger.once.warn("Cannot load openpgp, skipping decryption");
 		return null;
 	}
 	try {
-		const pk = await pgp.readPrivateKey({ armoredKey: privateKey.replace(require_regex.regEx(/\n[ \t]+/g), "\n") });
+		const pk = await pgp.readPrivateKey({ armoredKey: privateKey.replace(regEx(/\n[ \t]+/g), "\n") });
 		const startBlock = "-----BEGIN PGP MESSAGE-----\n\n";
 		const endBlock = "\n-----END PGP MESSAGE-----";
 		let armoredMessage = encryptedStr.trim();
@@ -32,14 +29,14 @@ async function tryDecryptOpenPgp(privateKey, encryptedStr) {
 			message,
 			decryptionKeys: pk
 		});
-		require_index.logger.debug("Decrypted config using openpgp");
+		logger.debug("Decrypted config using openpgp");
 		return data;
 	} catch (err) {
-		require_index.logger.debug({ err }, "Could not decrypt using openpgp");
+		logger.debug({ err }, "Could not decrypt using openpgp");
 		return null;
 	}
 }
 
 //#endregion
-exports.tryDecryptOpenPgp = tryDecryptOpenPgp;
+export { tryDecryptOpenPgp };
 //# sourceMappingURL=openpgp.js.map

package/dist/config/decrypt/openpgp.js.map

@@ -1 +1 @@
-{"version":3,"file":"openpgp.js","names":["regEx"],"sources":["../../../lib/config/decrypt/openpgp.ts"],"sourcesContent":["import { openpgp } from '../../expose.cjs';\nimport { logger } from '../../logger/index.ts';\nimport { regEx } from '../../util/regex.ts';\n\nlet pgp: typeof import('openpgp') | null | undefined = undefined;\n\nexport async function tryDecryptOpenPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  if (pgp === undefined) {\n    try {\n      pgp = openpgp();\n    } catch (err) {\n      logger.warn({ err }, 'Could load openpgp');\n      pgp = null;\n    }\n  }\n\n  if (pgp === null) {\n    logger.once.warn('Cannot load openpgp, skipping decryption');\n    return null;\n  }\n\n  try {\n    const pk = await pgp.readPrivateKey({\n      // prettier-ignore\n      armoredKey: privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n    });\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.startsWith(startBlock)) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.endsWith(endBlock)) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n    const message = await pgp.readMessage({\n      armoredMessage,\n    });\n    const { data } = await pgp.decrypt({\n      message,\n      decryptionKeys: pk,\n    });\n    logger.debug('Decrypted config using openpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using openpgp');\n    return null;\n  }\n}\n"],"mappings":";;;;;;2BAC+C;0BACH;AAE5C,IAAI,MAAmD;AAEvD,eAAsB,kBACpB,YACA,cACwB;AACxB,KAAI,QAAQ,OACV,KAAI;AACF,oCAAe;UACR,KAAK;AACZ,uBAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB;AAC1C,QAAM;;AAIV,KAAI,QAAQ,MAAM;AAChB,uBAAO,KAAK,KAAK,2CAA2C;AAC5D,SAAO;;AAGT,KAAI;EACF,MAAM,KAAK,MAAM,IAAI,eAAe,EAElC,YAAY,WAAW,QAAQA,oBAAM,YAAY,EAAE,KAAK,EACzD,CAAC;EACF,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,MAAM;;AAExC,MAAI,CAAC,eAAe,WAAW,WAAW,CACxC,kBAAiB,GAAG,aAAa;;AAGnC,MAAI,CAAC,eAAe,SAAS,SAAS,CACpC,kBAAiB,GAAG,iBAAiB;EAEvC,MAAM,UAAU,MAAM,IAAI,YAAY,EACpC,gBACD,CAAC;EACF,MAAM,EAAE,SAAS,MAAM,IAAI,QAAQ;GACjC;GACA,gBAAgB;GACjB,CAAC;AACF,uBAAO,MAAM,iCAAiC;AAC9C,SAAO;UACA,KAAK;AACZ,uBAAO,MAAM,EAAE,KAAK,EAAE,kCAAkC;AACxD,SAAO"}
+{"version":3,"file":"openpgp.js","names":[],"sources":["../../../lib/config/decrypt/openpgp.ts"],"sourcesContent":["import { openpgp } from '../../expose.ts';\nimport { logger } from '../../logger/index.ts';\nimport { regEx } from '../../util/regex.ts';\n\nlet pgp: typeof import('openpgp') | null | undefined = undefined;\n\nexport async function tryDecryptOpenPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  if (pgp === undefined) {\n    try {\n      pgp = await openpgp();\n    } catch (err) {\n      logger.warn({ err }, 'Could load openpgp');\n      pgp = null;\n    }\n  }\n\n  if (pgp === null) {\n    logger.once.warn('Cannot load openpgp, skipping decryption');\n    return null;\n  }\n\n  try {\n    const pk = await pgp.readPrivateKey({\n      // prettier-ignore\n      armoredKey: privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n    });\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.startsWith(startBlock)) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.endsWith(endBlock)) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n    const message = await pgp.readMessage({\n      armoredMessage,\n    });\n    const { data } = await pgp.decrypt({\n      message,\n      decryptionKeys: pk,\n    });\n    logger.debug('Decrypted config using openpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using openpgp');\n    return null;\n  }\n}\n"],"mappings":";;;;;AAIA,IAAI,MAAmD;AAEvD,eAAsB,kBACpB,YACA,cACwB;AACxB,KAAI,QAAQ,OACV,KAAI;AACF,QAAM,MAAM,SAAS;UACd,KAAK;AACZ,SAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB;AAC1C,QAAM;;AAIV,KAAI,QAAQ,MAAM;AAChB,SAAO,KAAK,KAAK,2CAA2C;AAC5D,SAAO;;AAGT,KAAI;EACF,MAAM,KAAK,MAAM,IAAI,eAAe,EAElC,YAAY,WAAW,QAAQ,MAAM,YAAY,EAAE,KAAK,EACzD,CAAC;EACF,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,MAAM;;AAExC,MAAI,CAAC,eAAe,WAAW,WAAW,CACxC,kBAAiB,GAAG,aAAa;;AAGnC,MAAI,CAAC,eAAe,SAAS,SAAS,CACpC,kBAAiB,GAAG,iBAAiB;EAEvC,MAAM,UAAU,MAAM,IAAI,YAAY,EACpC,gBACD,CAAC;EACF,MAAM,EAAE,SAAS,MAAM,IAAI,QAAQ;GACjC;GACA,gBAAgB;GACjB,CAAC;AACF,SAAO,MAAM,iCAAiC;AAC9C,SAAO;UACA,KAAK;AACZ,SAAO,MAAM,EAAE,KAAK,EAAE,kCAAkC;AACxD,SAAO"}

package/dist/config/decrypt.js

@@ -1,23 +1,16 @@
-const require_rolldown_runtime = require('../_virtual/rolldown_runtime.js');
-const require_env = require('../util/env.js');
-const require_error_messages = require('../constants/error-messages.js');
-const require_regex = require('../util/regex.js');
-const require_sanitize = require('../util/sanitize.js');
-const require_index = require('../logger/index.js');
-const require_url = require('../util/url.js');
-const require_config_global = require('./global.js');
-const require_bcpgp = require('./decrypt/bcpgp.js');
-const require_openpgp = require('./decrypt/openpgp.js');
-const require_schema = require('./schema.js');
-let _sindresorhus_is = require("@sindresorhus/is");
+import { getEnv } from "../util/env.js";
+import { CONFIG_VALIDATION } from "../constants/error-messages.js";
+import { regEx } from "../util/regex.js";
+import { addSecretForSanitizing } from "../util/sanitize.js";
+import { logger } from "../logger/index.js";
+import { ensureTrailingSlash, parseUrl, trimSlashes } from "../util/url.js";
+import { GlobalConfig } from "./global.js";
+import { tryDecryptBcPgp } from "./decrypt/bcpgp.js";
+import { tryDecryptOpenPgp } from "./decrypt/openpgp.js";
+import { DecryptedObject } from "./schema.js";
+import { isArray, isNonEmptyString, isObject, isString } from "@sindresorhus/is";
 
 //#region lib/config/decrypt.ts
-require_error_messages.init_error_messages();
-require_index.init_logger();
-require_env.init_env();
-require_regex.init_regex();
-require_sanitize.init_sanitize();
-require_url.init_url();
 let privateKey;
 let privateKeyOld;
 function setPrivateKeys(pKey, pKeyOld) {
@@ -26,90 +19,90 @@ function setPrivateKeys(pKey, pKeyOld) {
 }
 async function tryDecrypt(key, encryptedStr, repository) {
 	let decryptedStr = null;
-	const decryptedObjStr = require_env.getEnv().RENOVATE_X_USE_OPENPGP === "true" ? await require_openpgp.tryDecryptOpenPgp(key, encryptedStr) : await require_bcpgp.tryDecryptBcPgp(key, encryptedStr);
+	const decryptedObjStr = getEnv().RENOVATE_X_USE_OPENPGP === "true" ? await tryDecryptOpenPgp(key, encryptedStr) : await tryDecryptBcPgp(key, encryptedStr);
 	if (decryptedObjStr) decryptedStr = validateDecryptedValue(decryptedObjStr, repository);
 	return decryptedStr;
 }
 function validateDecryptedValue(decryptedObjStr, repository) {
 	try {
-		const decryptedObj = require_schema.DecryptedObject.safeParse(decryptedObjStr);
+		const decryptedObj = DecryptedObject.safeParse(decryptedObjStr);
 		if (!decryptedObj.success) {
 			const error = /* @__PURE__ */ new Error("config-validation");
 			error.validationError = `Could not parse decrypted config.`;
 			throw error;
 		}
 		const { o: org, r: repo, v: value } = decryptedObj.data;
-		if (!(0, _sindresorhus_is.isNonEmptyString)(value)) {
+		if (!isNonEmptyString(value)) {
 			const error = /* @__PURE__ */ new Error("config-validation");
 			error.validationError = `Encrypted value in config is missing a value.`;
 			throw error;
 		}
-		if (!(0, _sindresorhus_is.isNonEmptyString)(org)) {
+		if (!isNonEmptyString(org)) {
 			const error = /* @__PURE__ */ new Error("config-validation");
 			error.validationError = `Encrypted value in config is missing a scope.`;
 			throw error;
 		}
 		const repositories = [repository.toUpperCase()];
 		const azureCollection = getAzureCollection();
-		if ((0, _sindresorhus_is.isNonEmptyString)(azureCollection)) {
+		if (isNonEmptyString(azureCollection)) {
 			repositories.push(`${azureCollection}/${repository}`.toUpperCase());
 			repositories.push(`${azureCollection}/*/`.toUpperCase());
 		}
-		const orgPrefixes = org.split(",").map((o) => o.trim()).map((o) => o.toUpperCase()).map((o) => require_url.ensureTrailingSlash(o));
-		if ((0, _sindresorhus_is.isNonEmptyString)(repo)) {
+		const orgPrefixes = org.split(",").map((o) => o.trim()).map((o) => o.toUpperCase()).map((o) => ensureTrailingSlash(o));
+		if (isNonEmptyString(repo)) {
 			const scopedRepos = orgPrefixes.map((orgPrefix) => `${orgPrefix}${repo}`.toUpperCase());
 			for (const rp of repositories) if (scopedRepos.some((r) => r === rp)) return value;
-			require_index.logger.debug({ scopedRepos }, "Secret is scoped to a different repository");
+			logger.debug({ scopedRepos }, "Secret is scoped to a different repository");
 			const error = /* @__PURE__ */ new Error("config-validation");
 			error.validationError = `Encrypted secret is scoped to a different repository: "${scopedRepos.join(",")}".`;
 			throw error;
 		}
-		const azcol = azureCollection === void 0 ? void 0 : require_url.ensureTrailingSlash(azureCollection).toUpperCase();
+		const azcol = azureCollection === void 0 ? void 0 : ensureTrailingSlash(azureCollection).toUpperCase();
 		for (const rp of repositories) if (orgPrefixes.some((orgPrefix) => rp.startsWith(orgPrefix) && orgPrefix !== azcol)) return value;
-		require_index.logger.debug({ orgPrefixes }, "Secret is scoped to a different org");
+		logger.debug({ orgPrefixes }, "Secret is scoped to a different org");
 		const error = /* @__PURE__ */ new Error("config-validation");
 		error.validationError = `Encrypted secret is scoped to a different org: "${orgPrefixes.join(",")}".`;
 		throw error;
 	} catch (err) {
-		require_index.logger.warn({ err }, "Could not parse decrypted string");
+		logger.warn({ err }, "Could not parse decrypted string");
 	}
 	return null;
 }
 async function decryptConfig(config, repository, existingPath = "$") {
-	require_index.logger.trace({ config }, "decryptConfig()");
+	logger.trace({ config }, "decryptConfig()");
 	const decryptedConfig = { ...config };
-	for (const [key, val] of Object.entries(config)) if (key === "encrypted" && (0, _sindresorhus_is.isObject)(val)) {
+	for (const [key, val] of Object.entries(config)) if (key === "encrypted" && isObject(val)) {
 		const path = `${existingPath}.${key}`;
-		require_index.logger.debug({ config: val }, `Found encrypted config in ${path}`);
-		const encryptedWarning = require_config_global.GlobalConfig.get("encryptedWarning");
-		if ((0, _sindresorhus_is.isString)(encryptedWarning)) require_index.logger.once.warn(encryptedWarning);
+		logger.debug({ config: val }, `Found encrypted config in ${path}`);
+		const encryptedWarning = GlobalConfig.get("encryptedWarning");
+		if (isString(encryptedWarning)) logger.once.warn(encryptedWarning);
 		if (privateKey) for (const [eKey, eVal] of Object.entries(val)) {
-			require_index.logger.debug(`Trying to decrypt ${eKey} in ${path}`);
+			logger.debug(`Trying to decrypt ${eKey} in ${path}`);
 			let decryptedStr = await tryDecrypt(privateKey, eVal, repository);
-			if (privateKeyOld && !(0, _sindresorhus_is.isNonEmptyString)(decryptedStr)) {
-				require_index.logger.debug(`Trying to decrypt with old private key`);
+			if (privateKeyOld && !isNonEmptyString(decryptedStr)) {
+				logger.debug(`Trying to decrypt with old private key`);
 				decryptedStr = await tryDecrypt(privateKeyOld, eVal, repository);
 			}
-			if (!(0, _sindresorhus_is.isNonEmptyString)(decryptedStr)) {
+			if (!isNonEmptyString(decryptedStr)) {
 				const error = /* @__PURE__ */ new Error("config-validation");
 				error.validationError = `Failed to decrypt field ${eKey}. Please re-encrypt and try again.`;
 				throw error;
 			}
-			require_index.logger.debug(`Decrypted ${eKey} in ${path}`);
+			logger.debug(`Decrypted ${eKey} in ${path}`);
 			// v8 ignore if -- TODO: add test #40625
 			if (eKey === "npmToken") {
-				const token = decryptedStr.replace(require_regex.regEx(/\n$/), "");
+				const token = decryptedStr.replace(regEx(/\n$/), "");
 				decryptedConfig[eKey] = token;
-				require_sanitize.addSecretForSanitizing(token);
+				addSecretForSanitizing(token);
 			} else {
 				decryptedConfig[eKey] = decryptedStr;
-				require_sanitize.addSecretForSanitizing(decryptedStr);
+				addSecretForSanitizing(decryptedStr);
 			}
 		}
 		else {
-			const env = require_env.getEnv();
+			const env = getEnv();
 			if (env.RENOVATE_X_ENCRYPTED_STRICT === "true") {
-				const error = new Error(require_error_messages.CONFIG_VALIDATION);
+				const error = new Error(CONFIG_VALIDATION);
 				error.validationSource = "config";
 				error.validationError = "Encrypted config unsupported";
 				error.validationMessage = `This config contains an encrypted object at location \`$.${key}\` but no privateKey is configured. To support encrypted config, the Renovate administrator must configure a \`privateKey\` in Global Configuration.`;
@@ -118,31 +111,31 @@ Please migrate all secrets to the Developer Portal using the web UI available at
 
 Refer to migration documents here: https://docs.renovatebot.com/mend-hosted/migrating-secrets/`;
 				throw error;
-			} else require_index.logger.error("Found encrypted data but no privateKey");
+			} else logger.error("Found encrypted data but no privateKey");
 		}
 		delete decryptedConfig.encrypted;
-	} else if ((0, _sindresorhus_is.isArray)(val)) {
+	} else if (isArray(val)) {
 		decryptedConfig[key] = [];
-		for (const [index, item] of val.entries()) if ((0, _sindresorhus_is.isObject)(item) && !(0, _sindresorhus_is.isArray)(item)) {
+		for (const [index, item] of val.entries()) if (isObject(item) && !isArray(item)) {
 			const path = `${existingPath}.${key}[${index}]`;
 			decryptedConfig[key].push(await decryptConfig(item, repository, path));
 		} else decryptedConfig[key].push(item);
-	} else if ((0, _sindresorhus_is.isObject)(val) && key !== "content") decryptedConfig[key] = await decryptConfig(val, repository, `${existingPath}.${key}`);
+	} else if (isObject(val) && key !== "content") decryptedConfig[key] = await decryptConfig(val, repository, `${existingPath}.${key}`);
 	delete decryptedConfig.encrypted;
-	require_index.logger.trace({ config: decryptedConfig }, "decryptedConfig");
+	logger.trace({ config: decryptedConfig }, "decryptedConfig");
 	return decryptedConfig;
 }
 function getAzureCollection() {
-	if (require_config_global.GlobalConfig.get("platform") !== "azure") return;
-	const endpoint = require_config_global.GlobalConfig.get("endpoint");
-	const endpointUrl = require_url.parseUrl(endpoint);
+	if (GlobalConfig.get("platform") !== "azure") return;
+	const endpoint = GlobalConfig.get("endpoint");
+	const endpointUrl = parseUrl(endpoint);
 	if (endpointUrl === null) {
-		require_index.logger.warn({ endpoint }, "Unable to parse endpoint for token decryption");
+		logger.warn({ endpoint }, "Unable to parse endpoint for token decryption");
 		return;
 	}
-	const azureCollection = require_url.trimSlashes(endpointUrl.pathname);
-	if (!(0, _sindresorhus_is.isNonEmptyString)(azureCollection)) {
-		require_index.logger.debug({ endpoint }, "Unable to find azure collection name from URL");
+	const azureCollection = trimSlashes(endpointUrl.pathname);
+	if (!isNonEmptyString(azureCollection)) {
+		logger.debug({ endpoint }, "Unable to find azure collection name from URL");
 		return;
 	}
 	if (azureCollection.startsWith("tfs/")) return azureCollection.substring(4);
@@ -150,6 +143,5 @@ function getAzureCollection() {
 }
 
 //#endregion
-exports.decryptConfig = decryptConfig;
-exports.setPrivateKeys = setPrivateKeys;
+export { decryptConfig, setPrivateKeys };
 //# sourceMappingURL=decrypt.js.map

package/dist/config/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","names":["getEnv","tryDecryptOpenPgp","tryDecryptBcPgp","DecryptedObject","ensureTrailingSlash","GlobalConfig","regEx","CONFIG_VALIDATION","parseUrl","trimSlashes"],"sources":["../../lib/config/decrypt.ts"],"sourcesContent":["import {\n  isArray,\n  isNonEmptyString,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport { CONFIG_VALIDATION } from '../constants/error-messages.ts';\nimport { logger } from '../logger/index.ts';\nimport { getEnv } from '../util/env.ts';\nimport { regEx } from '../util/regex.ts';\nimport { addSecretForSanitizing } from '../util/sanitize.ts';\nimport { ensureTrailingSlash, parseUrl, trimSlashes } from '../util/url.ts';\nimport { tryDecryptBcPgp } from './decrypt/bcpgp.ts';\nimport { tryDecryptOpenPgp } from './decrypt/openpgp.ts';\nimport { GlobalConfig } from './global.ts';\nimport { DecryptedObject } from './schema.ts';\nimport type { AllConfig, RenovateConfig } from './types.ts';\n\nlet privateKey: string | undefined;\nlet privateKeyOld: string | undefined;\n\nexport function setPrivateKeys(\n  pKey: string | undefined,\n  pKeyOld: string | undefined,\n): void {\n  privateKey = pKey;\n  privateKeyOld = pKeyOld;\n}\n\nexport async function tryDecrypt(\n  key: string,\n  encryptedStr: string,\n  repository: string,\n): Promise<string | null> {\n  let decryptedStr: string | null = null;\n  const decryptedObjStr =\n    getEnv().RENOVATE_X_USE_OPENPGP === 'true'\n      ? await tryDecryptOpenPgp(key, encryptedStr)\n      : await tryDecryptBcPgp(key, encryptedStr);\n  if (decryptedObjStr) {\n    decryptedStr = validateDecryptedValue(decryptedObjStr, repository);\n  }\n  return decryptedStr;\n}\n\nexport function validateDecryptedValue(\n  decryptedObjStr: string,\n  repository: string,\n): string | null {\n  try {\n    const decryptedObj = DecryptedObject.safeParse(decryptedObjStr);\n    if (!decryptedObj.success) {\n      const error = new Error('config-validation');\n      error.validationError = `Could not parse decrypted config.`;\n      throw error;\n    }\n\n    const { o: org, r: repo, v: value } = decryptedObj.data;\n\n    if (!isNonEmptyString(value)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a value.`;\n      throw error;\n    }\n\n    if (!isNonEmptyString(org)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a scope.`;\n      throw error;\n    }\n\n    const repositories = [repository.toUpperCase()];\n\n    const azureCollection = getAzureCollection();\n    if (isNonEmptyString(azureCollection)) {\n      // used for full 'org/project/repo' matching\n      repositories.push(`${azureCollection}/${repository}`.toUpperCase());\n      // used for org prefix matching without repo\n      repositories.push(`${azureCollection}/*/`.toUpperCase());\n    }\n\n    const orgPrefixes = org\n      .split(',')\n      .map((o) => o.trim())\n      .map((o) => o.toUpperCase())\n      .map((o) => ensureTrailingSlash(o));\n\n    if (isNonEmptyString(repo)) {\n      const scopedRepos = orgPrefixes.map((orgPrefix) =>\n        `${orgPrefix}${repo}`.toUpperCase(),\n      );\n      for (const rp of repositories) {\n        if (scopedRepos.some((r) => r === rp)) {\n          return value;\n        }\n      }\n\n      logger.debug(\n        { scopedRepos },\n        'Secret is scoped to a different repository',\n      );\n      const error = new Error('config-validation');\n      const scopeString = scopedRepos.join(',');\n      error.validationError = `Encrypted secret is scoped to a different repository: \"${scopeString}\".`;\n      throw error;\n    }\n\n    // no scoped repos, only org\n    const azcol =\n      azureCollection === undefined\n        ? undefined\n        : ensureTrailingSlash(azureCollection).toUpperCase();\n    for (const rp of repositories) {\n      if (\n        orgPrefixes.some(\n          (orgPrefix) => rp.startsWith(orgPrefix) && orgPrefix !== azcol,\n        )\n      ) {\n        return value;\n      }\n    }\n    logger.debug({ orgPrefixes }, 'Secret is scoped to a different org');\n    const error = new Error('config-validation');\n    const scopeString = orgPrefixes.join(',');\n    error.validationError = `Encrypted secret is scoped to a different org: \"${scopeString}\".`;\n    throw error;\n  } catch (err) {\n    logger.warn({ err }, 'Could not parse decrypted string');\n  }\n  return null;\n}\n\nexport async function decryptConfig<T extends RenovateConfig = AllConfig>(\n  config: T,\n  repository: string,\n  existingPath = '$',\n): Promise<T> {\n  logger.trace({ config }, 'decryptConfig()');\n  const decryptedConfig = { ...config };\n  for (const [key, val] of Object.entries(config)) {\n    if (key === 'encrypted' && isObject(val)) {\n      const path = `${existingPath}.${key}`;\n      logger.debug({ config: val }, `Found encrypted config in ${path}`);\n\n      const encryptedWarning = GlobalConfig.get('encryptedWarning');\n      if (isString(encryptedWarning)) {\n        logger.once.warn(encryptedWarning);\n      }\n\n      if (privateKey) {\n        for (const [eKey, eVal] of Object.entries(val)) {\n          logger.debug(`Trying to decrypt ${eKey} in ${path}`);\n          let decryptedStr = await tryDecrypt(privateKey, eVal, repository);\n          if (privateKeyOld && !isNonEmptyString(decryptedStr)) {\n            logger.debug(`Trying to decrypt with old private key`);\n            decryptedStr = await tryDecrypt(privateKeyOld, eVal, repository);\n          }\n          if (!isNonEmptyString(decryptedStr)) {\n            const error = new Error('config-validation');\n            error.validationError = `Failed to decrypt field ${eKey}. Please re-encrypt and try again.`;\n            throw error;\n          }\n          logger.debug(`Decrypted ${eKey} in ${path}`);\n          // v8 ignore if -- TODO: add test #40625\n          if (eKey === 'npmToken') {\n            const token = decryptedStr.replace(regEx(/\\n$/), '');\n            decryptedConfig[eKey] = token;\n            addSecretForSanitizing(token);\n          } else {\n            // @ts-expect-error -- type can't be narrowed\n            decryptedConfig[eKey] = decryptedStr;\n            addSecretForSanitizing(decryptedStr);\n          }\n        }\n      } else {\n        const env = getEnv();\n        if (env.RENOVATE_X_ENCRYPTED_STRICT === 'true') {\n          const error = new Error(CONFIG_VALIDATION);\n          error.validationSource = 'config';\n          error.validationError = 'Encrypted config unsupported';\n          error.validationMessage = `This config contains an encrypted object at location \\`$.${key}\\` but no privateKey is configured. To support encrypted config, the Renovate administrator must configure a \\`privateKey\\` in Global Configuration.`;\n          if (env.MEND_HOSTED === 'true') {\n            error.validationMessage = `Mend-hosted Renovate Apps no longer support the use of encrypted secrets in Renovate file config (e.g. renovate.json).\nPlease migrate all secrets to the Developer Portal using the web UI available at https://developer.mend.io/\n\nRefer to migration documents here: https://docs.renovatebot.com/mend-hosted/migrating-secrets/`;\n          }\n          throw error;\n        } else {\n          logger.error('Found encrypted data but no privateKey');\n        }\n      }\n      delete decryptedConfig.encrypted;\n    } else if (isArray(val)) {\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = [];\n      for (const [index, item] of val.entries()) {\n        if (isObject(item) && !isArray(item)) {\n          const path = `${existingPath}.${key}[${index}]`;\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as RenovateConfig[]).push(\n            await decryptConfig(item as RenovateConfig, repository, path),\n          );\n        } else {\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as unknown[]).push(item);\n        }\n      }\n    } else if (isObject(val) && key !== 'content') {\n      const path = `${existingPath}.${key}`;\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = await decryptConfig(\n        val as RenovateConfig,\n        repository,\n        path,\n      );\n    }\n  }\n  delete decryptedConfig.encrypted;\n  logger.trace({ config: decryptedConfig }, 'decryptedConfig');\n  return decryptedConfig;\n}\n\nexport function getAzureCollection(): string | undefined {\n  const platform = GlobalConfig.get('platform');\n  if (platform !== 'azure') {\n    return undefined;\n  }\n\n  const endpoint = GlobalConfig.get('endpoint');\n  const endpointUrl = parseUrl(endpoint);\n  if (endpointUrl === null) {\n    // should not happen\n    logger.warn({ endpoint }, 'Unable to parse endpoint for token decryption');\n    return undefined;\n  }\n\n  const azureCollection = trimSlashes(endpointUrl.pathname);\n  if (!isNonEmptyString(azureCollection)) {\n    logger.debug({ endpoint }, 'Unable to find azure collection name from URL');\n    return undefined;\n  }\n\n  if (azureCollection.startsWith('tfs/')) {\n    // Azure DevOps Server\n    return azureCollection.substring(4);\n  }\n  return azureCollection;\n}\n"],"mappings":";;;;;;;;;;;;;;4CAMmE;2BACvB;sBACJ;0BACC;gCACoB;sBACe;AAO5E,IAAI;AACJ,IAAI;AAEJ,SAAgB,eACd,MACA,SACM;AACN,cAAa;AACb,iBAAgB;;AAGlB,eAAsB,WACpB,KACA,cACA,YACwB;CACxB,IAAI,eAA8B;CAClC,MAAM,kBACJA,oBAAQ,CAAC,2BAA2B,SAChC,MAAMC,kCAAkB,KAAK,aAAa,GAC1C,MAAMC,8BAAgB,KAAK,aAAa;AAC9C,KAAI,gBACF,gBAAe,uBAAuB,iBAAiB,WAAW;AAEpE,QAAO;;AAGT,SAAgB,uBACd,iBACA,YACe;AACf,KAAI;EACF,MAAM,eAAeC,+BAAgB,UAAU,gBAAgB;AAC/D,MAAI,CAAC,aAAa,SAAS;GACzB,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;EAGR,MAAM,EAAE,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,aAAa;AAEnD,MAAI,wCAAkB,MAAM,EAAE;GAC5B,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;AAGR,MAAI,wCAAkB,IAAI,EAAE;GAC1B,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;EAGR,MAAM,eAAe,CAAC,WAAW,aAAa,CAAC;EAE/C,MAAM,kBAAkB,oBAAoB;AAC5C,6CAAqB,gBAAgB,EAAE;AAErC,gBAAa,KAAK,GAAG,gBAAgB,GAAG,aAAa,aAAa,CAAC;AAEnE,gBAAa,KAAK,GAAG,gBAAgB,KAAK,aAAa,CAAC;;EAG1D,MAAM,cAAc,IACjB,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,KAAK,MAAM,EAAE,aAAa,CAAC,CAC3B,KAAK,MAAMC,gCAAoB,EAAE,CAAC;AAErC,6CAAqB,KAAK,EAAE;GAC1B,MAAM,cAAc,YAAY,KAAK,cACnC,GAAG,YAAY,OAAO,aAAa,CACpC;AACD,QAAK,MAAM,MAAM,aACf,KAAI,YAAY,MAAM,MAAM,MAAM,GAAG,CACnC,QAAO;AAIX,wBAAO,MACL,EAAE,aAAa,EACf,6CACD;GACD,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAE5C,SAAM,kBAAkB,0DADJ,YAAY,KAAK,IAAI,CACqD;AAC9F,SAAM;;EAIR,MAAM,QACJ,oBAAoB,SAChB,SACAA,gCAAoB,gBAAgB,CAAC,aAAa;AACxD,OAAK,MAAM,MAAM,aACf,KACE,YAAY,MACT,cAAc,GAAG,WAAW,UAAU,IAAI,cAAc,MAC1D,CAED,QAAO;AAGX,uBAAO,MAAM,EAAE,aAAa,EAAE,sCAAsC;EACpE,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAE5C,QAAM,kBAAkB,mDADJ,YAAY,KAAK,IAAI,CAC8C;AACvF,QAAM;UACC,KAAK;AACZ,uBAAO,KAAK,EAAE,KAAK,EAAE,mCAAmC;;AAE1D,QAAO;;AAGT,eAAsB,cACpB,QACA,YACA,eAAe,KACH;AACZ,sBAAO,MAAM,EAAE,QAAQ,EAAE,kBAAkB;CAC3C,MAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,OAAO,CAC7C,KAAI,QAAQ,8CAAwB,IAAI,EAAE;EACxC,MAAM,OAAO,GAAG,aAAa,GAAG;AAChC,uBAAO,MAAM,EAAE,QAAQ,KAAK,EAAE,6BAA6B,OAAO;EAElE,MAAM,mBAAmBC,mCAAa,IAAI,mBAAmB;AAC7D,qCAAa,iBAAiB,CAC5B,sBAAO,KAAK,KAAK,iBAAiB;AAGpC,MAAI,WACF,MAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,IAAI,EAAE;AAC9C,wBAAO,MAAM,qBAAqB,KAAK,MAAM,OAAO;GACpD,IAAI,eAAe,MAAM,WAAW,YAAY,MAAM,WAAW;AACjE,OAAI,iBAAiB,wCAAkB,aAAa,EAAE;AACpD,yBAAO,MAAM,yCAAyC;AACtD,mBAAe,MAAM,WAAW,eAAe,MAAM,WAAW;;AAElE,OAAI,wCAAkB,aAAa,EAAE;IACnC,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,UAAM,kBAAkB,2BAA2B,KAAK;AACxD,UAAM;;AAER,wBAAO,MAAM,aAAa,KAAK,MAAM,OAAO;;AAE5C,OAAI,SAAS,YAAY;IACvB,MAAM,QAAQ,aAAa,QAAQC,oBAAM,MAAM,EAAE,GAAG;AACpD,oBAAgB,QAAQ;AACxB,4CAAuB,MAAM;UACxB;AAEL,oBAAgB,QAAQ;AACxB,4CAAuB,aAAa;;;OAGnC;GACL,MAAM,MAAMN,oBAAQ;AACpB,OAAI,IAAI,gCAAgC,QAAQ;IAC9C,MAAM,QAAQ,IAAI,MAAMO,yCAAkB;AAC1C,UAAM,mBAAmB;AACzB,UAAM,kBAAkB;AACxB,UAAM,oBAAoB,4DAA4D,IAAI;AAC1F,QAAI,IAAI,gBAAgB,OACtB,OAAM,oBAAoB;;;;AAK5B,UAAM;SAEN,sBAAO,MAAM,yCAAyC;;AAG1D,SAAO,gBAAgB;0CACN,IAAI,EAAE;AAEvB,kBAAgB,OAAO,EAAE;AACzB,OAAK,MAAM,CAAC,OAAO,SAAS,IAAI,SAAS,CACvC,oCAAa,KAAK,IAAI,+BAAS,KAAK,EAAE;GACpC,MAAM,OAAO,GAAG,aAAa,GAAG,IAAI,GAAG,MAAM;AAE7C,GAAC,gBAAgB,KAA0B,KACzC,MAAM,cAAc,MAAwB,YAAY,KAAK,CAC9D;QAGD,CAAC,gBAAgB,KAAmB,KAAK,KAAK;2CAGhC,IAAI,IAAI,QAAQ,UAGlC,iBAAgB,OAAO,MAAM,cAC3B,KACA,YAJW,GAAG,aAAa,GAAG,MAM/B;AAGL,QAAO,gBAAgB;AACvB,sBAAO,MAAM,EAAE,QAAQ,iBAAiB,EAAE,kBAAkB;AAC5D,QAAO;;AAGT,SAAgB,qBAAyC;AAEvD,KADiBF,mCAAa,IAAI,WAAW,KAC5B,QACf;CAGF,MAAM,WAAWA,mCAAa,IAAI,WAAW;CAC7C,MAAM,cAAcG,qBAAS,SAAS;AACtC,KAAI,gBAAgB,MAAM;AAExB,uBAAO,KAAK,EAAE,UAAU,EAAE,gDAAgD;AAC1E;;CAGF,MAAM,kBAAkBC,wBAAY,YAAY,SAAS;AACzD,KAAI,wCAAkB,gBAAgB,EAAE;AACtC,uBAAO,MAAM,EAAE,UAAU,EAAE,gDAAgD;AAC3E;;AAGF,KAAI,gBAAgB,WAAW,OAAO,CAEpC,QAAO,gBAAgB,UAAU,EAAE;AAErC,QAAO"}
+{"version":3,"file":"decrypt.js","names":[],"sources":["../../lib/config/decrypt.ts"],"sourcesContent":["import {\n  isArray,\n  isNonEmptyString,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport { CONFIG_VALIDATION } from '../constants/error-messages.ts';\nimport { logger } from '../logger/index.ts';\nimport { getEnv } from '../util/env.ts';\nimport { regEx } from '../util/regex.ts';\nimport { addSecretForSanitizing } from '../util/sanitize.ts';\nimport { ensureTrailingSlash, parseUrl, trimSlashes } from '../util/url.ts';\nimport { tryDecryptBcPgp } from './decrypt/bcpgp.ts';\nimport { tryDecryptOpenPgp } from './decrypt/openpgp.ts';\nimport { GlobalConfig } from './global.ts';\nimport { DecryptedObject } from './schema.ts';\nimport type { AllConfig, RenovateConfig } from './types.ts';\n\nlet privateKey: string | undefined;\nlet privateKeyOld: string | undefined;\n\nexport function setPrivateKeys(\n  pKey: string | undefined,\n  pKeyOld: string | undefined,\n): void {\n  privateKey = pKey;\n  privateKeyOld = pKeyOld;\n}\n\nexport async function tryDecrypt(\n  key: string,\n  encryptedStr: string,\n  repository: string,\n): Promise<string | null> {\n  let decryptedStr: string | null = null;\n  const decryptedObjStr =\n    getEnv().RENOVATE_X_USE_OPENPGP === 'true'\n      ? await tryDecryptOpenPgp(key, encryptedStr)\n      : await tryDecryptBcPgp(key, encryptedStr);\n  if (decryptedObjStr) {\n    decryptedStr = validateDecryptedValue(decryptedObjStr, repository);\n  }\n  return decryptedStr;\n}\n\nexport function validateDecryptedValue(\n  decryptedObjStr: string,\n  repository: string,\n): string | null {\n  try {\n    const decryptedObj = DecryptedObject.safeParse(decryptedObjStr);\n    if (!decryptedObj.success) {\n      const error = new Error('config-validation');\n      error.validationError = `Could not parse decrypted config.`;\n      throw error;\n    }\n\n    const { o: org, r: repo, v: value } = decryptedObj.data;\n\n    if (!isNonEmptyString(value)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a value.`;\n      throw error;\n    }\n\n    if (!isNonEmptyString(org)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a scope.`;\n      throw error;\n    }\n\n    const repositories = [repository.toUpperCase()];\n\n    const azureCollection = getAzureCollection();\n    if (isNonEmptyString(azureCollection)) {\n      // used for full 'org/project/repo' matching\n      repositories.push(`${azureCollection}/${repository}`.toUpperCase());\n      // used for org prefix matching without repo\n      repositories.push(`${azureCollection}/*/`.toUpperCase());\n    }\n\n    const orgPrefixes = org\n      .split(',')\n      .map((o) => o.trim())\n      .map((o) => o.toUpperCase())\n      .map((o) => ensureTrailingSlash(o));\n\n    if (isNonEmptyString(repo)) {\n      const scopedRepos = orgPrefixes.map((orgPrefix) =>\n        `${orgPrefix}${repo}`.toUpperCase(),\n      );\n      for (const rp of repositories) {\n        if (scopedRepos.some((r) => r === rp)) {\n          return value;\n        }\n      }\n\n      logger.debug(\n        { scopedRepos },\n        'Secret is scoped to a different repository',\n      );\n      const error = new Error('config-validation');\n      const scopeString = scopedRepos.join(',');\n      error.validationError = `Encrypted secret is scoped to a different repository: \"${scopeString}\".`;\n      throw error;\n    }\n\n    // no scoped repos, only org\n    const azcol =\n      azureCollection === undefined\n        ? undefined\n        : ensureTrailingSlash(azureCollection).toUpperCase();\n    for (const rp of repositories) {\n      if (\n        orgPrefixes.some(\n          (orgPrefix) => rp.startsWith(orgPrefix) && orgPrefix !== azcol,\n        )\n      ) {\n        return value;\n      }\n    }\n    logger.debug({ orgPrefixes }, 'Secret is scoped to a different org');\n    const error = new Error('config-validation');\n    const scopeString = orgPrefixes.join(',');\n    error.validationError = `Encrypted secret is scoped to a different org: \"${scopeString}\".`;\n    throw error;\n  } catch (err) {\n    logger.warn({ err }, 'Could not parse decrypted string');\n  }\n  return null;\n}\n\nexport async function decryptConfig<T extends RenovateConfig = AllConfig>(\n  config: T,\n  repository: string,\n  existingPath = '$',\n): Promise<T> {\n  logger.trace({ config }, 'decryptConfig()');\n  const decryptedConfig = { ...config };\n  for (const [key, val] of Object.entries(config)) {\n    if (key === 'encrypted' && isObject(val)) {\n      const path = `${existingPath}.${key}`;\n      logger.debug({ config: val }, `Found encrypted config in ${path}`);\n\n      const encryptedWarning = GlobalConfig.get('encryptedWarning');\n      if (isString(encryptedWarning)) {\n        logger.once.warn(encryptedWarning);\n      }\n\n      if (privateKey) {\n        for (const [eKey, eVal] of Object.entries(val)) {\n          logger.debug(`Trying to decrypt ${eKey} in ${path}`);\n          let decryptedStr = await tryDecrypt(privateKey, eVal, repository);\n          if (privateKeyOld && !isNonEmptyString(decryptedStr)) {\n            logger.debug(`Trying to decrypt with old private key`);\n            decryptedStr = await tryDecrypt(privateKeyOld, eVal, repository);\n          }\n          if (!isNonEmptyString(decryptedStr)) {\n            const error = new Error('config-validation');\n            error.validationError = `Failed to decrypt field ${eKey}. Please re-encrypt and try again.`;\n            throw error;\n          }\n          logger.debug(`Decrypted ${eKey} in ${path}`);\n          // v8 ignore if -- TODO: add test #40625\n          if (eKey === 'npmToken') {\n            const token = decryptedStr.replace(regEx(/\\n$/), '');\n            decryptedConfig[eKey] = token;\n            addSecretForSanitizing(token);\n          } else {\n            // @ts-expect-error -- type can't be narrowed\n            decryptedConfig[eKey] = decryptedStr;\n            addSecretForSanitizing(decryptedStr);\n          }\n        }\n      } else {\n        const env = getEnv();\n        if (env.RENOVATE_X_ENCRYPTED_STRICT === 'true') {\n          const error = new Error(CONFIG_VALIDATION);\n          error.validationSource = 'config';\n          error.validationError = 'Encrypted config unsupported';\n          error.validationMessage = `This config contains an encrypted object at location \\`$.${key}\\` but no privateKey is configured. To support encrypted config, the Renovate administrator must configure a \\`privateKey\\` in Global Configuration.`;\n          if (env.MEND_HOSTED === 'true') {\n            error.validationMessage = `Mend-hosted Renovate Apps no longer support the use of encrypted secrets in Renovate file config (e.g. renovate.json).\nPlease migrate all secrets to the Developer Portal using the web UI available at https://developer.mend.io/\n\nRefer to migration documents here: https://docs.renovatebot.com/mend-hosted/migrating-secrets/`;\n          }\n          throw error;\n        } else {\n          logger.error('Found encrypted data but no privateKey');\n        }\n      }\n      delete decryptedConfig.encrypted;\n    } else if (isArray(val)) {\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = [];\n      for (const [index, item] of val.entries()) {\n        if (isObject(item) && !isArray(item)) {\n          const path = `${existingPath}.${key}[${index}]`;\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as RenovateConfig[]).push(\n            await decryptConfig(item as RenovateConfig, repository, path),\n          );\n        } else {\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as unknown[]).push(item);\n        }\n      }\n    } else if (isObject(val) && key !== 'content') {\n      const path = `${existingPath}.${key}`;\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = await decryptConfig(\n        val as RenovateConfig,\n        repository,\n        path,\n      );\n    }\n  }\n  delete decryptedConfig.encrypted;\n  logger.trace({ config: decryptedConfig }, 'decryptedConfig');\n  return decryptedConfig;\n}\n\nexport function getAzureCollection(): string | undefined {\n  const platform = GlobalConfig.get('platform');\n  if (platform !== 'azure') {\n    return undefined;\n  }\n\n  const endpoint = GlobalConfig.get('endpoint');\n  const endpointUrl = parseUrl(endpoint);\n  if (endpointUrl === null) {\n    // should not happen\n    logger.warn({ endpoint }, 'Unable to parse endpoint for token decryption');\n    return undefined;\n  }\n\n  const azureCollection = trimSlashes(endpointUrl.pathname);\n  if (!isNonEmptyString(azureCollection)) {\n    logger.debug({ endpoint }, 'Unable to find azure collection name from URL');\n    return undefined;\n  }\n\n  if (azureCollection.startsWith('tfs/')) {\n    // Azure DevOps Server\n    return azureCollection.substring(4);\n  }\n  return azureCollection;\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,IAAI;AACJ,IAAI;AAEJ,SAAgB,eACd,MACA,SACM;AACN,cAAa;AACb,iBAAgB;;AAGlB,eAAsB,WACpB,KACA,cACA,YACwB;CACxB,IAAI,eAA8B;CAClC,MAAM,kBACJ,QAAQ,CAAC,2BAA2B,SAChC,MAAM,kBAAkB,KAAK,aAAa,GAC1C,MAAM,gBAAgB,KAAK,aAAa;AAC9C,KAAI,gBACF,gBAAe,uBAAuB,iBAAiB,WAAW;AAEpE,QAAO;;AAGT,SAAgB,uBACd,iBACA,YACe;AACf,KAAI;EACF,MAAM,eAAe,gBAAgB,UAAU,gBAAgB;AAC/D,MAAI,CAAC,aAAa,SAAS;GACzB,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;EAGR,MAAM,EAAE,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,aAAa;AAEnD,MAAI,CAAC,iBAAiB,MAAM,EAAE;GAC5B,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;AAGR,MAAI,CAAC,iBAAiB,IAAI,EAAE;GAC1B,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;EAGR,MAAM,eAAe,CAAC,WAAW,aAAa,CAAC;EAE/C,MAAM,kBAAkB,oBAAoB;AAC5C,MAAI,iBAAiB,gBAAgB,EAAE;AAErC,gBAAa,KAAK,GAAG,gBAAgB,GAAG,aAAa,aAAa,CAAC;AAEnE,gBAAa,KAAK,GAAG,gBAAgB,KAAK,aAAa,CAAC;;EAG1D,MAAM,cAAc,IACjB,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,KAAK,MAAM,EAAE,aAAa,CAAC,CAC3B,KAAK,MAAM,oBAAoB,EAAE,CAAC;AAErC,MAAI,iBAAiB,KAAK,EAAE;GAC1B,MAAM,cAAc,YAAY,KAAK,cACnC,GAAG,YAAY,OAAO,aAAa,CACpC;AACD,QAAK,MAAM,MAAM,aACf,KAAI,YAAY,MAAM,MAAM,MAAM,GAAG,CACnC,QAAO;AAIX,UAAO,MACL,EAAE,aAAa,EACf,6CACD;GACD,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAE5C,SAAM,kBAAkB,0DADJ,YAAY,KAAK,IAAI,CACqD;AAC9F,SAAM;;EAIR,MAAM,QACJ,oBAAoB,SAChB,SACA,oBAAoB,gBAAgB,CAAC,aAAa;AACxD,OAAK,MAAM,MAAM,aACf,KACE,YAAY,MACT,cAAc,GAAG,WAAW,UAAU,IAAI,cAAc,MAC1D,CAED,QAAO;AAGX,SAAO,MAAM,EAAE,aAAa,EAAE,sCAAsC;EACpE,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAE5C,QAAM,kBAAkB,mDADJ,YAAY,KAAK,IAAI,CAC8C;AACvF,QAAM;UACC,KAAK;AACZ,SAAO,KAAK,EAAE,KAAK,EAAE,mCAAmC;;AAE1D,QAAO;;AAGT,eAAsB,cACpB,QACA,YACA,eAAe,KACH;AACZ,QAAO,MAAM,EAAE,QAAQ,EAAE,kBAAkB;CAC3C,MAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,OAAO,CAC7C,KAAI,QAAQ,eAAe,SAAS,IAAI,EAAE;EACxC,MAAM,OAAO,GAAG,aAAa,GAAG;AAChC,SAAO,MAAM,EAAE,QAAQ,KAAK,EAAE,6BAA6B,OAAO;EAElE,MAAM,mBAAmB,aAAa,IAAI,mBAAmB;AAC7D,MAAI,SAAS,iBAAiB,CAC5B,QAAO,KAAK,KAAK,iBAAiB;AAGpC,MAAI,WACF,MAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,IAAI,EAAE;AAC9C,UAAO,MAAM,qBAAqB,KAAK,MAAM,OAAO;GACpD,IAAI,eAAe,MAAM,WAAW,YAAY,MAAM,WAAW;AACjE,OAAI,iBAAiB,CAAC,iBAAiB,aAAa,EAAE;AACpD,WAAO,MAAM,yCAAyC;AACtD,mBAAe,MAAM,WAAW,eAAe,MAAM,WAAW;;AAElE,OAAI,CAAC,iBAAiB,aAAa,EAAE;IACnC,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,UAAM,kBAAkB,2BAA2B,KAAK;AACxD,UAAM;;AAER,UAAO,MAAM,aAAa,KAAK,MAAM,OAAO;;AAE5C,OAAI,SAAS,YAAY;IACvB,MAAM,QAAQ,aAAa,QAAQ,MAAM,MAAM,EAAE,GAAG;AACpD,oBAAgB,QAAQ;AACxB,2BAAuB,MAAM;UACxB;AAEL,oBAAgB,QAAQ;AACxB,2BAAuB,aAAa;;;OAGnC;GACL,MAAM,MAAM,QAAQ;AACpB,OAAI,IAAI,gCAAgC,QAAQ;IAC9C,MAAM,QAAQ,IAAI,MAAM,kBAAkB;AAC1C,UAAM,mBAAmB;AACzB,UAAM,kBAAkB;AACxB,UAAM,oBAAoB,4DAA4D,IAAI;AAC1F,QAAI,IAAI,gBAAgB,OACtB,OAAM,oBAAoB;;;;AAK5B,UAAM;SAEN,QAAO,MAAM,yCAAyC;;AAG1D,SAAO,gBAAgB;YACd,QAAQ,IAAI,EAAE;AAEvB,kBAAgB,OAAO,EAAE;AACzB,OAAK,MAAM,CAAC,OAAO,SAAS,IAAI,SAAS,CACvC,KAAI,SAAS,KAAK,IAAI,CAAC,QAAQ,KAAK,EAAE;GACpC,MAAM,OAAO,GAAG,aAAa,GAAG,IAAI,GAAG,MAAM;AAE7C,GAAC,gBAAgB,KAA0B,KACzC,MAAM,cAAc,MAAwB,YAAY,KAAK,CAC9D;QAGD,CAAC,gBAAgB,KAAmB,KAAK,KAAK;YAGzC,SAAS,IAAI,IAAI,QAAQ,UAGlC,iBAAgB,OAAO,MAAM,cAC3B,KACA,YAJW,GAAG,aAAa,GAAG,MAM/B;AAGL,QAAO,gBAAgB;AACvB,QAAO,MAAM,EAAE,QAAQ,iBAAiB,EAAE,kBAAkB;AAC5D,QAAO;;AAGT,SAAgB,qBAAyC;AAEvD,KADiB,aAAa,IAAI,WAAW,KAC5B,QACf;CAGF,MAAM,WAAW,aAAa,IAAI,WAAW;CAC7C,MAAM,cAAc,SAAS,SAAS;AACtC,KAAI,gBAAgB,MAAM;AAExB,SAAO,KAAK,EAAE,UAAU,EAAE,gDAAgD;AAC1E;;CAGF,MAAM,kBAAkB,YAAY,YAAY,SAAS;AACzD,KAAI,CAAC,iBAAiB,gBAAgB,EAAE;AACtC,SAAO,MAAM,EAAE,UAAU,EAAE,gDAAgD;AAC3E;;AAGF,KAAI,gBAAgB,WAAW,OAAO,CAEpC,QAAO,gBAAgB,UAAU,EAAE;AAErC,QAAO"}

package/dist/config/defaults.js

@@ -1,5 +1,5 @@
-const require_clone = require('../util/clone.js');
-const require_index = require('./options/index.js');
+import { clone } from "../util/clone.js";
+import { getOptions } from "./options/index.js";
 
 //#region lib/config/defaults.ts
 const defaultValueFactories = {
@@ -10,10 +10,10 @@ const defaultValueFactories = {
 	integer: () => null
 };
 function getDefault(option) {
-	return option.default === void 0 ? defaultValueFactories[option.type]() : require_clone.clone(option.default);
+	return option.default === void 0 ? defaultValueFactories[option.type]() : clone(option.default);
 }
 function getConfig() {
-	const options = require_index.getOptions();
+	const options = getOptions();
 	const config = {};
 	options.forEach((option) => {
 		if (!option.parents || option.parents.includes(".")) config[option.name] = getDefault(option);
@@ -22,5 +22,5 @@ function getConfig() {
 }
 
 //#endregion
-exports.getConfig = getConfig;
+export { getConfig };
 //# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","names":["clone","getOptions"],"sources":["../../lib/config/defaults.ts"],"sourcesContent":["import { clone } from '../util/clone.ts';\nimport { getOptions } from './options/index.ts';\nimport type { AllConfig, RenovateOptions } from './types.ts';\n\n// Use functions instead of direct values to avoid introducing global references.\n// In particular, we want a new array instance every time we request a default array\n// instead of sharing a single instance - mutation of this value could cause serious problems.\n// See https://github.com/mend/renovate-on-prem/issues/290 for an example\nconst defaultValueFactories = {\n  boolean: () => true,\n  array: () => [],\n  string: () => null,\n  object: () => null,\n  integer: () => null,\n} as const;\n\nexport function getDefault(option: RenovateOptions): any {\n  return option.default === undefined\n    ? defaultValueFactories[option.type]()\n    : clone(option.default);\n}\n\nexport function getConfig(): AllConfig {\n  const options = getOptions();\n  const config: AllConfig = {};\n  options.forEach((option) => {\n    if (!option.parents || option.parents.includes('.')) {\n      config[option.name as keyof AllConfig] = getDefault(option);\n    }\n  });\n  return config;\n}\n"],"mappings":";;;;AAQA,MAAM,wBAAwB;CAC5B,eAAe;CACf,aAAa,EAAE;CACf,cAAc;CACd,cAAc;CACd,eAAe;CAChB;AAED,SAAgB,WAAW,QAA8B;AACvD,QAAO,OAAO,YAAY,SACtB,sBAAsB,OAAO,OAAO,GACpCA,oBAAM,OAAO,QAAQ;;AAG3B,SAAgB,YAAuB;CACrC,MAAM,UAAUC,0BAAY;CAC5B,MAAM,SAAoB,EAAE;AAC5B,SAAQ,SAAS,WAAW;AAC1B,MAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,SAAS,IAAI,CACjD,QAAO,OAAO,QAA2B,WAAW,OAAO;GAE7D;AACF,QAAO"}
+{"version":3,"file":"defaults.js","names":[],"sources":["../../lib/config/defaults.ts"],"sourcesContent":["import { clone } from '../util/clone.ts';\nimport { getOptions } from './options/index.ts';\nimport type { AllConfig, RenovateOptions } from './types.ts';\n\n// Use functions instead of direct values to avoid introducing global references.\n// In particular, we want a new array instance every time we request a default array\n// instead of sharing a single instance - mutation of this value could cause serious problems.\n// See https://github.com/mend/renovate-on-prem/issues/290 for an example\nconst defaultValueFactories = {\n  boolean: () => true,\n  array: () => [],\n  string: () => null,\n  object: () => null,\n  integer: () => null,\n} as const;\n\nexport function getDefault(option: RenovateOptions): any {\n  return option.default === undefined\n    ? defaultValueFactories[option.type]()\n    : clone(option.default);\n}\n\nexport function getConfig(): AllConfig {\n  const options = getOptions();\n  const config: AllConfig = {};\n  options.forEach((option) => {\n    if (!option.parents || option.parents.includes('.')) {\n      config[option.name as keyof AllConfig] = getDefault(option);\n    }\n  });\n  return config;\n}\n"],"mappings":";;;;AAQA,MAAM,wBAAwB;CAC5B,eAAe;CACf,aAAa,EAAE;CACf,cAAc;CACd,cAAc;CACd,eAAe;CAChB;AAED,SAAgB,WAAW,QAA8B;AACvD,QAAO,OAAO,YAAY,SACtB,sBAAsB,OAAO,OAAO,GACpC,MAAM,OAAO,QAAQ;;AAG3B,SAAgB,YAAuB;CACrC,MAAM,UAAU,YAAY;CAC5B,MAAM,SAAoB,EAAE;AAC5B,SAAQ,SAAS,WAAW;AAC1B,MAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,SAAS,IAAI,CACjD,QAAO,OAAO,QAA2B,WAAW,OAAO;GAE7D;AACF,QAAO"}

package/dist/config/global.js

@@ -1,4 +1,3 @@
-
 //#region lib/config/global.ts
 var GlobalConfig = class GlobalConfig {
 	static OPTIONS = [
@@ -63,5 +62,5 @@ var GlobalConfig = class GlobalConfig {
 };
 
 //#endregion
-exports.GlobalConfig = GlobalConfig;
+export { GlobalConfig };
 //# sourceMappingURL=global.js.map

package/dist/config/global.js.map

@@ -1 +1 @@
-{"version":3,"file":"global.js","names":[],"sources":["../../lib/config/global.ts"],"sourcesContent":["import type { RenovateConfig, RepoGlobalConfig } from './types.ts';\n\nexport class GlobalConfig {\n  // TODO: once global config work is complete, add a test to make sure this list includes all options with globalOnly=true (#9603)\n  static OPTIONS: readonly (keyof RepoGlobalConfig)[] = [\n    'allowCustomCrateRegistries',\n    'allowPlugins',\n    'allowScripts',\n    'allowShellExecutorForPostUpgradeCommands',\n    'allowedCommands',\n    'allowedEnv',\n    'allowedHeaders',\n    'allowedUnsafeExecutions',\n    'autodiscoverRepoOrder',\n    'autodiscoverRepoSort',\n    'binarySource',\n    'cacheDir',\n    'cacheHardTtlMinutes',\n    'cachePrivatePackages',\n    'cacheTtlOverride',\n    'configFileNames',\n    'containerbaseDir',\n    'customEnvVariables',\n    'dockerChildPrefix',\n    'dockerCliOptions',\n    'dockerMaxPages',\n    'dockerSidecarImage',\n    'dockerUser',\n    'dryRun',\n    'encryptedWarning',\n    'endpoint',\n    'executionTimeout',\n    'exposeAllEnv',\n    'gitTimeout',\n    'githubTokenWarn',\n    'httpCacheTtlDays',\n    'ignorePrAuthor',\n    'includeMirrors',\n    'localDir',\n    'migratePresets',\n    'onboardingAutoCloseAge',\n    'platform',\n    'presetCachePersistence',\n    's3Endpoint',\n    's3PathStyle',\n    'userAgent',\n  ];\n\n  private static config: RepoGlobalConfig = {};\n\n  static get(): RepoGlobalConfig;\n  static get<Key extends keyof RepoGlobalConfig>(\n    key: Key,\n  ): RepoGlobalConfig[Key];\n  static get<Key extends keyof RepoGlobalConfig>(\n    key: Key,\n    defaultValue: Required<RepoGlobalConfig>[Key],\n  ): Required<RepoGlobalConfig>[Key];\n  static get<Key extends keyof RepoGlobalConfig>(\n    key?: Key,\n    defaultValue?: RepoGlobalConfig[Key],\n  ): RepoGlobalConfig | RepoGlobalConfig[Key] {\n    return key\n      ? (GlobalConfig.config[key] ?? defaultValue)\n      : GlobalConfig.config;\n  }\n\n  static set(config: RenovateConfig & RepoGlobalConfig): RenovateConfig {\n    GlobalConfig.reset();\n\n    const result = { ...config };\n    for (const option of GlobalConfig.OPTIONS) {\n      GlobalConfig.config[option] = config[option] as never;\n      delete result[option];\n    }\n\n    return result;\n  }\n\n  static reset(): void {\n    GlobalConfig.config = {};\n  }\n}\n"],"mappings":";;AAEA,IAAa,eAAb,MAAa,aAAa;CAExB,OAAO,UAA+C;EACpD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CAED,OAAe,SAA2B,EAAE;CAU5C,OAAO,IACL,KACA,cAC0C;AAC1C,SAAO,MACF,aAAa,OAAO,QAAQ,eAC7B,aAAa;;CAGnB,OAAO,IAAI,QAA2D;AACpE,eAAa,OAAO;EAEpB,MAAM,SAAS,EAAE,GAAG,QAAQ;AAC5B,OAAK,MAAM,UAAU,aAAa,SAAS;AACzC,gBAAa,OAAO,UAAU,OAAO;AACrC,UAAO,OAAO;;AAGhB,SAAO;;CAGT,OAAO,QAAc;AACnB,eAAa,SAAS,EAAE"}
+{"version":3,"file":"global.js","names":[],"sources":["../../lib/config/global.ts"],"sourcesContent":["import type { RenovateConfig, RepoGlobalConfig } from './types.ts';\n\nexport class GlobalConfig {\n  // TODO: once global config work is complete, add a test to make sure this list includes all options with globalOnly=true (#9603)\n  static OPTIONS: readonly (keyof RepoGlobalConfig)[] = [\n    'allowCustomCrateRegistries',\n    'allowPlugins',\n    'allowScripts',\n    'allowShellExecutorForPostUpgradeCommands',\n    'allowedCommands',\n    'allowedEnv',\n    'allowedHeaders',\n    'allowedUnsafeExecutions',\n    'autodiscoverRepoOrder',\n    'autodiscoverRepoSort',\n    'binarySource',\n    'cacheDir',\n    'cacheHardTtlMinutes',\n    'cachePrivatePackages',\n    'cacheTtlOverride',\n    'configFileNames',\n    'containerbaseDir',\n    'customEnvVariables',\n    'dockerChildPrefix',\n    'dockerCliOptions',\n    'dockerMaxPages',\n    'dockerSidecarImage',\n    'dockerUser',\n    'dryRun',\n    'encryptedWarning',\n    'endpoint',\n    'executionTimeout',\n    'exposeAllEnv',\n    'gitTimeout',\n    'githubTokenWarn',\n    'httpCacheTtlDays',\n    'ignorePrAuthor',\n    'includeMirrors',\n    'localDir',\n    'migratePresets',\n    'onboardingAutoCloseAge',\n    'platform',\n    'presetCachePersistence',\n    's3Endpoint',\n    's3PathStyle',\n    'userAgent',\n  ];\n\n  private static config: RepoGlobalConfig = {};\n\n  static get(): RepoGlobalConfig;\n  static get<Key extends keyof RepoGlobalConfig>(\n    key: Key,\n  ): RepoGlobalConfig[Key];\n  static get<Key extends keyof RepoGlobalConfig>(\n    key: Key,\n    defaultValue: Required<RepoGlobalConfig>[Key],\n  ): Required<RepoGlobalConfig>[Key];\n  static get<Key extends keyof RepoGlobalConfig>(\n    key?: Key,\n    defaultValue?: RepoGlobalConfig[Key],\n  ): RepoGlobalConfig | RepoGlobalConfig[Key] {\n    return key\n      ? (GlobalConfig.config[key] ?? defaultValue)\n      : GlobalConfig.config;\n  }\n\n  static set(config: RenovateConfig & RepoGlobalConfig): RenovateConfig {\n    GlobalConfig.reset();\n\n    const result = { ...config };\n    for (const option of GlobalConfig.OPTIONS) {\n      GlobalConfig.config[option] = config[option] as never;\n      delete result[option];\n    }\n\n    return result;\n  }\n\n  static reset(): void {\n    GlobalConfig.config = {};\n  }\n}\n"],"mappings":";AAEA,IAAa,eAAb,MAAa,aAAa;CAExB,OAAO,UAA+C;EACpD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CAED,OAAe,SAA2B,EAAE;CAU5C,OAAO,IACL,KACA,cAC0C;AAC1C,SAAO,MACF,aAAa,OAAO,QAAQ,eAC7B,aAAa;;CAGnB,OAAO,IAAI,QAA2D;AACpE,eAAa,OAAO;EAEpB,MAAM,SAAS,EAAE,GAAG,QAAQ;AAC5B,OAAK,MAAM,UAAU,aAAa,SAAS;AACzC,gBAAa,OAAO,UAAU,OAAO;AACrC,UAAO,OAAO;;AAGhB,SAAO;;CAGT,OAAO,QAAc;AACnB,eAAa,SAAS,EAAE"}