renovate 44.0.0-next.3 → 44.0.1

package/dist/_virtual/_rolldown/runtime.js

@@ -1,22 +1,16 @@
 import { createRequire } from "node:module";
-
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {
 	let target = {};
-	for (var name in all) {
-		__defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	}
-	if (!no_symbols) {
-		__defProp(target, Symbol.toStringTag, { value: "Module" });
-	}
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
 	return target;
 };
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
-export { __commonJSMin, __exportAll, __require };
+export { __commonJSMin, __exportAll, __require };

package/dist/config/app-strings.js

@@ -1,19 +1,15 @@
 import { regEx } from "../util/regex.js";
 import { isNonEmptyString } from "@sindresorhus/is";
-
+import { braceExpand } from "minimatch";
 //#region lib/config/app-strings.ts
 const configFileNames = [
-	"renovate.json",
-	"renovate.json5",
-	".github/renovate.json",
-	".github/renovate.json5",
-	".gitlab/renovate.json",
-	".gitlab/renovate.json5",
+	"renovate.json{,c,5}",
+	".github/renovate.json{,c,5}",
+	".gitlab/renovate.json{,c,5}",
 	".renovaterc",
-	".renovaterc.json",
-	".renovaterc.json5",
+	".renovaterc.json{,c,5}",
 	"package.json"
-];
+].flatMap((p) => braceExpand(p));
 let userAddedConfigFileNames = [];
 function setUserConfigFileNames(fileNames) {
 	userAddedConfigFileNames = fileNames;
@@ -21,21 +17,22 @@ function setUserConfigFileNames(fileNames) {
 function getConfigFileNames(platform) {
 	let filteredConfigFileNames = [...configFileNames];
 	if (isNonEmptyString(platform)) {
-		const platfromRe = regEx("\\.(?<platform>.*)\\/renovate\\.json[5]?$");
+		const platfromRe = regEx("\\.(?<platform>.*)\\/renovate\\.json[c5]?$");
 		filteredConfigFileNames = configFileNames.filter((filename) => {
 			const matchResult = platfromRe.exec(filename);
 			if (!matchResult) return true;
-			else if (matchResult?.groups?.platform === platform) return true;
+			if (matchResult?.groups?.platform === platform) return true;
 			return false;
 		});
 		if (!["github", "gitlab"].includes(platform) && platform !== "local") {
 			filteredConfigFileNames.push(`.${platform}/renovate.json`);
+			filteredConfigFileNames.push(`.${platform}/renovate.jsonc`);
 			filteredConfigFileNames.push(`.${platform}/renovate.json5`);
 		}
 	}
 	return [...userAddedConfigFileNames, ...filteredConfigFileNames];
 }
-
 //#endregion
 export { getConfigFileNames, setUserConfigFileNames };
+
 //# sourceMappingURL=app-strings.js.map

package/dist/config/app-strings.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-strings.js","names":[],"sources":["../../lib/config/app-strings.ts"],"sourcesContent":["import { isNonEmptyString } from '@sindresorhus/is';\nimport type { PlatformId } from '../constants/index.ts';\nimport { regEx } from '../util/regex.ts';\n\nconst configFileNames = [\n  'renovate.json',\n  'renovate.json5',\n  '.github/renovate.json',\n  '.github/renovate.json5',\n  '.gitlab/renovate.json',\n  '.gitlab/renovate.json5',\n  '.renovaterc',\n  '.renovaterc.json',\n  '.renovaterc.json5',\n  'package.json',\n];\n\nlet userAddedConfigFileNames: string[] = [];\n\nexport function setUserConfigFileNames(fileNames: string[]): void {\n  userAddedConfigFileNames = fileNames;\n}\n\nexport function getConfigFileNames(platform?: PlatformId): string[] {\n  let filteredConfigFileNames = [...configFileNames];\n\n  if (isNonEmptyString(platform)) {\n    const platfromRe = regEx('\\\\.(?<platform>.*)\\\\/renovate\\\\.json[5]?$');\n    filteredConfigFileNames = configFileNames.filter((filename) => {\n      const matchResult = platfromRe.exec(filename);\n      if (!matchResult) {\n        return true;\n      } else if (matchResult?.groups?.platform === platform) {\n        return true;\n      }\n\n      return false;\n    });\n\n    if (!['github', 'gitlab'].includes(platform) && platform !== 'local') {\n      filteredConfigFileNames.push(`.${platform}/renovate.json`);\n      filteredConfigFileNames.push(`.${platform}/renovate.json5`);\n    }\n  }\n  return [...userAddedConfigFileNames, ...filteredConfigFileNames];\n}\n"],"mappings":";;;;AAIA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,IAAI,2BAAqC,EAAE;AAE3C,SAAgB,uBAAuB,WAA2B;AAChE,4BAA2B;;AAG7B,SAAgB,mBAAmB,UAAiC;CAClE,IAAI,0BAA0B,CAAC,GAAG,gBAAgB;AAElD,KAAI,iBAAiB,SAAS,EAAE;EAC9B,MAAM,aAAa,MAAM,4CAA4C;AACrE,4BAA0B,gBAAgB,QAAQ,aAAa;GAC7D,MAAM,cAAc,WAAW,KAAK,SAAS;AAC7C,OAAI,CAAC,YACH,QAAO;YACE,aAAa,QAAQ,aAAa,SAC3C,QAAO;AAGT,UAAO;IACP;AAEF,MAAI,CAAC,CAAC,UAAU,SAAS,CAAC,SAAS,SAAS,IAAI,aAAa,SAAS;AACpE,2BAAwB,KAAK,IAAI,SAAS,gBAAgB;AAC1D,2BAAwB,KAAK,IAAI,SAAS,iBAAiB;;;AAG/D,QAAO,CAAC,GAAG,0BAA0B,GAAG,wBAAwB"}
+{"version":3,"file":"app-strings.js","names":[],"sources":["../../lib/config/app-strings.ts"],"sourcesContent":["import { isNonEmptyString } from '@sindresorhus/is';\nimport { braceExpand } from 'minimatch';\nimport type { PlatformId } from '../constants/index.ts';\nimport { regEx } from '../util/regex.ts';\n\nconst configFilePatterns = [\n  'renovate.json{,c,5}',\n  '.github/renovate.json{,c,5}',\n  '.gitlab/renovate.json{,c,5}',\n  '.renovaterc',\n  '.renovaterc.json{,c,5}',\n  'package.json',\n];\n\nconst configFileNames = configFilePatterns.flatMap((p) => braceExpand(p));\n\nlet userAddedConfigFileNames: string[] = [];\n\nexport function setUserConfigFileNames(fileNames: string[]): void {\n  userAddedConfigFileNames = fileNames;\n}\n\nexport function getConfigFileNames(platform?: PlatformId): string[] {\n  let filteredConfigFileNames = [...configFileNames];\n\n  if (isNonEmptyString(platform)) {\n    const platfromRe = regEx('\\\\.(?<platform>.*)\\\\/renovate\\\\.json[c5]?$');\n    filteredConfigFileNames = configFileNames.filter((filename) => {\n      const matchResult = platfromRe.exec(filename);\n      if (!matchResult) {\n        return true;\n      }\n      if (matchResult?.groups?.platform === platform) {\n        return true;\n      }\n\n      return false;\n    });\n\n    if (!['github', 'gitlab'].includes(platform) && platform !== 'local') {\n      filteredConfigFileNames.push(`.${platform}/renovate.json`);\n      filteredConfigFileNames.push(`.${platform}/renovate.jsonc`);\n      filteredConfigFileNames.push(`.${platform}/renovate.json5`);\n    }\n  }\n  return [...userAddedConfigFileNames, ...filteredConfigFileNames];\n}\n"],"mappings":";;;;AAcA,MAAM,kBAAkB;CARtB;CACA;CACA;CACA;CACA;CACA;AAGuC,CAAC,CAAC,SAAS,MAAM,YAAY,CAAC,CAAC;AAExE,IAAI,2BAAqC,CAAC;AAE1C,SAAgB,uBAAuB,WAA2B;CAChE,2BAA2B;AAC7B;AAEA,SAAgB,mBAAmB,UAAiC;CAClE,IAAI,0BAA0B,CAAC,GAAG,eAAe;CAEjD,IAAI,iBAAiB,QAAQ,GAAG;EAC9B,MAAM,aAAa,MAAM,4CAA4C;EACrE,0BAA0B,gBAAgB,QAAQ,aAAa;GAC7D,MAAM,cAAc,WAAW,KAAK,QAAQ;GAC5C,IAAI,CAAC,aACH,OAAO;GAET,IAAI,aAAa,QAAQ,aAAa,UACpC,OAAO;GAGT,OAAO;EACT,CAAC;EAED,IAAI,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC,SAAS,QAAQ,KAAK,aAAa,SAAS;GACpE,wBAAwB,KAAK,IAAI,SAAS,eAAe;GACzD,wBAAwB,KAAK,IAAI,SAAS,gBAAgB;GAC1D,wBAAwB,KAAK,IAAI,SAAS,gBAAgB;EAC5D;CACF;CACA,OAAO,CAAC,GAAG,0BAA0B,GAAG,uBAAuB;AACjE"}

package/dist/config/decrypt/bcpgp.js

@@ -2,7 +2,6 @@ import { getEnv } from "../../util/env.js";
 import { regEx } from "../../util/regex.js";
 import { logger } from "../../logger/index.js";
 import { decrypt, isSupportedRuntime } from "@renovatebot/pgp";
-
 //#region lib/config/decrypt/bcpgp.ts
 async function tryDecryptBcPgp(privateKey, encryptedStr) {
 	try {
@@ -29,14 +28,17 @@ async function tryDecryptBcPgp(privateKey, encryptedStr) {
 }
 function runtime() {
 	const runtime = getEnv().RENOVATE_X_PGP_RUNTIME;
-	if (runtime) if (isSupportedRuntime(runtime)) {
-		logger.trace({ runtime }, "Using configured PGP runtime");
-		return runtime;
-	} else logger.once.warn({ runtime }, "Unknown PGP runtime, using wasm-java");
+	if (runtime) {
+		if (isSupportedRuntime(runtime)) {
+			logger.trace({ runtime }, "Using configured PGP runtime");
+			return runtime;
+		}
+		logger.once.warn({ runtime }, "Unknown PGP runtime, using wasm-java");
+	}
 	logger.trace("Using default PGP runtime: wasm-java");
 	return "wasm-java";
 }
-
 //#endregion
 export { tryDecryptBcPgp };
+
 //# sourceMappingURL=bcpgp.js.map

package/dist/config/decrypt/bcpgp.js.map

@@ -1 +1 @@
-{"version":3,"file":"bcpgp.js","names":[],"sources":["../../../lib/config/decrypt/bcpgp.ts"],"sourcesContent":["import type { RuntimeType } from '@renovatebot/pgp';\nimport { decrypt, isSupportedRuntime } from '@renovatebot/pgp';\nimport { logger } from '../../logger/index.ts';\nimport { getEnv } from '../../util/env.ts';\nimport { regEx } from '../../util/regex.ts';\n\nexport async function tryDecryptBcPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  try {\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n\n    const hasStartHeader = armoredMessage.startsWith(startBlock);\n    const hasEndHeader = armoredMessage.endsWith(endBlock);\n\n    if (\n      !hasStartHeader &&\n      !hasEndHeader &&\n      !armoredMessage.includes('=') &&\n      !armoredMessage.includes('\\n') &&\n      armoredMessage.length % 4 !== 0\n    ) {\n      logger.debug('Adding base64 padding to armored message');\n      armoredMessage += `=`.repeat(4 - (armoredMessage.length % 4));\n    }\n\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasStartHeader) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasEndHeader) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n\n    const data = await decrypt(\n      privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n      armoredMessage,\n      {\n        runtime: runtime(),\n      },\n    );\n    logger.debug('Decrypted config using bcpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using bcpgp');\n    return null;\n  }\n}\n\nfunction runtime(): RuntimeType {\n  const runtime = getEnv().RENOVATE_X_PGP_RUNTIME;\n  if (runtime) {\n    if (isSupportedRuntime(runtime)) {\n      logger.trace({ runtime }, 'Using configured PGP runtime');\n      return runtime;\n    } else {\n      logger.once.warn({ runtime }, 'Unknown PGP runtime, using wasm-java');\n    }\n  }\n  logger.trace('Using default PGP runtime: wasm-java');\n  return 'wasm-java';\n}\n"],"mappings":";;;;;;AAMA,eAAsB,gBACpB,YACA,cACwB;AACxB,KAAI;EACF,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,MAAM;EAExC,MAAM,iBAAiB,eAAe,WAAW,WAAW;EAC5D,MAAM,eAAe,eAAe,SAAS,SAAS;AAEtD,MACE,CAAC,kBACD,CAAC,gBACD,CAAC,eAAe,SAAS,IAAI,IAC7B,CAAC,eAAe,SAAS,KAAK,IAC9B,eAAe,SAAS,MAAM,GAC9B;AACA,UAAO,MAAM,2CAA2C;AACxD,qBAAkB,IAAI,OAAO,IAAK,eAAe,SAAS,EAAG;;;AAI/D,MAAI,CAAC,eACH,kBAAiB,GAAG,aAAa;;AAGnC,MAAI,CAAC,aACH,kBAAiB,GAAG,iBAAiB;EAGvC,MAAM,OAAO,MAAM,QACjB,WAAW,QAAQ,MAAM,YAAY,EAAE,KAAK,EAC5C,gBACA,EACE,SAAS,SAAS,EACnB,CACF;AACD,SAAO,MAAM,+BAA+B;AAC5C,SAAO;UACA,KAAK;AACZ,SAAO,MAAM,EAAE,KAAK,EAAE,gCAAgC;AACtD,SAAO;;;AAIX,SAAS,UAAuB;CAC9B,MAAM,UAAU,QAAQ,CAAC;AACzB,KAAI,QACF,KAAI,mBAAmB,QAAQ,EAAE;AAC/B,SAAO,MAAM,EAAE,SAAS,EAAE,+BAA+B;AACzD,SAAO;OAEP,QAAO,KAAK,KAAK,EAAE,SAAS,EAAE,uCAAuC;AAGzE,QAAO,MAAM,uCAAuC;AACpD,QAAO"}
+{"version":3,"file":"bcpgp.js","names":[],"sources":["../../../lib/config/decrypt/bcpgp.ts"],"sourcesContent":["import type { RuntimeType } from '@renovatebot/pgp';\nimport { decrypt, isSupportedRuntime } from '@renovatebot/pgp';\nimport { logger } from '../../logger/index.ts';\nimport { getEnv } from '../../util/env.ts';\nimport { regEx } from '../../util/regex.ts';\n\nexport async function tryDecryptBcPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  try {\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n\n    const hasStartHeader = armoredMessage.startsWith(startBlock);\n    const hasEndHeader = armoredMessage.endsWith(endBlock);\n\n    if (\n      !hasStartHeader &&\n      !hasEndHeader &&\n      !armoredMessage.includes('=') &&\n      !armoredMessage.includes('\\n') &&\n      armoredMessage.length % 4 !== 0\n    ) {\n      logger.debug('Adding base64 padding to armored message');\n      armoredMessage += `=`.repeat(4 - (armoredMessage.length % 4));\n    }\n\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasStartHeader) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!hasEndHeader) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n\n    const data = await decrypt(\n      privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n      armoredMessage,\n      {\n        runtime: runtime(),\n      },\n    );\n    logger.debug('Decrypted config using bcpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using bcpgp');\n    return null;\n  }\n}\n\nfunction runtime(): RuntimeType {\n  const runtime = getEnv().RENOVATE_X_PGP_RUNTIME;\n  if (runtime) {\n    if (isSupportedRuntime(runtime)) {\n      logger.trace({ runtime }, 'Using configured PGP runtime');\n      return runtime;\n    }\n    logger.once.warn({ runtime }, 'Unknown PGP runtime, using wasm-java');\n  }\n  logger.trace('Using default PGP runtime: wasm-java');\n  return 'wasm-java';\n}\n"],"mappings":";;;;;AAMA,eAAsB,gBACpB,YACA,cACwB;CACxB,IAAI;EACF,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,KAAK;EAEvC,MAAM,iBAAiB,eAAe,WAAW,UAAU;EAC3D,MAAM,eAAe,eAAe,SAAS,QAAQ;EAErD,IACE,CAAC,kBACD,CAAC,gBACD,CAAC,eAAe,SAAS,GAAG,KAC5B,CAAC,eAAe,SAAS,IAAI,KAC7B,eAAe,SAAS,MAAM,GAC9B;GACA,OAAO,MAAM,0CAA0C;GACvD,kBAAkB,IAAI,OAAO,IAAK,eAAe,SAAS,CAAE;EAC9D;;EAGA,IAAI,CAAC,gBACH,iBAAiB,GAAG,aAAa;;EAGnC,IAAI,CAAC,cACH,iBAAiB,GAAG,iBAAiB;EAGvC,MAAM,OAAO,MAAM,QACjB,WAAW,QAAQ,MAAM,WAAW,GAAG,IAAI,GAC3C,gBACA,EACE,SAAS,QAAQ,EACnB,CACF;EACA,OAAO,MAAM,8BAA8B;EAC3C,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+BAA+B;EACrD,OAAO;CACT;AACF;AAEA,SAAS,UAAuB;CAC9B,MAAM,UAAU,OAAO,CAAC,CAAC;CACzB,IAAI,SAAS;EACX,IAAI,mBAAmB,OAAO,GAAG;GAC/B,OAAO,MAAM,EAAE,QAAQ,GAAG,8BAA8B;GACxD,OAAO;EACT;EACA,OAAO,KAAK,KAAK,EAAE,QAAQ,GAAG,sCAAsC;CACtE;CACA,OAAO,MAAM,sCAAsC;CACnD,OAAO;AACT"}

package/dist/config/decrypt/openpgp.js

@@ -1,7 +1,6 @@
 import { openpgp } from "../../expose.js";
 import { regEx } from "../../util/regex.js";
 import { logger } from "../../logger/index.js";
-
 //#region lib/config/decrypt/openpgp.ts
 let pgp = void 0;
 async function tryDecryptOpenPgp(privateKey, encryptedStr) {
@@ -36,7 +35,7 @@ async function tryDecryptOpenPgp(privateKey, encryptedStr) {
 		return null;
 	}
 }
-
 //#endregion
 export { tryDecryptOpenPgp };
+
 //# sourceMappingURL=openpgp.js.map

package/dist/config/decrypt/openpgp.js.map

@@ -1 +1 @@
-{"version":3,"file":"openpgp.js","names":[],"sources":["../../../lib/config/decrypt/openpgp.ts"],"sourcesContent":["import { openpgp } from '../../expose.ts';\nimport { logger } from '../../logger/index.ts';\nimport { regEx } from '../../util/regex.ts';\n\nlet pgp: typeof import('openpgp') | null | undefined = undefined;\n\nexport async function tryDecryptOpenPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  if (pgp === undefined) {\n    try {\n      pgp = await openpgp();\n    } catch (err) {\n      logger.warn({ err }, 'Could load openpgp');\n      pgp = null;\n    }\n  }\n\n  if (pgp === null) {\n    logger.once.warn('Cannot load openpgp, skipping decryption');\n    return null;\n  }\n\n  try {\n    const pk = await pgp.readPrivateKey({\n      // prettier-ignore\n      armoredKey: privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n    });\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.startsWith(startBlock)) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.endsWith(endBlock)) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n    const message = await pgp.readMessage({\n      armoredMessage,\n    });\n    const { data } = await pgp.decrypt({\n      message,\n      decryptionKeys: pk,\n    });\n    logger.debug('Decrypted config using openpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using openpgp');\n    return null;\n  }\n}\n"],"mappings":";;;;;AAIA,IAAI,MAAmD;AAEvD,eAAsB,kBACpB,YACA,cACwB;AACxB,KAAI,QAAQ,OACV,KAAI;AACF,QAAM,MAAM,SAAS;UACd,KAAK;AACZ,SAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB;AAC1C,QAAM;;AAIV,KAAI,QAAQ,MAAM;AAChB,SAAO,KAAK,KAAK,2CAA2C;AAC5D,SAAO;;AAGT,KAAI;EACF,MAAM,KAAK,MAAM,IAAI,eAAe,EAElC,YAAY,WAAW,QAAQ,MAAM,YAAY,EAAE,KAAK,EACzD,CAAC;EACF,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,MAAM;;AAExC,MAAI,CAAC,eAAe,WAAW,WAAW,CACxC,kBAAiB,GAAG,aAAa;;AAGnC,MAAI,CAAC,eAAe,SAAS,SAAS,CACpC,kBAAiB,GAAG,iBAAiB;EAEvC,MAAM,UAAU,MAAM,IAAI,YAAY,EACpC,gBACD,CAAC;EACF,MAAM,EAAE,SAAS,MAAM,IAAI,QAAQ;GACjC;GACA,gBAAgB;GACjB,CAAC;AACF,SAAO,MAAM,iCAAiC;AAC9C,SAAO;UACA,KAAK;AACZ,SAAO,MAAM,EAAE,KAAK,EAAE,kCAAkC;AACxD,SAAO"}
+{"version":3,"file":"openpgp.js","names":[],"sources":["../../../lib/config/decrypt/openpgp.ts"],"sourcesContent":["import { openpgp } from '../../expose.ts';\nimport { logger } from '../../logger/index.ts';\nimport { regEx } from '../../util/regex.ts';\n\nlet pgp: typeof import('openpgp') | null | undefined = undefined;\n\nexport async function tryDecryptOpenPgp(\n  privateKey: string,\n  encryptedStr: string,\n): Promise<string | null> {\n  if (pgp === undefined) {\n    try {\n      pgp = await openpgp();\n    } catch (err) {\n      logger.warn({ err }, 'Could load openpgp');\n      pgp = null;\n    }\n  }\n\n  if (pgp === null) {\n    logger.once.warn('Cannot load openpgp, skipping decryption');\n    return null;\n  }\n\n  try {\n    const pk = await pgp.readPrivateKey({\n      // prettier-ignore\n      armoredKey: privateKey.replace(regEx(/\\n[ \\t]+/g), '\\n'), // little massage to help a common problem\n    });\n    const startBlock = '-----BEGIN PGP MESSAGE-----\\n\\n';\n    const endBlock = '\\n-----END PGP MESSAGE-----';\n    let armoredMessage = encryptedStr.trim();\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.startsWith(startBlock)) {\n      armoredMessage = `${startBlock}${armoredMessage}`;\n    }\n    // v8 ignore else -- TODO: add test #40625\n    if (!armoredMessage.endsWith(endBlock)) {\n      armoredMessage = `${armoredMessage}${endBlock}`;\n    }\n    const message = await pgp.readMessage({\n      armoredMessage,\n    });\n    const { data } = await pgp.decrypt({\n      message,\n      decryptionKeys: pk,\n    });\n    logger.debug('Decrypted config using openpgp');\n    return data;\n  } catch (err) {\n    logger.debug({ err }, 'Could not decrypt using openpgp');\n    return null;\n  }\n}\n"],"mappings":";;;;AAIA,IAAI,MAAmD,KAAA;AAEvD,eAAsB,kBACpB,YACA,cACwB;CACxB,IAAI,QAAQ,KAAA,GACV,IAAI;EACF,MAAM,MAAM,QAAQ;CACtB,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,oBAAoB;EACzC,MAAM;CACR;CAGF,IAAI,QAAQ,MAAM;EAChB,OAAO,KAAK,KAAK,0CAA0C;EAC3D,OAAO;CACT;CAEA,IAAI;EACF,MAAM,KAAK,MAAM,IAAI,eAAe,EAElC,YAAY,WAAW,QAAQ,MAAM,WAAW,GAAG,IAAI,EACzD,CAAC;EACD,MAAM,aAAa;EACnB,MAAM,WAAW;EACjB,IAAI,iBAAiB,aAAa,KAAK;;EAEvC,IAAI,CAAC,eAAe,WAAW,UAAU,GACvC,iBAAiB,GAAG,aAAa;;EAGnC,IAAI,CAAC,eAAe,SAAS,QAAQ,GACnC,iBAAiB,GAAG,iBAAiB;EAEvC,MAAM,UAAU,MAAM,IAAI,YAAY,EACpC,eACF,CAAC;EACD,MAAM,EAAE,SAAS,MAAM,IAAI,QAAQ;GACjC;GACA,gBAAgB;EAClB,CAAC;EACD,OAAO,MAAM,gCAAgC;EAC7C,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,iCAAiC;EACvD,OAAO;CACT;AACF"}

package/dist/config/decrypt.js

@@ -9,7 +9,6 @@ import { tryDecryptBcPgp } from "./decrypt/bcpgp.js";
 import { tryDecryptOpenPgp } from "./decrypt/openpgp.js";
 import { DecryptedObject } from "./schema.js";
 import { isArray, isNonEmptyString, isObject, isString } from "@sindresorhus/is";
-
 //#region lib/config/decrypt.ts
 let privateKey;
 let privateKeyOld;
@@ -109,7 +108,7 @@ async function decryptConfig(config, repository, existingPath = "$") {
 				if (env.MEND_HOSTED === "true") error.validationMessage = `Mend-hosted Renovate Apps no longer support the use of encrypted secrets in Renovate file config (e.g. renovate.json).
 Please migrate all secrets to the Developer Portal using the web UI available at https://developer.mend.io/
 
-Refer to migration documents here: https://docs.renovatebot.com/mend-hosted/migrating-secrets/`;
+Refer to migration documents here: ${GlobalConfig.get("productLinks").documentation}mend-hosted/migrating-secrets/`;
 				throw error;
 			} else logger.error("Found encrypted data but no privateKey");
 		}
@@ -141,7 +140,7 @@ function getAzureCollection() {
 	if (azureCollection.startsWith("tfs/")) return azureCollection.substring(4);
 	return azureCollection;
 }
-
 //#endregion
-export { decryptConfig, setPrivateKeys };
+export { decryptConfig, getAzureCollection, setPrivateKeys, tryDecrypt, validateDecryptedValue };
+
 //# sourceMappingURL=decrypt.js.map

package/dist/config/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","names":[],"sources":["../../lib/config/decrypt.ts"],"sourcesContent":["import {\n  isArray,\n  isNonEmptyString,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport { CONFIG_VALIDATION } from '../constants/error-messages.ts';\nimport { logger } from '../logger/index.ts';\nimport { getEnv } from '../util/env.ts';\nimport { regEx } from '../util/regex.ts';\nimport { addSecretForSanitizing } from '../util/sanitize.ts';\nimport { ensureTrailingSlash, parseUrl, trimSlashes } from '../util/url.ts';\nimport { tryDecryptBcPgp } from './decrypt/bcpgp.ts';\nimport { tryDecryptOpenPgp } from './decrypt/openpgp.ts';\nimport { GlobalConfig } from './global.ts';\nimport { DecryptedObject } from './schema.ts';\nimport type { AllConfig, RenovateConfig } from './types.ts';\n\nlet privateKey: string | undefined;\nlet privateKeyOld: string | undefined;\n\nexport function setPrivateKeys(\n  pKey: string | undefined,\n  pKeyOld: string | undefined,\n): void {\n  privateKey = pKey;\n  privateKeyOld = pKeyOld;\n}\n\nexport async function tryDecrypt(\n  key: string,\n  encryptedStr: string,\n  repository: string,\n): Promise<string | null> {\n  let decryptedStr: string | null = null;\n  const decryptedObjStr =\n    getEnv().RENOVATE_X_USE_OPENPGP === 'true'\n      ? await tryDecryptOpenPgp(key, encryptedStr)\n      : await tryDecryptBcPgp(key, encryptedStr);\n  if (decryptedObjStr) {\n    decryptedStr = validateDecryptedValue(decryptedObjStr, repository);\n  }\n  return decryptedStr;\n}\n\nexport function validateDecryptedValue(\n  decryptedObjStr: string,\n  repository: string,\n): string | null {\n  try {\n    const decryptedObj = DecryptedObject.safeParse(decryptedObjStr);\n    if (!decryptedObj.success) {\n      const error = new Error('config-validation');\n      error.validationError = `Could not parse decrypted config.`;\n      throw error;\n    }\n\n    const { o: org, r: repo, v: value } = decryptedObj.data;\n\n    if (!isNonEmptyString(value)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a value.`;\n      throw error;\n    }\n\n    if (!isNonEmptyString(org)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a scope.`;\n      throw error;\n    }\n\n    const repositories = [repository.toUpperCase()];\n\n    const azureCollection = getAzureCollection();\n    if (isNonEmptyString(azureCollection)) {\n      // used for full 'org/project/repo' matching\n      repositories.push(`${azureCollection}/${repository}`.toUpperCase());\n      // used for org prefix matching without repo\n      repositories.push(`${azureCollection}/*/`.toUpperCase());\n    }\n\n    const orgPrefixes = org\n      .split(',')\n      .map((o) => o.trim())\n      .map((o) => o.toUpperCase())\n      .map((o) => ensureTrailingSlash(o));\n\n    if (isNonEmptyString(repo)) {\n      const scopedRepos = orgPrefixes.map((orgPrefix) =>\n        `${orgPrefix}${repo}`.toUpperCase(),\n      );\n      for (const rp of repositories) {\n        if (scopedRepos.some((r) => r === rp)) {\n          return value;\n        }\n      }\n\n      logger.debug(\n        { scopedRepos },\n        'Secret is scoped to a different repository',\n      );\n      const error = new Error('config-validation');\n      const scopeString = scopedRepos.join(',');\n      error.validationError = `Encrypted secret is scoped to a different repository: \"${scopeString}\".`;\n      throw error;\n    }\n\n    // no scoped repos, only org\n    const azcol =\n      azureCollection === undefined\n        ? undefined\n        : ensureTrailingSlash(azureCollection).toUpperCase();\n    for (const rp of repositories) {\n      if (\n        orgPrefixes.some(\n          (orgPrefix) => rp.startsWith(orgPrefix) && orgPrefix !== azcol,\n        )\n      ) {\n        return value;\n      }\n    }\n    logger.debug({ orgPrefixes }, 'Secret is scoped to a different org');\n    const error = new Error('config-validation');\n    const scopeString = orgPrefixes.join(',');\n    error.validationError = `Encrypted secret is scoped to a different org: \"${scopeString}\".`;\n    throw error;\n  } catch (err) {\n    logger.warn({ err }, 'Could not parse decrypted string');\n  }\n  return null;\n}\n\nexport async function decryptConfig<T extends RenovateConfig = AllConfig>(\n  config: T,\n  repository: string,\n  existingPath = '$',\n): Promise<T> {\n  logger.trace({ config }, 'decryptConfig()');\n  const decryptedConfig = { ...config };\n  for (const [key, val] of Object.entries(config)) {\n    if (key === 'encrypted' && isObject(val)) {\n      const path = `${existingPath}.${key}`;\n      logger.debug({ config: val }, `Found encrypted config in ${path}`);\n\n      const encryptedWarning = GlobalConfig.get('encryptedWarning');\n      if (isString(encryptedWarning)) {\n        logger.once.warn(encryptedWarning);\n      }\n\n      if (privateKey) {\n        for (const [eKey, eVal] of Object.entries(val)) {\n          logger.debug(`Trying to decrypt ${eKey} in ${path}`);\n          let decryptedStr = await tryDecrypt(privateKey, eVal, repository);\n          if (privateKeyOld && !isNonEmptyString(decryptedStr)) {\n            logger.debug(`Trying to decrypt with old private key`);\n            decryptedStr = await tryDecrypt(privateKeyOld, eVal, repository);\n          }\n          if (!isNonEmptyString(decryptedStr)) {\n            const error = new Error('config-validation');\n            error.validationError = `Failed to decrypt field ${eKey}. Please re-encrypt and try again.`;\n            throw error;\n          }\n          logger.debug(`Decrypted ${eKey} in ${path}`);\n          // v8 ignore if -- TODO: add test #40625\n          if (eKey === 'npmToken') {\n            const token = decryptedStr.replace(regEx(/\\n$/), '');\n            decryptedConfig[eKey] = token;\n            addSecretForSanitizing(token);\n          } else {\n            // @ts-expect-error -- type can't be narrowed\n            decryptedConfig[eKey] = decryptedStr;\n            addSecretForSanitizing(decryptedStr);\n          }\n        }\n      } else {\n        const env = getEnv();\n        if (env.RENOVATE_X_ENCRYPTED_STRICT === 'true') {\n          const error = new Error(CONFIG_VALIDATION);\n          error.validationSource = 'config';\n          error.validationError = 'Encrypted config unsupported';\n          error.validationMessage = `This config contains an encrypted object at location \\`$.${key}\\` but no privateKey is configured. To support encrypted config, the Renovate administrator must configure a \\`privateKey\\` in Global Configuration.`;\n          if (env.MEND_HOSTED === 'true') {\n            error.validationMessage = `Mend-hosted Renovate Apps no longer support the use of encrypted secrets in Renovate file config (e.g. renovate.json).\nPlease migrate all secrets to the Developer Portal using the web UI available at https://developer.mend.io/\n\nRefer to migration documents here: https://docs.renovatebot.com/mend-hosted/migrating-secrets/`;\n          }\n          throw error;\n        } else {\n          logger.error('Found encrypted data but no privateKey');\n        }\n      }\n      delete decryptedConfig.encrypted;\n    } else if (isArray(val)) {\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = [];\n      for (const [index, item] of val.entries()) {\n        if (isObject(item) && !isArray(item)) {\n          const path = `${existingPath}.${key}[${index}]`;\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as RenovateConfig[]).push(\n            await decryptConfig(item as RenovateConfig, repository, path),\n          );\n        } else {\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as unknown[]).push(item);\n        }\n      }\n    } else if (isObject(val) && key !== 'content') {\n      const path = `${existingPath}.${key}`;\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = await decryptConfig(\n        val as RenovateConfig,\n        repository,\n        path,\n      );\n    }\n  }\n  delete decryptedConfig.encrypted;\n  logger.trace({ config: decryptedConfig }, 'decryptedConfig');\n  return decryptedConfig;\n}\n\nexport function getAzureCollection(): string | undefined {\n  const platform = GlobalConfig.get('platform');\n  if (platform !== 'azure') {\n    return undefined;\n  }\n\n  const endpoint = GlobalConfig.get('endpoint');\n  const endpointUrl = parseUrl(endpoint);\n  if (endpointUrl === null) {\n    // should not happen\n    logger.warn({ endpoint }, 'Unable to parse endpoint for token decryption');\n    return undefined;\n  }\n\n  const azureCollection = trimSlashes(endpointUrl.pathname);\n  if (!isNonEmptyString(azureCollection)) {\n    logger.debug({ endpoint }, 'Unable to find azure collection name from URL');\n    return undefined;\n  }\n\n  if (azureCollection.startsWith('tfs/')) {\n    // Azure DevOps Server\n    return azureCollection.substring(4);\n  }\n  return azureCollection;\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,IAAI;AACJ,IAAI;AAEJ,SAAgB,eACd,MACA,SACM;AACN,cAAa;AACb,iBAAgB;;AAGlB,eAAsB,WACpB,KACA,cACA,YACwB;CACxB,IAAI,eAA8B;CAClC,MAAM,kBACJ,QAAQ,CAAC,2BAA2B,SAChC,MAAM,kBAAkB,KAAK,aAAa,GAC1C,MAAM,gBAAgB,KAAK,aAAa;AAC9C,KAAI,gBACF,gBAAe,uBAAuB,iBAAiB,WAAW;AAEpE,QAAO;;AAGT,SAAgB,uBACd,iBACA,YACe;AACf,KAAI;EACF,MAAM,eAAe,gBAAgB,UAAU,gBAAgB;AAC/D,MAAI,CAAC,aAAa,SAAS;GACzB,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;EAGR,MAAM,EAAE,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,aAAa;AAEnD,MAAI,CAAC,iBAAiB,MAAM,EAAE;GAC5B,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;AAGR,MAAI,CAAC,iBAAiB,IAAI,EAAE;GAC1B,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,SAAM,kBAAkB;AACxB,SAAM;;EAGR,MAAM,eAAe,CAAC,WAAW,aAAa,CAAC;EAE/C,MAAM,kBAAkB,oBAAoB;AAC5C,MAAI,iBAAiB,gBAAgB,EAAE;AAErC,gBAAa,KAAK,GAAG,gBAAgB,GAAG,aAAa,aAAa,CAAC;AAEnE,gBAAa,KAAK,GAAG,gBAAgB,KAAK,aAAa,CAAC;;EAG1D,MAAM,cAAc,IACjB,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,KAAK,MAAM,EAAE,aAAa,CAAC,CAC3B,KAAK,MAAM,oBAAoB,EAAE,CAAC;AAErC,MAAI,iBAAiB,KAAK,EAAE;GAC1B,MAAM,cAAc,YAAY,KAAK,cACnC,GAAG,YAAY,OAAO,aAAa,CACpC;AACD,QAAK,MAAM,MAAM,aACf,KAAI,YAAY,MAAM,MAAM,MAAM,GAAG,CACnC,QAAO;AAIX,UAAO,MACL,EAAE,aAAa,EACf,6CACD;GACD,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAE5C,SAAM,kBAAkB,0DADJ,YAAY,KAAK,IAAI,CACqD;AAC9F,SAAM;;EAIR,MAAM,QACJ,oBAAoB,SAChB,SACA,oBAAoB,gBAAgB,CAAC,aAAa;AACxD,OAAK,MAAM,MAAM,aACf,KACE,YAAY,MACT,cAAc,GAAG,WAAW,UAAU,IAAI,cAAc,MAC1D,CAED,QAAO;AAGX,SAAO,MAAM,EAAE,aAAa,EAAE,sCAAsC;EACpE,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAE5C,QAAM,kBAAkB,mDADJ,YAAY,KAAK,IAAI,CAC8C;AACvF,QAAM;UACC,KAAK;AACZ,SAAO,KAAK,EAAE,KAAK,EAAE,mCAAmC;;AAE1D,QAAO;;AAGT,eAAsB,cACpB,QACA,YACA,eAAe,KACH;AACZ,QAAO,MAAM,EAAE,QAAQ,EAAE,kBAAkB;CAC3C,MAAM,kBAAkB,EAAE,GAAG,QAAQ;AACrC,MAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,OAAO,CAC7C,KAAI,QAAQ,eAAe,SAAS,IAAI,EAAE;EACxC,MAAM,OAAO,GAAG,aAAa,GAAG;AAChC,SAAO,MAAM,EAAE,QAAQ,KAAK,EAAE,6BAA6B,OAAO;EAElE,MAAM,mBAAmB,aAAa,IAAI,mBAAmB;AAC7D,MAAI,SAAS,iBAAiB,CAC5B,QAAO,KAAK,KAAK,iBAAiB;AAGpC,MAAI,WACF,MAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,IAAI,EAAE;AAC9C,UAAO,MAAM,qBAAqB,KAAK,MAAM,OAAO;GACpD,IAAI,eAAe,MAAM,WAAW,YAAY,MAAM,WAAW;AACjE,OAAI,iBAAiB,CAAC,iBAAiB,aAAa,EAAE;AACpD,WAAO,MAAM,yCAAyC;AACtD,mBAAe,MAAM,WAAW,eAAe,MAAM,WAAW;;AAElE,OAAI,CAAC,iBAAiB,aAAa,EAAE;IACnC,MAAM,wBAAQ,IAAI,MAAM,oBAAoB;AAC5C,UAAM,kBAAkB,2BAA2B,KAAK;AACxD,UAAM;;AAER,UAAO,MAAM,aAAa,KAAK,MAAM,OAAO;;AAE5C,OAAI,SAAS,YAAY;IACvB,MAAM,QAAQ,aAAa,QAAQ,MAAM,MAAM,EAAE,GAAG;AACpD,oBAAgB,QAAQ;AACxB,2BAAuB,MAAM;UACxB;AAEL,oBAAgB,QAAQ;AACxB,2BAAuB,aAAa;;;OAGnC;GACL,MAAM,MAAM,QAAQ;AACpB,OAAI,IAAI,gCAAgC,QAAQ;IAC9C,MAAM,QAAQ,IAAI,MAAM,kBAAkB;AAC1C,UAAM,mBAAmB;AACzB,UAAM,kBAAkB;AACxB,UAAM,oBAAoB,4DAA4D,IAAI;AAC1F,QAAI,IAAI,gBAAgB,OACtB,OAAM,oBAAoB;;;;AAK5B,UAAM;SAEN,QAAO,MAAM,yCAAyC;;AAG1D,SAAO,gBAAgB;YACd,QAAQ,IAAI,EAAE;AAEvB,kBAAgB,OAAO,EAAE;AACzB,OAAK,MAAM,CAAC,OAAO,SAAS,IAAI,SAAS,CACvC,KAAI,SAAS,KAAK,IAAI,CAAC,QAAQ,KAAK,EAAE;GACpC,MAAM,OAAO,GAAG,aAAa,GAAG,IAAI,GAAG,MAAM;AAE7C,GAAC,gBAAgB,KAA0B,KACzC,MAAM,cAAc,MAAwB,YAAY,KAAK,CAC9D;QAGD,CAAC,gBAAgB,KAAmB,KAAK,KAAK;YAGzC,SAAS,IAAI,IAAI,QAAQ,UAGlC,iBAAgB,OAAO,MAAM,cAC3B,KACA,YAJW,GAAG,aAAa,GAAG,MAM/B;AAGL,QAAO,gBAAgB;AACvB,QAAO,MAAM,EAAE,QAAQ,iBAAiB,EAAE,kBAAkB;AAC5D,QAAO;;AAGT,SAAgB,qBAAyC;AAEvD,KADiB,aAAa,IAAI,WAAW,KAC5B,QACf;CAGF,MAAM,WAAW,aAAa,IAAI,WAAW;CAC7C,MAAM,cAAc,SAAS,SAAS;AACtC,KAAI,gBAAgB,MAAM;AAExB,SAAO,KAAK,EAAE,UAAU,EAAE,gDAAgD;AAC1E;;CAGF,MAAM,kBAAkB,YAAY,YAAY,SAAS;AACzD,KAAI,CAAC,iBAAiB,gBAAgB,EAAE;AACtC,SAAO,MAAM,EAAE,UAAU,EAAE,gDAAgD;AAC3E;;AAGF,KAAI,gBAAgB,WAAW,OAAO,CAEpC,QAAO,gBAAgB,UAAU,EAAE;AAErC,QAAO"}
+{"version":3,"file":"decrypt.js","names":[],"sources":["../../lib/config/decrypt.ts"],"sourcesContent":["import {\n  isArray,\n  isNonEmptyString,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport { CONFIG_VALIDATION } from '../constants/error-messages.ts';\nimport { logger } from '../logger/index.ts';\nimport { getEnv } from '../util/env.ts';\nimport { regEx } from '../util/regex.ts';\nimport { addSecretForSanitizing } from '../util/sanitize.ts';\nimport { ensureTrailingSlash, parseUrl, trimSlashes } from '../util/url.ts';\nimport { tryDecryptBcPgp } from './decrypt/bcpgp.ts';\nimport { tryDecryptOpenPgp } from './decrypt/openpgp.ts';\nimport { GlobalConfig } from './global.ts';\nimport { DecryptedObject } from './schema.ts';\nimport type { AllConfig, RenovateConfig } from './types.ts';\n\nlet privateKey: string | undefined;\nlet privateKeyOld: string | undefined;\n\nexport function setPrivateKeys(\n  pKey: string | undefined,\n  pKeyOld: string | undefined,\n): void {\n  privateKey = pKey;\n  privateKeyOld = pKeyOld;\n}\n\nexport async function tryDecrypt(\n  key: string,\n  encryptedStr: string,\n  repository: string,\n): Promise<string | null> {\n  let decryptedStr: string | null = null;\n  const decryptedObjStr =\n    getEnv().RENOVATE_X_USE_OPENPGP === 'true'\n      ? await tryDecryptOpenPgp(key, encryptedStr)\n      : await tryDecryptBcPgp(key, encryptedStr);\n  if (decryptedObjStr) {\n    decryptedStr = validateDecryptedValue(decryptedObjStr, repository);\n  }\n  return decryptedStr;\n}\n\nexport function validateDecryptedValue(\n  decryptedObjStr: string,\n  repository: string,\n): string | null {\n  try {\n    const decryptedObj = DecryptedObject.safeParse(decryptedObjStr);\n    if (!decryptedObj.success) {\n      const error = new Error('config-validation');\n      error.validationError = `Could not parse decrypted config.`;\n      throw error;\n    }\n\n    const { o: org, r: repo, v: value } = decryptedObj.data;\n\n    if (!isNonEmptyString(value)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a value.`;\n      throw error;\n    }\n\n    if (!isNonEmptyString(org)) {\n      const error = new Error('config-validation');\n      error.validationError = `Encrypted value in config is missing a scope.`;\n      throw error;\n    }\n\n    const repositories = [repository.toUpperCase()];\n\n    const azureCollection = getAzureCollection();\n    if (isNonEmptyString(azureCollection)) {\n      // used for full 'org/project/repo' matching\n      repositories.push(`${azureCollection}/${repository}`.toUpperCase());\n      // used for org prefix matching without repo\n      repositories.push(`${azureCollection}/*/`.toUpperCase());\n    }\n\n    const orgPrefixes = org\n      .split(',')\n      .map((o) => o.trim())\n      .map((o) => o.toUpperCase())\n      .map((o) => ensureTrailingSlash(o));\n\n    if (isNonEmptyString(repo)) {\n      const scopedRepos = orgPrefixes.map((orgPrefix) =>\n        `${orgPrefix}${repo}`.toUpperCase(),\n      );\n      for (const rp of repositories) {\n        if (scopedRepos.some((r) => r === rp)) {\n          return value;\n        }\n      }\n\n      logger.debug(\n        { scopedRepos },\n        'Secret is scoped to a different repository',\n      );\n      const error = new Error('config-validation');\n      const scopeString = scopedRepos.join(',');\n      error.validationError = `Encrypted secret is scoped to a different repository: \"${scopeString}\".`;\n      throw error;\n    }\n\n    // no scoped repos, only org\n    const azcol =\n      azureCollection === undefined\n        ? undefined\n        : ensureTrailingSlash(azureCollection).toUpperCase();\n    for (const rp of repositories) {\n      if (\n        orgPrefixes.some(\n          (orgPrefix) => rp.startsWith(orgPrefix) && orgPrefix !== azcol,\n        )\n      ) {\n        return value;\n      }\n    }\n    logger.debug({ orgPrefixes }, 'Secret is scoped to a different org');\n    const error = new Error('config-validation');\n    const scopeString = orgPrefixes.join(',');\n    error.validationError = `Encrypted secret is scoped to a different org: \"${scopeString}\".`;\n    throw error;\n  } catch (err) {\n    logger.warn({ err }, 'Could not parse decrypted string');\n  }\n  return null;\n}\n\nexport async function decryptConfig<T extends RenovateConfig = AllConfig>(\n  config: T,\n  repository: string,\n  existingPath = '$',\n): Promise<T> {\n  logger.trace({ config }, 'decryptConfig()');\n  const decryptedConfig = { ...config };\n  for (const [key, val] of Object.entries(config)) {\n    if (key === 'encrypted' && isObject(val)) {\n      const path = `${existingPath}.${key}`;\n      logger.debug({ config: val }, `Found encrypted config in ${path}`);\n\n      const encryptedWarning = GlobalConfig.get('encryptedWarning');\n      if (isString(encryptedWarning)) {\n        logger.once.warn(encryptedWarning);\n      }\n\n      if (privateKey) {\n        for (const [eKey, eVal] of Object.entries(val)) {\n          logger.debug(`Trying to decrypt ${eKey} in ${path}`);\n          let decryptedStr = await tryDecrypt(privateKey, eVal, repository);\n          if (privateKeyOld && !isNonEmptyString(decryptedStr)) {\n            logger.debug(`Trying to decrypt with old private key`);\n            decryptedStr = await tryDecrypt(privateKeyOld, eVal, repository);\n          }\n          if (!isNonEmptyString(decryptedStr)) {\n            const error = new Error('config-validation');\n            error.validationError = `Failed to decrypt field ${eKey}. Please re-encrypt and try again.`;\n            throw error;\n          }\n          logger.debug(`Decrypted ${eKey} in ${path}`);\n          // v8 ignore if -- TODO: add test #40625\n          if (eKey === 'npmToken') {\n            const token = decryptedStr.replace(regEx(/\\n$/), '');\n            decryptedConfig[eKey] = token;\n            addSecretForSanitizing(token);\n          } else {\n            // @ts-expect-error -- type can't be narrowed\n            decryptedConfig[eKey] = decryptedStr;\n            addSecretForSanitizing(decryptedStr);\n          }\n        }\n      } else {\n        const env = getEnv();\n        if (env.RENOVATE_X_ENCRYPTED_STRICT === 'true') {\n          const error = new Error(CONFIG_VALIDATION);\n          error.validationSource = 'config';\n          error.validationError = 'Encrypted config unsupported';\n          error.validationMessage = `This config contains an encrypted object at location \\`$.${key}\\` but no privateKey is configured. To support encrypted config, the Renovate administrator must configure a \\`privateKey\\` in Global Configuration.`;\n          if (env.MEND_HOSTED === 'true') {\n            error.validationMessage = `Mend-hosted Renovate Apps no longer support the use of encrypted secrets in Renovate file config (e.g. renovate.json).\nPlease migrate all secrets to the Developer Portal using the web UI available at https://developer.mend.io/\n\nRefer to migration documents here: ${GlobalConfig.get('productLinks').documentation}mend-hosted/migrating-secrets/`;\n          }\n          throw error;\n        } else {\n          logger.error('Found encrypted data but no privateKey');\n        }\n      }\n      delete decryptedConfig.encrypted;\n    } else if (isArray(val)) {\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = [];\n      for (const [index, item] of val.entries()) {\n        if (isObject(item) && !isArray(item)) {\n          const path = `${existingPath}.${key}[${index}]`;\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as RenovateConfig[]).push(\n            await decryptConfig(item as RenovateConfig, repository, path),\n          );\n        } else {\n          // @ts-expect-error -- type can't be narrowed\n          (decryptedConfig[key] as unknown[]).push(item);\n        }\n      }\n    } else if (isObject(val) && key !== 'content') {\n      const path = `${existingPath}.${key}`;\n      // @ts-expect-error -- type can't be narrowed\n      decryptedConfig[key] = await decryptConfig(\n        val as RenovateConfig,\n        repository,\n        path,\n      );\n    }\n  }\n  delete decryptedConfig.encrypted;\n  logger.trace({ config: decryptedConfig }, 'decryptedConfig');\n  return decryptedConfig;\n}\n\nexport function getAzureCollection(): string | undefined {\n  const platform = GlobalConfig.get('platform');\n  if (platform !== 'azure') {\n    return undefined;\n  }\n\n  const endpoint = GlobalConfig.get('endpoint');\n  const endpointUrl = parseUrl(endpoint);\n  if (endpointUrl === null) {\n    // should not happen\n    logger.warn({ endpoint }, 'Unable to parse endpoint for token decryption');\n    return undefined;\n  }\n\n  const azureCollection = trimSlashes(endpointUrl.pathname);\n  if (!isNonEmptyString(azureCollection)) {\n    logger.debug({ endpoint }, 'Unable to find azure collection name from URL');\n    return undefined;\n  }\n\n  if (azureCollection.startsWith('tfs/')) {\n    // Azure DevOps Server\n    return azureCollection.substring(4);\n  }\n  return azureCollection;\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,IAAI;AACJ,IAAI;AAEJ,SAAgB,eACd,MACA,SACM;CACN,aAAa;CACb,gBAAgB;AAClB;AAEA,eAAsB,WACpB,KACA,cACA,YACwB;CACxB,IAAI,eAA8B;CAClC,MAAM,kBACJ,OAAO,CAAC,CAAC,2BAA2B,SAChC,MAAM,kBAAkB,KAAK,YAAY,IACzC,MAAM,gBAAgB,KAAK,YAAY;CAC7C,IAAI,iBACF,eAAe,uBAAuB,iBAAiB,UAAU;CAEnE,OAAO;AACT;AAEA,SAAgB,uBACd,iBACA,YACe;CACf,IAAI;EACF,MAAM,eAAe,gBAAgB,UAAU,eAAe;EAC9D,IAAI,CAAC,aAAa,SAAS;GACzB,MAAM,wBAAQ,IAAI,MAAM,mBAAmB;GAC3C,MAAM,kBAAkB;GACxB,MAAM;EACR;EAEA,MAAM,EAAE,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,aAAa;EAEnD,IAAI,CAAC,iBAAiB,KAAK,GAAG;GAC5B,MAAM,wBAAQ,IAAI,MAAM,mBAAmB;GAC3C,MAAM,kBAAkB;GACxB,MAAM;EACR;EAEA,IAAI,CAAC,iBAAiB,GAAG,GAAG;GAC1B,MAAM,wBAAQ,IAAI,MAAM,mBAAmB;GAC3C,MAAM,kBAAkB;GACxB,MAAM;EACR;EAEA,MAAM,eAAe,CAAC,WAAW,YAAY,CAAC;EAE9C,MAAM,kBAAkB,mBAAmB;EAC3C,IAAI,iBAAiB,eAAe,GAAG;GAErC,aAAa,KAAK,GAAG,gBAAgB,GAAG,aAAa,YAAY,CAAC;GAElE,aAAa,KAAK,GAAG,gBAAgB,KAAK,YAAY,CAAC;EACzD;EAEA,MAAM,cAAc,IACjB,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAC3B,KAAK,MAAM,oBAAoB,CAAC,CAAC;EAEpC,IAAI,iBAAiB,IAAI,GAAG;GAC1B,MAAM,cAAc,YAAY,KAAK,cACnC,GAAG,YAAY,OAAO,YAAY,CACpC;GACA,KAAK,MAAM,MAAM,cACf,IAAI,YAAY,MAAM,MAAM,MAAM,EAAE,GAClC,OAAO;GAIX,OAAO,MACL,EAAE,YAAY,GACd,4CACF;GACA,MAAM,wBAAQ,IAAI,MAAM,mBAAmB;GAE3C,MAAM,kBAAkB,0DADJ,YAAY,KAAK,GACuD,EAAE;GAC9F,MAAM;EACR;EAGA,MAAM,QACJ,oBAAoB,KAAA,IAChB,KAAA,IACA,oBAAoB,eAAe,CAAC,CAAC,YAAY;EACvD,KAAK,MAAM,MAAM,cACf,IACE,YAAY,MACT,cAAc,GAAG,WAAW,SAAS,KAAK,cAAc,KAC3D,GAEA,OAAO;EAGX,OAAO,MAAM,EAAE,YAAY,GAAG,qCAAqC;EACnE,MAAM,wBAAQ,IAAI,MAAM,mBAAmB;EAE3C,MAAM,kBAAkB,mDADJ,YAAY,KAAK,GACgD,EAAE;EACvF,MAAM;CACR,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,IAAI,GAAG,kCAAkC;CACzD;CACA,OAAO;AACT;AAEA,eAAsB,cACpB,QACA,YACA,eAAe,KACH;CACZ,OAAO,MAAM,EAAE,OAAO,GAAG,iBAAiB;CAC1C,MAAM,kBAAkB,EAAE,GAAG,OAAO;CACpC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,MAAM,GAC5C,IAAI,QAAQ,eAAe,SAAS,GAAG,GAAG;EACxC,MAAM,OAAO,GAAG,aAAa,GAAG;EAChC,OAAO,MAAM,EAAE,QAAQ,IAAI,GAAG,6BAA6B,MAAM;EAEjE,MAAM,mBAAmB,aAAa,IAAI,kBAAkB;EAC5D,IAAI,SAAS,gBAAgB,GAC3B,OAAO,KAAK,KAAK,gBAAgB;EAGnC,IAAI,YACF,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,GAAG,GAAG;GAC9C,OAAO,MAAM,qBAAqB,KAAK,MAAM,MAAM;GACnD,IAAI,eAAe,MAAM,WAAW,YAAY,MAAM,UAAU;GAChE,IAAI,iBAAiB,CAAC,iBAAiB,YAAY,GAAG;IACpD,OAAO,MAAM,wCAAwC;IACrD,eAAe,MAAM,WAAW,eAAe,MAAM,UAAU;GACjE;GACA,IAAI,CAAC,iBAAiB,YAAY,GAAG;IACnC,MAAM,wBAAQ,IAAI,MAAM,mBAAmB;IAC3C,MAAM,kBAAkB,2BAA2B,KAAK;IACxD,MAAM;GACR;GACA,OAAO,MAAM,aAAa,KAAK,MAAM,MAAM;;GAE3C,IAAI,SAAS,YAAY;IACvB,MAAM,QAAQ,aAAa,QAAQ,MAAM,KAAK,GAAG,EAAE;IACnD,gBAAgB,QAAQ;IACxB,uBAAuB,KAAK;GAC9B,OAAO;IAEL,gBAAgB,QAAQ;IACxB,uBAAuB,YAAY;GACrC;EACF;OACK;GACL,MAAM,MAAM,OAAO;GACnB,IAAI,IAAI,gCAAgC,QAAQ;IAC9C,MAAM,QAAQ,IAAI,MAAM,iBAAiB;IACzC,MAAM,mBAAmB;IACzB,MAAM,kBAAkB;IACxB,MAAM,oBAAoB,4DAA4D,IAAI;IAC1F,IAAI,IAAI,gBAAgB,QACtB,MAAM,oBAAoB;;;qCAGD,aAAa,IAAI,cAAc,CAAC,CAAC,cAAc;IAE1E,MAAM;GACR,OACE,OAAO,MAAM,wCAAwC;EAEzD;EACA,OAAO,gBAAgB;CACzB,OAAO,IAAI,QAAQ,GAAG,GAAG;EAEvB,gBAAgB,OAAO,CAAC;EACxB,KAAK,MAAM,CAAC,OAAO,SAAS,IAAI,QAAQ,GACtC,IAAI,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,GAAG;GACpC,MAAM,OAAO,GAAG,aAAa,GAAG,IAAI,GAAG,MAAM;GAE7C,gBAAiB,IAAI,CAAsB,KACzC,MAAM,cAAc,MAAwB,YAAY,IAAI,CAC9D;EACF,OAEE,gBAAiB,IAAI,CAAe,KAAK,IAAI;CAGnD,OAAO,IAAI,SAAS,GAAG,KAAK,QAAQ,WAGlC,gBAAgB,OAAO,MAAM,cAC3B,KACA,YACA,GALc,aAAa,GAAG,KAMhC;CAGJ,OAAO,gBAAgB;CACvB,OAAO,MAAM,EAAE,QAAQ,gBAAgB,GAAG,iBAAiB;CAC3D,OAAO;AACT;AAEA,SAAgB,qBAAyC;CAEvD,IADiB,aAAa,IAAI,UACvB,MAAM,SACf;CAGF,MAAM,WAAW,aAAa,IAAI,UAAU;CAC5C,MAAM,cAAc,SAAS,QAAQ;CACrC,IAAI,gBAAgB,MAAM;EAExB,OAAO,KAAK,EAAE,SAAS,GAAG,+CAA+C;EACzE;CACF;CAEA,MAAM,kBAAkB,YAAY,YAAY,QAAQ;CACxD,IAAI,CAAC,iBAAiB,eAAe,GAAG;EACtC,OAAO,MAAM,EAAE,SAAS,GAAG,+CAA+C;EAC1E;CACF;CAEA,IAAI,gBAAgB,WAAW,MAAM,GAEnC,OAAO,gBAAgB,UAAU,CAAC;CAEpC,OAAO;AACT"}

package/dist/config/defaults.d.ts

@@ -1,5 +1,4 @@
 import { AllConfig, RenovateOptions } from "./types.js";
-
 //#region lib/config/defaults.d.ts
 declare function getDefault(option: RenovateOptions): any;
 declare function getConfig(): AllConfig;

package/dist/config/defaults.js

@@ -1,6 +1,5 @@
 import { clone } from "../util/clone.js";
 import { getOptions } from "./options/index.js";
-
 //#region lib/config/defaults.ts
 const defaultValueFactories = {
 	boolean: () => true,
@@ -20,7 +19,7 @@ function getConfig() {
 	});
 	return config;
 }
-
 //#endregion
 export { getConfig, getDefault };
+
 //# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","names":[],"sources":["../../lib/config/defaults.ts"],"sourcesContent":["import { clone } from '../util/clone.ts';\nimport { getOptions } from './options/index.ts';\nimport type { AllConfig, RenovateOptions } from './types.ts';\n\n// Use functions instead of direct values to avoid introducing global references.\n// In particular, we want a new array instance every time we request a default array\n// instead of sharing a single instance - mutation of this value could cause serious problems.\n// See https://github.com/mend/renovate-on-prem/issues/290 for an example\nconst defaultValueFactories = {\n  boolean: () => true,\n  array: () => [],\n  string: () => null,\n  object: () => null,\n  integer: () => null,\n} as const;\n\nexport function getDefault(option: RenovateOptions): any {\n  return option.default === undefined\n    ? defaultValueFactories[option.type]()\n    : clone(option.default);\n}\n\nexport function getConfig(): AllConfig {\n  const options = getOptions();\n  const config: AllConfig = {};\n  options.forEach((option) => {\n    if (!option.parents || option.parents.includes('.')) {\n      config[option.name as keyof AllConfig] = getDefault(option);\n    }\n  });\n  return config;\n}\n"],"mappings":";;;;AAQA,MAAM,wBAAwB;CAC5B,eAAe;CACf,aAAa,EAAE;CACf,cAAc;CACd,cAAc;CACd,eAAe;CAChB;AAED,SAAgB,WAAW,QAA8B;AACvD,QAAO,OAAO,YAAY,SACtB,sBAAsB,OAAO,OAAO,GACpC,MAAM,OAAO,QAAQ;;AAG3B,SAAgB,YAAuB;CACrC,MAAM,UAAU,YAAY;CAC5B,MAAM,SAAoB,EAAE;AAC5B,SAAQ,SAAS,WAAW;AAC1B,MAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,SAAS,IAAI,CACjD,QAAO,OAAO,QAA2B,WAAW,OAAO;GAE7D;AACF,QAAO"}
+{"version":3,"file":"defaults.js","names":[],"sources":["../../lib/config/defaults.ts"],"sourcesContent":["import { clone } from '../util/clone.ts';\nimport { getOptions } from './options/index.ts';\nimport type { AllConfig, RenovateOptions } from './types.ts';\n\n// Use functions instead of direct values to avoid introducing global references.\n// In particular, we want a new array instance every time we request a default array\n// instead of sharing a single instance - mutation of this value could cause serious problems.\n// See https://github.com/mend/renovate-on-prem/issues/290 for an example\nconst defaultValueFactories = {\n  boolean: () => true,\n  array: () => [],\n  string: () => null,\n  object: () => null,\n  integer: () => null,\n} as const;\n\nexport function getDefault(option: RenovateOptions): any {\n  return option.default === undefined\n    ? defaultValueFactories[option.type]()\n    : clone(option.default);\n}\n\nexport function getConfig(): AllConfig {\n  const options = getOptions();\n  const config: AllConfig = {};\n  options.forEach((option) => {\n    if (!option.parents || option.parents.includes('.')) {\n      config[option.name as keyof AllConfig] = getDefault(option);\n    }\n  });\n  return config;\n}\n"],"mappings":";;;AAQA,MAAM,wBAAwB;CAC5B,eAAe;CACf,aAAa,CAAC;CACd,cAAc;CACd,cAAc;CACd,eAAe;AACjB;AAEA,SAAgB,WAAW,QAA8B;CACvD,OAAO,OAAO,YAAY,KAAA,IACtB,sBAAsB,OAAO,KAAK,CAAC,IACnC,MAAM,OAAO,OAAO;AAC1B;AAEA,SAAgB,YAAuB;CACrC,MAAM,UAAU,WAAW;CAC3B,MAAM,SAAoB,CAAC;CAC3B,QAAQ,SAAS,WAAW;EAC1B,IAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,SAAS,GAAG,GAChD,OAAO,OAAO,QAA2B,WAAW,MAAM;CAE9D,CAAC;CACD,OAAO;AACT"}

package/dist/config/global.d.ts

@@ -1,13 +1,11 @@
-import { RenovateConfig, RepoGlobalConfig } from "./types.js";
-
+import { InternalGlobalConfigOptions, RenovateConfig, RepoGlobalConfig } from "./types.js";
 //#region lib/config/global.d.ts
 declare class GlobalConfig {
-  static OPTIONS: readonly (keyof RepoGlobalConfig)[];
+  static OPTIONS: readonly ["allowCustomCrateRegistries", "allowPlugins", "allowScripts", "allowShellExecutorForPostUpgradeCommands", "allowedCommands", "allowedEnv", "allowedHeaders", "allowedUnsafeExecutions", "autodiscoverRepoOrder", "autodiscoverRepoSort", "bbUseDevelopmentBranch", "binarySource", "cacheDir", "cacheHardTtlMinutes", "cachePrivatePackages", "cacheTtlOverride", "checkedBranches", "configFileNames", "containerbaseDir", "customEnvVariables", "dockerChildPrefix", "dockerCliOptions", "dockerMaxPages", "dockerSidecarImage", "dockerUser", "dryRun", "encryptedWarning", "endpoint", "executionTimeout", "exposeAllEnv", "gitTimeout", "githubTokenWarn", "httpCacheTtlDays", "ignorePrAuthor", "includeMirrors", "localDir", "migratePresets", "onboarding", "onboardingAutoCloseAge", "onboardingBranch", "onboardingCommitMessage", "onboardingConfig", "onboardingConfigFileName", "onboardingNoDeps", "onboardingPrTitle", "platform", "prCacheSyncMaxPages", "presetCachePersistence", "productLinks", "rebaseAllOpenBranches", "repositoryCacheForceLocal", "requireConfig", "s3Endpoint", "s3PathStyle", "toolSettings", "userAgent"];
   private static config;
-  static get(): RepoGlobalConfig;
-  static get<Key extends keyof RepoGlobalConfig>(key: Key): RepoGlobalConfig[Key];
-  static get<Key extends keyof RepoGlobalConfig>(key: Key, defaultValue: Required<RepoGlobalConfig>[Key]): Required<RepoGlobalConfig>[Key];
-  static set(config: RenovateConfig & RepoGlobalConfig): RenovateConfig;
+  static get(): RepoGlobalConfig & InternalGlobalConfigOptions;
+  static get<Key extends keyof RepoGlobalConfig | keyof InternalGlobalConfigOptions>(key: Key): Required<RepoGlobalConfig & InternalGlobalConfigOptions>[Key];
+  static set(config: RenovateConfig & RepoGlobalConfig & InternalGlobalConfigOptions): RenovateConfig;
   static reset(): void;
 }
 //#endregion

package/dist/config/global.js

@@ -1,3 +1,4 @@
+import { globalConfigOptionDefaults } from "../global-config-option-defaults.generated.js";
 //#region lib/config/global.ts
 var GlobalConfig = class GlobalConfig {
 	static OPTIONS = [
@@ -17,6 +18,7 @@ var GlobalConfig = class GlobalConfig {
 		"cacheHardTtlMinutes",
 		"cachePrivatePackages",
 		"cacheTtlOverride",
+		"checkedBranches",
 		"configFileNames",
 		"containerbaseDir",
 		"customEnvVariables",
@@ -37,18 +39,29 @@ var GlobalConfig = class GlobalConfig {
 		"includeMirrors",
 		"localDir",
 		"migratePresets",
+		"onboarding",
 		"onboardingAutoCloseAge",
 		"onboardingBranch",
+		"onboardingCommitMessage",
+		"onboardingConfig",
+		"onboardingConfigFileName",
+		"onboardingNoDeps",
+		"onboardingPrTitle",
 		"platform",
+		"prCacheSyncMaxPages",
 		"presetCachePersistence",
+		"productLinks",
+		"rebaseAllOpenBranches",
 		"repositoryCacheForceLocal",
+		"requireConfig",
 		"s3Endpoint",
 		"s3PathStyle",
 		"toolSettings",
 		"userAgent"
 	];
 	static config = {};
-	static get(key, defaultValue) {
+	static get(key) {
+		const defaultValue = key ? globalConfigOptionDefaults[key] : void 0;
 		return key ? GlobalConfig.config[key] ?? defaultValue : GlobalConfig.config;
 	}
 	static set(config) {
@@ -64,7 +77,7 @@ var GlobalConfig = class GlobalConfig {
 		GlobalConfig.config = {};
 	}
 };
-
 //#endregion
 export { GlobalConfig };
+
 //# sourceMappingURL=global.js.map

package/dist/config/global.js.map

@@ -1 +1 @@
-{"version":3,"file":"global.js","names":[],"sources":["../../lib/config/global.ts"],"sourcesContent":["import type { RenovateConfig, RepoGlobalConfig } from './types.ts';\n\nexport class GlobalConfig {\n  // TODO: once global config work is complete, add a test to make sure this list includes all options with globalOnly=true (#9603)\n  static OPTIONS: readonly (keyof RepoGlobalConfig)[] = [\n    'allowCustomCrateRegistries',\n    'allowPlugins',\n    'allowScripts',\n    'allowShellExecutorForPostUpgradeCommands',\n    'allowedCommands',\n    'allowedEnv',\n    'allowedHeaders',\n    'allowedUnsafeExecutions',\n    'autodiscoverRepoOrder',\n    'autodiscoverRepoSort',\n    'bbUseDevelopmentBranch',\n    'binarySource',\n    'cacheDir',\n    'cacheHardTtlMinutes',\n    'cachePrivatePackages',\n    'cacheTtlOverride',\n    'configFileNames',\n    'containerbaseDir',\n    'customEnvVariables',\n    'dockerChildPrefix',\n    'dockerCliOptions',\n    'dockerMaxPages',\n    'dockerSidecarImage',\n    'dockerUser',\n    'dryRun',\n    'encryptedWarning',\n    'endpoint',\n    'executionTimeout',\n    'exposeAllEnv',\n    'gitTimeout',\n    'githubTokenWarn',\n    'httpCacheTtlDays',\n    'ignorePrAuthor',\n    'includeMirrors',\n    'localDir',\n    'migratePresets',\n    'onboardingAutoCloseAge',\n    'onboardingBranch',\n    'platform',\n    'presetCachePersistence',\n    'repositoryCacheForceLocal',\n    's3Endpoint',\n    's3PathStyle',\n    'toolSettings',\n    'userAgent',\n  ];\n\n  private static config: RepoGlobalConfig = {};\n\n  static get(): RepoGlobalConfig;\n  static get<Key extends keyof RepoGlobalConfig>(\n    key: Key,\n  ): RepoGlobalConfig[Key];\n  static get<Key extends keyof RepoGlobalConfig>(\n    key: Key,\n    defaultValue: Required<RepoGlobalConfig>[Key],\n  ): Required<RepoGlobalConfig>[Key];\n  static get<Key extends keyof RepoGlobalConfig>(\n    key?: Key,\n    defaultValue?: RepoGlobalConfig[Key],\n  ): RepoGlobalConfig | RepoGlobalConfig[Key] {\n    return key\n      ? (GlobalConfig.config[key] ?? defaultValue)\n      : GlobalConfig.config;\n  }\n\n  static set(config: RenovateConfig & RepoGlobalConfig): RenovateConfig {\n    GlobalConfig.reset();\n\n    const result = { ...config };\n    for (const option of GlobalConfig.OPTIONS) {\n      GlobalConfig.config[option] = config[option] as never;\n      delete result[option];\n    }\n\n    return result;\n  }\n\n  static reset(): void {\n    GlobalConfig.config = {};\n  }\n}\n"],"mappings":";AAEA,IAAa,eAAb,MAAa,aAAa;CAExB,OAAO,UAA+C;EACpD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CAED,OAAe,SAA2B,EAAE;CAU5C,OAAO,IACL,KACA,cAC0C;AAC1C,SAAO,MACF,aAAa,OAAO,QAAQ,eAC7B,aAAa;;CAGnB,OAAO,IAAI,QAA2D;AACpE,eAAa,OAAO;EAEpB,MAAM,SAAS,EAAE,GAAG,QAAQ;AAC5B,OAAK,MAAM,UAAU,aAAa,SAAS;AACzC,gBAAa,OAAO,UAAU,OAAO;AACrC,UAAO,OAAO;;AAGhB,SAAO;;CAGT,OAAO,QAAc;AACnB,eAAa,SAAS,EAAE"}
+{"version":3,"file":"global.js","names":[],"sources":["../../lib/config/global.ts"],"sourcesContent":["import { globalConfigOptionDefaults } from '../global-config-option-defaults.generated.ts';\nimport type {\n  InternalGlobalConfigOptions,\n  RenovateConfig,\n  RepoGlobalConfig,\n} from './types.ts';\n\nexport class GlobalConfig {\n  // TODO: once global config work is complete, add a test to make sure this list includes all options with globalOnly=true (#9603)\n  static OPTIONS = [\n    'allowCustomCrateRegistries',\n    'allowPlugins',\n    'allowScripts',\n    'allowShellExecutorForPostUpgradeCommands',\n    'allowedCommands',\n    'allowedEnv',\n    'allowedHeaders',\n    'allowedUnsafeExecutions',\n    'autodiscoverRepoOrder',\n    'autodiscoverRepoSort',\n    'bbUseDevelopmentBranch',\n    'binarySource',\n    'cacheDir',\n    'cacheHardTtlMinutes',\n    'cachePrivatePackages',\n    'cacheTtlOverride',\n    'checkedBranches',\n    'configFileNames',\n    'containerbaseDir',\n    'customEnvVariables',\n    'dockerChildPrefix',\n    'dockerCliOptions',\n    'dockerMaxPages',\n    'dockerSidecarImage',\n    'dockerUser',\n    'dryRun',\n    'encryptedWarning',\n    'endpoint',\n    'executionTimeout',\n    'exposeAllEnv',\n    'gitTimeout',\n    'githubTokenWarn',\n    'httpCacheTtlDays',\n    'ignorePrAuthor',\n    'includeMirrors',\n    /** NOTE that this is not a config option, but an internal variable **/\n    'localDir',\n    'migratePresets',\n    'onboarding',\n    'onboardingAutoCloseAge',\n    'onboardingBranch',\n    'onboardingCommitMessage',\n    'onboardingConfig',\n    'onboardingConfigFileName',\n    'onboardingNoDeps',\n    'onboardingPrTitle',\n    'platform',\n    'prCacheSyncMaxPages',\n    'presetCachePersistence',\n    'productLinks',\n    'rebaseAllOpenBranches',\n    'repositoryCacheForceLocal',\n    'requireConfig',\n    's3Endpoint',\n    's3PathStyle',\n    'toolSettings',\n    'userAgent',\n  ] as const satisfies readonly (\n    | keyof RepoGlobalConfig\n    | keyof InternalGlobalConfigOptions\n  )[];\n\n  private static config: RepoGlobalConfig & InternalGlobalConfigOptions = {};\n\n  static get(): RepoGlobalConfig & InternalGlobalConfigOptions;\n  static get<\n    Key extends keyof RepoGlobalConfig | keyof InternalGlobalConfigOptions,\n  >(key: Key): Required<RepoGlobalConfig & InternalGlobalConfigOptions>[Key];\n  static get<\n    Key extends keyof RepoGlobalConfig | keyof InternalGlobalConfigOptions,\n  >(\n    key?: Key,\n  ):\n    | (RepoGlobalConfig & InternalGlobalConfigOptions)\n    | Required<RepoGlobalConfig & InternalGlobalConfigOptions>[Key] {\n    const defaultValue = key\n      ? (globalConfigOptionDefaults[key] as Required<\n          RepoGlobalConfig & InternalGlobalConfigOptions\n        >[Key])\n      : undefined;\n\n    return key\n      ? ((GlobalConfig.config[key] ?? defaultValue) as Required<\n          RepoGlobalConfig & InternalGlobalConfigOptions\n        >[Key])\n      : GlobalConfig.config;\n  }\n\n  static set(\n    config: RenovateConfig & RepoGlobalConfig & InternalGlobalConfigOptions,\n  ): RenovateConfig {\n    GlobalConfig.reset();\n\n    const result = { ...config };\n    for (const option of GlobalConfig.OPTIONS) {\n      GlobalConfig.config[option] = config[option] as never;\n      delete result[option];\n    }\n\n    return result;\n  }\n\n  static reset(): void {\n    GlobalConfig.config = {};\n  }\n}\n"],"mappings":";;AAOA,IAAa,eAAb,MAAa,aAAa;CAExB,OAAO,UAAU;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAEA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CAKA,OAAe,SAAyD,CAAC;CAMzE,OAAO,IAGL,KAGgE;EAChE,MAAM,eAAe,MAChB,2BAA2B,OAG5B,KAAA;EAEJ,OAAO,MACD,aAAa,OAAO,QAAQ,eAG9B,aAAa;CACnB;CAEA,OAAO,IACL,QACgB;EAChB,aAAa,MAAM;EAEnB,MAAM,SAAS,EAAE,GAAG,OAAO;EAC3B,KAAK,MAAM,UAAU,aAAa,SAAS;GACzC,aAAa,OAAO,UAAU,OAAO;GACrC,OAAO,OAAO;EAChB;EAEA,OAAO;CACT;CAEA,OAAO,QAAc;EACnB,aAAa,SAAS,CAAC;CACzB;AACF"}

package/dist/config/index.js

@@ -1,8 +1,7 @@
 import { logger } from "../logger/index.js";
-import { allManagersList, get } from "../modules/manager/index.js";
 import { getOptions } from "./options/index.js";
 import { mergeChildConfig } from "./utils.js";
-
+import { allManagersList, get } from "../modules/manager/index.js";
 //#region lib/config/index.ts
 function getManagerConfig(config, manager) {
 	let managerConfig = {
@@ -41,7 +40,7 @@ function filterConfig(inputConfig, targetStage) {
 	}
 	return outputConfig;
 }
-
 //#endregion
-export { filterConfig, getManagerConfig, removeGlobalConfig };
+export { filterConfig, getManagerConfig, mergeChildConfig, removeGlobalConfig };
+
 //# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["options.getOptions"],"sources":["../../lib/config/index.ts"],"sourcesContent":["import { logger } from '../logger/index.ts';\nimport { allManagersList, get } from '../modules/manager/index.ts';\nimport * as options from './options/index.ts';\nimport type {\n  AllConfig,\n  ManagerConfig,\n  RenovateConfig,\n  RenovateConfigStage,\n} from './types.ts';\nimport { mergeChildConfig } from './utils.ts';\n\nexport { mergeChildConfig };\n\nexport function getManagerConfig(\n  config: RenovateConfig,\n  manager: string,\n): ManagerConfig {\n  let managerConfig: ManagerConfig = {\n    ...config,\n    manager,\n  };\n  const categories = get(manager, 'categories');\n  if (categories) {\n    managerConfig.categories = categories;\n  }\n  // TODO: fix types #22198\n  // @ts-expect-error -- not easily typed\n  managerConfig = mergeChildConfig(managerConfig, config[manager] as any);\n  for (const i of allManagersList) {\n    // @ts-expect-error -- not easily typed\n    delete managerConfig[i];\n  }\n  return managerConfig;\n}\n\nexport function removeGlobalConfig(\n  config: RenovateConfig,\n  keepInherited: boolean,\n): RenovateConfig {\n  const outputConfig: RenovateConfig = { ...config };\n  for (const option of options.getOptions()) {\n    if (keepInherited && option.inheritConfigSupport) {\n      continue;\n    }\n    if (option.globalOnly) {\n      // @ts-expect-error -- not easily typed\n      delete outputConfig[option.name];\n    }\n  }\n  return outputConfig;\n}\n\nexport function filterConfig<T extends AllConfig = AllConfig>(\n  inputConfig: T,\n  targetStage: RenovateConfigStage,\n): T {\n  logger.trace({ config: inputConfig }, `filterConfig('${targetStage}')`);\n  const outputConfig: T = { ...inputConfig };\n  const stages: (string | undefined)[] = [\n    'global',\n    'inherit',\n    'repository',\n    'package',\n    'branch',\n    'pr',\n  ];\n  const targetIndex = stages.indexOf(targetStage);\n  for (const option of options.getOptions()) {\n    const optionIndex = stages.indexOf(option.stage);\n    if (optionIndex !== -1 && optionIndex < targetIndex) {\n      // @ts-expect-error -- not easily typed\n      delete outputConfig[option.name];\n    }\n  }\n  return outputConfig;\n}\n"],"mappings":";;;;;;AAaA,SAAgB,iBACd,QACA,SACe;CACf,IAAI,gBAA+B;EACjC,GAAG;EACH;EACD;CACD,MAAM,aAAa,IAAI,SAAS,aAAa;AAC7C,KAAI,WACF,eAAc,aAAa;AAI7B,iBAAgB,iBAAiB,eAAe,OAAO,SAAgB;AACvE,MAAK,MAAM,KAAK,gBAEd,QAAO,cAAc;AAEvB,QAAO;;AAGT,SAAgB,mBACd,QACA,eACgB;CAChB,MAAM,eAA+B,EAAE,GAAG,QAAQ;AAClD,MAAK,MAAM,UAAUA,YAAoB,EAAE;AACzC,MAAI,iBAAiB,OAAO,qBAC1B;AAEF,MAAI,OAAO,WAET,QAAO,aAAa,OAAO;;AAG/B,QAAO;;AAGT,SAAgB,aACd,aACA,aACG;AACH,QAAO,MAAM,EAAE,QAAQ,aAAa,EAAE,iBAAiB,YAAY,IAAI;CACvE,MAAM,eAAkB,EAAE,GAAG,aAAa;CAC1C,MAAM,SAAiC;EACrC;EACA;EACA;EACA;EACA;EACA;EACD;CACD,MAAM,cAAc,OAAO,QAAQ,YAAY;AAC/C,MAAK,MAAM,UAAUA,YAAoB,EAAE;EACzC,MAAM,cAAc,OAAO,QAAQ,OAAO,MAAM;AAChD,MAAI,gBAAgB,MAAM,cAAc,YAEtC,QAAO,aAAa,OAAO;;AAG/B,QAAO"}
+{"version":3,"file":"index.js","names":["options.getOptions"],"sources":["../../lib/config/index.ts"],"sourcesContent":["import { logger } from '../logger/index.ts';\nimport { allManagersList, get } from '../modules/manager/index.ts';\nimport * as options from './options/index.ts';\nimport type {\n  AllConfig,\n  ManagerConfig,\n  RenovateConfig,\n  RenovateConfigStage,\n} from './types.ts';\nimport { mergeChildConfig } from './utils.ts';\n\nexport { mergeChildConfig };\n\nexport function getManagerConfig(\n  config: RenovateConfig,\n  manager: string,\n): ManagerConfig {\n  let managerConfig: ManagerConfig = {\n    ...config,\n    manager,\n  };\n  const categories = get(manager, 'categories');\n  if (categories) {\n    managerConfig.categories = categories;\n  }\n  // TODO: fix types #22198\n  // @ts-expect-error -- not easily typed\n  managerConfig = mergeChildConfig(managerConfig, config[manager] as any);\n  for (const i of allManagersList) {\n    // @ts-expect-error -- not easily typed\n    delete managerConfig[i];\n  }\n  return managerConfig;\n}\n\nexport function removeGlobalConfig(\n  config: RenovateConfig,\n  keepInherited: boolean,\n): RenovateConfig {\n  const outputConfig: RenovateConfig = { ...config };\n  for (const option of options.getOptions()) {\n    if (keepInherited && option.inheritConfigSupport) {\n      continue;\n    }\n    if (option.globalOnly) {\n      // @ts-expect-error -- not easily typed\n      delete outputConfig[option.name];\n    }\n  }\n  return outputConfig;\n}\n\nexport function filterConfig<T extends AllConfig = AllConfig>(\n  inputConfig: T,\n  targetStage: RenovateConfigStage,\n): T {\n  logger.trace({ config: inputConfig }, `filterConfig('${targetStage}')`);\n  const outputConfig: T = { ...inputConfig };\n  const stages: (string | undefined)[] = [\n    'global',\n    'inherit',\n    'repository',\n    'package',\n    'branch',\n    'pr',\n  ];\n  const targetIndex = stages.indexOf(targetStage);\n  for (const option of options.getOptions()) {\n    const optionIndex = stages.indexOf(option.stage);\n    if (optionIndex !== -1 && optionIndex < targetIndex) {\n      // @ts-expect-error -- not easily typed\n      delete outputConfig[option.name];\n    }\n  }\n  return outputConfig;\n}\n"],"mappings":";;;;;AAaA,SAAgB,iBACd,QACA,SACe;CACf,IAAI,gBAA+B;EACjC,GAAG;EACH;CACF;CACA,MAAM,aAAa,IAAI,SAAS,YAAY;CAC5C,IAAI,YACF,cAAc,aAAa;CAI7B,gBAAgB,iBAAiB,eAAe,OAAO,QAAe;CACtE,KAAK,MAAM,KAAK,iBAEd,OAAO,cAAc;CAEvB,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,eACgB;CAChB,MAAM,eAA+B,EAAE,GAAG,OAAO;CACjD,KAAK,MAAM,UAAUA,WAAmB,GAAG;EACzC,IAAI,iBAAiB,OAAO,sBAC1B;EAEF,IAAI,OAAO,YAET,OAAO,aAAa,OAAO;CAE/B;CACA,OAAO;AACT;AAEA,SAAgB,aACd,aACA,aACG;CACH,OAAO,MAAM,EAAE,QAAQ,YAAY,GAAG,iBAAiB,YAAY,GAAG;CACtE,MAAM,eAAkB,EAAE,GAAG,YAAY;CACzC,MAAM,SAAiC;EACrC;EACA;EACA;EACA;EACA;EACA;CACF;CACA,MAAM,cAAc,OAAO,QAAQ,WAAW;CAC9C,KAAK,MAAM,UAAUA,WAAmB,GAAG;EACzC,MAAM,cAAc,OAAO,QAAQ,OAAO,KAAK;EAC/C,IAAI,gBAAgB,MAAM,cAAc,aAEtC,OAAO,aAAa,OAAO;CAE/B;CACA,OAAO;AACT"}

package/dist/config/inherit.js

@@ -4,8 +4,15 @@ var InheritConfig = class InheritConfig {
 	static OPTIONS = [
 		"bbUseDevelopmentBranch",
 		"configFileNames",
+		"onboarding",
 		"onboardingAutoCloseAge",
-		"onboardingBranch"
+		"onboardingBranch",
+		"onboardingCommitMessage",
+		"onboardingConfig",
+		"onboardingConfigFileName",
+		"onboardingNoDeps",
+		"onboardingPrTitle",
+		"requireConfig"
 	];
 	static config = {};
 	static get(key) {
@@ -25,7 +32,7 @@ var InheritConfig = class InheritConfig {
 		InheritConfig.config = {};
 	}
 };
-
 //#endregion
 export { InheritConfig, NOT_PRESENT };
+
 //# sourceMappingURL=inherit.js.map

package/dist/config/inherit.js.map

@@ -1 +1 @@
-{"version":3,"file":"inherit.js","names":[],"sources":["../../lib/config/inherit.ts"],"sourcesContent":["import type { GlobalInheritableConfig, RenovateConfig } from './types.ts';\n\nexport const NOT_PRESENT = Symbol('not-present');\n\nexport class InheritConfig {\n  static OPTIONS: readonly (keyof GlobalInheritableConfig)[] = [\n    'bbUseDevelopmentBranch',\n    'configFileNames',\n    'onboardingAutoCloseAge',\n    'onboardingBranch',\n  ];\n\n  private static config: GlobalInheritableConfig = {};\n\n  static get<Key extends keyof GlobalInheritableConfig>(\n    key: Key,\n  ): GlobalInheritableConfig[Key] | typeof NOT_PRESENT {\n    if (key in InheritConfig.config) {\n      return InheritConfig.config[key];\n    }\n\n    return NOT_PRESENT;\n  }\n\n  static set(config: RenovateConfig & GlobalInheritableConfig): RenovateConfig {\n    InheritConfig.reset();\n\n    const result = { ...config };\n    for (const option of InheritConfig.OPTIONS) {\n      if (option in config) {\n        InheritConfig.config[option] = config[option] as never;\n      }\n      delete result[option];\n    }\n\n    return result;\n  }\n\n  static reset(): void {\n    InheritConfig.config = {};\n  }\n}\n"],"mappings":";AAEA,MAAa,cAAc,OAAO,cAAc;AAEhD,IAAa,gBAAb,MAAa,cAAc;CACzB,OAAO,UAAsD;EAC3D;EACA;EACA;EACA;EACD;CAED,OAAe,SAAkC,EAAE;CAEnD,OAAO,IACL,KACmD;AACnD,MAAI,OAAO,cAAc,OACvB,QAAO,cAAc,OAAO;AAG9B,SAAO;;CAGT,OAAO,IAAI,QAAkE;AAC3E,gBAAc,OAAO;EAErB,MAAM,SAAS,EAAE,GAAG,QAAQ;AAC5B,OAAK,MAAM,UAAU,cAAc,SAAS;AAC1C,OAAI,UAAU,OACZ,eAAc,OAAO,UAAU,OAAO;AAExC,UAAO,OAAO;;AAGhB,SAAO;;CAGT,OAAO,QAAc;AACnB,gBAAc,SAAS,EAAE"}
+{"version":3,"file":"inherit.js","names":[],"sources":["../../lib/config/inherit.ts"],"sourcesContent":["import type { GlobalInheritableConfig, RenovateConfig } from './types.ts';\n\nexport const NOT_PRESENT = Symbol('not-present');\n\nexport class InheritConfig {\n  static OPTIONS: readonly (keyof GlobalInheritableConfig)[] = [\n    'bbUseDevelopmentBranch',\n    'configFileNames',\n    'onboarding',\n    'onboardingAutoCloseAge',\n    'onboardingBranch',\n    'onboardingCommitMessage',\n    'onboardingConfig',\n    'onboardingConfigFileName',\n    'onboardingNoDeps',\n    'onboardingPrTitle',\n    'requireConfig',\n  ];\n\n  private static config: GlobalInheritableConfig = {};\n\n  static get<Key extends keyof GlobalInheritableConfig>(\n    key: Key,\n  ): GlobalInheritableConfig[Key] | typeof NOT_PRESENT {\n    if (key in InheritConfig.config) {\n      return InheritConfig.config[key];\n    }\n\n    return NOT_PRESENT;\n  }\n\n  static set(config: RenovateConfig & GlobalInheritableConfig): RenovateConfig {\n    InheritConfig.reset();\n\n    const result = { ...config };\n    for (const option of InheritConfig.OPTIONS) {\n      if (option in config) {\n        InheritConfig.config[option] = config[option] as never;\n      }\n      delete result[option];\n    }\n\n    return result;\n  }\n\n  static reset(): void {\n    InheritConfig.config = {};\n  }\n}\n"],"mappings":";AAEA,MAAa,cAAc,OAAO,aAAa;AAE/C,IAAa,gBAAb,MAAa,cAAc;CACzB,OAAO,UAAsD;EAC3D;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CAEA,OAAe,SAAkC,CAAC;CAElD,OAAO,IACL,KACmD;EACnD,IAAI,OAAO,cAAc,QACvB,OAAO,cAAc,OAAO;EAG9B,OAAO;CACT;CAEA,OAAO,IAAI,QAAkE;EAC3E,cAAc,MAAM;EAEpB,MAAM,SAAS,EAAE,GAAG,OAAO;EAC3B,KAAK,MAAM,UAAU,cAAc,SAAS;GAC1C,IAAI,UAAU,QACZ,cAAc,OAAO,UAAU,OAAO;GAExC,OAAO,OAAO;EAChB;EAEA,OAAO;CACT;CAEA,OAAO,QAAc;EACnB,cAAc,SAAS,CAAC;CAC1B;AACF"}

package/dist/config/massage.js

@@ -1,7 +1,7 @@
 import { clone } from "../util/clone.js";
+import { toMs } from "../util/pretty-time.js";
 import { getOptions } from "./options/index.js";
 import { isArray, isNonEmptyArray, isObject, isString } from "@sindresorhus/is";
-
 //#region lib/config/massage.ts
 const options = getOptions();
 let allowedStrings;
@@ -13,7 +13,8 @@ function massageConfig(config) {
 		});
 	}
 	const massagedConfig = clone(config);
-	for (const [key, val] of Object.entries(config)) if (allowedStrings.includes(key) && isString(val)) massagedConfig[key] = [val];
+	for (const [key, val] of Object.entries(config)) if (key === "minimumReleaseAge" && isString(val) && toMs(val) === 0) massagedConfig.minimumReleaseAge = null;
+	else if (allowedStrings.includes(key) && isString(val)) massagedConfig[key] = [val];
 	else if (isArray(val)) {
 		massagedConfig[key] = [];
 		val.forEach((item) => {
@@ -58,7 +59,7 @@ function massageConfig(config) {
 	}
 	return massagedConfig;
 }
-
 //#endregion
 export { massageConfig };
+
 //# sourceMappingURL=massage.js.map

package/dist/config/massage.js.map

@@ -1 +1 @@
-{"version":3,"file":"massage.js","names":[],"sources":["../../lib/config/massage.ts"],"sourcesContent":["import { isArray, isNonEmptyArray, isObject, isString } from '@sindresorhus/is';\nimport { clone } from '../util/clone.ts';\nimport { getOptions } from './options/index.ts';\nimport type { PackageRule, RenovateConfig, UpdateType } from './types.ts';\n\nconst options = getOptions();\n\nlet allowedStrings: string[];\n\n// Returns a massaged config\nexport function massageConfig(config: RenovateConfig): RenovateConfig {\n  if (!allowedStrings) {\n    allowedStrings = [];\n    options.forEach((option) => {\n      if (option.allowString) {\n        allowedStrings.push(option.name);\n      }\n    });\n  }\n  const massagedConfig = clone(config);\n  for (const [key, val] of Object.entries(config)) {\n    if (allowedStrings.includes(key) && isString(val)) {\n      // @ts-expect-error -- TODO: fix me\n      massagedConfig[key] = [val];\n    } else if (isArray(val)) {\n      // @ts-expect-error -- TODO: fix me\n      massagedConfig[key] = [];\n      val.forEach((item) => {\n        if (isObject(item)) {\n          // @ts-expect-error -- TODO: fix me\n          (massagedConfig[key] as RenovateConfig[]).push(\n            massageConfig(item as RenovateConfig),\n          );\n        } else {\n          // @ts-expect-error -- TODO: fix me\n          (massagedConfig[key] as unknown[]).push(item);\n        }\n      });\n    } else if (isObject(val) && key !== 'encrypted') {\n      // @ts-expect-error -- TODO: fix me\n      massagedConfig[key] = massageConfig(val as RenovateConfig);\n    }\n  }\n  if (isNonEmptyArray(massagedConfig.packageRules)) {\n    let newRules: PackageRule[] = [];\n    const updateTypes: UpdateType[] = [\n      'major',\n      'minor',\n      'patch',\n      'pin',\n      'digest',\n      'rollback',\n    ];\n    for (const rule of massagedConfig.packageRules) {\n      newRules.push(rule);\n      for (const [key, val] of Object.entries(rule) as [\n        UpdateType,\n        PackageRule,\n      ][]) {\n        if (updateTypes.includes(key)) {\n          let newRule = clone(rule);\n          Object.keys(newRule).forEach((newKey) => {\n            if (!(newKey.startsWith(`match`) || newKey.startsWith('exclude'))) {\n              // @ts-expect-error -- TODO: fix me\n              delete newRule[newKey];\n            }\n          });\n          newRule.matchUpdateTypes = rule.matchUpdateTypes ?? [];\n          newRule.matchUpdateTypes.push(key);\n          newRule = { ...newRule, ...val };\n          newRules.push(newRule);\n        }\n      }\n    }\n    for (const rule of newRules) {\n      updateTypes.forEach((updateType) => {\n        delete rule[updateType];\n      });\n    }\n    newRules = newRules.filter((rule) => {\n      if (\n        Object.keys(rule).every(\n          (key) => key.startsWith('match') || key.startsWith('exclude'),\n        )\n      ) {\n        // Exclude rules which contain only match or exclude options\n        return false;\n      }\n      return true;\n    });\n    massagedConfig.packageRules = newRules;\n  }\n  return massagedConfig;\n}\n"],"mappings":";;;;;AAKA,MAAM,UAAU,YAAY;AAE5B,IAAI;AAGJ,SAAgB,cAAc,QAAwC;AACpE,KAAI,CAAC,gBAAgB;AACnB,mBAAiB,EAAE;AACnB,UAAQ,SAAS,WAAW;AAC1B,OAAI,OAAO,YACT,gBAAe,KAAK,OAAO,KAAK;IAElC;;CAEJ,MAAM,iBAAiB,MAAM,OAAO;AACpC,MAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,OAAO,CAC7C,KAAI,eAAe,SAAS,IAAI,IAAI,SAAS,IAAI,CAE/C,gBAAe,OAAO,CAAC,IAAI;UAClB,QAAQ,IAAI,EAAE;AAEvB,iBAAe,OAAO,EAAE;AACxB,MAAI,SAAS,SAAS;AACpB,OAAI,SAAS,KAAK,CAEhB,CAAC,eAAe,KAA0B,KACxC,cAAc,KAAuB,CACtC;OAGD,CAAC,eAAe,KAAmB,KAAK,KAAK;IAE/C;YACO,SAAS,IAAI,IAAI,QAAQ,YAElC,gBAAe,OAAO,cAAc,IAAsB;AAG9D,KAAI,gBAAgB,eAAe,aAAa,EAAE;EAChD,IAAI,WAA0B,EAAE;EAChC,MAAM,cAA4B;GAChC;GACA;GACA;GACA;GACA;GACA;GACD;AACD,OAAK,MAAM,QAAQ,eAAe,cAAc;AAC9C,YAAS,KAAK,KAAK;AACnB,QAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,KAAK,CAI3C,KAAI,YAAY,SAAS,IAAI,EAAE;IAC7B,IAAI,UAAU,MAAM,KAAK;AACzB,WAAO,KAAK,QAAQ,CAAC,SAAS,WAAW;AACvC,SAAI,EAAE,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,UAAU,EAE9D,QAAO,QAAQ;MAEjB;AACF,YAAQ,mBAAmB,KAAK,oBAAoB,EAAE;AACtD,YAAQ,iBAAiB,KAAK,IAAI;AAClC,cAAU;KAAE,GAAG;KAAS,GAAG;KAAK;AAChC,aAAS,KAAK,QAAQ;;;AAI5B,OAAK,MAAM,QAAQ,SACjB,aAAY,SAAS,eAAe;AAClC,UAAO,KAAK;IACZ;AAEJ,aAAW,SAAS,QAAQ,SAAS;AACnC,OACE,OAAO,KAAK,KAAK,CAAC,OACf,QAAQ,IAAI,WAAW,QAAQ,IAAI,IAAI,WAAW,UAAU,CAC9D,CAGD,QAAO;AAET,UAAO;IACP;AACF,iBAAe,eAAe;;AAEhC,QAAO"}
+{"version":3,"file":"massage.js","names":[],"sources":["../../lib/config/massage.ts"],"sourcesContent":["import { isArray, isNonEmptyArray, isObject, isString } from '@sindresorhus/is';\nimport { clone } from '../util/clone.ts';\nimport { toMs } from '../util/pretty-time.ts';\nimport { getOptions } from './options/index.ts';\nimport type { PackageRule, RenovateConfig, UpdateType } from './types.ts';\n\nconst options = getOptions();\n\nlet allowedStrings: string[];\n\n// Returns a massaged config\nexport function massageConfig(config: RenovateConfig): RenovateConfig {\n  if (!allowedStrings) {\n    allowedStrings = [];\n    options.forEach((option) => {\n      if (option.allowString) {\n        allowedStrings.push(option.name);\n      }\n    });\n  }\n  const massagedConfig = clone(config);\n  for (const [key, val] of Object.entries(config)) {\n    if (key === 'minimumReleaseAge' && isString(val) && toMs(val) === 0) {\n      massagedConfig.minimumReleaseAge = null;\n    } else if (allowedStrings.includes(key) && isString(val)) {\n      // @ts-expect-error -- TODO: fix me\n      massagedConfig[key] = [val];\n    } else if (isArray(val)) {\n      // @ts-expect-error -- TODO: fix me\n      massagedConfig[key] = [];\n      val.forEach((item) => {\n        if (isObject(item)) {\n          // @ts-expect-error -- TODO: fix me\n          (massagedConfig[key] as RenovateConfig[]).push(massageConfig(item));\n        } else {\n          // @ts-expect-error -- TODO: fix me\n          (massagedConfig[key] as unknown[]).push(item);\n        }\n      });\n    } else if (isObject(val) && key !== 'encrypted') {\n      // @ts-expect-error -- TODO: fix me\n      massagedConfig[key] = massageConfig(val);\n    }\n  }\n  if (isNonEmptyArray(massagedConfig.packageRules)) {\n    let newRules: PackageRule[] = [];\n    const updateTypes: UpdateType[] = [\n      'major',\n      'minor',\n      'patch',\n      'pin',\n      'digest',\n      'rollback',\n    ];\n    for (const rule of massagedConfig.packageRules) {\n      newRules.push(rule);\n      for (const [key, val] of Object.entries(rule) as [\n        UpdateType,\n        PackageRule,\n      ][]) {\n        if (updateTypes.includes(key)) {\n          let newRule = clone(rule);\n          Object.keys(newRule).forEach((newKey) => {\n            if (!(newKey.startsWith(`match`) || newKey.startsWith('exclude'))) {\n              // @ts-expect-error -- TODO: fix me\n              delete newRule[newKey];\n            }\n          });\n          newRule.matchUpdateTypes = rule.matchUpdateTypes ?? [];\n          newRule.matchUpdateTypes.push(key);\n          newRule = { ...newRule, ...val };\n          newRules.push(newRule);\n        }\n      }\n    }\n    for (const rule of newRules) {\n      updateTypes.forEach((updateType) => {\n        delete rule[updateType];\n      });\n    }\n    newRules = newRules.filter((rule) => {\n      if (\n        Object.keys(rule).every(\n          (key) => key.startsWith('match') || key.startsWith('exclude'),\n        )\n      ) {\n        // Exclude rules which contain only match or exclude options\n        return false;\n      }\n      return true;\n    });\n    massagedConfig.packageRules = newRules;\n  }\n  return massagedConfig;\n}\n"],"mappings":";;;;;AAMA,MAAM,UAAU,WAAW;AAE3B,IAAI;AAGJ,SAAgB,cAAc,QAAwC;CACpE,IAAI,CAAC,gBAAgB;EACnB,iBAAiB,CAAC;EAClB,QAAQ,SAAS,WAAW;GAC1B,IAAI,OAAO,aACT,eAAe,KAAK,OAAO,IAAI;EAEnC,CAAC;CACH;CACA,MAAM,iBAAiB,MAAM,MAAM;CACnC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,MAAM,GAC5C,IAAI,QAAQ,uBAAuB,SAAS,GAAG,KAAK,KAAK,GAAG,MAAM,GAChE,eAAe,oBAAoB;MAC9B,IAAI,eAAe,SAAS,GAAG,KAAK,SAAS,GAAG,GAErD,eAAe,OAAO,CAAC,GAAG;MACrB,IAAI,QAAQ,GAAG,GAAG;EAEvB,eAAe,OAAO,CAAC;EACvB,IAAI,SAAS,SAAS;GACpB,IAAI,SAAS,IAAI,GAEf,eAAgB,IAAI,CAAsB,KAAK,cAAc,IAAI,CAAC;QAGlE,eAAgB,IAAI,CAAe,KAAK,IAAI;EAEhD,CAAC;CACH,OAAO,IAAI,SAAS,GAAG,KAAK,QAAQ,aAElC,eAAe,OAAO,cAAc,GAAG;CAG3C,IAAI,gBAAgB,eAAe,YAAY,GAAG;EAChD,IAAI,WAA0B,CAAC;EAC/B,MAAM,cAA4B;GAChC;GACA;GACA;GACA;GACA;GACA;EACF;EACA,KAAK,MAAM,QAAQ,eAAe,cAAc;GAC9C,SAAS,KAAK,IAAI;GAClB,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,IAAI,GAI1C,IAAI,YAAY,SAAS,GAAG,GAAG;IAC7B,IAAI,UAAU,MAAM,IAAI;IACxB,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,WAAW;KACvC,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,OAAO,WAAW,SAAS,IAE7D,OAAO,QAAQ;IAEnB,CAAC;IACD,QAAQ,mBAAmB,KAAK,oBAAoB,CAAC;IACrD,QAAQ,iBAAiB,KAAK,GAAG;IACjC,UAAU;KAAE,GAAG;KAAS,GAAG;IAAI;IAC/B,SAAS,KAAK,OAAO;GACvB;EAEJ;EACA,KAAK,MAAM,QAAQ,UACjB,YAAY,SAAS,eAAe;GAClC,OAAO,KAAK;EACd,CAAC;EAEH,WAAW,SAAS,QAAQ,SAAS;GACnC,IACE,OAAO,KAAK,IAAI,CAAC,CAAC,OACf,QAAQ,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,SAAS,CAC9D,GAGA,OAAO;GAET,OAAO;EACT,CAAC;EACD,eAAe,eAAe;CAChC;CACA,OAAO;AACT"}

package/dist/config/migrate-validate.js

@@ -2,9 +2,8 @@ import { logger } from "../logger/index.js";
 import { massageConfig } from "./massage.js";
 import { migrateConfig } from "./migration.js";
 import { validateConfig } from "./validation.js";
-import { dequal } from "dequal";
 import { isNonEmptyArray } from "@sindresorhus/is";
-
+import { dequal } from "dequal";
 //#region lib/config/migrate-validate.ts
 async function migrateAndValidate(config, input) {
 	logger.debug("migrateAndValidate()");
@@ -29,7 +28,7 @@ async function migrateAndValidate(config, input) {
 		throw err;
 	}
 }
-
 //#endregion
 export { migrateAndValidate };
+
 //# sourceMappingURL=migrate-validate.js.map

package/dist/config/migrate-validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-validate.js","names":["configMigration.migrateConfig","configMassage.massageConfig","configValidation.validateConfig"],"sources":["../../lib/config/migrate-validate.ts"],"sourcesContent":["import { isNonEmptyArray } from '@sindresorhus/is';\nimport { dequal } from 'dequal';\nimport { logger } from '../logger/index.ts';\nimport * as configMassage from './massage.ts';\nimport * as configMigration from './migration.ts';\nimport type { RenovateConfig, ValidationMessage } from './types.ts';\nimport * as configValidation from './validation.ts';\n\nexport async function migrateAndValidate(\n  config: RenovateConfig,\n  input: RenovateConfig,\n): Promise<RenovateConfig> {\n  logger.debug('migrateAndValidate()');\n  try {\n    const { isMigrated, migratedConfig } = configMigration.migrateConfig(input);\n    if (isMigrated) {\n      logger.debug(\n        { oldConfig: input, newConfig: migratedConfig },\n        'Config migration necessary',\n      );\n    } else {\n      logger.debug('No config migration necessary');\n    }\n    const massagedConfig = configMassage.massageConfig(migratedConfig);\n    // log only if it's changed\n    if (!dequal(input, massagedConfig)) {\n      logger.debug({ config: massagedConfig }, 'Post-massage config');\n    }\n    const {\n      warnings,\n      errors,\n    }: {\n      warnings: ValidationMessage[];\n      errors: ValidationMessage[];\n    } = await configValidation.validateConfig('repo', massagedConfig);\n    /* v8 ignore if -- hard to test */\n    if (isNonEmptyArray(warnings)) {\n      logger.warn({ warnings }, 'Found renovate config warnings');\n    }\n    if (isNonEmptyArray(errors)) {\n      logger.info({ errors }, 'Found renovate config errors');\n    }\n    massagedConfig.errors = (config.errors ?? []).concat(errors);\n    if (!config.repoIsOnboarded) {\n      massagedConfig.warnings = (config.warnings ?? []).concat(warnings);\n    }\n    return massagedConfig;\n  } catch (err) {\n    logger.debug({ config: input }, 'migrateAndValidate error');\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;AAQA,eAAsB,mBACpB,QACA,OACyB;AACzB,QAAO,MAAM,uBAAuB;AACpC,KAAI;EACF,MAAM,EAAE,YAAY,mBAAmBA,cAA8B,MAAM;AAC3E,MAAI,WACF,QAAO,MACL;GAAE,WAAW;GAAO,WAAW;GAAgB,EAC/C,6BACD;MAED,QAAO,MAAM,gCAAgC;EAE/C,MAAM,iBAAiBC,cAA4B,eAAe;AAElE,MAAI,CAAC,OAAO,OAAO,eAAe,CAChC,QAAO,MAAM,EAAE,QAAQ,gBAAgB,EAAE,sBAAsB;EAEjE,MAAM,EACJ,UACA,WAIE,MAAMC,eAAgC,QAAQ,eAAe;;AAEjE,MAAI,gBAAgB,SAAS,CAC3B,QAAO,KAAK,EAAE,UAAU,EAAE,iCAAiC;AAE7D,MAAI,gBAAgB,OAAO,CACzB,QAAO,KAAK,EAAE,QAAQ,EAAE,+BAA+B;AAEzD,iBAAe,UAAU,OAAO,UAAU,EAAE,EAAE,OAAO,OAAO;AAC5D,MAAI,CAAC,OAAO,gBACV,gBAAe,YAAY,OAAO,YAAY,EAAE,EAAE,OAAO,SAAS;AAEpE,SAAO;UACA,KAAK;AACZ,SAAO,MAAM,EAAE,QAAQ,OAAO,EAAE,2BAA2B;AAC3D,QAAM"}
+{"version":3,"file":"migrate-validate.js","names":["configMigration.migrateConfig","configMassage.massageConfig","configValidation.validateConfig"],"sources":["../../lib/config/migrate-validate.ts"],"sourcesContent":["import { isNonEmptyArray } from '@sindresorhus/is';\nimport { dequal } from 'dequal';\nimport { logger } from '../logger/index.ts';\nimport * as configMassage from './massage.ts';\nimport * as configMigration from './migration.ts';\nimport type { RenovateConfig, ValidationMessage } from './types.ts';\nimport * as configValidation from './validation.ts';\n\nexport async function migrateAndValidate(\n  config: RenovateConfig,\n  input: RenovateConfig,\n): Promise<RenovateConfig> {\n  logger.debug('migrateAndValidate()');\n  try {\n    const { isMigrated, migratedConfig } = configMigration.migrateConfig(input);\n    if (isMigrated) {\n      logger.debug(\n        { oldConfig: input, newConfig: migratedConfig },\n        'Config migration necessary',\n      );\n    } else {\n      logger.debug('No config migration necessary');\n    }\n    const massagedConfig = configMassage.massageConfig(migratedConfig);\n    // log only if it's changed\n    if (!dequal(input, massagedConfig)) {\n      logger.debug({ config: massagedConfig }, 'Post-massage config');\n    }\n    const {\n      warnings,\n      errors,\n    }: {\n      warnings: ValidationMessage[];\n      errors: ValidationMessage[];\n    } = await configValidation.validateConfig('repo', massagedConfig);\n    /* v8 ignore if -- hard to test */\n    if (isNonEmptyArray(warnings)) {\n      logger.warn({ warnings }, 'Found renovate config warnings');\n    }\n    if (isNonEmptyArray(errors)) {\n      logger.info({ errors }, 'Found renovate config errors');\n    }\n    massagedConfig.errors = (config.errors ?? []).concat(errors);\n    if (!config.repoIsOnboarded) {\n      massagedConfig.warnings = (config.warnings ?? []).concat(warnings);\n    }\n    return massagedConfig;\n  } catch (err) {\n    logger.debug({ config: input }, 'migrateAndValidate error');\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;AAQA,eAAsB,mBACpB,QACA,OACyB;CACzB,OAAO,MAAM,sBAAsB;CACnC,IAAI;EACF,MAAM,EAAE,YAAY,mBAAmBA,cAA8B,KAAK;EAC1E,IAAI,YACF,OAAO,MACL;GAAE,WAAW;GAAO,WAAW;EAAe,GAC9C,4BACF;OAEA,OAAO,MAAM,+BAA+B;EAE9C,MAAM,iBAAiBC,cAA4B,cAAc;EAEjE,IAAI,CAAC,OAAO,OAAO,cAAc,GAC/B,OAAO,MAAM,EAAE,QAAQ,eAAe,GAAG,qBAAqB;EAEhE,MAAM,EACJ,UACA,WAIE,MAAMC,eAAgC,QAAQ,cAAc;;EAEhE,IAAI,gBAAgB,QAAQ,GAC1B,OAAO,KAAK,EAAE,SAAS,GAAG,gCAAgC;EAE5D,IAAI,gBAAgB,MAAM,GACxB,OAAO,KAAK,EAAE,OAAO,GAAG,8BAA8B;EAExD,eAAe,UAAU,OAAO,UAAU,CAAC,EAAA,CAAG,OAAO,MAAM;EAC3D,IAAI,CAAC,OAAO,iBACV,eAAe,YAAY,OAAO,YAAY,CAAC,EAAA,CAAG,OAAO,QAAQ;EAEnE,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,QAAQ,MAAM,GAAG,0BAA0B;EAC1D,MAAM;CACR;AACF"}