renovate 44.210.2 → 44.211.0

package/dist/modules/manager/maven-wrapper/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["mavenVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/maven-wrapper/artifacts.ts"],"sourcesContent":["import type { Stats } from 'node:fs';\nimport os from 'node:os';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport {\n  chmodLocalFile,\n  deleteLocalFile,\n  readLocalFile,\n  statLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { MavenDatasource } from '../../datasource/maven/index.ts';\nimport mavenVersioning from '../../versioning/maven/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nconst http = new Http('maven-wrapper');\nconst DEFAULT_MAVEN_REPO_URL = 'https://repo.maven.apache.org/maven2';\n\nfunction getChecksumFromUrl(url: string): Promise<string> {\n  return withCache(\n    {\n      namespace: 'url-sha256',\n      key: url,\n      ttlMinutes: 3 * 24 * 60, // 3 days\n    },\n    () => hashStream(http.stream(url), 'sha256'),\n  );\n}\n\nfunction getDistributionUrl(content: string): string | null {\n  const match = regEx(/^distributionUrl\\s*=\\s*(?<distributionUrl>.+)$/m).exec(\n    content,\n  );\n  return (\n    match?.groups?.distributionUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null\n  );\n}\n\nfunction getWrapperUrl(content: string): string | null {\n  const match = regEx(/^wrapperUrl\\s*=\\s*(?<wrapperUrl>.+)$/m).exec(content);\n  return match?.groups?.wrapperUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null;\n}\n\nfunction constructWrapperUrl(\n  version: string,\n  repoUrl: string = DEFAULT_MAVEN_REPO_URL,\n): string {\n  return `${repoUrl}/org/apache/maven/wrapper/maven-wrapper/${version}/maven-wrapper-${version}.jar`;\n}\n\nfunction getWrapperVersion(content: string): string | null {\n  const match = regEx(/^wrapperVersion\\s*=\\s*(?<wrapperVersion>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.wrapperVersion?.trim() ?? null;\n}\n\nfunction getDistributionType(content: string): string | null {\n  const match = regEx(/^distributionType\\s*=\\s*(?<distributionType>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.distributionType?.trim() ?? null;\n}\n\nfunction getChecksumValue(content: string, key: string): string | null {\n  const match = regEx(`^${key}\\\\s*=\\\\s*(?<value>.+)$`, 'm').exec(content);\n  return match?.groups?.value?.trim() ?? null;\n}\n\nfunction addChecksumAfterLine(\n  content: string,\n  lineRegex: RegExp,\n  key: string,\n  value: string,\n): string {\n  return content.replace(\n    regEx(lineRegex),\n    (lineMatch) => `${lineMatch}\\n${key}=${value}`,\n  );\n}\n\nasync function updateChecksums(\n  content: string,\n  updatedDeps: PackageDependency[],\n  addDistributionChecksum: boolean,\n  addWrapperChecksum: boolean,\n  originalContent: string,\n): Promise<string> {\n  let updatedContent = content;\n\n  // Update or add distribution checksum\n  if (addDistributionChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'distributionSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'distributionSha256Sum',\n    );\n    const distUrl = getDistributionUrl(updatedContent);\n    if (distUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(distUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after distributionUrl\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: distUrl },\n          'Failed to fetch distribution checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  // Update or add wrapper checksum\n  if (addWrapperChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'wrapperSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'wrapperSha256Sum',\n    );\n    let wrapperUrl = getWrapperUrl(updatedContent);\n\n    // If no wrapperUrl, try to construct from wrapperVersion\n    if (!wrapperUrl) {\n      const wrapperVersion = getWrapperVersion(updatedContent);\n      if (wrapperVersion) {\n        const customRepoUrl = getCustomMavenWrapperRepoUrl(updatedDeps);\n        wrapperUrl = constructWrapperUrl(\n          wrapperVersion,\n          customRepoUrl ?? DEFAULT_MAVEN_REPO_URL,\n        );\n      }\n    }\n\n    if (wrapperUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(wrapperUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/wrapperSha256Sum=.*/),\n            `wrapperSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after wrapperUrl or wrapperVersion\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: wrapperUrl },\n          'Failed to fetch wrapper checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  return updatedContent;\n}\n\ninterface MavenWrapperPaths {\n  wrapperExecutableFileName: string;\n  localProjectDir: string;\n  wrapperFullyQualifiedPath: string;\n}\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'maven-wrapper.updateArtifacts()');\n\n    const hasMavenUpdate = updatedDeps.some((dep) => dep.depName === 'maven');\n    const hasWrapperUpdate = updatedDeps.some(\n      (dep) => dep.depName === 'maven-wrapper',\n    );\n    // Remember original content properties - we'll restore them after wrapper:wrapper\n    const hadDistributionChecksum = newPackageFileContent.includes(\n      'distributionSha256Sum=',\n    );\n    const hadWrapperChecksum =\n      newPackageFileContent.includes('wrapperSha256Sum=');\n    const originalDistributionType = getDistributionType(newPackageFileContent);\n\n    // Skip if no relevant updates\n    if (!hasWrapperUpdate && !(hasMavenUpdate && hadDistributionChecksum)) {\n      logger.debug(\n        'No Maven wrapper or distribution checksum updates - skipping Artifacts update',\n      );\n      return null;\n    }\n\n    // If wrapper is being updated, check if mvnw exists first\n    let cmd: string | null = null;\n    if (hasWrapperUpdate) {\n      cmd = await createWrapperCommand(\n        packageFileName,\n        originalDistributionType,\n      );\n\n      if (!cmd) {\n        logger.info('No mvnw found - skipping Artifacts update');\n        return null;\n      }\n    }\n\n    // Delete old maven-wrapper.jar if checksums exist and wrapper:wrapper will run\n    // This prevents checksum validation failure when wrapper:wrapper runs\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      const jarPath = packageFileName.replace(\n        'maven-wrapper.properties',\n        'maven-wrapper.jar',\n      );\n      if (jarPath.endsWith('maven-wrapper.jar')) {\n        try {\n          await deleteLocalFile(jarPath);\n          logger.debug({ jarPath }, 'Deleted old maven-wrapper.jar');\n        } catch {\n          // File may not exist, ignore\n        }\n      }\n    }\n\n    // Strip checksum lines before running wrapper:wrapper to avoid validation failure\n    // (mvnw would try to validate NEW jar against OLD checksum)\n    let contentToWrite = newPackageFileContent;\n    if (hasWrapperUpdate && (hadWrapperChecksum || hadDistributionChecksum)) {\n      contentToWrite = contentToWrite\n        .replace(regEx(/^distributionSha256Sum=.*\\n?/m), '')\n        .replace(regEx(/^wrapperSha256Sum=.*\\n?/m), '');\n    }\n\n    // Write the properties file\n    await writeLocalFile(packageFileName, contentToWrite);\n\n    // Run wrapper:wrapper if the wrapper itself is being updated\n    if (hasWrapperUpdate && cmd) {\n      const extraEnv = getExtraEnvOptions(updatedDeps);\n      await executeWrapperCommand(cmd, config, packageFileName, extraEnv);\n    }\n\n    // Now update checksums AFTER wrapper:wrapper has run (if it ran)\n    // This ensures we compute checksums for the actual generated content\n    if (hadDistributionChecksum || hadWrapperChecksum) {\n      const currentContent = await readLocalFile(packageFileName, 'utf8');\n      if (currentContent) {\n        const contentWithChecksums = await updateChecksums(\n          currentContent,\n          updatedDeps,\n          hadDistributionChecksum,\n          hadWrapperChecksum,\n          newPackageFileContent,\n        );\n        await writeLocalFile(packageFileName, contentWithChecksums);\n      }\n    }\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      '.mvn/wrapper/maven-wrapper.properties',\n      '.mvn/wrapper/maven-wrapper.jar',\n      '.mvn/wrapper/MavenWrapperDownloader.java',\n      'mvnw',\n      'mvnw.cmd',\n    ].map(\n      (filename) =>\n        packageFileName.replace('.mvn/wrapper/maven-wrapper.properties', '') +\n        filename,\n    );\n    const updateArtifactsResult = (\n      await getUpdatedArtifacts(status, artifactFileNames)\n    ).filter(isTruthy);\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated maven-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Maven Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nasync function getUpdatedArtifacts(\n  status: StatusResult,\n  artifactFileNames: string[],\n): Promise<UpdateArtifactsResult[]> {\n  const updatedResults: UpdateArtifactsResult[] = [];\n  for (const artifactFileName of artifactFileNames) {\n    const updatedResult = await addIfUpdated(status, artifactFileName);\n    if (updatedResult !== null) {\n      updatedResults.push(updatedResult);\n    }\n  }\n  return updatedResults;\n}\n\n/**\n * Find compatible java version for maven.\n * see https://maven.apache.org/developers/compatibility-plan.html\n * @param mavenWrapperVersion current maven version\n * @returns A Java semver range\n */\nexport function getJavaConstraint(\n  mavenWrapperVersion: string | null | undefined,\n): string | null {\n  const major = mavenWrapperVersion\n    ? mavenVersioning.getMajor(mavenWrapperVersion)\n    : null;\n\n  if (major && major >= 3) {\n    return '^17.0.0';\n  }\n\n  return '^8.0.0';\n}\n\nasync function executeWrapperCommand(\n  cmd: string,\n  config: UpdateArtifactsConfig,\n  packageFileName: string,\n  extraEnv: ExtraEnv,\n): Promise<void> {\n  logger.debug(`Updating maven wrapper: \"${cmd}\"`);\n  const { wrapperFullyQualifiedPath } = getMavenPaths(packageFileName);\n\n  const execOptions: ExecOptions = {\n    cwdFile: wrapperFullyQualifiedPath,\n    docker: {},\n    extraEnv,\n    toolConstraints: [\n      {\n        toolName: 'java',\n        constraint: await resolveToolConstraint(config, 'java', () =>\n          getJavaConstraint(config.currentValue),\n        ),\n      },\n    ],\n  };\n\n  try {\n    await exec(cmd, execOptions);\n  } catch (err) {\n    logger.error({ err }, 'Error executing maven wrapper update command.');\n    throw err;\n  }\n}\n\nfunction getExtraEnvOptions(deps: PackageDependency[]): ExtraEnv {\n  const extraEnv: ExtraEnv = {};\n\n  const customMavenWrapperUrl = getCustomMavenWrapperRepoUrl(deps);\n  if (customMavenWrapperUrl) {\n    extraEnv.MVNW_REPOURL = customMavenWrapperUrl;\n\n    const { username, password } = hostRules.find({\n      hostType: MavenDatasource.id,\n      url: customMavenWrapperUrl,\n    });\n\n    if (username && password) {\n      extraEnv.MVNW_USERNAME = username;\n      extraEnv.MVNW_PASSWORD = password;\n      logger.trace(\n        { customMavenWrapperUrl },\n        'Using MVNW_USERNAME and MVNW_PASSWORD for private repository',\n      );\n    }\n  }\n\n  return extraEnv;\n}\n\nfunction getCustomMavenWrapperRepoUrl(\n  deps: PackageDependency[],\n): string | null {\n  const replaceString = deps.find(\n    (dep) => dep.depName === 'maven-wrapper',\n  )?.replaceString;\n\n  if (!replaceString) {\n    return null;\n  }\n\n  const match = regEx(/^(?<repoUrl>.*?)\\/org\\/apache\\/maven\\/wrapper\\//).exec(\n    replaceString,\n  );\n\n  if (!match) {\n    return null;\n  }\n\n  return match.groups!.repoUrl === DEFAULT_MAVEN_REPO_URL\n    ? null\n    : match.groups!.repoUrl;\n}\n\nasync function createWrapperCommand(\n  packageFileName: string,\n  distributionType: string | null,\n): Promise<string | null> {\n  const {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  } = getMavenPaths(packageFileName);\n\n  // Use existing distributionType or default to 'script' to preserve JAR-based mode\n  // (prevents Maven 3.3.x from defaulting to only-script which doesn't support checksums)\n  const type = distributionType ?? 'script';\n  const args = `wrapper:wrapper -Dtype=${quote(type)}`;\n\n  return await prepareCommand(\n    wrapperExecutableFileName,\n    localProjectDir,\n    await statLocalFile(wrapperFullyQualifiedPath),\n    args,\n  );\n}\n\nfunction mavenWrapperFileName(): string {\n  if (\n    os.platform() === 'win32' &&\n    GlobalConfig.get('binarySource') !== 'docker'\n  ) {\n    return 'mvnw.cmd';\n  }\n  return './mvnw';\n}\n\nfunction getMavenPaths(packageFileName: string): MavenWrapperPaths {\n  const wrapperExecutableFileName = mavenWrapperFileName();\n  const localProjectDir = upath.join(\n    upath.dirname(packageFileName),\n    packageFileName.includes('mvnw') ? '.' : '../../',\n  );\n  const wrapperFullyQualifiedPath = upath.join(\n    localProjectDir,\n    wrapperExecutableFileName,\n  );\n  return {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  };\n}\n\nasync function prepareCommand(\n  fileName: string,\n  cwd: string | undefined,\n  pathFileStats: Stats | null,\n  args: string | null,\n): Promise<string | null> {\n  /* v8 ignore next -- hard to test */\n  if (pathFileStats?.isFile() === true) {\n    // if the file is not executable by others\n    if (os.platform() !== 'win32' && (pathFileStats.mode & 0o1) === 0) {\n      // add the execution permission to the owner, group and others\n      logger.warn('Maven wrapper is missing the executable bit');\n      await chmodLocalFile(\n        // TODO: types (#22198)\n        upath.join(cwd!, fileName),\n        pathFileStats.mode | 0o111,\n      );\n    }\n    if (args === null) {\n      return fileName;\n    }\n    return `${fileName} ${args}`;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,MAAM,OAAO,IAAI,KAAK,eAAe;AACrC,MAAM,yBAAyB;AAE/B,SAAS,mBAAmB,KAA8B;CACxD,OAAO,UACL;EACE,WAAW;EACX,KAAK;EACL,YAAY;CACd,SACM,WAAW,KAAK,OAAO,GAAG,GAAG,QAAQ,CAC7C;AACF;AAEA,SAAS,mBAAmB,SAAgC;CAI1D,OAHc,MAAM,iDAAiD,CAAC,CAAC,KACrE,OAGI,CAAC,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAE1E;AAEA,SAAS,cAAc,SAAgC;CAErD,OADc,MAAM,uCAAuC,CAAC,CAAC,KAAK,OACvD,CAAC,EAAE,QAAQ,YAAY,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAC1E;AAEA,SAAS,oBACP,SACA,UAAkB,wBACV;CACR,OAAO,GAAG,QAAQ,0CAA0C,QAAQ,iBAAiB,QAAQ;AAC/F;AAEA,SAAS,kBAAkB,SAAgC;CAIzD,OAHc,MAAM,+CAA+C,CAAC,CAAC,KACnE,OAES,CAAC,EAAE,QAAQ,gBAAgB,KAAK,KAAK;AAClD;AAEA,SAAS,oBAAoB,SAAgC;CAI3D,OAHc,MAAM,mDAAmD,CAAC,CAAC,KACvE,OAES,CAAC,EAAE,QAAQ,kBAAkB,KAAK,KAAK;AACpD;AAEA,SAAS,iBAAiB,SAAiB,KAA4B;CAErE,OADc,MAAM,IAAI,IAAI,yBAAyB,GAAG,CAAC,CAAC,KAAK,OACpD,CAAC,EAAE,QAAQ,OAAO,KAAK,KAAK;AACzC;AAEA,SAAS,qBACP,SACA,WACA,KACA,OACQ;CACR,OAAO,QAAQ,QACb,MAAM,SAAS,IACd,cAAc,GAAG,UAAU,IAAI,IAAI,GAAG,OACzC;AACF;AAEA,eAAe,gBACb,SACA,aACA,yBACA,oBACA,iBACiB;CACjB,IAAI,iBAAiB;CAGrB,IAAI,yBAAyB;EAC3B,MAAM,mBAAmB,iBACvB,gBACA,uBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,uBACF;EACA,MAAM,UAAU,mBAAmB,cAAc;EACjD,IAAI,SACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,OAAO;GACjD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B;QAGA,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAQ,GACpB,uCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,gBACF;EAEJ;CAEJ;CAGA,IAAI,oBAAoB;EACtB,MAAM,mBAAmB,iBACvB,gBACA,kBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,kBACF;EACA,IAAI,aAAa,cAAc,cAAc;EAG7C,IAAI,CAAC,YAAY;GACf,MAAM,iBAAiB,kBAAkB,cAAc;GACvD,IAAI,gBAEF,aAAa,oBACX,gBAFoB,6BAA6B,WAGrC,KAAK,sBACnB;EAEJ;EAEA,IAAI,YACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,UAAU;GACpD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,qBAAqB,GAC3B,oBAAoB,UACtB;QAGA,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAW,GACvB,kCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,gBACF;EAEJ;CAEJ;CAEA,OAAO;AACT;AAQA,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAE/D,MAAM,iBAAiB,YAAY,MAAM,QAAQ,IAAI,YAAY,OAAO;EACxE,MAAM,mBAAmB,YAAY,MAClC,QAAQ,IAAI,YAAY,eAC3B;EAEA,MAAM,0BAA0B,sBAAsB,SACpD,wBACF;EACA,MAAM,qBACJ,sBAAsB,SAAS,mBAAmB;EACpD,MAAM,2BAA2B,oBAAoB,qBAAqB;EAG1E,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,0BAA0B;GACrE,OAAO,MACL,+EACF;GACA,OAAO;EACT;EAGA,IAAI,MAAqB;EACzB,IAAI,kBAAkB;GACpB,MAAM,MAAM,qBACV,iBACA,wBACF;GAEA,IAAI,CAAC,KAAK;IACR,OAAO,KAAK,2CAA2C;IACvD,OAAO;GACT;EACF;EAIA,IAAI,qBAAqB,sBAAsB,0BAA0B;GACvE,MAAM,UAAU,gBAAgB,QAC9B,4BACA,mBACF;GACA,IAAI,QAAQ,SAAS,mBAAmB,GACtC,IAAI;IACF,MAAM,gBAAgB,OAAO;IAC7B,OAAO,MAAM,EAAE,QAAQ,GAAG,+BAA+B;GAC3D,QAAQ,CAER;EAEJ;EAIA,IAAI,iBAAiB;EACrB,IAAI,qBAAqB,sBAAsB,0BAC7C,iBAAiB,eACd,QAAQ,MAAM,+BAA+B,GAAG,EAAE,CAAC,CACnD,QAAQ,MAAM,0BAA0B,GAAG,EAAE;EAIlD,MAAM,eAAe,iBAAiB,cAAc;EAGpD,IAAI,oBAAoB,KAAK;GAC3B,MAAM,WAAW,mBAAmB,WAAW;GAC/C,MAAM,sBAAsB,KAAK,QAAQ,iBAAiB,QAAQ;EACpE;EAIA,IAAI,2BAA2B,oBAAoB;GACjD,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM;GAClE,IAAI,gBAAgB;IAClB,MAAM,uBAAuB,MAAM,gBACjC,gBACA,aACA,yBACA,oBACA,qBACF;IACA,MAAM,eAAe,iBAAiB,oBAAoB;GAC5D;EACF;EAcA,MAAM,yBACJ,MAAM,oBAAoB,MAbP,cAAc,GACT;GACxB;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KACC,aACC,gBAAgB,QAAQ,yCAAyC,EAAE,IACnE,QAGgD,CAAC,EAAA,CACnD,OAAO,QAAQ;EAEjB,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,uCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,eAAe,oBACb,QACA,mBACkC;CAClC,MAAM,iBAA0C,CAAC;CACjD,KAAK,MAAM,oBAAoB,mBAAmB;EAChD,MAAM,gBAAgB,MAAM,aAAa,QAAQ,gBAAgB;EACjE,IAAI,kBAAkB,MACpB,eAAe,KAAK,aAAa;CAErC;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,kBACd,qBACe;CACf,MAAM,QAAQ,sBACVA,IAAgB,SAAS,mBAAmB,IAC5C;CAEJ,IAAI,SAAS,SAAS,GACpB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,sBACb,KACA,QACA,iBACA,UACe;CACf,OAAO,MAAM,4BAA4B,IAAI,EAAE;CAC/C,MAAM,EAAE,8BAA8B,cAAc,eAAe;CAEnE,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT;EACA,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,cAC9C,kBAAkB,OAAO,YAAY,CACvC;EACF,CACF;CACF;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;CAC7B,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,MAAM;CACR;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,MAAM,WAAqB,CAAC;CAE5B,MAAM,wBAAwB,6BAA6B,IAAI;CAC/D,IAAI,uBAAuB;EACzB,SAAS,eAAe;EAExB,MAAM,EAAE,UAAU,aAAaC,KAAe;GAC5C,UAAU,gBAAgB;GAC1B,KAAK;EACP,CAAC;EAED,IAAI,YAAY,UAAU;GACxB,SAAS,gBAAgB;GACzB,SAAS,gBAAgB;GACzB,OAAO,MACL,EAAE,sBAAsB,GACxB,8DACF;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAS,6BACP,MACe;CACf,MAAM,gBAAgB,KAAK,MACxB,QAAQ,IAAI,YAAY,eAC3B,CAAC,EAAE;CAEH,IAAI,CAAC,eACH,OAAO;CAGT,MAAM,QAAQ,MAAM,iDAAiD,CAAC,CAAC,KACrE,aACF;CAEA,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,MAAM,OAAQ,YAAY,yBAC7B,OACA,MAAM,OAAQ;AACpB;AAEA,eAAe,qBACb,iBACA,kBACwB;CACxB,MAAM,EACJ,2BACA,iBACA,8BACE,cAAc,eAAe;CAKjC,MAAM,OAAO,0BAA0B,MAD1B,oBAAoB,QACgB;CAEjD,OAAO,MAAM,eACX,2BACA,iBACA,MAAM,cAAc,yBAAyB,GAC7C,IACF;AACF;AAEA,SAAS,uBAA+B;CACtC,IACE,GAAG,SAAS,MAAM,WAClB,aAAa,IAAI,cAAc,MAAM,UAErC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,cAAc,iBAA4C;CACjE,MAAM,4BAA4B,qBAAqB;CACvD,MAAM,kBAAkB,MAAM,KAC5B,MAAM,QAAQ,eAAe,GAC7B,gBAAgB,SAAS,MAAM,IAAI,MAAM,QAC3C;CAKA,OAAO;EACL;EACA;EACA,2BAPgC,MAAM,KACtC,iBACA,yBAKwB;CAC1B;AACF;AAEA,eAAe,eACb,UACA,KACA,eACA,MACwB;;CAExB,IAAI,eAAe,OAAO,MAAM,MAAM;EAEpC,IAAI,GAAG,SAAS,MAAM,YAAY,cAAc,OAAO,OAAS,GAAG;GAEjE,OAAO,KAAK,6CAA6C;GACzD,MAAM,eAEJ,MAAM,KAAK,KAAM,QAAQ,GACzB,cAAc,OAAO,EACvB;EACF;EACA,IAAI,SAAS,MACX,OAAO;EAET,OAAO,GAAG,SAAS,GAAG;CACxB;CACA,OAAO;AACT"}
+{"version":3,"file":"artifacts.js","names":["mavenVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/maven-wrapper/artifacts.ts"],"sourcesContent":["import type { Stats } from 'node:fs';\nimport os from 'node:os';\nimport { isTruthy } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { withCache } from '../../../util/cache/package/with-cache.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type { ExecOptions, ExtraEnv } from '../../../util/exec/types.ts';\nimport {\n  chmodLocalFile,\n  deleteLocalFile,\n  readLocalFile,\n  statLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport type { StatusResult } from '../../../util/git/types.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { MavenDatasource } from '../../datasource/maven/index.ts';\nimport mavenVersioning from '../../versioning/maven/index.ts';\nimport type {\n  PackageDependency,\n  UpdateArtifact,\n  UpdateArtifactsConfig,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport { resolveToolConstraint } from '../util.ts';\n\nconst http = new Http('maven-wrapper');\nconst DEFAULT_MAVEN_REPO_URL = 'https://repo.maven.apache.org/maven2';\n\nfunction getChecksumFromUrl(url: string): Promise<string> {\n  return withCache(\n    {\n      namespace: 'url-sha256',\n      key: url,\n      ttlMinutes: 3 * 24 * 60, // 3 days\n    },\n    () => hashStream(http.stream(url), 'sha256'),\n  );\n}\n\nfunction getDistributionUrl(content: string): string | null {\n  const match = regEx(/^distributionUrl\\s*=\\s*(?<distributionUrl>.+)$/m).exec(\n    content,\n  );\n  return (\n    match?.groups?.distributionUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null\n  );\n}\n\nfunction getWrapperUrl(content: string): string | null {\n  const match = regEx(/^wrapperUrl\\s*=\\s*(?<wrapperUrl>.+)$/m).exec(content);\n  return match?.groups?.wrapperUrl?.replace(regEx(/\\\\:/g), ':').trim() ?? null;\n}\n\nfunction constructWrapperUrl(\n  version: string,\n  repoUrl: string = DEFAULT_MAVEN_REPO_URL,\n): string {\n  return `${repoUrl}/org/apache/maven/wrapper/maven-wrapper/${version}/maven-wrapper-${version}.jar`;\n}\n\nfunction getWrapperVersion(content: string): string | null {\n  const match = regEx(/^wrapperVersion\\s*=\\s*(?<wrapperVersion>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.wrapperVersion?.trim() ?? null;\n}\n\nfunction getDistributionType(content: string): string | null {\n  const match = regEx(/^distributionType\\s*=\\s*(?<distributionType>.+)$/m).exec(\n    content,\n  );\n  return match?.groups?.distributionType?.trim() ?? null;\n}\n\nfunction getChecksumValue(content: string, key: string): string | null {\n  const match = regEx(`^${key}\\\\s*=\\\\s*(?<value>.+)$`, 'm').exec(content);\n  return match?.groups?.value?.trim() ?? null;\n}\n\nfunction addChecksumAfterLine(\n  content: string,\n  lineRegex: RegExp,\n  key: string,\n  value: string,\n): string {\n  return content.replace(\n    regEx(lineRegex),\n    (lineMatch) => `${lineMatch}\\n${key}=${value}`,\n  );\n}\n\nasync function updateChecksums(\n  content: string,\n  updatedDeps: PackageDependency[],\n  addDistributionChecksum: boolean,\n  addWrapperChecksum: boolean,\n  originalContent: string,\n): Promise<string> {\n  let updatedContent = content;\n\n  // Update or add distribution checksum\n  if (addDistributionChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'distributionSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'distributionSha256Sum',\n    );\n    const distUrl = getDistributionUrl(updatedContent);\n    if (distUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(distUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/distributionSha256Sum=.*/),\n            `distributionSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after distributionUrl\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: distUrl },\n          'Failed to fetch distribution checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:distributionUrl\\s*=\\s*.+)$/m),\n            'distributionSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  // Update or add wrapper checksum\n  if (addWrapperChecksum) {\n    const existingChecksum = getChecksumValue(\n      updatedContent,\n      'wrapperSha256Sum',\n    );\n    const fallbackChecksum = getChecksumValue(\n      originalContent,\n      'wrapperSha256Sum',\n    );\n    let wrapperUrl = getWrapperUrl(updatedContent);\n\n    // If no wrapperUrl, try to construct from wrapperVersion\n    if (!wrapperUrl) {\n      const wrapperVersion = getWrapperVersion(updatedContent);\n      if (wrapperVersion) {\n        const customRepoUrl = getCustomMavenWrapperRepoUrl(updatedDeps);\n        wrapperUrl = constructWrapperUrl(\n          wrapperVersion,\n          customRepoUrl ?? DEFAULT_MAVEN_REPO_URL,\n        );\n      }\n    }\n\n    if (wrapperUrl) {\n      try {\n        const checksum = await getChecksumFromUrl(wrapperUrl);\n        if (existingChecksum) {\n          updatedContent = updatedContent.replace(\n            regEx(/wrapperSha256Sum=.*/),\n            `wrapperSha256Sum=${checksum}`,\n          );\n        } else {\n          // Add checksum after wrapperUrl or wrapperVersion\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            checksum,\n          );\n        }\n      } catch (err) {\n        logger.warn(\n          { err, url: wrapperUrl },\n          'Failed to fetch wrapper checksum',\n        );\n        if (!existingChecksum && fallbackChecksum) {\n          updatedContent = addChecksumAfterLine(\n            updatedContent,\n            regEx(/^(?:wrapperUrl\\s*=\\s*.+|wrapperVersion\\s*=\\s*.+)$/m),\n            'wrapperSha256Sum',\n            fallbackChecksum,\n          );\n        }\n      }\n    }\n  }\n\n  return updatedContent;\n}\n\ninterface MavenWrapperPaths {\n  wrapperExecutableFileName: string;\n  localProjectDir: string;\n  wrapperFullyQualifiedPath: string;\n}\n\nasync function addIfUpdated(\n  status: StatusResult,\n  fileProjectPath: string,\n): Promise<UpdateArtifactsResult | null> {\n  if (status.modified.includes(fileProjectPath)) {\n    return {\n      file: {\n        type: 'addition',\n        path: fileProjectPath,\n        contents: await readLocalFile(fileProjectPath),\n      },\n    };\n  }\n  return null;\n}\n\nexport async function updateArtifacts({\n  packageFileName,\n  newPackageFileContent,\n  updatedDeps,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  try {\n    logger.debug({ updatedDeps }, 'maven-wrapper.updateArtifacts()');\n\n    const hasMavenUpdate = updatedDeps.some((dep) => dep.depName === 'maven');\n    const hasWrapperUpdate = updatedDeps.some(\n      (dep) => dep.depName === 'maven-wrapper',\n    );\n    // Remember original content properties - we'll restore them after wrapper:wrapper\n    const hadDistributionChecksum = newPackageFileContent.includes(\n      'distributionSha256Sum=',\n    );\n    const hadWrapperChecksum =\n      newPackageFileContent.includes('wrapperSha256Sum=');\n    const hadAnyChecksum = hadWrapperChecksum || hadDistributionChecksum;\n    const originalDistributionType = getDistributionType(newPackageFileContent);\n\n    // Skip if no relevant updates\n    if (!hasWrapperUpdate && !(hasMavenUpdate && hadDistributionChecksum)) {\n      logger.debug(\n        'No Maven wrapper or distribution checksum updates - skipping Artifacts update',\n      );\n      return null;\n    }\n\n    // If wrapper is being updated, check if mvnw exists first\n    let cmd: string | null = null;\n    if (hasWrapperUpdate) {\n      cmd = await createWrapperCommand(\n        packageFileName,\n        originalDistributionType,\n      );\n\n      if (!cmd) {\n        logger.info('No mvnw found - skipping Artifacts update');\n        return null;\n      }\n    }\n\n    // Delete old maven-wrapper.jar if checksums exist and wrapper:wrapper will run\n    // This prevents checksum validation failure when wrapper:wrapper runs\n    if (hasWrapperUpdate && hadAnyChecksum) {\n      const jarPath = packageFileName.replace(\n        'maven-wrapper.properties',\n        'maven-wrapper.jar',\n      );\n      if (jarPath.endsWith('maven-wrapper.jar')) {\n        try {\n          await deleteLocalFile(jarPath);\n          logger.debug({ jarPath }, 'Deleted old maven-wrapper.jar');\n        } catch {\n          // File may not exist, ignore\n        }\n      }\n    }\n\n    // Strip checksum lines before running wrapper:wrapper to avoid validation failure\n    // (mvnw would try to validate NEW jar against OLD checksum)\n    let contentToWrite = newPackageFileContent;\n    if (hasWrapperUpdate && hadAnyChecksum) {\n      contentToWrite = contentToWrite\n        .replace(regEx(/^distributionSha256Sum=.*\\n?/m), '')\n        .replace(regEx(/^wrapperSha256Sum=.*\\n?/m), '');\n    }\n\n    // Write the properties file\n    await writeLocalFile(packageFileName, contentToWrite);\n\n    // Run wrapper:wrapper if the wrapper itself is being updated\n    if (hasWrapperUpdate && cmd) {\n      const extraEnv = getExtraEnvOptions(updatedDeps);\n      await executeWrapperCommand(cmd, config, packageFileName, extraEnv);\n    }\n\n    // Now update checksums AFTER wrapper:wrapper has run (if it ran)\n    // This ensures we compute checksums for the actual generated content\n    if (hadDistributionChecksum || hadWrapperChecksum) {\n      const currentContent = await readLocalFile(packageFileName, 'utf8');\n      if (currentContent) {\n        const contentWithChecksums = await updateChecksums(\n          currentContent,\n          updatedDeps,\n          hadDistributionChecksum,\n          hadWrapperChecksum,\n          newPackageFileContent,\n        );\n        await writeLocalFile(packageFileName, contentWithChecksums);\n      }\n    }\n\n    const status = await getRepoStatus();\n    const artifactFileNames = [\n      '.mvn/wrapper/maven-wrapper.properties',\n      '.mvn/wrapper/maven-wrapper.jar',\n      '.mvn/wrapper/MavenWrapperDownloader.java',\n      'mvnw',\n      'mvnw.cmd',\n    ].map(\n      (filename) =>\n        packageFileName.replace('.mvn/wrapper/maven-wrapper.properties', '') +\n        filename,\n    );\n    const updateArtifactsResult = (\n      await getUpdatedArtifacts(status, artifactFileNames)\n    ).filter(isTruthy);\n\n    logger.debug(\n      { files: updateArtifactsResult.map((r) => r.file?.path) },\n      `Returning updated maven-wrapper files`,\n    );\n    return updateArtifactsResult;\n  } catch (err) {\n    logger.debug({ err }, 'Error setting new Maven Wrapper release value');\n    return [\n      {\n        artifactError: {\n          fileName: packageFileName,\n          stderr: err.message,\n        },\n      },\n    ];\n  }\n}\n\nasync function getUpdatedArtifacts(\n  status: StatusResult,\n  artifactFileNames: string[],\n): Promise<UpdateArtifactsResult[]> {\n  const updatedResults: UpdateArtifactsResult[] = [];\n  for (const artifactFileName of artifactFileNames) {\n    const updatedResult = await addIfUpdated(status, artifactFileName);\n    if (updatedResult !== null) {\n      updatedResults.push(updatedResult);\n    }\n  }\n  return updatedResults;\n}\n\n/**\n * Find compatible java version for maven.\n * see https://maven.apache.org/developers/compatibility-plan.html\n * @param mavenWrapperVersion current maven version\n * @returns A Java semver range\n */\nexport function getJavaConstraint(\n  mavenWrapperVersion: string | null | undefined,\n): string | null {\n  const major = mavenWrapperVersion\n    ? mavenVersioning.getMajor(mavenWrapperVersion)\n    : null;\n\n  if (major && major >= 3) {\n    return '^17.0.0';\n  }\n\n  return '^8.0.0';\n}\n\nasync function executeWrapperCommand(\n  cmd: string,\n  config: UpdateArtifactsConfig,\n  packageFileName: string,\n  extraEnv: ExtraEnv,\n): Promise<void> {\n  logger.debug(`Updating maven wrapper: \"${cmd}\"`);\n  const { wrapperFullyQualifiedPath } = getMavenPaths(packageFileName);\n\n  const execOptions: ExecOptions = {\n    cwdFile: wrapperFullyQualifiedPath,\n    docker: {},\n    extraEnv,\n    toolConstraints: [\n      {\n        toolName: 'java',\n        constraint: await resolveToolConstraint(config, 'java', () =>\n          getJavaConstraint(config.currentValue),\n        ),\n      },\n    ],\n  };\n\n  try {\n    await exec(cmd, execOptions);\n  } catch (err) {\n    logger.error({ err }, 'Error executing maven wrapper update command.');\n    throw err;\n  }\n}\n\nfunction getExtraEnvOptions(deps: PackageDependency[]): ExtraEnv {\n  const extraEnv: ExtraEnv = {};\n\n  const customMavenWrapperUrl = getCustomMavenWrapperRepoUrl(deps);\n  if (customMavenWrapperUrl) {\n    extraEnv.MVNW_REPOURL = customMavenWrapperUrl;\n\n    const { username, password } = hostRules.find({\n      hostType: MavenDatasource.id,\n      url: customMavenWrapperUrl,\n    });\n\n    if (username && password) {\n      extraEnv.MVNW_USERNAME = username;\n      extraEnv.MVNW_PASSWORD = password;\n      logger.trace(\n        { customMavenWrapperUrl },\n        'Using MVNW_USERNAME and MVNW_PASSWORD for private repository',\n      );\n    }\n  }\n\n  return extraEnv;\n}\n\nfunction getCustomMavenWrapperRepoUrl(\n  deps: PackageDependency[],\n): string | null {\n  const replaceString = deps.find(\n    (dep) => dep.depName === 'maven-wrapper',\n  )?.replaceString;\n\n  if (!replaceString) {\n    return null;\n  }\n\n  const match = regEx(/^(?<repoUrl>.*?)\\/org\\/apache\\/maven\\/wrapper\\//).exec(\n    replaceString,\n  );\n\n  if (!match) {\n    return null;\n  }\n\n  return match.groups!.repoUrl === DEFAULT_MAVEN_REPO_URL\n    ? null\n    : match.groups!.repoUrl;\n}\n\nasync function createWrapperCommand(\n  packageFileName: string,\n  distributionType: string | null,\n): Promise<string | null> {\n  const {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  } = getMavenPaths(packageFileName);\n\n  // Use existing distributionType or default to 'script' to preserve JAR-based mode\n  // (prevents Maven 3.3.x from defaulting to only-script which doesn't support checksums)\n  const type = distributionType ?? 'script';\n  const args = `wrapper:wrapper -Dtype=${quote(type)}`;\n\n  return await prepareCommand(\n    wrapperExecutableFileName,\n    localProjectDir,\n    await statLocalFile(wrapperFullyQualifiedPath),\n    args,\n  );\n}\n\nfunction mavenWrapperFileName(): string {\n  if (\n    os.platform() === 'win32' &&\n    GlobalConfig.get('binarySource') !== 'docker'\n  ) {\n    return 'mvnw.cmd';\n  }\n  return './mvnw';\n}\n\nfunction getMavenPaths(packageFileName: string): MavenWrapperPaths {\n  const wrapperExecutableFileName = mavenWrapperFileName();\n  const localProjectDir = upath.join(\n    upath.dirname(packageFileName),\n    packageFileName.includes('mvnw') ? '.' : '../../',\n  );\n  const wrapperFullyQualifiedPath = upath.join(\n    localProjectDir,\n    wrapperExecutableFileName,\n  );\n  return {\n    wrapperExecutableFileName,\n    localProjectDir,\n    wrapperFullyQualifiedPath,\n  };\n}\n\nasync function prepareCommand(\n  fileName: string,\n  cwd: string | undefined,\n  pathFileStats: Stats | null,\n  args: string | null,\n): Promise<string | null> {\n  /* v8 ignore next -- hard to test */\n  if (pathFileStats?.isFile() === true) {\n    // if the file is not executable by others\n    if (os.platform() !== 'win32' && (pathFileStats.mode & 0o1) === 0) {\n      // add the execution permission to the owner, group and others\n      logger.warn('Maven wrapper is missing the executable bit');\n      await chmodLocalFile(\n        // TODO: types (#22198)\n        upath.join(cwd!, fileName),\n        pathFileStats.mode | 0o111,\n      );\n    }\n    if (args === null) {\n      return fileName;\n    }\n    return `${fileName} ${args}`;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiCA,MAAM,OAAO,IAAI,KAAK,eAAe;AACrC,MAAM,yBAAyB;AAE/B,SAAS,mBAAmB,KAA8B;CACxD,OAAO,UACL;EACE,WAAW;EACX,KAAK;EACL,YAAY;CACd,SACM,WAAW,KAAK,OAAO,GAAG,GAAG,QAAQ,CAC7C;AACF;AAEA,SAAS,mBAAmB,SAAgC;CAI1D,OAHc,MAAM,iDAAiD,CAAC,CAAC,KACrE,OAGI,CAAC,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAE1E;AAEA,SAAS,cAAc,SAAgC;CAErD,OADc,MAAM,uCAAuC,CAAC,CAAC,KAAK,OACvD,CAAC,EAAE,QAAQ,YAAY,QAAQ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK;AAC1E;AAEA,SAAS,oBACP,SACA,UAAkB,wBACV;CACR,OAAO,GAAG,QAAQ,0CAA0C,QAAQ,iBAAiB,QAAQ;AAC/F;AAEA,SAAS,kBAAkB,SAAgC;CAIzD,OAHc,MAAM,+CAA+C,CAAC,CAAC,KACnE,OAES,CAAC,EAAE,QAAQ,gBAAgB,KAAK,KAAK;AAClD;AAEA,SAAS,oBAAoB,SAAgC;CAI3D,OAHc,MAAM,mDAAmD,CAAC,CAAC,KACvE,OAES,CAAC,EAAE,QAAQ,kBAAkB,KAAK,KAAK;AACpD;AAEA,SAAS,iBAAiB,SAAiB,KAA4B;CAErE,OADc,MAAM,IAAI,IAAI,yBAAyB,GAAG,CAAC,CAAC,KAAK,OACpD,CAAC,EAAE,QAAQ,OAAO,KAAK,KAAK;AACzC;AAEA,SAAS,qBACP,SACA,WACA,KACA,OACQ;CACR,OAAO,QAAQ,QACb,MAAM,SAAS,IACd,cAAc,GAAG,UAAU,IAAI,IAAI,GAAG,OACzC;AACF;AAEA,eAAe,gBACb,SACA,aACA,yBACA,oBACA,iBACiB;CACjB,IAAI,iBAAiB;CAGrB,IAAI,yBAAyB;EAC3B,MAAM,mBAAmB,iBACvB,gBACA,uBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,uBACF;EACA,MAAM,UAAU,mBAAmB,cAAc;EACjD,IAAI,SACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,OAAO;GACjD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,0BAA0B,GAChC,yBAAyB,UAC3B;QAGA,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAQ,GACpB,uCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,iCAAiC,GACvC,yBACA,gBACF;EAEJ;CAEJ;CAGA,IAAI,oBAAoB;EACtB,MAAM,mBAAmB,iBACvB,gBACA,kBACF;EACA,MAAM,mBAAmB,iBACvB,iBACA,kBACF;EACA,IAAI,aAAa,cAAc,cAAc;EAG7C,IAAI,CAAC,YAAY;GACf,MAAM,iBAAiB,kBAAkB,cAAc;GACvD,IAAI,gBAEF,aAAa,oBACX,gBAFoB,6BAA6B,WAGrC,KAAK,sBACnB;EAEJ;EAEA,IAAI,YACF,IAAI;GACF,MAAM,WAAW,MAAM,mBAAmB,UAAU;GACpD,IAAI,kBACF,iBAAiB,eAAe,QAC9B,MAAM,qBAAqB,GAC3B,oBAAoB,UACtB;QAGA,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,QACF;EAEJ,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK,KAAK;GAAW,GACvB,kCACF;GACA,IAAI,CAAC,oBAAoB,kBACvB,iBAAiB,qBACf,gBACA,MAAM,oDAAoD,GAC1D,oBACA,gBACF;EAEJ;CAEJ;CAEA,OAAO;AACT;AAQA,eAAe,aACb,QACA,iBACuC;CACvC,IAAI,OAAO,SAAS,SAAS,eAAe,GAC1C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU,MAAM,cAAc,eAAe;CAC/C,EACF;CAEF,OAAO;AACT;AAEA,eAAsB,gBAAgB,EACpC,iBACA,uBACA,aACA,UAC0D;CAC1D,IAAI;EACF,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAE/D,MAAM,iBAAiB,YAAY,MAAM,QAAQ,IAAI,YAAY,OAAO;EACxE,MAAM,mBAAmB,YAAY,MAClC,QAAQ,IAAI,YAAY,eAC3B;EAEA,MAAM,0BAA0B,sBAAsB,SACpD,wBACF;EACA,MAAM,qBACJ,sBAAsB,SAAS,mBAAmB;EACpD,MAAM,iBAAiB,sBAAsB;EAC7C,MAAM,2BAA2B,oBAAoB,qBAAqB;EAG1E,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,0BAA0B;GACrE,OAAO,MACL,+EACF;GACA,OAAO;EACT;EAGA,IAAI,MAAqB;EACzB,IAAI,kBAAkB;GACpB,MAAM,MAAM,qBACV,iBACA,wBACF;GAEA,IAAI,CAAC,KAAK;IACR,OAAO,KAAK,2CAA2C;IACvD,OAAO;GACT;EACF;EAIA,IAAI,oBAAoB,gBAAgB;GACtC,MAAM,UAAU,gBAAgB,QAC9B,4BACA,mBACF;GACA,IAAI,QAAQ,SAAS,mBAAmB,GACtC,IAAI;IACF,MAAM,gBAAgB,OAAO;IAC7B,OAAO,MAAM,EAAE,QAAQ,GAAG,+BAA+B;GAC3D,QAAQ,CAER;EAEJ;EAIA,IAAI,iBAAiB;EACrB,IAAI,oBAAoB,gBACtB,iBAAiB,eACd,QAAQ,MAAM,+BAA+B,GAAG,EAAE,CAAC,CACnD,QAAQ,MAAM,0BAA0B,GAAG,EAAE;EAIlD,MAAM,eAAe,iBAAiB,cAAc;EAGpD,IAAI,oBAAoB,KAAK;GAC3B,MAAM,WAAW,mBAAmB,WAAW;GAC/C,MAAM,sBAAsB,KAAK,QAAQ,iBAAiB,QAAQ;EACpE;EAIA,IAAI,2BAA2B,oBAAoB;GACjD,MAAM,iBAAiB,MAAM,cAAc,iBAAiB,MAAM;GAClE,IAAI,gBAAgB;IAClB,MAAM,uBAAuB,MAAM,gBACjC,gBACA,aACA,yBACA,oBACA,qBACF;IACA,MAAM,eAAe,iBAAiB,oBAAoB;GAC5D;EACF;EAcA,MAAM,yBACJ,MAAM,oBAAoB,MAbP,cAAc,GACT;GACxB;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KACC,aACC,gBAAgB,QAAQ,yCAAyC,EAAE,IACnE,QAGgD,CAAC,EAAA,CACnD,OAAO,QAAQ;EAEjB,OAAO,MACL,EAAE,OAAO,sBAAsB,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,GACxD,uCACF;EACA,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,OAAO,CACL,EACE,eAAe;GACb,UAAU;GACV,QAAQ,IAAI;EACd,EACF,CACF;CACF;AACF;AAEA,eAAe,oBACb,QACA,mBACkC;CAClC,MAAM,iBAA0C,CAAC;CACjD,KAAK,MAAM,oBAAoB,mBAAmB;EAChD,MAAM,gBAAgB,MAAM,aAAa,QAAQ,gBAAgB;EACjE,IAAI,kBAAkB,MACpB,eAAe,KAAK,aAAa;CAErC;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,kBACd,qBACe;CACf,MAAM,QAAQ,sBACVA,IAAgB,SAAS,mBAAmB,IAC5C;CAEJ,IAAI,SAAS,SAAS,GACpB,OAAO;CAGT,OAAO;AACT;AAEA,eAAe,sBACb,KACA,QACA,iBACA,UACe;CACf,OAAO,MAAM,4BAA4B,IAAI,EAAE;CAC/C,MAAM,EAAE,8BAA8B,cAAc,eAAe;CAEnE,MAAM,cAA2B;EAC/B,SAAS;EACT,QAAQ,CAAC;EACT;EACA,iBAAiB,CACf;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,cAC9C,kBAAkB,OAAO,YAAY,CACvC;EACF,CACF;CACF;CAEA,IAAI;EACF,MAAM,KAAK,KAAK,WAAW;CAC7B,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;EACrE,MAAM;CACR;AACF;AAEA,SAAS,mBAAmB,MAAqC;CAC/D,MAAM,WAAqB,CAAC;CAE5B,MAAM,wBAAwB,6BAA6B,IAAI;CAC/D,IAAI,uBAAuB;EACzB,SAAS,eAAe;EAExB,MAAM,EAAE,UAAU,aAAaC,KAAe;GAC5C,UAAU,gBAAgB;GAC1B,KAAK;EACP,CAAC;EAED,IAAI,YAAY,UAAU;GACxB,SAAS,gBAAgB;GACzB,SAAS,gBAAgB;GACzB,OAAO,MACL,EAAE,sBAAsB,GACxB,8DACF;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAS,6BACP,MACe;CACf,MAAM,gBAAgB,KAAK,MACxB,QAAQ,IAAI,YAAY,eAC3B,CAAC,EAAE;CAEH,IAAI,CAAC,eACH,OAAO;CAGT,MAAM,QAAQ,MAAM,iDAAiD,CAAC,CAAC,KACrE,aACF;CAEA,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,MAAM,OAAQ,YAAY,yBAC7B,OACA,MAAM,OAAQ;AACpB;AAEA,eAAe,qBACb,iBACA,kBACwB;CACxB,MAAM,EACJ,2BACA,iBACA,8BACE,cAAc,eAAe;CAKjC,MAAM,OAAO,0BAA0B,MAD1B,oBAAoB,QACgB;CAEjD,OAAO,MAAM,eACX,2BACA,iBACA,MAAM,cAAc,yBAAyB,GAC7C,IACF;AACF;AAEA,SAAS,uBAA+B;CACtC,IACE,GAAG,SAAS,MAAM,WAClB,aAAa,IAAI,cAAc,MAAM,UAErC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,cAAc,iBAA4C;CACjE,MAAM,4BAA4B,qBAAqB;CACvD,MAAM,kBAAkB,MAAM,KAC5B,MAAM,QAAQ,eAAe,GAC7B,gBAAgB,SAAS,MAAM,IAAI,MAAM,QAC3C;CAKA,OAAO;EACL;EACA;EACA,2BAPgC,MAAM,KACtC,iBACA,yBAKwB;CAC1B;AACF;AAEA,eAAe,eACb,UACA,KACA,eACA,MACwB;;CAExB,IAAI,eAAe,OAAO,MAAM,MAAM;EAEpC,IAAI,GAAG,SAAS,MAAM,YAAY,cAAc,OAAO,OAAS,GAAG;GAEjE,OAAO,KAAK,6CAA6C;GACzD,MAAM,eAEJ,MAAM,KAAK,KAAM,QAAQ,GACzB,cAAc,OAAO,EACvB;EACF;EACA,IAAI,SAAS,MACX,OAAO;EAET,OAAO,GAAG,SAAS,GAAG;CACxB;CACA,OAAO;AACT"}

package/dist/modules/manager/mise/artifacts.js

@@ -52,7 +52,8 @@ async function detectMiseVersion(execOptions) {
 }
 /** True when `version` is at or above the safe-mode / `--bump` release. */
 function versionSupportsSafeFeatures(version) {
-	return !!version && (api.equals(version, MISE_SAFE_MODE_MIN_VERSION) || api.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION));
+	if (!version) return false;
+	return api.equals(version, MISE_SAFE_MODE_MIN_VERSION) || api.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION);
 }
 /**
 * Resolver tools that mise may invoke while running `mise lock`, for instance to convert an inexact version like `1` against the npm registry.

package/dist/modules/manager/mise/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":["miseVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/mise/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type {\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../util/exec/types.ts';\nimport { readLocalFile, writeLocalFile } from '../../../util/fs/index.ts';\nimport { collectFileChanges } from '../../../util/git/file-changes.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { api as miseVersioning } from '../../versioning/semver/index.ts';\nimport type {\n  ToolConstraintsConfig,\n  UpdateArtifact,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport {\n  artifactErrorResult,\n  fileChangesToArtifactResults,\n  resolveToolConstraint,\n  updateLockFile,\n} from '../util.ts';\nimport { getConfigType, getLockFileName, getSidecarDir } from './lockfile.ts';\n\n/**\n * First mise release that supports the features this manager relies on:\n * `MISE_SAFE=1` safe mode (a hard boundary against project config executing\n * code during `mise lock`) and `mise lock --bump` (advancing fuzzy selectors).\n *\n * Safe mode (jdx/mise#11146) and lockfile bumping (jdx/mise#11145) merged after\n * v2026.7.11 and first shipped in v2026.7.12.\n *\n * @see https://github.com/jdx/mise/pull/11146\n * @see https://github.com/jdx/mise/pull/11145\n * @see https://mise.jdx.dev/configuration/settings.html#safe\n */\nconst MISE_SAFE_MODE_MIN_VERSION = '2026.7.12';\n\n/**\n * Detects the mise version that will actually run, by executing `mise version`.\n * `mise version` only prints the binary's version — it does not load or execute\n * project configuration — so it is safe to run even without allowlisting.\n *\n * Output looks like `2026.7.12 macos-arm64 (2026-07-21)`; we take the leading\n * `major.minor.patch`. Returns `null` if the probe fails or cannot be parsed,\n * in which case callers fall back to the conservative (pre-safe-mode) behavior.\n */\nasync function detectMiseVersion(\n  execOptions: ExecOptions,\n): Promise<string | null> {\n  try {\n    const { stdout } = await exec('mise version', execOptions);\n    const version = regEx(/\\d+\\.\\d+\\.\\d+/).exec(stdout)?.[0];\n    if (version && miseVersioning.isVersion(version)) {\n      return version;\n    }\n    logger.debug({ stdout }, 'Could not parse mise version output');\n    return null;\n  } catch (err) {\n    logger.debug({ err }, 'Failed to determine mise version');\n    return null;\n  }\n}\n\n/** True when `version` is at or above the safe-mode / `--bump` release. */\nfunction versionSupportsSafeFeatures(version: string | null): boolean {\n  return (\n    !!version &&\n    (miseVersioning.equals(version, MISE_SAFE_MODE_MIN_VERSION) ||\n      miseVersioning.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION))\n  );\n}\n\n/**\n * Resolver tools that mise may invoke while running `mise lock`, for instance to convert an inexact version like `1` against the npm registry.\n *\n * NOTE: this will install all relevant tools, regardless of what the given mise configuration uses.\n *\n * In safe mode these are unnecessary: npm version listing uses mise's built-in\n * registry HTTP client and go runs with `GOTOOLCHAIN=local`, so `mise lock`\n * resolves versions over HTTP without shelling out to node/npm/ruby.\n *\n * @see https://mise.jdx.dev/dev-tools/backends/npm.html\n * @see https://mise.jdx.dev/dev-tools/backends/go.html\n * @see https://mise.jdx.dev/dev-tools/backends/gem.html\n */\nasync function getMiseLockToolConstraints(\n  config: ToolConstraintsConfig,\n  miseConstraint: string | undefined,\n  safeMode = false,\n): Promise<ToolConstraint[]> {\n  const miseToolConstraint: ToolConstraint = {\n    toolName: 'mise',\n    constraint: miseConstraint,\n  };\n  if (safeMode) {\n    return [miseToolConstraint];\n  }\n  return [\n    miseToolConstraint,\n    {\n      toolName: 'node',\n      constraint: await resolveToolConstraint(config, 'node'),\n    },\n    {\n      toolName: 'npm',\n      constraint: await resolveToolConstraint(config, 'npm'),\n    },\n    {\n      // the golang tool is constrained by the `go` constraint\n      toolName: 'golang',\n      constraint: await resolveToolConstraint(config, 'go'),\n    },\n    {\n      toolName: 'ruby',\n      constraint: await resolveToolConstraint(config, 'ruby'),\n    },\n  ];\n}\n\n/**\n * Collects the native dependency sidecars which `mise lock` wrote beside the\n * lock file. The lock file records each sidecar's path and digest, so they\n * have to be committed together. A version change moves a sidecar to a new\n * directory, so this includes new untracked files and deleted ones.\n *\n * @see https://mise.jdx.dev/dev-tools/mise-lock.html#native-dependency-sidecars\n */\nasync function getSidecarChanges(\n  lockFileName: string,\n): Promise<UpdateArtifactsResult[]> {\n  const status = await getRepoStatus(getSidecarDir(lockFileName));\n  return fileChangesToArtifactResults(await collectFileChanges(status));\n}\n\n/**\n * Updates mise lock files when dependencies are updated.\n * Runs `mise lock` for lock file maintenance or `mise lock <tools>` for targeted updates.\n */\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  newLockFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = getLockFileName(packageFileName);\n  const originalLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  const currentLockFileContent = newLockFileContent ?? originalLockFileContent;\n  if (!currentLockFileContent) {\n    logger.debug({ lockFileName }, 'No mise lock file found');\n    return null;\n  }\n\n  // `mise lock` normally executes the project's mise config, so it requires\n  // `allowedUnsafeExecutions`. When the mise that will run supports safe mode,\n  // we instead run with `MISE_SAFE=1`, which is a hard boundary against the\n  // config executing code — so the allowlist is not required on that path.\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n  const miseAllowlisted = allowlist.includes('mise');\n\n  // The mise version is needed to decide safe mode (untrusted path) and\n  // `mise lock --bump` (lock file maintenance). Detect it at runtime rather\n  // than requiring a pinned `constraints.mise`. Skip the probe when it cannot\n  // change the outcome: an allowlisted, non-maintenance run behaves the same\n  // regardless of version.\n  const miseConstraint = await resolveToolConstraint(config, 'mise');\n  let miseSupportsSafeFeatures = false;\n  if (!miseAllowlisted || config.isLockFileMaintenance) {\n    const miseVersion = await detectMiseVersion({\n      cwdFile: packageFileName,\n      toolConstraints: [{ toolName: 'mise', constraint: miseConstraint }],\n      docker: {},\n    });\n    miseSupportsSafeFeatures = versionSupportsSafeFeatures(miseVersion);\n  }\n\n  const safeMode = !miseAllowlisted && miseSupportsSafeFeatures;\n  if (!miseAllowlisted && !safeMode) {\n    logger.once.warn(\n      { safeModeMinVersion: MISE_SAFE_MODE_MIN_VERSION },\n      '`mise lock` requires either `mise` in `allowedUnsafeExecutions`, or a mise version that supports safe mode',\n    );\n    return null;\n  }\n\n  const { isLocal, env } = getConfigType(packageFileName);\n  const localFlag = isLocal ? ' --local' : '';\n\n  let lockCmd: string;\n  if (config.isLockFileMaintenance) {\n    // Lock file maintenance means \"update to the latest versions\". Plain\n    // `mise lock` only refreshes metadata for already-locked versions, so use\n    // `mise lock --bump` to also advance fuzzy selectors (e.g. `node = \"22\"`)\n    // to the latest matching version. `--bump` requires a new enough mise, so\n    // fall back to a plain refresh when the version cannot be guaranteed.\n    const bumpFlag = miseSupportsSafeFeatures ? ' --bump' : '';\n    lockCmd = `mise lock${localFlag}${bumpFlag}`;\n  } else {\n    const tools = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map(quote)\n      .join(' ');\n    lockCmd = tools\n      ? `mise lock${localFlag} ${tools}`\n      : `mise lock${localFlag}`;\n  }\n\n  const extraEnv: ExtraEnv = {};\n  if (env) {\n    extraEnv.MISE_ENV = env;\n  }\n  if (safeMode) {\n    extraEnv.MISE_SAFE = '1';\n  }\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n  if (token) {\n    extraEnv.GITHUB_TOKEN = token;\n  }\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv,\n    toolConstraints: await getMiseLockToolConstraints(\n      config,\n      miseConstraint,\n      safeMode,\n    ),\n    docker: {},\n  };\n\n  // `mise trust` is only needed on the allowlisted path. In safe mode mise\n  // loads untrusted config without a trust prompt (the config is inert — it\n  // can neither execute code nor inject environment), so the trust step is\n  // unnecessary and is skipped.\n  const commands = safeMode\n    ? [lockCmd]\n    : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];\n\n  try {\n    if (newLockFileContent) {\n      await writeLocalFile(lockFileName, newLockFileContent);\n    }\n    const lockFileResults = await updateLockFile({\n      lockFileName,\n      existingLockFileContent: originalLockFileContent,\n      packageFile: { path: packageFileName, contents: newPackageFileContent },\n      run: () => exec(commands, execOptions),\n    });\n    const results = [\n      ...coerceArray(lockFileResults),\n      ...(await getSidecarChanges(lockFileName)),\n    ];\n    return results.length ? results : null;\n  } catch (err) {\n    /* v8 ignore if -- defensive rethrow, not worth testing */\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.warn({ err, lockFileName }, 'Error updating mise lock file');\n    return artifactErrorResult(lockFileName, err);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAM,6BAA6B;;;;;;;;;;AAWnC,eAAe,kBACb,aACwB;CACxB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,KAAK,gBAAgB,WAAW;EACzD,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG;EACtD,IAAI,WAAWA,IAAe,UAAU,OAAO,GAC7C,OAAO;EAET,OAAO,MAAM,EAAE,OAAO,GAAG,qCAAqC;EAC9D,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EACxD,OAAO;CACT;AACF;;AAGA,SAAS,4BAA4B,SAAiC;CACpE,OACE,CAAC,CAAC,YACDA,IAAe,OAAO,SAAS,0BAA0B,KACxDA,IAAe,cAAc,SAAS,0BAA0B;AAEtE;;;;;;;;;;;;;;AAeA,eAAe,2BACb,QACA,gBACA,WAAW,OACgB;CAC3B,MAAM,qBAAqC;EACzC,UAAU;EACV,YAAY;CACd;CACA,IAAI,UACF,OAAO,CAAC,kBAAkB;CAE5B,OAAO;EACL;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,KAAK;EACvD;EACA;GAEE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,IAAI;EACtD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;CACF;AACF;;;;;;;;;AAUA,eAAe,kBACb,cACkC;CAClC,MAAM,SAAS,MAAM,cAAc,cAAc,YAAY,CAAC;CAC9D,OAAO,6BAA6B,MAAM,mBAAmB,MAAM,CAAC;AACtE;;;;;AAMA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,oBACA,UAC0D;CAC1D,MAAM,eAAe,gBAAgB,eAAe;CACpD,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CAExE,IAAI,EAD2B,sBAAsB,0BACxB;EAC3B,OAAO,MAAM,EAAE,aAAa,GAAG,yBAAyB;EACxD,OAAO;CACT;CAOA,MAAM,kBADY,aAAa,IAAI,yBACH,CAAC,CAAC,SAAS,MAAM;CAOjD,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;CACjE,IAAI,2BAA2B;CAC/B,IAAI,CAAC,mBAAmB,OAAO,uBAM7B,2BAA2B,4BAA4B,MAL7B,kBAAkB;EAC1C,SAAS;EACT,iBAAiB,CAAC;GAAE,UAAU;GAAQ,YAAY;EAAe,CAAC;EAClE,QAAQ,CAAC;CACX,CAAC,CACiE;CAGpE,MAAM,WAAW,CAAC,mBAAmB;CACrC,IAAI,CAAC,mBAAmB,CAAC,UAAU;EACjC,OAAO,KAAK,KACV,EAAE,oBAAoB,2BAA2B,GACjD,4GACF;EACA,OAAO;CACT;CAEA,MAAM,EAAE,SAAS,QAAQ,cAAc,eAAe;CACtD,MAAM,YAAY,UAAU,aAAa;CAEzC,IAAI;CACJ,IAAI,OAAO,uBAOT,UAAU,YAAY,YADL,2BAA2B,YAAY;MAEnD;EACL,MAAM,QAAQ,YACX,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;EACX,UAAU,QACN,YAAY,UAAU,GAAG,UACzB,YAAY;CAClB;CAEA,MAAM,WAAqB,CAAC;CAC5B,IAAI,KACF,SAAS,WAAW;CAEtB,IAAI,UACF,SAAS,YAAY;CAEvB,MAAM,QAAQ,gBACZC,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CACA,IAAI,OACF,SAAS,eAAe;CAG1B,MAAM,cAA2B;EAC/B,SAAS;EACT;EACA,iBAAiB,MAAM,2BACrB,QACA,gBACA,QACF;EACA,QAAQ,CAAC;CACX;CAMA,MAAM,WAAW,WACb,CAAC,OAAO,IACR,CAAC,cAAc,MAAM,MAAM,SAAS,eAAe,CAAC,KAAK,OAAO;CAEpE,IAAI;EACF,IAAI,oBACF,MAAM,eAAe,cAAc,kBAAkB;EAEvD,MAAM,kBAAkB,MAAM,eAAe;GAC3C;GACA,yBAAyB;GACzB,aAAa;IAAE,MAAM;IAAiB,UAAU;GAAsB;GACtE,WAAW,KAAK,UAAU,WAAW;EACvC,CAAC;EACD,MAAM,UAAU,CACd,GAAG,YAAY,eAAe,GAC9B,GAAI,MAAM,kBAAkB,YAAY,CAC1C;EACA,OAAO,QAAQ,SAAS,UAAU;CACpC,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,KAAK;GAAE;GAAK;EAAa,GAAG,+BAA+B;EAClE,OAAO,oBAAoB,cAAc,GAAG;CAC9C;AACF"}
+{"version":3,"file":"artifacts.js","names":["miseVersioning","hostRules.find"],"sources":["../../../../lib/modules/manager/mise/artifacts.ts"],"sourcesContent":["import { isNonEmptyStringAndNotWhitespace } from '@sindresorhus/is';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { TEMPORARY_ERROR } from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { coerceArray } from '../../../util/array.ts';\nimport { findGithubToken } from '../../../util/check-token.ts';\nimport { exec } from '../../../util/exec/index.ts';\nimport type {\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../util/exec/types.ts';\nimport { readLocalFile, writeLocalFile } from '../../../util/fs/index.ts';\nimport { collectFileChanges } from '../../../util/git/file-changes.ts';\nimport { getRepoStatus } from '../../../util/git/index.ts';\nimport * as hostRules from '../../../util/host-rules.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { api as miseVersioning } from '../../versioning/semver/index.ts';\nimport type {\n  ToolConstraintsConfig,\n  UpdateArtifact,\n  UpdateArtifactsResult,\n} from '../types.ts';\nimport {\n  artifactErrorResult,\n  fileChangesToArtifactResults,\n  resolveToolConstraint,\n  updateLockFile,\n} from '../util.ts';\nimport { getConfigType, getLockFileName, getSidecarDir } from './lockfile.ts';\n\n/**\n * First mise release that supports the features this manager relies on:\n * `MISE_SAFE=1` safe mode (a hard boundary against project config executing\n * code during `mise lock`) and `mise lock --bump` (advancing fuzzy selectors).\n *\n * Safe mode (jdx/mise#11146) and lockfile bumping (jdx/mise#11145) merged after\n * v2026.7.11 and first shipped in v2026.7.12.\n *\n * @see https://github.com/jdx/mise/pull/11146\n * @see https://github.com/jdx/mise/pull/11145\n * @see https://mise.jdx.dev/configuration/settings.html#safe\n */\nconst MISE_SAFE_MODE_MIN_VERSION = '2026.7.12';\n\n/**\n * Detects the mise version that will actually run, by executing `mise version`.\n * `mise version` only prints the binary's version — it does not load or execute\n * project configuration — so it is safe to run even without allowlisting.\n *\n * Output looks like `2026.7.12 macos-arm64 (2026-07-21)`; we take the leading\n * `major.minor.patch`. Returns `null` if the probe fails or cannot be parsed,\n * in which case callers fall back to the conservative (pre-safe-mode) behavior.\n */\nasync function detectMiseVersion(\n  execOptions: ExecOptions,\n): Promise<string | null> {\n  try {\n    const { stdout } = await exec('mise version', execOptions);\n    const version = regEx(/\\d+\\.\\d+\\.\\d+/).exec(stdout)?.[0];\n    if (version && miseVersioning.isVersion(version)) {\n      return version;\n    }\n    logger.debug({ stdout }, 'Could not parse mise version output');\n    return null;\n  } catch (err) {\n    logger.debug({ err }, 'Failed to determine mise version');\n    return null;\n  }\n}\n\n/** True when `version` is at or above the safe-mode / `--bump` release. */\nfunction versionSupportsSafeFeatures(version: string | null): boolean {\n  if (!version) {\n    return false;\n  }\n  return (\n    miseVersioning.equals(version, MISE_SAFE_MODE_MIN_VERSION) ||\n    miseVersioning.isGreaterThan(version, MISE_SAFE_MODE_MIN_VERSION)\n  );\n}\n\n/**\n * Resolver tools that mise may invoke while running `mise lock`, for instance to convert an inexact version like `1` against the npm registry.\n *\n * NOTE: this will install all relevant tools, regardless of what the given mise configuration uses.\n *\n * In safe mode these are unnecessary: npm version listing uses mise's built-in\n * registry HTTP client and go runs with `GOTOOLCHAIN=local`, so `mise lock`\n * resolves versions over HTTP without shelling out to node/npm/ruby.\n *\n * @see https://mise.jdx.dev/dev-tools/backends/npm.html\n * @see https://mise.jdx.dev/dev-tools/backends/go.html\n * @see https://mise.jdx.dev/dev-tools/backends/gem.html\n */\nasync function getMiseLockToolConstraints(\n  config: ToolConstraintsConfig,\n  miseConstraint: string | undefined,\n  safeMode = false,\n): Promise<ToolConstraint[]> {\n  const miseToolConstraint: ToolConstraint = {\n    toolName: 'mise',\n    constraint: miseConstraint,\n  };\n  if (safeMode) {\n    return [miseToolConstraint];\n  }\n  return [\n    miseToolConstraint,\n    {\n      toolName: 'node',\n      constraint: await resolveToolConstraint(config, 'node'),\n    },\n    {\n      toolName: 'npm',\n      constraint: await resolveToolConstraint(config, 'npm'),\n    },\n    {\n      // the golang tool is constrained by the `go` constraint\n      toolName: 'golang',\n      constraint: await resolveToolConstraint(config, 'go'),\n    },\n    {\n      toolName: 'ruby',\n      constraint: await resolveToolConstraint(config, 'ruby'),\n    },\n  ];\n}\n\n/**\n * Collects the native dependency sidecars which `mise lock` wrote beside the\n * lock file. The lock file records each sidecar's path and digest, so they\n * have to be committed together. A version change moves a sidecar to a new\n * directory, so this includes new untracked files and deleted ones.\n *\n * @see https://mise.jdx.dev/dev-tools/mise-lock.html#native-dependency-sidecars\n */\nasync function getSidecarChanges(\n  lockFileName: string,\n): Promise<UpdateArtifactsResult[]> {\n  const status = await getRepoStatus(getSidecarDir(lockFileName));\n  return fileChangesToArtifactResults(await collectFileChanges(status));\n}\n\n/**\n * Updates mise lock files when dependencies are updated.\n * Runs `mise lock` for lock file maintenance or `mise lock <tools>` for targeted updates.\n */\nexport async function updateArtifacts({\n  packageFileName,\n  updatedDeps,\n  newPackageFileContent,\n  newLockFileContent,\n  config,\n}: UpdateArtifact): Promise<UpdateArtifactsResult[] | null> {\n  const lockFileName = getLockFileName(packageFileName);\n  const originalLockFileContent = await readLocalFile(lockFileName, 'utf8');\n  const currentLockFileContent = newLockFileContent ?? originalLockFileContent;\n  if (!currentLockFileContent) {\n    logger.debug({ lockFileName }, 'No mise lock file found');\n    return null;\n  }\n\n  // `mise lock` normally executes the project's mise config, so it requires\n  // `allowedUnsafeExecutions`. When the mise that will run supports safe mode,\n  // we instead run with `MISE_SAFE=1`, which is a hard boundary against the\n  // config executing code — so the allowlist is not required on that path.\n  const allowlist = GlobalConfig.get('allowedUnsafeExecutions');\n  const miseAllowlisted = allowlist.includes('mise');\n\n  // The mise version is needed to decide safe mode (untrusted path) and\n  // `mise lock --bump` (lock file maintenance). Detect it at runtime rather\n  // than requiring a pinned `constraints.mise`. Skip the probe when it cannot\n  // change the outcome: an allowlisted, non-maintenance run behaves the same\n  // regardless of version.\n  const miseConstraint = await resolveToolConstraint(config, 'mise');\n  let miseSupportsSafeFeatures = false;\n  if (!miseAllowlisted || config.isLockFileMaintenance) {\n    const miseVersion = await detectMiseVersion({\n      cwdFile: packageFileName,\n      toolConstraints: [{ toolName: 'mise', constraint: miseConstraint }],\n      docker: {},\n    });\n    miseSupportsSafeFeatures = versionSupportsSafeFeatures(miseVersion);\n  }\n\n  const safeMode = !miseAllowlisted && miseSupportsSafeFeatures;\n  if (!miseAllowlisted && !safeMode) {\n    logger.once.warn(\n      { safeModeMinVersion: MISE_SAFE_MODE_MIN_VERSION },\n      '`mise lock` requires either `mise` in `allowedUnsafeExecutions`, or a mise version that supports safe mode',\n    );\n    return null;\n  }\n\n  const { isLocal, env } = getConfigType(packageFileName);\n  const localFlag = isLocal ? ' --local' : '';\n\n  let lockCmd: string;\n  if (config.isLockFileMaintenance) {\n    // Lock file maintenance means \"update to the latest versions\". Plain\n    // `mise lock` only refreshes metadata for already-locked versions, so use\n    // `mise lock --bump` to also advance fuzzy selectors (e.g. `node = \"22\"`)\n    // to the latest matching version. `--bump` requires a new enough mise, so\n    // fall back to a plain refresh when the version cannot be guaranteed.\n    const bumpFlag = miseSupportsSafeFeatures ? ' --bump' : '';\n    lockCmd = `mise lock${localFlag}${bumpFlag}`;\n  } else {\n    const tools = updatedDeps\n      .map(({ depName }) => depName)\n      .filter(isNonEmptyStringAndNotWhitespace)\n      .map(quote)\n      .join(' ');\n    lockCmd = tools\n      ? `mise lock${localFlag} ${tools}`\n      : `mise lock${localFlag}`;\n  }\n\n  const extraEnv: ExtraEnv = {};\n  if (env) {\n    extraEnv.MISE_ENV = env;\n  }\n  if (safeMode) {\n    extraEnv.MISE_SAFE = '1';\n  }\n  const token = findGithubToken(\n    hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }),\n  );\n  if (token) {\n    extraEnv.GITHUB_TOKEN = token;\n  }\n\n  const execOptions: ExecOptions = {\n    cwdFile: packageFileName,\n    extraEnv,\n    toolConstraints: await getMiseLockToolConstraints(\n      config,\n      miseConstraint,\n      safeMode,\n    ),\n    docker: {},\n  };\n\n  // `mise trust` is only needed on the allowlisted path. In safe mode mise\n  // loads untrusted config without a trust prompt (the config is inert — it\n  // can neither execute code nor inject environment), so the trust step is\n  // unnecessary and is skipped.\n  const commands = safeMode\n    ? [lockCmd]\n    : [`mise trust ${quote(upath.basename(packageFileName))}`, lockCmd];\n\n  try {\n    if (newLockFileContent) {\n      await writeLocalFile(lockFileName, newLockFileContent);\n    }\n    const lockFileResults = await updateLockFile({\n      lockFileName,\n      existingLockFileContent: originalLockFileContent,\n      packageFile: { path: packageFileName, contents: newPackageFileContent },\n      run: () => exec(commands, execOptions),\n    });\n    const results = [\n      ...coerceArray(lockFileResults),\n      ...(await getSidecarChanges(lockFileName)),\n    ];\n    return results.length ? results : null;\n  } catch (err) {\n    /* v8 ignore if -- defensive rethrow, not worth testing */\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n\n    logger.warn({ err, lockFileName }, 'Error updating mise lock file');\n    return artifactErrorResult(lockFileName, err);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAM,6BAA6B;;;;;;;;;;AAWnC,eAAe,kBACb,aACwB;CACxB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,KAAK,gBAAgB,WAAW;EACzD,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG;EACtD,IAAI,WAAWA,IAAe,UAAU,OAAO,GAC7C,OAAO;EAET,OAAO,MAAM,EAAE,OAAO,GAAG,qCAAqC;EAC9D,OAAO;CACT,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,kCAAkC;EACxD,OAAO;CACT;AACF;;AAGA,SAAS,4BAA4B,SAAiC;CACpE,IAAI,CAAC,SACH,OAAO;CAET,OACEA,IAAe,OAAO,SAAS,0BAA0B,KACzDA,IAAe,cAAc,SAAS,0BAA0B;AAEpE;;;;;;;;;;;;;;AAeA,eAAe,2BACb,QACA,gBACA,WAAW,OACgB;CAC3B,MAAM,qBAAqC;EACzC,UAAU;EACV,YAAY;CACd;CACA,IAAI,UACF,OAAO,CAAC,kBAAkB;CAE5B,OAAO;EACL;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,KAAK;EACvD;EACA;GAEE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,IAAI;EACtD;EACA;GACE,UAAU;GACV,YAAY,MAAM,sBAAsB,QAAQ,MAAM;EACxD;CACF;AACF;;;;;;;;;AAUA,eAAe,kBACb,cACkC;CAClC,MAAM,SAAS,MAAM,cAAc,cAAc,YAAY,CAAC;CAC9D,OAAO,6BAA6B,MAAM,mBAAmB,MAAM,CAAC;AACtE;;;;;AAMA,eAAsB,gBAAgB,EACpC,iBACA,aACA,uBACA,oBACA,UAC0D;CAC1D,MAAM,eAAe,gBAAgB,eAAe;CACpD,MAAM,0BAA0B,MAAM,cAAc,cAAc,MAAM;CAExE,IAAI,EAD2B,sBAAsB,0BACxB;EAC3B,OAAO,MAAM,EAAE,aAAa,GAAG,yBAAyB;EACxD,OAAO;CACT;CAOA,MAAM,kBADY,aAAa,IAAI,yBACH,CAAC,CAAC,SAAS,MAAM;CAOjD,MAAM,iBAAiB,MAAM,sBAAsB,QAAQ,MAAM;CACjE,IAAI,2BAA2B;CAC/B,IAAI,CAAC,mBAAmB,OAAO,uBAM7B,2BAA2B,4BAA4B,MAL7B,kBAAkB;EAC1C,SAAS;EACT,iBAAiB,CAAC;GAAE,UAAU;GAAQ,YAAY;EAAe,CAAC;EAClE,QAAQ,CAAC;CACX,CAAC,CACiE;CAGpE,MAAM,WAAW,CAAC,mBAAmB;CACrC,IAAI,CAAC,mBAAmB,CAAC,UAAU;EACjC,OAAO,KAAK,KACV,EAAE,oBAAoB,2BAA2B,GACjD,4GACF;EACA,OAAO;CACT;CAEA,MAAM,EAAE,SAAS,QAAQ,cAAc,eAAe;CACtD,MAAM,YAAY,UAAU,aAAa;CAEzC,IAAI;CACJ,IAAI,OAAO,uBAOT,UAAU,YAAY,YADL,2BAA2B,YAAY;MAEnD;EACL,MAAM,QAAQ,YACX,KAAK,EAAE,cAAc,OAAO,CAAC,CAC7B,OAAO,gCAAgC,CAAC,CACxC,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;EACX,UAAU,QACN,YAAY,UAAU,GAAG,UACzB,YAAY;CAClB;CAEA,MAAM,WAAqB,CAAC;CAC5B,IAAI,KACF,SAAS,WAAW;CAEtB,IAAI,UACF,SAAS,YAAY;CAEvB,MAAM,QAAQ,gBACZC,KAAe;EACb,UAAU;EACV,KAAK;CACP,CAAC,CACH;CACA,IAAI,OACF,SAAS,eAAe;CAG1B,MAAM,cAA2B;EAC/B,SAAS;EACT;EACA,iBAAiB,MAAM,2BACrB,QACA,gBACA,QACF;EACA,QAAQ,CAAC;CACX;CAMA,MAAM,WAAW,WACb,CAAC,OAAO,IACR,CAAC,cAAc,MAAM,MAAM,SAAS,eAAe,CAAC,KAAK,OAAO;CAEpE,IAAI;EACF,IAAI,oBACF,MAAM,eAAe,cAAc,kBAAkB;EAEvD,MAAM,kBAAkB,MAAM,eAAe;GAC3C;GACA,yBAAyB;GACzB,aAAa;IAAE,MAAM;IAAiB,UAAU;GAAsB;GACtE,WAAW,KAAK,UAAU,WAAW;EACvC,CAAC;EACD,MAAM,UAAU,CACd,GAAG,YAAY,eAAe,GAC9B,GAAI,MAAM,kBAAkB,YAAY,CAC1C;EACA,OAAO,QAAQ,SAAS,UAAU;CACpC,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAGR,OAAO,KAAK;GAAE;GAAK;EAAa,GAAG,+BAA+B;EAClE,OAAO,oBAAoB,cAAc,GAAG;CAC9C;AACF"}

package/dist/modules/manager/mise/extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract.js","names":[],"sources":["../../../../lib/modules/manager/mise/extract.ts"],"sourcesContent":["import {\n  isArray,\n  isFunction,\n  isNonEmptyString,\n  isObject,\n} from '@sindresorhus/is';\nimport javaLtsVersions from '../../../data/java-version-lts.json' with { type: 'json' };\nimport { logger } from '../../../logger/index.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { GithubReleasesDatasource } from '../../datasource/github-releases/index.ts';\nimport { JavaVersionDatasource } from '../../datasource/java-version/index.ts';\nimport { NodeVersionDatasource } from '../../datasource/node-version/index.ts';\nimport type { StaticTooling } from '../asdf/types.ts';\nimport type { PackageDependency, PackageFileContent } from '../types.ts';\nimport {\n  createAquaToolConfig,\n  createCargoToolConfig,\n  createCondaToolConfig,\n  createDotnetToolConfig,\n  createGemToolConfig,\n  createGithubToolConfig,\n  createGitlabToolConfig,\n  createGoToolConfig,\n  createNpmToolConfig,\n  createPipxToolConfig,\n  createPypiToolConfig,\n  createSpmToolConfig,\n  createUbiToolConfig,\n} from './backends.ts';\nimport { extractGitReference } from './git-reference.ts';\nimport { extractInclude } from './include.ts';\nimport { getLockFileName, getLockedVersion } from './lockfile.ts';\nimport type { MiseTool, MiseToolOptions, MiseToolValue } from './schema.ts';\nimport { MiseLockFile } from './schema.ts';\nimport type { BackendToolingConfig, ToolingDefinition } from './types.ts';\nimport {\n  asdfTooling,\n  getOrderedMiseRegistryBackends,\n  miseTooling,\n} from './upgradeable-tooling.ts';\nimport { parseTomlFile } from './utils.ts';\n\n// Tool names can have options in the tool name\n// e.g. ubi:tamasfe/taplo[matching=full,exe=taplo]\nconst optionInToolNameRegex = regEx(/^(?<name>.+?)(?:\\[(?<options>.+)\\])?$/);\nconst nonVersionSelectorRegex = regEx(/^(?:ref:|path:|sub-\\d+(?::|$))/);\nconst partialSelectorRegex = regEx(\n  /^(?<prefix>[^\\d]*)(?<major>\\d+)(?:\\.(?<minor>\\d+))?$/,\n);\nconst versionPrefixRegex = regEx(/^(?<prefix>[^\\d]*)\\d/);\n\ntype MiseDependency = PackageDependency & { depName: string };\n\ninterface MiseSelectorConfig {\n  allowedVersions?: string;\n  ignoreUnstable?: boolean;\n}\n\n/**\n * Extracts mise tool dependencies from a mise configuration file.\n * Supports various backends (core, asdf, aqua, cargo, etc.) and\n * extracts locked versions when a corresponding lock file exists.\n */\nexport async function extractPackageFile(\n  content: string,\n  packageFile: string,\n): Promise<PackageFileContent | null> {\n  logger.trace(`mise.extractPackageFile(${packageFile})`);\n\n  const misefile = parseTomlFile(content, packageFile);\n  if (!misefile) {\n    return null;\n  }\n\n  const toolEntries: [string, MiseTool, string][] = [];\n\n  for (const [name, toolData] of Object.entries(misefile.tools)) {\n    toolEntries.push([name, toolData, 'tools']);\n  }\n\n  for (const [taskName, taskData] of Object.entries(misefile.tasks)) {\n    for (const [name, toolData] of Object.entries(\n      coerceObject(taskData.tools),\n    )) {\n      toolEntries.push([name, toolData, `task-${taskName}-tools`]);\n    }\n  }\n\n  const taskFileDeps: PackageDependency[] = [];\n  for (const [taskName, taskData] of Object.entries(misefile.tasks)) {\n    if (taskData.file) {\n      // local paths and plain http(s) urls have no version\n      const dep = extractGitReference(\n        taskData.file.trim(),\n        content,\n        `task-${taskName}-file`,\n      );\n      if (dep) {\n        taskFileDeps.push(dep);\n      }\n    }\n  }\n\n  const includeDeps = misefile.include.map((include) =>\n    extractInclude(include, content),\n  );\n\n  if (!toolEntries.length && !taskFileDeps.length && !includeDeps.length) {\n    return null;\n  }\n\n  const lockFileName = getLockFileName(packageFile);\n  const lockFileContent = await readLocalFile(lockFileName, 'utf8');\n  let lockFileData: MiseLockFile | undefined;\n  if (lockFileContent) {\n    const lockFileParsed = MiseLockFile.safeParse(lockFileContent);\n    if (lockFileParsed.success) {\n      lockFileData = lockFileParsed.data;\n    } else {\n      logger.debug(\n        { lockFileName, err: lockFileParsed.error },\n        'Failed to parse mise lock file',\n      );\n    }\n  }\n\n  const deps = [\n    ...toolEntries.map(([name, toolData, depType]) =>\n      extractToolEntry(name, toolData, depType, lockFileData),\n    ),\n    ...taskFileDeps,\n    ...includeDeps,\n  ];\n  const result: PackageFileContent = { deps };\n\n  if (lockFileData) {\n    result.lockFiles = [lockFileName];\n  }\n\n  return result;\n}\n\n/**\n * Returns the primary tool entry. For arrays only the first entry is managed,\n * e.g. 'erlang = [\"23.3\", \"24.0\"]' or\n * 'rust = [{ version = \"1.98.1\", profile = \"minimal\" }, { version = \"nightly\" }]'.\n */\nfunction getPrimaryToolValue(toolData: MiseTool): MiseToolValue | null {\n  if (isArray(toolData)) {\n    return toolData.length ? toolData[0] : null;\n  }\n  return toolData;\n}\n\nfunction parseVersion(toolValue: MiseToolValue | null): string | null {\n  if (isNonEmptyString(toolValue)) {\n    // Handle the string case\n    // e.g. 'erlang = \"23.3\"'\n    return toolValue;\n  }\n  if (isObject(toolValue) && isNonEmptyString(toolValue.version)) {\n    // Handle the object case with a string version\n    // e.g. 'python = { version = \"3.11.2\" }'\n    return toolValue.version;\n  }\n  return null; // Return null if no version is found\n}\n\nfunction parseOptions(\n  optionsInName: string,\n  toolOptions: MiseToolOptions,\n): MiseToolOptions {\n  const options = isNonEmptyString(optionsInName)\n    ? Object.fromEntries(\n        optionsInName.split(',').map((option) => option.split('=', 2)),\n      )\n    : {};\n  // Options in toolOptions will override options in the tool name\n  return {\n    ...options,\n    ...toolOptions,\n  };\n}\n\nfunction getToolConfig(\n  backend: string,\n  toolName: string,\n  version: string,\n  toolOptions: MiseToolOptions,\n): StaticTooling | BackendToolingConfig | null {\n  switch (backend) {\n    case '': {\n      // If the tool name does not specify a backend, it should be a short name or an alias defined by users\n      const staticResult = getRegistryToolConfig(toolName, version);\n      if (staticResult) {\n        return staticResult;\n      }\n\n      // Otherwise, see if we have any known short tool names that are in the `mise-registry.json` data file\n      const backends = getOrderedMiseRegistryBackends(toolName);\n\n      // prioritise the github backend as the best source for data\n      if (backends.github) {\n        const result = getToolConfig(\n          'github',\n          backends.github,\n          version,\n          toolOptions,\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (result !== null) {\n          return result;\n        }\n      }\n\n      for (const [backendType, backendName] of Object.entries(backends)) {\n        const result = getToolConfig(\n          backendType,\n          backendName,\n          version,\n          toolOptions,\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (result !== null) {\n          return result;\n        }\n      }\n      return null;\n    }\n    // We can specify core, asdf, vfox, aqua backends for tools in the default registry\n    // e.g. 'core:rust', 'asdf:rust', 'vfox:clang', 'aqua:act'\n    case 'core':\n      return getConfigFromTooling(miseTooling, toolName, version);\n    case 'asdf':\n      return getConfigFromTooling(asdfTooling, toolName, version);\n    case 'vfox':\n      return getRegistryToolConfig(toolName, version);\n    case 'aqua':\n      return (\n        getRegistryToolConfig(toolName, version) ??\n        createAquaToolConfig(toolName, version)\n      );\n    case 'cargo':\n      return createCargoToolConfig(toolName, version);\n    case 'conda':\n      return createCondaToolConfig(toolName);\n    case 'dotnet':\n      return createDotnetToolConfig(toolName);\n    case 'gem':\n      return createGemToolConfig(toolName);\n    case 'github':\n      return createGithubToolConfig(toolName, version, toolOptions);\n    case 'gitlab':\n      return createGitlabToolConfig(toolName, version, toolOptions);\n    case 'go':\n      return createGoToolConfig(toolName);\n    case 'npm':\n      return createNpmToolConfig(toolName);\n    case 'pipx':\n      return createPipxToolConfig(toolName);\n    case 'pypi':\n      return createPypiToolConfig(toolName);\n    case 'spm':\n      return createSpmToolConfig(toolName);\n    case 'ubi':\n      return createUbiToolConfig(toolName, version, toolOptions);\n    default:\n      // Unsupported backend\n      return null;\n  }\n}\n\n/**\n * Get the tooling config for a short name defined in the default registry\n * @link https://mise.jdx.dev/registry.html\n */\nfunction getRegistryToolConfig(\n  short: string,\n  version: string,\n): StaticTooling | null {\n  // Try to get the config from miseTooling first, then asdfTooling\n  return (\n    getConfigFromTooling(miseTooling, short, version) ??\n    getConfigFromTooling(asdfTooling, short, version)\n  );\n}\n\nfunction getConfigFromTooling(\n  toolingSource: Record<string, ToolingDefinition>,\n  name: string,\n  version: string,\n): StaticTooling | null {\n  const toolDefinition = toolingSource[name];\n  if (!toolDefinition) {\n    return null;\n  } // Return null if no toolDefinition is found\n\n  return (\n    (isFunction(toolDefinition.config)\n      ? toolDefinition.config(version)\n      : toolDefinition.config) ?? null\n  ); // Ensure null is returned instead of undefined\n}\n\nfunction getLtsDatasource(\n  backend: string,\n  toolName: string,\n  datasource: string | undefined,\n): string | undefined {\n  if (datasource) {\n    return datasource;\n  }\n  if ((backend === '' || backend === 'core') && toolName === 'java') {\n    return JavaVersionDatasource.id;\n  }\n  return undefined;\n}\n\nfunction getSelectorConfig(\n  version: string,\n  backend: string,\n  toolName: string,\n  datasource: string | undefined,\n  lockedVersion: string,\n): MiseSelectorConfig | null {\n  if (version === 'latest') {\n    return {};\n  }\n\n  if (version === 'lts') {\n    const ltsDatasource = getLtsDatasource(backend, toolName, datasource);\n    if (ltsDatasource === NodeVersionDatasource.id) {\n      return { ignoreUnstable: true };\n    }\n    if (ltsDatasource === JavaVersionDatasource.id) {\n      return {\n        allowedVersions: `/^(?:${javaLtsVersions.join('|')})(?:\\\\.|-|\\\\+|$)/`,\n        ignoreUnstable: true,\n      };\n    }\n    return null;\n  }\n\n  if (nonVersionSelectorRegex.test(version)) {\n    return null;\n  }\n\n  const match = partialSelectorRegex.exec(version);\n  if (!match?.groups || lockedVersion === version) {\n    return null;\n  }\n\n  const { prefix, major, minor } = match.groups;\n  const lockedPrefix = versionPrefixRegex.exec(lockedVersion)?.groups?.prefix;\n  const effectivePrefix = prefix || lockedPrefix;\n  let prefixPattern = '';\n  if (effectivePrefix) {\n    prefixPattern = `(?:${RegExp.escape(effectivePrefix)})?`;\n  } else if (\n    datasource === GithubReleasesDatasource.id ||\n    datasource === NodeVersionDatasource.id\n  ) {\n    prefixPattern = `(?:${RegExp.escape('v')})?`;\n  }\n  const precisionPattern = minor\n    ? `\\\\.${minor}(?:\\\\.|-|\\\\+|$)`\n    : `(?:\\\\.|-|\\\\+|$)`;\n  return {\n    allowedVersions: `/^${prefixPattern}${major}${precisionPattern}/`,\n  };\n}\n\nfunction extractSelectorLockedDependency(\n  depName: string,\n  version: string,\n  backend: string,\n  toolName: string,\n  options: MiseToolOptions,\n  toolConfig: StaticTooling | BackendToolingConfig | null,\n  lockedVersion: string,\n  depType: string,\n): PackageDependency | null {\n  const selectorConfig = getSelectorConfig(\n    version,\n    backend,\n    toolName,\n    toolConfig?.datasource,\n    lockedVersion,\n  );\n  if (!selectorConfig) {\n    return null;\n  }\n\n  const resolvedToolConfig = getToolConfig(\n    backend,\n    toolName,\n    lockedVersion,\n    options,\n  );\n  if (!resolvedToolConfig) {\n    return null;\n  }\n\n  const comparableLockedVersion =\n    resolvedToolConfig.currentValue ?? lockedVersion;\n  return {\n    ...createDependency(depName, version, resolvedToolConfig, depType),\n    currentValue: version,\n    lockedVersion: comparableLockedVersion,\n    rangeStrategy: 'update-lockfile',\n    isLockfileOnly: true,\n    ...selectorConfig,\n  };\n}\n\nfunction extractToolEntry(\n  name: string,\n  toolData: MiseTool,\n  depType: string,\n  lockFileData?: MiseLockFile,\n): PackageDependency {\n  const toolValue = getPrimaryToolValue(toolData);\n  const version = parseVersion(toolValue);\n  const { name: depName, options: optionsInName } = optionInToolNameRegex.exec(\n    name.trim(),\n  )!.groups!;\n  const delimiterIndex = depName.indexOf(':');\n  const backend = depName.substring(0, delimiterIndex);\n  const toolName = depName.substring(delimiterIndex + 1);\n  const options = parseOptions(\n    optionsInName,\n    isObject(toolValue) ? toolValue : {},\n  );\n  const toolConfig =\n    version === null\n      ? null\n      : getToolConfig(backend, toolName, version, options);\n  const dependency = createDependency(depName, version, toolConfig, depType);\n  const lockedVersion = lockFileData\n    ? getLockedVersion(lockFileData, dependency.depName)\n    : undefined;\n\n  if (version !== null && lockedVersion) {\n    const selectorDependency = extractSelectorLockedDependency(\n      depName,\n      version,\n      backend,\n      toolName,\n      options,\n      toolConfig,\n      lockedVersion,\n      depType,\n    );\n    if (selectorDependency) {\n      return selectorDependency;\n    }\n  }\n\n  if (lockedVersion) {\n    return { ...dependency, lockedVersion };\n  }\n  return dependency;\n}\n\nfunction getConfiguredDepName(\n  config: StaticTooling | BackendToolingConfig,\n): string | undefined {\n  if ('depName' in config) {\n    return config.depName;\n  }\n  return undefined;\n}\n\nfunction createDependency(\n  name: string,\n  version: string | null,\n  config: StaticTooling | BackendToolingConfig | null,\n  depType: string,\n): MiseDependency {\n  if (version === null) {\n    return {\n      depName: name,\n      depType,\n      skipReason: 'unspecified-version',\n    };\n  }\n  if (config === null) {\n    return {\n      depName: name,\n      depType,\n      skipReason: 'unsupported-datasource',\n    };\n  }\n\n  return {\n    depType,\n    currentValue: version,\n    ...config,\n    // Allow tooling definitions to override the parsed mise tool name.\n    depName: getConfiguredDepName(config) ?? name,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8CA,MAAM,wBAAwB,MAAM,uCAAuC;AAC3E,MAAM,0BAA0B,MAAM,gCAAgC;AACtE,MAAM,uBAAuB,MAC3B,sDACF;AACA,MAAM,qBAAqB,MAAM,sBAAsB;;;;;;AAcvD,eAAsB,mBACpB,SACA,aACoC;CACpC,OAAO,MAAM,2BAA2B,YAAY,EAAE;CAEtD,MAAM,WAAW,cAAc,SAAS,WAAW;CACnD,IAAI,CAAC,UACH,OAAO;CAGT,MAAM,cAA4C,CAAC;CAEnD,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,SAAS,KAAK,GAC1D,YAAY,KAAK;EAAC;EAAM;EAAU;CAAO,CAAC;CAG5C,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,SAAS,KAAK,GAC9D,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QACpC,aAAa,SAAS,KAAK,CAC7B,GACE,YAAY,KAAK;EAAC;EAAM;EAAU,QAAQ,SAAS;CAAO,CAAC;CAI/D,MAAM,eAAoC,CAAC;CAC3C,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,SAAS,KAAK,GAC9D,IAAI,SAAS,MAAM;EAEjB,MAAM,MAAM,oBACV,SAAS,KAAK,KAAK,GACnB,SACA,QAAQ,SAAS,MACnB;EACA,IAAI,KACF,aAAa,KAAK,GAAG;CAEzB;CAGF,MAAM,cAAc,SAAS,QAAQ,KAAK,YACxC,eAAe,SAAS,OAAO,CACjC;CAEA,IAAI,CAAC,YAAY,UAAU,CAAC,aAAa,UAAU,CAAC,YAAY,QAC9D,OAAO;CAGT,MAAM,eAAe,gBAAgB,WAAW;CAChD,MAAM,kBAAkB,MAAM,cAAc,cAAc,MAAM;CAChE,IAAI;CACJ,IAAI,iBAAiB;EACnB,MAAM,iBAAiB,aAAa,UAAU,eAAe;EAC7D,IAAI,eAAe,SACjB,eAAe,eAAe;OAE9B,OAAO,MACL;GAAE;GAAc,KAAK,eAAe;EAAM,GAC1C,gCACF;CAEJ;CASA,MAAM,SAA6B,EAAE,MAAA;EANnC,GAAG,YAAY,KAAK,CAAC,MAAM,UAAU,aACnC,iBAAiB,MAAM,UAAU,SAAS,YAAY,CACxD;EACA,GAAG;EACH,GAAG;CAEmC,EAAE;CAE1C,IAAI,cACF,OAAO,YAAY,CAAC,YAAY;CAGlC,OAAO;AACT;;;;;;AAOA,SAAS,oBAAoB,UAA0C;CACrE,IAAI,QAAQ,QAAQ,GAClB,OAAO,SAAS,SAAS,SAAS,KAAK;CAEzC,OAAO;AACT;AAEA,SAAS,aAAa,WAAgD;CACpE,IAAI,iBAAiB,SAAS,GAG5B,OAAO;CAET,IAAI,SAAS,SAAS,KAAK,iBAAiB,UAAU,OAAO,GAG3D,OAAO,UAAU;CAEnB,OAAO;AACT;AAEA,SAAS,aACP,eACA,aACiB;CAOjB,OAAO;EACL,GAPc,iBAAiB,aAAa,IAC1C,OAAO,YACL,cAAc,MAAM,GAAG,CAAC,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,CAAC,CAAC,CAC/D,IACA,CAAC;EAIH,GAAG;CACL;AACF;AAEA,SAAS,cACP,SACA,UACA,SACA,aAC6C;CAC7C,QAAQ,SAAR;EACE,KAAK,IAAI;GAEP,MAAM,eAAe,sBAAsB,UAAU,OAAO;GAC5D,IAAI,cACF,OAAO;GAIT,MAAM,WAAW,+BAA+B,QAAQ;GAGxD,IAAI,SAAS,QAAQ;IACnB,MAAM,SAAS,cACb,UACA,SAAS,QACT,SACA,WACF;;IAEA,IAAI,WAAW,MACb,OAAO;GAEX;GAEA,KAAK,MAAM,CAAC,aAAa,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;IACjE,MAAM,SAAS,cACb,aACA,aACA,SACA,WACF;;IAEA,IAAI,WAAW,MACb,OAAO;GAEX;GACA,OAAO;EACT;EAGA,KAAK,QACH,OAAO,qBAAqB,aAAa,UAAU,OAAO;EAC5D,KAAK,QACH,OAAO,qBAAqB,aAAa,UAAU,OAAO;EAC5D,KAAK,QACH,OAAO,sBAAsB,UAAU,OAAO;EAChD,KAAK,QACH,OACE,sBAAsB,UAAU,OAAO,KACvC,qBAAqB,UAAU,OAAO;EAE1C,KAAK,SACH,OAAO,sBAAsB,UAAU,OAAO;EAChD,KAAK,SACH,OAAO,sBAAsB,QAAQ;EACvC,KAAK,UACH,OAAO,uBAAuB,QAAQ;EACxC,KAAK,OACH,OAAO,oBAAoB,QAAQ;EACrC,KAAK,UACH,OAAO,uBAAuB,UAAU,SAAS,WAAW;EAC9D,KAAK,UACH,OAAO,uBAAuB,UAAU,SAAS,WAAW;EAC9D,KAAK,MACH,OAAO,mBAAmB,QAAQ;EACpC,KAAK,OACH,OAAO,oBAAoB,QAAQ;EACrC,KAAK,QACH,OAAO,qBAAqB,QAAQ;EACtC,KAAK,QACH,OAAO,qBAAqB,QAAQ;EACtC,KAAK,OACH,OAAO,oBAAoB,QAAQ;EACrC,KAAK,OACH,OAAO,oBAAoB,UAAU,SAAS,WAAW;EAC3D,SAEE,OAAO;CACX;AACF;;;;;AAMA,SAAS,sBACP,OACA,SACsB;CAEtB,OACE,qBAAqB,aAAa,OAAO,OAAO,KAChD,qBAAqB,aAAa,OAAO,OAAO;AAEpD;AAEA,SAAS,qBACP,eACA,MACA,SACsB;CACtB,MAAM,iBAAiB,cAAc;CACrC,IAAI,CAAC,gBACH,OAAO;CAGT,QACG,WAAW,eAAe,MAAM,IAC7B,eAAe,OAAO,OAAO,IAC7B,eAAe,WAAW;AAElC;AAEA,SAAS,iBACP,SACA,UACA,YACoB;CACpB,IAAI,YACF,OAAO;CAET,KAAK,YAAY,MAAM,YAAY,WAAW,aAAa,QACzD,OAAO,sBAAsB;AAGjC;AAEA,SAAS,kBACP,SACA,SACA,UACA,YACA,eAC2B;CAC3B,IAAI,YAAY,UACd,OAAO,CAAC;CAGV,IAAI,YAAY,OAAO;EACrB,MAAM,gBAAgB,iBAAiB,SAAS,UAAU,UAAU;EACpE,IAAI,kBAAkB,sBAAsB,IAC1C,OAAO,EAAE,gBAAgB,KAAK;EAEhC,IAAI,kBAAkB,sBAAsB,IAC1C,OAAO;GACL,iBAAiB,QAAA,yBAAwB,KAAK,GAAG,EAAE;GACnD,gBAAgB;EAClB;EAEF,OAAO;CACT;CAEA,IAAI,wBAAwB,KAAK,OAAO,GACtC,OAAO;CAGT,MAAM,QAAQ,qBAAqB,KAAK,OAAO;CAC/C,IAAI,CAAC,OAAO,UAAU,kBAAkB,SACtC,OAAO;CAGT,MAAM,EAAE,QAAQ,OAAO,UAAU,MAAM;CACvC,MAAM,eAAe,mBAAmB,KAAK,aAAa,CAAC,EAAE,QAAQ;CACrE,MAAM,kBAAkB,UAAU;CAClC,IAAI,gBAAgB;CACpB,IAAI,iBACF,gBAAgB,MAAM,OAAO,OAAO,eAAe,EAAE;MAChD,IACL,eAAe,yBAAyB,MACxC,eAAe,sBAAsB,IAErC,gBAAgB,MAAM,OAAO,OAAO,GAAG,EAAE;CAE3C,MAAM,mBAAmB,QACrB,MAAM,MAAM,mBACZ;CACJ,OAAO,EACL,iBAAiB,KAAK,gBAAgB,QAAQ,iBAAiB,GACjE;AACF;AAEA,SAAS,gCACP,SACA,SACA,SACA,UACA,SACA,YACA,eACA,SAC0B;CAC1B,MAAM,iBAAiB,kBACrB,SACA,SACA,UACA,YAAY,YACZ,aACF;CACA,IAAI,CAAC,gBACH,OAAO;CAGT,MAAM,qBAAqB,cACzB,SACA,UACA,eACA,OACF;CACA,IAAI,CAAC,oBACH,OAAO;CAGT,MAAM,0BACJ,mBAAmB,gBAAgB;CACrC,OAAO;EACL,GAAG,iBAAiB,SAAS,SAAS,oBAAoB,OAAO;EACjE,cAAc;EACd,eAAe;EACf,eAAe;EACf,gBAAgB;EAChB,GAAG;CACL;AACF;AAEA,SAAS,iBACP,MACA,UACA,SACA,cACmB;CACnB,MAAM,YAAY,oBAAoB,QAAQ;CAC9C,MAAM,UAAU,aAAa,SAAS;CACtC,MAAM,EAAE,MAAM,SAAS,SAAS,kBAAkB,sBAAsB,KACtE,KAAK,KAAK,CACZ,CAAC,CAAE;CACH,MAAM,iBAAiB,QAAQ,QAAQ,GAAG;CAC1C,MAAM,UAAU,QAAQ,UAAU,GAAG,cAAc;CACnD,MAAM,WAAW,QAAQ,UAAU,iBAAiB,CAAC;CACrD,MAAM,UAAU,aACd,eACA,SAAS,SAAS,IAAI,YAAY,CAAC,CACrC;CACA,MAAM,aACJ,YAAY,OACR,OACA,cAAc,SAAS,UAAU,SAAS,OAAO;CACvD,MAAM,aAAa,iBAAiB,SAAS,SAAS,YAAY,OAAO;CACzE,MAAM,gBAAgB,eAClB,iBAAiB,cAAc,WAAW,OAAO,IACjD,KAAA;CAEJ,IAAI,YAAY,QAAQ,eAAe;EACrC,MAAM,qBAAqB,gCACzB,SACA,SACA,SACA,UACA,SACA,YACA,eACA,OACF;EACA,IAAI,oBACF,OAAO;CAEX;CAEA,IAAI,eACF,OAAO;EAAE,GAAG;EAAY;CAAc;CAExC,OAAO;AACT;AAEA,SAAS,qBACP,QACoB;CACpB,IAAI,aAAa,QACf,OAAO,OAAO;AAGlB;AAEA,SAAS,iBACP,MACA,SACA,QACA,SACgB;CAChB,IAAI,YAAY,MACd,OAAO;EACL,SAAS;EACT;EACA,YAAY;CACd;CAEF,IAAI,WAAW,MACb,OAAO;EACL,SAAS;EACT;EACA,YAAY;CACd;CAGF,OAAO;EACL;EACA,cAAc;EACd,GAAG;EAEH,SAAS,qBAAqB,MAAM,KAAK;CAC3C;AACF"}
+{"version":3,"file":"extract.js","names":[],"sources":["../../../../lib/modules/manager/mise/extract.ts"],"sourcesContent":["import {\n  isArray,\n  isFunction,\n  isNonEmptyString,\n  isObject,\n} from '@sindresorhus/is';\nimport javaLtsVersions from '../../../data/java-version-lts.json' with { type: 'json' };\nimport { logger } from '../../../logger/index.ts';\nimport { readLocalFile } from '../../../util/fs/index.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { GithubReleasesDatasource } from '../../datasource/github-releases/index.ts';\nimport { JavaVersionDatasource } from '../../datasource/java-version/index.ts';\nimport { NodeVersionDatasource } from '../../datasource/node-version/index.ts';\nimport type { StaticTooling } from '../asdf/types.ts';\nimport type { PackageDependency, PackageFileContent } from '../types.ts';\nimport {\n  createAquaToolConfig,\n  createCargoToolConfig,\n  createCondaToolConfig,\n  createDotnetToolConfig,\n  createGemToolConfig,\n  createGithubToolConfig,\n  createGitlabToolConfig,\n  createGoToolConfig,\n  createNpmToolConfig,\n  createPipxToolConfig,\n  createPypiToolConfig,\n  createSpmToolConfig,\n  createUbiToolConfig,\n} from './backends.ts';\nimport { extractGitReference } from './git-reference.ts';\nimport { extractInclude } from './include.ts';\nimport { getLockFileName, getLockedVersion } from './lockfile.ts';\nimport type { MiseTool, MiseToolOptions, MiseToolValue } from './schema.ts';\nimport { MiseLockFile } from './schema.ts';\nimport type { BackendToolingConfig, ToolingDefinition } from './types.ts';\nimport {\n  asdfTooling,\n  getOrderedMiseRegistryBackends,\n  miseTooling,\n} from './upgradeable-tooling.ts';\nimport { parseTomlFile } from './utils.ts';\n\n// Tool names can have options in the tool name\n// e.g. ubi:tamasfe/taplo[matching=full,exe=taplo]\nconst optionInToolNameRegex = regEx(/^(?<name>.+?)(?:\\[(?<options>.+)\\])?$/);\nconst nonVersionSelectorRegex = regEx(/^(?:ref:|path:|sub-\\d+(?::|$))/);\nconst partialSelectorRegex = regEx(\n  /^(?<prefix>[^\\d]*)(?<major>\\d+)(?:\\.(?<minor>\\d+))?$/,\n);\nconst versionPrefixRegex = regEx(/^(?<prefix>[^\\d]*)\\d/);\n\ntype MiseDependency = PackageDependency & { depName: string };\n\ninterface MiseSelectorConfig {\n  allowedVersions?: string;\n  ignoreUnstable?: boolean;\n}\n\n/**\n * Extracts mise tool dependencies from a mise configuration file.\n * Supports various backends (core, asdf, aqua, cargo, etc.) and\n * extracts locked versions when a corresponding lock file exists.\n */\nexport async function extractPackageFile(\n  content: string,\n  packageFile: string,\n): Promise<PackageFileContent | null> {\n  logger.trace(`mise.extractPackageFile(${packageFile})`);\n\n  const misefile = parseTomlFile(content, packageFile);\n  if (!misefile) {\n    return null;\n  }\n\n  const toolEntries: [string, MiseTool, string][] = [];\n\n  for (const [name, toolData] of Object.entries(misefile.tools)) {\n    toolEntries.push([name, toolData, 'tools']);\n  }\n\n  for (const [taskName, taskData] of Object.entries(misefile.tasks)) {\n    for (const [name, toolData] of Object.entries(\n      coerceObject(taskData.tools),\n    )) {\n      toolEntries.push([name, toolData, `task-${taskName}-tools`]);\n    }\n  }\n\n  const taskFileDeps: PackageDependency[] = [];\n  for (const [taskName, taskData] of Object.entries(misefile.tasks)) {\n    if (taskData.file) {\n      // local paths and plain http(s) urls have no version\n      const dep = extractGitReference(\n        taskData.file.trim(),\n        content,\n        `task-${taskName}-file`,\n      );\n      if (dep) {\n        taskFileDeps.push(dep);\n      }\n    }\n  }\n\n  const includeDeps = misefile.include.map((include) =>\n    extractInclude(include, content),\n  );\n\n  if (!toolEntries.length && !taskFileDeps.length && !includeDeps.length) {\n    return null;\n  }\n\n  const lockFileName = getLockFileName(packageFile);\n  const lockFileContent = await readLocalFile(lockFileName, 'utf8');\n  let lockFileData: MiseLockFile | undefined;\n  if (lockFileContent) {\n    const lockFileParsed = MiseLockFile.safeParse(lockFileContent);\n    if (lockFileParsed.success) {\n      lockFileData = lockFileParsed.data;\n    } else {\n      logger.debug(\n        { lockFileName, err: lockFileParsed.error },\n        'Failed to parse mise lock file',\n      );\n    }\n  }\n\n  const deps = [\n    ...toolEntries.map(([name, toolData, depType]) =>\n      extractToolEntry(name, toolData, depType, lockFileData),\n    ),\n    ...taskFileDeps,\n    ...includeDeps,\n  ];\n  const result: PackageFileContent = { deps };\n\n  if (lockFileData) {\n    result.lockFiles = [lockFileName];\n  }\n\n  return result;\n}\n\n/**\n * Returns the primary tool entry. For arrays only the first entry is managed,\n * e.g. 'erlang = [\"23.3\", \"24.0\"]' or\n * 'rust = [{ version = \"1.98.1\", profile = \"minimal\" }, { version = \"nightly\" }]'.\n */\nfunction getPrimaryToolValue(toolData: MiseTool): MiseToolValue | null {\n  if (isArray(toolData)) {\n    return toolData.length ? toolData[0] : null;\n  }\n  return toolData;\n}\n\nfunction parseVersion(toolValue: MiseToolValue | null): string | null {\n  if (isNonEmptyString(toolValue)) {\n    // Handle the string case\n    // e.g. 'erlang = \"23.3\"'\n    return toolValue;\n  }\n  if (isObject(toolValue) && isNonEmptyString(toolValue.version)) {\n    // Handle the object case with a string version\n    // e.g. 'python = { version = \"3.11.2\" }'\n    return toolValue.version;\n  }\n  return null; // Return null if no version is found\n}\n\nfunction parseOptions(\n  optionsInName: string,\n  toolOptions: MiseToolOptions,\n): MiseToolOptions {\n  const options = isNonEmptyString(optionsInName)\n    ? Object.fromEntries(\n        optionsInName.split(',').map((option) => option.split('=', 2)),\n      )\n    : {};\n  // Options in toolOptions will override options in the tool name\n  return {\n    ...options,\n    ...toolOptions,\n  };\n}\n\nfunction getToolConfig(\n  backend: string,\n  toolName: string,\n  version: string,\n  toolOptions: MiseToolOptions,\n): StaticTooling | BackendToolingConfig | null {\n  switch (backend) {\n    case '': {\n      // If the tool name does not specify a backend, it should be a short name or an alias defined by users\n      const staticResult = getRegistryToolConfig(toolName, version);\n      if (staticResult) {\n        return staticResult;\n      }\n\n      // Otherwise, see if we have any known short tool names that are in the `mise-registry.json` data file\n      const backends = getOrderedMiseRegistryBackends(toolName);\n\n      // prioritise the github backend as the best source for data\n      if (backends.github) {\n        const result = getToolConfig(\n          'github',\n          backends.github,\n          version,\n          toolOptions,\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (result !== null) {\n          return result;\n        }\n      }\n\n      for (const [backendType, backendName] of Object.entries(backends)) {\n        const result = getToolConfig(\n          backendType,\n          backendName,\n          version,\n          toolOptions,\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (result !== null) {\n          return result;\n        }\n      }\n      return null;\n    }\n    // We can specify core, asdf, vfox, aqua backends for tools in the default registry\n    // e.g. 'core:rust', 'asdf:rust', 'vfox:clang', 'aqua:act'\n    case 'core':\n      return getConfigFromTooling(miseTooling, toolName, version);\n    case 'asdf':\n      return getConfigFromTooling(asdfTooling, toolName, version);\n    case 'vfox':\n      return getRegistryToolConfig(toolName, version);\n    case 'aqua':\n      return (\n        getRegistryToolConfig(toolName, version) ??\n        createAquaToolConfig(toolName, version)\n      );\n    case 'cargo':\n      return createCargoToolConfig(toolName, version);\n    case 'conda':\n      return createCondaToolConfig(toolName);\n    case 'dotnet':\n      return createDotnetToolConfig(toolName);\n    case 'gem':\n      return createGemToolConfig(toolName);\n    case 'github':\n      return createGithubToolConfig(toolName, version, toolOptions);\n    case 'gitlab':\n      return createGitlabToolConfig(toolName, version, toolOptions);\n    case 'go':\n      return createGoToolConfig(toolName);\n    case 'npm':\n      return createNpmToolConfig(toolName);\n    case 'pipx':\n      return createPipxToolConfig(toolName);\n    case 'pypi':\n      return createPypiToolConfig(toolName);\n    case 'spm':\n      return createSpmToolConfig(toolName);\n    case 'ubi':\n      return createUbiToolConfig(toolName, version, toolOptions);\n    default:\n      // Unsupported backend\n      return null;\n  }\n}\n\n/**\n * Get the tooling config for a short name defined in the default registry\n * @link https://mise.jdx.dev/registry.html\n */\nfunction getRegistryToolConfig(\n  short: string,\n  version: string,\n): StaticTooling | null {\n  // Try to get the config from miseTooling first, then asdfTooling\n  return (\n    getConfigFromTooling(miseTooling, short, version) ??\n    getConfigFromTooling(asdfTooling, short, version)\n  );\n}\n\nfunction getConfigFromTooling(\n  toolingSource: Record<string, ToolingDefinition>,\n  name: string,\n  version: string,\n): StaticTooling | null {\n  const toolDefinition = toolingSource[name];\n  if (!toolDefinition) {\n    return null;\n  } // Return null if no toolDefinition is found\n\n  return (\n    (isFunction(toolDefinition.config)\n      ? toolDefinition.config(version)\n      : toolDefinition.config) ?? null\n  ); // Ensure null is returned instead of undefined\n}\n\nfunction getLtsDatasource(\n  backend: string,\n  toolName: string,\n  datasource: string | undefined,\n): string | undefined {\n  if (datasource) {\n    return datasource;\n  }\n  const isCoreBackend = backend === '' || backend === 'core';\n  if (isCoreBackend && toolName === 'java') {\n    return JavaVersionDatasource.id;\n  }\n  return undefined;\n}\n\nfunction getSelectorConfig(\n  version: string,\n  backend: string,\n  toolName: string,\n  datasource: string | undefined,\n  lockedVersion: string,\n): MiseSelectorConfig | null {\n  if (version === 'latest') {\n    return {};\n  }\n\n  if (version === 'lts') {\n    const ltsDatasource = getLtsDatasource(backend, toolName, datasource);\n    if (ltsDatasource === NodeVersionDatasource.id) {\n      return { ignoreUnstable: true };\n    }\n    if (ltsDatasource === JavaVersionDatasource.id) {\n      return {\n        allowedVersions: `/^(?:${javaLtsVersions.join('|')})(?:\\\\.|-|\\\\+|$)/`,\n        ignoreUnstable: true,\n      };\n    }\n    return null;\n  }\n\n  if (nonVersionSelectorRegex.test(version)) {\n    return null;\n  }\n\n  const match = partialSelectorRegex.exec(version);\n  if (!match?.groups || lockedVersion === version) {\n    return null;\n  }\n\n  const { prefix, major, minor } = match.groups;\n  const lockedPrefix = versionPrefixRegex.exec(lockedVersion)?.groups?.prefix;\n  const effectivePrefix = prefix || lockedPrefix;\n  let prefixPattern = '';\n  if (effectivePrefix) {\n    prefixPattern = `(?:${RegExp.escape(effectivePrefix)})?`;\n  } else if (\n    datasource === GithubReleasesDatasource.id ||\n    datasource === NodeVersionDatasource.id\n  ) {\n    prefixPattern = `(?:${RegExp.escape('v')})?`;\n  }\n  const precisionPattern = minor\n    ? `\\\\.${minor}(?:\\\\.|-|\\\\+|$)`\n    : `(?:\\\\.|-|\\\\+|$)`;\n  return {\n    allowedVersions: `/^${prefixPattern}${major}${precisionPattern}/`,\n  };\n}\n\nfunction extractSelectorLockedDependency(\n  depName: string,\n  version: string,\n  backend: string,\n  toolName: string,\n  options: MiseToolOptions,\n  toolConfig: StaticTooling | BackendToolingConfig | null,\n  lockedVersion: string,\n  depType: string,\n): PackageDependency | null {\n  const selectorConfig = getSelectorConfig(\n    version,\n    backend,\n    toolName,\n    toolConfig?.datasource,\n    lockedVersion,\n  );\n  if (!selectorConfig) {\n    return null;\n  }\n\n  const resolvedToolConfig = getToolConfig(\n    backend,\n    toolName,\n    lockedVersion,\n    options,\n  );\n  if (!resolvedToolConfig) {\n    return null;\n  }\n\n  const comparableLockedVersion =\n    resolvedToolConfig.currentValue ?? lockedVersion;\n  return {\n    ...createDependency(depName, version, resolvedToolConfig, depType),\n    currentValue: version,\n    lockedVersion: comparableLockedVersion,\n    rangeStrategy: 'update-lockfile',\n    isLockfileOnly: true,\n    ...selectorConfig,\n  };\n}\n\nfunction extractToolEntry(\n  name: string,\n  toolData: MiseTool,\n  depType: string,\n  lockFileData?: MiseLockFile,\n): PackageDependency {\n  const toolValue = getPrimaryToolValue(toolData);\n  const version = parseVersion(toolValue);\n  const { name: depName, options: optionsInName } = optionInToolNameRegex.exec(\n    name.trim(),\n  )!.groups!;\n  const delimiterIndex = depName.indexOf(':');\n  const backend = depName.substring(0, delimiterIndex);\n  const toolName = depName.substring(delimiterIndex + 1);\n  const options = parseOptions(\n    optionsInName,\n    isObject(toolValue) ? toolValue : {},\n  );\n  const toolConfig =\n    version === null\n      ? null\n      : getToolConfig(backend, toolName, version, options);\n  const dependency = createDependency(depName, version, toolConfig, depType);\n  const lockedVersion = lockFileData\n    ? getLockedVersion(lockFileData, dependency.depName)\n    : undefined;\n\n  if (version !== null && lockedVersion) {\n    const selectorDependency = extractSelectorLockedDependency(\n      depName,\n      version,\n      backend,\n      toolName,\n      options,\n      toolConfig,\n      lockedVersion,\n      depType,\n    );\n    if (selectorDependency) {\n      return selectorDependency;\n    }\n  }\n\n  if (lockedVersion) {\n    return { ...dependency, lockedVersion };\n  }\n  return dependency;\n}\n\nfunction getConfiguredDepName(\n  config: StaticTooling | BackendToolingConfig,\n): string | undefined {\n  if ('depName' in config) {\n    return config.depName;\n  }\n  return undefined;\n}\n\nfunction createDependency(\n  name: string,\n  version: string | null,\n  config: StaticTooling | BackendToolingConfig | null,\n  depType: string,\n): MiseDependency {\n  if (version === null) {\n    return {\n      depName: name,\n      depType,\n      skipReason: 'unspecified-version',\n    };\n  }\n  if (config === null) {\n    return {\n      depName: name,\n      depType,\n      skipReason: 'unsupported-datasource',\n    };\n  }\n\n  return {\n    depType,\n    currentValue: version,\n    ...config,\n    // Allow tooling definitions to override the parsed mise tool name.\n    depName: getConfiguredDepName(config) ?? name,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8CA,MAAM,wBAAwB,MAAM,uCAAuC;AAC3E,MAAM,0BAA0B,MAAM,gCAAgC;AACtE,MAAM,uBAAuB,MAC3B,sDACF;AACA,MAAM,qBAAqB,MAAM,sBAAsB;;;;;;AAcvD,eAAsB,mBACpB,SACA,aACoC;CACpC,OAAO,MAAM,2BAA2B,YAAY,EAAE;CAEtD,MAAM,WAAW,cAAc,SAAS,WAAW;CACnD,IAAI,CAAC,UACH,OAAO;CAGT,MAAM,cAA4C,CAAC;CAEnD,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,SAAS,KAAK,GAC1D,YAAY,KAAK;EAAC;EAAM;EAAU;CAAO,CAAC;CAG5C,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,SAAS,KAAK,GAC9D,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QACpC,aAAa,SAAS,KAAK,CAC7B,GACE,YAAY,KAAK;EAAC;EAAM;EAAU,QAAQ,SAAS;CAAO,CAAC;CAI/D,MAAM,eAAoC,CAAC;CAC3C,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,SAAS,KAAK,GAC9D,IAAI,SAAS,MAAM;EAEjB,MAAM,MAAM,oBACV,SAAS,KAAK,KAAK,GACnB,SACA,QAAQ,SAAS,MACnB;EACA,IAAI,KACF,aAAa,KAAK,GAAG;CAEzB;CAGF,MAAM,cAAc,SAAS,QAAQ,KAAK,YACxC,eAAe,SAAS,OAAO,CACjC;CAEA,IAAI,CAAC,YAAY,UAAU,CAAC,aAAa,UAAU,CAAC,YAAY,QAC9D,OAAO;CAGT,MAAM,eAAe,gBAAgB,WAAW;CAChD,MAAM,kBAAkB,MAAM,cAAc,cAAc,MAAM;CAChE,IAAI;CACJ,IAAI,iBAAiB;EACnB,MAAM,iBAAiB,aAAa,UAAU,eAAe;EAC7D,IAAI,eAAe,SACjB,eAAe,eAAe;OAE9B,OAAO,MACL;GAAE;GAAc,KAAK,eAAe;EAAM,GAC1C,gCACF;CAEJ;CASA,MAAM,SAA6B,EAAE,MAAA;EANnC,GAAG,YAAY,KAAK,CAAC,MAAM,UAAU,aACnC,iBAAiB,MAAM,UAAU,SAAS,YAAY,CACxD;EACA,GAAG;EACH,GAAG;CAEmC,EAAE;CAE1C,IAAI,cACF,OAAO,YAAY,CAAC,YAAY;CAGlC,OAAO;AACT;;;;;;AAOA,SAAS,oBAAoB,UAA0C;CACrE,IAAI,QAAQ,QAAQ,GAClB,OAAO,SAAS,SAAS,SAAS,KAAK;CAEzC,OAAO;AACT;AAEA,SAAS,aAAa,WAAgD;CACpE,IAAI,iBAAiB,SAAS,GAG5B,OAAO;CAET,IAAI,SAAS,SAAS,KAAK,iBAAiB,UAAU,OAAO,GAG3D,OAAO,UAAU;CAEnB,OAAO;AACT;AAEA,SAAS,aACP,eACA,aACiB;CAOjB,OAAO;EACL,GAPc,iBAAiB,aAAa,IAC1C,OAAO,YACL,cAAc,MAAM,GAAG,CAAC,CAAC,KAAK,WAAW,OAAO,MAAM,KAAK,CAAC,CAAC,CAC/D,IACA,CAAC;EAIH,GAAG;CACL;AACF;AAEA,SAAS,cACP,SACA,UACA,SACA,aAC6C;CAC7C,QAAQ,SAAR;EACE,KAAK,IAAI;GAEP,MAAM,eAAe,sBAAsB,UAAU,OAAO;GAC5D,IAAI,cACF,OAAO;GAIT,MAAM,WAAW,+BAA+B,QAAQ;GAGxD,IAAI,SAAS,QAAQ;IACnB,MAAM,SAAS,cACb,UACA,SAAS,QACT,SACA,WACF;;IAEA,IAAI,WAAW,MACb,OAAO;GAEX;GAEA,KAAK,MAAM,CAAC,aAAa,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;IACjE,MAAM,SAAS,cACb,aACA,aACA,SACA,WACF;;IAEA,IAAI,WAAW,MACb,OAAO;GAEX;GACA,OAAO;EACT;EAGA,KAAK,QACH,OAAO,qBAAqB,aAAa,UAAU,OAAO;EAC5D,KAAK,QACH,OAAO,qBAAqB,aAAa,UAAU,OAAO;EAC5D,KAAK,QACH,OAAO,sBAAsB,UAAU,OAAO;EAChD,KAAK,QACH,OACE,sBAAsB,UAAU,OAAO,KACvC,qBAAqB,UAAU,OAAO;EAE1C,KAAK,SACH,OAAO,sBAAsB,UAAU,OAAO;EAChD,KAAK,SACH,OAAO,sBAAsB,QAAQ;EACvC,KAAK,UACH,OAAO,uBAAuB,QAAQ;EACxC,KAAK,OACH,OAAO,oBAAoB,QAAQ;EACrC,KAAK,UACH,OAAO,uBAAuB,UAAU,SAAS,WAAW;EAC9D,KAAK,UACH,OAAO,uBAAuB,UAAU,SAAS,WAAW;EAC9D,KAAK,MACH,OAAO,mBAAmB,QAAQ;EACpC,KAAK,OACH,OAAO,oBAAoB,QAAQ;EACrC,KAAK,QACH,OAAO,qBAAqB,QAAQ;EACtC,KAAK,QACH,OAAO,qBAAqB,QAAQ;EACtC,KAAK,OACH,OAAO,oBAAoB,QAAQ;EACrC,KAAK,OACH,OAAO,oBAAoB,UAAU,SAAS,WAAW;EAC3D,SAEE,OAAO;CACX;AACF;;;;;AAMA,SAAS,sBACP,OACA,SACsB;CAEtB,OACE,qBAAqB,aAAa,OAAO,OAAO,KAChD,qBAAqB,aAAa,OAAO,OAAO;AAEpD;AAEA,SAAS,qBACP,eACA,MACA,SACsB;CACtB,MAAM,iBAAiB,cAAc;CACrC,IAAI,CAAC,gBACH,OAAO;CAGT,QACG,WAAW,eAAe,MAAM,IAC7B,eAAe,OAAO,OAAO,IAC7B,eAAe,WAAW;AAElC;AAEA,SAAS,iBACP,SACA,UACA,YACoB;CACpB,IAAI,YACF,OAAO;CAGT,KADsB,YAAY,MAAM,YAAY,WAC/B,aAAa,QAChC,OAAO,sBAAsB;AAGjC;AAEA,SAAS,kBACP,SACA,SACA,UACA,YACA,eAC2B;CAC3B,IAAI,YAAY,UACd,OAAO,CAAC;CAGV,IAAI,YAAY,OAAO;EACrB,MAAM,gBAAgB,iBAAiB,SAAS,UAAU,UAAU;EACpE,IAAI,kBAAkB,sBAAsB,IAC1C,OAAO,EAAE,gBAAgB,KAAK;EAEhC,IAAI,kBAAkB,sBAAsB,IAC1C,OAAO;GACL,iBAAiB,QAAA,yBAAwB,KAAK,GAAG,EAAE;GACnD,gBAAgB;EAClB;EAEF,OAAO;CACT;CAEA,IAAI,wBAAwB,KAAK,OAAO,GACtC,OAAO;CAGT,MAAM,QAAQ,qBAAqB,KAAK,OAAO;CAC/C,IAAI,CAAC,OAAO,UAAU,kBAAkB,SACtC,OAAO;CAGT,MAAM,EAAE,QAAQ,OAAO,UAAU,MAAM;CACvC,MAAM,eAAe,mBAAmB,KAAK,aAAa,CAAC,EAAE,QAAQ;CACrE,MAAM,kBAAkB,UAAU;CAClC,IAAI,gBAAgB;CACpB,IAAI,iBACF,gBAAgB,MAAM,OAAO,OAAO,eAAe,EAAE;MAChD,IACL,eAAe,yBAAyB,MACxC,eAAe,sBAAsB,IAErC,gBAAgB,MAAM,OAAO,OAAO,GAAG,EAAE;CAE3C,MAAM,mBAAmB,QACrB,MAAM,MAAM,mBACZ;CACJ,OAAO,EACL,iBAAiB,KAAK,gBAAgB,QAAQ,iBAAiB,GACjE;AACF;AAEA,SAAS,gCACP,SACA,SACA,SACA,UACA,SACA,YACA,eACA,SAC0B;CAC1B,MAAM,iBAAiB,kBACrB,SACA,SACA,UACA,YAAY,YACZ,aACF;CACA,IAAI,CAAC,gBACH,OAAO;CAGT,MAAM,qBAAqB,cACzB,SACA,UACA,eACA,OACF;CACA,IAAI,CAAC,oBACH,OAAO;CAGT,MAAM,0BACJ,mBAAmB,gBAAgB;CACrC,OAAO;EACL,GAAG,iBAAiB,SAAS,SAAS,oBAAoB,OAAO;EACjE,cAAc;EACd,eAAe;EACf,eAAe;EACf,gBAAgB;EAChB,GAAG;CACL;AACF;AAEA,SAAS,iBACP,MACA,UACA,SACA,cACmB;CACnB,MAAM,YAAY,oBAAoB,QAAQ;CAC9C,MAAM,UAAU,aAAa,SAAS;CACtC,MAAM,EAAE,MAAM,SAAS,SAAS,kBAAkB,sBAAsB,KACtE,KAAK,KAAK,CACZ,CAAC,CAAE;CACH,MAAM,iBAAiB,QAAQ,QAAQ,GAAG;CAC1C,MAAM,UAAU,QAAQ,UAAU,GAAG,cAAc;CACnD,MAAM,WAAW,QAAQ,UAAU,iBAAiB,CAAC;CACrD,MAAM,UAAU,aACd,eACA,SAAS,SAAS,IAAI,YAAY,CAAC,CACrC;CACA,MAAM,aACJ,YAAY,OACR,OACA,cAAc,SAAS,UAAU,SAAS,OAAO;CACvD,MAAM,aAAa,iBAAiB,SAAS,SAAS,YAAY,OAAO;CACzE,MAAM,gBAAgB,eAClB,iBAAiB,cAAc,WAAW,OAAO,IACjD,KAAA;CAEJ,IAAI,YAAY,QAAQ,eAAe;EACrC,MAAM,qBAAqB,gCACzB,SACA,SACA,SACA,UACA,SACA,YACA,eACA,OACF;EACA,IAAI,oBACF,OAAO;CAEX;CAEA,IAAI,eACF,OAAO;EAAE,GAAG;EAAY;CAAc;CAExC,OAAO;AACT;AAEA,SAAS,qBACP,QACoB;CACpB,IAAI,aAAa,QACf,OAAO,OAAO;AAGlB;AAEA,SAAS,iBACP,MACA,SACA,QACA,SACgB;CAChB,IAAI,YAAY,MACd,OAAO;EACL,SAAS;EACT;EACA,YAAY;CACd;CAEF,IAAI,WAAW,MACb,OAAO;EACL,SAAS;EACT;EACA,YAAY;CACd;CAGF,OAAO;EACL;EACA,cAAc;EACd,GAAG;EAEH,SAAS,qBAAqB,MAAM,KAAK;CAC3C;AACF"}

package/dist/modules/manager/npm/artifacts.js

@@ -37,7 +37,9 @@ async function getYarnBerryHash(version) {
 */
 async function handlePackageManagerUpdates(updateArtifactsConfig) {
 	const { packageFileName, updatedDeps, newPackageFileContent } = updateArtifactsConfig;
-	const packageManagerUpdates = updatedDeps.filter((dep) => (dep.depType === "packageManager" || dep.depType === "devEngines.packageManager") && dep.currentValue && regEx(versionWithHashRegString).test(dep.currentValue));
+	const packageManagerUpdates = updatedDeps.filter((dep) => {
+		return (dep.depType === "packageManager" || dep.depType === "devEngines.packageManager") && dep.currentValue && regEx(versionWithHashRegString).test(dep.currentValue);
+	});
 	let newContent = newPackageFileContent;
 	for (const packageManagerUpdate of packageManagerUpdates) {
 		const { depName, packageName, newVersion, newDigest } = packageManagerUpdate;

package/dist/modules/manager/npm/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/npm/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isNonEmptyObject, isString } from '@sindresorhus/is';\nimport upath from 'upath';\nimport type { Scalar, YAMLSeq } from 'yaml';\nimport { isScalar, isSeq, parseDocument } from 'yaml';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { matchRegexOrGlob } from '../../../util/string-match.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport type { NpmManagerData } from './types.ts';\nimport { updateDependency } from './update/dependency/index.ts';\n\n// eg. 8.15.5+sha256.4b4efa12490e5055d59b9b9fc9438b7d581a6b7af3b5675eb5c5f447cee1a589\nconst versionWithHashRegString = '^(?<version>.*)\\\\+(?<hash>.*)';\n\n// Matches a Subresource Integrity string, eg. sha512-<base64 digest>\nconst sriRegString = '^(?<algo>sha\\\\d+)-(?<hash>[A-Za-z0-9+/]+={0,2})$';\n\nconst http = new Http('npm');\n\nconst packageManagerFieldRegString = '(\"packageManager\"\\\\s*:\\\\s*\")[^\"]*\"';\n\nexport async function updateArtifacts(\n  updateArtifactsConfig: UpdateArtifact<NpmManagerData>,\n): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`npm.updateArtifacts(${updateArtifactsConfig.packageFileName})`);\n  let res: UpdateArtifactsResult[] = [];\n  res.push(\n    coerceObject(await handlePackageManagerUpdates(updateArtifactsConfig)),\n  );\n  res.push(coerceObject(await updatePnpmWorkspace(updateArtifactsConfig)));\n\n  res = res.filter(isNonEmptyObject);\n  if (res.length === 0) {\n    return null;\n  }\n\n  return res;\n}\n\n/**\n * Corepack hashes `yarn.js` for yarn berry instead of the npm tarball, so the registry integrity can't be used.\n * @see https://github.com/nodejs/corepack/blob/d4dcb1f89741603e776bba9d457425750fa26987/config.json#L152-L171\n */\nasync function getYarnBerryHash(version: string): Promise<string> {\n  const url = `https://repo.yarnpkg.com/${version}/packages/yarnpkg-cli/bin/yarn.js`;\n  return `sha512.${await hashStream(http.stream(url))}`;\n}\n\n/**\n * Updates corepack hashes in `packageManager` and `devEngines.packageManager` from the new version's integrity digest.\n * @see https://github.com/nodejs/corepack/blob/57bfb67b062ea1b8746b302bcdbf9f8e8438c526/sources/corepackUtils.ts#L300\n */\nasync function handlePackageManagerUpdates(\n  updateArtifactsConfig: UpdateArtifact<NpmManagerData>,\n): Promise<UpdateArtifactsResult | null> {\n  const { packageFileName, updatedDeps, newPackageFileContent } =\n    updateArtifactsConfig;\n  const packageManagerUpdates = updatedDeps.filter(\n    (dep) =>\n      (dep.depType === 'packageManager' ||\n        dep.depType === 'devEngines.packageManager') &&\n      dep.currentValue &&\n      regEx(versionWithHashRegString).test(dep.currentValue),\n  );\n\n  let newContent = newPackageFileContent;\n  for (const packageManagerUpdate of packageManagerUpdates) {\n    const { depName, packageName, newVersion, newDigest } =\n      packageManagerUpdate;\n    let corepackHash: string;\n    if (packageName === '@yarnpkg/cli-dist' && newVersion) {\n      try {\n        corepackHash = await getYarnBerryHash(newVersion);\n      } catch (err) {\n        logger.warn(\n          { err, packageFileName, depName, newVersion },\n          'Cannot update packageManager hash: failed to download yarn.js',\n        );\n        return {\n          artifactError: {\n            fileName: packageFileName,\n            stderr: `Cannot update packageManager hash for ${depName}@${newVersion}: failed to download yarn.js`,\n          },\n        };\n      }\n    } else {\n      const sriMatch = regEx(sriRegString).exec(newDigest ?? '');\n      if (!sriMatch?.groups) {\n        logger.warn(\n          { packageFileName, depName, newVersion, newDigest },\n          'Cannot update packageManager hash: no valid digest available',\n        );\n        return {\n          artifactError: {\n            fileName: packageFileName,\n            stderr: `Cannot update packageManager hash for ${depName}@${newVersion}: no valid digest available`,\n          },\n        };\n      }\n\n      const { algo, hash } = sriMatch.groups;\n      corepackHash = `${algo}.${Buffer.from(hash, 'base64').toString('hex')}`;\n    }\n    const versionWithHash = `${newVersion}+${corepackHash}`;\n\n    if (packageManagerUpdate.depType === 'packageManager') {\n      newContent = newContent.replace(\n        regEx(packageManagerFieldRegString),\n        `$1${depName}@${versionWithHash}\"`,\n      );\n    } else {\n      const updatedContent = updateDependency({\n        fileContent: newContent,\n        packageFile: packageFileName,\n        upgrade: { ...packageManagerUpdate, newValue: versionWithHash },\n      });\n      if (!updatedContent) {\n        return {\n          artifactError: {\n            fileName: packageFileName,\n            stderr: `Failed to apply Corepack hash for ${depName}@${newVersion}`,\n          },\n        };\n      }\n      newContent = updatedContent;\n    }\n  }\n\n  if (newContent === newPackageFileContent) {\n    return null;\n  }\n\n  logger.debug('Returning updated package.json');\n  return {\n    file: {\n      type: 'addition',\n      path: packageFileName,\n      contents: newContent,\n    },\n  };\n}\n\n/**\n * Update the minimumReleaseAgeExclude setting in pnpm-workspace.yaml if needed\n */\nasync function updatePnpmWorkspace(\n  updateArtifactsConfig: UpdateArtifact<NpmManagerData>,\n): Promise<UpdateArtifactsResult | null> {\n  const upgrades = updateArtifactsConfig.updatedDeps.filter(\n    (u) => u.isVulnerabilityAlert,\n  );\n  // return early if no security updates are present\n  if (isEmptyArray(upgrades)) {\n    return null;\n  }\n\n  const pnpmLockFile = upgrades[0].managerData?.pnpmLockFile;\n  if (!isString(pnpmLockFile)) {\n    logger.debug(\n      'No pnpm shrinkwrap found, not attempting to update pnpm-workspace.yaml',\n    );\n    return null;\n  }\n  const lockFileDir = upath.dirname(pnpmLockFile);\n  const pnpmWorkspaceFilePath = upath.join(lockFileDir, 'pnpm-workspace.yaml');\n\n  if (!(await localPathExists(pnpmWorkspaceFilePath))) {\n    return null;\n  }\n\n  // use already-updated content when updating the workspace file itself\n  const packageFileContent =\n    updateArtifactsConfig.packageFileName === pnpmWorkspaceFilePath\n      ? updateArtifactsConfig.newPackageFileContent\n      : (await readLocalFile(pnpmWorkspaceFilePath, 'utf8'))!;\n  const doc = parseDocument(packageFileContent);\n\n  if (!doc.get('minimumReleaseAge')) {\n    return null;\n  }\n\n  let updated = false;\n\n  for (const upgrade of upgrades) {\n    let excludeNode = doc.getIn(['minimumReleaseAgeExclude']) as YAMLSeq | null;\n    // v8 ignore next -- TODO: add test #40625\n    const newVersion = upgrade.newVersion ?? upgrade.newValue;\n    // For pnpm overrides with range selectors (e.g. \"pkg@<=1.0.0\"), depName contains\n    // the full key including the selector. Use packageName (bare package name) for\n    // minimumReleaseAgeExclude entries which require exact versions only.\n    const excludeDepName = upgrade.packageName ?? upgrade.depName;\n\n    /* v8 ignore if -- should not happen, adding for type narrowing*/\n    if (excludeNode && !isSeq(excludeNode)) {\n      return null;\n    }\n\n    if (!excludeNode) {\n      logger.debug('Adding new exclude block');\n      excludeNode = doc.createNode([]);\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      excludeNode.items.push(newItem);\n      doc.set('minimumReleaseAgeExclude', excludeNode);\n      updated = true;\n      continue;\n    }\n\n    const {\n      item: matchedItem,\n      allExcluded,\n      malformed,\n    } = getMatchedItem(excludeDepName!, excludeNode.items);\n\n    if (allExcluded) {\n      // still clean up any malformed entries even when a wildcard covers the package\n    } else if (malformed && isScalar<string>(matchedItem)) {\n      logger.debug(\n        { entry: matchedItem.value, excludeDepName, newVersion },\n        'Replacing malformed minimumReleaseAgeExclude entry',\n      );\n      matchedItem.value = `${excludeDepName}@${newVersion}`;\n      matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      updated = true;\n    } else if (isScalar<string>(matchedItem)) {\n      // if we have a comment before the list, which includes the dependency\n      if (excludeNode?.commentBefore?.includes(`${excludeDepName}@`)) {\n        // and it doesn't already have the version included in it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            excludeNode.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // then append it\n\n          // normalize value (no quote handling needed)\n          excludeNode.commentBefore = `${excludeNode.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      }\n      // otherwise, if it's in our matched item's comment\n      else if (matchedItem.commentBefore) {\n        // add it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            matchedItem.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // normalize value (no quote handling needed)\n          matchedItem.commentBefore = `${matchedItem.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      } else {\n        matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n        updated = true;\n      }\n\n      if (\n        !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n          matchedItem.value,\n          excludeDepName,\n          newVersion,\n        )\n      ) {\n        matchedItem.value = `${matchedItem.value} || ${newVersion}`;\n        updated = true;\n      }\n    } else {\n      // add new entry\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n\n      excludeNode.items.push(newItem);\n      updated = true;\n    }\n\n    // Remove any malformed entries for the same package left over from the prior bug\n    for (let i = excludeNode.items.length - 1; i >= 0; i--) {\n      const item = excludeNode.items[i];\n      if (\n        item !== matchedItem &&\n        isScalar(item) &&\n        isString(item.value) &&\n        item.value.startsWith(`${excludeDepName}@`) &&\n        !isValidMinimumReleaseAgeExcludeEntry(item.value, excludeDepName!)\n      ) {\n        excludeNode.items.splice(i, 1);\n        updated = true;\n      }\n    }\n  }\n\n  if (!updated) {\n    return null;\n  }\n\n  const newContent = doc.toString();\n  await writeLocalFile(pnpmWorkspaceFilePath, newContent);\n\n  return {\n    file: {\n      type: 'addition',\n      path: pnpmWorkspaceFilePath,\n      contents: newContent,\n    },\n  };\n}\n\nfunction getMatchedItem(\n  depName: string,\n  items: unknown[],\n): {\n  item: Scalar | null;\n  allExcluded: boolean;\n  malformed?: boolean;\n} {\n  let malformedItem: Scalar | null = null;\n\n  for (const item of items) {\n    /* v8 ignore if -- should not happen */\n    if (!isScalar(item) || !isString(item.value)) {\n      continue;\n    }\n\n    if (item.value.startsWith(`${depName}@`)) {\n      if (isValidMinimumReleaseAgeExcludeEntry(item.value, depName)) {\n        return {\n          allExcluded: false,\n          item,\n        };\n      }\n      malformedItem ??= item;\n      continue;\n    }\n\n    if (item.value === depName || matchRegexOrGlob(depName, item.value)) {\n      return {\n        allExcluded: true,\n        item,\n      };\n    }\n  }\n\n  if (malformedItem) {\n    return {\n      allExcluded: false,\n      item: malformedItem,\n      malformed: true,\n    };\n  }\n\n  return {\n    item: null,\n    allExcluded: false,\n  };\n}\n\n/** pnpm requires package@version entries without range selectors or extra @ in the version part */\nfunction isValidMinimumReleaseAgeExcludeEntry(\n  value: string,\n  packageName: string,\n): boolean {\n  return !value.slice(`${packageName}@`.length).includes('@');\n}\n\n/** determine whether a comment or a list item contains the depName at a given newVersion */\nfunction minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n  line: string,\n  depName: string | undefined,\n  newVersion: string | undefined,\n): boolean {\n  if (line.includes(`${depName}@${newVersion}`)) {\n    return true;\n  }\n\n  if (line.includes(`|| ${newVersion}`)) {\n    return true;\n  }\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,MAAM,2BAA2B;AAGjC,MAAM,eAAe;AAErB,MAAM,OAAO,IAAI,KAAK,KAAK;AAE3B,MAAM,+BAA+B;AAErC,eAAsB,gBACpB,uBACyC;CACzC,OAAO,MAAM,uBAAuB,sBAAsB,gBAAgB,EAAE;CAC5E,IAAI,MAA+B,CAAC;CACpC,IAAI,KACF,aAAa,MAAM,4BAA4B,qBAAqB,CAAC,CACvE;CACA,IAAI,KAAK,aAAa,MAAM,oBAAoB,qBAAqB,CAAC,CAAC;CAEvE,MAAM,IAAI,OAAO,gBAAgB;CACjC,IAAI,IAAI,WAAW,GACjB,OAAO;CAGT,OAAO;AACT;;;;;AAMA,eAAe,iBAAiB,SAAkC;CAChE,MAAM,MAAM,4BAA4B,QAAQ;CAChD,OAAO,UAAU,MAAM,WAAW,KAAK,OAAO,GAAG,CAAC;AACpD;;;;;AAMA,eAAe,4BACb,uBACuC;CACvC,MAAM,EAAE,iBAAiB,aAAa,0BACpC;CACF,MAAM,wBAAwB,YAAY,QACvC,SACE,IAAI,YAAY,oBACf,IAAI,YAAY,gCAClB,IAAI,gBACJ,MAAM,wBAAwB,CAAC,CAAC,KAAK,IAAI,YAAY,CACzD;CAEA,IAAI,aAAa;CACjB,KAAK,MAAM,wBAAwB,uBAAuB;EACxD,MAAM,EAAE,SAAS,aAAa,YAAY,cACxC;EACF,IAAI;EACJ,IAAI,gBAAgB,uBAAuB,YACzC,IAAI;GACF,eAAe,MAAM,iBAAiB,UAAU;EAClD,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;IAAiB;IAAS;GAAW,GAC5C,+DACF;GACA,OAAO,EACL,eAAe;IACb,UAAU;IACV,QAAQ,yCAAyC,QAAQ,GAAG,WAAW;GACzE,EACF;EACF;OACK;GACL,MAAM,WAAW,MAAM,YAAY,CAAC,CAAC,KAAK,aAAa,EAAE;GACzD,IAAI,CAAC,UAAU,QAAQ;IACrB,OAAO,KACL;KAAE;KAAiB;KAAS;KAAY;IAAU,GAClD,8DACF;IACA,OAAO,EACL,eAAe;KACb,UAAU;KACV,QAAQ,yCAAyC,QAAQ,GAAG,WAAW;IACzE,EACF;GACF;GAEA,MAAM,EAAE,MAAM,SAAS,SAAS;GAChC,eAAe,GAAG,KAAK,GAAG,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,SAAS,KAAK;EACtE;EACA,MAAM,kBAAkB,GAAG,WAAW,GAAG;EAEzC,IAAI,qBAAqB,YAAY,kBACnC,aAAa,WAAW,QACtB,MAAM,4BAA4B,GAClC,KAAK,QAAQ,GAAG,gBAAgB,EAClC;OACK;GACL,MAAM,iBAAiB,iBAAiB;IACtC,aAAa;IACb,aAAa;IACb,SAAS;KAAE,GAAG;KAAsB,UAAU;IAAgB;GAChE,CAAC;GACD,IAAI,CAAC,gBACH,OAAO,EACL,eAAe;IACb,UAAU;IACV,QAAQ,qCAAqC,QAAQ,GAAG;GAC1D,EACF;GAEF,aAAa;EACf;CACF;CAEA,IAAI,eAAe,uBACjB,OAAO;CAGT,OAAO,MAAM,gCAAgC;CAC7C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF;AACF;;;;AAKA,eAAe,oBACb,uBACuC;CACvC,MAAM,WAAW,sBAAsB,YAAY,QAChD,MAAM,EAAE,oBACX;CAEA,IAAI,aAAa,QAAQ,GACvB,OAAO;CAGT,MAAM,eAAe,SAAS,EAAE,CAAC,aAAa;CAC9C,IAAI,CAAC,SAAS,YAAY,GAAG;EAC3B,OAAO,MACL,wEACF;EACA,OAAO;CACT;CACA,MAAM,cAAc,MAAM,QAAQ,YAAY;CAC9C,MAAM,wBAAwB,MAAM,KAAK,aAAa,qBAAqB;CAE3E,IAAI,CAAE,MAAM,gBAAgB,qBAAqB,GAC/C,OAAO;CAIT,MAAM,qBACJ,sBAAsB,oBAAoB,wBACtC,sBAAsB,wBACrB,MAAM,cAAc,uBAAuB,MAAM;CACxD,MAAM,MAAM,cAAc,kBAAkB;CAE5C,IAAI,CAAC,IAAI,IAAI,mBAAmB,GAC9B,OAAO;CAGT,IAAI,UAAU;CAEd,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,cAAc,IAAI,MAAM,CAAC,0BAA0B,CAAC;;EAExD,MAAM,aAAa,QAAQ,cAAc,QAAQ;EAIjD,MAAM,iBAAiB,QAAQ,eAAe,QAAQ;;EAGtD,IAAI,eAAe,CAAC,MAAM,WAAW,GACnC,OAAO;EAGT,IAAI,CAAC,aAAa;GAChB,OAAO,MAAM,0BAA0B;GACvC,cAAc,IAAI,WAAW,CAAC,CAAC;GAC/B,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GACxE,YAAY,MAAM,KAAK,OAAO;GAC9B,IAAI,IAAI,4BAA4B,WAAW;GAC/C,UAAU;GACV;EACF;EAEA,MAAM,EACJ,MAAM,aACN,aACA,cACE,eAAe,gBAAiB,YAAY,KAAK;EAErD,IAAI,aAAa,CAEjB,OAAO,IAAI,aAAa,SAAiB,WAAW,GAAG;GACrD,OAAO,MACL;IAAE,OAAO,YAAY;IAAO;IAAgB;GAAW,GACvD,oDACF;GACA,YAAY,QAAQ,GAAG,eAAe,GAAG;GACzC,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;GAC5E,UAAU;EACZ,OAAO,IAAI,SAAiB,WAAW,GAAG;GAExC,IAAI,aAAa,eAAe,SAAS,GAAG,eAAe,EAAE,GAGzD;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAIA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UAGG,IAAI,YAAY,eAGjB;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAEA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UACK;IACL,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;IAC5E,UAAU;GACZ;GAEA,IACE,CAAC,kDACC,YAAY,OACZ,gBACA,UACF,GACA;IACA,YAAY,QAAQ,GAAG,YAAY,MAAM,MAAM;IAC/C,UAAU;GACZ;EACF,OAAO;GAEL,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GAExE,YAAY,MAAM,KAAK,OAAO;GAC9B,UAAU;EACZ;EAGA,KAAK,IAAI,IAAI,YAAY,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;GACtD,MAAM,OAAO,YAAY,MAAM;GAC/B,IACE,SAAS,eACT,SAAS,IAAI,KACb,SAAS,KAAK,KAAK,KACnB,KAAK,MAAM,WAAW,GAAG,eAAe,EAAE,KAC1C,CAAC,qCAAqC,KAAK,OAAO,cAAe,GACjE;IACA,YAAY,MAAM,OAAO,GAAG,CAAC;IAC7B,UAAU;GACZ;EACF;CACF;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,aAAa,IAAI,SAAS;CAChC,MAAM,eAAe,uBAAuB,UAAU;CAEtD,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF;AACF;AAEA,SAAS,eACP,SACA,OAKA;CACA,IAAI,gBAA+B;CAEnC,KAAK,MAAM,QAAQ,OAAO;;EAExB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,GACzC;EAGF,IAAI,KAAK,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG;GACxC,IAAI,qCAAqC,KAAK,OAAO,OAAO,GAC1D,OAAO;IACL,aAAa;IACb;GACF;GAEF,kBAAkB;GAClB;EACF;EAEA,IAAI,KAAK,UAAU,WAAW,iBAAiB,SAAS,KAAK,KAAK,GAChE,OAAO;GACL,aAAa;GACb;EACF;CAEJ;CAEA,IAAI,eACF,OAAO;EACL,aAAa;EACb,MAAM;EACN,WAAW;CACb;CAGF,OAAO;EACL,MAAM;EACN,aAAa;CACf;AACF;;AAGA,SAAS,qCACP,OACA,aACS;CACT,OAAO,CAAC,MAAM,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC,SAAS,GAAG;AAC5D;;AAGA,SAAS,kDACP,MACA,SACA,YACS;CACT,IAAI,KAAK,SAAS,GAAG,QAAQ,GAAG,YAAY,GAC1C,OAAO;CAGT,IAAI,KAAK,SAAS,MAAM,YAAY,GAClC,OAAO;CAGT,OAAO;AACT"}
+{"version":3,"file":"artifacts.js","names":[],"sources":["../../../../lib/modules/manager/npm/artifacts.ts"],"sourcesContent":["import { isEmptyArray, isNonEmptyObject, isString } from '@sindresorhus/is';\nimport upath from 'upath';\nimport type { Scalar, YAMLSeq } from 'yaml';\nimport { isScalar, isSeq, parseDocument } from 'yaml';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  localPathExists,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../util/fs/index.ts';\nimport { hashStream } from '../../../util/hash.ts';\nimport { Http } from '../../../util/http/index.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { matchRegexOrGlob } from '../../../util/string-match.ts';\nimport type { UpdateArtifact, UpdateArtifactsResult } from '../types.ts';\nimport type { NpmManagerData } from './types.ts';\nimport { updateDependency } from './update/dependency/index.ts';\n\n// eg. 8.15.5+sha256.4b4efa12490e5055d59b9b9fc9438b7d581a6b7af3b5675eb5c5f447cee1a589\nconst versionWithHashRegString = '^(?<version>.*)\\\\+(?<hash>.*)';\n\n// Matches a Subresource Integrity string, eg. sha512-<base64 digest>\nconst sriRegString = '^(?<algo>sha\\\\d+)-(?<hash>[A-Za-z0-9+/]+={0,2})$';\n\nconst http = new Http('npm');\n\nconst packageManagerFieldRegString = '(\"packageManager\"\\\\s*:\\\\s*\")[^\"]*\"';\n\nexport async function updateArtifacts(\n  updateArtifactsConfig: UpdateArtifact<NpmManagerData>,\n): Promise<UpdateArtifactsResult[] | null> {\n  logger.debug(`npm.updateArtifacts(${updateArtifactsConfig.packageFileName})`);\n  let res: UpdateArtifactsResult[] = [];\n  res.push(\n    coerceObject(await handlePackageManagerUpdates(updateArtifactsConfig)),\n  );\n  res.push(coerceObject(await updatePnpmWorkspace(updateArtifactsConfig)));\n\n  res = res.filter(isNonEmptyObject);\n  if (res.length === 0) {\n    return null;\n  }\n\n  return res;\n}\n\n/**\n * Corepack hashes `yarn.js` for yarn berry instead of the npm tarball, so the registry integrity can't be used.\n * @see https://github.com/nodejs/corepack/blob/d4dcb1f89741603e776bba9d457425750fa26987/config.json#L152-L171\n */\nasync function getYarnBerryHash(version: string): Promise<string> {\n  const url = `https://repo.yarnpkg.com/${version}/packages/yarnpkg-cli/bin/yarn.js`;\n  return `sha512.${await hashStream(http.stream(url))}`;\n}\n\n/**\n * Updates corepack hashes in `packageManager` and `devEngines.packageManager` from the new version's integrity digest.\n * @see https://github.com/nodejs/corepack/blob/57bfb67b062ea1b8746b302bcdbf9f8e8438c526/sources/corepackUtils.ts#L300\n */\nasync function handlePackageManagerUpdates(\n  updateArtifactsConfig: UpdateArtifact<NpmManagerData>,\n): Promise<UpdateArtifactsResult | null> {\n  const { packageFileName, updatedDeps, newPackageFileContent } =\n    updateArtifactsConfig;\n  const packageManagerUpdates = updatedDeps.filter((dep) => {\n    const isPackageManager =\n      dep.depType === 'packageManager' ||\n      dep.depType === 'devEngines.packageManager';\n    return (\n      isPackageManager &&\n      dep.currentValue &&\n      regEx(versionWithHashRegString).test(dep.currentValue)\n    );\n  });\n\n  let newContent = newPackageFileContent;\n  for (const packageManagerUpdate of packageManagerUpdates) {\n    const { depName, packageName, newVersion, newDigest } =\n      packageManagerUpdate;\n    let corepackHash: string;\n    if (packageName === '@yarnpkg/cli-dist' && newVersion) {\n      try {\n        corepackHash = await getYarnBerryHash(newVersion);\n      } catch (err) {\n        logger.warn(\n          { err, packageFileName, depName, newVersion },\n          'Cannot update packageManager hash: failed to download yarn.js',\n        );\n        return {\n          artifactError: {\n            fileName: packageFileName,\n            stderr: `Cannot update packageManager hash for ${depName}@${newVersion}: failed to download yarn.js`,\n          },\n        };\n      }\n    } else {\n      const sriMatch = regEx(sriRegString).exec(newDigest ?? '');\n      if (!sriMatch?.groups) {\n        logger.warn(\n          { packageFileName, depName, newVersion, newDigest },\n          'Cannot update packageManager hash: no valid digest available',\n        );\n        return {\n          artifactError: {\n            fileName: packageFileName,\n            stderr: `Cannot update packageManager hash for ${depName}@${newVersion}: no valid digest available`,\n          },\n        };\n      }\n\n      const { algo, hash } = sriMatch.groups;\n      corepackHash = `${algo}.${Buffer.from(hash, 'base64').toString('hex')}`;\n    }\n    const versionWithHash = `${newVersion}+${corepackHash}`;\n\n    if (packageManagerUpdate.depType === 'packageManager') {\n      newContent = newContent.replace(\n        regEx(packageManagerFieldRegString),\n        `$1${depName}@${versionWithHash}\"`,\n      );\n    } else {\n      const updatedContent = updateDependency({\n        fileContent: newContent,\n        packageFile: packageFileName,\n        upgrade: { ...packageManagerUpdate, newValue: versionWithHash },\n      });\n      if (!updatedContent) {\n        return {\n          artifactError: {\n            fileName: packageFileName,\n            stderr: `Failed to apply Corepack hash for ${depName}@${newVersion}`,\n          },\n        };\n      }\n      newContent = updatedContent;\n    }\n  }\n\n  if (newContent === newPackageFileContent) {\n    return null;\n  }\n\n  logger.debug('Returning updated package.json');\n  return {\n    file: {\n      type: 'addition',\n      path: packageFileName,\n      contents: newContent,\n    },\n  };\n}\n\n/**\n * Update the minimumReleaseAgeExclude setting in pnpm-workspace.yaml if needed\n */\nasync function updatePnpmWorkspace(\n  updateArtifactsConfig: UpdateArtifact<NpmManagerData>,\n): Promise<UpdateArtifactsResult | null> {\n  const upgrades = updateArtifactsConfig.updatedDeps.filter(\n    (u) => u.isVulnerabilityAlert,\n  );\n  // return early if no security updates are present\n  if (isEmptyArray(upgrades)) {\n    return null;\n  }\n\n  const pnpmLockFile = upgrades[0].managerData?.pnpmLockFile;\n  if (!isString(pnpmLockFile)) {\n    logger.debug(\n      'No pnpm shrinkwrap found, not attempting to update pnpm-workspace.yaml',\n    );\n    return null;\n  }\n  const lockFileDir = upath.dirname(pnpmLockFile);\n  const pnpmWorkspaceFilePath = upath.join(lockFileDir, 'pnpm-workspace.yaml');\n\n  if (!(await localPathExists(pnpmWorkspaceFilePath))) {\n    return null;\n  }\n\n  // use already-updated content when updating the workspace file itself\n  const packageFileContent =\n    updateArtifactsConfig.packageFileName === pnpmWorkspaceFilePath\n      ? updateArtifactsConfig.newPackageFileContent\n      : (await readLocalFile(pnpmWorkspaceFilePath, 'utf8'))!;\n  const doc = parseDocument(packageFileContent);\n\n  if (!doc.get('minimumReleaseAge')) {\n    return null;\n  }\n\n  let updated = false;\n\n  for (const upgrade of upgrades) {\n    let excludeNode = doc.getIn(['minimumReleaseAgeExclude']) as YAMLSeq | null;\n    // v8 ignore next -- TODO: add test #40625\n    const newVersion = upgrade.newVersion ?? upgrade.newValue;\n    // For pnpm overrides with range selectors (e.g. \"pkg@<=1.0.0\"), depName contains\n    // the full key including the selector. Use packageName (bare package name) for\n    // minimumReleaseAgeExclude entries which require exact versions only.\n    const excludeDepName = upgrade.packageName ?? upgrade.depName;\n\n    /* v8 ignore if -- should not happen, adding for type narrowing*/\n    if (excludeNode && !isSeq(excludeNode)) {\n      return null;\n    }\n\n    if (!excludeNode) {\n      logger.debug('Adding new exclude block');\n      excludeNode = doc.createNode([]);\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      excludeNode.items.push(newItem);\n      doc.set('minimumReleaseAgeExclude', excludeNode);\n      updated = true;\n      continue;\n    }\n\n    const {\n      item: matchedItem,\n      allExcluded,\n      malformed,\n    } = getMatchedItem(excludeDepName!, excludeNode.items);\n\n    if (allExcluded) {\n      // still clean up any malformed entries even when a wildcard covers the package\n    } else if (malformed && isScalar<string>(matchedItem)) {\n      logger.debug(\n        { entry: matchedItem.value, excludeDepName, newVersion },\n        'Replacing malformed minimumReleaseAgeExclude entry',\n      );\n      matchedItem.value = `${excludeDepName}@${newVersion}`;\n      matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n      updated = true;\n    } else if (isScalar<string>(matchedItem)) {\n      // if we have a comment before the list, which includes the dependency\n      if (excludeNode?.commentBefore?.includes(`${excludeDepName}@`)) {\n        // and it doesn't already have the version included in it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            excludeNode.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // then append it\n\n          // normalize value (no quote handling needed)\n          excludeNode.commentBefore = `${excludeNode.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      }\n      // otherwise, if it's in our matched item's comment\n      else if (matchedItem.commentBefore) {\n        // add it\n        if (\n          !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n            matchedItem.commentBefore,\n            excludeDepName,\n            newVersion,\n          )\n        ) {\n          // normalize value (no quote handling needed)\n          matchedItem.commentBefore = `${matchedItem.commentBefore} || ${newVersion}`;\n          updated = true;\n        }\n      } else {\n        matchedItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n        updated = true;\n      }\n\n      if (\n        !minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n          matchedItem.value,\n          excludeDepName,\n          newVersion,\n        )\n      ) {\n        matchedItem.value = `${matchedItem.value} || ${newVersion}`;\n        updated = true;\n      }\n    } else {\n      // add new entry\n      const newItem = doc.createNode(`${excludeDepName}@${newVersion}`);\n      newItem.commentBefore = ` Renovate security update: ${excludeDepName}@${newVersion}`;\n\n      excludeNode.items.push(newItem);\n      updated = true;\n    }\n\n    // Remove any malformed entries for the same package left over from the prior bug\n    for (let i = excludeNode.items.length - 1; i >= 0; i--) {\n      const item = excludeNode.items[i];\n      if (\n        item !== matchedItem &&\n        isScalar(item) &&\n        isString(item.value) &&\n        item.value.startsWith(`${excludeDepName}@`) &&\n        !isValidMinimumReleaseAgeExcludeEntry(item.value, excludeDepName!)\n      ) {\n        excludeNode.items.splice(i, 1);\n        updated = true;\n      }\n    }\n  }\n\n  if (!updated) {\n    return null;\n  }\n\n  const newContent = doc.toString();\n  await writeLocalFile(pnpmWorkspaceFilePath, newContent);\n\n  return {\n    file: {\n      type: 'addition',\n      path: pnpmWorkspaceFilePath,\n      contents: newContent,\n    },\n  };\n}\n\nfunction getMatchedItem(\n  depName: string,\n  items: unknown[],\n): {\n  item: Scalar | null;\n  allExcluded: boolean;\n  malformed?: boolean;\n} {\n  let malformedItem: Scalar | null = null;\n\n  for (const item of items) {\n    /* v8 ignore if -- should not happen */\n    if (!isScalar(item) || !isString(item.value)) {\n      continue;\n    }\n\n    if (item.value.startsWith(`${depName}@`)) {\n      if (isValidMinimumReleaseAgeExcludeEntry(item.value, depName)) {\n        return {\n          allExcluded: false,\n          item,\n        };\n      }\n      malformedItem ??= item;\n      continue;\n    }\n\n    if (item.value === depName || matchRegexOrGlob(depName, item.value)) {\n      return {\n        allExcluded: true,\n        item,\n      };\n    }\n  }\n\n  if (malformedItem) {\n    return {\n      allExcluded: false,\n      item: malformedItem,\n      malformed: true,\n    };\n  }\n\n  return {\n    item: null,\n    allExcluded: false,\n  };\n}\n\n/** pnpm requires package@version entries without range selectors or extra @ in the version part */\nfunction isValidMinimumReleaseAgeExcludeEntry(\n  value: string,\n  packageName: string,\n): boolean {\n  return !value.slice(`${packageName}@`.length).includes('@');\n}\n\n/** determine whether a comment or a list item contains the depName at a given newVersion */\nfunction minimumReleaseAgeExcludeIncludesDepNameAndVersion(\n  line: string,\n  depName: string | undefined,\n  newVersion: string | undefined,\n): boolean {\n  if (line.includes(`${depName}@${newVersion}`)) {\n    return true;\n  }\n\n  if (line.includes(`|| ${newVersion}`)) {\n    return true;\n  }\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,MAAM,2BAA2B;AAGjC,MAAM,eAAe;AAErB,MAAM,OAAO,IAAI,KAAK,KAAK;AAE3B,MAAM,+BAA+B;AAErC,eAAsB,gBACpB,uBACyC;CACzC,OAAO,MAAM,uBAAuB,sBAAsB,gBAAgB,EAAE;CAC5E,IAAI,MAA+B,CAAC;CACpC,IAAI,KACF,aAAa,MAAM,4BAA4B,qBAAqB,CAAC,CACvE;CACA,IAAI,KAAK,aAAa,MAAM,oBAAoB,qBAAqB,CAAC,CAAC;CAEvE,MAAM,IAAI,OAAO,gBAAgB;CACjC,IAAI,IAAI,WAAW,GACjB,OAAO;CAGT,OAAO;AACT;;;;;AAMA,eAAe,iBAAiB,SAAkC;CAChE,MAAM,MAAM,4BAA4B,QAAQ;CAChD,OAAO,UAAU,MAAM,WAAW,KAAK,OAAO,GAAG,CAAC;AACpD;;;;;AAMA,eAAe,4BACb,uBACuC;CACvC,MAAM,EAAE,iBAAiB,aAAa,0BACpC;CACF,MAAM,wBAAwB,YAAY,QAAQ,QAAQ;EAIxD,QAFE,IAAI,YAAY,oBAChB,IAAI,YAAY,gCAGhB,IAAI,gBACJ,MAAM,wBAAwB,CAAC,CAAC,KAAK,IAAI,YAAY;CAEzD,CAAC;CAED,IAAI,aAAa;CACjB,KAAK,MAAM,wBAAwB,uBAAuB;EACxD,MAAM,EAAE,SAAS,aAAa,YAAY,cACxC;EACF,IAAI;EACJ,IAAI,gBAAgB,uBAAuB,YACzC,IAAI;GACF,eAAe,MAAM,iBAAiB,UAAU;EAClD,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;IAAiB;IAAS;GAAW,GAC5C,+DACF;GACA,OAAO,EACL,eAAe;IACb,UAAU;IACV,QAAQ,yCAAyC,QAAQ,GAAG,WAAW;GACzE,EACF;EACF;OACK;GACL,MAAM,WAAW,MAAM,YAAY,CAAC,CAAC,KAAK,aAAa,EAAE;GACzD,IAAI,CAAC,UAAU,QAAQ;IACrB,OAAO,KACL;KAAE;KAAiB;KAAS;KAAY;IAAU,GAClD,8DACF;IACA,OAAO,EACL,eAAe;KACb,UAAU;KACV,QAAQ,yCAAyC,QAAQ,GAAG,WAAW;IACzE,EACF;GACF;GAEA,MAAM,EAAE,MAAM,SAAS,SAAS;GAChC,eAAe,GAAG,KAAK,GAAG,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,SAAS,KAAK;EACtE;EACA,MAAM,kBAAkB,GAAG,WAAW,GAAG;EAEzC,IAAI,qBAAqB,YAAY,kBACnC,aAAa,WAAW,QACtB,MAAM,4BAA4B,GAClC,KAAK,QAAQ,GAAG,gBAAgB,EAClC;OACK;GACL,MAAM,iBAAiB,iBAAiB;IACtC,aAAa;IACb,aAAa;IACb,SAAS;KAAE,GAAG;KAAsB,UAAU;IAAgB;GAChE,CAAC;GACD,IAAI,CAAC,gBACH,OAAO,EACL,eAAe;IACb,UAAU;IACV,QAAQ,qCAAqC,QAAQ,GAAG;GAC1D,EACF;GAEF,aAAa;EACf;CACF;CAEA,IAAI,eAAe,uBACjB,OAAO;CAGT,OAAO,MAAM,gCAAgC;CAC7C,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF;AACF;;;;AAKA,eAAe,oBACb,uBACuC;CACvC,MAAM,WAAW,sBAAsB,YAAY,QAChD,MAAM,EAAE,oBACX;CAEA,IAAI,aAAa,QAAQ,GACvB,OAAO;CAGT,MAAM,eAAe,SAAS,EAAE,CAAC,aAAa;CAC9C,IAAI,CAAC,SAAS,YAAY,GAAG;EAC3B,OAAO,MACL,wEACF;EACA,OAAO;CACT;CACA,MAAM,cAAc,MAAM,QAAQ,YAAY;CAC9C,MAAM,wBAAwB,MAAM,KAAK,aAAa,qBAAqB;CAE3E,IAAI,CAAE,MAAM,gBAAgB,qBAAqB,GAC/C,OAAO;CAIT,MAAM,qBACJ,sBAAsB,oBAAoB,wBACtC,sBAAsB,wBACrB,MAAM,cAAc,uBAAuB,MAAM;CACxD,MAAM,MAAM,cAAc,kBAAkB;CAE5C,IAAI,CAAC,IAAI,IAAI,mBAAmB,GAC9B,OAAO;CAGT,IAAI,UAAU;CAEd,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,cAAc,IAAI,MAAM,CAAC,0BAA0B,CAAC;;EAExD,MAAM,aAAa,QAAQ,cAAc,QAAQ;EAIjD,MAAM,iBAAiB,QAAQ,eAAe,QAAQ;;EAGtD,IAAI,eAAe,CAAC,MAAM,WAAW,GACnC,OAAO;EAGT,IAAI,CAAC,aAAa;GAChB,OAAO,MAAM,0BAA0B;GACvC,cAAc,IAAI,WAAW,CAAC,CAAC;GAC/B,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GACxE,YAAY,MAAM,KAAK,OAAO;GAC9B,IAAI,IAAI,4BAA4B,WAAW;GAC/C,UAAU;GACV;EACF;EAEA,MAAM,EACJ,MAAM,aACN,aACA,cACE,eAAe,gBAAiB,YAAY,KAAK;EAErD,IAAI,aAAa,CAEjB,OAAO,IAAI,aAAa,SAAiB,WAAW,GAAG;GACrD,OAAO,MACL;IAAE,OAAO,YAAY;IAAO;IAAgB;GAAW,GACvD,oDACF;GACA,YAAY,QAAQ,GAAG,eAAe,GAAG;GACzC,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;GAC5E,UAAU;EACZ,OAAO,IAAI,SAAiB,WAAW,GAAG;GAExC,IAAI,aAAa,eAAe,SAAS,GAAG,eAAe,EAAE,GAGzD;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAIA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UAGG,IAAI,YAAY,eAGjB;QAAA,CAAC,kDACC,YAAY,eACZ,gBACA,UACF,GACA;KAEA,YAAY,gBAAgB,GAAG,YAAY,cAAc,MAAM;KAC/D,UAAU;IACZ;UACK;IACL,YAAY,gBAAgB,8BAA8B,eAAe,GAAG;IAC5E,UAAU;GACZ;GAEA,IACE,CAAC,kDACC,YAAY,OACZ,gBACA,UACF,GACA;IACA,YAAY,QAAQ,GAAG,YAAY,MAAM,MAAM;IAC/C,UAAU;GACZ;EACF,OAAO;GAEL,MAAM,UAAU,IAAI,WAAW,GAAG,eAAe,GAAG,YAAY;GAChE,QAAQ,gBAAgB,8BAA8B,eAAe,GAAG;GAExE,YAAY,MAAM,KAAK,OAAO;GAC9B,UAAU;EACZ;EAGA,KAAK,IAAI,IAAI,YAAY,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;GACtD,MAAM,OAAO,YAAY,MAAM;GAC/B,IACE,SAAS,eACT,SAAS,IAAI,KACb,SAAS,KAAK,KAAK,KACnB,KAAK,MAAM,WAAW,GAAG,eAAe,EAAE,KAC1C,CAAC,qCAAqC,KAAK,OAAO,cAAe,GACjE;IACA,YAAY,MAAM,OAAO,GAAG,CAAC;IAC7B,UAAU;GACZ;EACF;CACF;CAEA,IAAI,CAAC,SACH,OAAO;CAGT,MAAM,aAAa,IAAI,SAAS;CAChC,MAAM,eAAe,uBAAuB,UAAU;CAEtD,OAAO,EACL,MAAM;EACJ,MAAM;EACN,MAAM;EACN,UAAU;CACZ,EACF;AACF;AAEA,SAAS,eACP,SACA,OAKA;CACA,IAAI,gBAA+B;CAEnC,KAAK,MAAM,QAAQ,OAAO;;EAExB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,GACzC;EAGF,IAAI,KAAK,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG;GACxC,IAAI,qCAAqC,KAAK,OAAO,OAAO,GAC1D,OAAO;IACL,aAAa;IACb;GACF;GAEF,kBAAkB;GAClB;EACF;EAEA,IAAI,KAAK,UAAU,WAAW,iBAAiB,SAAS,KAAK,KAAK,GAChE,OAAO;GACL,aAAa;GACb;EACF;CAEJ;CAEA,IAAI,eACF,OAAO;EACL,aAAa;EACb,MAAM;EACN,WAAW;CACb;CAGF,OAAO;EACL,MAAM;EACN,aAAa;CACf;AACF;;AAGA,SAAS,qCACP,OACA,aACS;CACT,OAAO,CAAC,MAAM,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC,SAAS,GAAG;AAC5D;;AAGA,SAAS,kDACP,MACA,SACA,YACS;CACT,IAAI,KAAK,SAAS,GAAG,QAAQ,GAAG,YAAY,GAC1C,OAAO;CAGT,IAAI,KAAK,SAAS,MAAM,YAAY,GAClC,OAAO;CAGT,OAAO;AACT"}

package/dist/modules/manager/npm/extract/common/dependency.js

@@ -173,7 +173,10 @@ function getExtractedConstraints(deps) {
 		"pnpm",
 		"vscode"
 	];
-	for (const dep of deps) if (!dep.skipReason && (dep.depType === "engines" || dep.depType === "packageManager" || dep.depType === "devEngines.runtime" || dep.depType === "devEngines.packageManager") && dep.depName && isConstraintName(dep.depName) && constraints.includes(dep.depName) && isString(dep.currentValue)) extractedConstraints[dep.depName] = dep.currentValue;
+	for (const dep of deps) {
+		const isConstraintDepType = dep.depType === "engines" || dep.depType === "packageManager" || dep.depType === "devEngines.runtime" || dep.depType === "devEngines.packageManager";
+		if (!dep.skipReason && isConstraintDepType && dep.depName && isConstraintName(dep.depName) && constraints.includes(dep.depName) && isString(dep.currentValue)) extractedConstraints[dep.depName] = dep.currentValue;
+	}
 	return extractedConstraints;
 }
 export { extractDependency, getExtractedConstraints, parseDepName };

package/dist/modules/manager/npm/extract/common/dependency.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency.js","names":[],"sources":["../../../../../../lib/modules/manager/npm/extract/common/dependency.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport validateNpmPackageName from 'validate-npm-package-name';\nimport { logger } from '../../../../../logger/index.ts';\nimport { coerceArray } from '../../../../../util/array.ts';\nimport type { ConstraintName } from '../../../../../util/exec/types.ts';\nimport { isConstraintName } from '../../../../../util/exec/types.ts';\nimport { regEx } from '../../../../../util/regex.ts';\nimport { coerceString } from '../../../../../util/string.ts';\nimport { GithubTagsDatasource } from '../../../../datasource/github-tags/index.ts';\nimport { NodeVersionDatasource } from '../../../../datasource/node-version/index.ts';\nimport { NpmDatasource } from '../../../../datasource/npm/index.ts';\nimport {\n  api,\n  isValid,\n  isVersion,\n  id as npmVersioningId,\n} from '../../../../versioning/npm/index.ts';\nimport type { PackageDependency } from '../../../types.ts';\n\nconst RE_REPOSITORY_GITHUB_SSH_FORMAT = regEx(\n  /(?:git@)github.com:(?<owner>[^/]+)\\/(?<repo>[^/]+?)(?:\\.git)?$/,\n);\n\nexport function parseDepName(depType: string, key: string): string {\n  if (depType !== 'resolutions') {\n    return key;\n  }\n\n  // Yarn selective dependency resolutions may nest a path of parent\n  // packages before the target package, e.g. `parent/child` or\n  // `@scope/parent/child`, and any segment (including the last) may carry\n  // a `@range` suffix used to disambiguate which version of that package\n  // to match, e.g. `@cypress/request/qs@~6.14.1`.\n  const parts = key.split('/');\n  const segments: string[] = [];\n  for (let i = 0; i < parts.length; i += 1) {\n    const part = parts[i];\n    if (part.startsWith('@') && i + 1 < parts.length) {\n      i += 1;\n      segments.push(`${part}/${parts[i]}`);\n    } else {\n      segments.push(part);\n    }\n  }\n\n  const lastSegment = segments.at(-1);\n  const [, depName] = coerceArray(\n    regEx(/^(?<depName>(?:@[^/]+\\/)?[^@]+)/).exec(coerceString(lastSegment)),\n  );\n  return depName;\n}\n\nexport function extractDependency(\n  depType: string,\n  depName: string,\n  input: unknown,\n): Omit<PackageDependency, 'managerData'> {\n  const dep: Omit<PackageDependency, 'managerData'> = {};\n  if (!validateNpmPackageName(depName).validForOldPackages) {\n    dep.skipReason = 'invalid-name';\n    return dep;\n  }\n  if (!isString(input)) {\n    dep.skipReason = 'invalid-value';\n    return dep;\n  }\n  dep.currentValue = input.trim();\n  if (\n    depType === 'engines' ||\n    depType === 'packageManager' ||\n    depType === 'devEngines.runtime' ||\n    depType === 'devEngines.packageManager'\n  ) {\n    if (depName === 'node') {\n      dep.datasource = NodeVersionDatasource.id;\n    } else if (depName === 'yarn') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Yarn';\n      const major =\n        isVersion(dep.currentValue) && api.getMajor(dep.currentValue);\n      if (major && major > 1) {\n        dep.packageName = '@yarnpkg/cli-dist';\n      }\n    } else if (depName === 'npm') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'npm';\n    } else if (depName === 'pnpm') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'pnpm';\n    } else if (depType === 'devEngines.runtime' && depName === 'deno') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Deno';\n    } else if (depName === 'vscode') {\n      dep.datasource = GithubTagsDatasource.id;\n      dep.packageName = 'microsoft/vscode';\n      dep.versioning = npmVersioningId;\n    } else if (depName === 'bun') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Bun';\n    } else {\n      dep.skipReason = 'unknown-engines';\n    }\n    if (!isValid(dep.currentValue)) {\n      dep.skipReason = 'unspecified-version';\n    }\n    return dep;\n  }\n\n  // support for volta\n  if (depType === 'volta') {\n    if (depName === 'node') {\n      dep.datasource = NodeVersionDatasource.id;\n    } else if (depName === 'yarn') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Yarn';\n      const major =\n        isVersion(dep.currentValue) && api.getMajor(dep.currentValue);\n      if (major && major > 1) {\n        dep.packageName = '@yarnpkg/cli-dist';\n      }\n    } else if (depName === 'npm') {\n      dep.datasource = NpmDatasource.id;\n    } else if (depName === 'pnpm') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'pnpm';\n    } else {\n      dep.skipReason = 'unknown-volta';\n    }\n    if (!isValid(dep.currentValue)) {\n      dep.skipReason = 'unspecified-version';\n    }\n    return dep;\n  }\n\n  if (dep.currentValue.startsWith('npm:')) {\n    dep.npmPackageAlias = true;\n    const valSplit = dep.currentValue.replace('npm:', '').split('@');\n    if (valSplit.length === 1) {\n      dep.packageName = depName;\n      dep.currentValue = valSplit[0];\n    } else if (valSplit.length === 2) {\n      dep.packageName = valSplit[0];\n      dep.currentValue = valSplit[1];\n    } else if (valSplit.length === 3) {\n      dep.packageName = `${valSplit[0]}@${valSplit[1]}`;\n      dep.currentValue = valSplit[2];\n    } else {\n      logger.debug(\n        `Invalid npm package alias for dependency: \"${depName}\":\"${dep.currentValue}\"`,\n      );\n    }\n  }\n  if (dep.currentValue.startsWith('file:')) {\n    dep.skipReason = 'file';\n    return dep;\n  }\n\n  if (isValid(dep.currentValue)) {\n    dep.datasource = NpmDatasource.id;\n    if (dep.currentValue === '') {\n      dep.skipReason = 'empty';\n    }\n    return dep;\n  }\n  const hashSplit = dep.currentValue.split('#');\n  if (hashSplit.length !== 2) {\n    dep.skipReason = 'unspecified-version';\n    return dep;\n  }\n  const [depNamePart, depRefPart] = hashSplit;\n\n  let githubOwnerRepo: string;\n  let githubOwner: string;\n  let githubRepo: string;\n  const matchUrlSshFormat = RE_REPOSITORY_GITHUB_SSH_FORMAT.exec(depNamePart);\n  if (matchUrlSshFormat === null) {\n    githubOwnerRepo = depNamePart\n      .replace(regEx(/^github:/), '')\n      .replace(regEx(/^git\\+/), '')\n      .replace(regEx(/^https:\\/\\/github\\.com\\//), '')\n      .replace(regEx(/\\.git$/), '');\n    const githubRepoSplit = githubOwnerRepo.split('/');\n    if (githubRepoSplit.length !== 2) {\n      dep.skipReason = 'unspecified-version';\n      return dep;\n    }\n    [githubOwner, githubRepo] = githubRepoSplit;\n  } else {\n    githubOwner = matchUrlSshFormat.groups!.owner;\n    githubRepo = matchUrlSshFormat.groups!.repo;\n    githubOwnerRepo = `${githubOwner}/${githubRepo}`;\n  }\n  // combined with the length check below, this is equivalent to\n  // /^[a-z\\d](?:[a-z\\d]|-(?=[a-z\\d])){0,38}$/i without the lookahead\n  const githubOwnerRegex = regEx(/^[a-z\\d](?:-?[a-z\\d]){0,38}$/i);\n  const githubRepoRegex = regEx(/^[a-zA-Z0-9._-]{1,100}$/);\n  if (\n    githubOwner.length > 39 ||\n    !githubOwnerRegex.test(githubOwner) ||\n    !githubRepoRegex.test(githubRepo)\n  ) {\n    dep.skipReason = 'unspecified-version';\n    return dep;\n  }\n  if (isVersion(depRefPart)) {\n    dep.currentRawValue = dep.currentValue;\n    dep.currentValue = depRefPart;\n    dep.datasource = GithubTagsDatasource.id;\n    dep.versioning = npmVersioningId;\n    dep.packageName = githubOwnerRepo;\n    dep.pinDigests = false;\n  } else if (\n    regEx(/^[0-9a-f]{7}$/).test(depRefPart) ||\n    regEx(/^[0-9a-f]{40}$/).test(depRefPart)\n  ) {\n    dep.currentRawValue = dep.currentValue;\n    dep.currentValue = null;\n    dep.currentDigest = depRefPart;\n    dep.datasource = GithubTagsDatasource.id;\n    dep.versioning = npmVersioningId;\n    dep.packageName = githubOwnerRepo;\n  } else {\n    // <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>[#<commit-ish> | #semver:<semver>]\n    // https://docs.npmjs.com/cli/v10/configuring-npm/package-json#git-urls-as-dependencies\n    const len = 7; // length of 'semver:'\n    const maybeVersion = depRefPart.substring(len);\n\n    if (depRefPart.startsWith('semver:') && isValid(maybeVersion)) {\n      dep.currentRawValue = dep.currentValue;\n      dep.currentValue = maybeVersion;\n      dep.datasource = GithubTagsDatasource.id;\n      dep.versioning = npmVersioningId;\n      dep.packageName = githubOwnerRepo;\n      dep.pinDigests = false;\n    } else {\n      dep.skipReason = 'unversioned-reference';\n      return dep;\n    }\n  }\n  dep.sourceUrl = `https://github.com/${githubOwnerRepo}`;\n  dep.gitRef = true;\n  return dep;\n}\n\nexport function getExtractedConstraints(\n  deps: PackageDependency[],\n): Partial<Record<ConstraintName, string>> {\n  const extractedConstraints: Partial<Record<ConstraintName, string>> = {};\n  const constraints: ConstraintName[] = [\n    'bun',\n    'node',\n    'yarn',\n    'npm',\n    'pnpm',\n    'vscode',\n  ];\n  for (const dep of deps) {\n    if (\n      !dep.skipReason &&\n      (dep.depType === 'engines' ||\n        dep.depType === 'packageManager' ||\n        dep.depType === 'devEngines.runtime' ||\n        dep.depType === 'devEngines.packageManager') &&\n      dep.depName &&\n      isConstraintName(dep.depName) &&\n      constraints.includes(dep.depName) &&\n      isString(dep.currentValue)\n    ) {\n      extractedConstraints[dep.depName] = dep.currentValue;\n    }\n  }\n  return extractedConstraints;\n}\n"],"mappings":";;;;;;;;;;;;AAmBA,MAAM,kCAAkC,MACtC,gEACF;AAEA,SAAgB,aAAa,SAAiB,KAAqB;CACjE,IAAI,YAAY,eACd,OAAO;CAQT,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,MAAM,WAAqB,CAAC;CAC5B,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxC,MAAM,OAAO,MAAM;EACnB,IAAI,KAAK,WAAW,GAAG,KAAK,IAAI,IAAI,MAAM,QAAQ;GAChD,KAAK;GACL,SAAS,KAAK,GAAG,KAAK,GAAG,MAAM,IAAI;EACrC,OACE,SAAS,KAAK,IAAI;CAEtB;CAEA,MAAM,cAAc,SAAS,GAAG,EAAE;CAClC,MAAM,GAAG,WAAW,YAClB,MAAM,iCAAiC,CAAC,CAAC,KAAK,aAAa,WAAW,CAAC,CACzE;CACA,OAAO;AACT;AAEA,SAAgB,kBACd,SACA,SACA,OACwC;CACxC,MAAM,MAA8C,CAAC;CACrD,IAAI,CAAC,uBAAuB,OAAO,CAAC,CAAC,qBAAqB;EACxD,IAAI,aAAa;EACjB,OAAO;CACT;CACA,IAAI,CAAC,SAAS,KAAK,GAAG;EACpB,IAAI,aAAa;EACjB,OAAO;CACT;CACA,IAAI,eAAe,MAAM,KAAK;CAC9B,IACE,YAAY,aACZ,YAAY,oBACZ,YAAY,wBACZ,YAAY,6BACZ;EACA,IAAI,YAAY,QACd,IAAI,aAAa,sBAAsB;OAClC,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;GACzB,MAAM,QACJ,UAAU,IAAI,YAAY,KAAK,IAAI,SAAS,IAAI,YAAY;GAC9D,IAAI,SAAS,QAAQ,GACnB,IAAI,cAAc;EAEtB,OAAO,IAAI,YAAY,OAAO;GAC5B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OAAO,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OAAO,IAAI,YAAY,wBAAwB,YAAY,QAAQ;GACjE,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OAAO,IAAI,YAAY,UAAU;GAC/B,IAAI,aAAa,qBAAqB;GACtC,IAAI,cAAc;GAClB,IAAI,aAAA;EACN,OAAO,IAAI,YAAY,OAAO;GAC5B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OACE,IAAI,aAAa;EAEnB,IAAI,CAAC,QAAQ,IAAI,YAAY,GAC3B,IAAI,aAAa;EAEnB,OAAO;CACT;CAGA,IAAI,YAAY,SAAS;EACvB,IAAI,YAAY,QACd,IAAI,aAAa,sBAAsB;OAClC,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;GACzB,MAAM,QACJ,UAAU,IAAI,YAAY,KAAK,IAAI,SAAS,IAAI,YAAY;GAC9D,IAAI,SAAS,QAAQ,GACnB,IAAI,cAAc;EAEtB,OAAO,IAAI,YAAY,OACrB,IAAI,aAAa,cAAc;OAC1B,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OACE,IAAI,aAAa;EAEnB,IAAI,CAAC,QAAQ,IAAI,YAAY,GAC3B,IAAI,aAAa;EAEnB,OAAO;CACT;CAEA,IAAI,IAAI,aAAa,WAAW,MAAM,GAAG;EACvC,IAAI,kBAAkB;EACtB,MAAM,WAAW,IAAI,aAAa,QAAQ,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG;EAC/D,IAAI,SAAS,WAAW,GAAG;GACzB,IAAI,cAAc;GAClB,IAAI,eAAe,SAAS;EAC9B,OAAO,IAAI,SAAS,WAAW,GAAG;GAChC,IAAI,cAAc,SAAS;GAC3B,IAAI,eAAe,SAAS;EAC9B,OAAO,IAAI,SAAS,WAAW,GAAG;GAChC,IAAI,cAAc,GAAG,SAAS,GAAG,GAAG,SAAS;GAC7C,IAAI,eAAe,SAAS;EAC9B,OACE,OAAO,MACL,8CAA8C,QAAQ,KAAK,IAAI,aAAa,EAC9E;CAEJ;CACA,IAAI,IAAI,aAAa,WAAW,OAAO,GAAG;EACxC,IAAI,aAAa;EACjB,OAAO;CACT;CAEA,IAAI,QAAQ,IAAI,YAAY,GAAG;EAC7B,IAAI,aAAa,cAAc;EAC/B,IAAI,IAAI,iBAAiB,IACvB,IAAI,aAAa;EAEnB,OAAO;CACT;CACA,MAAM,YAAY,IAAI,aAAa,MAAM,GAAG;CAC5C,IAAI,UAAU,WAAW,GAAG;EAC1B,IAAI,aAAa;EACjB,OAAO;CACT;CACA,MAAM,CAAC,aAAa,cAAc;CAElC,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,oBAAoB,gCAAgC,KAAK,WAAW;CAC1E,IAAI,sBAAsB,MAAM;EAC9B,kBAAkB,YACf,QAAQ,MAAM,UAAU,GAAG,EAAE,CAAC,CAC9B,QAAQ,MAAM,QAAQ,GAAG,EAAE,CAAC,CAC5B,QAAQ,MAAM,0BAA0B,GAAG,EAAE,CAAC,CAC9C,QAAQ,MAAM,QAAQ,GAAG,EAAE;EAC9B,MAAM,kBAAkB,gBAAgB,MAAM,GAAG;EACjD,IAAI,gBAAgB,WAAW,GAAG;GAChC,IAAI,aAAa;GACjB,OAAO;EACT;EACA,CAAC,aAAa,cAAc;CAC9B,OAAO;EACL,cAAc,kBAAkB,OAAQ;EACxC,aAAa,kBAAkB,OAAQ;EACvC,kBAAkB,GAAG,YAAY,GAAG;CACtC;CAGA,MAAM,mBAAmB,MAAM,+BAA+B;CAC9D,MAAM,kBAAkB,MAAM,yBAAyB;CACvD,IACE,YAAY,SAAS,MACrB,CAAC,iBAAiB,KAAK,WAAW,KAClC,CAAC,gBAAgB,KAAK,UAAU,GAChC;EACA,IAAI,aAAa;EACjB,OAAO;CACT;CACA,IAAI,UAAU,UAAU,GAAG;EACzB,IAAI,kBAAkB,IAAI;EAC1B,IAAI,eAAe;EACnB,IAAI,aAAa,qBAAqB;EACtC,IAAI,aAAA;EACJ,IAAI,cAAc;EAClB,IAAI,aAAa;CACnB,OAAO,IACL,MAAM,eAAe,CAAC,CAAC,KAAK,UAAU,KACtC,MAAM,gBAAgB,CAAC,CAAC,KAAK,UAAU,GACvC;EACA,IAAI,kBAAkB,IAAI;EAC1B,IAAI,eAAe;EACnB,IAAI,gBAAgB;EACpB,IAAI,aAAa,qBAAqB;EACtC,IAAI,aAAA;EACJ,IAAI,cAAc;CACpB,OAAO;EAIL,MAAM,eAAe,WAAW,UAAU,CAAG;EAE7C,IAAI,WAAW,WAAW,SAAS,KAAK,QAAQ,YAAY,GAAG;GAC7D,IAAI,kBAAkB,IAAI;GAC1B,IAAI,eAAe;GACnB,IAAI,aAAa,qBAAqB;GACtC,IAAI,aAAA;GACJ,IAAI,cAAc;GAClB,IAAI,aAAa;EACnB,OAAO;GACL,IAAI,aAAa;GACjB,OAAO;EACT;CACF;CACA,IAAI,YAAY,sBAAsB;CACtC,IAAI,SAAS;CACb,OAAO;AACT;AAEA,SAAgB,wBACd,MACyC;CACzC,MAAM,uBAAgE,CAAC;CACvE,MAAM,cAAgC;EACpC;EACA;EACA;EACA;EACA;EACA;CACF;CACA,KAAK,MAAM,OAAO,MAChB,IACE,CAAC,IAAI,eACJ,IAAI,YAAY,aACf,IAAI,YAAY,oBAChB,IAAI,YAAY,wBAChB,IAAI,YAAY,gCAClB,IAAI,WACJ,iBAAiB,IAAI,OAAO,KAC5B,YAAY,SAAS,IAAI,OAAO,KAChC,SAAS,IAAI,YAAY,GAEzB,qBAAqB,IAAI,WAAW,IAAI;CAG5C,OAAO;AACT"}
+{"version":3,"file":"dependency.js","names":[],"sources":["../../../../../../lib/modules/manager/npm/extract/common/dependency.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport validateNpmPackageName from 'validate-npm-package-name';\nimport { logger } from '../../../../../logger/index.ts';\nimport { coerceArray } from '../../../../../util/array.ts';\nimport type { ConstraintName } from '../../../../../util/exec/types.ts';\nimport { isConstraintName } from '../../../../../util/exec/types.ts';\nimport { regEx } from '../../../../../util/regex.ts';\nimport { coerceString } from '../../../../../util/string.ts';\nimport { GithubTagsDatasource } from '../../../../datasource/github-tags/index.ts';\nimport { NodeVersionDatasource } from '../../../../datasource/node-version/index.ts';\nimport { NpmDatasource } from '../../../../datasource/npm/index.ts';\nimport {\n  api,\n  isValid,\n  isVersion,\n  id as npmVersioningId,\n} from '../../../../versioning/npm/index.ts';\nimport type { PackageDependency } from '../../../types.ts';\n\nconst RE_REPOSITORY_GITHUB_SSH_FORMAT = regEx(\n  /(?:git@)github.com:(?<owner>[^/]+)\\/(?<repo>[^/]+?)(?:\\.git)?$/,\n);\n\nexport function parseDepName(depType: string, key: string): string {\n  if (depType !== 'resolutions') {\n    return key;\n  }\n\n  // Yarn selective dependency resolutions may nest a path of parent\n  // packages before the target package, e.g. `parent/child` or\n  // `@scope/parent/child`, and any segment (including the last) may carry\n  // a `@range` suffix used to disambiguate which version of that package\n  // to match, e.g. `@cypress/request/qs@~6.14.1`.\n  const parts = key.split('/');\n  const segments: string[] = [];\n  for (let i = 0; i < parts.length; i += 1) {\n    const part = parts[i];\n    if (part.startsWith('@') && i + 1 < parts.length) {\n      i += 1;\n      segments.push(`${part}/${parts[i]}`);\n    } else {\n      segments.push(part);\n    }\n  }\n\n  const lastSegment = segments.at(-1);\n  const [, depName] = coerceArray(\n    regEx(/^(?<depName>(?:@[^/]+\\/)?[^@]+)/).exec(coerceString(lastSegment)),\n  );\n  return depName;\n}\n\nexport function extractDependency(\n  depType: string,\n  depName: string,\n  input: unknown,\n): Omit<PackageDependency, 'managerData'> {\n  const dep: Omit<PackageDependency, 'managerData'> = {};\n  if (!validateNpmPackageName(depName).validForOldPackages) {\n    dep.skipReason = 'invalid-name';\n    return dep;\n  }\n  if (!isString(input)) {\n    dep.skipReason = 'invalid-value';\n    return dep;\n  }\n  dep.currentValue = input.trim();\n  if (\n    depType === 'engines' ||\n    depType === 'packageManager' ||\n    depType === 'devEngines.runtime' ||\n    depType === 'devEngines.packageManager'\n  ) {\n    if (depName === 'node') {\n      dep.datasource = NodeVersionDatasource.id;\n    } else if (depName === 'yarn') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Yarn';\n      const major =\n        isVersion(dep.currentValue) && api.getMajor(dep.currentValue);\n      if (major && major > 1) {\n        dep.packageName = '@yarnpkg/cli-dist';\n      }\n    } else if (depName === 'npm') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'npm';\n    } else if (depName === 'pnpm') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'pnpm';\n    } else if (depType === 'devEngines.runtime' && depName === 'deno') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Deno';\n    } else if (depName === 'vscode') {\n      dep.datasource = GithubTagsDatasource.id;\n      dep.packageName = 'microsoft/vscode';\n      dep.versioning = npmVersioningId;\n    } else if (depName === 'bun') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Bun';\n    } else {\n      dep.skipReason = 'unknown-engines';\n    }\n    if (!isValid(dep.currentValue)) {\n      dep.skipReason = 'unspecified-version';\n    }\n    return dep;\n  }\n\n  // support for volta\n  if (depType === 'volta') {\n    if (depName === 'node') {\n      dep.datasource = NodeVersionDatasource.id;\n    } else if (depName === 'yarn') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'Yarn';\n      const major =\n        isVersion(dep.currentValue) && api.getMajor(dep.currentValue);\n      if (major && major > 1) {\n        dep.packageName = '@yarnpkg/cli-dist';\n      }\n    } else if (depName === 'npm') {\n      dep.datasource = NpmDatasource.id;\n    } else if (depName === 'pnpm') {\n      dep.datasource = NpmDatasource.id;\n      dep.commitMessageTopic = 'pnpm';\n    } else {\n      dep.skipReason = 'unknown-volta';\n    }\n    if (!isValid(dep.currentValue)) {\n      dep.skipReason = 'unspecified-version';\n    }\n    return dep;\n  }\n\n  if (dep.currentValue.startsWith('npm:')) {\n    dep.npmPackageAlias = true;\n    const valSplit = dep.currentValue.replace('npm:', '').split('@');\n    if (valSplit.length === 1) {\n      dep.packageName = depName;\n      dep.currentValue = valSplit[0];\n    } else if (valSplit.length === 2) {\n      dep.packageName = valSplit[0];\n      dep.currentValue = valSplit[1];\n    } else if (valSplit.length === 3) {\n      dep.packageName = `${valSplit[0]}@${valSplit[1]}`;\n      dep.currentValue = valSplit[2];\n    } else {\n      logger.debug(\n        `Invalid npm package alias for dependency: \"${depName}\":\"${dep.currentValue}\"`,\n      );\n    }\n  }\n  if (dep.currentValue.startsWith('file:')) {\n    dep.skipReason = 'file';\n    return dep;\n  }\n\n  if (isValid(dep.currentValue)) {\n    dep.datasource = NpmDatasource.id;\n    if (dep.currentValue === '') {\n      dep.skipReason = 'empty';\n    }\n    return dep;\n  }\n  const hashSplit = dep.currentValue.split('#');\n  if (hashSplit.length !== 2) {\n    dep.skipReason = 'unspecified-version';\n    return dep;\n  }\n  const [depNamePart, depRefPart] = hashSplit;\n\n  let githubOwnerRepo: string;\n  let githubOwner: string;\n  let githubRepo: string;\n  const matchUrlSshFormat = RE_REPOSITORY_GITHUB_SSH_FORMAT.exec(depNamePart);\n  if (matchUrlSshFormat === null) {\n    githubOwnerRepo = depNamePart\n      .replace(regEx(/^github:/), '')\n      .replace(regEx(/^git\\+/), '')\n      .replace(regEx(/^https:\\/\\/github\\.com\\//), '')\n      .replace(regEx(/\\.git$/), '');\n    const githubRepoSplit = githubOwnerRepo.split('/');\n    if (githubRepoSplit.length !== 2) {\n      dep.skipReason = 'unspecified-version';\n      return dep;\n    }\n    [githubOwner, githubRepo] = githubRepoSplit;\n  } else {\n    githubOwner = matchUrlSshFormat.groups!.owner;\n    githubRepo = matchUrlSshFormat.groups!.repo;\n    githubOwnerRepo = `${githubOwner}/${githubRepo}`;\n  }\n  // combined with the length check below, this is equivalent to\n  // /^[a-z\\d](?:[a-z\\d]|-(?=[a-z\\d])){0,38}$/i without the lookahead\n  const githubOwnerRegex = regEx(/^[a-z\\d](?:-?[a-z\\d]){0,38}$/i);\n  const githubRepoRegex = regEx(/^[a-zA-Z0-9._-]{1,100}$/);\n  if (\n    githubOwner.length > 39 ||\n    !githubOwnerRegex.test(githubOwner) ||\n    !githubRepoRegex.test(githubRepo)\n  ) {\n    dep.skipReason = 'unspecified-version';\n    return dep;\n  }\n  if (isVersion(depRefPart)) {\n    dep.currentRawValue = dep.currentValue;\n    dep.currentValue = depRefPart;\n    dep.datasource = GithubTagsDatasource.id;\n    dep.versioning = npmVersioningId;\n    dep.packageName = githubOwnerRepo;\n    dep.pinDigests = false;\n  } else if (\n    regEx(/^[0-9a-f]{7}$/).test(depRefPart) ||\n    regEx(/^[0-9a-f]{40}$/).test(depRefPart)\n  ) {\n    dep.currentRawValue = dep.currentValue;\n    dep.currentValue = null;\n    dep.currentDigest = depRefPart;\n    dep.datasource = GithubTagsDatasource.id;\n    dep.versioning = npmVersioningId;\n    dep.packageName = githubOwnerRepo;\n  } else {\n    // <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>[#<commit-ish> | #semver:<semver>]\n    // https://docs.npmjs.com/cli/v10/configuring-npm/package-json#git-urls-as-dependencies\n    const len = 7; // length of 'semver:'\n    const maybeVersion = depRefPart.substring(len);\n\n    if (depRefPart.startsWith('semver:') && isValid(maybeVersion)) {\n      dep.currentRawValue = dep.currentValue;\n      dep.currentValue = maybeVersion;\n      dep.datasource = GithubTagsDatasource.id;\n      dep.versioning = npmVersioningId;\n      dep.packageName = githubOwnerRepo;\n      dep.pinDigests = false;\n    } else {\n      dep.skipReason = 'unversioned-reference';\n      return dep;\n    }\n  }\n  dep.sourceUrl = `https://github.com/${githubOwnerRepo}`;\n  dep.gitRef = true;\n  return dep;\n}\n\nexport function getExtractedConstraints(\n  deps: PackageDependency[],\n): Partial<Record<ConstraintName, string>> {\n  const extractedConstraints: Partial<Record<ConstraintName, string>> = {};\n  const constraints: ConstraintName[] = [\n    'bun',\n    'node',\n    'yarn',\n    'npm',\n    'pnpm',\n    'vscode',\n  ];\n  for (const dep of deps) {\n    const isConstraintDepType =\n      dep.depType === 'engines' ||\n      dep.depType === 'packageManager' ||\n      dep.depType === 'devEngines.runtime' ||\n      dep.depType === 'devEngines.packageManager';\n    if (\n      !dep.skipReason &&\n      isConstraintDepType &&\n      dep.depName &&\n      isConstraintName(dep.depName) &&\n      constraints.includes(dep.depName) &&\n      isString(dep.currentValue)\n    ) {\n      extractedConstraints[dep.depName] = dep.currentValue;\n    }\n  }\n  return extractedConstraints;\n}\n"],"mappings":";;;;;;;;;;;;AAmBA,MAAM,kCAAkC,MACtC,gEACF;AAEA,SAAgB,aAAa,SAAiB,KAAqB;CACjE,IAAI,YAAY,eACd,OAAO;CAQT,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,MAAM,WAAqB,CAAC;CAC5B,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxC,MAAM,OAAO,MAAM;EACnB,IAAI,KAAK,WAAW,GAAG,KAAK,IAAI,IAAI,MAAM,QAAQ;GAChD,KAAK;GACL,SAAS,KAAK,GAAG,KAAK,GAAG,MAAM,IAAI;EACrC,OACE,SAAS,KAAK,IAAI;CAEtB;CAEA,MAAM,cAAc,SAAS,GAAG,EAAE;CAClC,MAAM,GAAG,WAAW,YAClB,MAAM,iCAAiC,CAAC,CAAC,KAAK,aAAa,WAAW,CAAC,CACzE;CACA,OAAO;AACT;AAEA,SAAgB,kBACd,SACA,SACA,OACwC;CACxC,MAAM,MAA8C,CAAC;CACrD,IAAI,CAAC,uBAAuB,OAAO,CAAC,CAAC,qBAAqB;EACxD,IAAI,aAAa;EACjB,OAAO;CACT;CACA,IAAI,CAAC,SAAS,KAAK,GAAG;EACpB,IAAI,aAAa;EACjB,OAAO;CACT;CACA,IAAI,eAAe,MAAM,KAAK;CAC9B,IACE,YAAY,aACZ,YAAY,oBACZ,YAAY,wBACZ,YAAY,6BACZ;EACA,IAAI,YAAY,QACd,IAAI,aAAa,sBAAsB;OAClC,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;GACzB,MAAM,QACJ,UAAU,IAAI,YAAY,KAAK,IAAI,SAAS,IAAI,YAAY;GAC9D,IAAI,SAAS,QAAQ,GACnB,IAAI,cAAc;EAEtB,OAAO,IAAI,YAAY,OAAO;GAC5B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OAAO,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OAAO,IAAI,YAAY,wBAAwB,YAAY,QAAQ;GACjE,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OAAO,IAAI,YAAY,UAAU;GAC/B,IAAI,aAAa,qBAAqB;GACtC,IAAI,cAAc;GAClB,IAAI,aAAA;EACN,OAAO,IAAI,YAAY,OAAO;GAC5B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OACE,IAAI,aAAa;EAEnB,IAAI,CAAC,QAAQ,IAAI,YAAY,GAC3B,IAAI,aAAa;EAEnB,OAAO;CACT;CAGA,IAAI,YAAY,SAAS;EACvB,IAAI,YAAY,QACd,IAAI,aAAa,sBAAsB;OAClC,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;GACzB,MAAM,QACJ,UAAU,IAAI,YAAY,KAAK,IAAI,SAAS,IAAI,YAAY;GAC9D,IAAI,SAAS,QAAQ,GACnB,IAAI,cAAc;EAEtB,OAAO,IAAI,YAAY,OACrB,IAAI,aAAa,cAAc;OAC1B,IAAI,YAAY,QAAQ;GAC7B,IAAI,aAAa,cAAc;GAC/B,IAAI,qBAAqB;EAC3B,OACE,IAAI,aAAa;EAEnB,IAAI,CAAC,QAAQ,IAAI,YAAY,GAC3B,IAAI,aAAa;EAEnB,OAAO;CACT;CAEA,IAAI,IAAI,aAAa,WAAW,MAAM,GAAG;EACvC,IAAI,kBAAkB;EACtB,MAAM,WAAW,IAAI,aAAa,QAAQ,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG;EAC/D,IAAI,SAAS,WAAW,GAAG;GACzB,IAAI,cAAc;GAClB,IAAI,eAAe,SAAS;EAC9B,OAAO,IAAI,SAAS,WAAW,GAAG;GAChC,IAAI,cAAc,SAAS;GAC3B,IAAI,eAAe,SAAS;EAC9B,OAAO,IAAI,SAAS,WAAW,GAAG;GAChC,IAAI,cAAc,GAAG,SAAS,GAAG,GAAG,SAAS;GAC7C,IAAI,eAAe,SAAS;EAC9B,OACE,OAAO,MACL,8CAA8C,QAAQ,KAAK,IAAI,aAAa,EAC9E;CAEJ;CACA,IAAI,IAAI,aAAa,WAAW,OAAO,GAAG;EACxC,IAAI,aAAa;EACjB,OAAO;CACT;CAEA,IAAI,QAAQ,IAAI,YAAY,GAAG;EAC7B,IAAI,aAAa,cAAc;EAC/B,IAAI,IAAI,iBAAiB,IACvB,IAAI,aAAa;EAEnB,OAAO;CACT;CACA,MAAM,YAAY,IAAI,aAAa,MAAM,GAAG;CAC5C,IAAI,UAAU,WAAW,GAAG;EAC1B,IAAI,aAAa;EACjB,OAAO;CACT;CACA,MAAM,CAAC,aAAa,cAAc;CAElC,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,oBAAoB,gCAAgC,KAAK,WAAW;CAC1E,IAAI,sBAAsB,MAAM;EAC9B,kBAAkB,YACf,QAAQ,MAAM,UAAU,GAAG,EAAE,CAAC,CAC9B,QAAQ,MAAM,QAAQ,GAAG,EAAE,CAAC,CAC5B,QAAQ,MAAM,0BAA0B,GAAG,EAAE,CAAC,CAC9C,QAAQ,MAAM,QAAQ,GAAG,EAAE;EAC9B,MAAM,kBAAkB,gBAAgB,MAAM,GAAG;EACjD,IAAI,gBAAgB,WAAW,GAAG;GAChC,IAAI,aAAa;GACjB,OAAO;EACT;EACA,CAAC,aAAa,cAAc;CAC9B,OAAO;EACL,cAAc,kBAAkB,OAAQ;EACxC,aAAa,kBAAkB,OAAQ;EACvC,kBAAkB,GAAG,YAAY,GAAG;CACtC;CAGA,MAAM,mBAAmB,MAAM,+BAA+B;CAC9D,MAAM,kBAAkB,MAAM,yBAAyB;CACvD,IACE,YAAY,SAAS,MACrB,CAAC,iBAAiB,KAAK,WAAW,KAClC,CAAC,gBAAgB,KAAK,UAAU,GAChC;EACA,IAAI,aAAa;EACjB,OAAO;CACT;CACA,IAAI,UAAU,UAAU,GAAG;EACzB,IAAI,kBAAkB,IAAI;EAC1B,IAAI,eAAe;EACnB,IAAI,aAAa,qBAAqB;EACtC,IAAI,aAAA;EACJ,IAAI,cAAc;EAClB,IAAI,aAAa;CACnB,OAAO,IACL,MAAM,eAAe,CAAC,CAAC,KAAK,UAAU,KACtC,MAAM,gBAAgB,CAAC,CAAC,KAAK,UAAU,GACvC;EACA,IAAI,kBAAkB,IAAI;EAC1B,IAAI,eAAe;EACnB,IAAI,gBAAgB;EACpB,IAAI,aAAa,qBAAqB;EACtC,IAAI,aAAA;EACJ,IAAI,cAAc;CACpB,OAAO;EAIL,MAAM,eAAe,WAAW,UAAU,CAAG;EAE7C,IAAI,WAAW,WAAW,SAAS,KAAK,QAAQ,YAAY,GAAG;GAC7D,IAAI,kBAAkB,IAAI;GAC1B,IAAI,eAAe;GACnB,IAAI,aAAa,qBAAqB;GACtC,IAAI,aAAA;GACJ,IAAI,cAAc;GAClB,IAAI,aAAa;EACnB,OAAO;GACL,IAAI,aAAa;GACjB,OAAO;EACT;CACF;CACA,IAAI,YAAY,sBAAsB;CACtC,IAAI,SAAS;CACb,OAAO;AACT;AAEA,SAAgB,wBACd,MACyC;CACzC,MAAM,uBAAgE,CAAC;CACvE,MAAM,cAAgC;EACpC;EACA;EACA;EACA;EACA;EACA;CACF;CACA,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,sBACJ,IAAI,YAAY,aAChB,IAAI,YAAY,oBAChB,IAAI,YAAY,wBAChB,IAAI,YAAY;EAClB,IACE,CAAC,IAAI,cACL,uBACA,IAAI,WACJ,iBAAiB,IAAI,OAAO,KAC5B,YAAY,SAAS,IAAI,OAAO,KAChC,SAAS,IAAI,YAAY,GAEzB,qBAAqB,IAAI,WAAW,IAAI;CAE5C;CACA,OAAO;AACT"}

package/dist/modules/manager/npm/extract/common/package-file.js

@@ -127,7 +127,8 @@ function extractPackageJson(packageJson, packageFile) {
 async function hasPackageManager(packageJsonDir) {
 	logger.trace(`npm.hasPackageManager from package.json`);
 	const packageJsonResult = await loadPackageJson(packageJsonDir);
-	return isNonEmptyString(packageJsonResult?.packageManager?.name) && isNonEmptyString(packageJsonResult?.packageManager?.version) || hasDevEnginesPackageManager(packageJsonResult);
+	if (isNonEmptyString(packageJsonResult?.packageManager?.name) && isNonEmptyString(packageJsonResult?.packageManager?.version)) return true;
+	return hasDevEnginesPackageManager(packageJsonResult);
 }
 export { extractPackageJson, hasDevEnginesPackageManager, hasPackageManager };
 

package/dist/modules/manager/npm/extract/common/package-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"package-file.js","names":[],"sources":["../../../../../../lib/modules/manager/npm/extract/common/package-file.ts"],"sourcesContent":["import { parsePkgAndParentSelector } from '@pnpm/parse-overrides';\nimport {\n  isNonEmptyObject,\n  isNonEmptyString,\n  isNonEmptyStringAndNotWhitespace,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport { CONFIG_VALIDATION } from '../../../../../constants/error-messages.ts';\nimport { logger } from '../../../../../logger/index.ts';\nimport { regEx } from '../../../../../util/regex.ts';\nimport type { PackageDependency, PackageFileContent } from '../../../types.ts';\nimport type { NpmManagerData } from '../../types.ts';\nimport { loadPackageJson } from '../../utils.ts';\nimport type {\n  NpmPackage,\n  NpmPackageDependency,\n  OverrideDependency,\n} from '../types.ts';\nimport {\n  extractDependency,\n  getExtractedConstraints,\n  parseDepName,\n} from './dependency.ts';\nimport { setNodeCommitTopic } from './node.ts';\nimport { extractOverrideDepsRec } from './overrides.ts';\n\nexport function hasDevEnginesPackageManager(\n  packageJson: Pick<NpmPackage, 'devEngines'>,\n): boolean {\n  const pm = packageJson.devEngines?.packageManager;\n  if (Array.isArray(pm)) {\n    return pm.some((item) => isNonEmptyObject(item));\n  }\n  return isNonEmptyObject(pm);\n}\n\nexport function extractPackageJson(\n  packageJson: NpmPackage,\n  packageFile: string,\n): PackageFileContent<NpmManagerData> | null {\n  logger.trace(`npm.extractPackageJson(${packageFile})`);\n  const deps: PackageDependency<NpmManagerData>[] = [];\n\n  if (packageJson._id && packageJson._args && packageJson._from) {\n    logger.debug({ packageFile }, 'Ignoring vendorised package.json');\n    return null;\n  }\n  if (packageFile !== 'package.json' && packageJson.renovate) {\n    const error = new Error(CONFIG_VALIDATION);\n    error.validationSource = packageFile;\n    error.validationError =\n      'Nested package.json must not contain Renovate configuration. Please use `packageRules` with `matchFileNames` in your main config instead.';\n    throw error;\n  }\n  const packageJsonName = packageJson.name;\n  logger.debug(\n    `npm file ${packageFile} has name ${JSON.stringify(packageJsonName)}`,\n  );\n  const packageFileVersion = packageJson.version;\n\n  const depTypes = {\n    dependencies: 'dependency',\n    devDependencies: 'devDependency',\n    optionalDependencies: 'optionalDependency',\n    peerDependencies: 'peerDependency',\n    engines: 'engine',\n    volta: 'volta',\n    resolutions: 'resolutions',\n    packageManager: 'packageManager',\n    overrides: 'overrides',\n    pnpm: 'pnpm',\n  };\n\n  for (const depType of Object.keys(depTypes) as (keyof typeof depTypes)[]) {\n    let dependencies = packageJson[depType];\n    if (dependencies) {\n      try {\n        if (depType === 'packageManager') {\n          const match = regEx('^(?<name>.+)@(?<range>.+)$').exec(\n            dependencies as string,\n          );\n          /* v8 ignore next -- needs test */\n          if (!match?.groups) {\n            break;\n          }\n          dependencies = { [match.groups.name]: match.groups.range };\n        }\n        for (const [key, val] of Object.entries(\n          dependencies as Partial<OverrideDependency>,\n        )) {\n          const depName = parseDepName(depType, key);\n          let dep: PackageDependency<NpmManagerData> = {\n            depType,\n            depName,\n          };\n          if (depName !== key) {\n            dep.managerData = { key };\n          }\n          // v8 ignore else -- TODO: add test #40625\n          if (depType === 'overrides' && !isString(val)) {\n            deps.push(...extractOverrideDepsRec([depName], val));\n          } else if (depType === 'pnpm' && depName === 'overrides') {\n            // pnpm overrides\n            // https://pnpm.io/package_json#pnpmoverrides\n            for (const [overridesKey, overridesVal] of Object.entries(\n              val as unknown as NpmPackageDependency,\n            )) {\n              if (isString(overridesVal)) {\n                // Newer flat syntax: `parent>parent>child`\n                const packageName =\n                  parsePkgAndParentSelector(overridesKey).targetPkg.name;\n                dep = {\n                  depName: overridesKey,\n                  packageName,\n                  depType: 'pnpm.overrides',\n                  ...extractDependency(depName, packageName, overridesVal),\n                };\n                setNodeCommitTopic(dep);\n                // TODO: Is this expected? It's always 'overrides'.\n                dep.prettyDepType = depTypes[depName];\n                deps.push(dep);\n              } else if (isObject(overridesVal)) {\n                // Older nested object syntax: `parent: { parent: { child: version } }`\n                deps.push(\n                  ...extractOverrideDepsRec([overridesKey], overridesVal),\n                );\n              }\n            }\n          } else {\n            dep = { ...dep, ...extractDependency(depType, depName, val) };\n            setNodeCommitTopic(dep);\n            dep.prettyDepType = depTypes[depType];\n            deps.push(dep);\n          }\n        }\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.debug(\n          { fileName: packageFile, depType, err },\n          'Error parsing package.json',\n        );\n        return null;\n      }\n    }\n  }\n\n  if (packageJson.devEngines) {\n    for (const subKey of ['runtime', 'packageManager'] as const) {\n      const value = packageJson.devEngines[subKey];\n      if (!value) {\n        continue;\n      }\n      const items = Array.isArray(value) ? value : [value];\n      const depType = `devEngines.${subKey}`;\n      for (let i = 0; i < items.length; i += 1) {\n        const item = items[i];\n        if (!item?.name || !item.version) {\n          continue;\n        }\n        const dep: PackageDependency<NpmManagerData> = {\n          depType,\n          depName: item.name,\n          ...extractDependency(depType, item.name, item.version),\n        };\n        setNodeCommitTopic(dep);\n        dep.prettyDepType = depType;\n        if (Array.isArray(value)) {\n          dep.managerData = {\n            ...dep.managerData,\n            devEnginesIndex: i,\n          };\n        }\n        deps.push(dep);\n      }\n    }\n  }\n\n  const extractedConstraints = getExtractedConstraints(deps);\n\n  return {\n    deps,\n    extractedConstraints,\n    packageFileVersion,\n    managerData: {\n      packageJsonName,\n      hasPackageManager:\n        isNonEmptyStringAndNotWhitespace(packageJson.packageManager) ||\n        hasDevEnginesPackageManager(packageJson),\n      workspaces: packageJson.workspaces,\n    },\n  };\n}\n\nexport async function hasPackageManager(\n  packageJsonDir: string,\n): Promise<boolean> {\n  logger.trace(`npm.hasPackageManager from package.json`);\n\n  const packageJsonResult = await loadPackageJson(packageJsonDir);\n\n  return (\n    (isNonEmptyString(packageJsonResult?.packageManager?.name) &&\n      isNonEmptyString(packageJsonResult?.packageManager?.version)) ||\n    hasDevEnginesPackageManager(packageJsonResult)\n  );\n}\n"],"mappings":";;;;;;;;;;AA2BA,SAAgB,4BACd,aACS;CACT,MAAM,KAAK,YAAY,YAAY;CACnC,IAAI,MAAM,QAAQ,EAAE,GAClB,OAAO,GAAG,MAAM,SAAS,iBAAiB,IAAI,CAAC;CAEjD,OAAO,iBAAiB,EAAE;AAC5B;AAEA,SAAgB,mBACd,aACA,aAC2C;CAC3C,OAAO,MAAM,0BAA0B,YAAY,EAAE;CACrD,MAAM,OAA4C,CAAC;CAEnD,IAAI,YAAY,OAAO,YAAY,SAAS,YAAY,OAAO;EAC7D,OAAO,MAAM,EAAE,YAAY,GAAG,kCAAkC;EAChE,OAAO;CACT;CACA,IAAI,gBAAgB,kBAAkB,YAAY,UAAU;EAC1D,MAAM,QAAQ,IAAI,MAAM,iBAAiB;EACzC,MAAM,mBAAmB;EACzB,MAAM,kBACJ;EACF,MAAM;CACR;CACA,MAAM,kBAAkB,YAAY;CACpC,OAAO,MACL,YAAY,YAAY,YAAY,KAAK,UAAU,eAAe,GACpE;CACA,MAAM,qBAAqB,YAAY;CAEvC,MAAM,WAAW;EACf,cAAc;EACd,iBAAiB;EACjB,sBAAsB;EACtB,kBAAkB;EAClB,SAAS;EACT,OAAO;EACP,aAAa;EACb,gBAAgB;EAChB,WAAW;EACX,MAAM;CACR;CAEA,KAAK,MAAM,WAAW,OAAO,KAAK,QAAQ,GAAgC;EACxE,IAAI,eAAe,YAAY;EAC/B,IAAI,cACF,IAAI;GACF,IAAI,YAAY,kBAAkB;IAChC,MAAM,QAAQ,MAAM,4BAA4B,CAAC,CAAC,KAChD,YACF;;IAEA,IAAI,CAAC,OAAO,QACV;IAEF,eAAe,GAAG,MAAM,OAAO,OAAO,MAAM,OAAO,MAAM;GAC3D;GACA,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAC9B,YACF,GAAG;IACD,MAAM,UAAU,aAAa,SAAS,GAAG;IACzC,IAAI,MAAyC;KAC3C;KACA;IACF;IACA,IAAI,YAAY,KACd,IAAI,cAAc,EAAE,IAAI;;IAG1B,IAAI,YAAY,eAAe,CAAC,SAAS,GAAG,GAC1C,KAAK,KAAK,GAAG,uBAAuB,CAAC,OAAO,GAAG,GAAG,CAAC;SAC9C,IAAI,YAAY,UAAU,YAAY,aAGtC;UAAA,MAAM,CAAC,cAAc,iBAAiB,OAAO,QAChD,GACF,GACE,IAAI,SAAS,YAAY,GAAG;MAE1B,MAAM,cACJ,0BAA0B,YAAY,CAAC,CAAC,UAAU;MACpD,MAAM;OACJ,SAAS;OACT;OACA,SAAS;OACT,GAAG,kBAAkB,SAAS,aAAa,YAAY;MACzD;MACA,mBAAmB,GAAG;MAEtB,IAAI,gBAAgB,SAAS;MAC7B,KAAK,KAAK,GAAG;KACf,OAAO,IAAI,SAAS,YAAY,GAE9B,KAAK,KACH,GAAG,uBAAuB,CAAC,YAAY,GAAG,YAAY,CACxD;IAAA,OAGC;KACL,MAAM;MAAE,GAAG;MAAK,GAAG,kBAAkB,SAAS,SAAS,GAAG;KAAE;KAC5D,mBAAmB,GAAG;KACtB,IAAI,gBAAgB,SAAS;KAC7B,KAAK,KAAK,GAAG;IACf;GACF;EACF,SAAS,mDAAmD;GAC1D,OAAO,MACL;IAAE,UAAU;IAAa;IAAS;GAAI,GACtC,4BACF;GACA,OAAO;EACT;CAEJ;CAEA,IAAI,YAAY,YACd,KAAK,MAAM,UAAU,CAAC,WAAW,gBAAgB,GAAY;EAC3D,MAAM,QAAQ,YAAY,WAAW;EACrC,IAAI,CAAC,OACH;EAEF,MAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;EACnD,MAAM,UAAU,cAAc;EAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxC,MAAM,OAAO,MAAM;GACnB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,SACvB;GAEF,MAAM,MAAyC;IAC7C;IACA,SAAS,KAAK;IACd,GAAG,kBAAkB,SAAS,KAAK,MAAM,KAAK,OAAO;GACvD;GACA,mBAAmB,GAAG;GACtB,IAAI,gBAAgB;GACpB,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,cAAc;IAChB,GAAG,IAAI;IACP,iBAAiB;GACnB;GAEF,KAAK,KAAK,GAAG;EACf;CACF;CAKF,OAAO;EACL;EACA,sBAJ2B,wBAAwB,IAIhC;EACnB;EACA,aAAa;GACX;GACA,mBACE,iCAAiC,YAAY,cAAc,KAC3D,4BAA4B,WAAW;GACzC,YAAY,YAAY;EAC1B;CACF;AACF;AAEA,eAAsB,kBACpB,gBACkB;CAClB,OAAO,MAAM,yCAAyC;CAEtD,MAAM,oBAAoB,MAAM,gBAAgB,cAAc;CAE9D,OACG,iBAAiB,mBAAmB,gBAAgB,IAAI,KACvD,iBAAiB,mBAAmB,gBAAgB,OAAO,KAC7D,4BAA4B,iBAAiB;AAEjD"}
+{"version":3,"file":"package-file.js","names":[],"sources":["../../../../../../lib/modules/manager/npm/extract/common/package-file.ts"],"sourcesContent":["import { parsePkgAndParentSelector } from '@pnpm/parse-overrides';\nimport {\n  isNonEmptyObject,\n  isNonEmptyString,\n  isNonEmptyStringAndNotWhitespace,\n  isObject,\n  isString,\n} from '@sindresorhus/is';\nimport { CONFIG_VALIDATION } from '../../../../../constants/error-messages.ts';\nimport { logger } from '../../../../../logger/index.ts';\nimport { regEx } from '../../../../../util/regex.ts';\nimport type { PackageDependency, PackageFileContent } from '../../../types.ts';\nimport type { NpmManagerData } from '../../types.ts';\nimport { loadPackageJson } from '../../utils.ts';\nimport type {\n  NpmPackage,\n  NpmPackageDependency,\n  OverrideDependency,\n} from '../types.ts';\nimport {\n  extractDependency,\n  getExtractedConstraints,\n  parseDepName,\n} from './dependency.ts';\nimport { setNodeCommitTopic } from './node.ts';\nimport { extractOverrideDepsRec } from './overrides.ts';\n\nexport function hasDevEnginesPackageManager(\n  packageJson: Pick<NpmPackage, 'devEngines'>,\n): boolean {\n  const pm = packageJson.devEngines?.packageManager;\n  if (Array.isArray(pm)) {\n    return pm.some((item) => isNonEmptyObject(item));\n  }\n  return isNonEmptyObject(pm);\n}\n\nexport function extractPackageJson(\n  packageJson: NpmPackage,\n  packageFile: string,\n): PackageFileContent<NpmManagerData> | null {\n  logger.trace(`npm.extractPackageJson(${packageFile})`);\n  const deps: PackageDependency<NpmManagerData>[] = [];\n\n  if (packageJson._id && packageJson._args && packageJson._from) {\n    logger.debug({ packageFile }, 'Ignoring vendorised package.json');\n    return null;\n  }\n  if (packageFile !== 'package.json' && packageJson.renovate) {\n    const error = new Error(CONFIG_VALIDATION);\n    error.validationSource = packageFile;\n    error.validationError =\n      'Nested package.json must not contain Renovate configuration. Please use `packageRules` with `matchFileNames` in your main config instead.';\n    throw error;\n  }\n  const packageJsonName = packageJson.name;\n  logger.debug(\n    `npm file ${packageFile} has name ${JSON.stringify(packageJsonName)}`,\n  );\n  const packageFileVersion = packageJson.version;\n\n  const depTypes = {\n    dependencies: 'dependency',\n    devDependencies: 'devDependency',\n    optionalDependencies: 'optionalDependency',\n    peerDependencies: 'peerDependency',\n    engines: 'engine',\n    volta: 'volta',\n    resolutions: 'resolutions',\n    packageManager: 'packageManager',\n    overrides: 'overrides',\n    pnpm: 'pnpm',\n  };\n\n  for (const depType of Object.keys(depTypes) as (keyof typeof depTypes)[]) {\n    let dependencies = packageJson[depType];\n    if (dependencies) {\n      try {\n        if (depType === 'packageManager') {\n          const match = regEx('^(?<name>.+)@(?<range>.+)$').exec(\n            dependencies as string,\n          );\n          /* v8 ignore next -- needs test */\n          if (!match?.groups) {\n            break;\n          }\n          dependencies = { [match.groups.name]: match.groups.range };\n        }\n        for (const [key, val] of Object.entries(\n          dependencies as Partial<OverrideDependency>,\n        )) {\n          const depName = parseDepName(depType, key);\n          let dep: PackageDependency<NpmManagerData> = {\n            depType,\n            depName,\n          };\n          if (depName !== key) {\n            dep.managerData = { key };\n          }\n          // v8 ignore else -- TODO: add test #40625\n          if (depType === 'overrides' && !isString(val)) {\n            deps.push(...extractOverrideDepsRec([depName], val));\n          } else if (depType === 'pnpm' && depName === 'overrides') {\n            // pnpm overrides\n            // https://pnpm.io/package_json#pnpmoverrides\n            for (const [overridesKey, overridesVal] of Object.entries(\n              val as unknown as NpmPackageDependency,\n            )) {\n              if (isString(overridesVal)) {\n                // Newer flat syntax: `parent>parent>child`\n                const packageName =\n                  parsePkgAndParentSelector(overridesKey).targetPkg.name;\n                dep = {\n                  depName: overridesKey,\n                  packageName,\n                  depType: 'pnpm.overrides',\n                  ...extractDependency(depName, packageName, overridesVal),\n                };\n                setNodeCommitTopic(dep);\n                // TODO: Is this expected? It's always 'overrides'.\n                dep.prettyDepType = depTypes[depName];\n                deps.push(dep);\n              } else if (isObject(overridesVal)) {\n                // Older nested object syntax: `parent: { parent: { child: version } }`\n                deps.push(\n                  ...extractOverrideDepsRec([overridesKey], overridesVal),\n                );\n              }\n            }\n          } else {\n            dep = { ...dep, ...extractDependency(depType, depName, val) };\n            setNodeCommitTopic(dep);\n            dep.prettyDepType = depTypes[depType];\n            deps.push(dep);\n          }\n        }\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.debug(\n          { fileName: packageFile, depType, err },\n          'Error parsing package.json',\n        );\n        return null;\n      }\n    }\n  }\n\n  if (packageJson.devEngines) {\n    for (const subKey of ['runtime', 'packageManager'] as const) {\n      const value = packageJson.devEngines[subKey];\n      if (!value) {\n        continue;\n      }\n      const items = Array.isArray(value) ? value : [value];\n      const depType = `devEngines.${subKey}`;\n      for (let i = 0; i < items.length; i += 1) {\n        const item = items[i];\n        if (!item?.name || !item.version) {\n          continue;\n        }\n        const dep: PackageDependency<NpmManagerData> = {\n          depType,\n          depName: item.name,\n          ...extractDependency(depType, item.name, item.version),\n        };\n        setNodeCommitTopic(dep);\n        dep.prettyDepType = depType;\n        if (Array.isArray(value)) {\n          dep.managerData = {\n            ...dep.managerData,\n            devEnginesIndex: i,\n          };\n        }\n        deps.push(dep);\n      }\n    }\n  }\n\n  const extractedConstraints = getExtractedConstraints(deps);\n\n  return {\n    deps,\n    extractedConstraints,\n    packageFileVersion,\n    managerData: {\n      packageJsonName,\n      hasPackageManager:\n        isNonEmptyStringAndNotWhitespace(packageJson.packageManager) ||\n        hasDevEnginesPackageManager(packageJson),\n      workspaces: packageJson.workspaces,\n    },\n  };\n}\n\nexport async function hasPackageManager(\n  packageJsonDir: string,\n): Promise<boolean> {\n  logger.trace(`npm.hasPackageManager from package.json`);\n\n  const packageJsonResult = await loadPackageJson(packageJsonDir);\n\n  if (\n    isNonEmptyString(packageJsonResult?.packageManager?.name) &&\n    isNonEmptyString(packageJsonResult?.packageManager?.version)\n  ) {\n    return true;\n  }\n  return hasDevEnginesPackageManager(packageJsonResult);\n}\n"],"mappings":";;;;;;;;;;AA2BA,SAAgB,4BACd,aACS;CACT,MAAM,KAAK,YAAY,YAAY;CACnC,IAAI,MAAM,QAAQ,EAAE,GAClB,OAAO,GAAG,MAAM,SAAS,iBAAiB,IAAI,CAAC;CAEjD,OAAO,iBAAiB,EAAE;AAC5B;AAEA,SAAgB,mBACd,aACA,aAC2C;CAC3C,OAAO,MAAM,0BAA0B,YAAY,EAAE;CACrD,MAAM,OAA4C,CAAC;CAEnD,IAAI,YAAY,OAAO,YAAY,SAAS,YAAY,OAAO;EAC7D,OAAO,MAAM,EAAE,YAAY,GAAG,kCAAkC;EAChE,OAAO;CACT;CACA,IAAI,gBAAgB,kBAAkB,YAAY,UAAU;EAC1D,MAAM,QAAQ,IAAI,MAAM,iBAAiB;EACzC,MAAM,mBAAmB;EACzB,MAAM,kBACJ;EACF,MAAM;CACR;CACA,MAAM,kBAAkB,YAAY;CACpC,OAAO,MACL,YAAY,YAAY,YAAY,KAAK,UAAU,eAAe,GACpE;CACA,MAAM,qBAAqB,YAAY;CAEvC,MAAM,WAAW;EACf,cAAc;EACd,iBAAiB;EACjB,sBAAsB;EACtB,kBAAkB;EAClB,SAAS;EACT,OAAO;EACP,aAAa;EACb,gBAAgB;EAChB,WAAW;EACX,MAAM;CACR;CAEA,KAAK,MAAM,WAAW,OAAO,KAAK,QAAQ,GAAgC;EACxE,IAAI,eAAe,YAAY;EAC/B,IAAI,cACF,IAAI;GACF,IAAI,YAAY,kBAAkB;IAChC,MAAM,QAAQ,MAAM,4BAA4B,CAAC,CAAC,KAChD,YACF;;IAEA,IAAI,CAAC,OAAO,QACV;IAEF,eAAe,GAAG,MAAM,OAAO,OAAO,MAAM,OAAO,MAAM;GAC3D;GACA,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAC9B,YACF,GAAG;IACD,MAAM,UAAU,aAAa,SAAS,GAAG;IACzC,IAAI,MAAyC;KAC3C;KACA;IACF;IACA,IAAI,YAAY,KACd,IAAI,cAAc,EAAE,IAAI;;IAG1B,IAAI,YAAY,eAAe,CAAC,SAAS,GAAG,GAC1C,KAAK,KAAK,GAAG,uBAAuB,CAAC,OAAO,GAAG,GAAG,CAAC;SAC9C,IAAI,YAAY,UAAU,YAAY,aAGtC;UAAA,MAAM,CAAC,cAAc,iBAAiB,OAAO,QAChD,GACF,GACE,IAAI,SAAS,YAAY,GAAG;MAE1B,MAAM,cACJ,0BAA0B,YAAY,CAAC,CAAC,UAAU;MACpD,MAAM;OACJ,SAAS;OACT;OACA,SAAS;OACT,GAAG,kBAAkB,SAAS,aAAa,YAAY;MACzD;MACA,mBAAmB,GAAG;MAEtB,IAAI,gBAAgB,SAAS;MAC7B,KAAK,KAAK,GAAG;KACf,OAAO,IAAI,SAAS,YAAY,GAE9B,KAAK,KACH,GAAG,uBAAuB,CAAC,YAAY,GAAG,YAAY,CACxD;IAAA,OAGC;KACL,MAAM;MAAE,GAAG;MAAK,GAAG,kBAAkB,SAAS,SAAS,GAAG;KAAE;KAC5D,mBAAmB,GAAG;KACtB,IAAI,gBAAgB,SAAS;KAC7B,KAAK,KAAK,GAAG;IACf;GACF;EACF,SAAS,mDAAmD;GAC1D,OAAO,MACL;IAAE,UAAU;IAAa;IAAS;GAAI,GACtC,4BACF;GACA,OAAO;EACT;CAEJ;CAEA,IAAI,YAAY,YACd,KAAK,MAAM,UAAU,CAAC,WAAW,gBAAgB,GAAY;EAC3D,MAAM,QAAQ,YAAY,WAAW;EACrC,IAAI,CAAC,OACH;EAEF,MAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;EACnD,MAAM,UAAU,cAAc;EAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxC,MAAM,OAAO,MAAM;GACnB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,SACvB;GAEF,MAAM,MAAyC;IAC7C;IACA,SAAS,KAAK;IACd,GAAG,kBAAkB,SAAS,KAAK,MAAM,KAAK,OAAO;GACvD;GACA,mBAAmB,GAAG;GACtB,IAAI,gBAAgB;GACpB,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,cAAc;IAChB,GAAG,IAAI;IACP,iBAAiB;GACnB;GAEF,KAAK,KAAK,GAAG;EACf;CACF;CAKF,OAAO;EACL;EACA,sBAJ2B,wBAAwB,IAIhC;EACnB;EACA,aAAa;GACX;GACA,mBACE,iCAAiC,YAAY,cAAc,KAC3D,4BAA4B,WAAW;GACzC,YAAY,YAAY;EAC1B;CACF;AACF;AAEA,eAAsB,kBACpB,gBACkB;CAClB,OAAO,MAAM,yCAAyC;CAEtD,MAAM,oBAAoB,MAAM,gBAAgB,cAAc;CAE9D,IACE,iBAAiB,mBAAmB,gBAAgB,IAAI,KACxD,iBAAiB,mBAAmB,gBAAgB,OAAO,GAE3D,OAAO;CAET,OAAO,4BAA4B,iBAAiB;AACtD"}