renovate 44.210.2 → 44.211.0

package/dist/modules/manager/npm/extract/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../../lib/modules/manager/npm/extract/index.ts"],"sourcesContent":["import {\n  isArray,\n  isNonEmptyStringAndNotWhitespace,\n  isString,\n} from '@sindresorhus/is';\nimport upath from 'upath';\nimport { logger } from '../../../../logger/index.ts';\nimport {\n  findLocalSiblingOrParent,\n  getSiblingFileName,\n  readLocalFile,\n} from '../../../../util/fs/index.ts';\nimport { NpmDatasource } from '../../../datasource/npm/index.ts';\n\nimport type {\n  ExtractConfig,\n  NpmrcPackageFile,\n  NpmrcPackageFileContent,\n} from '../../types.ts';\nimport { resolveNpmrc } from '../npmrc.ts';\nimport { PnpmWorkspaceFile, type YarnConfig } from '../schema.ts';\nimport type { NpmLockFiles, NpmManagerData } from '../types.ts';\nimport { getExtractedConstraints } from './common/dependency.ts';\nimport {\n  extractPackageJson,\n  hasDevEnginesPackageManager,\n  hasPackageManager,\n} from './common/package-file.ts';\nimport {\n  applyPnpmWorkspaceRegistries,\n  extractPnpmWorkspaceFile,\n} from './pnpm.ts';\nimport { postExtract } from './post/index.ts';\nimport type { NpmPackage } from './types.ts';\nimport { extractYarnCatalogs, isZeroInstall } from './yarn.ts';\nimport {\n  loadConfigFromLegacyYarnrc,\n  loadConfigFromYarnrcYml,\n  resolveRegistryUrl,\n} from './yarnrc.ts';\n\nfunction hasMultipleLockFiles(lockFiles: NpmLockFiles): boolean {\n  return Object.values(lockFiles).filter(isString).length > 1;\n}\n\nexport async function extractPackageFile(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig,\n): Promise<NpmrcPackageFileContent<NpmManagerData> | null> {\n  logger.trace(`npm.extractPackageFile(${packageFile})`);\n  logger.trace({ content });\n  let packageJson: NpmPackage;\n  try {\n    packageJson = JSON.parse(content);\n  } catch {\n    logger.debug({ packageFile }, `Invalid JSON`);\n    return null;\n  }\n\n  const res = extractPackageJson(packageJson, packageFile);\n  if (!res) {\n    return null;\n  }\n\n  let workspacesPackages: string[] | undefined;\n  if (isArray(packageJson.workspaces)) {\n    workspacesPackages = packageJson.workspaces;\n  } else {\n    workspacesPackages = packageJson.workspaces?.packages;\n  }\n\n  const lockFiles: NpmLockFiles = {\n    yarnLock: 'yarn.lock',\n    packageLock: 'package-lock.json',\n    shrinkwrapJson: 'npm-shrinkwrap.json',\n    pnpmLockFile: 'pnpm-lock.yaml',\n  };\n\n  for (const [key, val] of Object.entries(lockFiles) as [\n    'yarnLock' | 'packageLock' | 'shrinkwrapJson' | 'pnpmLockFile',\n    string,\n  ][]) {\n    const filePath = getSiblingFileName(packageFile, val);\n    if (await readLocalFile(filePath, 'utf8')) {\n      lockFiles[key] = filePath;\n    } else {\n      lockFiles[key] = undefined;\n    }\n  }\n  lockFiles.npmLock = lockFiles.packageLock ?? lockFiles.shrinkwrapJson;\n  delete lockFiles.packageLock;\n  delete lockFiles.shrinkwrapJson;\n\n  if (hasMultipleLockFiles(lockFiles)) {\n    logger.warn(\n      'Updating multiple npm lock files is deprecated and support will be removed in future versions.',\n    );\n  }\n\n  const { npmrc, npmrcFileName, repoNpmrc } = await resolveNpmrc(\n    packageFile,\n    config,\n  );\n\n  const yarnrcYmlFileName = await findLocalSiblingOrParent(\n    packageFile,\n    '.yarnrc.yml',\n  );\n  const yarnZeroInstall = yarnrcYmlFileName\n    ? await isZeroInstall(yarnrcYmlFileName)\n    : false;\n\n  let yarnrcConfig: YarnConfig | null = null;\n  const repoYarnrcYml = yarnrcYmlFileName\n    ? await readLocalFile(yarnrcYmlFileName, 'utf8')\n    : null;\n  if (isString(repoYarnrcYml) && repoYarnrcYml.trim().length > 0) {\n    yarnrcConfig = loadConfigFromYarnrcYml(repoYarnrcYml);\n  }\n\n  const legacyYarnrcFileName = await findLocalSiblingOrParent(\n    packageFile,\n    '.yarnrc',\n  );\n  const repoLegacyYarnrc = legacyYarnrcFileName\n    ? await readLocalFile(legacyYarnrcFileName, 'utf8')\n    : null;\n  if (isString(repoLegacyYarnrc) && repoLegacyYarnrc.trim().length > 0) {\n    yarnrcConfig = loadConfigFromLegacyYarnrc(repoLegacyYarnrc);\n  }\n\n  let pnpmWorkspaceRegistry: string | undefined;\n  let pnpmWorkspaceRegistries: Record<string, string> | undefined;\n  const pnpmWorkspaceYamlFileName = await findLocalSiblingOrParent(\n    packageFile,\n    'pnpm-workspace.yaml',\n  );\n  const repoPnpmWorkspaceYaml = pnpmWorkspaceYamlFileName\n    ? await readLocalFile(pnpmWorkspaceYamlFileName, 'utf8')\n    : null;\n  if (isNonEmptyStringAndNotWhitespace(repoPnpmWorkspaceYaml)) {\n    const parsed = await PnpmWorkspaceFile.safeParseAsync(\n      repoPnpmWorkspaceYaml,\n    );\n    if (parsed.success) {\n      pnpmWorkspaceRegistry = parsed.data.registry;\n      pnpmWorkspaceRegistries = parsed.data.registries;\n    } else {\n      logger.debug(\n        { packageFile: pnpmWorkspaceYamlFileName, err: parsed.error },\n        'Failed to parse pnpm-workspace.yaml',\n      );\n    }\n  }\n\n  if (res.deps.length === 0) {\n    logger.debug('Package file has no deps');\n    if (!(\n      !!res.managerData?.packageJsonName ||\n      !!res.packageFileVersion ||\n      !!npmrc ||\n      workspacesPackages\n    )) {\n      logger.debug('Skipping file');\n      return null;\n    }\n  }\n  let skipInstalls = config.skipInstalls;\n  if (skipInstalls === null) {\n    const hasFancyRefs = !!res.deps.some(\n      (dep) =>\n        !!dep.currentValue?.startsWith('file:') ||\n        !!dep.currentValue?.startsWith('npm:'),\n    );\n    if ((hasFancyRefs && !!lockFiles.npmLock) || yarnZeroInstall) {\n      // https://github.com/npm/cli/issues/1432\n      // Explanation:\n      //  - npm install --package-lock-only is buggy for transitive deps in file: and npm: references\n      //  - So we set skipInstalls to false if file: or npm: refs are found *and* the user hasn't explicitly set the value already\n      //  - Also, do not skip install if Yarn zero-install is used\n      logger.debug('Automatically setting skipInstalls to false');\n      skipInstalls = false;\n    } else {\n      skipInstalls = true;\n    }\n  }\n\n  const extractedConstraints = getExtractedConstraints(res.deps);\n\n  if (yarnrcConfig) {\n    for (const dep of res.deps) {\n      // v8 ignore else -- TODO: add tests #40625\n      if (dep.depName) {\n        const registryUrlFromYarnrcConfig = resolveRegistryUrl(\n          dep.packageName ?? dep.depName,\n          yarnrcConfig,\n        );\n        if (\n          registryUrlFromYarnrcConfig &&\n          dep.datasource === NpmDatasource.id\n        ) {\n          dep.registryUrls = [registryUrlFromYarnrcConfig];\n        }\n      }\n    }\n  }\n\n  // Applied after the yarnrc resolution so pnpm-workspace.yaml wins in pnpm repos\n  applyPnpmWorkspaceRegistries(\n    res.deps,\n    pnpmWorkspaceRegistries,\n    pnpmWorkspaceRegistry,\n  );\n\n  return {\n    ...res,\n    ...(isString(npmrc) && { npmrc }),\n    managerData: {\n      ...res.managerData,\n      ...lockFiles,\n      yarnZeroInstall,\n      hasPackageManager:\n        isNonEmptyStringAndNotWhitespace(packageJson.packageManager) ||\n        hasDevEnginesPackageManager(packageJson),\n      workspacesPackages,\n      npmrcFileName, // store npmrc file name so we can later tell if it came from the workspace or not\n      repoNpmrc, // stored instead of `npmrc` in the repository cache, from which `npmrc` is rebuilt\n    },\n    skipInstalls,\n    extractedConstraints,\n  };\n}\n\nexport async function extractAllPackageFiles(\n  config: ExtractConfig,\n  packageFiles: string[],\n): Promise<NpmrcPackageFile<NpmManagerData>[]> {\n  const npmFiles: NpmrcPackageFile<NpmManagerData>[] = [];\n  for (const packageFile of packageFiles) {\n    const content = await readLocalFile(packageFile, 'utf8');\n    if (content) {\n      // pnpm workspace files are their own package file, defined via managerFilePatterns.\n      if (packageFile.endsWith('pnpm-workspace.yaml')) {\n        logger.trace(\n          { packageFile },\n          `Extracting as a pnpm-workspace.yaml file`,\n        );\n        const parsedPnpmWorkspaceYaml =\n          await PnpmWorkspaceFile.safeParseAsync(content);\n        if (parsedPnpmWorkspaceYaml.success) {\n          logger.trace(\n            { packageFile },\n            `Extracting file as a pnpm workspace YAML file`,\n          );\n          const deps = await extractPnpmWorkspaceFile(\n            parsedPnpmWorkspaceYaml.data,\n            packageFile,\n          );\n          // v8 ignore else -- TODO: add test #40625\n          if (deps) {\n            npmFiles.push({\n              ...deps,\n              packageFile,\n            });\n          }\n        } else {\n          logger.warn(\n            { packageFile, err: parsedPnpmWorkspaceYaml.error },\n            `Failed to parse pnpm-workspace.yaml file`,\n          );\n        }\n      } else {\n        if (packageFile.endsWith('json')) {\n          logger.trace({ packageFile }, `Extracting as a package.json file`);\n\n          const deps = await extractPackageFile(content, packageFile, config);\n          // v8 ignore else -- TODO: add tests #40625\n          if (deps) {\n            npmFiles.push({\n              ...deps,\n              packageFile,\n            });\n          }\n        } else {\n          logger.trace({ packageFile }, `Extracting as a .yarnrc.yml file`);\n\n          const yarnConfig = loadConfigFromYarnrcYml(content);\n\n          // v8 ignore else -- TODO: add tests #40625\n          if (yarnConfig?.catalogs || yarnConfig?.catalog) {\n            const hasPackageManagerResult = await hasPackageManager(\n              upath.dirname(packageFile),\n            );\n            const catalogsDeps = await extractYarnCatalogs(\n              { catalog: yarnConfig.catalog, catalogs: yarnConfig.catalogs },\n              packageFile,\n              hasPackageManagerResult,\n            );\n            // v8 ignore else -- TODO: add tests #40625\n            if (catalogsDeps) {\n              npmFiles.push({\n                ...catalogsDeps,\n                packageFile,\n              });\n            }\n          }\n        }\n      }\n    } else {\n      logger.debug({ packageFile }, `No content found`);\n    }\n  }\n\n  await postExtract(npmFiles);\n  return npmFiles;\n}\n"],"mappings":";;;;;;;;;;;;;;AAyCA,SAAS,qBAAqB,WAAkC;CAC9D,OAAO,OAAO,OAAO,SAAS,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,SAAS;AAC5D;AAEA,eAAsB,mBACpB,SACA,aACA,QACyD;CACzD,OAAO,MAAM,0BAA0B,YAAY,EAAE;CACrD,OAAO,MAAM,EAAE,QAAQ,CAAC;CACxB,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,OAAO;CAClC,QAAQ;EACN,OAAO,MAAM,EAAE,YAAY,GAAG,cAAc;EAC5C,OAAO;CACT;CAEA,MAAM,MAAM,mBAAmB,aAAa,WAAW;CACvD,IAAI,CAAC,KACH,OAAO;CAGT,IAAI;CACJ,IAAI,QAAQ,YAAY,UAAU,GAChC,qBAAqB,YAAY;MAEjC,qBAAqB,YAAY,YAAY;CAG/C,MAAM,YAA0B;EAC9B,UAAU;EACV,aAAa;EACb,gBAAgB;EAChB,cAAc;CAChB;CAEA,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,SAAS,GAG5C;EACH,MAAM,WAAW,mBAAmB,aAAa,GAAG;EACpD,IAAI,MAAM,cAAc,UAAU,MAAM,GACtC,UAAU,OAAO;OAEjB,UAAU,OAAO,KAAA;CAErB;CACA,UAAU,UAAU,UAAU,eAAe,UAAU;CACvD,OAAO,UAAU;CACjB,OAAO,UAAU;CAEjB,IAAI,qBAAqB,SAAS,GAChC,OAAO,KACL,gGACF;CAGF,MAAM,EAAE,OAAO,eAAe,cAAc,MAAM,aAChD,aACA,MACF;CAEA,MAAM,oBAAoB,MAAM,yBAC9B,aACA,aACF;CACA,MAAM,kBAAkB,oBACpB,MAAM,cAAc,iBAAiB,IACrC;CAEJ,IAAI,eAAkC;CACtC,MAAM,gBAAgB,oBAClB,MAAM,cAAc,mBAAmB,MAAM,IAC7C;CACJ,IAAI,SAAS,aAAa,KAAK,cAAc,KAAK,CAAC,CAAC,SAAS,GAC3D,eAAe,wBAAwB,aAAa;CAGtD,MAAM,uBAAuB,MAAM,yBACjC,aACA,SACF;CACA,MAAM,mBAAmB,uBACrB,MAAM,cAAc,sBAAsB,MAAM,IAChD;CACJ,IAAI,SAAS,gBAAgB,KAAK,iBAAiB,KAAK,CAAC,CAAC,SAAS,GACjE,eAAe,2BAA2B,gBAAgB;CAG5D,IAAI;CACJ,IAAI;CACJ,MAAM,4BAA4B,MAAM,yBACtC,aACA,qBACF;CACA,MAAM,wBAAwB,4BAC1B,MAAM,cAAc,2BAA2B,MAAM,IACrD;CACJ,IAAI,iCAAiC,qBAAqB,GAAG;EAC3D,MAAM,SAAS,MAAM,kBAAkB,eACrC,qBACF;EACA,IAAI,OAAO,SAAS;GAClB,wBAAwB,OAAO,KAAK;GACpC,0BAA0B,OAAO,KAAK;EACxC,OACE,OAAO,MACL;GAAE,aAAa;GAA2B,KAAK,OAAO;EAAM,GAC5D,qCACF;CAEJ;CAEA,IAAI,IAAI,KAAK,WAAW,GAAG;EACzB,OAAO,MAAM,0BAA0B;EACvC,IAAI,EACF,CAAC,CAAC,IAAI,aAAa,mBACnB,CAAC,CAAC,IAAI,sBACN,CAAC,CAAC,SACF,qBACC;GACD,OAAO,MAAM,eAAe;GAC5B,OAAO;EACT;CACF;CACA,IAAI,eAAe,OAAO;CAC1B,IAAI,iBAAiB,MAAM;EAMzB,IAAK,CALiB,CAAC,IAAI,KAAK,MAC7B,QACC,CAAC,CAAC,IAAI,cAAc,WAAW,OAAO,KACtC,CAAC,CAAC,IAAI,cAAc,WAAW,MAAM,CACzC,KACqB,CAAC,CAAC,UAAU,WAAY,iBAAiB;GAM5D,OAAO,MAAM,6CAA6C;GAC1D,eAAe;EACjB,OACE,eAAe;CAEnB;CAEA,MAAM,uBAAuB,wBAAwB,IAAI,IAAI;CAE7D,IAAI,cACG;OAAA,MAAM,OAAO,IAAI;;EAEpB,IAAI,IAAI,SAAS;GACf,MAAM,8BAA8B,mBAClC,IAAI,eAAe,IAAI,SACvB,YACF;GACA,IACE,+BACA,IAAI,eAAe,cAAc,IAEjC,IAAI,eAAe,CAAC,2BAA2B;EAEnD;;CAKJ,6BACE,IAAI,MACJ,yBACA,qBACF;CAEA,OAAO;EACL,GAAG;EACH,GAAI,SAAS,KAAK,KAAK,EAAE,MAAM;EAC/B,aAAa;GACX,GAAG,IAAI;GACP,GAAG;GACH;GACA,mBACE,iCAAiC,YAAY,cAAc,KAC3D,4BAA4B,WAAW;GACzC;GACA;GACA;EACF;EACA;EACA;CACF;AACF;AAEA,eAAsB,uBACpB,QACA,cAC6C;CAC7C,MAAM,WAA+C,CAAC;CACtD,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,UAAU,MAAM,cAAc,aAAa,MAAM;EACvD,IAAI,SAAS;GAEX,IAAI,YAAY,SAAS,qBAAqB,GAAG;IAC/C,OAAO,MACL,EAAE,YAAY,GACd,0CACF;IACA,MAAM,0BACJ,MAAM,kBAAkB,eAAe,OAAO;IAChD,IAAI,wBAAwB,SAAS;KACnC,OAAO,MACL,EAAE,YAAY,GACd,+CACF;KACA,MAAM,OAAO,MAAM,yBACjB,wBAAwB,MACxB,WACF;;KAEA,IAAI,MACF,SAAS,KAAK;MACZ,GAAG;MACH;KACF,CAAC;IAEL,OACE,OAAO,KACL;KAAE;KAAa,KAAK,wBAAwB;IAAM,GAClD,0CACF;GAEJ,OACE,IAAI,YAAY,SAAS,MAAM,GAAG;IAChC,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;IAEjE,MAAM,OAAO,MAAM,mBAAmB,SAAS,aAAa,MAAM;;IAElE,IAAI,MACF,SAAS,KAAK;KACZ,GAAG;KACH;IACF,CAAC;GAEL,OAAO;IACL,OAAO,MAAM,EAAE,YAAY,GAAG,kCAAkC;IAEhE,MAAM,aAAa,wBAAwB,OAAO;;IAGlD,IAAI,YAAY,YAAY,YAAY,SAAS;KAC/C,MAAM,0BAA0B,MAAM,kBACpC,MAAM,QAAQ,WAAW,CAC3B;KACA,MAAM,eAAe,MAAM,oBACzB;MAAE,SAAS,WAAW;MAAS,UAAU,WAAW;KAAS,GAC7D,aACA,uBACF;;KAEA,IAAI,cACF,SAAS,KAAK;MACZ,GAAG;MACH;KACF,CAAC;IAEL;GACF;EAEJ,OACE,OAAO,MAAM,EAAE,YAAY,GAAG,kBAAkB;CAEpD;CAEA,MAAM,YAAY,QAAQ;CAC1B,OAAO;AACT"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../../lib/modules/manager/npm/extract/index.ts"],"sourcesContent":["import {\n  isArray,\n  isNonEmptyStringAndNotWhitespace,\n  isString,\n} from '@sindresorhus/is';\nimport upath from 'upath';\nimport { logger } from '../../../../logger/index.ts';\nimport {\n  findLocalSiblingOrParent,\n  getSiblingFileName,\n  readLocalFile,\n} from '../../../../util/fs/index.ts';\nimport { NpmDatasource } from '../../../datasource/npm/index.ts';\n\nimport type {\n  ExtractConfig,\n  NpmrcPackageFile,\n  NpmrcPackageFileContent,\n} from '../../types.ts';\nimport { resolveNpmrc } from '../npmrc.ts';\nimport { PnpmWorkspaceFile, type YarnConfig } from '../schema.ts';\nimport type { NpmLockFiles, NpmManagerData } from '../types.ts';\nimport { getExtractedConstraints } from './common/dependency.ts';\nimport {\n  extractPackageJson,\n  hasDevEnginesPackageManager,\n  hasPackageManager,\n} from './common/package-file.ts';\nimport {\n  applyPnpmWorkspaceRegistries,\n  extractPnpmWorkspaceFile,\n} from './pnpm.ts';\nimport { postExtract } from './post/index.ts';\nimport type { NpmPackage } from './types.ts';\nimport { extractYarnCatalogs, isZeroInstall } from './yarn.ts';\nimport {\n  loadConfigFromLegacyYarnrc,\n  loadConfigFromYarnrcYml,\n  resolveRegistryUrl,\n} from './yarnrc.ts';\n\nfunction hasMultipleLockFiles(lockFiles: NpmLockFiles): boolean {\n  return Object.values(lockFiles).filter(isString).length > 1;\n}\n\nexport async function extractPackageFile(\n  content: string,\n  packageFile: string,\n  config: ExtractConfig,\n): Promise<NpmrcPackageFileContent<NpmManagerData> | null> {\n  logger.trace(`npm.extractPackageFile(${packageFile})`);\n  logger.trace({ content });\n  let packageJson: NpmPackage;\n  try {\n    packageJson = JSON.parse(content);\n  } catch {\n    logger.debug({ packageFile }, `Invalid JSON`);\n    return null;\n  }\n\n  const res = extractPackageJson(packageJson, packageFile);\n  if (!res) {\n    return null;\n  }\n\n  let workspacesPackages: string[] | undefined;\n  if (isArray(packageJson.workspaces)) {\n    workspacesPackages = packageJson.workspaces;\n  } else {\n    workspacesPackages = packageJson.workspaces?.packages;\n  }\n\n  const lockFiles: NpmLockFiles = {\n    yarnLock: 'yarn.lock',\n    packageLock: 'package-lock.json',\n    shrinkwrapJson: 'npm-shrinkwrap.json',\n    pnpmLockFile: 'pnpm-lock.yaml',\n  };\n\n  for (const [key, val] of Object.entries(lockFiles) as [\n    'yarnLock' | 'packageLock' | 'shrinkwrapJson' | 'pnpmLockFile',\n    string,\n  ][]) {\n    const filePath = getSiblingFileName(packageFile, val);\n    if (await readLocalFile(filePath, 'utf8')) {\n      lockFiles[key] = filePath;\n    } else {\n      lockFiles[key] = undefined;\n    }\n  }\n  lockFiles.npmLock = lockFiles.packageLock ?? lockFiles.shrinkwrapJson;\n  delete lockFiles.packageLock;\n  delete lockFiles.shrinkwrapJson;\n\n  if (hasMultipleLockFiles(lockFiles)) {\n    logger.warn(\n      'Updating multiple npm lock files is deprecated and support will be removed in future versions.',\n    );\n  }\n\n  const { npmrc, npmrcFileName, repoNpmrc } = await resolveNpmrc(\n    packageFile,\n    config,\n  );\n\n  const yarnrcYmlFileName = await findLocalSiblingOrParent(\n    packageFile,\n    '.yarnrc.yml',\n  );\n  const yarnZeroInstall = yarnrcYmlFileName\n    ? await isZeroInstall(yarnrcYmlFileName)\n    : false;\n\n  let yarnrcConfig: YarnConfig | null = null;\n  const repoYarnrcYml = yarnrcYmlFileName\n    ? await readLocalFile(yarnrcYmlFileName, 'utf8')\n    : null;\n  if (isString(repoYarnrcYml) && repoYarnrcYml.trim().length > 0) {\n    yarnrcConfig = loadConfigFromYarnrcYml(repoYarnrcYml);\n  }\n\n  const legacyYarnrcFileName = await findLocalSiblingOrParent(\n    packageFile,\n    '.yarnrc',\n  );\n  const repoLegacyYarnrc = legacyYarnrcFileName\n    ? await readLocalFile(legacyYarnrcFileName, 'utf8')\n    : null;\n  if (isString(repoLegacyYarnrc) && repoLegacyYarnrc.trim().length > 0) {\n    yarnrcConfig = loadConfigFromLegacyYarnrc(repoLegacyYarnrc);\n  }\n\n  let pnpmWorkspaceRegistry: string | undefined;\n  let pnpmWorkspaceRegistries: Record<string, string> | undefined;\n  const pnpmWorkspaceYamlFileName = await findLocalSiblingOrParent(\n    packageFile,\n    'pnpm-workspace.yaml',\n  );\n  const repoPnpmWorkspaceYaml = pnpmWorkspaceYamlFileName\n    ? await readLocalFile(pnpmWorkspaceYamlFileName, 'utf8')\n    : null;\n  if (isNonEmptyStringAndNotWhitespace(repoPnpmWorkspaceYaml)) {\n    const parsed = await PnpmWorkspaceFile.safeParseAsync(\n      repoPnpmWorkspaceYaml,\n    );\n    if (parsed.success) {\n      pnpmWorkspaceRegistry = parsed.data.registry;\n      pnpmWorkspaceRegistries = parsed.data.registries;\n    } else {\n      logger.debug(\n        { packageFile: pnpmWorkspaceYamlFileName, err: parsed.error },\n        'Failed to parse pnpm-workspace.yaml',\n      );\n    }\n  }\n\n  if (res.deps.length === 0) {\n    logger.debug('Package file has no deps');\n    if (!(\n      !!res.managerData?.packageJsonName ||\n      !!res.packageFileVersion ||\n      !!npmrc ||\n      workspacesPackages\n    )) {\n      logger.debug('Skipping file');\n      return null;\n    }\n  }\n  let skipInstalls = config.skipInstalls;\n  if (skipInstalls === null) {\n    const hasFancyRefs = !!res.deps.some(\n      (dep) =>\n        !!dep.currentValue?.startsWith('file:') ||\n        !!dep.currentValue?.startsWith('npm:'),\n    );\n    const hasFancyRefsWithNpmLock = hasFancyRefs && !!lockFiles.npmLock;\n    if (hasFancyRefsWithNpmLock || yarnZeroInstall) {\n      // https://github.com/npm/cli/issues/1432\n      // Explanation:\n      //  - npm install --package-lock-only is buggy for transitive deps in file: and npm: references\n      //  - So we set skipInstalls to false if file: or npm: refs are found *and* the user hasn't explicitly set the value already\n      //  - Also, do not skip install if Yarn zero-install is used\n      logger.debug('Automatically setting skipInstalls to false');\n      skipInstalls = false;\n    } else {\n      skipInstalls = true;\n    }\n  }\n\n  const extractedConstraints = getExtractedConstraints(res.deps);\n\n  if (yarnrcConfig) {\n    for (const dep of res.deps) {\n      // v8 ignore else -- TODO: add tests #40625\n      if (dep.depName) {\n        const registryUrlFromYarnrcConfig = resolveRegistryUrl(\n          dep.packageName ?? dep.depName,\n          yarnrcConfig,\n        );\n        if (\n          registryUrlFromYarnrcConfig &&\n          dep.datasource === NpmDatasource.id\n        ) {\n          dep.registryUrls = [registryUrlFromYarnrcConfig];\n        }\n      }\n    }\n  }\n\n  // Applied after the yarnrc resolution so pnpm-workspace.yaml wins in pnpm repos\n  applyPnpmWorkspaceRegistries(\n    res.deps,\n    pnpmWorkspaceRegistries,\n    pnpmWorkspaceRegistry,\n  );\n\n  return {\n    ...res,\n    ...(isString(npmrc) && { npmrc }),\n    managerData: {\n      ...res.managerData,\n      ...lockFiles,\n      yarnZeroInstall,\n      hasPackageManager:\n        isNonEmptyStringAndNotWhitespace(packageJson.packageManager) ||\n        hasDevEnginesPackageManager(packageJson),\n      workspacesPackages,\n      npmrcFileName, // store npmrc file name so we can later tell if it came from the workspace or not\n      repoNpmrc, // stored instead of `npmrc` in the repository cache, from which `npmrc` is rebuilt\n    },\n    skipInstalls,\n    extractedConstraints,\n  };\n}\n\nexport async function extractAllPackageFiles(\n  config: ExtractConfig,\n  packageFiles: string[],\n): Promise<NpmrcPackageFile<NpmManagerData>[]> {\n  const npmFiles: NpmrcPackageFile<NpmManagerData>[] = [];\n  for (const packageFile of packageFiles) {\n    const content = await readLocalFile(packageFile, 'utf8');\n    if (content) {\n      // pnpm workspace files are their own package file, defined via managerFilePatterns.\n      if (packageFile.endsWith('pnpm-workspace.yaml')) {\n        logger.trace(\n          { packageFile },\n          `Extracting as a pnpm-workspace.yaml file`,\n        );\n        const parsedPnpmWorkspaceYaml =\n          await PnpmWorkspaceFile.safeParseAsync(content);\n        if (parsedPnpmWorkspaceYaml.success) {\n          logger.trace(\n            { packageFile },\n            `Extracting file as a pnpm workspace YAML file`,\n          );\n          const deps = await extractPnpmWorkspaceFile(\n            parsedPnpmWorkspaceYaml.data,\n            packageFile,\n          );\n          // v8 ignore else -- TODO: add test #40625\n          if (deps) {\n            npmFiles.push({\n              ...deps,\n              packageFile,\n            });\n          }\n        } else {\n          logger.warn(\n            { packageFile, err: parsedPnpmWorkspaceYaml.error },\n            `Failed to parse pnpm-workspace.yaml file`,\n          );\n        }\n      } else {\n        if (packageFile.endsWith('json')) {\n          logger.trace({ packageFile }, `Extracting as a package.json file`);\n\n          const deps = await extractPackageFile(content, packageFile, config);\n          // v8 ignore else -- TODO: add tests #40625\n          if (deps) {\n            npmFiles.push({\n              ...deps,\n              packageFile,\n            });\n          }\n        } else {\n          logger.trace({ packageFile }, `Extracting as a .yarnrc.yml file`);\n\n          const yarnConfig = loadConfigFromYarnrcYml(content);\n\n          // v8 ignore else -- TODO: add tests #40625\n          if (yarnConfig?.catalogs || yarnConfig?.catalog) {\n            const hasPackageManagerResult = await hasPackageManager(\n              upath.dirname(packageFile),\n            );\n            const catalogsDeps = await extractYarnCatalogs(\n              { catalog: yarnConfig.catalog, catalogs: yarnConfig.catalogs },\n              packageFile,\n              hasPackageManagerResult,\n            );\n            // v8 ignore else -- TODO: add tests #40625\n            if (catalogsDeps) {\n              npmFiles.push({\n                ...catalogsDeps,\n                packageFile,\n              });\n            }\n          }\n        }\n      }\n    } else {\n      logger.debug({ packageFile }, `No content found`);\n    }\n  }\n\n  await postExtract(npmFiles);\n  return npmFiles;\n}\n"],"mappings":";;;;;;;;;;;;;;AAyCA,SAAS,qBAAqB,WAAkC;CAC9D,OAAO,OAAO,OAAO,SAAS,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,SAAS;AAC5D;AAEA,eAAsB,mBACpB,SACA,aACA,QACyD;CACzD,OAAO,MAAM,0BAA0B,YAAY,EAAE;CACrD,OAAO,MAAM,EAAE,QAAQ,CAAC;CACxB,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,OAAO;CAClC,QAAQ;EACN,OAAO,MAAM,EAAE,YAAY,GAAG,cAAc;EAC5C,OAAO;CACT;CAEA,MAAM,MAAM,mBAAmB,aAAa,WAAW;CACvD,IAAI,CAAC,KACH,OAAO;CAGT,IAAI;CACJ,IAAI,QAAQ,YAAY,UAAU,GAChC,qBAAqB,YAAY;MAEjC,qBAAqB,YAAY,YAAY;CAG/C,MAAM,YAA0B;EAC9B,UAAU;EACV,aAAa;EACb,gBAAgB;EAChB,cAAc;CAChB;CAEA,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,SAAS,GAG5C;EACH,MAAM,WAAW,mBAAmB,aAAa,GAAG;EACpD,IAAI,MAAM,cAAc,UAAU,MAAM,GACtC,UAAU,OAAO;OAEjB,UAAU,OAAO,KAAA;CAErB;CACA,UAAU,UAAU,UAAU,eAAe,UAAU;CACvD,OAAO,UAAU;CACjB,OAAO,UAAU;CAEjB,IAAI,qBAAqB,SAAS,GAChC,OAAO,KACL,gGACF;CAGF,MAAM,EAAE,OAAO,eAAe,cAAc,MAAM,aAChD,aACA,MACF;CAEA,MAAM,oBAAoB,MAAM,yBAC9B,aACA,aACF;CACA,MAAM,kBAAkB,oBACpB,MAAM,cAAc,iBAAiB,IACrC;CAEJ,IAAI,eAAkC;CACtC,MAAM,gBAAgB,oBAClB,MAAM,cAAc,mBAAmB,MAAM,IAC7C;CACJ,IAAI,SAAS,aAAa,KAAK,cAAc,KAAK,CAAC,CAAC,SAAS,GAC3D,eAAe,wBAAwB,aAAa;CAGtD,MAAM,uBAAuB,MAAM,yBACjC,aACA,SACF;CACA,MAAM,mBAAmB,uBACrB,MAAM,cAAc,sBAAsB,MAAM,IAChD;CACJ,IAAI,SAAS,gBAAgB,KAAK,iBAAiB,KAAK,CAAC,CAAC,SAAS,GACjE,eAAe,2BAA2B,gBAAgB;CAG5D,IAAI;CACJ,IAAI;CACJ,MAAM,4BAA4B,MAAM,yBACtC,aACA,qBACF;CACA,MAAM,wBAAwB,4BAC1B,MAAM,cAAc,2BAA2B,MAAM,IACrD;CACJ,IAAI,iCAAiC,qBAAqB,GAAG;EAC3D,MAAM,SAAS,MAAM,kBAAkB,eACrC,qBACF;EACA,IAAI,OAAO,SAAS;GAClB,wBAAwB,OAAO,KAAK;GACpC,0BAA0B,OAAO,KAAK;EACxC,OACE,OAAO,MACL;GAAE,aAAa;GAA2B,KAAK,OAAO;EAAM,GAC5D,qCACF;CAEJ;CAEA,IAAI,IAAI,KAAK,WAAW,GAAG;EACzB,OAAO,MAAM,0BAA0B;EACvC,IAAI,EACF,CAAC,CAAC,IAAI,aAAa,mBACnB,CAAC,CAAC,IAAI,sBACN,CAAC,CAAC,SACF,qBACC;GACD,OAAO,MAAM,eAAe;GAC5B,OAAO;EACT;CACF;CACA,IAAI,eAAe,OAAO;CAC1B,IAAI,iBAAiB,MAAM;EAOzB,IADgC,CALV,CAAC,IAAI,KAAK,MAC7B,QACC,CAAC,CAAC,IAAI,cAAc,WAAW,OAAO,KACtC,CAAC,CAAC,IAAI,cAAc,WAAW,MAAM,CACzC,KACgD,CAAC,CAAC,UAAU,WAC7B,iBAAiB;GAM9C,OAAO,MAAM,6CAA6C;GAC1D,eAAe;EACjB,OACE,eAAe;CAEnB;CAEA,MAAM,uBAAuB,wBAAwB,IAAI,IAAI;CAE7D,IAAI,cACG;OAAA,MAAM,OAAO,IAAI;;EAEpB,IAAI,IAAI,SAAS;GACf,MAAM,8BAA8B,mBAClC,IAAI,eAAe,IAAI,SACvB,YACF;GACA,IACE,+BACA,IAAI,eAAe,cAAc,IAEjC,IAAI,eAAe,CAAC,2BAA2B;EAEnD;;CAKJ,6BACE,IAAI,MACJ,yBACA,qBACF;CAEA,OAAO;EACL,GAAG;EACH,GAAI,SAAS,KAAK,KAAK,EAAE,MAAM;EAC/B,aAAa;GACX,GAAG,IAAI;GACP,GAAG;GACH;GACA,mBACE,iCAAiC,YAAY,cAAc,KAC3D,4BAA4B,WAAW;GACzC;GACA;GACA;EACF;EACA;EACA;CACF;AACF;AAEA,eAAsB,uBACpB,QACA,cAC6C;CAC7C,MAAM,WAA+C,CAAC;CACtD,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,UAAU,MAAM,cAAc,aAAa,MAAM;EACvD,IAAI,SAAS;GAEX,IAAI,YAAY,SAAS,qBAAqB,GAAG;IAC/C,OAAO,MACL,EAAE,YAAY,GACd,0CACF;IACA,MAAM,0BACJ,MAAM,kBAAkB,eAAe,OAAO;IAChD,IAAI,wBAAwB,SAAS;KACnC,OAAO,MACL,EAAE,YAAY,GACd,+CACF;KACA,MAAM,OAAO,MAAM,yBACjB,wBAAwB,MACxB,WACF;;KAEA,IAAI,MACF,SAAS,KAAK;MACZ,GAAG;MACH;KACF,CAAC;IAEL,OACE,OAAO,KACL;KAAE;KAAa,KAAK,wBAAwB;IAAM,GAClD,0CACF;GAEJ,OACE,IAAI,YAAY,SAAS,MAAM,GAAG;IAChC,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;IAEjE,MAAM,OAAO,MAAM,mBAAmB,SAAS,aAAa,MAAM;;IAElE,IAAI,MACF,SAAS,KAAK;KACZ,GAAG;KACH;IACF,CAAC;GAEL,OAAO;IACL,OAAO,MAAM,EAAE,YAAY,GAAG,kCAAkC;IAEhE,MAAM,aAAa,wBAAwB,OAAO;;IAGlD,IAAI,YAAY,YAAY,YAAY,SAAS;KAC/C,MAAM,0BAA0B,MAAM,kBACpC,MAAM,QAAQ,WAAW,CAC3B;KACA,MAAM,eAAe,MAAM,oBACzB;MAAE,SAAS,WAAW;MAAS,UAAU,WAAW;KAAS,GAC7D,aACA,uBACF;;KAEA,IAAI,cACF,SAAS,KAAK;MACZ,GAAG;MACH;KACF,CAAC;IAEL;GACF;EAEJ,OACE,OAAO,MAAM,EAAE,YAAY,GAAG,kBAAkB;CAEpD;CAEA,MAAM,YAAY,QAAQ;CAC1B,OAAO;AACT"}

package/dist/modules/manager/npm/extract/post/locked-versions.js.map

@@ -1 +1 @@
-{"version":3,"file":"locked-versions.js","names":[],"sources":["../../../../../../lib/modules/manager/npm/extract/post/locked-versions.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport semver from 'semver';\nimport upath from 'upath';\nimport { logger } from '../../../../../logger/index.ts';\nimport { regEx } from '../../../../../util/regex.ts';\nimport type { PackageFile } from '../../../types.ts';\nimport type { NpmManagerData } from '../../types.ts';\nimport { getNpmLock } from '../npm.ts';\nimport { getPnpmLock } from '../pnpm.ts';\nimport type { LockFile } from '../types.ts';\nimport { getYarnLock, getYarnVersionFromLock } from '../yarn.ts';\n\nconst pnpmCatalogDepTypeRe = regEx(/pnpm\\.catalog\\.(?<version>.*)/);\n\nexport async function getLockedVersions(\n  packageFiles: PackageFile<NpmManagerData>[],\n): Promise<void> {\n  const lockFileCache: Record<string, LockFile> = {};\n  logger.debug('Finding locked versions');\n  for (const packageFile of packageFiles) {\n    const { managerData = {} } = packageFile;\n    const { yarnLock, npmLock, pnpmLockFile } = managerData;\n    const lockFiles: string[] = [];\n    if (yarnLock) {\n      logger.trace('Found yarnLock');\n      lockFiles.push(yarnLock);\n      // v8 ignore else -- TODO: add test #40625\n      if (!lockFileCache[yarnLock]) {\n        logger.trace(`Retrieving/parsing ${yarnLock}`);\n        lockFileCache[yarnLock] = await getYarnLock(yarnLock);\n      }\n      const { isYarn1 } = lockFileCache[yarnLock];\n      let yarn: string | undefined;\n      if (!isYarn1 && !packageFile.extractedConstraints?.yarn) {\n        yarn = getYarnVersionFromLock(lockFileCache[yarnLock]);\n      }\n      if (yarn) {\n        packageFile.extractedConstraints ??= {};\n        packageFile.extractedConstraints.yarn = yarn;\n      }\n      for (const dep of packageFile.deps) {\n        if (\n          dep.depType !== 'devEngines.runtime' &&\n          dep.depType !== 'devEngines.packageManager'\n        ) {\n          dep.lockedVersion =\n            lockFileCache[yarnLock].lockedVersions?.[\n              // TODO: types (#22198)\n              `${dep.depName}@${dep.currentValue}`\n            ];\n        }\n        if (\n          (dep.depType === 'engines' ||\n            dep.depType === 'packageManager' ||\n            dep.depType === 'devEngines.packageManager') &&\n          dep.depName === 'yarn' &&\n          !isYarn1\n        ) {\n          dep.packageName = '@yarnpkg/cli-dist';\n        }\n      }\n    } else if (npmLock) {\n      logger.debug(`Found ${npmLock} for ${packageFile.packageFile}`);\n      lockFiles.push(npmLock);\n      if (!lockFileCache[npmLock]) {\n        logger.trace(`Retrieving/parsing ${npmLock}`);\n        const cache = await getNpmLock(npmLock);\n        /* v8 ignore next -- needs test */\n        if (!cache) {\n          logger.warn({ npmLock }, 'Npm: unable to get lockfile');\n          return;\n        }\n        lockFileCache[npmLock] = cache;\n      }\n\n      const { lockfileVersion } = lockFileCache[npmLock];\n      let npm: string | undefined;\n      if (lockfileVersion === 1) {\n        if (packageFile.extractedConstraints?.npm) {\n          // Add a <7 constraint if it's not already a fixed version\n          if (\n            semver.satisfies('6.14.18', packageFile.extractedConstraints.npm)\n          ) {\n            npm = `${packageFile.extractedConstraints.npm} <7`;\n          }\n        } else {\n          npm = '<7';\n        }\n      } else if (lockfileVersion === 2) {\n        if (packageFile.extractedConstraints?.npm) {\n          // Add a <9 constraint if the latest 8.x is compatible\n          if (\n            semver.satisfies('8.19.3', packageFile.extractedConstraints.npm)\n          ) {\n            npm = `${packageFile.extractedConstraints.npm} <9`;\n          }\n        } else {\n          npm = '<9';\n        }\n      } else if (lockfileVersion === 3) {\n        if (!packageFile.extractedConstraints?.npm) {\n          npm = '>=7';\n        }\n      } else {\n        logger.warn(\n          { lockfileVersion, npmLock },\n          'Found unsupported npm lockfile version',\n        );\n        return;\n      }\n      if (npm) {\n        packageFile.extractedConstraints ??= {};\n        packageFile.extractedConstraints.npm = npm;\n      }\n\n      const packageDir = upath.dirname(packageFile.packageFile);\n      const npmRootDir = upath.dirname(npmLock);\n      const relativeDir = upath.relative(npmRootDir, packageDir);\n\n      for (const dep of packageFile.deps) {\n        // Skip dependency types which are not locked in the lock file\n        if (\n          dep.depType === 'engines' ||\n          dep.depType === 'packageManager' ||\n          dep.depType === 'volta' ||\n          dep.depType === 'devEngines.runtime' ||\n          dep.depType === 'devEngines.packageManager'\n        ) {\n          continue;\n        }\n\n        // TODO: types (#22198)\n        let lockedDepName = dep.depName!;\n        if (relativeDir && relativeDir !== '.') {\n          lockedDepName = `${relativeDir}/node_modules/${dep.depName}`;\n        }\n\n        dep.lockedVersion = semver.valid(\n          lockFileCache[npmLock].lockedVersions?.[lockedDepName],\n        )!;\n      }\n    } else if (pnpmLockFile) {\n      logger.debug('Found pnpm lock-file');\n      lockFiles.push(pnpmLockFile);\n      if (!lockFileCache[pnpmLockFile]) {\n        logger.trace(`Retrieving/parsing ${pnpmLockFile}`);\n        lockFileCache[pnpmLockFile] = await getPnpmLock(pnpmLockFile);\n      }\n\n      const packageDir = upath.dirname(packageFile.packageFile);\n      const pnpmRootDir = upath.dirname(pnpmLockFile);\n      const relativeDir = upath.relative(pnpmRootDir, packageDir) || '.';\n\n      for (const dep of packageFile.deps) {\n        const { depName, depType } = dep;\n\n        const catalogName = pnpmCatalogDepTypeRe.exec(depType!)?.groups\n          ?.version;\n\n        if (catalogName) {\n          const lockedVersion = semver.valid(\n            lockFileCache[pnpmLockFile].lockedVersionsWithCatalog?.[\n              catalogName\n            ]?.[depName!],\n          );\n\n          // v8 ignore else -- TODO: add test #40625\n          if (isString(lockedVersion)) {\n            dep.lockedVersion = lockedVersion;\n          }\n        } else {\n          // TODO: types (#22198)\n          const lockedVersion = semver.valid(\n            lockFileCache[pnpmLockFile].lockedVersionsWithPath?.[relativeDir]?.[\n              depType!\n            ]?.[depName!],\n          );\n\n          // v8 ignore else -- TODO: add test #40625\n          if (isString(lockedVersion)) {\n            dep.lockedVersion = lockedVersion;\n          }\n        }\n      }\n    }\n    if (lockFiles.length) {\n      packageFile.lockFiles = lockFiles;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,MAAM,uBAAuB,MAAM,+BAA+B;AAElE,eAAsB,kBACpB,cACe;CACf,MAAM,gBAA0C,CAAC;CACjD,OAAO,MAAM,yBAAyB;CACtC,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,EAAE,cAAc,CAAC,MAAM;EAC7B,MAAM,EAAE,UAAU,SAAS,iBAAiB;EAC5C,MAAM,YAAsB,CAAC;EAC7B,IAAI,UAAU;GACZ,OAAO,MAAM,gBAAgB;GAC7B,UAAU,KAAK,QAAQ;;GAEvB,IAAI,CAAC,cAAc,WAAW;IAC5B,OAAO,MAAM,sBAAsB,UAAU;IAC7C,cAAc,YAAY,MAAM,YAAY,QAAQ;GACtD;GACA,MAAM,EAAE,YAAY,cAAc;GAClC,IAAI;GACJ,IAAI,CAAC,WAAW,CAAC,YAAY,sBAAsB,MACjD,OAAO,uBAAuB,cAAc,SAAS;GAEvD,IAAI,MAAM;IACR,YAAY,yBAAyB,CAAC;IACtC,YAAY,qBAAqB,OAAO;GAC1C;GACA,KAAK,MAAM,OAAO,YAAY,MAAM;IAClC,IACE,IAAI,YAAY,wBAChB,IAAI,YAAY,6BAEhB,IAAI,gBACF,cAAc,SAAS,CAAC,iBAEtB,GAAG,IAAI,QAAQ,GAAG,IAAI;IAG5B,KACG,IAAI,YAAY,aACf,IAAI,YAAY,oBAChB,IAAI,YAAY,gCAClB,IAAI,YAAY,UAChB,CAAC,SAED,IAAI,cAAc;GAEtB;EACF,OAAO,IAAI,SAAS;GAClB,OAAO,MAAM,SAAS,QAAQ,OAAO,YAAY,aAAa;GAC9D,UAAU,KAAK,OAAO;GACtB,IAAI,CAAC,cAAc,UAAU;IAC3B,OAAO,MAAM,sBAAsB,SAAS;IAC5C,MAAM,QAAQ,MAAM,WAAW,OAAO;;IAEtC,IAAI,CAAC,OAAO;KACV,OAAO,KAAK,EAAE,QAAQ,GAAG,6BAA6B;KACtD;IACF;IACA,cAAc,WAAW;GAC3B;GAEA,MAAM,EAAE,oBAAoB,cAAc;GAC1C,IAAI;GACJ,IAAI,oBAAoB,GAAG;IACzB,IAAI,YAAY,sBAAsB,KAGlC;SAAA,OAAO,UAAU,WAAW,YAAY,qBAAqB,GAAG,GAEhE,MAAM,GAAG,YAAY,qBAAqB,IAAI;IAAA,OAGhD,MAAM;GAEV,OAAO,IAAI,oBAAoB,GAAG;IAChC,IAAI,YAAY,sBAAsB,KAGlC;SAAA,OAAO,UAAU,UAAU,YAAY,qBAAqB,GAAG,GAE/D,MAAM,GAAG,YAAY,qBAAqB,IAAI;IAAA,OAGhD,MAAM;GAEV,OAAO,IAAI,oBAAoB,GACzB;QAAA,CAAC,YAAY,sBAAsB,KACrC,MAAM;GAAA,OAEH;IACL,OAAO,KACL;KAAE;KAAiB;IAAQ,GAC3B,wCACF;IACA;GACF;GACA,IAAI,KAAK;IACP,YAAY,yBAAyB,CAAC;IACtC,YAAY,qBAAqB,MAAM;GACzC;GAEA,MAAM,aAAa,MAAM,QAAQ,YAAY,WAAW;GACxD,MAAM,aAAa,MAAM,QAAQ,OAAO;GACxC,MAAM,cAAc,MAAM,SAAS,YAAY,UAAU;GAEzD,KAAK,MAAM,OAAO,YAAY,MAAM;IAElC,IACE,IAAI,YAAY,aAChB,IAAI,YAAY,oBAChB,IAAI,YAAY,WAChB,IAAI,YAAY,wBAChB,IAAI,YAAY,6BAEhB;IAIF,IAAI,gBAAgB,IAAI;IACxB,IAAI,eAAe,gBAAgB,KACjC,gBAAgB,GAAG,YAAY,gBAAgB,IAAI;IAGrD,IAAI,gBAAgB,OAAO,MACzB,cAAc,QAAQ,CAAC,iBAAiB,cAC1C;GACF;EACF,OAAO,IAAI,cAAc;GACvB,OAAO,MAAM,sBAAsB;GACnC,UAAU,KAAK,YAAY;GAC3B,IAAI,CAAC,cAAc,eAAe;IAChC,OAAO,MAAM,sBAAsB,cAAc;IACjD,cAAc,gBAAgB,MAAM,YAAY,YAAY;GAC9D;GAEA,MAAM,aAAa,MAAM,QAAQ,YAAY,WAAW;GACxD,MAAM,cAAc,MAAM,QAAQ,YAAY;GAC9C,MAAM,cAAc,MAAM,SAAS,aAAa,UAAU,KAAK;GAE/D,KAAK,MAAM,OAAO,YAAY,MAAM;IAClC,MAAM,EAAE,SAAS,YAAY;IAE7B,MAAM,cAAc,qBAAqB,KAAK,OAAQ,CAAC,EAAE,QACrD;IAEJ,IAAI,aAAa;KACf,MAAM,gBAAgB,OAAO,MAC3B,cAAc,aAAa,CAAC,4BAC1B,YACD,GAAG,QACN;;KAGA,IAAI,SAAS,aAAa,GACxB,IAAI,gBAAgB;IAExB,OAAO;KAEL,MAAM,gBAAgB,OAAO,MAC3B,cAAc,aAAa,CAAC,yBAAyB,YAAY,GAC/D,QACD,GAAG,QACN;;KAGA,IAAI,SAAS,aAAa,GACxB,IAAI,gBAAgB;IAExB;GACF;EACF;EACA,IAAI,UAAU,QACZ,YAAY,YAAY;CAE5B;AACF"}
+{"version":3,"file":"locked-versions.js","names":[],"sources":["../../../../../../lib/modules/manager/npm/extract/post/locked-versions.ts"],"sourcesContent":["import { isString } from '@sindresorhus/is';\nimport semver from 'semver';\nimport upath from 'upath';\nimport { logger } from '../../../../../logger/index.ts';\nimport { regEx } from '../../../../../util/regex.ts';\nimport type { PackageFile } from '../../../types.ts';\nimport type { NpmManagerData } from '../../types.ts';\nimport { getNpmLock } from '../npm.ts';\nimport { getPnpmLock } from '../pnpm.ts';\nimport type { LockFile } from '../types.ts';\nimport { getYarnLock, getYarnVersionFromLock } from '../yarn.ts';\n\nconst pnpmCatalogDepTypeRe = regEx(/pnpm\\.catalog\\.(?<version>.*)/);\n\nexport async function getLockedVersions(\n  packageFiles: PackageFile<NpmManagerData>[],\n): Promise<void> {\n  const lockFileCache: Record<string, LockFile> = {};\n  logger.debug('Finding locked versions');\n  for (const packageFile of packageFiles) {\n    const { managerData = {} } = packageFile;\n    const { yarnLock, npmLock, pnpmLockFile } = managerData;\n    const lockFiles: string[] = [];\n    if (yarnLock) {\n      logger.trace('Found yarnLock');\n      lockFiles.push(yarnLock);\n      // v8 ignore else -- TODO: add test #40625\n      if (!lockFileCache[yarnLock]) {\n        logger.trace(`Retrieving/parsing ${yarnLock}`);\n        lockFileCache[yarnLock] = await getYarnLock(yarnLock);\n      }\n      const { isYarn1 } = lockFileCache[yarnLock];\n      let yarn: string | undefined;\n      if (!isYarn1 && !packageFile.extractedConstraints?.yarn) {\n        yarn = getYarnVersionFromLock(lockFileCache[yarnLock]);\n      }\n      if (yarn) {\n        packageFile.extractedConstraints ??= {};\n        packageFile.extractedConstraints.yarn = yarn;\n      }\n      for (const dep of packageFile.deps) {\n        if (\n          dep.depType !== 'devEngines.runtime' &&\n          dep.depType !== 'devEngines.packageManager'\n        ) {\n          dep.lockedVersion =\n            lockFileCache[yarnLock].lockedVersions?.[\n              // TODO: types (#22198)\n              `${dep.depName}@${dep.currentValue}`\n            ];\n        }\n        const isPackageManagerDepType =\n          dep.depType === 'engines' ||\n          dep.depType === 'packageManager' ||\n          dep.depType === 'devEngines.packageManager';\n        if (isPackageManagerDepType && dep.depName === 'yarn' && !isYarn1) {\n          dep.packageName = '@yarnpkg/cli-dist';\n        }\n      }\n    } else if (npmLock) {\n      logger.debug(`Found ${npmLock} for ${packageFile.packageFile}`);\n      lockFiles.push(npmLock);\n      if (!lockFileCache[npmLock]) {\n        logger.trace(`Retrieving/parsing ${npmLock}`);\n        const cache = await getNpmLock(npmLock);\n        /* v8 ignore next -- needs test */\n        if (!cache) {\n          logger.warn({ npmLock }, 'Npm: unable to get lockfile');\n          return;\n        }\n        lockFileCache[npmLock] = cache;\n      }\n\n      const { lockfileVersion } = lockFileCache[npmLock];\n      let npm: string | undefined;\n      if (lockfileVersion === 1) {\n        if (packageFile.extractedConstraints?.npm) {\n          // Add a <7 constraint if it's not already a fixed version\n          if (\n            semver.satisfies('6.14.18', packageFile.extractedConstraints.npm)\n          ) {\n            npm = `${packageFile.extractedConstraints.npm} <7`;\n          }\n        } else {\n          npm = '<7';\n        }\n      } else if (lockfileVersion === 2) {\n        if (packageFile.extractedConstraints?.npm) {\n          // Add a <9 constraint if the latest 8.x is compatible\n          if (\n            semver.satisfies('8.19.3', packageFile.extractedConstraints.npm)\n          ) {\n            npm = `${packageFile.extractedConstraints.npm} <9`;\n          }\n        } else {\n          npm = '<9';\n        }\n      } else if (lockfileVersion === 3) {\n        if (!packageFile.extractedConstraints?.npm) {\n          npm = '>=7';\n        }\n      } else {\n        logger.warn(\n          { lockfileVersion, npmLock },\n          'Found unsupported npm lockfile version',\n        );\n        return;\n      }\n      if (npm) {\n        packageFile.extractedConstraints ??= {};\n        packageFile.extractedConstraints.npm = npm;\n      }\n\n      const packageDir = upath.dirname(packageFile.packageFile);\n      const npmRootDir = upath.dirname(npmLock);\n      const relativeDir = upath.relative(npmRootDir, packageDir);\n\n      for (const dep of packageFile.deps) {\n        // Skip dependency types which are not locked in the lock file\n        if (\n          dep.depType === 'engines' ||\n          dep.depType === 'packageManager' ||\n          dep.depType === 'volta' ||\n          dep.depType === 'devEngines.runtime' ||\n          dep.depType === 'devEngines.packageManager'\n        ) {\n          continue;\n        }\n\n        // TODO: types (#22198)\n        let lockedDepName = dep.depName!;\n        if (relativeDir && relativeDir !== '.') {\n          lockedDepName = `${relativeDir}/node_modules/${dep.depName}`;\n        }\n\n        dep.lockedVersion = semver.valid(\n          lockFileCache[npmLock].lockedVersions?.[lockedDepName],\n        )!;\n      }\n    } else if (pnpmLockFile) {\n      logger.debug('Found pnpm lock-file');\n      lockFiles.push(pnpmLockFile);\n      if (!lockFileCache[pnpmLockFile]) {\n        logger.trace(`Retrieving/parsing ${pnpmLockFile}`);\n        lockFileCache[pnpmLockFile] = await getPnpmLock(pnpmLockFile);\n      }\n\n      const packageDir = upath.dirname(packageFile.packageFile);\n      const pnpmRootDir = upath.dirname(pnpmLockFile);\n      const relativeDir = upath.relative(pnpmRootDir, packageDir) || '.';\n\n      for (const dep of packageFile.deps) {\n        const { depName, depType } = dep;\n\n        const catalogName = pnpmCatalogDepTypeRe.exec(depType!)?.groups\n          ?.version;\n\n        if (catalogName) {\n          const lockedVersion = semver.valid(\n            lockFileCache[pnpmLockFile].lockedVersionsWithCatalog?.[\n              catalogName\n            ]?.[depName!],\n          );\n\n          // v8 ignore else -- TODO: add test #40625\n          if (isString(lockedVersion)) {\n            dep.lockedVersion = lockedVersion;\n          }\n        } else {\n          // TODO: types (#22198)\n          const lockedVersion = semver.valid(\n            lockFileCache[pnpmLockFile].lockedVersionsWithPath?.[relativeDir]?.[\n              depType!\n            ]?.[depName!],\n          );\n\n          // v8 ignore else -- TODO: add test #40625\n          if (isString(lockedVersion)) {\n            dep.lockedVersion = lockedVersion;\n          }\n        }\n      }\n    }\n    if (lockFiles.length) {\n      packageFile.lockFiles = lockFiles;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,MAAM,uBAAuB,MAAM,+BAA+B;AAElE,eAAsB,kBACpB,cACe;CACf,MAAM,gBAA0C,CAAC;CACjD,OAAO,MAAM,yBAAyB;CACtC,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,EAAE,cAAc,CAAC,MAAM;EAC7B,MAAM,EAAE,UAAU,SAAS,iBAAiB;EAC5C,MAAM,YAAsB,CAAC;EAC7B,IAAI,UAAU;GACZ,OAAO,MAAM,gBAAgB;GAC7B,UAAU,KAAK,QAAQ;;GAEvB,IAAI,CAAC,cAAc,WAAW;IAC5B,OAAO,MAAM,sBAAsB,UAAU;IAC7C,cAAc,YAAY,MAAM,YAAY,QAAQ;GACtD;GACA,MAAM,EAAE,YAAY,cAAc;GAClC,IAAI;GACJ,IAAI,CAAC,WAAW,CAAC,YAAY,sBAAsB,MACjD,OAAO,uBAAuB,cAAc,SAAS;GAEvD,IAAI,MAAM;IACR,YAAY,yBAAyB,CAAC;IACtC,YAAY,qBAAqB,OAAO;GAC1C;GACA,KAAK,MAAM,OAAO,YAAY,MAAM;IAClC,IACE,IAAI,YAAY,wBAChB,IAAI,YAAY,6BAEhB,IAAI,gBACF,cAAc,SAAS,CAAC,iBAEtB,GAAG,IAAI,QAAQ,GAAG,IAAI;IAO5B,KAHE,IAAI,YAAY,aAChB,IAAI,YAAY,oBAChB,IAAI,YAAY,gCACa,IAAI,YAAY,UAAU,CAAC,SACxD,IAAI,cAAc;GAEtB;EACF,OAAO,IAAI,SAAS;GAClB,OAAO,MAAM,SAAS,QAAQ,OAAO,YAAY,aAAa;GAC9D,UAAU,KAAK,OAAO;GACtB,IAAI,CAAC,cAAc,UAAU;IAC3B,OAAO,MAAM,sBAAsB,SAAS;IAC5C,MAAM,QAAQ,MAAM,WAAW,OAAO;;IAEtC,IAAI,CAAC,OAAO;KACV,OAAO,KAAK,EAAE,QAAQ,GAAG,6BAA6B;KACtD;IACF;IACA,cAAc,WAAW;GAC3B;GAEA,MAAM,EAAE,oBAAoB,cAAc;GAC1C,IAAI;GACJ,IAAI,oBAAoB,GAAG;IACzB,IAAI,YAAY,sBAAsB,KAGlC;SAAA,OAAO,UAAU,WAAW,YAAY,qBAAqB,GAAG,GAEhE,MAAM,GAAG,YAAY,qBAAqB,IAAI;IAAA,OAGhD,MAAM;GAEV,OAAO,IAAI,oBAAoB,GAAG;IAChC,IAAI,YAAY,sBAAsB,KAGlC;SAAA,OAAO,UAAU,UAAU,YAAY,qBAAqB,GAAG,GAE/D,MAAM,GAAG,YAAY,qBAAqB,IAAI;IAAA,OAGhD,MAAM;GAEV,OAAO,IAAI,oBAAoB,GACzB;QAAA,CAAC,YAAY,sBAAsB,KACrC,MAAM;GAAA,OAEH;IACL,OAAO,KACL;KAAE;KAAiB;IAAQ,GAC3B,wCACF;IACA;GACF;GACA,IAAI,KAAK;IACP,YAAY,yBAAyB,CAAC;IACtC,YAAY,qBAAqB,MAAM;GACzC;GAEA,MAAM,aAAa,MAAM,QAAQ,YAAY,WAAW;GACxD,MAAM,aAAa,MAAM,QAAQ,OAAO;GACxC,MAAM,cAAc,MAAM,SAAS,YAAY,UAAU;GAEzD,KAAK,MAAM,OAAO,YAAY,MAAM;IAElC,IACE,IAAI,YAAY,aAChB,IAAI,YAAY,oBAChB,IAAI,YAAY,WAChB,IAAI,YAAY,wBAChB,IAAI,YAAY,6BAEhB;IAIF,IAAI,gBAAgB,IAAI;IACxB,IAAI,eAAe,gBAAgB,KACjC,gBAAgB,GAAG,YAAY,gBAAgB,IAAI;IAGrD,IAAI,gBAAgB,OAAO,MACzB,cAAc,QAAQ,CAAC,iBAAiB,cAC1C;GACF;EACF,OAAO,IAAI,cAAc;GACvB,OAAO,MAAM,sBAAsB;GACnC,UAAU,KAAK,YAAY;GAC3B,IAAI,CAAC,cAAc,eAAe;IAChC,OAAO,MAAM,sBAAsB,cAAc;IACjD,cAAc,gBAAgB,MAAM,YAAY,YAAY;GAC9D;GAEA,MAAM,aAAa,MAAM,QAAQ,YAAY,WAAW;GACxD,MAAM,cAAc,MAAM,QAAQ,YAAY;GAC9C,MAAM,cAAc,MAAM,SAAS,aAAa,UAAU,KAAK;GAE/D,KAAK,MAAM,OAAO,YAAY,MAAM;IAClC,MAAM,EAAE,SAAS,YAAY;IAE7B,MAAM,cAAc,qBAAqB,KAAK,OAAQ,CAAC,EAAE,QACrD;IAEJ,IAAI,aAAa;KACf,MAAM,gBAAgB,OAAO,MAC3B,cAAc,aAAa,CAAC,4BAC1B,YACD,GAAG,QACN;;KAGA,IAAI,SAAS,aAAa,GACxB,IAAI,gBAAgB;IAExB,OAAO;KAEL,MAAM,gBAAgB,OAAO,MAC3B,cAAc,aAAa,CAAC,yBAAyB,YAAY,GAC/D,QACD,GAAG,QACN;;KAGA,IAAI,SAAS,aAAa,GACxB,IAAI,gBAAgB;IAExB;GACF;EACF;EACA,IAAI,UAAU,QACZ,YAAY,YAAY;CAE5B;AACF"}

package/dist/modules/manager/npm/npmrc.js

@@ -126,7 +126,8 @@ const npmrcCommentRegex = regEx(/[#;]/);
 * Whether the repository `.npmrc` has content `hasNpmrcCredentials()` does not read: a `#` or `;` anywhere, which may start a comment, or a non-blank line which is neither a setting nor a section.
 */
 function hasUnreadContent(repoNpmrc) {
-	return npmrcCommentRegex.test(repoNpmrc.content) || parseNpmrc(repoNpmrc.content).lines.some((line) => line.type === "other" && !!line.raw.trim());
+	if (npmrcCommentRegex.test(repoNpmrc.content)) return true;
+	return parseNpmrc(repoNpmrc.content).lines.some((line) => line.type === "other" && !!line.raw.trim());
 }
 /**
 * Returns why `repoNpmrc` is not cached, or `null` when it is cached.

package/dist/modules/manager/npm/npmrc.js.map

@@ -1 +1 @@
-{"version":3,"file":"npmrc.js","names":[],"sources":["../../../../lib/modules/manager/npm/npmrc.ts"],"sourcesContent":["import { isString, isUndefined } from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  findLocalSiblingOrParent,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { hasUrlCredentials } from '../../../util/url.ts';\nimport type { NpmrcPackageFile } from '../types.ts';\nimport { parseNpmrc, renderNpmrc } from './npmrc-parser.ts';\nimport type {\n  NpmManagerData,\n  NpmrcConfig,\n  NpmrcLine,\n  NpmrcLineEnding,\n  NpmrcResult,\n  NpmrcSettingLine,\n  SanitizedRepoNpmrc,\n} from './types.ts';\n\n/**\n * Mirrors npm's environment-reference grammar. Escape handling remains\n * procedural because RE2 does not support lookbehind.\n */\nconst environmentVariableReferenceRegex = regEx(\n  // oxlint-disable-next-line prefer-named-capture-group -- Only the full match and its position are used.\n  /\\$\\{([^${}?]+)(\\?)?\\}/g,\n);\n\nfunction containsEnvironmentVariableReference(value: unknown): boolean {\n  if (!isString(value)) {\n    return false;\n  }\n\n  for (const match of value.matchAll(environmentVariableReferenceRegex)) {\n    let escapeCount = 0;\n    let escapeIndex = match.index - 1;\n    while (value[escapeIndex] === '\\\\') {\n      escapeCount += 1;\n      escapeIndex -= 1;\n    }\n\n    if (escapeCount % 2 === 0) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nfunction hasEnvironmentVariableReference(line: NpmrcSettingLine): boolean {\n  return (\n    containsEnvironmentVariableReference(line.key) ||\n    containsEnvironmentVariableReference(line.value)\n  );\n}\n\nfunction sanitizeRepoNpmrc(\n  repoNpmrc: string,\n  npmrcFileName: string,\n): SanitizedRepoNpmrc {\n  const document = parseNpmrc(repoNpmrc);\n  const retainedLines: NpmrcLine[] = [];\n  const allowEnvironmentVariableReferences = GlobalConfig.get('exposeAllEnv');\n  let removedEnvironmentVariableReferenceLine = false;\n  let removedPackageLockSetting = false;\n\n  for (const line of document.lines) {\n    if (line.type !== 'setting' || line.section !== null) {\n      retainedLines.push(line);\n      continue;\n    }\n\n    if (line.key === 'package-lock') {\n      removedPackageLockSetting = true;\n      continue;\n    }\n\n    if (\n      !allowEnvironmentVariableReferences &&\n      hasEnvironmentVariableReference(line)\n    ) {\n      removedEnvironmentVariableReferenceLine = true;\n      continue;\n    }\n\n    retainedLines.push(line);\n  }\n\n  if (removedPackageLockSetting) {\n    logger.debug('Stripping package-lock setting from .npmrc');\n  }\n\n  if (removedEnvironmentVariableReferenceLine) {\n    logger.debug(\n      { npmrcFileName },\n      'Stripping .npmrc file of lines with variables',\n    );\n  }\n\n  return {\n    fileName: npmrcFileName,\n    content: renderNpmrc(retainedLines),\n    detectedLineEnding: document.detectedLineEnding,\n  };\n}\n\nfunction mergeNpmrcDocuments(\n  configNpmrc: string | undefined,\n  sanitizedRepoNpmrc: SanitizedRepoNpmrc,\n): string {\n  if (!configNpmrc) {\n    return sanitizedRepoNpmrc.content;\n  }\n\n  const configDocument = parseNpmrc(configNpmrc);\n  if (configDocument.trailingLineEnding) {\n    return `${configNpmrc}${sanitizedRepoNpmrc.content}`;\n  }\n\n  const separator: Exclude<NpmrcLineEnding, ''> =\n    configDocument.detectedLineEnding ??\n    sanitizedRepoNpmrc.detectedLineEnding ??\n    '\\n';\n\n  return `${configNpmrc}${separator}${sanitizedRepoNpmrc.content}`;\n}\n\n/**\n * Whether the repository `.npmrc` is ignored in favour of a configured `npmrc` without `npmrcMerge`.\n */\nfunction isRepoNpmrcIgnored(config: NpmrcConfig): boolean {\n  return isString(config.npmrc) && !config.npmrcMerge;\n}\n\n/**\n * Combines the configured `npmrc` with the sanitized repository `.npmrc`, honouring `npmrcMerge`.\n *\n * @returns the `npmrc` to use for the package file, or `undefined` when there is neither\n */\nexport function applyConfigNpmrc(\n  config: NpmrcConfig,\n  repoNpmrc: SanitizedRepoNpmrc | undefined,\n): string | undefined {\n  if (!repoNpmrc) {\n    return isString(config.npmrc) ? config.npmrc : undefined;\n  }\n\n  if (isRepoNpmrcIgnored(config)) {\n    logger.info(\n      { npmrcFileName: repoNpmrc.fileName },\n      'Repo .npmrc file is ignored due to config.npmrc with config.npmrcMerge=false',\n    );\n\n    return config.npmrc;\n  }\n\n  return mergeNpmrcDocuments(config.npmrc, repoNpmrc);\n}\n\n/**\n * The npm settings holding a secret: the auth settings, and `key` with an inline client key; `username`, `email`, `cert`, `certfile` and `keyfile` are not.\n *\n * @see https://docs.npmjs.com/cli/configuring-npm/npmrc#auth-related-configuration\n */\nconst credentialKeyRegex = regEx(/(?:^|:)(?:_auth|_authToken|_password|key)$/i);\n\nconst singleEnvironmentVariableReferenceRegex = regEx(\n  /^\\$\\{[a-z_][a-z\\d_]*\\}$/i,\n);\n\n/**\n * Whether `value` is exactly one `${NAME}` environment variable reference.\n */\nfunction isSingleEnvironmentVariableReference(value: unknown): boolean {\n  return isString(value) && singleEnvironmentVariableReferenceRegex.test(value);\n}\n\nfunction hasRegistryUrlCredentials(value: unknown): boolean {\n  if (!isString(value)) {\n    return false;\n  }\n  // a protocol-relative registry URL is given a scheme, which `hasUrlCredentials()` looks for\n  return hasUrlCredentials(value.startsWith('//') ? `https:${value}` : value);\n}\n\n/**\n * Whether the registry URL of a `//host/:setting` or `https://host/:setting` key, the part before its last `:`, carries credentials.\n */\nfunction hasKeyUrlCredentials(key: string): boolean {\n  const separatorIndex = key.lastIndexOf(':');\n  if (separatorIndex === -1) {\n    return false;\n  }\n  return hasRegistryUrlCredentials(key.slice(0, separatorIndex));\n}\n\n/**\n * Whether the sanitized repository `.npmrc` carries credentials: an `_auth`, `_authToken`, `_password` or `key` setting other than exactly one `${NAME}` reference, or a URL with credentials in its userinfo, in a setting's key or value.\n */\nexport function hasNpmrcCredentials(repoNpmrc: SanitizedRepoNpmrc): boolean {\n  const settings = parseNpmrc(repoNpmrc.content).lines.filter(\n    (line): line is NpmrcSettingLine => line.type === 'setting',\n  );\n  for (const line of settings) {\n    if (hasKeyUrlCredentials(line.key)) {\n      return true;\n    }\n    // an environment variable reference is only replaced when the `.npmrc` is used, so the stored value is not a credential\n    if (isSingleEnvironmentVariableReference(line.value)) {\n      continue;\n    }\n    if (\n      credentialKeyRegex.test(line.key) ||\n      hasRegistryUrlCredentials(line.value)\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Matches the characters which start a comment in an `.npmrc`, at the start of a line or inline.\n */\nconst npmrcCommentRegex = regEx(/[#;]/);\n\n/**\n * Whether the repository `.npmrc` has content `hasNpmrcCredentials()` does not read: a `#` or `;` anywhere, which may start a comment, or a non-blank line which is neither a setting nor a section.\n */\nfunction hasUnreadContent(repoNpmrc: SanitizedRepoNpmrc): boolean {\n  return (\n    npmrcCommentRegex.test(repoNpmrc.content) ||\n    parseNpmrc(repoNpmrc.content).lines.some(\n      (line) => line.type === 'other' && !!line.raw.trim(),\n    )\n  );\n}\n\n/**\n * Why a repository `.npmrc` is not cached: it carries credentials, or has content which is not checked for credentials.\n */\ntype UncachedNpmrcReason = 'credentials' | 'unread-content';\n\n/**\n * Returns why `repoNpmrc` is not cached, or `null` when it is cached.\n */\nfunction getUncachedNpmrcReason(\n  repoNpmrc: SanitizedRepoNpmrc,\n): UncachedNpmrcReason | null {\n  if (hasNpmrcCredentials(repoNpmrc)) {\n    return 'credentials';\n  }\n  if (hasUnreadContent(repoNpmrc)) {\n    return 'unread-content';\n  }\n  return null;\n}\n\n/**\n * Returns shallow copies of the package files without their `npmrc`, as they are put into the repository cache.\n *\n * A repository `.npmrc` carrying credentials, or with a comment or another line which is not checked for credentials, is dropped as well and the copy is marked with its `uncachedNpmrcFileName`. So is a copy of a package file with an `npmrcFileName` but without `npmrc`, whose repository `.npmrc` cannot be read.\n */\nexport function stripNpmrc(\n  packageFiles: NpmrcPackageFile<NpmManagerData>[],\n): NpmrcPackageFile<NpmManagerData>[] {\n  const result: NpmrcPackageFile<NpmManagerData>[] = [];\n  // the workspaces of a monorepo share one `.npmrc`, which is classified once\n  const reasonByContent = new Map<string, UncachedNpmrcReason | null>();\n  for (const packageFile of packageFiles) {\n    const copy = { ...packageFile };\n    delete copy.npmrc;\n    // read from disk again, so that the configured `npmrc` is not used in its place when the package file is restored\n    const npmrcFileName = copy.managerData?.npmrcFileName;\n    if (npmrcFileName && !isString(packageFile.npmrc)) {\n      copy.managerData = {\n        ...copy.managerData,\n        uncachedNpmrcFileName: npmrcFileName,\n      };\n    }\n    const repoNpmrc = copy.managerData?.repoNpmrc;\n    if (repoNpmrc) {\n      let reason = reasonByContent.get(repoNpmrc.content);\n      if (reason === undefined) {\n        reason = getUncachedNpmrcReason(repoNpmrc);\n        reasonByContent.set(repoNpmrc.content, reason);\n      }\n      if (reason === 'credentials') {\n        logger.once.warn(\n          { npmrcFileName: repoNpmrc.fileName },\n          'A repository .npmrc contains credentials, which are not cached: configure them through hostRules or the npmrc option instead',\n        );\n      } else if (reason === 'unread-content') {\n        logger.once.debug(\n          { npmrcFileName: repoNpmrc.fileName },\n          'A repository .npmrc contains comments or lines which are not settings, so it is not cached',\n        );\n      }\n      if (reason) {\n        copy.managerData = {\n          ...copy.managerData,\n          uncachedNpmrcFileName: repoNpmrc.fileName,\n        };\n        delete copy.managerData.repoNpmrc;\n      }\n    }\n    result.push(copy);\n  }\n  return result;\n}\n\n/**\n * Whether `packageFile` was extracted with an `npmrc` from `resolveNpmrc()`, which also sets its `npmrcFileName`, `null` without a repository `.npmrc`.\n */\nfunction hasResolvedNpmrc(\n  packageFile: NpmrcPackageFile<NpmManagerData>,\n): boolean {\n  return !isUndefined(packageFile.managerData?.npmrcFileName);\n}\n\n/**\n * Returns shallow copies of cached package files with their `npmrc` rebuilt from the cached repository `.npmrc` and the config, or read from disk again for a file with an `uncachedNpmrcFileName`.\n * A package file extracted without `npmrc`, such as a `pnpm-workspace.yaml` or `.yarnrc.yml` catalog, is copied without one.\n */\nexport async function restoreNpmrc(\n  packageFiles: NpmrcPackageFile<NpmManagerData>[],\n  config: NpmrcConfig,\n): Promise<NpmrcPackageFile<NpmManagerData>[]> {\n  const result: NpmrcPackageFile<NpmManagerData>[] = [];\n  // the workspaces of a monorepo share one `.npmrc`, which is read once\n  const npmrcByFileName = new Map<string, string | undefined>();\n  for (const packageFile of packageFiles) {\n    if (!hasResolvedNpmrc(packageFile)) {\n      result.push({ ...packageFile });\n      continue;\n    }\n    let npmrc: string | undefined;\n    const uncachedNpmrcFileName =\n      packageFile.managerData?.uncachedNpmrcFileName;\n    if (uncachedNpmrcFileName) {\n      if (!npmrcByFileName.has(uncachedNpmrcFileName)) {\n        const read = await readRepoNpmrc(uncachedNpmrcFileName, config);\n        npmrcByFileName.set(uncachedNpmrcFileName, read.npmrc);\n      }\n      npmrc = npmrcByFileName.get(uncachedNpmrcFileName);\n    } else {\n      npmrc = applyConfigNpmrc(config, packageFile.managerData?.repoNpmrc);\n    }\n    result.push({ ...packageFile, ...(isString(npmrc) && { npmrc }) });\n  }\n  return result;\n}\n\n/**\n * Whether any of the cached package files has an `uncachedNpmrcFileName`.\n */\nexport function hasUncachedNpmrc(\n  packageFiles: NpmrcPackageFile<NpmManagerData>[],\n): boolean {\n  return packageFiles.some(\n    (packageFile) => !!packageFile.managerData?.uncachedNpmrcFileName,\n  );\n}\n\n/**\n * Reads and sanitizes the repository `.npmrc` and combines it with the configured `npmrc`.\n *\n * @returns the `npmrc` to use, `undefined` when the repository `.npmrc` cannot be read, and the sanitized repository `.npmrc` when it is readable and not ignored\n */\nasync function readRepoNpmrc(\n  npmrcFileName: string,\n  config: NpmrcConfig,\n): Promise<Omit<NpmrcResult, 'npmrcFileName'>> {\n  const content = await readLocalFile(npmrcFileName, 'utf8');\n  if (!isString(content)) {\n    return { npmrc: undefined };\n  }\n\n  const repoNpmrc = sanitizeRepoNpmrc(content, npmrcFileName);\n  const npmrc = applyConfigNpmrc(config, repoNpmrc);\n  if (isRepoNpmrcIgnored(config)) {\n    return { npmrc };\n  }\n  return { npmrc, repoNpmrc };\n}\n\nexport async function resolveNpmrc(\n  packageFile: string,\n  config: NpmrcConfig,\n): Promise<NpmrcResult> {\n  const npmrcFileName = await findLocalSiblingOrParent(packageFile, '.npmrc');\n  if (!npmrcFileName) {\n    return {\n      npmrc: applyConfigNpmrc(config, undefined),\n      npmrcFileName,\n    };\n  }\n\n  return { ...(await readRepoNpmrc(npmrcFileName, config)), npmrcFileName };\n}\n"],"mappings":";;;;;;;;;;;;AAyBA,MAAM,oCAAoC,MAExC,wBACF;AAEA,SAAS,qCAAqC,OAAyB;CACrE,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAGT,KAAK,MAAM,SAAS,MAAM,SAAS,iCAAiC,GAAG;EACrE,IAAI,cAAc;EAClB,IAAI,cAAc,MAAM,QAAQ;EAChC,OAAO,MAAM,iBAAiB,MAAM;GAClC,eAAe;GACf,eAAe;EACjB;EAEA,IAAI,cAAc,MAAM,GACtB,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAS,gCAAgC,MAAiC;CACxE,OACE,qCAAqC,KAAK,GAAG,KAC7C,qCAAqC,KAAK,KAAK;AAEnD;AAEA,SAAS,kBACP,WACA,eACoB;CACpB,MAAM,WAAW,WAAW,SAAS;CACrC,MAAM,gBAA6B,CAAC;CACpC,MAAM,qCAAqC,aAAa,IAAI,cAAc;CAC1E,IAAI,0CAA0C;CAC9C,IAAI,4BAA4B;CAEhC,KAAK,MAAM,QAAQ,SAAS,OAAO;EACjC,IAAI,KAAK,SAAS,aAAa,KAAK,YAAY,MAAM;GACpD,cAAc,KAAK,IAAI;GACvB;EACF;EAEA,IAAI,KAAK,QAAQ,gBAAgB;GAC/B,4BAA4B;GAC5B;EACF;EAEA,IACE,CAAC,sCACD,gCAAgC,IAAI,GACpC;GACA,0CAA0C;GAC1C;EACF;EAEA,cAAc,KAAK,IAAI;CACzB;CAEA,IAAI,2BACF,OAAO,MAAM,4CAA4C;CAG3D,IAAI,yCACF,OAAO,MACL,EAAE,cAAc,GAChB,+CACF;CAGF,OAAO;EACL,UAAU;EACV,SAAS,YAAY,aAAa;EAClC,oBAAoB,SAAS;CAC/B;AACF;AAEA,SAAS,oBACP,aACA,oBACQ;CACR,IAAI,CAAC,aACH,OAAO,mBAAmB;CAG5B,MAAM,iBAAiB,WAAW,WAAW;CAC7C,IAAI,eAAe,oBACjB,OAAO,GAAG,cAAc,mBAAmB;CAQ7C,OAAO,GAAG,cAJR,eAAe,sBACf,mBAAmB,sBACnB,OAEkC,mBAAmB;AACzD;;;;AAKA,SAAS,mBAAmB,QAA8B;CACxD,OAAO,SAAS,OAAO,KAAK,KAAK,CAAC,OAAO;AAC3C;;;;;;AAOA,SAAgB,iBACd,QACA,WACoB;CACpB,IAAI,CAAC,WACH,OAAO,SAAS,OAAO,KAAK,IAAI,OAAO,QAAQ,KAAA;CAGjD,IAAI,mBAAmB,MAAM,GAAG;EAC9B,OAAO,KACL,EAAE,eAAe,UAAU,SAAS,GACpC,8EACF;EAEA,OAAO,OAAO;CAChB;CAEA,OAAO,oBAAoB,OAAO,OAAO,SAAS;AACpD;;;;;;AAOA,MAAM,qBAAqB,MAAM,6CAA6C;AAE9E,MAAM,0CAA0C,MAC9C,0BACF;;;;AAKA,SAAS,qCAAqC,OAAyB;CACrE,OAAO,SAAS,KAAK,KAAK,wCAAwC,KAAK,KAAK;AAC9E;AAEA,SAAS,0BAA0B,OAAyB;CAC1D,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAGT,OAAO,kBAAkB,MAAM,WAAW,IAAI,IAAI,SAAS,UAAU,KAAK;AAC5E;;;;AAKA,SAAS,qBAAqB,KAAsB;CAClD,MAAM,iBAAiB,IAAI,YAAY,GAAG;CAC1C,IAAI,mBAAmB,IACrB,OAAO;CAET,OAAO,0BAA0B,IAAI,MAAM,GAAG,cAAc,CAAC;AAC/D;;;;AAKA,SAAgB,oBAAoB,WAAwC;CAC1E,MAAM,WAAW,WAAW,UAAU,OAAO,CAAC,CAAC,MAAM,QAClD,SAAmC,KAAK,SAAS,SACpD;CACA,KAAK,MAAM,QAAQ,UAAU;EAC3B,IAAI,qBAAqB,KAAK,GAAG,GAC/B,OAAO;EAGT,IAAI,qCAAqC,KAAK,KAAK,GACjD;EAEF,IACE,mBAAmB,KAAK,KAAK,GAAG,KAChC,0BAA0B,KAAK,KAAK,GAEpC,OAAO;CAEX;CACA,OAAO;AACT;;;;AAKA,MAAM,oBAAoB,MAAM,MAAM;;;;AAKtC,SAAS,iBAAiB,WAAwC;CAChE,OACE,kBAAkB,KAAK,UAAU,OAAO,KACxC,WAAW,UAAU,OAAO,CAAC,CAAC,MAAM,MACjC,SAAS,KAAK,SAAS,WAAW,CAAC,CAAC,KAAK,IAAI,KAAK,CACrD;AAEJ;;;;AAUA,SAAS,uBACP,WAC4B;CAC5B,IAAI,oBAAoB,SAAS,GAC/B,OAAO;CAET,IAAI,iBAAiB,SAAS,GAC5B,OAAO;CAET,OAAO;AACT;;;;;;AAOA,SAAgB,WACd,cACoC;CACpC,MAAM,SAA6C,CAAC;CAEpD,MAAM,kCAAkB,IAAI,IAAwC;CACpE,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,OAAO,EAAE,GAAG,YAAY;EAC9B,OAAO,KAAK;EAEZ,MAAM,gBAAgB,KAAK,aAAa;EACxC,IAAI,iBAAiB,CAAC,SAAS,YAAY,KAAK,GAC9C,KAAK,cAAc;GACjB,GAAG,KAAK;GACR,uBAAuB;EACzB;EAEF,MAAM,YAAY,KAAK,aAAa;EACpC,IAAI,WAAW;GACb,IAAI,SAAS,gBAAgB,IAAI,UAAU,OAAO;GAClD,IAAI,WAAW,KAAA,GAAW;IACxB,SAAS,uBAAuB,SAAS;IACzC,gBAAgB,IAAI,UAAU,SAAS,MAAM;GAC/C;GACA,IAAI,WAAW,eACb,OAAO,KAAK,KACV,EAAE,eAAe,UAAU,SAAS,GACpC,8HACF;QACK,IAAI,WAAW,kBACpB,OAAO,KAAK,MACV,EAAE,eAAe,UAAU,SAAS,GACpC,4FACF;GAEF,IAAI,QAAQ;IACV,KAAK,cAAc;KACjB,GAAG,KAAK;KACR,uBAAuB,UAAU;IACnC;IACA,OAAO,KAAK,YAAY;GAC1B;EACF;EACA,OAAO,KAAK,IAAI;CAClB;CACA,OAAO;AACT;;;;AAKA,SAAS,iBACP,aACS;CACT,OAAO,CAAC,YAAY,YAAY,aAAa,aAAa;AAC5D;;;;;AAMA,eAAsB,aACpB,cACA,QAC6C;CAC7C,MAAM,SAA6C,CAAC;CAEpD,MAAM,kCAAkB,IAAI,IAAgC;CAC5D,KAAK,MAAM,eAAe,cAAc;EACtC,IAAI,CAAC,iBAAiB,WAAW,GAAG;GAClC,OAAO,KAAK,EAAE,GAAG,YAAY,CAAC;GAC9B;EACF;EACA,IAAI;EACJ,MAAM,wBACJ,YAAY,aAAa;EAC3B,IAAI,uBAAuB;GACzB,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,GAAG;IAC/C,MAAM,OAAO,MAAM,cAAc,uBAAuB,MAAM;IAC9D,gBAAgB,IAAI,uBAAuB,KAAK,KAAK;GACvD;GACA,QAAQ,gBAAgB,IAAI,qBAAqB;EACnD,OACE,QAAQ,iBAAiB,QAAQ,YAAY,aAAa,SAAS;EAErE,OAAO,KAAK;GAAE,GAAG;GAAa,GAAI,SAAS,KAAK,KAAK,EAAE,MAAM;EAAG,CAAC;CACnE;CACA,OAAO;AACT;;;;AAKA,SAAgB,iBACd,cACS;CACT,OAAO,aAAa,MACjB,gBAAgB,CAAC,CAAC,YAAY,aAAa,qBAC9C;AACF;;;;;;AAOA,eAAe,cACb,eACA,QAC6C;CAC7C,MAAM,UAAU,MAAM,cAAc,eAAe,MAAM;CACzD,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,EAAE,OAAO,KAAA,EAAU;CAG5B,MAAM,YAAY,kBAAkB,SAAS,aAAa;CAC1D,MAAM,QAAQ,iBAAiB,QAAQ,SAAS;CAChD,IAAI,mBAAmB,MAAM,GAC3B,OAAO,EAAE,MAAM;CAEjB,OAAO;EAAE;EAAO;CAAU;AAC5B;AAEA,eAAsB,aACpB,aACA,QACsB;CACtB,MAAM,gBAAgB,MAAM,yBAAyB,aAAa,QAAQ;CAC1E,IAAI,CAAC,eACH,OAAO;EACL,OAAO,iBAAiB,QAAQ,KAAA,CAAS;EACzC;CACF;CAGF,OAAO;EAAE,GAAI,MAAM,cAAc,eAAe,MAAM;EAAI;CAAc;AAC1E"}
+{"version":3,"file":"npmrc.js","names":[],"sources":["../../../../lib/modules/manager/npm/npmrc.ts"],"sourcesContent":["import { isString, isUndefined } from '@sindresorhus/is';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { logger } from '../../../logger/index.ts';\nimport {\n  findLocalSiblingOrParent,\n  readLocalFile,\n} from '../../../util/fs/index.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { hasUrlCredentials } from '../../../util/url.ts';\nimport type { NpmrcPackageFile } from '../types.ts';\nimport { parseNpmrc, renderNpmrc } from './npmrc-parser.ts';\nimport type {\n  NpmManagerData,\n  NpmrcConfig,\n  NpmrcLine,\n  NpmrcLineEnding,\n  NpmrcResult,\n  NpmrcSettingLine,\n  SanitizedRepoNpmrc,\n} from './types.ts';\n\n/**\n * Mirrors npm's environment-reference grammar. Escape handling remains\n * procedural because RE2 does not support lookbehind.\n */\nconst environmentVariableReferenceRegex = regEx(\n  // oxlint-disable-next-line prefer-named-capture-group -- Only the full match and its position are used.\n  /\\$\\{([^${}?]+)(\\?)?\\}/g,\n);\n\nfunction containsEnvironmentVariableReference(value: unknown): boolean {\n  if (!isString(value)) {\n    return false;\n  }\n\n  for (const match of value.matchAll(environmentVariableReferenceRegex)) {\n    let escapeCount = 0;\n    let escapeIndex = match.index - 1;\n    while (value[escapeIndex] === '\\\\') {\n      escapeCount += 1;\n      escapeIndex -= 1;\n    }\n\n    if (escapeCount % 2 === 0) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nfunction hasEnvironmentVariableReference(line: NpmrcSettingLine): boolean {\n  return (\n    containsEnvironmentVariableReference(line.key) ||\n    containsEnvironmentVariableReference(line.value)\n  );\n}\n\nfunction sanitizeRepoNpmrc(\n  repoNpmrc: string,\n  npmrcFileName: string,\n): SanitizedRepoNpmrc {\n  const document = parseNpmrc(repoNpmrc);\n  const retainedLines: NpmrcLine[] = [];\n  const allowEnvironmentVariableReferences = GlobalConfig.get('exposeAllEnv');\n  let removedEnvironmentVariableReferenceLine = false;\n  let removedPackageLockSetting = false;\n\n  for (const line of document.lines) {\n    if (line.type !== 'setting' || line.section !== null) {\n      retainedLines.push(line);\n      continue;\n    }\n\n    if (line.key === 'package-lock') {\n      removedPackageLockSetting = true;\n      continue;\n    }\n\n    if (\n      !allowEnvironmentVariableReferences &&\n      hasEnvironmentVariableReference(line)\n    ) {\n      removedEnvironmentVariableReferenceLine = true;\n      continue;\n    }\n\n    retainedLines.push(line);\n  }\n\n  if (removedPackageLockSetting) {\n    logger.debug('Stripping package-lock setting from .npmrc');\n  }\n\n  if (removedEnvironmentVariableReferenceLine) {\n    logger.debug(\n      { npmrcFileName },\n      'Stripping .npmrc file of lines with variables',\n    );\n  }\n\n  return {\n    fileName: npmrcFileName,\n    content: renderNpmrc(retainedLines),\n    detectedLineEnding: document.detectedLineEnding,\n  };\n}\n\nfunction mergeNpmrcDocuments(\n  configNpmrc: string | undefined,\n  sanitizedRepoNpmrc: SanitizedRepoNpmrc,\n): string {\n  if (!configNpmrc) {\n    return sanitizedRepoNpmrc.content;\n  }\n\n  const configDocument = parseNpmrc(configNpmrc);\n  if (configDocument.trailingLineEnding) {\n    return `${configNpmrc}${sanitizedRepoNpmrc.content}`;\n  }\n\n  const separator: Exclude<NpmrcLineEnding, ''> =\n    configDocument.detectedLineEnding ??\n    sanitizedRepoNpmrc.detectedLineEnding ??\n    '\\n';\n\n  return `${configNpmrc}${separator}${sanitizedRepoNpmrc.content}`;\n}\n\n/**\n * Whether the repository `.npmrc` is ignored in favour of a configured `npmrc` without `npmrcMerge`.\n */\nfunction isRepoNpmrcIgnored(config: NpmrcConfig): boolean {\n  return isString(config.npmrc) && !config.npmrcMerge;\n}\n\n/**\n * Combines the configured `npmrc` with the sanitized repository `.npmrc`, honouring `npmrcMerge`.\n *\n * @returns the `npmrc` to use for the package file, or `undefined` when there is neither\n */\nexport function applyConfigNpmrc(\n  config: NpmrcConfig,\n  repoNpmrc: SanitizedRepoNpmrc | undefined,\n): string | undefined {\n  if (!repoNpmrc) {\n    return isString(config.npmrc) ? config.npmrc : undefined;\n  }\n\n  if (isRepoNpmrcIgnored(config)) {\n    logger.info(\n      { npmrcFileName: repoNpmrc.fileName },\n      'Repo .npmrc file is ignored due to config.npmrc with config.npmrcMerge=false',\n    );\n\n    return config.npmrc;\n  }\n\n  return mergeNpmrcDocuments(config.npmrc, repoNpmrc);\n}\n\n/**\n * The npm settings holding a secret: the auth settings, and `key` with an inline client key; `username`, `email`, `cert`, `certfile` and `keyfile` are not.\n *\n * @see https://docs.npmjs.com/cli/configuring-npm/npmrc#auth-related-configuration\n */\nconst credentialKeyRegex = regEx(/(?:^|:)(?:_auth|_authToken|_password|key)$/i);\n\nconst singleEnvironmentVariableReferenceRegex = regEx(\n  /^\\$\\{[a-z_][a-z\\d_]*\\}$/i,\n);\n\n/**\n * Whether `value` is exactly one `${NAME}` environment variable reference.\n */\nfunction isSingleEnvironmentVariableReference(value: unknown): boolean {\n  return isString(value) && singleEnvironmentVariableReferenceRegex.test(value);\n}\n\nfunction hasRegistryUrlCredentials(value: unknown): boolean {\n  if (!isString(value)) {\n    return false;\n  }\n  // a protocol-relative registry URL is given a scheme, which `hasUrlCredentials()` looks for\n  return hasUrlCredentials(value.startsWith('//') ? `https:${value}` : value);\n}\n\n/**\n * Whether the registry URL of a `//host/:setting` or `https://host/:setting` key, the part before its last `:`, carries credentials.\n */\nfunction hasKeyUrlCredentials(key: string): boolean {\n  const separatorIndex = key.lastIndexOf(':');\n  if (separatorIndex === -1) {\n    return false;\n  }\n  return hasRegistryUrlCredentials(key.slice(0, separatorIndex));\n}\n\n/**\n * Whether the sanitized repository `.npmrc` carries credentials: an `_auth`, `_authToken`, `_password` or `key` setting other than exactly one `${NAME}` reference, or a URL with credentials in its userinfo, in a setting's key or value.\n */\nexport function hasNpmrcCredentials(repoNpmrc: SanitizedRepoNpmrc): boolean {\n  const settings = parseNpmrc(repoNpmrc.content).lines.filter(\n    (line): line is NpmrcSettingLine => line.type === 'setting',\n  );\n  for (const line of settings) {\n    if (hasKeyUrlCredentials(line.key)) {\n      return true;\n    }\n    // an environment variable reference is only replaced when the `.npmrc` is used, so the stored value is not a credential\n    if (isSingleEnvironmentVariableReference(line.value)) {\n      continue;\n    }\n    if (\n      credentialKeyRegex.test(line.key) ||\n      hasRegistryUrlCredentials(line.value)\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Matches the characters which start a comment in an `.npmrc`, at the start of a line or inline.\n */\nconst npmrcCommentRegex = regEx(/[#;]/);\n\n/**\n * Whether the repository `.npmrc` has content `hasNpmrcCredentials()` does not read: a `#` or `;` anywhere, which may start a comment, or a non-blank line which is neither a setting nor a section.\n */\nfunction hasUnreadContent(repoNpmrc: SanitizedRepoNpmrc): boolean {\n  if (npmrcCommentRegex.test(repoNpmrc.content)) {\n    return true;\n  }\n  return parseNpmrc(repoNpmrc.content).lines.some(\n    (line) => line.type === 'other' && !!line.raw.trim(),\n  );\n}\n\n/**\n * Why a repository `.npmrc` is not cached: it carries credentials, or has content which is not checked for credentials.\n */\ntype UncachedNpmrcReason = 'credentials' | 'unread-content';\n\n/**\n * Returns why `repoNpmrc` is not cached, or `null` when it is cached.\n */\nfunction getUncachedNpmrcReason(\n  repoNpmrc: SanitizedRepoNpmrc,\n): UncachedNpmrcReason | null {\n  if (hasNpmrcCredentials(repoNpmrc)) {\n    return 'credentials';\n  }\n  if (hasUnreadContent(repoNpmrc)) {\n    return 'unread-content';\n  }\n  return null;\n}\n\n/**\n * Returns shallow copies of the package files without their `npmrc`, as they are put into the repository cache.\n *\n * A repository `.npmrc` carrying credentials, or with a comment or another line which is not checked for credentials, is dropped as well and the copy is marked with its `uncachedNpmrcFileName`. So is a copy of a package file with an `npmrcFileName` but without `npmrc`, whose repository `.npmrc` cannot be read.\n */\nexport function stripNpmrc(\n  packageFiles: NpmrcPackageFile<NpmManagerData>[],\n): NpmrcPackageFile<NpmManagerData>[] {\n  const result: NpmrcPackageFile<NpmManagerData>[] = [];\n  // the workspaces of a monorepo share one `.npmrc`, which is classified once\n  const reasonByContent = new Map<string, UncachedNpmrcReason | null>();\n  for (const packageFile of packageFiles) {\n    const copy = { ...packageFile };\n    delete copy.npmrc;\n    // read from disk again, so that the configured `npmrc` is not used in its place when the package file is restored\n    const npmrcFileName = copy.managerData?.npmrcFileName;\n    if (npmrcFileName && !isString(packageFile.npmrc)) {\n      copy.managerData = {\n        ...copy.managerData,\n        uncachedNpmrcFileName: npmrcFileName,\n      };\n    }\n    const repoNpmrc = copy.managerData?.repoNpmrc;\n    if (repoNpmrc) {\n      let reason = reasonByContent.get(repoNpmrc.content);\n      if (reason === undefined) {\n        reason = getUncachedNpmrcReason(repoNpmrc);\n        reasonByContent.set(repoNpmrc.content, reason);\n      }\n      if (reason === 'credentials') {\n        logger.once.warn(\n          { npmrcFileName: repoNpmrc.fileName },\n          'A repository .npmrc contains credentials, which are not cached: configure them through hostRules or the npmrc option instead',\n        );\n      } else if (reason === 'unread-content') {\n        logger.once.debug(\n          { npmrcFileName: repoNpmrc.fileName },\n          'A repository .npmrc contains comments or lines which are not settings, so it is not cached',\n        );\n      }\n      if (reason) {\n        copy.managerData = {\n          ...copy.managerData,\n          uncachedNpmrcFileName: repoNpmrc.fileName,\n        };\n        delete copy.managerData.repoNpmrc;\n      }\n    }\n    result.push(copy);\n  }\n  return result;\n}\n\n/**\n * Whether `packageFile` was extracted with an `npmrc` from `resolveNpmrc()`, which also sets its `npmrcFileName`, `null` without a repository `.npmrc`.\n */\nfunction hasResolvedNpmrc(\n  packageFile: NpmrcPackageFile<NpmManagerData>,\n): boolean {\n  return !isUndefined(packageFile.managerData?.npmrcFileName);\n}\n\n/**\n * Returns shallow copies of cached package files with their `npmrc` rebuilt from the cached repository `.npmrc` and the config, or read from disk again for a file with an `uncachedNpmrcFileName`.\n * A package file extracted without `npmrc`, such as a `pnpm-workspace.yaml` or `.yarnrc.yml` catalog, is copied without one.\n */\nexport async function restoreNpmrc(\n  packageFiles: NpmrcPackageFile<NpmManagerData>[],\n  config: NpmrcConfig,\n): Promise<NpmrcPackageFile<NpmManagerData>[]> {\n  const result: NpmrcPackageFile<NpmManagerData>[] = [];\n  // the workspaces of a monorepo share one `.npmrc`, which is read once\n  const npmrcByFileName = new Map<string, string | undefined>();\n  for (const packageFile of packageFiles) {\n    if (!hasResolvedNpmrc(packageFile)) {\n      result.push({ ...packageFile });\n      continue;\n    }\n    let npmrc: string | undefined;\n    const uncachedNpmrcFileName =\n      packageFile.managerData?.uncachedNpmrcFileName;\n    if (uncachedNpmrcFileName) {\n      if (!npmrcByFileName.has(uncachedNpmrcFileName)) {\n        const read = await readRepoNpmrc(uncachedNpmrcFileName, config);\n        npmrcByFileName.set(uncachedNpmrcFileName, read.npmrc);\n      }\n      npmrc = npmrcByFileName.get(uncachedNpmrcFileName);\n    } else {\n      npmrc = applyConfigNpmrc(config, packageFile.managerData?.repoNpmrc);\n    }\n    result.push({ ...packageFile, ...(isString(npmrc) && { npmrc }) });\n  }\n  return result;\n}\n\n/**\n * Whether any of the cached package files has an `uncachedNpmrcFileName`.\n */\nexport function hasUncachedNpmrc(\n  packageFiles: NpmrcPackageFile<NpmManagerData>[],\n): boolean {\n  return packageFiles.some(\n    (packageFile) => !!packageFile.managerData?.uncachedNpmrcFileName,\n  );\n}\n\n/**\n * Reads and sanitizes the repository `.npmrc` and combines it with the configured `npmrc`.\n *\n * @returns the `npmrc` to use, `undefined` when the repository `.npmrc` cannot be read, and the sanitized repository `.npmrc` when it is readable and not ignored\n */\nasync function readRepoNpmrc(\n  npmrcFileName: string,\n  config: NpmrcConfig,\n): Promise<Omit<NpmrcResult, 'npmrcFileName'>> {\n  const content = await readLocalFile(npmrcFileName, 'utf8');\n  if (!isString(content)) {\n    return { npmrc: undefined };\n  }\n\n  const repoNpmrc = sanitizeRepoNpmrc(content, npmrcFileName);\n  const npmrc = applyConfigNpmrc(config, repoNpmrc);\n  if (isRepoNpmrcIgnored(config)) {\n    return { npmrc };\n  }\n  return { npmrc, repoNpmrc };\n}\n\nexport async function resolveNpmrc(\n  packageFile: string,\n  config: NpmrcConfig,\n): Promise<NpmrcResult> {\n  const npmrcFileName = await findLocalSiblingOrParent(packageFile, '.npmrc');\n  if (!npmrcFileName) {\n    return {\n      npmrc: applyConfigNpmrc(config, undefined),\n      npmrcFileName,\n    };\n  }\n\n  return { ...(await readRepoNpmrc(npmrcFileName, config)), npmrcFileName };\n}\n"],"mappings":";;;;;;;;;;;;AAyBA,MAAM,oCAAoC,MAExC,wBACF;AAEA,SAAS,qCAAqC,OAAyB;CACrE,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAGT,KAAK,MAAM,SAAS,MAAM,SAAS,iCAAiC,GAAG;EACrE,IAAI,cAAc;EAClB,IAAI,cAAc,MAAM,QAAQ;EAChC,OAAO,MAAM,iBAAiB,MAAM;GAClC,eAAe;GACf,eAAe;EACjB;EAEA,IAAI,cAAc,MAAM,GACtB,OAAO;CAEX;CAEA,OAAO;AACT;AAEA,SAAS,gCAAgC,MAAiC;CACxE,OACE,qCAAqC,KAAK,GAAG,KAC7C,qCAAqC,KAAK,KAAK;AAEnD;AAEA,SAAS,kBACP,WACA,eACoB;CACpB,MAAM,WAAW,WAAW,SAAS;CACrC,MAAM,gBAA6B,CAAC;CACpC,MAAM,qCAAqC,aAAa,IAAI,cAAc;CAC1E,IAAI,0CAA0C;CAC9C,IAAI,4BAA4B;CAEhC,KAAK,MAAM,QAAQ,SAAS,OAAO;EACjC,IAAI,KAAK,SAAS,aAAa,KAAK,YAAY,MAAM;GACpD,cAAc,KAAK,IAAI;GACvB;EACF;EAEA,IAAI,KAAK,QAAQ,gBAAgB;GAC/B,4BAA4B;GAC5B;EACF;EAEA,IACE,CAAC,sCACD,gCAAgC,IAAI,GACpC;GACA,0CAA0C;GAC1C;EACF;EAEA,cAAc,KAAK,IAAI;CACzB;CAEA,IAAI,2BACF,OAAO,MAAM,4CAA4C;CAG3D,IAAI,yCACF,OAAO,MACL,EAAE,cAAc,GAChB,+CACF;CAGF,OAAO;EACL,UAAU;EACV,SAAS,YAAY,aAAa;EAClC,oBAAoB,SAAS;CAC/B;AACF;AAEA,SAAS,oBACP,aACA,oBACQ;CACR,IAAI,CAAC,aACH,OAAO,mBAAmB;CAG5B,MAAM,iBAAiB,WAAW,WAAW;CAC7C,IAAI,eAAe,oBACjB,OAAO,GAAG,cAAc,mBAAmB;CAQ7C,OAAO,GAAG,cAJR,eAAe,sBACf,mBAAmB,sBACnB,OAEkC,mBAAmB;AACzD;;;;AAKA,SAAS,mBAAmB,QAA8B;CACxD,OAAO,SAAS,OAAO,KAAK,KAAK,CAAC,OAAO;AAC3C;;;;;;AAOA,SAAgB,iBACd,QACA,WACoB;CACpB,IAAI,CAAC,WACH,OAAO,SAAS,OAAO,KAAK,IAAI,OAAO,QAAQ,KAAA;CAGjD,IAAI,mBAAmB,MAAM,GAAG;EAC9B,OAAO,KACL,EAAE,eAAe,UAAU,SAAS,GACpC,8EACF;EAEA,OAAO,OAAO;CAChB;CAEA,OAAO,oBAAoB,OAAO,OAAO,SAAS;AACpD;;;;;;AAOA,MAAM,qBAAqB,MAAM,6CAA6C;AAE9E,MAAM,0CAA0C,MAC9C,0BACF;;;;AAKA,SAAS,qCAAqC,OAAyB;CACrE,OAAO,SAAS,KAAK,KAAK,wCAAwC,KAAK,KAAK;AAC9E;AAEA,SAAS,0BAA0B,OAAyB;CAC1D,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAGT,OAAO,kBAAkB,MAAM,WAAW,IAAI,IAAI,SAAS,UAAU,KAAK;AAC5E;;;;AAKA,SAAS,qBAAqB,KAAsB;CAClD,MAAM,iBAAiB,IAAI,YAAY,GAAG;CAC1C,IAAI,mBAAmB,IACrB,OAAO;CAET,OAAO,0BAA0B,IAAI,MAAM,GAAG,cAAc,CAAC;AAC/D;;;;AAKA,SAAgB,oBAAoB,WAAwC;CAC1E,MAAM,WAAW,WAAW,UAAU,OAAO,CAAC,CAAC,MAAM,QAClD,SAAmC,KAAK,SAAS,SACpD;CACA,KAAK,MAAM,QAAQ,UAAU;EAC3B,IAAI,qBAAqB,KAAK,GAAG,GAC/B,OAAO;EAGT,IAAI,qCAAqC,KAAK,KAAK,GACjD;EAEF,IACE,mBAAmB,KAAK,KAAK,GAAG,KAChC,0BAA0B,KAAK,KAAK,GAEpC,OAAO;CAEX;CACA,OAAO;AACT;;;;AAKA,MAAM,oBAAoB,MAAM,MAAM;;;;AAKtC,SAAS,iBAAiB,WAAwC;CAChE,IAAI,kBAAkB,KAAK,UAAU,OAAO,GAC1C,OAAO;CAET,OAAO,WAAW,UAAU,OAAO,CAAC,CAAC,MAAM,MACxC,SAAS,KAAK,SAAS,WAAW,CAAC,CAAC,KAAK,IAAI,KAAK,CACrD;AACF;;;;AAUA,SAAS,uBACP,WAC4B;CAC5B,IAAI,oBAAoB,SAAS,GAC/B,OAAO;CAET,IAAI,iBAAiB,SAAS,GAC5B,OAAO;CAET,OAAO;AACT;;;;;;AAOA,SAAgB,WACd,cACoC;CACpC,MAAM,SAA6C,CAAC;CAEpD,MAAM,kCAAkB,IAAI,IAAwC;CACpE,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,OAAO,EAAE,GAAG,YAAY;EAC9B,OAAO,KAAK;EAEZ,MAAM,gBAAgB,KAAK,aAAa;EACxC,IAAI,iBAAiB,CAAC,SAAS,YAAY,KAAK,GAC9C,KAAK,cAAc;GACjB,GAAG,KAAK;GACR,uBAAuB;EACzB;EAEF,MAAM,YAAY,KAAK,aAAa;EACpC,IAAI,WAAW;GACb,IAAI,SAAS,gBAAgB,IAAI,UAAU,OAAO;GAClD,IAAI,WAAW,KAAA,GAAW;IACxB,SAAS,uBAAuB,SAAS;IACzC,gBAAgB,IAAI,UAAU,SAAS,MAAM;GAC/C;GACA,IAAI,WAAW,eACb,OAAO,KAAK,KACV,EAAE,eAAe,UAAU,SAAS,GACpC,8HACF;QACK,IAAI,WAAW,kBACpB,OAAO,KAAK,MACV,EAAE,eAAe,UAAU,SAAS,GACpC,4FACF;GAEF,IAAI,QAAQ;IACV,KAAK,cAAc;KACjB,GAAG,KAAK;KACR,uBAAuB,UAAU;IACnC;IACA,OAAO,KAAK,YAAY;GAC1B;EACF;EACA,OAAO,KAAK,IAAI;CAClB;CACA,OAAO;AACT;;;;AAKA,SAAS,iBACP,aACS;CACT,OAAO,CAAC,YAAY,YAAY,aAAa,aAAa;AAC5D;;;;;AAMA,eAAsB,aACpB,cACA,QAC6C;CAC7C,MAAM,SAA6C,CAAC;CAEpD,MAAM,kCAAkB,IAAI,IAAgC;CAC5D,KAAK,MAAM,eAAe,cAAc;EACtC,IAAI,CAAC,iBAAiB,WAAW,GAAG;GAClC,OAAO,KAAK,EAAE,GAAG,YAAY,CAAC;GAC9B;EACF;EACA,IAAI;EACJ,MAAM,wBACJ,YAAY,aAAa;EAC3B,IAAI,uBAAuB;GACzB,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,GAAG;IAC/C,MAAM,OAAO,MAAM,cAAc,uBAAuB,MAAM;IAC9D,gBAAgB,IAAI,uBAAuB,KAAK,KAAK;GACvD;GACA,QAAQ,gBAAgB,IAAI,qBAAqB;EACnD,OACE,QAAQ,iBAAiB,QAAQ,YAAY,aAAa,SAAS;EAErE,OAAO,KAAK;GAAE,GAAG;GAAa,GAAI,SAAS,KAAK,KAAK,EAAE,MAAM;EAAG,CAAC;CACnE;CACA,OAAO;AACT;;;;AAKA,SAAgB,iBACd,cACS;CACT,OAAO,aAAa,MACjB,gBAAgB,CAAC,CAAC,YAAY,aAAa,qBAC9C;AACF;;;;;;AAOA,eAAe,cACb,eACA,QAC6C;CAC7C,MAAM,UAAU,MAAM,cAAc,eAAe,MAAM;CACzD,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,EAAE,OAAO,KAAA,EAAU;CAG5B,MAAM,YAAY,kBAAkB,SAAS,aAAa;CAC1D,MAAM,QAAQ,iBAAiB,QAAQ,SAAS;CAChD,IAAI,mBAAmB,MAAM,GAC3B,OAAO,EAAE,MAAM;CAEjB,OAAO;EAAE;EAAO;CAAU;AAC5B;AAEA,eAAsB,aACpB,aACA,QACsB;CACtB,MAAM,gBAAgB,MAAM,yBAAyB,aAAa,QAAQ;CAC1E,IAAI,CAAC,eACH,OAAO;EACL,OAAO,iBAAiB,QAAQ,KAAA,CAAS;EACzC;CACF;CAGF,OAAO;EAAE,GAAI,MAAM,cAAc,eAAe,MAAM;EAAI;CAAc;AAC1E"}

package/dist/modules/manager/npm/post-update/index.js

@@ -76,7 +76,8 @@ async function writeExistingFiles(config, packageFiles, originalNpmrcFiles = /*
 		const basedir = upath.dirname(packageFile.packageFile);
 		const npmrc = packageFile.npmrc;
 		const npmrcFilename = upath.join(basedir, ".npmrc");
-		if (isString(npmrc) && (npmrcFilename === packageFile.managerData.npmrcFileName || !packageFile.managerData.npmrcFileName)) try {
+		const isNpmrcOwnFile = npmrcFilename === packageFile.managerData.npmrcFileName || !packageFile.managerData.npmrcFileName;
+		if (isString(npmrc) && isNpmrcOwnFile) try {
 			if (!originalNpmrcFiles.has(npmrcFilename)) {
 				const originalNpmrc = await readLocalFile(npmrcFilename, "utf8");
 				if (isString(originalNpmrc)) originalNpmrcFiles.set(npmrcFilename, originalNpmrc);

package/dist/modules/manager/npm/post-update/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["hostRules.find","npm.generateLockFile","deepmerge","yarn.fuzzyMatchAdditionalYarnrcYml","yarn.generateLockFile","yarn.isYarnUpdate","pnpm.generateLockFile"],"sources":["../../../../../lib/modules/manager/npm/post-update/index.ts"],"sourcesContent":["// TODO: types (#22198)\nimport { isNonEmptyStringAndNotWhitespace, isString } from '@sindresorhus/is';\nimport deepmerge from 'deepmerge';\nimport upath from 'upath';\nimport { logger } from '../../../../logger/index.ts';\nimport { ExternalHostError } from '../../../../types/errors/external-host-error.ts';\nimport { getEnv } from '../../../../util/env.ts';\nimport {\n  ensureCacheDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../../util/fs/index.ts';\nimport { getFile, getRepoStatus } from '../../../../util/git/index.ts';\nimport type { FileChange } from '../../../../util/git/types.ts';\nimport * as hostRules from '../../../../util/host-rules.ts';\nimport { newlineRegex, regEx } from '../../../../util/regex.ts';\nimport { ensureTrailingSlash } from '../../../../util/url.ts';\nimport { dump, parseSingleYaml } from '../../../../util/yaml.ts';\nimport { NpmDatasource } from '../../../datasource/npm/index.ts';\nimport { scm } from '../../../platform/scm.ts';\nimport type {\n  ArtifactError,\n  ArtifactNotice,\n  NpmrcPackageFile,\n  PostUpdateConfig,\n  Upgrade,\n} from '../../types.ts';\nimport { artifactErrorMessageFromExecError } from '../../util.ts';\nimport {\n  NPM_CACHE_DIR,\n  PNPM_CACHE_BASE_DIR,\n  YARN_CACHE_DIR,\n  YARN_GLOBAL_DIR,\n} from '../constants.ts';\nimport { getZeroInstallPaths } from '../extract/yarn.ts';\nimport type { NpmManagerData } from '../types.ts';\nimport {\n  composeLockFile,\n  parseLockFile,\n  withNpmrcHostRules,\n} from '../utils.ts';\nimport * as npm from './npm.ts';\nimport * as pnpm from './pnpm.ts';\nimport { processHostRules } from './rules.ts';\nimport type {\n  AdditionalPackageFiles,\n  DetermineLockFileDirsResult,\n  WriteExistingFilesResult,\n  YarnRcYmlFile,\n} from './types.ts';\nimport * as yarn from './yarn.ts';\n\n// Strips empty values, deduplicates, and returns the directories from filenames\nfunction getDirs(arr: (string | null | undefined)[]): string[] {\n  return Array.from(new Set(arr.filter(isString)));\n}\n\nexport function determineLockFileDirs(\n  config: PostUpdateConfig<NpmManagerData>,\n  packageFiles: AdditionalPackageFiles,\n): DetermineLockFileDirsResult {\n  const npmLockDirs: (string | undefined)[] = [];\n  const yarnLockDirs: (string | undefined)[] = [];\n  const pnpmLockFileDirs: (string | undefined)[] = [];\n\n  for (const upgrade of config.upgrades) {\n    // v8 ignore else -- TODO: add test #40625\n    if (\n      upgrade.updateType === 'lockFileMaintenance' ||\n      upgrade.isRemediation === true ||\n      upgrade.isLockfileUpdate === true\n    ) {\n      yarnLockDirs.push(upgrade.managerData?.yarnLock);\n      npmLockDirs.push(upgrade.managerData?.npmLock);\n      pnpmLockFileDirs.push(upgrade.managerData?.pnpmLockFile);\n    }\n  }\n\n  if (\n    config.upgrades.every(\n      (upgrade: Upgrade) =>\n        upgrade.updateType === 'lockFileMaintenance' ||\n        upgrade.isLockfileUpdate,\n    )\n  ) {\n    return {\n      yarnLockDirs: getDirs(yarnLockDirs),\n      npmLockDirs: getDirs(npmLockDirs),\n      pnpmLockFileDirs: getDirs(pnpmLockFileDirs),\n    };\n  }\n\n  function getPackageFile(\n    fileName: string,\n  ): Partial<NpmrcPackageFile<NpmManagerData>> {\n    logger.trace(`Looking for packageFile: ${fileName}`);\n\n    for (const packageFile of packageFiles.npm!) {\n      if (packageFile.packageFile === fileName) {\n        logger.trace({ packageFile }, 'Found packageFile');\n        return packageFile;\n      }\n      logger.trace('No match');\n    }\n    return {};\n  }\n\n  // TODO #22198\n  for (const p of config.updatedPackageFiles!) {\n    logger.trace(`Checking ${String(p.path)} for lock files`);\n    const packageFile = getPackageFile(p.path);\n    /* v8 ignore next -- needs test */\n    if (!packageFile.managerData) {\n      continue;\n    }\n    // push full lock file names and convert them later\n    yarnLockDirs.push(packageFile.managerData.yarnLock);\n    npmLockDirs.push(packageFile.managerData.npmLock);\n    pnpmLockFileDirs.push(packageFile.managerData.pnpmLockFile);\n  }\n\n  return {\n    yarnLockDirs: getDirs(yarnLockDirs),\n    npmLockDirs: getDirs(npmLockDirs),\n    pnpmLockFileDirs: getDirs(pnpmLockFileDirs),\n  };\n}\n\nexport async function writeExistingFiles(\n  config: PostUpdateConfig<NpmManagerData>,\n  packageFiles: AdditionalPackageFiles,\n  originalNpmrcFiles = new Map<string, string>(),\n): Promise<void> {\n  if (!packageFiles.npm) {\n    return;\n  }\n  const npmFiles = packageFiles.npm;\n  logger.debug(\n    { packageFiles: npmFiles.map((n) => n.packageFile) },\n    'Writing package.json files',\n  );\n  for (const packageFile of npmFiles) {\n    /* v8 ignore if -- TODO: add test #40625 */\n    if (!packageFile.managerData) {\n      continue;\n    }\n    // TODO #22198\n    const basedir = upath.dirname(packageFile.packageFile!);\n    const npmrc = packageFile.npmrc;\n    const npmrcFilename = upath.join(basedir, '.npmrc');\n    // Write out the file unless the npmrc came from the workspace\n    // npmrcFilename will be set whenever the file was read from disk during extract\n    if (\n      isString(npmrc) &&\n      (npmrcFilename === packageFile.managerData.npmrcFileName ||\n        !packageFile.managerData.npmrcFileName)\n    ) {\n      try {\n        if (!originalNpmrcFiles.has(npmrcFilename)) {\n          const originalNpmrc = await readLocalFile(npmrcFilename, 'utf8');\n          if (isString(originalNpmrc)) {\n            originalNpmrcFiles.set(npmrcFilename, originalNpmrc);\n          }\n        }\n        await writeLocalFile(npmrcFilename, npmrc.replace(regEx(/\\n?$/), '\\n'));\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.warn({ npmrcFilename, err }, 'Error writing .npmrc');\n      }\n    }\n    const npmLock = packageFile.managerData.npmLock;\n    if (npmLock) {\n      const npmLockPath = npmLock;\n      logger.debug(`Writing ${npmLock}`);\n      let existingNpmLock: string;\n      try {\n        existingNpmLock = (await getFile(npmLock)) ?? '';\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.warn({ err }, 'Error reading npm lock file');\n        existingNpmLock = '';\n      }\n      const { detectedIndent, lockFileParsed: npmLockParsed } =\n        parseLockFile(existingNpmLock);\n      if (npmLockParsed) {\n        const packageNames =\n          'packages' in npmLockParsed\n            ? Object.keys(npmLockParsed.packages)\n            : [];\n        const widens: string[] = [];\n        let lockFileChanged = false;\n        for (const upgrade of config.upgrades) {\n          if (upgrade.lockFiles && !upgrade.lockFiles.includes(npmLock)) {\n            continue;\n          }\n          if (!upgrade.managerData) {\n            continue;\n          }\n          if (\n            upgrade.rangeStrategy === 'widen' &&\n            upgrade.managerData.npmLock === npmLock\n          ) {\n            // TODO #22198\n            widens.push(upgrade.depName!);\n          }\n          const { depName } = upgrade;\n          const oldVersion = upgrade.lockedVersion ?? upgrade.currentVersion;\n          if ('packages' in npmLockParsed) {\n            for (const packageName of packageNames) {\n              if (\n                packageName === `node_modules/${depName}` ||\n                packageName.startsWith(`node_modules/${depName}/`)\n              ) {\n                logger.trace({ packageName }, 'Massaging out package name');\n                lockFileChanged = true;\n                delete npmLockParsed.packages[packageName];\n                continue;\n              }\n              if (\n                !depName ||\n                !oldVersion ||\n                // Workspace entries (e.g. `packages/app`) and the root entry\n                // are link targets: `node_modules/<name>` points at them with\n                // `link: true`, so deleting one breaks npm with EMISSINGTARGET.\n                !packageName.startsWith('node_modules/')\n              ) {\n                continue;\n              }\n              // Lockstep monorepo siblings (e.g. vue -> @vue/server-renderer)\n              // pin the updated dep to its exact old version. Left in the lock\n              // they cannot resolve against the new version and npm fails with\n              // ERESOLVE, so massage them out too and let npm re-resolve them.\n              const entry = npmLockParsed.packages[packageName];\n              const pinned =\n                entry?.peerDependencies?.[depName] === oldVersion ||\n                entry?.dependencies?.[depName] === oldVersion ||\n                entry?.optionalDependencies?.[depName] === oldVersion;\n              if (pinned) {\n                logger.trace(\n                  { packageName, depName, oldVersion },\n                  'Massaging out lockstep sibling',\n                );\n                lockFileChanged = true;\n                delete npmLockParsed.packages[packageName];\n              }\n            }\n          }\n        }\n        // v8 ignore else -- TODO: add test #40625\n        if (widens.length) {\n          logger.debug(\n            `Removing ${String(widens)} from ${npmLock} to force an update`,\n          );\n          lockFileChanged = true;\n          try {\n            if ('dependencies' in npmLockParsed && npmLockParsed.dependencies) {\n              widens.forEach((depName) => {\n                // TODO #22198\n                delete npmLockParsed.dependencies![depName];\n              });\n            }\n          } catch /* v8 ignore next -- TODO: add test #40625 */ {\n            logger.warn(\n              { npmLock },\n              'Error massaging package-lock.json for widen',\n            );\n          }\n        }\n        // v8 ignore else -- TODO: add test #40625\n        if (lockFileChanged) {\n          logger.debug('Massaging npm lock file before writing to disk');\n          existingNpmLock = composeLockFile(npmLockParsed, detectedIndent);\n        }\n        await writeLocalFile(npmLockPath, existingNpmLock);\n      }\n    }\n  }\n}\n\nasync function restoreNpmrcFiles(\n  originalNpmrcFiles: Map<string, string>,\n): Promise<void> {\n  for (const [npmrcFilename, originalNpmrc] of originalNpmrcFiles) {\n    try {\n      await writeLocalFile(npmrcFilename, originalNpmrc);\n    } catch (err) {\n      logger.warn({ npmrcFilename, err }, 'Error restoring .npmrc');\n    }\n  }\n}\n\nexport async function writeUpdatedPackageFiles(\n  config: PostUpdateConfig,\n): Promise<void> {\n  logger.trace({ config }, 'writeUpdatedPackageFiles');\n  logger.debug('Writing any updated package files');\n  if (!config.updatedPackageFiles) {\n    logger.debug('No files found');\n    return;\n  }\n  // prefer artifact content when it updates the same file (e.g. pnpm-workspace.yaml)\n  const artifactContents = new Map<string, string>();\n  if (config.updatedArtifacts) {\n    for (const artifact of config.updatedArtifacts) {\n      if (artifact.type === 'addition' && artifact.contents) {\n        artifactContents.set(artifact.path, artifact.contents.toString());\n      }\n    }\n  }\n  const supportedLockFiles = ['package-lock.json', 'yarn.lock'];\n  for (const packageFile of config.updatedPackageFiles) {\n    if (packageFile.type !== 'addition') {\n      continue;\n    }\n    if (\n      supportedLockFiles.some((fileName) => packageFile.path.endsWith(fileName))\n    ) {\n      logger.debug(`Writing lock file: ${packageFile.path}`);\n      // TODO #22198\n\n      await writeLocalFile(packageFile.path, packageFile.contents!);\n      continue;\n    }\n    if (!(\n      packageFile.path.endsWith('package.json') ||\n      packageFile.path.endsWith('pnpm-workspace.yaml') ||\n      packageFile.path.endsWith('.yarnrc.yml')\n    )) {\n      continue;\n    }\n    const contents =\n      artifactContents.get(packageFile.path) ?? packageFile.contents!;\n    logger.debug(`Writing ${packageFile.path}`);\n    await writeLocalFile(packageFile.path, contents);\n  }\n}\n\n/* v8 ignore next -- needs test */\nasync function updateYarnOffline(\n  lockFileDir: string,\n  updatedArtifacts: FileChange[],\n): Promise<void> {\n  try {\n    const resolvedPaths: string[] = [];\n    const yarnrcYml = await getFile(upath.join(lockFileDir, '.yarnrc.yml'));\n    const yarnrc = await getFile(upath.join(lockFileDir, '.yarnrc'));\n\n    // As .yarnrc.yml overrides .yarnrc in Yarn 1 (https://git.io/JUcco)\n    // both files may exist, so check for .yarnrc.yml first\n    if (yarnrcYml) {\n      // Yarn 2 (offline cache and zero-installs)\n      const paths = getZeroInstallPaths(yarnrcYml);\n      resolvedPaths.push(...paths.map((p) => upath.join(lockFileDir, p)));\n    } else if (yarnrc) {\n      // Yarn 1 (offline mirror)\n      const mirrorLine = yarnrc\n        .split(newlineRegex)\n        .find((line) => line.startsWith('yarn-offline-mirror '));\n      if (mirrorLine) {\n        const mirrorPath = ensureTrailingSlash(\n          mirrorLine.split(' ')[1].replace(regEx(/\"/g), ''),\n        );\n        resolvedPaths.push(upath.join(lockFileDir, mirrorPath));\n      }\n    }\n    logger.debug({ resolvedPaths }, 'updateYarnOffline resolvedPaths');\n\n    if (resolvedPaths.length) {\n      const status = await getRepoStatus();\n      for (const f of status.modified.concat(status.not_added)) {\n        if (resolvedPaths.some((p) => f.startsWith(p))) {\n          updatedArtifacts.push({\n            type: 'addition',\n            path: f,\n            contents: await readLocalFile(f),\n          });\n        }\n      }\n      for (const f of status.deleted || []) {\n        if (resolvedPaths.some((p) => f.startsWith(p))) {\n          updatedArtifacts.push({ type: 'deletion', path: f });\n        }\n      }\n    }\n  } catch (err) {\n    logger.error({ err }, 'Error updating yarn offline packages');\n  }\n}\n\n// TODO: move to ./yarn.ts\n// exported for testing\nexport async function updateYarnBinary(\n  lockFileDir: string,\n  updatedArtifacts: FileChange[],\n  existingYarnrcYmlContent: string | undefined | null,\n): Promise<string | undefined | null> {\n  let yarnrcYml = existingYarnrcYmlContent;\n  try {\n    const yarnrcYmlFilename = upath.join(lockFileDir, '.yarnrc.yml');\n    yarnrcYml ??= (await getFile(yarnrcYmlFilename)) ?? undefined;\n    const newYarnrcYml = await readLocalFile(yarnrcYmlFilename, 'utf8');\n    if (!isString(yarnrcYml) || !isString(newYarnrcYml)) {\n      return existingYarnrcYmlContent;\n    }\n\n    // TODO: use schema (#9610)\n    const oldYarnPath = parseSingleYaml<YarnRcYmlFile>(yarnrcYml)?.yarnPath;\n    const newYarnPath = parseSingleYaml<YarnRcYmlFile>(newYarnrcYml)?.yarnPath;\n    if (\n      !isNonEmptyStringAndNotWhitespace(oldYarnPath) ||\n      !isNonEmptyStringAndNotWhitespace(newYarnPath)\n    ) {\n      return existingYarnrcYmlContent;\n    }\n\n    const oldYarnFullPath = upath.join(lockFileDir, oldYarnPath);\n    const newYarnFullPath = upath.join(lockFileDir, newYarnPath);\n    logger.debug({ oldYarnPath, newYarnPath }, 'Found updated Yarn binary');\n\n    yarnrcYml = yarnrcYml.replace(oldYarnPath, newYarnPath);\n    updatedArtifacts.push(\n      {\n        type: 'addition',\n        path: yarnrcYmlFilename,\n        contents: yarnrcYml,\n      },\n      {\n        type: 'deletion',\n        path: oldYarnFullPath,\n      },\n      {\n        type: 'addition',\n        path: newYarnFullPath,\n        contents: await readLocalFile(newYarnFullPath, 'utf8'),\n        isExecutable: true,\n      },\n    );\n  } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n    logger.error({ err }, 'Error updating Yarn binary');\n  }\n  return existingYarnrcYmlContent && yarnrcYml;\n}\n\nasync function getAdditionalFilesInner(\n  config: PostUpdateConfig<NpmManagerData>,\n  packageFiles: AdditionalPackageFiles,\n  originalNpmrcFiles: Map<string, string>,\n): Promise<WriteExistingFilesResult> {\n  logger.trace({ config }, 'getAdditionalFiles');\n  const artifactErrors: ArtifactError[] = [];\n  const artifactNotices: ArtifactNotice[] = [];\n  const updatedArtifacts: FileChange[] = [];\n  if (!packageFiles.npm?.length) {\n    return { artifactErrors, artifactNotices, updatedArtifacts };\n  }\n  if (config.skipArtifactsUpdate) {\n    logger.debug('Skipping lock file generation');\n    return { artifactErrors, artifactNotices, updatedArtifacts };\n  }\n  logger.debug('Getting updated lock files');\n  if (\n    config.isLockFileMaintenance &&\n    config.reuseExistingBranch &&\n    (await scm.branchExists(config.branchName))\n  ) {\n    logger.debug('Skipping lockFileMaintenance update');\n    return { artifactErrors, artifactNotices, updatedArtifacts };\n  }\n  const dirs = determineLockFileDirs(config, packageFiles);\n  logger.trace({ dirs }, 'lock file dirs');\n  await writeExistingFiles(config, packageFiles, originalNpmrcFiles);\n  await writeUpdatedPackageFiles(config);\n\n  const { additionalNpmrcContent, additionalYarnRcYml } = processHostRules();\n\n  // This isn't passed directly to the child process, so no need to filter.\n  // But pass custom env and user vars.\n  const env = {\n    ...getEnv(),\n    NPM_CONFIG_CACHE: await ensureCacheDir(NPM_CACHE_DIR),\n    YARN_CACHE_FOLDER: await ensureCacheDir(YARN_CACHE_DIR),\n    YARN_GLOBAL_FOLDER: await ensureCacheDir(YARN_GLOBAL_DIR),\n    npm_config_store: await ensureCacheDir(PNPM_CACHE_BASE_DIR),\n    NODE_ENV: 'dev',\n  };\n\n  let token: string | undefined;\n  try {\n    ({ token } = hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }));\n    // v8 ignore next -- TODO: add test #40625\n    token = token ? `${token}@` : token;\n  } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n    logger.warn({ err }, 'Error getting token for packageFile');\n  }\n  const tokenRe = regEx(`${token ?? ''}`, 'g', false);\n  for (const npmLock of dirs.npmLockDirs) {\n    const lockFileDir = upath.dirname(npmLock);\n    await withNpmrcHostRules(\n      lockFileDir,\n      additionalNpmrcContent,\n      async (npmrcContent) => {\n        const fileName = upath.basename(npmLock);\n        logger.debug(`Generating ${fileName} for ${lockFileDir}`);\n        const upgrades = config.upgrades.filter(\n          (upgrade) => upgrade.managerData?.npmLock === npmLock,\n        );\n        const res = await npm.generateLockFile(\n          lockFileDir,\n          env,\n          fileName,\n          config,\n          upgrades,\n          npmrcContent,\n        );\n        if (res.error) {\n          /* v8 ignore next -- needs test */\n          if (res.stderr?.includes('No matching version found for')) {\n            for (const upgrade of config.upgrades) {\n              if (\n                res.stderr.includes(\n                  `No matching version found for ${upgrade.depName}`,\n                )\n              ) {\n                logger.debug(\n                  { dependency: upgrade.depName, type: 'npm' },\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                );\n                const err = new Error(\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                );\n                throw new ExternalHostError(err, NpmDatasource.id);\n              }\n            }\n          }\n\n          artifactErrors.push({\n            fileName: npmLock,\n            stderr: res.stderr,\n          });\n        } else if (res.lockFile) {\n          if (res.beforeFallback) {\n            const message =\n              'npm `--before` could not be enforced because existing locked packages were published after the `minimumReleaseAge` cutoff. This will resolve after the next lock file maintenance run.';\n            logger.warn({ npmLock }, message);\n            artifactNotices.push({ file: npmLock, message });\n          }\n          const existingContent = await getFile(\n            npmLock,\n            config.reuseExistingBranch ? config.branchName : config.baseBranch,\n          );\n          if (res.lockFile === existingContent) {\n            logger.debug(`${npmLock} hasn't changed`);\n          } else {\n            logger.debug(`${npmLock} needs updating`);\n            updatedArtifacts.push({\n              type: 'addition',\n              path: npmLock,\n              // TODO: can this be undefined? (#22198)\n\n              contents: res.lockFile.replace(tokenRe, ''),\n            });\n          }\n        }\n      },\n    );\n  }\n\n  for (const yarnLock of dirs.yarnLockDirs) {\n    const lockFileDir = upath.dirname(yarnLock);\n    let yarnRcYmlFilename: string | undefined;\n    let existingYarnrcYmlContent: string | undefined | null;\n    await withNpmrcHostRules(lockFileDir, additionalNpmrcContent, async () => {\n      if (additionalYarnRcYml) {\n        yarnRcYmlFilename = getSiblingFileName(yarnLock, '.yarnrc.yml');\n        existingYarnrcYmlContent = await readLocalFile(\n          yarnRcYmlFilename,\n          'utf8',\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (existingYarnrcYmlContent) {\n          try {\n            // TODO: use schema (#9610)\n            const existingYarnrRcYml = parseSingleYaml<Record<string, unknown>>(\n              existingYarnrcYmlContent,\n            );\n\n            const updatedYarnYrcYml = deepmerge(\n              existingYarnrRcYml,\n              yarn.fuzzyMatchAdditionalYarnrcYml(\n                additionalYarnRcYml,\n                existingYarnrRcYml,\n              ),\n            );\n\n            await writeLocalFile(yarnRcYmlFilename, dump(updatedYarnYrcYml));\n            logger.debug('Added authentication to .yarnrc.yml');\n          } catch (err) {\n            logger.warn({ err }, 'Error appending .yarnrc.yml content');\n          }\n        }\n      }\n      logger.debug(`Generating yarn.lock for ${lockFileDir}`);\n      const lockFileName = upath.join(lockFileDir, 'yarn.lock');\n      const upgrades = config.upgrades.filter(\n        (upgrade) => upgrade.managerData?.yarnLock === yarnLock,\n      );\n      const res = await yarn.generateLockFile(\n        lockFileDir,\n        env,\n        config,\n        upgrades,\n      );\n      if (res.error) {\n        /* v8 ignore next -- needs test */\n        if (res.stderr?.includes(`Couldn't find any versions for`)) {\n          for (const upgrade of config.upgrades) {\n            if (\n              res.stderr.includes(\n                `Couldn't find any versions for \\\\\"${upgrade.depName}\\\\\"`,\n              )\n            ) {\n              logger.debug(\n                { dependency: upgrade.depName, type: 'yarn' },\n                'lock file failed for the dependency being updated - skipping branch creation',\n              );\n              throw new ExternalHostError(\n                new Error(\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                ),\n                NpmDatasource.id,\n              );\n            }\n          }\n        }\n\n        artifactErrors.push({\n          fileName: yarnLock,\n          stderr: artifactErrorMessageFromExecError(res, ''),\n        });\n      } else {\n        const existingContent = await getFile(\n          lockFileName,\n          config.reuseExistingBranch ? config.branchName : config.baseBranch,\n        );\n        if (res.lockFile === existingContent) {\n          logger.debug(\"yarn.lock hasn't changed\");\n        } else {\n          logger.debug('yarn.lock needs updating');\n          updatedArtifacts.push({\n            type: 'addition',\n            path: lockFileName,\n            // TODO #22198\n            contents: res.lockFile!,\n          });\n          await updateYarnOffline(lockFileDir, updatedArtifacts);\n        }\n\n        /* v8 ignore next -- needs test */\n        if (upgrades.some(yarn.isYarnUpdate)) {\n          existingYarnrcYmlContent = await updateYarnBinary(\n            lockFileDir,\n            updatedArtifacts,\n            existingYarnrcYmlContent,\n          );\n        }\n      }\n    });\n    /* v8 ignore next -- needs test */\n    if (existingYarnrcYmlContent) {\n      // TODO #22198\n      await writeLocalFile(yarnRcYmlFilename!, existingYarnrcYmlContent);\n    }\n  }\n\n  for (const pnpmLockFile of dirs.pnpmLockFileDirs) {\n    const lockFileDir = upath.dirname(pnpmLockFile);\n    await withNpmrcHostRules(lockFileDir, additionalNpmrcContent, async () => {\n      logger.debug(`Generating pnpm-lock.yaml for ${lockFileDir}`);\n      const upgrades = config.upgrades.filter(\n        (upgrade) => upgrade.managerData?.pnpmLockFile === pnpmLockFile,\n      );\n      const res = await pnpm.generateLockFile(\n        lockFileDir,\n        env,\n        config,\n        upgrades,\n      );\n      if (res.error) {\n        /* v8 ignore next -- needs test */\n        if (res.stdout?.includes(`No compatible version found:`)) {\n          for (const upgrade of config.upgrades) {\n            if (\n              res.stdout.includes(\n                `No compatible version found: ${upgrade.depName}`,\n              )\n            ) {\n              logger.debug(\n                { dependency: upgrade.depName, type: 'pnpm' },\n                'lock file failed for the dependency being updated - skipping branch creation',\n              );\n              throw new ExternalHostError(\n                Error(\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                ),\n                NpmDatasource.id,\n              );\n            }\n          }\n        }\n\n        artifactErrors.push({\n          fileName: pnpmLockFile,\n          stderr: artifactErrorMessageFromExecError(res, ''),\n        });\n      } else {\n        const existingContent = await getFile(\n          pnpmLockFile,\n          config.reuseExistingBranch ? config.branchName : config.baseBranch,\n        );\n        if (res.lockFile === existingContent) {\n          logger.debug(\"pnpm-lock.yaml hasn't changed\");\n        } else {\n          logger.debug('pnpm-lock.yaml needs updating');\n          updatedArtifacts.push({\n            type: 'addition',\n            path: pnpmLockFile,\n            // TODO: can be undefined? (#22198)\n            contents: res.lockFile!,\n          });\n        }\n      }\n    });\n  }\n\n  return { artifactErrors, artifactNotices, updatedArtifacts };\n}\n\nexport async function getAdditionalFiles(\n  config: PostUpdateConfig,\n  packageFiles: AdditionalPackageFiles,\n): Promise<WriteExistingFilesResult> {\n  const originalNpmrcFiles = new Map<string, string>();\n  try {\n    return await getAdditionalFilesInner(\n      // The branch config carries the manager data of every upgrade untyped; the npm post-update only reads the optional npm fields of it.\n      config as PostUpdateConfig<NpmManagerData>,\n      packageFiles,\n      originalNpmrcFiles,\n    );\n  } finally {\n    await restoreNpmrcFiles(originalNpmrcFiles);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,SAAS,QAAQ,KAA8C;CAC7D,OAAO,MAAM,KAAK,IAAI,IAAI,IAAI,OAAO,QAAQ,CAAC,CAAC;AACjD;AAEA,SAAgB,sBACd,QACA,cAC6B;CAC7B,MAAM,cAAsC,CAAC;CAC7C,MAAM,eAAuC,CAAC;CAC9C,MAAM,mBAA2C,CAAC;CAElD,KAAK,MAAM,WAAW,OAAO;;CAE3B,IACE,QAAQ,eAAe,yBACvB,QAAQ,kBAAkB,QAC1B,QAAQ,qBAAqB,MAC7B;EACA,aAAa,KAAK,QAAQ,aAAa,QAAQ;EAC/C,YAAY,KAAK,QAAQ,aAAa,OAAO;EAC7C,iBAAiB,KAAK,QAAQ,aAAa,YAAY;CACzD;CAGF,IACE,OAAO,SAAS,OACb,YACC,QAAQ,eAAe,yBACvB,QAAQ,gBACZ,GAEA,OAAO;EACL,cAAc,QAAQ,YAAY;EAClC,aAAa,QAAQ,WAAW;EAChC,kBAAkB,QAAQ,gBAAgB;CAC5C;CAGF,SAAS,eACP,UAC2C;EAC3C,OAAO,MAAM,4BAA4B,UAAU;EAEnD,KAAK,MAAM,eAAe,aAAa,KAAM;GAC3C,IAAI,YAAY,gBAAgB,UAAU;IACxC,OAAO,MAAM,EAAE,YAAY,GAAG,mBAAmB;IACjD,OAAO;GACT;GACA,OAAO,MAAM,UAAU;EACzB;EACA,OAAO,CAAC;CACV;CAGA,KAAK,MAAM,KAAK,OAAO,qBAAsB;EAC3C,OAAO,MAAM,YAAY,OAAO,EAAE,IAAI,EAAE,gBAAgB;EACxD,MAAM,cAAc,eAAe,EAAE,IAAI;;EAEzC,IAAI,CAAC,YAAY,aACf;EAGF,aAAa,KAAK,YAAY,YAAY,QAAQ;EAClD,YAAY,KAAK,YAAY,YAAY,OAAO;EAChD,iBAAiB,KAAK,YAAY,YAAY,YAAY;CAC5D;CAEA,OAAO;EACL,cAAc,QAAQ,YAAY;EAClC,aAAa,QAAQ,WAAW;EAChC,kBAAkB,QAAQ,gBAAgB;CAC5C;AACF;AAEA,eAAsB,mBACpB,QACA,cACA,qCAAqB,IAAI,IAAoB,GAC9B;CACf,IAAI,CAAC,aAAa,KAChB;CAEF,MAAM,WAAW,aAAa;CAC9B,OAAO,MACL,EAAE,cAAc,SAAS,KAAK,MAAM,EAAE,WAAW,EAAE,GACnD,4BACF;CACA,KAAK,MAAM,eAAe,UAAU;;EAElC,IAAI,CAAC,YAAY,aACf;EAGF,MAAM,UAAU,MAAM,QAAQ,YAAY,WAAY;EACtD,MAAM,QAAQ,YAAY;EAC1B,MAAM,gBAAgB,MAAM,KAAK,SAAS,QAAQ;EAGlD,IACE,SAAS,KAAK,MACb,kBAAkB,YAAY,YAAY,iBACzC,CAAC,YAAY,YAAY,gBAE3B,IAAI;GACF,IAAI,CAAC,mBAAmB,IAAI,aAAa,GAAG;IAC1C,MAAM,gBAAgB,MAAM,cAAc,eAAe,MAAM;IAC/D,IAAI,SAAS,aAAa,GACxB,mBAAmB,IAAI,eAAe,aAAa;GAEvD;GACA,MAAM,eAAe,eAAe,MAAM,QAAQ,MAAM,MAAM,GAAG,IAAI,CAAC;EACxE,SAAS,mDAAmD;GAC1D,OAAO,KAAK;IAAE;IAAe;GAAI,GAAG,sBAAsB;EAC5D;EAEF,MAAM,UAAU,YAAY,YAAY;EACxC,IAAI,SAAS;GACX,MAAM,cAAc;GACpB,OAAO,MAAM,WAAW,SAAS;GACjC,IAAI;GACJ,IAAI;IACF,kBAAmB,MAAM,QAAQ,OAAO,KAAM;GAChD,SAAS,mDAAmD;IAC1D,OAAO,KAAK,EAAE,IAAI,GAAG,6BAA6B;IAClD,kBAAkB;GACpB;GACA,MAAM,EAAE,gBAAgB,gBAAgB,kBACtC,cAAc,eAAe;GAC/B,IAAI,eAAe;IACjB,MAAM,eACJ,cAAc,gBACV,OAAO,KAAK,cAAc,QAAQ,IAClC,CAAC;IACP,MAAM,SAAmB,CAAC;IAC1B,IAAI,kBAAkB;IACtB,KAAK,MAAM,WAAW,OAAO,UAAU;KACrC,IAAI,QAAQ,aAAa,CAAC,QAAQ,UAAU,SAAS,OAAO,GAC1D;KAEF,IAAI,CAAC,QAAQ,aACX;KAEF,IACE,QAAQ,kBAAkB,WAC1B,QAAQ,YAAY,YAAY,SAGhC,OAAO,KAAK,QAAQ,OAAQ;KAE9B,MAAM,EAAE,YAAY;KACpB,MAAM,aAAa,QAAQ,iBAAiB,QAAQ;KACpD,IAAI,cAAc,eAChB,KAAK,MAAM,eAAe,cAAc;MACtC,IACE,gBAAgB,gBAAgB,aAChC,YAAY,WAAW,gBAAgB,QAAQ,EAAE,GACjD;OACA,OAAO,MAAM,EAAE,YAAY,GAAG,4BAA4B;OAC1D,kBAAkB;OAClB,OAAO,cAAc,SAAS;OAC9B;MACF;MACA,IACE,CAAC,WACD,CAAC,cAID,CAAC,YAAY,WAAW,eAAe,GAEvC;MAMF,MAAM,QAAQ,cAAc,SAAS;MAKrC,IAHE,OAAO,mBAAmB,aAAa,cACvC,OAAO,eAAe,aAAa,cACnC,OAAO,uBAAuB,aAAa,YACjC;OACV,OAAO,MACL;QAAE;QAAa;QAAS;OAAW,GACnC,gCACF;OACA,kBAAkB;OAClB,OAAO,cAAc,SAAS;MAChC;KACF;IAEJ;;IAEA,IAAI,OAAO,QAAQ;KACjB,OAAO,MACL,YAAY,OAAO,MAAM,EAAE,QAAQ,QAAQ,oBAC7C;KACA,kBAAkB;KAClB,IAAI;MACF,IAAI,kBAAkB,iBAAiB,cAAc,cACnD,OAAO,SAAS,YAAY;OAE1B,OAAO,cAAc,aAAc;MACrC,CAAC;KAEL,sDAAsD;MACpD,OAAO,KACL,EAAE,QAAQ,GACV,6CACF;KACF;IACF;;IAEA,IAAI,iBAAiB;KACnB,OAAO,MAAM,gDAAgD;KAC7D,kBAAkB,gBAAgB,eAAe,cAAc;IACjE;IACA,MAAM,eAAe,aAAa,eAAe;GACnD;EACF;CACF;AACF;AAEA,eAAe,kBACb,oBACe;CACf,KAAK,MAAM,CAAC,eAAe,kBAAkB,oBAC3C,IAAI;EACF,MAAM,eAAe,eAAe,aAAa;CACnD,SAAS,KAAK;EACZ,OAAO,KAAK;GAAE;GAAe;EAAI,GAAG,wBAAwB;CAC9D;AAEJ;AAEA,eAAsB,yBACpB,QACe;CACf,OAAO,MAAM,EAAE,OAAO,GAAG,0BAA0B;CACnD,OAAO,MAAM,mCAAmC;CAChD,IAAI,CAAC,OAAO,qBAAqB;EAC/B,OAAO,MAAM,gBAAgB;EAC7B;CACF;CAEA,MAAM,mCAAmB,IAAI,IAAoB;CACjD,IAAI,OAAO,kBACJ;OAAA,MAAM,YAAY,OAAO,kBAC5B,IAAI,SAAS,SAAS,cAAc,SAAS,UAC3C,iBAAiB,IAAI,SAAS,MAAM,SAAS,SAAS,SAAS,CAAC;CAAA;CAItE,MAAM,qBAAqB,CAAC,qBAAqB,WAAW;CAC5D,KAAK,MAAM,eAAe,OAAO,qBAAqB;EACpD,IAAI,YAAY,SAAS,YACvB;EAEF,IACE,mBAAmB,MAAM,aAAa,YAAY,KAAK,SAAS,QAAQ,CAAC,GACzE;GACA,OAAO,MAAM,sBAAsB,YAAY,MAAM;GAGrD,MAAM,eAAe,YAAY,MAAM,YAAY,QAAS;GAC5D;EACF;EACA,IAAI,EACF,YAAY,KAAK,SAAS,cAAc,KACxC,YAAY,KAAK,SAAS,qBAAqB,KAC/C,YAAY,KAAK,SAAS,aAAa,IAEvC;EAEF,MAAM,WACJ,iBAAiB,IAAI,YAAY,IAAI,KAAK,YAAY;EACxD,OAAO,MAAM,WAAW,YAAY,MAAM;EAC1C,MAAM,eAAe,YAAY,MAAM,QAAQ;CACjD;AACF;;AAGA,eAAe,kBACb,aACA,kBACe;CACf,IAAI;EACF,MAAM,gBAA0B,CAAC;EACjC,MAAM,YAAY,MAAM,QAAQ,MAAM,KAAK,aAAa,aAAa,CAAC;EACtE,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAK,aAAa,SAAS,CAAC;EAI/D,IAAI,WAAW;GAEb,MAAM,QAAQ,oBAAoB,SAAS;GAC3C,cAAc,KAAK,GAAG,MAAM,KAAK,MAAM,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC;EACpE,OAAO,IAAI,QAAQ;GAEjB,MAAM,aAAa,OAChB,MAAM,YAAY,CAAC,CACnB,MAAM,SAAS,KAAK,WAAW,sBAAsB,CAAC;GACzD,IAAI,YAAY;IACd,MAAM,aAAa,oBACjB,WAAW,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,MAAM,IAAI,GAAG,EAAE,CAClD;IACA,cAAc,KAAK,MAAM,KAAK,aAAa,UAAU,CAAC;GACxD;EACF;EACA,OAAO,MAAM,EAAE,cAAc,GAAG,iCAAiC;EAEjE,IAAI,cAAc,QAAQ;GACxB,MAAM,SAAS,MAAM,cAAc;GACnC,KAAK,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,SAAS,GACrD,IAAI,cAAc,MAAM,MAAM,EAAE,WAAW,CAAC,CAAC,GAC3C,iBAAiB,KAAK;IACpB,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,CAAC;GAGL,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC,GACjC,IAAI,cAAc,MAAM,MAAM,EAAE,WAAW,CAAC,CAAC,GAC3C,iBAAiB,KAAK;IAAE,MAAM;IAAY,MAAM;GAAE,CAAC;EAGzD;CACF,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,sCAAsC;CAC9D;AACF;AAIA,eAAsB,iBACpB,aACA,kBACA,0BACoC;CACpC,IAAI,YAAY;CAChB,IAAI;EACF,MAAM,oBAAoB,MAAM,KAAK,aAAa,aAAa;EAC/D,cAAe,MAAM,QAAQ,iBAAiB,KAAM,KAAA;EACpD,MAAM,eAAe,MAAM,cAAc,mBAAmB,MAAM;EAClE,IAAI,CAAC,SAAS,SAAS,KAAK,CAAC,SAAS,YAAY,GAChD,OAAO;EAIT,MAAM,cAAc,gBAA+B,SAAS,CAAC,EAAE;EAC/D,MAAM,cAAc,gBAA+B,YAAY,CAAC,EAAE;EAClE,IACE,CAAC,iCAAiC,WAAW,KAC7C,CAAC,iCAAiC,WAAW,GAE7C,OAAO;EAGT,MAAM,kBAAkB,MAAM,KAAK,aAAa,WAAW;EAC3D,MAAM,kBAAkB,MAAM,KAAK,aAAa,WAAW;EAC3D,OAAO,MAAM;GAAE;GAAa;EAAY,GAAG,2BAA2B;EAEtE,YAAY,UAAU,QAAQ,aAAa,WAAW;EACtD,iBAAiB,KACf;GACE,MAAM;GACN,MAAM;GACN,UAAU;EACZ,GACA;GACE,MAAM;GACN,MAAM;EACR,GACA;GACE,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,iBAAiB,MAAM;GACrD,cAAc;EAChB,CACF;CACF,SAAS,mDAAmD;EAC1D,OAAO,MAAM,EAAE,IAAI,GAAG,4BAA4B;CACpD;CACA,OAAO,4BAA4B;AACrC;AAEA,eAAe,wBACb,QACA,cACA,oBACmC;CACnC,OAAO,MAAM,EAAE,OAAO,GAAG,oBAAoB;CAC7C,MAAM,iBAAkC,CAAC;CACzC,MAAM,kBAAoC,CAAC;CAC3C,MAAM,mBAAiC,CAAC;CACxC,IAAI,CAAC,aAAa,KAAK,QACrB,OAAO;EAAE;EAAgB;EAAiB;CAAiB;CAE7D,IAAI,OAAO,qBAAqB;EAC9B,OAAO,MAAM,+BAA+B;EAC5C,OAAO;GAAE;GAAgB;GAAiB;EAAiB;CAC7D;CACA,OAAO,MAAM,4BAA4B;CACzC,IACE,OAAO,yBACP,OAAO,uBACN,MAAM,IAAI,aAAa,OAAO,UAAU,GACzC;EACA,OAAO,MAAM,qCAAqC;EAClD,OAAO;GAAE;GAAgB;GAAiB;EAAiB;CAC7D;CACA,MAAM,OAAO,sBAAsB,QAAQ,YAAY;CACvD,OAAO,MAAM,EAAE,KAAK,GAAG,gBAAgB;CACvC,MAAM,mBAAmB,QAAQ,cAAc,kBAAkB;CACjE,MAAM,yBAAyB,MAAM;CAErC,MAAM,EAAE,wBAAwB,wBAAwB,iBAAiB;CAIzE,MAAM,MAAM;EACV,GAAG,OAAO;EACV,kBAAkB,MAAM,eAAA,KAA4B;EACpD,mBAAmB,MAAM,eAAe,cAAc;EACtD,oBAAoB,MAAM,eAAe,eAAe;EACxD,kBAAkB,MAAM,eAAe,mBAAmB;EAC1D,UAAU;CACZ;CAEA,IAAI;CACJ,IAAI;EACF,CAAC,CAAE,SAAUA,KAAe;GAC1B,UAAU;GACV,KAAK;EACP,CAAC;;EAED,QAAQ,QAAQ,GAAG,MAAM,KAAK;CAChC,SAAS,mDAAmD;EAC1D,OAAO,KAAK,EAAE,IAAI,GAAG,qCAAqC;CAC5D;CACA,MAAM,UAAU,MAAM,GAAG,SAAS,MAAM,KAAK,KAAK;CAClD,KAAK,MAAM,WAAW,KAAK,aAAa;EACtC,MAAM,cAAc,MAAM,QAAQ,OAAO;EACzC,MAAM,mBACJ,aACA,wBACA,OAAO,iBAAiB;GACtB,MAAM,WAAW,MAAM,SAAS,OAAO;GACvC,OAAO,MAAM,cAAc,SAAS,OAAO,aAAa;GACxD,MAAM,WAAW,OAAO,SAAS,QAC9B,YAAY,QAAQ,aAAa,YAAY,OAChD;GACA,MAAM,MAAM,MAAMC,iBAChB,aACA,KACA,UACA,QACA,UACA,YACF;GACA,IAAI,IAAI,OAAO;;IAEb,IAAI,IAAI,QAAQ,SAAS,+BAA+B,GACjD;UAAA,MAAM,WAAW,OAAO,UAC3B,IACE,IAAI,OAAO,SACT,iCAAiC,QAAQ,SAC3C,GACA;MACA,OAAO,MACL;OAAE,YAAY,QAAQ;OAAS,MAAM;MAAM,GAC3C,8EACF;MAIA,MAAM,IAAI,kCAAkB,IAHZ,MACd,8EAE4B,GAAG,cAAc,EAAE;KACnD;;IAIJ,eAAe,KAAK;KAClB,UAAU;KACV,QAAQ,IAAI;IACd,CAAC;GACH,OAAO,IAAI,IAAI,UAAU;IACvB,IAAI,IAAI,gBAAgB;KACtB,MAAM,UACJ;KACF,OAAO,KAAK,EAAE,QAAQ,GAAG,OAAO;KAChC,gBAAgB,KAAK;MAAE,MAAM;MAAS;KAAQ,CAAC;IACjD;IACA,MAAM,kBAAkB,MAAM,QAC5B,SACA,OAAO,sBAAsB,OAAO,aAAa,OAAO,UAC1D;IACA,IAAI,IAAI,aAAa,iBACnB,OAAO,MAAM,GAAG,QAAQ,gBAAgB;SACnC;KACL,OAAO,MAAM,GAAG,QAAQ,gBAAgB;KACxC,iBAAiB,KAAK;MACpB,MAAM;MACN,MAAM;MAGN,UAAU,IAAI,SAAS,QAAQ,SAAS,EAAE;KAC5C,CAAC;IACH;GACF;EACF,CACF;CACF;CAEA,KAAK,MAAM,YAAY,KAAK,cAAc;EACxC,MAAM,cAAc,MAAM,QAAQ,QAAQ;EAC1C,IAAI;EACJ,IAAI;EACJ,MAAM,mBAAmB,aAAa,wBAAwB,YAAY;GACxE,IAAI,qBAAqB;IACvB,oBAAoB,mBAAmB,UAAU,aAAa;IAC9D,2BAA2B,MAAM,cAC/B,mBACA,MACF;;IAEA,IAAI,0BACF,IAAI;KAEF,MAAM,qBAAqB,gBACzB,wBACF;KAEA,MAAM,oBAAoBC,MACxB,oBACAC,8BACE,qBACA,kBACF,CACF;KAEA,MAAM,eAAe,mBAAmB,KAAK,iBAAiB,CAAC;KAC/D,OAAO,MAAM,qCAAqC;IACpD,SAAS,KAAK;KACZ,OAAO,KAAK,EAAE,IAAI,GAAG,qCAAqC;IAC5D;GAEJ;GACA,OAAO,MAAM,4BAA4B,aAAa;GACtD,MAAM,eAAe,MAAM,KAAK,aAAa,WAAW;GACxD,MAAM,WAAW,OAAO,SAAS,QAC9B,YAAY,QAAQ,aAAa,aAAa,QACjD;GACA,MAAM,MAAM,MAAMC,mBAChB,aACA,KACA,QACA,QACF;GACA,IAAI,IAAI,OAAO;;IAEb,IAAI,IAAI,QAAQ,SAAS,gCAAgC,GAClD;UAAA,MAAM,WAAW,OAAO,UAC3B,IACE,IAAI,OAAO,SACT,qCAAqC,QAAQ,QAAQ,IACvD,GACA;MACA,OAAO,MACL;OAAE,YAAY,QAAQ;OAAS,MAAM;MAAO,GAC5C,8EACF;MACA,MAAM,IAAI,kCACR,IAAI,MACF,8EACF,GACA,cAAc,EAChB;KACF;;IAIJ,eAAe,KAAK;KAClB,UAAU;KACV,QAAQ,kCAAkC,KAAK,EAAE;IACnD,CAAC;GACH,OAAO;IACL,MAAM,kBAAkB,MAAM,QAC5B,cACA,OAAO,sBAAsB,OAAO,aAAa,OAAO,UAC1D;IACA,IAAI,IAAI,aAAa,iBACnB,OAAO,MAAM,0BAA0B;SAClC;KACL,OAAO,MAAM,0BAA0B;KACvC,iBAAiB,KAAK;MACpB,MAAM;MACN,MAAM;MAEN,UAAU,IAAI;KAChB,CAAC;KACD,MAAM,kBAAkB,aAAa,gBAAgB;IACvD;;IAGA,IAAI,SAAS,KAAKC,YAAiB,GACjC,2BAA2B,MAAM,iBAC/B,aACA,kBACA,wBACF;GAEJ;EACF,CAAC;;EAED,IAAI,0BAEF,MAAM,eAAe,mBAAoB,wBAAwB;CAErE;CAEA,KAAK,MAAM,gBAAgB,KAAK,kBAAkB;EAChD,MAAM,cAAc,MAAM,QAAQ,YAAY;EAC9C,MAAM,mBAAmB,aAAa,wBAAwB,YAAY;GACxE,OAAO,MAAM,iCAAiC,aAAa;GAC3D,MAAM,WAAW,OAAO,SAAS,QAC9B,YAAY,QAAQ,aAAa,iBAAiB,YACrD;GACA,MAAM,MAAM,MAAMC,mBAChB,aACA,KACA,QACA,QACF;GACA,IAAI,IAAI,OAAO;;IAEb,IAAI,IAAI,QAAQ,SAAS,8BAA8B,GAChD;UAAA,MAAM,WAAW,OAAO,UAC3B,IACE,IAAI,OAAO,SACT,gCAAgC,QAAQ,SAC1C,GACA;MACA,OAAO,MACL;OAAE,YAAY,QAAQ;OAAS,MAAM;MAAO,GAC5C,8EACF;MACA,MAAM,IAAI,kBACR,MACE,8EACF,GACA,cAAc,EAChB;KACF;;IAIJ,eAAe,KAAK;KAClB,UAAU;KACV,QAAQ,kCAAkC,KAAK,EAAE;IACnD,CAAC;GACH,OAAO;IACL,MAAM,kBAAkB,MAAM,QAC5B,cACA,OAAO,sBAAsB,OAAO,aAAa,OAAO,UAC1D;IACA,IAAI,IAAI,aAAa,iBACnB,OAAO,MAAM,+BAA+B;SACvC;KACL,OAAO,MAAM,+BAA+B;KAC5C,iBAAiB,KAAK;MACpB,MAAM;MACN,MAAM;MAEN,UAAU,IAAI;KAChB,CAAC;IACH;GACF;EACF,CAAC;CACH;CAEA,OAAO;EAAE;EAAgB;EAAiB;CAAiB;AAC7D;AAEA,eAAsB,mBACpB,QACA,cACmC;CACnC,MAAM,qCAAqB,IAAI,IAAoB;CACnD,IAAI;EACF,OAAO,MAAM,wBAEX,QACA,cACA,kBACF;CACF,UAAU;EACR,MAAM,kBAAkB,kBAAkB;CAC5C;AACF"}
+{"version":3,"file":"index.js","names":["hostRules.find","npm.generateLockFile","deepmerge","yarn.fuzzyMatchAdditionalYarnrcYml","yarn.generateLockFile","yarn.isYarnUpdate","pnpm.generateLockFile"],"sources":["../../../../../lib/modules/manager/npm/post-update/index.ts"],"sourcesContent":["// TODO: types (#22198)\nimport { isNonEmptyStringAndNotWhitespace, isString } from '@sindresorhus/is';\nimport deepmerge from 'deepmerge';\nimport upath from 'upath';\nimport { logger } from '../../../../logger/index.ts';\nimport { ExternalHostError } from '../../../../types/errors/external-host-error.ts';\nimport { getEnv } from '../../../../util/env.ts';\nimport {\n  ensureCacheDir,\n  getSiblingFileName,\n  readLocalFile,\n  writeLocalFile,\n} from '../../../../util/fs/index.ts';\nimport { getFile, getRepoStatus } from '../../../../util/git/index.ts';\nimport type { FileChange } from '../../../../util/git/types.ts';\nimport * as hostRules from '../../../../util/host-rules.ts';\nimport { newlineRegex, regEx } from '../../../../util/regex.ts';\nimport { ensureTrailingSlash } from '../../../../util/url.ts';\nimport { dump, parseSingleYaml } from '../../../../util/yaml.ts';\nimport { NpmDatasource } from '../../../datasource/npm/index.ts';\nimport { scm } from '../../../platform/scm.ts';\nimport type {\n  ArtifactError,\n  ArtifactNotice,\n  NpmrcPackageFile,\n  PostUpdateConfig,\n  Upgrade,\n} from '../../types.ts';\nimport { artifactErrorMessageFromExecError } from '../../util.ts';\nimport {\n  NPM_CACHE_DIR,\n  PNPM_CACHE_BASE_DIR,\n  YARN_CACHE_DIR,\n  YARN_GLOBAL_DIR,\n} from '../constants.ts';\nimport { getZeroInstallPaths } from '../extract/yarn.ts';\nimport type { NpmManagerData } from '../types.ts';\nimport {\n  composeLockFile,\n  parseLockFile,\n  withNpmrcHostRules,\n} from '../utils.ts';\nimport * as npm from './npm.ts';\nimport * as pnpm from './pnpm.ts';\nimport { processHostRules } from './rules.ts';\nimport type {\n  AdditionalPackageFiles,\n  DetermineLockFileDirsResult,\n  WriteExistingFilesResult,\n  YarnRcYmlFile,\n} from './types.ts';\nimport * as yarn from './yarn.ts';\n\n// Strips empty values, deduplicates, and returns the directories from filenames\nfunction getDirs(arr: (string | null | undefined)[]): string[] {\n  return Array.from(new Set(arr.filter(isString)));\n}\n\nexport function determineLockFileDirs(\n  config: PostUpdateConfig<NpmManagerData>,\n  packageFiles: AdditionalPackageFiles,\n): DetermineLockFileDirsResult {\n  const npmLockDirs: (string | undefined)[] = [];\n  const yarnLockDirs: (string | undefined)[] = [];\n  const pnpmLockFileDirs: (string | undefined)[] = [];\n\n  for (const upgrade of config.upgrades) {\n    // v8 ignore else -- TODO: add test #40625\n    if (\n      upgrade.updateType === 'lockFileMaintenance' ||\n      upgrade.isRemediation === true ||\n      upgrade.isLockfileUpdate === true\n    ) {\n      yarnLockDirs.push(upgrade.managerData?.yarnLock);\n      npmLockDirs.push(upgrade.managerData?.npmLock);\n      pnpmLockFileDirs.push(upgrade.managerData?.pnpmLockFile);\n    }\n  }\n\n  if (\n    config.upgrades.every(\n      (upgrade: Upgrade) =>\n        upgrade.updateType === 'lockFileMaintenance' ||\n        upgrade.isLockfileUpdate,\n    )\n  ) {\n    return {\n      yarnLockDirs: getDirs(yarnLockDirs),\n      npmLockDirs: getDirs(npmLockDirs),\n      pnpmLockFileDirs: getDirs(pnpmLockFileDirs),\n    };\n  }\n\n  function getPackageFile(\n    fileName: string,\n  ): Partial<NpmrcPackageFile<NpmManagerData>> {\n    logger.trace(`Looking for packageFile: ${fileName}`);\n\n    for (const packageFile of packageFiles.npm!) {\n      if (packageFile.packageFile === fileName) {\n        logger.trace({ packageFile }, 'Found packageFile');\n        return packageFile;\n      }\n      logger.trace('No match');\n    }\n    return {};\n  }\n\n  // TODO #22198\n  for (const p of config.updatedPackageFiles!) {\n    logger.trace(`Checking ${String(p.path)} for lock files`);\n    const packageFile = getPackageFile(p.path);\n    /* v8 ignore next -- needs test */\n    if (!packageFile.managerData) {\n      continue;\n    }\n    // push full lock file names and convert them later\n    yarnLockDirs.push(packageFile.managerData.yarnLock);\n    npmLockDirs.push(packageFile.managerData.npmLock);\n    pnpmLockFileDirs.push(packageFile.managerData.pnpmLockFile);\n  }\n\n  return {\n    yarnLockDirs: getDirs(yarnLockDirs),\n    npmLockDirs: getDirs(npmLockDirs),\n    pnpmLockFileDirs: getDirs(pnpmLockFileDirs),\n  };\n}\n\nexport async function writeExistingFiles(\n  config: PostUpdateConfig<NpmManagerData>,\n  packageFiles: AdditionalPackageFiles,\n  originalNpmrcFiles = new Map<string, string>(),\n): Promise<void> {\n  if (!packageFiles.npm) {\n    return;\n  }\n  const npmFiles = packageFiles.npm;\n  logger.debug(\n    { packageFiles: npmFiles.map((n) => n.packageFile) },\n    'Writing package.json files',\n  );\n  for (const packageFile of npmFiles) {\n    /* v8 ignore if -- TODO: add test #40625 */\n    if (!packageFile.managerData) {\n      continue;\n    }\n    // TODO #22198\n    const basedir = upath.dirname(packageFile.packageFile!);\n    const npmrc = packageFile.npmrc;\n    const npmrcFilename = upath.join(basedir, '.npmrc');\n    // Write out the file unless the npmrc came from the workspace\n    // npmrcFilename will be set whenever the file was read from disk during extract\n    const isNpmrcOwnFile =\n      npmrcFilename === packageFile.managerData.npmrcFileName ||\n      !packageFile.managerData.npmrcFileName;\n    if (isString(npmrc) && isNpmrcOwnFile) {\n      try {\n        if (!originalNpmrcFiles.has(npmrcFilename)) {\n          const originalNpmrc = await readLocalFile(npmrcFilename, 'utf8');\n          if (isString(originalNpmrc)) {\n            originalNpmrcFiles.set(npmrcFilename, originalNpmrc);\n          }\n        }\n        await writeLocalFile(npmrcFilename, npmrc.replace(regEx(/\\n?$/), '\\n'));\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.warn({ npmrcFilename, err }, 'Error writing .npmrc');\n      }\n    }\n    const npmLock = packageFile.managerData.npmLock;\n    if (npmLock) {\n      const npmLockPath = npmLock;\n      logger.debug(`Writing ${npmLock}`);\n      let existingNpmLock: string;\n      try {\n        existingNpmLock = (await getFile(npmLock)) ?? '';\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.warn({ err }, 'Error reading npm lock file');\n        existingNpmLock = '';\n      }\n      const { detectedIndent, lockFileParsed: npmLockParsed } =\n        parseLockFile(existingNpmLock);\n      if (npmLockParsed) {\n        const packageNames =\n          'packages' in npmLockParsed\n            ? Object.keys(npmLockParsed.packages)\n            : [];\n        const widens: string[] = [];\n        let lockFileChanged = false;\n        for (const upgrade of config.upgrades) {\n          if (upgrade.lockFiles && !upgrade.lockFiles.includes(npmLock)) {\n            continue;\n          }\n          if (!upgrade.managerData) {\n            continue;\n          }\n          if (\n            upgrade.rangeStrategy === 'widen' &&\n            upgrade.managerData.npmLock === npmLock\n          ) {\n            // TODO #22198\n            widens.push(upgrade.depName!);\n          }\n          const { depName } = upgrade;\n          const oldVersion = upgrade.lockedVersion ?? upgrade.currentVersion;\n          if ('packages' in npmLockParsed) {\n            for (const packageName of packageNames) {\n              if (\n                packageName === `node_modules/${depName}` ||\n                packageName.startsWith(`node_modules/${depName}/`)\n              ) {\n                logger.trace({ packageName }, 'Massaging out package name');\n                lockFileChanged = true;\n                delete npmLockParsed.packages[packageName];\n                continue;\n              }\n              if (\n                !depName ||\n                !oldVersion ||\n                // Workspace entries (e.g. `packages/app`) and the root entry\n                // are link targets: `node_modules/<name>` points at them with\n                // `link: true`, so deleting one breaks npm with EMISSINGTARGET.\n                !packageName.startsWith('node_modules/')\n              ) {\n                continue;\n              }\n              // Lockstep monorepo siblings (e.g. vue -> @vue/server-renderer)\n              // pin the updated dep to its exact old version. Left in the lock\n              // they cannot resolve against the new version and npm fails with\n              // ERESOLVE, so massage them out too and let npm re-resolve them.\n              const entry = npmLockParsed.packages[packageName];\n              const pinned =\n                entry?.peerDependencies?.[depName] === oldVersion ||\n                entry?.dependencies?.[depName] === oldVersion ||\n                entry?.optionalDependencies?.[depName] === oldVersion;\n              if (pinned) {\n                logger.trace(\n                  { packageName, depName, oldVersion },\n                  'Massaging out lockstep sibling',\n                );\n                lockFileChanged = true;\n                delete npmLockParsed.packages[packageName];\n              }\n            }\n          }\n        }\n        // v8 ignore else -- TODO: add test #40625\n        if (widens.length) {\n          logger.debug(\n            `Removing ${String(widens)} from ${npmLock} to force an update`,\n          );\n          lockFileChanged = true;\n          try {\n            if ('dependencies' in npmLockParsed && npmLockParsed.dependencies) {\n              widens.forEach((depName) => {\n                // TODO #22198\n                delete npmLockParsed.dependencies![depName];\n              });\n            }\n          } catch /* v8 ignore next -- TODO: add test #40625 */ {\n            logger.warn(\n              { npmLock },\n              'Error massaging package-lock.json for widen',\n            );\n          }\n        }\n        // v8 ignore else -- TODO: add test #40625\n        if (lockFileChanged) {\n          logger.debug('Massaging npm lock file before writing to disk');\n          existingNpmLock = composeLockFile(npmLockParsed, detectedIndent);\n        }\n        await writeLocalFile(npmLockPath, existingNpmLock);\n      }\n    }\n  }\n}\n\nasync function restoreNpmrcFiles(\n  originalNpmrcFiles: Map<string, string>,\n): Promise<void> {\n  for (const [npmrcFilename, originalNpmrc] of originalNpmrcFiles) {\n    try {\n      await writeLocalFile(npmrcFilename, originalNpmrc);\n    } catch (err) {\n      logger.warn({ npmrcFilename, err }, 'Error restoring .npmrc');\n    }\n  }\n}\n\nexport async function writeUpdatedPackageFiles(\n  config: PostUpdateConfig,\n): Promise<void> {\n  logger.trace({ config }, 'writeUpdatedPackageFiles');\n  logger.debug('Writing any updated package files');\n  if (!config.updatedPackageFiles) {\n    logger.debug('No files found');\n    return;\n  }\n  // prefer artifact content when it updates the same file (e.g. pnpm-workspace.yaml)\n  const artifactContents = new Map<string, string>();\n  if (config.updatedArtifacts) {\n    for (const artifact of config.updatedArtifacts) {\n      if (artifact.type === 'addition' && artifact.contents) {\n        artifactContents.set(artifact.path, artifact.contents.toString());\n      }\n    }\n  }\n  const supportedLockFiles = ['package-lock.json', 'yarn.lock'];\n  for (const packageFile of config.updatedPackageFiles) {\n    if (packageFile.type !== 'addition') {\n      continue;\n    }\n    if (\n      supportedLockFiles.some((fileName) => packageFile.path.endsWith(fileName))\n    ) {\n      logger.debug(`Writing lock file: ${packageFile.path}`);\n      // TODO #22198\n\n      await writeLocalFile(packageFile.path, packageFile.contents!);\n      continue;\n    }\n    if (!(\n      packageFile.path.endsWith('package.json') ||\n      packageFile.path.endsWith('pnpm-workspace.yaml') ||\n      packageFile.path.endsWith('.yarnrc.yml')\n    )) {\n      continue;\n    }\n    const contents =\n      artifactContents.get(packageFile.path) ?? packageFile.contents!;\n    logger.debug(`Writing ${packageFile.path}`);\n    await writeLocalFile(packageFile.path, contents);\n  }\n}\n\n/* v8 ignore next -- needs test */\nasync function updateYarnOffline(\n  lockFileDir: string,\n  updatedArtifacts: FileChange[],\n): Promise<void> {\n  try {\n    const resolvedPaths: string[] = [];\n    const yarnrcYml = await getFile(upath.join(lockFileDir, '.yarnrc.yml'));\n    const yarnrc = await getFile(upath.join(lockFileDir, '.yarnrc'));\n\n    // As .yarnrc.yml overrides .yarnrc in Yarn 1 (https://git.io/JUcco)\n    // both files may exist, so check for .yarnrc.yml first\n    if (yarnrcYml) {\n      // Yarn 2 (offline cache and zero-installs)\n      const paths = getZeroInstallPaths(yarnrcYml);\n      resolvedPaths.push(...paths.map((p) => upath.join(lockFileDir, p)));\n    } else if (yarnrc) {\n      // Yarn 1 (offline mirror)\n      const mirrorLine = yarnrc\n        .split(newlineRegex)\n        .find((line) => line.startsWith('yarn-offline-mirror '));\n      if (mirrorLine) {\n        const mirrorPath = ensureTrailingSlash(\n          mirrorLine.split(' ')[1].replace(regEx(/\"/g), ''),\n        );\n        resolvedPaths.push(upath.join(lockFileDir, mirrorPath));\n      }\n    }\n    logger.debug({ resolvedPaths }, 'updateYarnOffline resolvedPaths');\n\n    if (resolvedPaths.length) {\n      const status = await getRepoStatus();\n      for (const f of status.modified.concat(status.not_added)) {\n        if (resolvedPaths.some((p) => f.startsWith(p))) {\n          updatedArtifacts.push({\n            type: 'addition',\n            path: f,\n            contents: await readLocalFile(f),\n          });\n        }\n      }\n      for (const f of status.deleted || []) {\n        if (resolvedPaths.some((p) => f.startsWith(p))) {\n          updatedArtifacts.push({ type: 'deletion', path: f });\n        }\n      }\n    }\n  } catch (err) {\n    logger.error({ err }, 'Error updating yarn offline packages');\n  }\n}\n\n// TODO: move to ./yarn.ts\n// exported for testing\nexport async function updateYarnBinary(\n  lockFileDir: string,\n  updatedArtifacts: FileChange[],\n  existingYarnrcYmlContent: string | undefined | null,\n): Promise<string | undefined | null> {\n  let yarnrcYml = existingYarnrcYmlContent;\n  try {\n    const yarnrcYmlFilename = upath.join(lockFileDir, '.yarnrc.yml');\n    yarnrcYml ??= (await getFile(yarnrcYmlFilename)) ?? undefined;\n    const newYarnrcYml = await readLocalFile(yarnrcYmlFilename, 'utf8');\n    if (!isString(yarnrcYml) || !isString(newYarnrcYml)) {\n      return existingYarnrcYmlContent;\n    }\n\n    // TODO: use schema (#9610)\n    const oldYarnPath = parseSingleYaml<YarnRcYmlFile>(yarnrcYml)?.yarnPath;\n    const newYarnPath = parseSingleYaml<YarnRcYmlFile>(newYarnrcYml)?.yarnPath;\n    if (\n      !isNonEmptyStringAndNotWhitespace(oldYarnPath) ||\n      !isNonEmptyStringAndNotWhitespace(newYarnPath)\n    ) {\n      return existingYarnrcYmlContent;\n    }\n\n    const oldYarnFullPath = upath.join(lockFileDir, oldYarnPath);\n    const newYarnFullPath = upath.join(lockFileDir, newYarnPath);\n    logger.debug({ oldYarnPath, newYarnPath }, 'Found updated Yarn binary');\n\n    yarnrcYml = yarnrcYml.replace(oldYarnPath, newYarnPath);\n    updatedArtifacts.push(\n      {\n        type: 'addition',\n        path: yarnrcYmlFilename,\n        contents: yarnrcYml,\n      },\n      {\n        type: 'deletion',\n        path: oldYarnFullPath,\n      },\n      {\n        type: 'addition',\n        path: newYarnFullPath,\n        contents: await readLocalFile(newYarnFullPath, 'utf8'),\n        isExecutable: true,\n      },\n    );\n  } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n    logger.error({ err }, 'Error updating Yarn binary');\n  }\n  return existingYarnrcYmlContent && yarnrcYml;\n}\n\nasync function getAdditionalFilesInner(\n  config: PostUpdateConfig<NpmManagerData>,\n  packageFiles: AdditionalPackageFiles,\n  originalNpmrcFiles: Map<string, string>,\n): Promise<WriteExistingFilesResult> {\n  logger.trace({ config }, 'getAdditionalFiles');\n  const artifactErrors: ArtifactError[] = [];\n  const artifactNotices: ArtifactNotice[] = [];\n  const updatedArtifacts: FileChange[] = [];\n  if (!packageFiles.npm?.length) {\n    return { artifactErrors, artifactNotices, updatedArtifacts };\n  }\n  if (config.skipArtifactsUpdate) {\n    logger.debug('Skipping lock file generation');\n    return { artifactErrors, artifactNotices, updatedArtifacts };\n  }\n  logger.debug('Getting updated lock files');\n  if (\n    config.isLockFileMaintenance &&\n    config.reuseExistingBranch &&\n    (await scm.branchExists(config.branchName))\n  ) {\n    logger.debug('Skipping lockFileMaintenance update');\n    return { artifactErrors, artifactNotices, updatedArtifacts };\n  }\n  const dirs = determineLockFileDirs(config, packageFiles);\n  logger.trace({ dirs }, 'lock file dirs');\n  await writeExistingFiles(config, packageFiles, originalNpmrcFiles);\n  await writeUpdatedPackageFiles(config);\n\n  const { additionalNpmrcContent, additionalYarnRcYml } = processHostRules();\n\n  // This isn't passed directly to the child process, so no need to filter.\n  // But pass custom env and user vars.\n  const env = {\n    ...getEnv(),\n    NPM_CONFIG_CACHE: await ensureCacheDir(NPM_CACHE_DIR),\n    YARN_CACHE_FOLDER: await ensureCacheDir(YARN_CACHE_DIR),\n    YARN_GLOBAL_FOLDER: await ensureCacheDir(YARN_GLOBAL_DIR),\n    npm_config_store: await ensureCacheDir(PNPM_CACHE_BASE_DIR),\n    NODE_ENV: 'dev',\n  };\n\n  let token: string | undefined;\n  try {\n    ({ token } = hostRules.find({\n      hostType: 'github',\n      url: 'https://api.github.com/',\n    }));\n    // v8 ignore next -- TODO: add test #40625\n    token = token ? `${token}@` : token;\n  } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n    logger.warn({ err }, 'Error getting token for packageFile');\n  }\n  const tokenRe = regEx(`${token ?? ''}`, 'g', false);\n  for (const npmLock of dirs.npmLockDirs) {\n    const lockFileDir = upath.dirname(npmLock);\n    await withNpmrcHostRules(\n      lockFileDir,\n      additionalNpmrcContent,\n      async (npmrcContent) => {\n        const fileName = upath.basename(npmLock);\n        logger.debug(`Generating ${fileName} for ${lockFileDir}`);\n        const upgrades = config.upgrades.filter(\n          (upgrade) => upgrade.managerData?.npmLock === npmLock,\n        );\n        const res = await npm.generateLockFile(\n          lockFileDir,\n          env,\n          fileName,\n          config,\n          upgrades,\n          npmrcContent,\n        );\n        if (res.error) {\n          /* v8 ignore next -- needs test */\n          if (res.stderr?.includes('No matching version found for')) {\n            for (const upgrade of config.upgrades) {\n              if (\n                res.stderr.includes(\n                  `No matching version found for ${upgrade.depName}`,\n                )\n              ) {\n                logger.debug(\n                  { dependency: upgrade.depName, type: 'npm' },\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                );\n                const err = new Error(\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                );\n                throw new ExternalHostError(err, NpmDatasource.id);\n              }\n            }\n          }\n\n          artifactErrors.push({\n            fileName: npmLock,\n            stderr: res.stderr,\n          });\n        } else if (res.lockFile) {\n          if (res.beforeFallback) {\n            const message =\n              'npm `--before` could not be enforced because existing locked packages were published after the `minimumReleaseAge` cutoff. This will resolve after the next lock file maintenance run.';\n            logger.warn({ npmLock }, message);\n            artifactNotices.push({ file: npmLock, message });\n          }\n          const existingContent = await getFile(\n            npmLock,\n            config.reuseExistingBranch ? config.branchName : config.baseBranch,\n          );\n          if (res.lockFile === existingContent) {\n            logger.debug(`${npmLock} hasn't changed`);\n          } else {\n            logger.debug(`${npmLock} needs updating`);\n            updatedArtifacts.push({\n              type: 'addition',\n              path: npmLock,\n              // TODO: can this be undefined? (#22198)\n\n              contents: res.lockFile.replace(tokenRe, ''),\n            });\n          }\n        }\n      },\n    );\n  }\n\n  for (const yarnLock of dirs.yarnLockDirs) {\n    const lockFileDir = upath.dirname(yarnLock);\n    let yarnRcYmlFilename: string | undefined;\n    let existingYarnrcYmlContent: string | undefined | null;\n    await withNpmrcHostRules(lockFileDir, additionalNpmrcContent, async () => {\n      if (additionalYarnRcYml) {\n        yarnRcYmlFilename = getSiblingFileName(yarnLock, '.yarnrc.yml');\n        existingYarnrcYmlContent = await readLocalFile(\n          yarnRcYmlFilename,\n          'utf8',\n        );\n        // v8 ignore else -- TODO: add test #40625\n        if (existingYarnrcYmlContent) {\n          try {\n            // TODO: use schema (#9610)\n            const existingYarnrRcYml = parseSingleYaml<Record<string, unknown>>(\n              existingYarnrcYmlContent,\n            );\n\n            const updatedYarnYrcYml = deepmerge(\n              existingYarnrRcYml,\n              yarn.fuzzyMatchAdditionalYarnrcYml(\n                additionalYarnRcYml,\n                existingYarnrRcYml,\n              ),\n            );\n\n            await writeLocalFile(yarnRcYmlFilename, dump(updatedYarnYrcYml));\n            logger.debug('Added authentication to .yarnrc.yml');\n          } catch (err) {\n            logger.warn({ err }, 'Error appending .yarnrc.yml content');\n          }\n        }\n      }\n      logger.debug(`Generating yarn.lock for ${lockFileDir}`);\n      const lockFileName = upath.join(lockFileDir, 'yarn.lock');\n      const upgrades = config.upgrades.filter(\n        (upgrade) => upgrade.managerData?.yarnLock === yarnLock,\n      );\n      const res = await yarn.generateLockFile(\n        lockFileDir,\n        env,\n        config,\n        upgrades,\n      );\n      if (res.error) {\n        /* v8 ignore next -- needs test */\n        if (res.stderr?.includes(`Couldn't find any versions for`)) {\n          for (const upgrade of config.upgrades) {\n            if (\n              res.stderr.includes(\n                `Couldn't find any versions for \\\\\"${upgrade.depName}\\\\\"`,\n              )\n            ) {\n              logger.debug(\n                { dependency: upgrade.depName, type: 'yarn' },\n                'lock file failed for the dependency being updated - skipping branch creation',\n              );\n              throw new ExternalHostError(\n                new Error(\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                ),\n                NpmDatasource.id,\n              );\n            }\n          }\n        }\n\n        artifactErrors.push({\n          fileName: yarnLock,\n          stderr: artifactErrorMessageFromExecError(res, ''),\n        });\n      } else {\n        const existingContent = await getFile(\n          lockFileName,\n          config.reuseExistingBranch ? config.branchName : config.baseBranch,\n        );\n        if (res.lockFile === existingContent) {\n          logger.debug(\"yarn.lock hasn't changed\");\n        } else {\n          logger.debug('yarn.lock needs updating');\n          updatedArtifacts.push({\n            type: 'addition',\n            path: lockFileName,\n            // TODO #22198\n            contents: res.lockFile!,\n          });\n          await updateYarnOffline(lockFileDir, updatedArtifacts);\n        }\n\n        /* v8 ignore next -- needs test */\n        if (upgrades.some(yarn.isYarnUpdate)) {\n          existingYarnrcYmlContent = await updateYarnBinary(\n            lockFileDir,\n            updatedArtifacts,\n            existingYarnrcYmlContent,\n          );\n        }\n      }\n    });\n    /* v8 ignore next -- needs test */\n    if (existingYarnrcYmlContent) {\n      // TODO #22198\n      await writeLocalFile(yarnRcYmlFilename!, existingYarnrcYmlContent);\n    }\n  }\n\n  for (const pnpmLockFile of dirs.pnpmLockFileDirs) {\n    const lockFileDir = upath.dirname(pnpmLockFile);\n    await withNpmrcHostRules(lockFileDir, additionalNpmrcContent, async () => {\n      logger.debug(`Generating pnpm-lock.yaml for ${lockFileDir}`);\n      const upgrades = config.upgrades.filter(\n        (upgrade) => upgrade.managerData?.pnpmLockFile === pnpmLockFile,\n      );\n      const res = await pnpm.generateLockFile(\n        lockFileDir,\n        env,\n        config,\n        upgrades,\n      );\n      if (res.error) {\n        /* v8 ignore next -- needs test */\n        if (res.stdout?.includes(`No compatible version found:`)) {\n          for (const upgrade of config.upgrades) {\n            if (\n              res.stdout.includes(\n                `No compatible version found: ${upgrade.depName}`,\n              )\n            ) {\n              logger.debug(\n                { dependency: upgrade.depName, type: 'pnpm' },\n                'lock file failed for the dependency being updated - skipping branch creation',\n              );\n              throw new ExternalHostError(\n                Error(\n                  'lock file failed for the dependency being updated - skipping branch creation',\n                ),\n                NpmDatasource.id,\n              );\n            }\n          }\n        }\n\n        artifactErrors.push({\n          fileName: pnpmLockFile,\n          stderr: artifactErrorMessageFromExecError(res, ''),\n        });\n      } else {\n        const existingContent = await getFile(\n          pnpmLockFile,\n          config.reuseExistingBranch ? config.branchName : config.baseBranch,\n        );\n        if (res.lockFile === existingContent) {\n          logger.debug(\"pnpm-lock.yaml hasn't changed\");\n        } else {\n          logger.debug('pnpm-lock.yaml needs updating');\n          updatedArtifacts.push({\n            type: 'addition',\n            path: pnpmLockFile,\n            // TODO: can be undefined? (#22198)\n            contents: res.lockFile!,\n          });\n        }\n      }\n    });\n  }\n\n  return { artifactErrors, artifactNotices, updatedArtifacts };\n}\n\nexport async function getAdditionalFiles(\n  config: PostUpdateConfig,\n  packageFiles: AdditionalPackageFiles,\n): Promise<WriteExistingFilesResult> {\n  const originalNpmrcFiles = new Map<string, string>();\n  try {\n    return await getAdditionalFilesInner(\n      // The branch config carries the manager data of every upgrade untyped; the npm post-update only reads the optional npm fields of it.\n      config as PostUpdateConfig<NpmManagerData>,\n      packageFiles,\n      originalNpmrcFiles,\n    );\n  } finally {\n    await restoreNpmrcFiles(originalNpmrcFiles);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsDA,SAAS,QAAQ,KAA8C;CAC7D,OAAO,MAAM,KAAK,IAAI,IAAI,IAAI,OAAO,QAAQ,CAAC,CAAC;AACjD;AAEA,SAAgB,sBACd,QACA,cAC6B;CAC7B,MAAM,cAAsC,CAAC;CAC7C,MAAM,eAAuC,CAAC;CAC9C,MAAM,mBAA2C,CAAC;CAElD,KAAK,MAAM,WAAW,OAAO;;CAE3B,IACE,QAAQ,eAAe,yBACvB,QAAQ,kBAAkB,QAC1B,QAAQ,qBAAqB,MAC7B;EACA,aAAa,KAAK,QAAQ,aAAa,QAAQ;EAC/C,YAAY,KAAK,QAAQ,aAAa,OAAO;EAC7C,iBAAiB,KAAK,QAAQ,aAAa,YAAY;CACzD;CAGF,IACE,OAAO,SAAS,OACb,YACC,QAAQ,eAAe,yBACvB,QAAQ,gBACZ,GAEA,OAAO;EACL,cAAc,QAAQ,YAAY;EAClC,aAAa,QAAQ,WAAW;EAChC,kBAAkB,QAAQ,gBAAgB;CAC5C;CAGF,SAAS,eACP,UAC2C;EAC3C,OAAO,MAAM,4BAA4B,UAAU;EAEnD,KAAK,MAAM,eAAe,aAAa,KAAM;GAC3C,IAAI,YAAY,gBAAgB,UAAU;IACxC,OAAO,MAAM,EAAE,YAAY,GAAG,mBAAmB;IACjD,OAAO;GACT;GACA,OAAO,MAAM,UAAU;EACzB;EACA,OAAO,CAAC;CACV;CAGA,KAAK,MAAM,KAAK,OAAO,qBAAsB;EAC3C,OAAO,MAAM,YAAY,OAAO,EAAE,IAAI,EAAE,gBAAgB;EACxD,MAAM,cAAc,eAAe,EAAE,IAAI;;EAEzC,IAAI,CAAC,YAAY,aACf;EAGF,aAAa,KAAK,YAAY,YAAY,QAAQ;EAClD,YAAY,KAAK,YAAY,YAAY,OAAO;EAChD,iBAAiB,KAAK,YAAY,YAAY,YAAY;CAC5D;CAEA,OAAO;EACL,cAAc,QAAQ,YAAY;EAClC,aAAa,QAAQ,WAAW;EAChC,kBAAkB,QAAQ,gBAAgB;CAC5C;AACF;AAEA,eAAsB,mBACpB,QACA,cACA,qCAAqB,IAAI,IAAoB,GAC9B;CACf,IAAI,CAAC,aAAa,KAChB;CAEF,MAAM,WAAW,aAAa;CAC9B,OAAO,MACL,EAAE,cAAc,SAAS,KAAK,MAAM,EAAE,WAAW,EAAE,GACnD,4BACF;CACA,KAAK,MAAM,eAAe,UAAU;;EAElC,IAAI,CAAC,YAAY,aACf;EAGF,MAAM,UAAU,MAAM,QAAQ,YAAY,WAAY;EACtD,MAAM,QAAQ,YAAY;EAC1B,MAAM,gBAAgB,MAAM,KAAK,SAAS,QAAQ;EAGlD,MAAM,iBACJ,kBAAkB,YAAY,YAAY,iBAC1C,CAAC,YAAY,YAAY;EAC3B,IAAI,SAAS,KAAK,KAAK,gBACrB,IAAI;GACF,IAAI,CAAC,mBAAmB,IAAI,aAAa,GAAG;IAC1C,MAAM,gBAAgB,MAAM,cAAc,eAAe,MAAM;IAC/D,IAAI,SAAS,aAAa,GACxB,mBAAmB,IAAI,eAAe,aAAa;GAEvD;GACA,MAAM,eAAe,eAAe,MAAM,QAAQ,MAAM,MAAM,GAAG,IAAI,CAAC;EACxE,SAAS,mDAAmD;GAC1D,OAAO,KAAK;IAAE;IAAe;GAAI,GAAG,sBAAsB;EAC5D;EAEF,MAAM,UAAU,YAAY,YAAY;EACxC,IAAI,SAAS;GACX,MAAM,cAAc;GACpB,OAAO,MAAM,WAAW,SAAS;GACjC,IAAI;GACJ,IAAI;IACF,kBAAmB,MAAM,QAAQ,OAAO,KAAM;GAChD,SAAS,mDAAmD;IAC1D,OAAO,KAAK,EAAE,IAAI,GAAG,6BAA6B;IAClD,kBAAkB;GACpB;GACA,MAAM,EAAE,gBAAgB,gBAAgB,kBACtC,cAAc,eAAe;GAC/B,IAAI,eAAe;IACjB,MAAM,eACJ,cAAc,gBACV,OAAO,KAAK,cAAc,QAAQ,IAClC,CAAC;IACP,MAAM,SAAmB,CAAC;IAC1B,IAAI,kBAAkB;IACtB,KAAK,MAAM,WAAW,OAAO,UAAU;KACrC,IAAI,QAAQ,aAAa,CAAC,QAAQ,UAAU,SAAS,OAAO,GAC1D;KAEF,IAAI,CAAC,QAAQ,aACX;KAEF,IACE,QAAQ,kBAAkB,WAC1B,QAAQ,YAAY,YAAY,SAGhC,OAAO,KAAK,QAAQ,OAAQ;KAE9B,MAAM,EAAE,YAAY;KACpB,MAAM,aAAa,QAAQ,iBAAiB,QAAQ;KACpD,IAAI,cAAc,eAChB,KAAK,MAAM,eAAe,cAAc;MACtC,IACE,gBAAgB,gBAAgB,aAChC,YAAY,WAAW,gBAAgB,QAAQ,EAAE,GACjD;OACA,OAAO,MAAM,EAAE,YAAY,GAAG,4BAA4B;OAC1D,kBAAkB;OAClB,OAAO,cAAc,SAAS;OAC9B;MACF;MACA,IACE,CAAC,WACD,CAAC,cAID,CAAC,YAAY,WAAW,eAAe,GAEvC;MAMF,MAAM,QAAQ,cAAc,SAAS;MAKrC,IAHE,OAAO,mBAAmB,aAAa,cACvC,OAAO,eAAe,aAAa,cACnC,OAAO,uBAAuB,aAAa,YACjC;OACV,OAAO,MACL;QAAE;QAAa;QAAS;OAAW,GACnC,gCACF;OACA,kBAAkB;OAClB,OAAO,cAAc,SAAS;MAChC;KACF;IAEJ;;IAEA,IAAI,OAAO,QAAQ;KACjB,OAAO,MACL,YAAY,OAAO,MAAM,EAAE,QAAQ,QAAQ,oBAC7C;KACA,kBAAkB;KAClB,IAAI;MACF,IAAI,kBAAkB,iBAAiB,cAAc,cACnD,OAAO,SAAS,YAAY;OAE1B,OAAO,cAAc,aAAc;MACrC,CAAC;KAEL,sDAAsD;MACpD,OAAO,KACL,EAAE,QAAQ,GACV,6CACF;KACF;IACF;;IAEA,IAAI,iBAAiB;KACnB,OAAO,MAAM,gDAAgD;KAC7D,kBAAkB,gBAAgB,eAAe,cAAc;IACjE;IACA,MAAM,eAAe,aAAa,eAAe;GACnD;EACF;CACF;AACF;AAEA,eAAe,kBACb,oBACe;CACf,KAAK,MAAM,CAAC,eAAe,kBAAkB,oBAC3C,IAAI;EACF,MAAM,eAAe,eAAe,aAAa;CACnD,SAAS,KAAK;EACZ,OAAO,KAAK;GAAE;GAAe;EAAI,GAAG,wBAAwB;CAC9D;AAEJ;AAEA,eAAsB,yBACpB,QACe;CACf,OAAO,MAAM,EAAE,OAAO,GAAG,0BAA0B;CACnD,OAAO,MAAM,mCAAmC;CAChD,IAAI,CAAC,OAAO,qBAAqB;EAC/B,OAAO,MAAM,gBAAgB;EAC7B;CACF;CAEA,MAAM,mCAAmB,IAAI,IAAoB;CACjD,IAAI,OAAO,kBACJ;OAAA,MAAM,YAAY,OAAO,kBAC5B,IAAI,SAAS,SAAS,cAAc,SAAS,UAC3C,iBAAiB,IAAI,SAAS,MAAM,SAAS,SAAS,SAAS,CAAC;CAAA;CAItE,MAAM,qBAAqB,CAAC,qBAAqB,WAAW;CAC5D,KAAK,MAAM,eAAe,OAAO,qBAAqB;EACpD,IAAI,YAAY,SAAS,YACvB;EAEF,IACE,mBAAmB,MAAM,aAAa,YAAY,KAAK,SAAS,QAAQ,CAAC,GACzE;GACA,OAAO,MAAM,sBAAsB,YAAY,MAAM;GAGrD,MAAM,eAAe,YAAY,MAAM,YAAY,QAAS;GAC5D;EACF;EACA,IAAI,EACF,YAAY,KAAK,SAAS,cAAc,KACxC,YAAY,KAAK,SAAS,qBAAqB,KAC/C,YAAY,KAAK,SAAS,aAAa,IAEvC;EAEF,MAAM,WACJ,iBAAiB,IAAI,YAAY,IAAI,KAAK,YAAY;EACxD,OAAO,MAAM,WAAW,YAAY,MAAM;EAC1C,MAAM,eAAe,YAAY,MAAM,QAAQ;CACjD;AACF;;AAGA,eAAe,kBACb,aACA,kBACe;CACf,IAAI;EACF,MAAM,gBAA0B,CAAC;EACjC,MAAM,YAAY,MAAM,QAAQ,MAAM,KAAK,aAAa,aAAa,CAAC;EACtE,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAK,aAAa,SAAS,CAAC;EAI/D,IAAI,WAAW;GAEb,MAAM,QAAQ,oBAAoB,SAAS;GAC3C,cAAc,KAAK,GAAG,MAAM,KAAK,MAAM,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC;EACpE,OAAO,IAAI,QAAQ;GAEjB,MAAM,aAAa,OAChB,MAAM,YAAY,CAAC,CACnB,MAAM,SAAS,KAAK,WAAW,sBAAsB,CAAC;GACzD,IAAI,YAAY;IACd,MAAM,aAAa,oBACjB,WAAW,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,MAAM,IAAI,GAAG,EAAE,CAClD;IACA,cAAc,KAAK,MAAM,KAAK,aAAa,UAAU,CAAC;GACxD;EACF;EACA,OAAO,MAAM,EAAE,cAAc,GAAG,iCAAiC;EAEjE,IAAI,cAAc,QAAQ;GACxB,MAAM,SAAS,MAAM,cAAc;GACnC,KAAK,MAAM,KAAK,OAAO,SAAS,OAAO,OAAO,SAAS,GACrD,IAAI,cAAc,MAAM,MAAM,EAAE,WAAW,CAAC,CAAC,GAC3C,iBAAiB,KAAK;IACpB,MAAM;IACN,MAAM;IACN,UAAU,MAAM,cAAc,CAAC;GACjC,CAAC;GAGL,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC,GACjC,IAAI,cAAc,MAAM,MAAM,EAAE,WAAW,CAAC,CAAC,GAC3C,iBAAiB,KAAK;IAAE,MAAM;IAAY,MAAM;GAAE,CAAC;EAGzD;CACF,SAAS,KAAK;EACZ,OAAO,MAAM,EAAE,IAAI,GAAG,sCAAsC;CAC9D;AACF;AAIA,eAAsB,iBACpB,aACA,kBACA,0BACoC;CACpC,IAAI,YAAY;CAChB,IAAI;EACF,MAAM,oBAAoB,MAAM,KAAK,aAAa,aAAa;EAC/D,cAAe,MAAM,QAAQ,iBAAiB,KAAM,KAAA;EACpD,MAAM,eAAe,MAAM,cAAc,mBAAmB,MAAM;EAClE,IAAI,CAAC,SAAS,SAAS,KAAK,CAAC,SAAS,YAAY,GAChD,OAAO;EAIT,MAAM,cAAc,gBAA+B,SAAS,CAAC,EAAE;EAC/D,MAAM,cAAc,gBAA+B,YAAY,CAAC,EAAE;EAClE,IACE,CAAC,iCAAiC,WAAW,KAC7C,CAAC,iCAAiC,WAAW,GAE7C,OAAO;EAGT,MAAM,kBAAkB,MAAM,KAAK,aAAa,WAAW;EAC3D,MAAM,kBAAkB,MAAM,KAAK,aAAa,WAAW;EAC3D,OAAO,MAAM;GAAE;GAAa;EAAY,GAAG,2BAA2B;EAEtE,YAAY,UAAU,QAAQ,aAAa,WAAW;EACtD,iBAAiB,KACf;GACE,MAAM;GACN,MAAM;GACN,UAAU;EACZ,GACA;GACE,MAAM;GACN,MAAM;EACR,GACA;GACE,MAAM;GACN,MAAM;GACN,UAAU,MAAM,cAAc,iBAAiB,MAAM;GACrD,cAAc;EAChB,CACF;CACF,SAAS,mDAAmD;EAC1D,OAAO,MAAM,EAAE,IAAI,GAAG,4BAA4B;CACpD;CACA,OAAO,4BAA4B;AACrC;AAEA,eAAe,wBACb,QACA,cACA,oBACmC;CACnC,OAAO,MAAM,EAAE,OAAO,GAAG,oBAAoB;CAC7C,MAAM,iBAAkC,CAAC;CACzC,MAAM,kBAAoC,CAAC;CAC3C,MAAM,mBAAiC,CAAC;CACxC,IAAI,CAAC,aAAa,KAAK,QACrB,OAAO;EAAE;EAAgB;EAAiB;CAAiB;CAE7D,IAAI,OAAO,qBAAqB;EAC9B,OAAO,MAAM,+BAA+B;EAC5C,OAAO;GAAE;GAAgB;GAAiB;EAAiB;CAC7D;CACA,OAAO,MAAM,4BAA4B;CACzC,IACE,OAAO,yBACP,OAAO,uBACN,MAAM,IAAI,aAAa,OAAO,UAAU,GACzC;EACA,OAAO,MAAM,qCAAqC;EAClD,OAAO;GAAE;GAAgB;GAAiB;EAAiB;CAC7D;CACA,MAAM,OAAO,sBAAsB,QAAQ,YAAY;CACvD,OAAO,MAAM,EAAE,KAAK,GAAG,gBAAgB;CACvC,MAAM,mBAAmB,QAAQ,cAAc,kBAAkB;CACjE,MAAM,yBAAyB,MAAM;CAErC,MAAM,EAAE,wBAAwB,wBAAwB,iBAAiB;CAIzE,MAAM,MAAM;EACV,GAAG,OAAO;EACV,kBAAkB,MAAM,eAAA,KAA4B;EACpD,mBAAmB,MAAM,eAAe,cAAc;EACtD,oBAAoB,MAAM,eAAe,eAAe;EACxD,kBAAkB,MAAM,eAAe,mBAAmB;EAC1D,UAAU;CACZ;CAEA,IAAI;CACJ,IAAI;EACF,CAAC,CAAE,SAAUA,KAAe;GAC1B,UAAU;GACV,KAAK;EACP,CAAC;;EAED,QAAQ,QAAQ,GAAG,MAAM,KAAK;CAChC,SAAS,mDAAmD;EAC1D,OAAO,KAAK,EAAE,IAAI,GAAG,qCAAqC;CAC5D;CACA,MAAM,UAAU,MAAM,GAAG,SAAS,MAAM,KAAK,KAAK;CAClD,KAAK,MAAM,WAAW,KAAK,aAAa;EACtC,MAAM,cAAc,MAAM,QAAQ,OAAO;EACzC,MAAM,mBACJ,aACA,wBACA,OAAO,iBAAiB;GACtB,MAAM,WAAW,MAAM,SAAS,OAAO;GACvC,OAAO,MAAM,cAAc,SAAS,OAAO,aAAa;GACxD,MAAM,WAAW,OAAO,SAAS,QAC9B,YAAY,QAAQ,aAAa,YAAY,OAChD;GACA,MAAM,MAAM,MAAMC,iBAChB,aACA,KACA,UACA,QACA,UACA,YACF;GACA,IAAI,IAAI,OAAO;;IAEb,IAAI,IAAI,QAAQ,SAAS,+BAA+B,GACjD;UAAA,MAAM,WAAW,OAAO,UAC3B,IACE,IAAI,OAAO,SACT,iCAAiC,QAAQ,SAC3C,GACA;MACA,OAAO,MACL;OAAE,YAAY,QAAQ;OAAS,MAAM;MAAM,GAC3C,8EACF;MAIA,MAAM,IAAI,kCAAkB,IAHZ,MACd,8EAE4B,GAAG,cAAc,EAAE;KACnD;;IAIJ,eAAe,KAAK;KAClB,UAAU;KACV,QAAQ,IAAI;IACd,CAAC;GACH,OAAO,IAAI,IAAI,UAAU;IACvB,IAAI,IAAI,gBAAgB;KACtB,MAAM,UACJ;KACF,OAAO,KAAK,EAAE,QAAQ,GAAG,OAAO;KAChC,gBAAgB,KAAK;MAAE,MAAM;MAAS;KAAQ,CAAC;IACjD;IACA,MAAM,kBAAkB,MAAM,QAC5B,SACA,OAAO,sBAAsB,OAAO,aAAa,OAAO,UAC1D;IACA,IAAI,IAAI,aAAa,iBACnB,OAAO,MAAM,GAAG,QAAQ,gBAAgB;SACnC;KACL,OAAO,MAAM,GAAG,QAAQ,gBAAgB;KACxC,iBAAiB,KAAK;MACpB,MAAM;MACN,MAAM;MAGN,UAAU,IAAI,SAAS,QAAQ,SAAS,EAAE;KAC5C,CAAC;IACH;GACF;EACF,CACF;CACF;CAEA,KAAK,MAAM,YAAY,KAAK,cAAc;EACxC,MAAM,cAAc,MAAM,QAAQ,QAAQ;EAC1C,IAAI;EACJ,IAAI;EACJ,MAAM,mBAAmB,aAAa,wBAAwB,YAAY;GACxE,IAAI,qBAAqB;IACvB,oBAAoB,mBAAmB,UAAU,aAAa;IAC9D,2BAA2B,MAAM,cAC/B,mBACA,MACF;;IAEA,IAAI,0BACF,IAAI;KAEF,MAAM,qBAAqB,gBACzB,wBACF;KAEA,MAAM,oBAAoBC,MACxB,oBACAC,8BACE,qBACA,kBACF,CACF;KAEA,MAAM,eAAe,mBAAmB,KAAK,iBAAiB,CAAC;KAC/D,OAAO,MAAM,qCAAqC;IACpD,SAAS,KAAK;KACZ,OAAO,KAAK,EAAE,IAAI,GAAG,qCAAqC;IAC5D;GAEJ;GACA,OAAO,MAAM,4BAA4B,aAAa;GACtD,MAAM,eAAe,MAAM,KAAK,aAAa,WAAW;GACxD,MAAM,WAAW,OAAO,SAAS,QAC9B,YAAY,QAAQ,aAAa,aAAa,QACjD;GACA,MAAM,MAAM,MAAMC,mBAChB,aACA,KACA,QACA,QACF;GACA,IAAI,IAAI,OAAO;;IAEb,IAAI,IAAI,QAAQ,SAAS,gCAAgC,GAClD;UAAA,MAAM,WAAW,OAAO,UAC3B,IACE,IAAI,OAAO,SACT,qCAAqC,QAAQ,QAAQ,IACvD,GACA;MACA,OAAO,MACL;OAAE,YAAY,QAAQ;OAAS,MAAM;MAAO,GAC5C,8EACF;MACA,MAAM,IAAI,kCACR,IAAI,MACF,8EACF,GACA,cAAc,EAChB;KACF;;IAIJ,eAAe,KAAK;KAClB,UAAU;KACV,QAAQ,kCAAkC,KAAK,EAAE;IACnD,CAAC;GACH,OAAO;IACL,MAAM,kBAAkB,MAAM,QAC5B,cACA,OAAO,sBAAsB,OAAO,aAAa,OAAO,UAC1D;IACA,IAAI,IAAI,aAAa,iBACnB,OAAO,MAAM,0BAA0B;SAClC;KACL,OAAO,MAAM,0BAA0B;KACvC,iBAAiB,KAAK;MACpB,MAAM;MACN,MAAM;MAEN,UAAU,IAAI;KAChB,CAAC;KACD,MAAM,kBAAkB,aAAa,gBAAgB;IACvD;;IAGA,IAAI,SAAS,KAAKC,YAAiB,GACjC,2BAA2B,MAAM,iBAC/B,aACA,kBACA,wBACF;GAEJ;EACF,CAAC;;EAED,IAAI,0BAEF,MAAM,eAAe,mBAAoB,wBAAwB;CAErE;CAEA,KAAK,MAAM,gBAAgB,KAAK,kBAAkB;EAChD,MAAM,cAAc,MAAM,QAAQ,YAAY;EAC9C,MAAM,mBAAmB,aAAa,wBAAwB,YAAY;GACxE,OAAO,MAAM,iCAAiC,aAAa;GAC3D,MAAM,WAAW,OAAO,SAAS,QAC9B,YAAY,QAAQ,aAAa,iBAAiB,YACrD;GACA,MAAM,MAAM,MAAMC,mBAChB,aACA,KACA,QACA,QACF;GACA,IAAI,IAAI,OAAO;;IAEb,IAAI,IAAI,QAAQ,SAAS,8BAA8B,GAChD;UAAA,MAAM,WAAW,OAAO,UAC3B,IACE,IAAI,OAAO,SACT,gCAAgC,QAAQ,SAC1C,GACA;MACA,OAAO,MACL;OAAE,YAAY,QAAQ;OAAS,MAAM;MAAO,GAC5C,8EACF;MACA,MAAM,IAAI,kBACR,MACE,8EACF,GACA,cAAc,EAChB;KACF;;IAIJ,eAAe,KAAK;KAClB,UAAU;KACV,QAAQ,kCAAkC,KAAK,EAAE;IACnD,CAAC;GACH,OAAO;IACL,MAAM,kBAAkB,MAAM,QAC5B,cACA,OAAO,sBAAsB,OAAO,aAAa,OAAO,UAC1D;IACA,IAAI,IAAI,aAAa,iBACnB,OAAO,MAAM,+BAA+B;SACvC;KACL,OAAO,MAAM,+BAA+B;KAC5C,iBAAiB,KAAK;MACpB,MAAM;MACN,MAAM;MAEN,UAAU,IAAI;KAChB,CAAC;IACH;GACF;EACF,CAAC;CACH;CAEA,OAAO;EAAE;EAAgB;EAAiB;CAAiB;AAC7D;AAEA,eAAsB,mBACpB,QACA,cACmC;CACnC,MAAM,qCAAqB,IAAI,IAAoB;CACnD,IAAI;EACF,OAAO,MAAM,wBAEX,QACA,cACA,kBACF;CACF,UAAU;EACR,MAAM,kBAAkB,kBAAkB;CAC5C;AACF"}

package/dist/modules/manager/npm/post-update/npm.js

@@ -9,7 +9,7 @@ import { deleteLocalFile, localPathExists, readLocalFile, renameLocalFile } from
 import { Result } from "../../../../util/result.js";
 import { exec, getToolSettingsOptions } from "../../../../util/exec/index.js";
 import { resolveToolConstraint } from "../../util.js";
-import { PackageLock } from "../schema.js";
+import { NpmrcCooldown, PackageLock } from "../schema.js";
 import { composeLockFile, parseLockFile } from "../utils.js";
 import { getNodeToolConstraint } from "./node-version.js";
 import { getNodeOptions, getPackageManagerVersion, lazyLoadPackageJson } from "./utils.js";
@@ -17,12 +17,11 @@ import { isNonEmptyString, isNumber, isString } from "@sindresorhus/is";
 import { DateTime } from "luxon";
 import { quote } from "shlex";
 import upath from "upath";
-import ini from "ini";
 import semver from "semver";
 // lib/modules/manager/npm/post-update/npm.ts
 function parseNpmrcCooldownDate(npmrcContent) {
 	if (!npmrcContent) return null;
-	const parsed = ini.parse(npmrcContent);
+	const parsed = NpmrcCooldown.parse(npmrcContent);
 	const before = parsed.before;
 	if (isNonEmptyString(before)) {
 		const dt = DateTime.fromISO(before, { zone: "utc" });

package/dist/modules/manager/npm/post-update/npm.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm.js","names":[],"sources":["../../../../../lib/modules/manager/npm/post-update/npm.ts"],"sourcesContent":["// TODO: types (#22198)\nimport { isNonEmptyString, isNumber, isString } from '@sindresorhus/is';\nimport ini from 'ini';\nimport { DateTime } from 'luxon';\nimport semver from 'semver';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../../config/global.ts';\nimport {\n  SYSTEM_INSUFFICIENT_DISK_SPACE,\n  TEMPORARY_ERROR,\n} from '../../../../constants/error-messages.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport { exec, getToolSettingsOptions } from '../../../../util/exec/index.ts';\nimport type {\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  localPathExists,\n  readLocalFile,\n  renameLocalFile,\n} from '../../../../util/fs/index.ts';\nimport { minimatch } from '../../../../util/minimatch.ts';\nimport { toMs } from '../../../../util/pretty-time.ts';\nimport { regEx } from '../../../../util/regex.ts';\nimport { Result } from '../../../../util/result.ts';\nimport { trimSlashes } from '../../../../util/url.ts';\nimport type { PostUpdateConfig, Upgrade } from '../../types.ts';\nimport { resolveToolConstraint } from '../../util.ts';\nimport { PackageLock } from '../schema.ts';\nimport type { NpmManagerData } from '../types.ts';\nimport { composeLockFile, parseLockFile } from '../utils.ts';\nimport { getNodeToolConstraint } from './node-version.ts';\nimport type { GenerateLockFileResult, NpmrcCooldownResult } from './types.ts';\nimport {\n  getNodeOptions,\n  getPackageManagerVersion,\n  lazyLoadPackageJson,\n} from './utils.ts';\n\nexport function parseNpmrcCooldownDate(\n  npmrcContent: string | null,\n): NpmrcCooldownResult | null {\n  if (!npmrcContent) {\n    return null;\n  }\n\n  const parsed = ini.parse(npmrcContent);\n\n  const before = parsed.before;\n  if (isNonEmptyString(before)) {\n    const dt = DateTime.fromISO(before, { zone: 'utc' });\n    if (dt.isValid) {\n      return { date: dt, source: 'before' };\n    }\n    logger.debug(`Invalid before date in .npmrc: ${before}, ignoring`);\n  }\n\n  const minReleaseAge = parsed['min-release-age'];\n  if (isNonEmptyString(minReleaseAge)) {\n    const days = parseInt(minReleaseAge, 10);\n    if (isNumber(days) && days >= 0) {\n      return {\n        date: DateTime.now().minus({ days }).toUTC(),\n        source: 'min-release-age',\n      };\n    }\n    logger.debug(\n      `Invalid min-release-age in .npmrc: ${minReleaseAge}, ignoring`,\n    );\n  }\n\n  return null;\n}\n\nasync function getNpmConstraintFromPackageLock(\n  lockFileDir: string,\n  filename: string,\n): Promise<string | null> {\n  const packageLockFileName = upath.join(lockFileDir, filename);\n  const packageLockContents = await readLocalFile(packageLockFileName, 'utf8');\n  const packageLockJson = Result.parse(\n    packageLockContents,\n    PackageLock,\n  ).unwrapOrNull();\n  if (!packageLockJson) {\n    logger.debug(`Could not parse ${packageLockFileName}`);\n    return null;\n  }\n  const { lockfileVersion } = packageLockJson;\n  if (lockfileVersion === 1) {\n    logger.debug(`Using npm constraint <7 for lockfileVersion=1`);\n    return `<7`;\n  }\n  if (lockfileVersion === 2) {\n    logger.debug(`Using npm constraint <9 for lockfileVersion=2`);\n    return `<9`;\n  }\n  return null;\n}\n\nexport async function generateLockFile(\n  lockFileDir: string,\n  env: NodeJS.ProcessEnv,\n  filename: string,\n  config: Partial<PostUpdateConfig<NpmManagerData>> = {},\n  upgrades: Upgrade<NpmManagerData>[] = [],\n  npmrcContent: string | null = null,\n): Promise<GenerateLockFileResult> {\n  // TODO: don't assume package-lock.json is in the same directory\n  const lockFileName = upath.join(lockFileDir, filename);\n\n  logger.debug(`Spawning npm install to create ${lockFileDir}/${filename}`);\n  const { skipInstalls, postUpdateOptions } = config;\n\n  let lockFile: string | null = null;\n  let beforeFallback = false;\n  try {\n    const lazyPkgJson = lazyLoadPackageJson(lockFileDir);\n    const npmToolConstraint: ToolConstraint = {\n      toolName: 'npm',\n      constraint:\n        (await resolveToolConstraint(\n          config,\n          'npm',\n          async () =>\n            getPackageManagerVersion('npm', await lazyPkgJson.getValue()) ??\n            (await getNpmConstraintFromPackageLock(lockFileDir, filename)),\n        )) ?? null,\n    };\n    const supportsPreferDedupeFlag =\n      !npmToolConstraint.constraint ||\n      semver.intersects('>=7.0.0', npmToolConstraint.constraint);\n    let commands: string[] = [];\n    let cmdOptions = '';\n    if (\n      (postUpdateOptions?.includes('npmDedupe') === true &&\n        !supportsPreferDedupeFlag) ||\n      skipInstalls === false\n    ) {\n      logger.debug('Performing node_modules install');\n      cmdOptions += '--no-audit';\n    } else {\n      logger.debug('Updating lock file only');\n      cmdOptions += '--package-lock-only --no-audit';\n    }\n\n    if (postUpdateOptions?.includes('npmDedupe') && supportsPreferDedupeFlag) {\n      logger.debug('Deduplicate dependencies on installation');\n      cmdOptions += ' --prefer-dedupe';\n    }\n\n    if (!GlobalConfig.get('allowScripts') || config.ignoreScripts) {\n      cmdOptions += ' --ignore-scripts';\n    }\n\n    let beforeFlag = '';\n    if (config.minimumReleaseAge) {\n      const ms = toMs(config.minimumReleaseAge);\n      if (ms === null) {\n        logger.debug(\n          {\n            minimumReleaseAge: config.minimumReleaseAge,\n          },\n          'Invalid minimumReleaseAge, skipping --before for npm install',\n        );\n      } else {\n        const npmrcCooldown = parseNpmrcCooldownDate(npmrcContent);\n\n        // npm rejects --before when min-release-age is set in .npmrc,\n        // so let the .npmrc handle cooldown natively in that case\n        if (npmrcCooldown?.source === 'min-release-age') {\n          logger.debug(\n            {\n              npmrcMinReleaseAge: npmrcCooldown.date.toISO(),\n              minimumReleaseAge: config.minimumReleaseAge,\n            },\n            'Skipping --before flag because .npmrc already contains min-release-age',\n          );\n        } else {\n          let beforeDate = DateTime.now().minus(ms).toUTC();\n\n          if (npmrcCooldown && npmrcCooldown.date < beforeDate) {\n            logger.debug(\n              {\n                npmrcDate: npmrcCooldown.date.toISO(),\n                beforeDate: beforeDate.toISO(),\n              },\n              'Using stricter .npmrc cooldown date over minimumReleaseAge date',\n            );\n            beforeDate = npmrcCooldown.date;\n          }\n\n          const beforeISO = beforeDate.toISO();\n          logger.debug(\n            {\n              beforeISO,\n              minimumReleaseAge: config.minimumReleaseAge,\n            },\n            'Setting npm --before based on minimumReleaseAge',\n          );\n          beforeFlag = ` --before=${beforeISO}`;\n        }\n      }\n    }\n\n    const extraEnv: ExtraEnv = {\n      NPM_CONFIG_CACHE: env.NPM_CONFIG_CACHE,\n      npm_config_store: env.npm_config_store,\n    };\n\n    const { nodeMaxMemory } = getToolSettingsOptions(config.toolSettings);\n    if (nodeMaxMemory) {\n      extraEnv.NODE_OPTIONS = getNodeOptions(nodeMaxMemory);\n    }\n\n    const execOptions: ExecOptions = {\n      cwdFile: lockFileName,\n      extraEnv,\n      toolConstraints: [\n        await getNodeToolConstraint(config, upgrades, lockFileDir, lazyPkgJson),\n        ...(isNonEmptyString(npmToolConstraint.constraint)\n          ? [npmToolConstraint]\n          : []),\n      ],\n      docker: {},\n    };\n    /* v8 ignore next -- needs test */\n    if (GlobalConfig.get('exposeAllEnv')) {\n      extraEnv.NPM_AUTH = env.NPM_AUTH;\n      extraEnv.NPM_EMAIL = env.NPM_EMAIL;\n    }\n\n    if (!upgrades.every((upgrade) => upgrade.isLockfileUpdate)) {\n      // This command updates the lock file based on package.json\n      commands.push(`npm install ${cmdOptions}${beforeFlag}`.trim());\n    }\n\n    // rangeStrategy = update-lockfile\n    const lockUpdates = upgrades.filter((upgrade) => upgrade.isLockfileUpdate);\n\n    // divide the deps in two categories: workspace and root\n    const { lockRootUpdates, lockWorkspacesUpdates, workspaces, rootDeps } =\n      divideWorkspaceAndRootDeps(lockFileDir, lockUpdates);\n\n    if (workspaces.size && lockWorkspacesUpdates.length) {\n      logger.debug('Performing lockfileUpdate (npm-workspaces)');\n      for (const workspace of workspaces) {\n        const currentWorkspaceUpdates = lockWorkspacesUpdates\n          .filter((update) => update.workspace === workspace)\n          .map((update) => update.managerData?.packageKey)\n          .filter(isString)\n          .filter((packageKey) => !rootDeps.has(packageKey));\n\n        // v8 ignore else -- TODO: add test #40625\n        if (currentWorkspaceUpdates.length) {\n          const updateCmd = `npm install ${cmdOptions}${beforeFlag} --workspace=${quote(workspace)} ${currentWorkspaceUpdates\n            .map(quote)\n            .join(' ')}`;\n          commands.push(updateCmd);\n        }\n      }\n    }\n\n    if (lockRootUpdates.length) {\n      logger.debug('Performing lockfileUpdate (npm)');\n      const updateCmd = `npm install ${cmdOptions}${beforeFlag} ${lockRootUpdates\n        .map((update) => update.managerData?.packageKey)\n        .filter(isString)\n        .map(quote)\n        .join(' ')}`;\n      commands.push(updateCmd);\n    }\n\n    if (upgrades.some((upgrade) => upgrade.isRemediation)) {\n      // We need to run twice to get the correct lock file\n      commands.push(`npm install ${cmdOptions}${beforeFlag}`.trim());\n    }\n\n    // Lock file maintenance recreates the lock file from scratch, and a single\n    // `npm install` can generate a lock file which is out of sync with\n    // package.json, so we need to run the install a second time (#37531).\n    // Skipped if `npmInstallTwice` is configured, as that doubles all install\n    // commands already.\n    if (\n      upgrades.some((upgrade) => upgrade.isLockFileMaintenance) &&\n      !postUpdateOptions?.includes('npmInstallTwice')\n    ) {\n      commands.push(`npm install ${cmdOptions}${beforeFlag}`.trim());\n    }\n\n    // postUpdateOptions\n    if (\n      config.postUpdateOptions?.includes('npmDedupe') &&\n      !supportsPreferDedupeFlag\n    ) {\n      logger.debug('Performing npm dedupe after installation');\n      commands.push('npm dedupe');\n    }\n\n    if (upgrades.find((upgrade) => upgrade.isLockFileMaintenance)) {\n      logger.debug(\n        `Removing ${lockFileName} first due to lock file maintenance upgrade`,\n      );\n      try {\n        await deleteLocalFile(lockFileName);\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.debug(\n          { err, lockFileName },\n          'Error removing `package-lock.json` for lock file maintenance',\n        );\n      }\n    }\n\n    if (postUpdateOptions?.includes('npmInstallTwice')) {\n      logger.debug('Running npm install twice');\n      // Run the install command twice to ensure the lock file is up to date\n      // iterate through commands and if any command starts with `npm install`, add it again\n      const existingCommands = [...commands];\n      commands = [];\n      for (const command of existingCommands) {\n        commands.push(command);\n        // v8 ignore else -- TODO: add test #40625\n        if (command.startsWith('npm install')) {\n          commands.push(command);\n        }\n      }\n    }\n\n    // Run the commands, retrying without --before on ETARGET if needed\n    await exec(commands, execOptions).catch(async (err) => {\n      if (beforeFlag && err.stderr?.includes('with a date before')) {\n        logger.debug('npm --before caused ETARGET, retrying without --before');\n        const commandsWithoutBefore = commands.map((cmd) =>\n          cmd.replace(beforeFlag, ''),\n        );\n        beforeFallback = true;\n        return exec(commandsWithoutBefore, execOptions);\n      }\n      throw err;\n    });\n\n    // massage to shrinkwrap if necessary\n    if (\n      filename === 'npm-shrinkwrap.json' &&\n      (await localPathExists(upath.join(lockFileDir, 'package-lock.json')))\n    ) {\n      await renameLocalFile(\n        upath.join(lockFileDir, 'package-lock.json'),\n        upath.join(lockFileDir, 'npm-shrinkwrap.json'),\n      );\n    }\n\n    // Read the result\n    // TODO #22198\n    lockFile = (await readLocalFile(\n      upath.join(lockFileDir, filename),\n      'utf8',\n    ))!;\n\n    // Massage lockfile counterparts of package.json that were modified\n    // because npm install was called with an explicit version for rangeStrategy=update-lockfile\n    if (lockUpdates.length) {\n      const { detectedIndent, lockFileParsed } = parseLockFile(lockFile);\n      if (\n        lockFileParsed?.lockfileVersion === 2 ||\n        lockFileParsed?.lockfileVersion === 3\n      ) {\n        lockUpdates.forEach((lockUpdate) => {\n          const depType = lockUpdate.depType as\n            'dependencies' | 'optionalDependencies';\n\n          // TODO #22198\n          // v8 ignore else -- TODO: add test #40625\n          if (\n            lockFileParsed.packages?.['']?.[depType]?.[lockUpdate.packageName!]\n          ) {\n            lockFileParsed.packages[''][depType][lockUpdate.packageName!] =\n              lockUpdate.newValue!;\n          }\n        });\n        lockFile = composeLockFile(lockFileParsed, detectedIndent);\n      }\n    }\n  } catch (err) {\n    // v8 ignore if -- TODO: add test #40625\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug(\n      {\n        err,\n        type: 'npm',\n      },\n      'lock file error',\n    );\n    // v8 ignore if -- TODO: add test #40625\n    if (err.stderr?.includes('ENOSPC: no space left on device')) {\n      throw new Error(SYSTEM_INSUFFICIENT_DISK_SPACE);\n    }\n    return { error: true, stderr: err.stderr };\n  }\n  return { error: !lockFile, lockFile, beforeFallback };\n}\n\nexport function divideWorkspaceAndRootDeps(\n  lockFileDir: string,\n  lockUpdates: Upgrade<NpmManagerData>[],\n): {\n  lockRootUpdates: Upgrade<NpmManagerData>[];\n  lockWorkspacesUpdates: Upgrade<NpmManagerData>[];\n  workspaces: Set<string>;\n  rootDeps: Set<string>;\n} {\n  const lockRootUpdates: Upgrade<NpmManagerData>[] = []; // stores all upgrades which are present in root package.json\n  const lockWorkspacesUpdates: Upgrade<NpmManagerData>[] = []; // stores all upgrades which are present in workspaces package.json\n  const workspaces = new Set<string>(); // name of all workspaces\n  const rootDeps = new Set<string>(); // packageName of all upgrades in root package.json (makes it check duplicate deps in root)\n\n  // divide the deps in two categories: workspace and root\n  for (const upgrade of lockUpdates) {\n    upgrade.managerData ??= {};\n    upgrade.managerData.packageKey = generatePackageKey(\n      upgrade.packageName!,\n      upgrade.newVersion!,\n    );\n    if (\n      upgrade.managerData.workspacesPackages?.length &&\n      isString(upgrade.packageFile)\n    ) {\n      const workspacePatterns = upgrade.managerData.workspacesPackages; // glob pattern or directory name/path\n      const packageFileDir = trimSlashes(\n        upgrade.packageFile.replace('package.json', ''),\n      );\n\n      // workspaceDir = packageFileDir - lockFileDir\n      const workspaceDir = trimSlashes(\n        packageFileDir.startsWith(lockFileDir)\n          ? packageFileDir.slice(lockFileDir.length)\n          : packageFileDir,\n      );\n\n      if (isNonEmptyString(workspaceDir)) {\n        let workspaceName: string | undefined;\n        // compare workspaceDir to workspace patterns\n        // stop when the first match is found and\n        // add workspaceDir to workspaces set and upgrade object\n        for (const workspacePattern of workspacePatterns) {\n          const massagedPattern = workspacePattern.replace(regEx(/^\\.\\//), '');\n          if (minimatch(massagedPattern).match(workspaceDir)) {\n            workspaceName = workspaceDir;\n            break;\n          }\n        }\n        if (workspaceName) {\n          // v8 ignore else -- TODO: add test #40625\n          if (\n            !rootDeps.has(upgrade.managerData.packageKey) // prevent same dep from existing in root and workspace\n          ) {\n            workspaces.add(workspaceName);\n            upgrade.workspace = workspaceName;\n            lockWorkspacesUpdates.push(upgrade);\n          }\n        } else {\n          logger.warn(\n            { workspacePatterns, workspaceDir },\n            'workspaceDir not found',\n          );\n        }\n        continue;\n      }\n    }\n    lockRootUpdates.push(upgrade);\n    rootDeps.add(upgrade.managerData.packageKey);\n  }\n\n  return { lockRootUpdates, lockWorkspacesUpdates, workspaces, rootDeps };\n}\n\nfunction generatePackageKey(packageName: string, version: string): string {\n  return `${packageName}@${version}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA2CA,SAAgB,uBACd,cAC4B;CAC5B,IAAI,CAAC,cACH,OAAO;CAGT,MAAM,SAAS,IAAI,MAAM,YAAY;CAErC,MAAM,SAAS,OAAO;CACtB,IAAI,iBAAiB,MAAM,GAAG;EAC5B,MAAM,KAAK,SAAS,QAAQ,QAAQ,EAAE,MAAM,MAAM,CAAC;EACnD,IAAI,GAAG,SACL,OAAO;GAAE,MAAM;GAAI,QAAQ;EAAS;EAEtC,OAAO,MAAM,kCAAkC,OAAO,WAAW;CACnE;CAEA,MAAM,gBAAgB,OAAO;CAC7B,IAAI,iBAAiB,aAAa,GAAG;EACnC,MAAM,OAAO,SAAS,eAAe,EAAE;EACvC,IAAI,SAAS,IAAI,KAAK,QAAQ,GAC5B,OAAO;GACL,MAAM,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM;GAC3C,QAAQ;EACV;EAEF,OAAO,MACL,sCAAsC,cAAc,WACtD;CACF;CAEA,OAAO;AACT;AAEA,eAAe,gCACb,aACA,UACwB;CACxB,MAAM,sBAAsB,MAAM,KAAK,aAAa,QAAQ;CAC5D,MAAM,sBAAsB,MAAM,cAAc,qBAAqB,MAAM;CAC3E,MAAM,kBAAkB,OAAO,MAC7B,qBACA,WACF,CAAC,CAAC,aAAa;CACf,IAAI,CAAC,iBAAiB;EACpB,OAAO,MAAM,mBAAmB,qBAAqB;EACrD,OAAO;CACT;CACA,MAAM,EAAE,oBAAoB;CAC5B,IAAI,oBAAoB,GAAG;EACzB,OAAO,MAAM,+CAA+C;EAC5D,OAAO;CACT;CACA,IAAI,oBAAoB,GAAG;EACzB,OAAO,MAAM,+CAA+C;EAC5D,OAAO;CACT;CACA,OAAO;AACT;AAEA,eAAsB,iBACpB,aACA,KACA,UACA,SAAoD,CAAC,GACrD,WAAsC,CAAC,GACvC,eAA8B,MACG;CAEjC,MAAM,eAAe,MAAM,KAAK,aAAa,QAAQ;CAErD,OAAO,MAAM,kCAAkC,YAAY,GAAG,UAAU;CACxE,MAAM,EAAE,cAAc,sBAAsB;CAE5C,IAAI,WAA0B;CAC9B,IAAI,iBAAiB;CACrB,IAAI;EACF,MAAM,cAAc,oBAAoB,WAAW;EACnD,MAAM,oBAAoC;GACxC,UAAU;GACV,YACG,MAAM,sBACL,QACA,OACA,YACE,yBAAyB,OAAO,MAAM,YAAY,SAAS,CAAC,KAC3D,MAAM,gCAAgC,aAAa,QAAQ,CAChE,KAAM;EACV;EACA,MAAM,2BACJ,CAAC,kBAAkB,cACnB,OAAO,WAAW,WAAW,kBAAkB,UAAU;EAC3D,IAAI,WAAqB,CAAC;EAC1B,IAAI,aAAa;EACjB,IACG,mBAAmB,SAAS,WAAW,MAAM,QAC5C,CAAC,4BACH,iBAAiB,OACjB;GACA,OAAO,MAAM,iCAAiC;GAC9C,cAAc;EAChB,OAAO;GACL,OAAO,MAAM,yBAAyB;GACtC,cAAc;EAChB;EAEA,IAAI,mBAAmB,SAAS,WAAW,KAAK,0BAA0B;GACxE,OAAO,MAAM,0CAA0C;GACvD,cAAc;EAChB;EAEA,IAAI,CAAC,aAAa,IAAI,cAAc,KAAK,OAAO,eAC9C,cAAc;EAGhB,IAAI,aAAa;EACjB,IAAI,OAAO,mBAAmB;GAC5B,MAAM,KAAK,KAAK,OAAO,iBAAiB;GACxC,IAAI,OAAO,MACT,OAAO,MACL,EACE,mBAAmB,OAAO,kBAC5B,GACA,8DACF;QACK;IACL,MAAM,gBAAgB,uBAAuB,YAAY;IAIzD,IAAI,eAAe,WAAW,mBAC5B,OAAO,MACL;KACE,oBAAoB,cAAc,KAAK,MAAM;KAC7C,mBAAmB,OAAO;IAC5B,GACA,wEACF;SACK;KACL,IAAI,aAAa,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;KAEhD,IAAI,iBAAiB,cAAc,OAAO,YAAY;MACpD,OAAO,MACL;OACE,WAAW,cAAc,KAAK,MAAM;OACpC,YAAY,WAAW,MAAM;MAC/B,GACA,iEACF;MACA,aAAa,cAAc;KAC7B;KAEA,MAAM,YAAY,WAAW,MAAM;KACnC,OAAO,MACL;MACE;MACA,mBAAmB,OAAO;KAC5B,GACA,iDACF;KACA,aAAa,aAAa;IAC5B;GACF;EACF;EAEA,MAAM,WAAqB;GACzB,kBAAkB,IAAI;GACtB,kBAAkB,IAAI;EACxB;EAEA,MAAM,EAAE,kBAAkB,uBAAuB,OAAO,YAAY;EACpE,IAAI,eACF,SAAS,eAAe,eAAe,aAAa;EAGtD,MAAM,cAA2B;GAC/B,SAAS;GACT;GACA,iBAAiB,CACf,MAAM,sBAAsB,QAAQ,UAAU,aAAa,WAAW,GACtE,GAAI,iBAAiB,kBAAkB,UAAU,IAC7C,CAAC,iBAAiB,IAClB,CAAC,CACP;GACA,QAAQ,CAAC;EACX;;EAEA,IAAI,aAAa,IAAI,cAAc,GAAG;GACpC,SAAS,WAAW,IAAI;GACxB,SAAS,YAAY,IAAI;EAC3B;EAEA,IAAI,CAAC,SAAS,OAAO,YAAY,QAAQ,gBAAgB,GAEvD,SAAS,KAAK,eAAe,aAAa,aAAa,KAAK,CAAC;EAI/D,MAAM,cAAc,SAAS,QAAQ,YAAY,QAAQ,gBAAgB;EAGzE,MAAM,EAAE,iBAAiB,uBAAuB,YAAY,aAC1D,2BAA2B,aAAa,WAAW;EAErD,IAAI,WAAW,QAAQ,sBAAsB,QAAQ;GACnD,OAAO,MAAM,4CAA4C;GACzD,KAAK,MAAM,aAAa,YAAY;IAClC,MAAM,0BAA0B,sBAC7B,QAAQ,WAAW,OAAO,cAAc,SAAS,CAAC,CAClD,KAAK,WAAW,OAAO,aAAa,UAAU,CAAC,CAC/C,OAAO,QAAQ,CAAC,CAChB,QAAQ,eAAe,CAAC,SAAS,IAAI,UAAU,CAAC;;IAGnD,IAAI,wBAAwB,QAAQ;KAClC,MAAM,YAAY,eAAe,aAAa,WAAW,eAAe,MAAM,SAAS,EAAE,GAAG,wBACzF,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;KACX,SAAS,KAAK,SAAS;IACzB;GACF;EACF;EAEA,IAAI,gBAAgB,QAAQ;GAC1B,OAAO,MAAM,iCAAiC;GAC9C,MAAM,YAAY,eAAe,aAAa,WAAW,GAAG,gBACzD,KAAK,WAAW,OAAO,aAAa,UAAU,CAAC,CAC/C,OAAO,QAAQ,CAAC,CAChB,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GACX,SAAS,KAAK,SAAS;EACzB;EAEA,IAAI,SAAS,MAAM,YAAY,QAAQ,aAAa,GAElD,SAAS,KAAK,eAAe,aAAa,aAAa,KAAK,CAAC;EAQ/D,IACE,SAAS,MAAM,YAAY,QAAQ,qBAAqB,KACxD,CAAC,mBAAmB,SAAS,iBAAiB,GAE9C,SAAS,KAAK,eAAe,aAAa,aAAa,KAAK,CAAC;EAI/D,IACE,OAAO,mBAAmB,SAAS,WAAW,KAC9C,CAAC,0BACD;GACA,OAAO,MAAM,0CAA0C;GACvD,SAAS,KAAK,YAAY;EAC5B;EAEA,IAAI,SAAS,MAAM,YAAY,QAAQ,qBAAqB,GAAG;GAC7D,OAAO,MACL,YAAY,aAAa,4CAC3B;GACA,IAAI;IACF,MAAM,gBAAgB,YAAY;GACpC,SAAS,mDAAmD;IAC1D,OAAO,MACL;KAAE;KAAK;IAAa,GACpB,8DACF;GACF;EACF;EAEA,IAAI,mBAAmB,SAAS,iBAAiB,GAAG;GAClD,OAAO,MAAM,2BAA2B;GAGxC,MAAM,mBAAmB,CAAC,GAAG,QAAQ;GACrC,WAAW,CAAC;GACZ,KAAK,MAAM,WAAW,kBAAkB;IACtC,SAAS,KAAK,OAAO;;IAErB,IAAI,QAAQ,WAAW,aAAa,GAClC,SAAS,KAAK,OAAO;GAEzB;EACF;EAGA,MAAM,KAAK,UAAU,WAAW,CAAC,CAAC,MAAM,OAAO,QAAQ;GACrD,IAAI,cAAc,IAAI,QAAQ,SAAS,oBAAoB,GAAG;IAC5D,OAAO,MAAM,wDAAwD;IACrE,MAAM,wBAAwB,SAAS,KAAK,QAC1C,IAAI,QAAQ,YAAY,EAAE,CAC5B;IACA,iBAAiB;IACjB,OAAO,KAAK,uBAAuB,WAAW;GAChD;GACA,MAAM;EACR,CAAC;EAGD,IACE,aAAa,yBACZ,MAAM,gBAAgB,MAAM,KAAK,aAAa,mBAAmB,CAAC,GAEnE,MAAM,gBACJ,MAAM,KAAK,aAAa,mBAAmB,GAC3C,MAAM,KAAK,aAAa,qBAAqB,CAC/C;EAKF,WAAY,MAAM,cAChB,MAAM,KAAK,aAAa,QAAQ,GAChC,MACF;EAIA,IAAI,YAAY,QAAQ;GACtB,MAAM,EAAE,gBAAgB,mBAAmB,cAAc,QAAQ;GACjE,IACE,gBAAgB,oBAAoB,KACpC,gBAAgB,oBAAoB,GACpC;IACA,YAAY,SAAS,eAAe;KAClC,MAAM,UAAU,WAAW;;KAK3B,IACE,eAAe,WAAW,GAAG,GAAG,QAAQ,GAAG,WAAW,cAEtD,eAAe,SAAS,GAAG,CAAC,QAAQ,CAAC,WAAW,eAC9C,WAAW;IAEjB,CAAC;IACD,WAAW,gBAAgB,gBAAgB,cAAc;GAC3D;EACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MACL;GACE;GACA,MAAM;EACR,GACA,iBACF;;EAEA,IAAI,IAAI,QAAQ,SAAS,iCAAiC,GACxD,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO;GAAE,OAAO;GAAM,QAAQ,IAAI;EAAO;CAC3C;CACA,OAAO;EAAE,OAAO,CAAC;EAAU;EAAU;CAAe;AACtD;AAEA,SAAgB,2BACd,aACA,aAMA;CACA,MAAM,kBAA6C,CAAC;CACpD,MAAM,wBAAmD,CAAC;CAC1D,MAAM,6BAAa,IAAI,IAAY;CACnC,MAAM,2BAAW,IAAI,IAAY;CAGjC,KAAK,MAAM,WAAW,aAAa;EACjC,QAAQ,gBAAgB,CAAC;EACzB,QAAQ,YAAY,aAAa,mBAC/B,QAAQ,aACR,QAAQ,UACV;EACA,IACE,QAAQ,YAAY,oBAAoB,UACxC,SAAS,QAAQ,WAAW,GAC5B;GACA,MAAM,oBAAoB,QAAQ,YAAY;GAC9C,MAAM,iBAAiB,YACrB,QAAQ,YAAY,QAAQ,gBAAgB,EAAE,CAChD;GAGA,MAAM,eAAe,YACnB,eAAe,WAAW,WAAW,IACjC,eAAe,MAAM,YAAY,MAAM,IACvC,cACN;GAEA,IAAI,iBAAiB,YAAY,GAAG;IAClC,IAAI;IAIJ,KAAK,MAAM,oBAAoB,mBAAmB;KAChD,MAAM,kBAAkB,iBAAiB,QAAQ,MAAM,OAAO,GAAG,EAAE;KACnE,IAAI,UAAU,eAAe,CAAC,CAAC,MAAM,YAAY,GAAG;MAClD,gBAAgB;MAChB;KACF;IACF;IACA,IAAI,eAGA;;SAAA,CAAC,SAAS,IAAI,QAAQ,YAAY,UAAU,GAC5C;MACA,WAAW,IAAI,aAAa;MAC5B,QAAQ,YAAY;MACpB,sBAAsB,KAAK,OAAO;KACpC;WAEA,OAAO,KACL;KAAE;KAAmB;IAAa,GAClC,wBACF;IAEF;GACF;EACF;EACA,gBAAgB,KAAK,OAAO;EAC5B,SAAS,IAAI,QAAQ,YAAY,UAAU;CAC7C;CAEA,OAAO;EAAE;EAAiB;EAAuB;EAAY;CAAS;AACxE;AAEA,SAAS,mBAAmB,aAAqB,SAAyB;CACxE,OAAO,GAAG,YAAY,GAAG;AAC3B"}
+{"version":3,"file":"npm.js","names":[],"sources":["../../../../../lib/modules/manager/npm/post-update/npm.ts"],"sourcesContent":["// TODO: types (#22198)\nimport { isNonEmptyString, isNumber, isString } from '@sindresorhus/is';\nimport { DateTime } from 'luxon';\nimport semver from 'semver';\nimport { quote } from 'shlex';\nimport upath from 'upath';\nimport { GlobalConfig } from '../../../../config/global.ts';\nimport {\n  SYSTEM_INSUFFICIENT_DISK_SPACE,\n  TEMPORARY_ERROR,\n} from '../../../../constants/error-messages.ts';\nimport { logger } from '../../../../logger/index.ts';\nimport { exec, getToolSettingsOptions } from '../../../../util/exec/index.ts';\nimport type {\n  ExecOptions,\n  ExtraEnv,\n  ToolConstraint,\n} from '../../../../util/exec/types.ts';\nimport {\n  deleteLocalFile,\n  localPathExists,\n  readLocalFile,\n  renameLocalFile,\n} from '../../../../util/fs/index.ts';\nimport { minimatch } from '../../../../util/minimatch.ts';\nimport { toMs } from '../../../../util/pretty-time.ts';\nimport { regEx } from '../../../../util/regex.ts';\nimport { Result } from '../../../../util/result.ts';\nimport { trimSlashes } from '../../../../util/url.ts';\nimport type { PostUpdateConfig, Upgrade } from '../../types.ts';\nimport { resolveToolConstraint } from '../../util.ts';\nimport { NpmrcCooldown, PackageLock } from '../schema.ts';\nimport type { NpmManagerData } from '../types.ts';\nimport { composeLockFile, parseLockFile } from '../utils.ts';\nimport { getNodeToolConstraint } from './node-version.ts';\nimport type { GenerateLockFileResult, NpmrcCooldownResult } from './types.ts';\nimport {\n  getNodeOptions,\n  getPackageManagerVersion,\n  lazyLoadPackageJson,\n} from './utils.ts';\n\nexport function parseNpmrcCooldownDate(\n  npmrcContent: string | null,\n): NpmrcCooldownResult | null {\n  if (!npmrcContent) {\n    return null;\n  }\n\n  const parsed = NpmrcCooldown.parse(npmrcContent);\n\n  const before = parsed.before;\n  if (isNonEmptyString(before)) {\n    const dt = DateTime.fromISO(before, { zone: 'utc' });\n    if (dt.isValid) {\n      return { date: dt, source: 'before' };\n    }\n    logger.debug(`Invalid before date in .npmrc: ${before}, ignoring`);\n  }\n\n  const minReleaseAge = parsed['min-release-age'];\n  if (isNonEmptyString(minReleaseAge)) {\n    const days = parseInt(minReleaseAge, 10);\n    if (isNumber(days) && days >= 0) {\n      return {\n        date: DateTime.now().minus({ days }).toUTC(),\n        source: 'min-release-age',\n      };\n    }\n    logger.debug(\n      `Invalid min-release-age in .npmrc: ${minReleaseAge}, ignoring`,\n    );\n  }\n\n  return null;\n}\n\nasync function getNpmConstraintFromPackageLock(\n  lockFileDir: string,\n  filename: string,\n): Promise<string | null> {\n  const packageLockFileName = upath.join(lockFileDir, filename);\n  const packageLockContents = await readLocalFile(packageLockFileName, 'utf8');\n  const packageLockJson = Result.parse(\n    packageLockContents,\n    PackageLock,\n  ).unwrapOrNull();\n  if (!packageLockJson) {\n    logger.debug(`Could not parse ${packageLockFileName}`);\n    return null;\n  }\n  const { lockfileVersion } = packageLockJson;\n  if (lockfileVersion === 1) {\n    logger.debug(`Using npm constraint <7 for lockfileVersion=1`);\n    return `<7`;\n  }\n  if (lockfileVersion === 2) {\n    logger.debug(`Using npm constraint <9 for lockfileVersion=2`);\n    return `<9`;\n  }\n  return null;\n}\n\nexport async function generateLockFile(\n  lockFileDir: string,\n  env: NodeJS.ProcessEnv,\n  filename: string,\n  config: Partial<PostUpdateConfig<NpmManagerData>> = {},\n  upgrades: Upgrade<NpmManagerData>[] = [],\n  npmrcContent: string | null = null,\n): Promise<GenerateLockFileResult> {\n  // TODO: don't assume package-lock.json is in the same directory\n  const lockFileName = upath.join(lockFileDir, filename);\n\n  logger.debug(`Spawning npm install to create ${lockFileDir}/${filename}`);\n  const { skipInstalls, postUpdateOptions } = config;\n\n  let lockFile: string | null = null;\n  let beforeFallback = false;\n  try {\n    const lazyPkgJson = lazyLoadPackageJson(lockFileDir);\n    const npmToolConstraint: ToolConstraint = {\n      toolName: 'npm',\n      constraint:\n        (await resolveToolConstraint(\n          config,\n          'npm',\n          async () =>\n            getPackageManagerVersion('npm', await lazyPkgJson.getValue()) ??\n            (await getNpmConstraintFromPackageLock(lockFileDir, filename)),\n        )) ?? null,\n    };\n    const supportsPreferDedupeFlag =\n      !npmToolConstraint.constraint ||\n      semver.intersects('>=7.0.0', npmToolConstraint.constraint);\n    let commands: string[] = [];\n    let cmdOptions = '';\n    const needsDedupeWithoutFlag =\n      postUpdateOptions?.includes('npmDedupe') === true &&\n      !supportsPreferDedupeFlag;\n    if (needsDedupeWithoutFlag || skipInstalls === false) {\n      logger.debug('Performing node_modules install');\n      cmdOptions += '--no-audit';\n    } else {\n      logger.debug('Updating lock file only');\n      cmdOptions += '--package-lock-only --no-audit';\n    }\n\n    if (postUpdateOptions?.includes('npmDedupe') && supportsPreferDedupeFlag) {\n      logger.debug('Deduplicate dependencies on installation');\n      cmdOptions += ' --prefer-dedupe';\n    }\n\n    if (!GlobalConfig.get('allowScripts') || config.ignoreScripts) {\n      cmdOptions += ' --ignore-scripts';\n    }\n\n    let beforeFlag = '';\n    if (config.minimumReleaseAge) {\n      const ms = toMs(config.minimumReleaseAge);\n      if (ms === null) {\n        logger.debug(\n          {\n            minimumReleaseAge: config.minimumReleaseAge,\n          },\n          'Invalid minimumReleaseAge, skipping --before for npm install',\n        );\n      } else {\n        const npmrcCooldown = parseNpmrcCooldownDate(npmrcContent);\n\n        // npm rejects --before when min-release-age is set in .npmrc,\n        // so let the .npmrc handle cooldown natively in that case\n        if (npmrcCooldown?.source === 'min-release-age') {\n          logger.debug(\n            {\n              npmrcMinReleaseAge: npmrcCooldown.date.toISO(),\n              minimumReleaseAge: config.minimumReleaseAge,\n            },\n            'Skipping --before flag because .npmrc already contains min-release-age',\n          );\n        } else {\n          let beforeDate = DateTime.now().minus(ms).toUTC();\n\n          if (npmrcCooldown && npmrcCooldown.date < beforeDate) {\n            logger.debug(\n              {\n                npmrcDate: npmrcCooldown.date.toISO(),\n                beforeDate: beforeDate.toISO(),\n              },\n              'Using stricter .npmrc cooldown date over minimumReleaseAge date',\n            );\n            beforeDate = npmrcCooldown.date;\n          }\n\n          const beforeISO = beforeDate.toISO();\n          logger.debug(\n            {\n              beforeISO,\n              minimumReleaseAge: config.minimumReleaseAge,\n            },\n            'Setting npm --before based on minimumReleaseAge',\n          );\n          beforeFlag = ` --before=${beforeISO}`;\n        }\n      }\n    }\n\n    const extraEnv: ExtraEnv = {\n      NPM_CONFIG_CACHE: env.NPM_CONFIG_CACHE,\n      npm_config_store: env.npm_config_store,\n    };\n\n    const { nodeMaxMemory } = getToolSettingsOptions(config.toolSettings);\n    if (nodeMaxMemory) {\n      extraEnv.NODE_OPTIONS = getNodeOptions(nodeMaxMemory);\n    }\n\n    const execOptions: ExecOptions = {\n      cwdFile: lockFileName,\n      extraEnv,\n      toolConstraints: [\n        await getNodeToolConstraint(config, upgrades, lockFileDir, lazyPkgJson),\n        ...(isNonEmptyString(npmToolConstraint.constraint)\n          ? [npmToolConstraint]\n          : []),\n      ],\n      docker: {},\n    };\n    /* v8 ignore next -- needs test */\n    if (GlobalConfig.get('exposeAllEnv')) {\n      extraEnv.NPM_AUTH = env.NPM_AUTH;\n      extraEnv.NPM_EMAIL = env.NPM_EMAIL;\n    }\n\n    if (!upgrades.every((upgrade) => upgrade.isLockfileUpdate)) {\n      // This command updates the lock file based on package.json\n      commands.push(`npm install ${cmdOptions}${beforeFlag}`.trim());\n    }\n\n    // rangeStrategy = update-lockfile\n    const lockUpdates = upgrades.filter((upgrade) => upgrade.isLockfileUpdate);\n\n    // divide the deps in two categories: workspace and root\n    const { lockRootUpdates, lockWorkspacesUpdates, workspaces, rootDeps } =\n      divideWorkspaceAndRootDeps(lockFileDir, lockUpdates);\n\n    if (workspaces.size && lockWorkspacesUpdates.length) {\n      logger.debug('Performing lockfileUpdate (npm-workspaces)');\n      for (const workspace of workspaces) {\n        const currentWorkspaceUpdates = lockWorkspacesUpdates\n          .filter((update) => update.workspace === workspace)\n          .map((update) => update.managerData?.packageKey)\n          .filter(isString)\n          .filter((packageKey) => !rootDeps.has(packageKey));\n\n        // v8 ignore else -- TODO: add test #40625\n        if (currentWorkspaceUpdates.length) {\n          const updateCmd = `npm install ${cmdOptions}${beforeFlag} --workspace=${quote(workspace)} ${currentWorkspaceUpdates\n            .map(quote)\n            .join(' ')}`;\n          commands.push(updateCmd);\n        }\n      }\n    }\n\n    if (lockRootUpdates.length) {\n      logger.debug('Performing lockfileUpdate (npm)');\n      const updateCmd = `npm install ${cmdOptions}${beforeFlag} ${lockRootUpdates\n        .map((update) => update.managerData?.packageKey)\n        .filter(isString)\n        .map(quote)\n        .join(' ')}`;\n      commands.push(updateCmd);\n    }\n\n    if (upgrades.some((upgrade) => upgrade.isRemediation)) {\n      // We need to run twice to get the correct lock file\n      commands.push(`npm install ${cmdOptions}${beforeFlag}`.trim());\n    }\n\n    // Lock file maintenance recreates the lock file from scratch, and a single\n    // `npm install` can generate a lock file which is out of sync with\n    // package.json, so we need to run the install a second time (#37531).\n    // Skipped if `npmInstallTwice` is configured, as that doubles all install\n    // commands already.\n    if (\n      upgrades.some((upgrade) => upgrade.isLockFileMaintenance) &&\n      !postUpdateOptions?.includes('npmInstallTwice')\n    ) {\n      commands.push(`npm install ${cmdOptions}${beforeFlag}`.trim());\n    }\n\n    // postUpdateOptions\n    if (\n      config.postUpdateOptions?.includes('npmDedupe') &&\n      !supportsPreferDedupeFlag\n    ) {\n      logger.debug('Performing npm dedupe after installation');\n      commands.push('npm dedupe');\n    }\n\n    if (upgrades.find((upgrade) => upgrade.isLockFileMaintenance)) {\n      logger.debug(\n        `Removing ${lockFileName} first due to lock file maintenance upgrade`,\n      );\n      try {\n        await deleteLocalFile(lockFileName);\n      } catch (err) /* v8 ignore next -- TODO: add test #40625 */ {\n        logger.debug(\n          { err, lockFileName },\n          'Error removing `package-lock.json` for lock file maintenance',\n        );\n      }\n    }\n\n    if (postUpdateOptions?.includes('npmInstallTwice')) {\n      logger.debug('Running npm install twice');\n      // Run the install command twice to ensure the lock file is up to date\n      // iterate through commands and if any command starts with `npm install`, add it again\n      const existingCommands = [...commands];\n      commands = [];\n      for (const command of existingCommands) {\n        commands.push(command);\n        // v8 ignore else -- TODO: add test #40625\n        if (command.startsWith('npm install')) {\n          commands.push(command);\n        }\n      }\n    }\n\n    // Run the commands, retrying without --before on ETARGET if needed\n    await exec(commands, execOptions).catch(async (err) => {\n      if (beforeFlag && err.stderr?.includes('with a date before')) {\n        logger.debug('npm --before caused ETARGET, retrying without --before');\n        const commandsWithoutBefore = commands.map((cmd) =>\n          cmd.replace(beforeFlag, ''),\n        );\n        beforeFallback = true;\n        return exec(commandsWithoutBefore, execOptions);\n      }\n      throw err;\n    });\n\n    // massage to shrinkwrap if necessary\n    if (\n      filename === 'npm-shrinkwrap.json' &&\n      (await localPathExists(upath.join(lockFileDir, 'package-lock.json')))\n    ) {\n      await renameLocalFile(\n        upath.join(lockFileDir, 'package-lock.json'),\n        upath.join(lockFileDir, 'npm-shrinkwrap.json'),\n      );\n    }\n\n    // Read the result\n    // TODO #22198\n    lockFile = (await readLocalFile(\n      upath.join(lockFileDir, filename),\n      'utf8',\n    ))!;\n\n    // Massage lockfile counterparts of package.json that were modified\n    // because npm install was called with an explicit version for rangeStrategy=update-lockfile\n    if (lockUpdates.length) {\n      const { detectedIndent, lockFileParsed } = parseLockFile(lockFile);\n      if (\n        lockFileParsed?.lockfileVersion === 2 ||\n        lockFileParsed?.lockfileVersion === 3\n      ) {\n        lockUpdates.forEach((lockUpdate) => {\n          const depType = lockUpdate.depType as\n            'dependencies' | 'optionalDependencies';\n\n          // TODO #22198\n          // v8 ignore else -- TODO: add test #40625\n          if (\n            lockFileParsed.packages?.['']?.[depType]?.[lockUpdate.packageName!]\n          ) {\n            lockFileParsed.packages[''][depType][lockUpdate.packageName!] =\n              lockUpdate.newValue!;\n          }\n        });\n        lockFile = composeLockFile(lockFileParsed, detectedIndent);\n      }\n    }\n  } catch (err) {\n    // v8 ignore if -- TODO: add test #40625\n    if (err.message === TEMPORARY_ERROR) {\n      throw err;\n    }\n    logger.debug(\n      {\n        err,\n        type: 'npm',\n      },\n      'lock file error',\n    );\n    // v8 ignore if -- TODO: add test #40625\n    if (err.stderr?.includes('ENOSPC: no space left on device')) {\n      throw new Error(SYSTEM_INSUFFICIENT_DISK_SPACE);\n    }\n    return { error: true, stderr: err.stderr };\n  }\n  return { error: !lockFile, lockFile, beforeFallback };\n}\n\nexport function divideWorkspaceAndRootDeps(\n  lockFileDir: string,\n  lockUpdates: Upgrade<NpmManagerData>[],\n): {\n  lockRootUpdates: Upgrade<NpmManagerData>[];\n  lockWorkspacesUpdates: Upgrade<NpmManagerData>[];\n  workspaces: Set<string>;\n  rootDeps: Set<string>;\n} {\n  const lockRootUpdates: Upgrade<NpmManagerData>[] = []; // stores all upgrades which are present in root package.json\n  const lockWorkspacesUpdates: Upgrade<NpmManagerData>[] = []; // stores all upgrades which are present in workspaces package.json\n  const workspaces = new Set<string>(); // name of all workspaces\n  const rootDeps = new Set<string>(); // packageName of all upgrades in root package.json (makes it check duplicate deps in root)\n\n  // divide the deps in two categories: workspace and root\n  for (const upgrade of lockUpdates) {\n    upgrade.managerData ??= {};\n    upgrade.managerData.packageKey = generatePackageKey(\n      upgrade.packageName!,\n      upgrade.newVersion!,\n    );\n    if (\n      upgrade.managerData.workspacesPackages?.length &&\n      isString(upgrade.packageFile)\n    ) {\n      const workspacePatterns = upgrade.managerData.workspacesPackages; // glob pattern or directory name/path\n      const packageFileDir = trimSlashes(\n        upgrade.packageFile.replace('package.json', ''),\n      );\n\n      // workspaceDir = packageFileDir - lockFileDir\n      const workspaceDir = trimSlashes(\n        packageFileDir.startsWith(lockFileDir)\n          ? packageFileDir.slice(lockFileDir.length)\n          : packageFileDir,\n      );\n\n      if (isNonEmptyString(workspaceDir)) {\n        let workspaceName: string | undefined;\n        // compare workspaceDir to workspace patterns\n        // stop when the first match is found and\n        // add workspaceDir to workspaces set and upgrade object\n        for (const workspacePattern of workspacePatterns) {\n          const massagedPattern = workspacePattern.replace(regEx(/^\\.\\//), '');\n          if (minimatch(massagedPattern).match(workspaceDir)) {\n            workspaceName = workspaceDir;\n            break;\n          }\n        }\n        if (workspaceName) {\n          // v8 ignore else -- TODO: add test #40625\n          if (\n            !rootDeps.has(upgrade.managerData.packageKey) // prevent same dep from existing in root and workspace\n          ) {\n            workspaces.add(workspaceName);\n            upgrade.workspace = workspaceName;\n            lockWorkspacesUpdates.push(upgrade);\n          }\n        } else {\n          logger.warn(\n            { workspacePatterns, workspaceDir },\n            'workspaceDir not found',\n          );\n        }\n        continue;\n      }\n    }\n    lockRootUpdates.push(upgrade);\n    rootDeps.add(upgrade.managerData.packageKey);\n  }\n\n  return { lockRootUpdates, lockWorkspacesUpdates, workspaces, rootDeps };\n}\n\nfunction generatePackageKey(packageName: string, version: string): string {\n  return `${packageName}@${version}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0CA,SAAgB,uBACd,cAC4B;CAC5B,IAAI,CAAC,cACH,OAAO;CAGT,MAAM,SAAS,cAAc,MAAM,YAAY;CAE/C,MAAM,SAAS,OAAO;CACtB,IAAI,iBAAiB,MAAM,GAAG;EAC5B,MAAM,KAAK,SAAS,QAAQ,QAAQ,EAAE,MAAM,MAAM,CAAC;EACnD,IAAI,GAAG,SACL,OAAO;GAAE,MAAM;GAAI,QAAQ;EAAS;EAEtC,OAAO,MAAM,kCAAkC,OAAO,WAAW;CACnE;CAEA,MAAM,gBAAgB,OAAO;CAC7B,IAAI,iBAAiB,aAAa,GAAG;EACnC,MAAM,OAAO,SAAS,eAAe,EAAE;EACvC,IAAI,SAAS,IAAI,KAAK,QAAQ,GAC5B,OAAO;GACL,MAAM,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM;GAC3C,QAAQ;EACV;EAEF,OAAO,MACL,sCAAsC,cAAc,WACtD;CACF;CAEA,OAAO;AACT;AAEA,eAAe,gCACb,aACA,UACwB;CACxB,MAAM,sBAAsB,MAAM,KAAK,aAAa,QAAQ;CAC5D,MAAM,sBAAsB,MAAM,cAAc,qBAAqB,MAAM;CAC3E,MAAM,kBAAkB,OAAO,MAC7B,qBACA,WACF,CAAC,CAAC,aAAa;CACf,IAAI,CAAC,iBAAiB;EACpB,OAAO,MAAM,mBAAmB,qBAAqB;EACrD,OAAO;CACT;CACA,MAAM,EAAE,oBAAoB;CAC5B,IAAI,oBAAoB,GAAG;EACzB,OAAO,MAAM,+CAA+C;EAC5D,OAAO;CACT;CACA,IAAI,oBAAoB,GAAG;EACzB,OAAO,MAAM,+CAA+C;EAC5D,OAAO;CACT;CACA,OAAO;AACT;AAEA,eAAsB,iBACpB,aACA,KACA,UACA,SAAoD,CAAC,GACrD,WAAsC,CAAC,GACvC,eAA8B,MACG;CAEjC,MAAM,eAAe,MAAM,KAAK,aAAa,QAAQ;CAErD,OAAO,MAAM,kCAAkC,YAAY,GAAG,UAAU;CACxE,MAAM,EAAE,cAAc,sBAAsB;CAE5C,IAAI,WAA0B;CAC9B,IAAI,iBAAiB;CACrB,IAAI;EACF,MAAM,cAAc,oBAAoB,WAAW;EACnD,MAAM,oBAAoC;GACxC,UAAU;GACV,YACG,MAAM,sBACL,QACA,OACA,YACE,yBAAyB,OAAO,MAAM,YAAY,SAAS,CAAC,KAC3D,MAAM,gCAAgC,aAAa,QAAQ,CAChE,KAAM;EACV;EACA,MAAM,2BACJ,CAAC,kBAAkB,cACnB,OAAO,WAAW,WAAW,kBAAkB,UAAU;EAC3D,IAAI,WAAqB,CAAC;EAC1B,IAAI,aAAa;EAIjB,IAFE,mBAAmB,SAAS,WAAW,MAAM,QAC7C,CAAC,4BAC2B,iBAAiB,OAAO;GACpD,OAAO,MAAM,iCAAiC;GAC9C,cAAc;EAChB,OAAO;GACL,OAAO,MAAM,yBAAyB;GACtC,cAAc;EAChB;EAEA,IAAI,mBAAmB,SAAS,WAAW,KAAK,0BAA0B;GACxE,OAAO,MAAM,0CAA0C;GACvD,cAAc;EAChB;EAEA,IAAI,CAAC,aAAa,IAAI,cAAc,KAAK,OAAO,eAC9C,cAAc;EAGhB,IAAI,aAAa;EACjB,IAAI,OAAO,mBAAmB;GAC5B,MAAM,KAAK,KAAK,OAAO,iBAAiB;GACxC,IAAI,OAAO,MACT,OAAO,MACL,EACE,mBAAmB,OAAO,kBAC5B,GACA,8DACF;QACK;IACL,MAAM,gBAAgB,uBAAuB,YAAY;IAIzD,IAAI,eAAe,WAAW,mBAC5B,OAAO,MACL;KACE,oBAAoB,cAAc,KAAK,MAAM;KAC7C,mBAAmB,OAAO;IAC5B,GACA,wEACF;SACK;KACL,IAAI,aAAa,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;KAEhD,IAAI,iBAAiB,cAAc,OAAO,YAAY;MACpD,OAAO,MACL;OACE,WAAW,cAAc,KAAK,MAAM;OACpC,YAAY,WAAW,MAAM;MAC/B,GACA,iEACF;MACA,aAAa,cAAc;KAC7B;KAEA,MAAM,YAAY,WAAW,MAAM;KACnC,OAAO,MACL;MACE;MACA,mBAAmB,OAAO;KAC5B,GACA,iDACF;KACA,aAAa,aAAa;IAC5B;GACF;EACF;EAEA,MAAM,WAAqB;GACzB,kBAAkB,IAAI;GACtB,kBAAkB,IAAI;EACxB;EAEA,MAAM,EAAE,kBAAkB,uBAAuB,OAAO,YAAY;EACpE,IAAI,eACF,SAAS,eAAe,eAAe,aAAa;EAGtD,MAAM,cAA2B;GAC/B,SAAS;GACT;GACA,iBAAiB,CACf,MAAM,sBAAsB,QAAQ,UAAU,aAAa,WAAW,GACtE,GAAI,iBAAiB,kBAAkB,UAAU,IAC7C,CAAC,iBAAiB,IAClB,CAAC,CACP;GACA,QAAQ,CAAC;EACX;;EAEA,IAAI,aAAa,IAAI,cAAc,GAAG;GACpC,SAAS,WAAW,IAAI;GACxB,SAAS,YAAY,IAAI;EAC3B;EAEA,IAAI,CAAC,SAAS,OAAO,YAAY,QAAQ,gBAAgB,GAEvD,SAAS,KAAK,eAAe,aAAa,aAAa,KAAK,CAAC;EAI/D,MAAM,cAAc,SAAS,QAAQ,YAAY,QAAQ,gBAAgB;EAGzE,MAAM,EAAE,iBAAiB,uBAAuB,YAAY,aAC1D,2BAA2B,aAAa,WAAW;EAErD,IAAI,WAAW,QAAQ,sBAAsB,QAAQ;GACnD,OAAO,MAAM,4CAA4C;GACzD,KAAK,MAAM,aAAa,YAAY;IAClC,MAAM,0BAA0B,sBAC7B,QAAQ,WAAW,OAAO,cAAc,SAAS,CAAC,CAClD,KAAK,WAAW,OAAO,aAAa,UAAU,CAAC,CAC/C,OAAO,QAAQ,CAAC,CAChB,QAAQ,eAAe,CAAC,SAAS,IAAI,UAAU,CAAC;;IAGnD,IAAI,wBAAwB,QAAQ;KAClC,MAAM,YAAY,eAAe,aAAa,WAAW,eAAe,MAAM,SAAS,EAAE,GAAG,wBACzF,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;KACX,SAAS,KAAK,SAAS;IACzB;GACF;EACF;EAEA,IAAI,gBAAgB,QAAQ;GAC1B,OAAO,MAAM,iCAAiC;GAC9C,MAAM,YAAY,eAAe,aAAa,WAAW,GAAG,gBACzD,KAAK,WAAW,OAAO,aAAa,UAAU,CAAC,CAC/C,OAAO,QAAQ,CAAC,CAChB,IAAI,KAAK,CAAC,CACV,KAAK,GAAG;GACX,SAAS,KAAK,SAAS;EACzB;EAEA,IAAI,SAAS,MAAM,YAAY,QAAQ,aAAa,GAElD,SAAS,KAAK,eAAe,aAAa,aAAa,KAAK,CAAC;EAQ/D,IACE,SAAS,MAAM,YAAY,QAAQ,qBAAqB,KACxD,CAAC,mBAAmB,SAAS,iBAAiB,GAE9C,SAAS,KAAK,eAAe,aAAa,aAAa,KAAK,CAAC;EAI/D,IACE,OAAO,mBAAmB,SAAS,WAAW,KAC9C,CAAC,0BACD;GACA,OAAO,MAAM,0CAA0C;GACvD,SAAS,KAAK,YAAY;EAC5B;EAEA,IAAI,SAAS,MAAM,YAAY,QAAQ,qBAAqB,GAAG;GAC7D,OAAO,MACL,YAAY,aAAa,4CAC3B;GACA,IAAI;IACF,MAAM,gBAAgB,YAAY;GACpC,SAAS,mDAAmD;IAC1D,OAAO,MACL;KAAE;KAAK;IAAa,GACpB,8DACF;GACF;EACF;EAEA,IAAI,mBAAmB,SAAS,iBAAiB,GAAG;GAClD,OAAO,MAAM,2BAA2B;GAGxC,MAAM,mBAAmB,CAAC,GAAG,QAAQ;GACrC,WAAW,CAAC;GACZ,KAAK,MAAM,WAAW,kBAAkB;IACtC,SAAS,KAAK,OAAO;;IAErB,IAAI,QAAQ,WAAW,aAAa,GAClC,SAAS,KAAK,OAAO;GAEzB;EACF;EAGA,MAAM,KAAK,UAAU,WAAW,CAAC,CAAC,MAAM,OAAO,QAAQ;GACrD,IAAI,cAAc,IAAI,QAAQ,SAAS,oBAAoB,GAAG;IAC5D,OAAO,MAAM,wDAAwD;IACrE,MAAM,wBAAwB,SAAS,KAAK,QAC1C,IAAI,QAAQ,YAAY,EAAE,CAC5B;IACA,iBAAiB;IACjB,OAAO,KAAK,uBAAuB,WAAW;GAChD;GACA,MAAM;EACR,CAAC;EAGD,IACE,aAAa,yBACZ,MAAM,gBAAgB,MAAM,KAAK,aAAa,mBAAmB,CAAC,GAEnE,MAAM,gBACJ,MAAM,KAAK,aAAa,mBAAmB,GAC3C,MAAM,KAAK,aAAa,qBAAqB,CAC/C;EAKF,WAAY,MAAM,cAChB,MAAM,KAAK,aAAa,QAAQ,GAChC,MACF;EAIA,IAAI,YAAY,QAAQ;GACtB,MAAM,EAAE,gBAAgB,mBAAmB,cAAc,QAAQ;GACjE,IACE,gBAAgB,oBAAoB,KACpC,gBAAgB,oBAAoB,GACpC;IACA,YAAY,SAAS,eAAe;KAClC,MAAM,UAAU,WAAW;;KAK3B,IACE,eAAe,WAAW,GAAG,GAAG,QAAQ,GAAG,WAAW,cAEtD,eAAe,SAAS,GAAG,CAAC,QAAQ,CAAC,WAAW,eAC9C,WAAW;IAEjB,CAAC;IACD,WAAW,gBAAgB,gBAAgB,cAAc;GAC3D;EACF;CACF,SAAS,KAAK;;EAEZ,IAAI,IAAI,YAAA,mBACN,MAAM;EAER,OAAO,MACL;GACE;GACA,MAAM;EACR,GACA,iBACF;;EAEA,IAAI,IAAI,QAAQ,SAAS,iCAAiC,GACxD,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO;GAAE,OAAO;GAAM,QAAQ,IAAI;EAAO;CAC3C;CACA,OAAO;EAAE,OAAO,CAAC;EAAU;EAAU;CAAe;AACtD;AAEA,SAAgB,2BACd,aACA,aAMA;CACA,MAAM,kBAA6C,CAAC;CACpD,MAAM,wBAAmD,CAAC;CAC1D,MAAM,6BAAa,IAAI,IAAY;CACnC,MAAM,2BAAW,IAAI,IAAY;CAGjC,KAAK,MAAM,WAAW,aAAa;EACjC,QAAQ,gBAAgB,CAAC;EACzB,QAAQ,YAAY,aAAa,mBAC/B,QAAQ,aACR,QAAQ,UACV;EACA,IACE,QAAQ,YAAY,oBAAoB,UACxC,SAAS,QAAQ,WAAW,GAC5B;GACA,MAAM,oBAAoB,QAAQ,YAAY;GAC9C,MAAM,iBAAiB,YACrB,QAAQ,YAAY,QAAQ,gBAAgB,EAAE,CAChD;GAGA,MAAM,eAAe,YACnB,eAAe,WAAW,WAAW,IACjC,eAAe,MAAM,YAAY,MAAM,IACvC,cACN;GAEA,IAAI,iBAAiB,YAAY,GAAG;IAClC,IAAI;IAIJ,KAAK,MAAM,oBAAoB,mBAAmB;KAChD,MAAM,kBAAkB,iBAAiB,QAAQ,MAAM,OAAO,GAAG,EAAE;KACnE,IAAI,UAAU,eAAe,CAAC,CAAC,MAAM,YAAY,GAAG;MAClD,gBAAgB;MAChB;KACF;IACF;IACA,IAAI,eAGA;;SAAA,CAAC,SAAS,IAAI,QAAQ,YAAY,UAAU,GAC5C;MACA,WAAW,IAAI,aAAa;MAC5B,QAAQ,YAAY;MACpB,sBAAsB,KAAK,OAAO;KACpC;WAEA,OAAO,KACL;KAAE;KAAmB;IAAa,GAClC,wBACF;IAEF;GACF;EACF;EACA,gBAAgB,KAAK,OAAO;EAC5B,SAAS,IAAI,QAAQ,YAAY,UAAU;CAC7C;CAEA,OAAO;EAAE;EAAiB;EAAuB;EAAY;CAAS;AACxE;AAEA,SAAS,mBAAmB,aAAqB,SAAyB;CACxE,OAAO,GAAG,YAAY,GAAG;AAC3B"}