renovate 44.77.0 → 44.79.0

package/dist/util/http/http.js

@@ -3,6 +3,7 @@ import { get, set } from "../cache/memory/index.js";
 import { coerceObject } from "../object.js";
 import { getEnv } from "../env.js";
 import { GlobalConfig } from "../../config/global.js";
+import { coerceArray } from "../array.js";
 import { logger } from "../../logger/index.js";
 import { isHttpUrl, parseUrl, resolveBaseUrl } from "../url.js";
 import { ObsoleteCacheHitLogger } from "../stats.js";
@@ -15,6 +16,7 @@ import { acquireLock } from "../mutex.js";
 import { fetch, normalize, stream } from "./got.js";
 import { Result } from "../result.js";
 import { applyAuthorization } from "./auth.js";
+import { applyHostGuard } from "./host-guard.js";
 import { applyHostRule, findMatchingRule } from "./host-rules.js";
 import { getQueue } from "./queue.js";
 import { getRetryAfter, wrapWithRetry } from "./retry-after.js";
@@ -49,19 +51,21 @@ var HttpBase = class {
 			}
 		}, { isMergeableObject: isPlainObject });
 	}
-	async request(requestUrl, httpOptions) {
-		const resolvedUrl = this.resolveUrl(requestUrl, httpOptions);
+	/**
+	* Builds the final got options for a request to a given `url`
+	*
+	* This merges instance options, applies default headers, host rules and authorization, and rejects requests to disabled hosts.
+	*
+	* Both the `request()` and `stream()` paths must use this single entry point so that policy applied here covers every outbound request.
+	*/
+	prepareOptions(resolvedUrl, httpOptions) {
 		const url = resolvedUrl.toString();
-		this.processOptions(resolvedUrl, httpOptions);
 		let options = merge({
 			...this.options,
 			hostType: this.hostType
 		}, httpOptions, { isMergeableObject: isPlainObject });
-		const method = options.method.toLowerCase();
-		const isReadMethod = ["head", "get"].includes(method);
-		logger.trace(`HTTP request: ${method.toUpperCase()} ${url}`);
 		applyDefaultHeaders(options);
-		if (isUndefined(options.readOnly) && isReadMethod) options.readOnly = true;
+		if (isUndefined(options.readOnly) && ["head", "get"].includes(options.method.toLowerCase())) options.readOnly = true;
 		const hostRule = findMatchingRule(url, options);
 		options = applyHostRule(url, options, hostRule);
 		if (options.enabled === false) {
@@ -69,6 +73,26 @@ var HttpBase = class {
 			throw new Error(HOST_DISABLED);
 		}
 		options = applyAuthorization(options);
+		const guard = applyHostGuard(resolvedUrl, options.hostType, hostRule.internalHostGrant, options.responseBecomesConfig);
+		options.dnsLookup = guard.dnsLookup;
+		options.hooks = {
+			...options.hooks,
+			beforeRedirect: [...coerceArray(options.hooks?.beforeRedirect), guard.beforeRedirect]
+		};
+		if (guard.beforeRequest) options.hooks.beforeRequest = [...coerceArray(options.hooks.beforeRequest), guard.beforeRequest];
+		return {
+			options,
+			hostRule
+		};
+	}
+	async request(requestUrl, httpOptions) {
+		const resolvedUrl = this.resolveUrl(requestUrl, httpOptions);
+		const url = resolvedUrl.toString();
+		this.processOptions(resolvedUrl, httpOptions);
+		const { options, hostRule } = this.prepareOptions(resolvedUrl, httpOptions);
+		const method = options.method.toLowerCase();
+		const isReadMethod = ["head", "get"].includes(method);
+		logger.trace(`HTTP request: ${method.toUpperCase()} ${url}`);
 		const timeout = options.timeout ?? 6e4;
 		options.timeout = timeout;
 		let cacheProvider;
@@ -138,7 +162,8 @@ var HttpBase = class {
 		return [
 			"baseUrl",
 			"cacheProvider",
-			"readOnly"
+			"readOnly",
+			"responseBecomesConfig"
 		];
 	}
 	processOptions(_url, _options) {}
@@ -315,21 +340,12 @@ var HttpBase = class {
 		return this.requestJson("delete", args);
 	}
 	stream(url, options) {
-		let combinedOptions = {
-			...this.options,
-			hostType: this.hostType,
+		const resolvedUrl = this.resolveUrl(url, options);
+		const { options: combinedOptions } = this.prepareOptions(resolvedUrl, {
 			...options,
 			method: "get"
-		};
-		const resolvedUrl = this.resolveUrl(url, options).toString();
-		applyDefaultHeaders(combinedOptions);
-		// v8 ignore else -- TODO: add test #40625
-		if (isUndefined(combinedOptions.readOnly) && ["head", "get"].includes(combinedOptions.method)) combinedOptions.readOnly = true;
-		const hostRule = findMatchingRule(url, combinedOptions);
-		combinedOptions = applyHostRule(resolvedUrl, combinedOptions, hostRule);
-		if (combinedOptions.enabled === false) throw new Error(HOST_DISABLED);
-		combinedOptions = applyAuthorization(combinedOptions);
-		return stream(resolvedUrl, this._normalizeOptions(combinedOptions));
+		});
+		return stream(resolvedUrl.toString(), this._normalizeOptions(combinedOptions));
 	}
 	async getToml(arg1, arg2, arg3) {
 		const { url, schema, httpOptions } = this.resolveArgs(arg1, arg2, arg3);

package/dist/util/http/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","names":["memCache.get"],"sources":["../../../lib/util/http/http.ts"],"sourcesContent":["import { isPlainObject, isUndefined } from '@sindresorhus/is';\nimport merge from 'deepmerge';\nimport type { Options, OptionsInit, RetryObject } from 'got';\nimport type { Merge, SetRequired } from 'type-fest';\nimport type { z } from 'zod/v4';\nimport { ZodType } from 'zod/v4';\nimport { GlobalConfig } from '../../config/global.ts';\nimport { HOST_DISABLED } from '../../constants/error-messages.ts';\nimport { logger } from '../../logger/index.ts';\nimport { ExternalHostError } from '../../types/errors/external-host-error.ts';\nimport * as memCache from '../cache/memory/index.ts';\nimport { getEnv } from '../env.ts';\nimport { hash } from '../hash.ts';\nimport { acquireLock } from '../mutex.ts';\nimport { coerceObject } from '../object.ts';\nimport { type AsyncResult, Result } from '../result.ts';\nimport { Toml } from '../schema-utils/index.ts';\nimport { ObsoleteCacheHitLogger } from '../stats.ts';\nimport { compile } from '../template/index.ts';\nimport { isHttpUrl, parseUrl, resolveBaseUrl } from '../url.ts';\nimport { parseSingleYaml } from '../yaml.ts';\nimport { applyAuthorization } from './auth.ts';\nimport type { HttpCacheProvider } from './cache/types.ts';\nimport { fetch, normalize, stream } from './got.ts';\nimport { applyHostRule, findMatchingRule } from './host-rules.ts';\nimport { getQueue } from './queue.ts';\nimport { getRetryAfter, wrapWithRetry } from './retry-after.ts';\nimport { getThrottle } from './throttle.ts';\nimport type {\n  GotOptions,\n  GotStreamOptions,\n  GotTask,\n  HttpMethod,\n  HttpOptions,\n  HttpResponse,\n  SafeJsonError,\n} from './types.ts';\nimport { copyResponse } from './util.ts';\n\nexport interface InternalJsonUnsafeOptions<\n  Opts extends HttpOptions = HttpOptions,\n> {\n  url: string | URL;\n  httpOptions?: Opts;\n}\n\nexport interface InternalJsonOptions<\n  Opts extends HttpOptions,\n  ResT = unknown,\n  Schema extends ZodType<ResT, any> = ZodType<ResT, any>,\n> extends InternalJsonUnsafeOptions<Opts> {\n  schema?: Schema;\n}\n\nexport type InternalGotOptions = SetRequired<GotOptions, 'method' | 'context'>;\n\nexport interface InternalHttpOptions extends HttpOptions {\n  json?: HttpOptions['body'];\n\n  method?: HttpMethod;\n\n  parseJson?: Options['parseJson'];\n}\n\nexport function applyDefaultHeaders(options: OptionsInit): void {\n  const userAgentTemplate = GlobalConfig.get('userAgent');\n  options.headers = {\n    ...options.headers,\n    'user-agent': compile(userAgentTemplate, {}),\n  };\n}\n\nexport abstract class HttpBase<\n  JSONOpts extends HttpOptions = HttpOptions,\n  Opts extends HttpOptions = HttpOptions,\n> {\n  private readonly options: InternalGotOptions;\n\n  protected get baseUrl(): string | undefined {\n    return undefined;\n  }\n\n  protected hostType: string;\n\n  constructor(hostType: string, options: HttpOptions = {}) {\n    this.hostType = hostType;\n    const retryLimit = getEnv().NODE_ENV === 'test' ? 0 : 2;\n    this.options = merge<InternalGotOptions>(\n      options,\n      {\n        method: 'get',\n        context: { hostType },\n        retry: {\n          calculateDelay: (retryObject) =>\n            this.calculateRetryDelay(retryObject),\n          limit: retryLimit,\n          maxRetryAfter: 0, // Don't rely on `got` retry-after handling, just let it fail and then we'll handle it\n          enforceRetryRules: false,\n        },\n      },\n      { isMergeableObject: isPlainObject },\n    );\n  }\n\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions,\n  ): Promise<HttpResponse>;\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions & { responseType: 'text' },\n  ): Promise<HttpResponse>;\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions & { responseType: 'buffer' },\n  ): Promise<HttpResponse<Uint8Array>>;\n  private async request<T = unknown>(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions & { responseType: 'json' },\n  ): Promise<HttpResponse<T>>;\n\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions,\n  ): Promise<HttpResponse<unknown>> {\n    const resolvedUrl = this.resolveUrl(requestUrl, httpOptions);\n    const url = resolvedUrl.toString();\n\n    this.processOptions(resolvedUrl, httpOptions);\n\n    let options = merge<InternalGotOptions, InternalHttpOptions>(\n      {\n        ...this.options,\n        hostType: this.hostType,\n      },\n      httpOptions,\n      { isMergeableObject: isPlainObject },\n    );\n\n    const method = options.method.toLowerCase();\n    const isReadMethod = ['head', 'get'].includes(method);\n\n    logger.trace(`HTTP request: ${method.toUpperCase()} ${url}`);\n\n    applyDefaultHeaders(options);\n\n    if (isUndefined(options.readOnly) && isReadMethod) {\n      options.readOnly = true;\n    }\n\n    const hostRule = findMatchingRule(url, options);\n    options = applyHostRule(url, options, hostRule);\n    if (options.enabled === false) {\n      logger.debug(`Host is disabled - rejecting request. HostUrl: ${url}`);\n      throw new Error(HOST_DISABLED);\n    }\n    options = applyAuthorization(options);\n    const timeout = options.timeout ?? 60000;\n    options.timeout = timeout;\n\n    let cacheProvider: HttpCacheProvider | undefined;\n    if (isReadMethod && options.cacheProvider) {\n      cacheProvider = options.cacheProvider;\n    }\n\n    const memCacheKey =\n      !process.env.RENOVATE_X_DISABLE_HTTP_MEMCACHE &&\n      !cacheProvider &&\n      options.memCache !== false &&\n      isReadMethod\n        ? hash(\n            `got-${JSON.stringify({\n              url,\n              headers: options.headers,\n              method,\n            })}`,\n          )\n        : null;\n\n    let resPromise: Promise<HttpResponse<unknown>> | null = null;\n\n    // Cache GET requests unless memCache=false\n    if (memCacheKey) {\n      resPromise = memCache.get(memCacheKey);\n\n      /* v8 ignore next: temporary code */\n      if (resPromise && !cacheProvider) {\n        ObsoleteCacheHitLogger.write(url);\n      }\n    }\n\n    // v8 ignore else -- TODO: add test #40625\n    if (!resPromise) {\n      if (cacheProvider) {\n        await cacheProvider.setCacheHeaders(method, url, options);\n      }\n\n      const startTime = Date.now();\n      const httpTask: GotTask = async () => {\n        let releaseLock: undefined | (() => void);\n        if (isReadMethod) {\n          releaseLock = await acquireLock(\n            `${options.method} ${url}`,\n            'http-mutex',\n            timeout * 2,\n          );\n        }\n        try {\n          const cachedResponse = await cacheProvider?.bypassServer<unknown>(\n            options.method,\n            url,\n          );\n          if (cachedResponse) {\n            return cachedResponse;\n          }\n\n          const queueMs = Date.now() - startTime;\n          return fetch(url, this._normalizeOptions(options), {\n            queueMs,\n          });\n        } finally {\n          releaseLock?.();\n        }\n      };\n\n      const throttle = getThrottle(url);\n      const throttledTask = throttle ? () => throttle.add(httpTask) : httpTask;\n\n      const queue = getQueue(url);\n      const queuedTask = queue ? () => queue.add(throttledTask) : throttledTask;\n\n      const { maxRetryAfter = 60 } = hostRule;\n      resPromise = wrapWithRetry(queuedTask, url, getRetryAfter, maxRetryAfter);\n\n      if (memCacheKey) {\n        memCache.set(memCacheKey, resPromise);\n      }\n    }\n\n    try {\n      const res = await resPromise;\n      const deepCopyNeeded = !!memCacheKey && res.statusCode !== 304;\n      const resCopy = copyResponse(res, deepCopyNeeded);\n      resCopy.authorization = !!options?.headers?.authorization;\n\n      this.handleResponse(resolvedUrl, resCopy);\n\n      if (cacheProvider) {\n        return await cacheProvider.wrapServerResponse(method, url, resCopy);\n      }\n\n      return resCopy;\n    } catch (err) {\n      const { abortOnError, abortIgnoreStatusCodes } = options;\n      if (abortOnError && !abortIgnoreStatusCodes?.includes(err.statusCode)) {\n        throw new ExternalHostError(err);\n      }\n\n      const staleResponse = await cacheProvider?.bypassServer<\n        string | Uint8Array\n      >(method, url, true);\n      if (staleResponse) {\n        logger.debug(\n          { err },\n          `Request error: returning stale cache instead for ${url}`,\n        );\n        return staleResponse;\n      }\n\n      this.handleError(requestUrl, httpOptions, err);\n    }\n  }\n\n  private _normalizeOptions<T extends OptionsInit>(options: T): T {\n    return normalize(options, this.extraOptions());\n  }\n\n  /**\n   * Returns Renovate extra options which needs to be removed before passing to got.\n   * @returns extra Renovate options.\n   */\n  protected extraOptions(): readonly string[] {\n    return ['baseUrl', 'cacheProvider', 'readOnly'] as (keyof HttpOptions)[];\n  }\n\n  protected processOptions(_url: URL, _options: InternalHttpOptions): void {\n    // noop\n  }\n\n  protected handleError(\n    _url: string | URL,\n    _httpOptions: HttpOptions,\n    err: Error,\n  ): never {\n    throw err;\n  }\n\n  protected handleResponse(_url: URL, _res: HttpResponse<unknown>): void {\n    // noop\n  }\n\n  resolveUrl(requestUrl: string | URL, options?: HttpOptions): URL {\n    let url = requestUrl;\n\n    if (url instanceof URL) {\n      // already a aboslute URL\n      return url;\n    }\n\n    const baseUrl = options?.baseUrl ?? this.baseUrl;\n    if (baseUrl) {\n      url = resolveBaseUrl(baseUrl, url);\n    }\n\n    const parsedUrl = parseUrl(url);\n    if (!parsedUrl || !isHttpUrl(parsedUrl)) {\n      logger.error(\n        { url: requestUrl, baseUrl, resolvedUrl: url },\n        'Request Error: cannot parse url',\n      );\n      throw new Error('Invalid URL');\n    }\n    return parsedUrl;\n  }\n\n  protected calculateRetryDelay({ computedValue }: RetryObject): number {\n    return computedValue;\n  }\n\n  get(\n    url: string,\n    options: HttpOptions = {},\n  ): Promise<HttpResponse<string | Uint8Array>> {\n    return this.request(url, options);\n  }\n\n  head(url: string, options: HttpOptions = {}): Promise<HttpResponse<never>> {\n    // to complex to validate\n    return this.request(url, {\n      ...options,\n      responseType: 'text',\n      method: 'head',\n    }) as Promise<HttpResponse<never>>;\n  }\n\n  getText(url: string | URL, options: HttpOptions = {}): Promise<HttpResponse> {\n    return this.request(url, { ...options, responseType: 'text' });\n  }\n\n  getBuffer(\n    url: string | URL,\n    options: HttpOptions = {},\n  ): Promise<HttpResponse<Uint8Array>> {\n    return this.request(url, { ...options, responseType: 'buffer' });\n  }\n\n  protected requestJsonUnsafe<ResT>(\n    method: HttpMethod,\n    { url, httpOptions: requestOptions }: InternalJsonUnsafeOptions<JSONOpts>,\n  ): Promise<HttpResponse<ResT>> {\n    const { body: json, ...httpOptions } = { ...requestOptions };\n    const opts: InternalHttpOptions = {\n      ...httpOptions,\n      method,\n    };\n    // signal that we expect a json response\n    opts.headers = {\n      accept: 'application/json',\n      ...opts.headers,\n    };\n    if (json) {\n      opts.json = json;\n    }\n    return this.request<ResT>(url, { ...opts, responseType: 'json' });\n  }\n\n  private async requestJson<\n    ResT,\n    Schema extends ZodType<ResT, any> = ZodType<ResT, any>,\n  >(\n    method: HttpMethod,\n    options: InternalJsonOptions<JSONOpts, ResT, Schema>,\n  ): Promise<HttpResponse<ResT>> {\n    const res = await this.requestJsonUnsafe<ResT>(method, options);\n\n    if (options.schema) {\n      res.body = await options.schema.parseAsync(res.body);\n    }\n\n    return res;\n  }\n\n  private resolveArgs<ResT = unknown>(\n    arg1: string,\n    arg2: JSONOpts | ZodType<ResT> | undefined,\n    arg3: ZodType<ResT> | undefined,\n  ): InternalJsonOptions<JSONOpts, ResT> {\n    const res: InternalJsonOptions<JSONOpts, ResT> = { url: arg1 };\n\n    if (arg2 instanceof ZodType) {\n      res.schema = arg2;\n    } else if (arg2) {\n      res.httpOptions = arg2;\n    }\n\n    if (arg3) {\n      res.schema = arg3;\n    }\n\n    return res;\n  }\n\n  async getPlain(url: string, options?: Opts): Promise<HttpResponse> {\n    const opt = coerceObject(options);\n    return await this.getText(url, {\n      headers: {\n        Accept: 'text/plain',\n      },\n      ...opt,\n    });\n  }\n\n  /**\n   * @deprecated use `getYaml` instead\n   */\n  async getYamlUnchecked<ResT>(\n    url: string,\n    options?: Opts,\n  ): Promise<HttpResponse<ResT>> {\n    const res = await this.getText(url, options);\n    const body = parseSingleYaml<ResT>(res.body);\n    return { ...res, body };\n  }\n\n  async getYaml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getYaml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    options: Opts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getYaml<Schema extends ZodType<any, any, any>>(\n    arg1: string,\n    arg2?: Opts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>> {\n    const url = arg1;\n    let schema: Schema;\n    let httpOptions: Opts | undefined;\n    if (arg3) {\n      schema = arg3;\n      httpOptions = arg2 as Opts;\n    } else {\n      schema = arg2 as Schema;\n    }\n\n    const opts: InternalHttpOptions = {\n      ...httpOptions,\n      method: 'get',\n    };\n\n    const res = await this.getText(url, opts);\n    const body = await schema.parseAsync(parseSingleYaml(res.body));\n    return { ...res, body };\n  }\n\n  getYamlSafe<\n    ResT extends NonNullable<unknown>,\n    Schema extends ZodType<ResT> = ZodType<ResT>,\n  >(url: string, schema: Schema): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getYamlSafe<\n    ResT extends NonNullable<unknown>,\n    Schema extends ZodType<ResT> = ZodType<ResT>,\n  >(\n    url: string,\n    options: Opts,\n    schema: Schema,\n  ): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getYamlSafe<\n    ResT extends NonNullable<unknown>,\n    Schema extends ZodType<ResT> = ZodType<ResT>,\n  >(\n    arg1: string,\n    arg2: Opts | Schema,\n    arg3?: Schema,\n  ): AsyncResult<ResT, SafeJsonError> {\n    const url = arg1;\n    let schema: Schema;\n    let httpOptions: Opts | undefined;\n    if (arg3) {\n      schema = arg3;\n      httpOptions = arg2 as Opts;\n    } else {\n      schema = arg2 as Schema;\n    }\n\n    let res: AsyncResult<HttpResponse<ResT>, SafeJsonError>;\n    if (httpOptions) {\n      res = Result.wrap(this.getYaml(url, httpOptions, schema));\n    } else {\n      res = Result.wrap(this.getYaml(url, schema));\n    }\n\n    return res.transform((response) => Result.ok(response.body));\n  }\n\n  /**\n   * Request JSON and return the response without any validation.\n   *\n   * The usage of this method is discouraged, please use `getJson` instead.\n   *\n   * If you're new to Zod schema validation library:\n   * - consult the [documentation of Zod library](https://github.com/colinhacks/zod?tab=readme-ov-file#basic-usage)\n   * - search the Renovate codebase for 'zod' module usage\n   * - take a look at the `schema-utils.ts` file for Renovate-specific schemas and utilities\n   */\n  getJsonUnchecked<ResT = unknown>(\n    url: string,\n    options?: JSONOpts,\n  ): Promise<HttpResponse<ResT>> {\n    return this.requestJson<ResT>('get', { url, httpOptions: options });\n  }\n\n  /**\n   * Request JSON with a Zod schema for the response,\n   * throwing an error if the response is not valid.\n   *\n   * @param url\n   * @param schema Zod schema for the response\n   */\n  getJson<Schema extends ZodType<any, any, any>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  getJson<Schema extends ZodType<any, any, any>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  getJson<Schema extends ZodType<any, any, any>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>> {\n    const args = this.resolveArgs<z.infer<Schema>>(arg1, arg2, arg3);\n    return this.requestJson<z.infer<Schema>>('get', args);\n  }\n\n  /**\n   * Request JSON with a Zod schema for the response,\n   * wrapping response data in a `Result` class.\n   *\n   * @param url\n   * @param schema Zod schema for the response\n   */\n  getJsonSafe<ResT extends NonNullable<unknown>, Schema extends ZodType<ResT>>(\n    url: string,\n    schema: Schema,\n  ): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getJsonSafe<ResT extends NonNullable<unknown>, Schema extends ZodType<ResT>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getJsonSafe<ResT extends NonNullable<unknown>, Schema extends ZodType<ResT>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): AsyncResult<ResT, SafeJsonError> {\n    const args = this.resolveArgs<ResT>(arg1, arg2, arg3);\n    return Result.wrap(this.requestJson<ResT>('get', args)).transform(\n      (response) => Result.ok(response.body),\n    );\n  }\n\n  /**\n   * @deprecated use `head` instead\n   */\n  headJson(url: string, httpOptions?: JSONOpts): Promise<HttpResponse<never>> {\n    return this.requestJson<never>('head', { url, httpOptions });\n  }\n\n  postJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  postJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  postJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  postJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs(arg1, arg2, arg3);\n    return this.requestJson<T>('post', args);\n  }\n\n  putJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  putJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  putJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  putJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs<T>(arg1, arg2, arg3);\n    return this.requestJson<T>('put', args);\n  }\n\n  patchJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  patchJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  patchJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  patchJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs(arg1, arg2, arg3);\n    return this.requestJson<T>('patch', args);\n  }\n\n  deleteJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  deleteJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  deleteJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  deleteJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs(arg1, arg2, arg3);\n    return this.requestJson<T>('delete', args);\n  }\n\n  stream(url: string, options?: HttpOptions): NodeJS.ReadableStream {\n    let combinedOptions: Merge<\n      GotStreamOptions,\n      SetRequired<InternalHttpOptions, 'method'>\n    > = {\n      ...this.options,\n      hostType: this.hostType,\n      ...options,\n      method: 'get',\n    };\n\n    const resolvedUrl = this.resolveUrl(url, options).toString();\n\n    applyDefaultHeaders(combinedOptions);\n\n    // v8 ignore else -- TODO: add test #40625\n    if (\n      isUndefined(combinedOptions.readOnly) &&\n      ['head', 'get'].includes(combinedOptions.method)\n    ) {\n      combinedOptions.readOnly = true;\n    }\n\n    const hostRule = findMatchingRule(url, combinedOptions);\n    combinedOptions = applyHostRule(resolvedUrl, combinedOptions, hostRule);\n    if (combinedOptions.enabled === false) {\n      throw new Error(HOST_DISABLED);\n    }\n    combinedOptions = applyAuthorization(combinedOptions);\n\n    return stream(resolvedUrl, this._normalizeOptions(combinedOptions));\n  }\n\n  async getToml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    schema?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getToml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getToml<Schema extends ZodType<any, any, any>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>> {\n    const { url, schema, httpOptions } = this.resolveArgs<z.infer<Schema>>(\n      arg1,\n      arg2,\n      arg3,\n    );\n\n    const opts: InternalHttpOptions = {\n      ...httpOptions,\n      method: 'get',\n      headers: {\n        'Content-Type': 'application/toml',\n        ...httpOptions?.headers,\n      },\n    };\n\n    const res = await this.getText(url, opts);\n    if (schema) {\n      res.body = await Toml.pipe(schema).parseAsync(res.body);\n    } else {\n      res.body = (await Toml.parseAsync(res.body)) as z.infer<Schema>;\n    }\n\n    return res as HttpResponse<z.infer<Schema>>;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,SAAgB,oBAAoB,SAA4B;CAC9D,MAAM,oBAAoB,aAAa,IAAI,WAAW;CACtD,QAAQ,UAAU;EAChB,GAAG,QAAQ;EACX,cAAc,QAAQ,mBAAmB,CAAC,CAAC;CAC7C;AACF;AAEA,IAAsB,WAAtB,MAGE;CACA;CAEA,IAAc,UAA8B,CAE5C;CAEA;CAEA,YAAY,UAAkB,UAAuB,CAAC,GAAG;EACvD,KAAK,WAAW;EAChB,MAAM,aAAa,OAAO,CAAC,CAAC,aAAa,SAAS,IAAI;EACtD,KAAK,UAAU,MACb,SACA;GACE,QAAQ;GACR,SAAS,EAAE,SAAS;GACpB,OAAO;IACL,iBAAiB,gBACf,KAAK,oBAAoB,WAAW;IACtC,OAAO;IACP,eAAe;IACf,mBAAmB;GACrB;EACF,GACA,EAAE,mBAAmB,cAAc,CACrC;CACF;CAmBA,MAAc,QACZ,YACA,aACgC;EAChC,MAAM,cAAc,KAAK,WAAW,YAAY,WAAW;EAC3D,MAAM,MAAM,YAAY,SAAS;EAEjC,KAAK,eAAe,aAAa,WAAW;EAE5C,IAAI,UAAU,MACZ;GACE,GAAG,KAAK;GACR,UAAU,KAAK;EACjB,GACA,aACA,EAAE,mBAAmB,cAAc,CACrC;EAEA,MAAM,SAAS,QAAQ,OAAO,YAAY;EAC1C,MAAM,eAAe,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,MAAM;EAEpD,OAAO,MAAM,iBAAiB,OAAO,YAAY,EAAE,GAAG,KAAK;EAE3D,oBAAoB,OAAO;EAE3B,IAAI,YAAY,QAAQ,QAAQ,KAAK,cACnC,QAAQ,WAAW;EAGrB,MAAM,WAAW,iBAAiB,KAAK,OAAO;EAC9C,UAAU,cAAc,KAAK,SAAS,QAAQ;EAC9C,IAAI,QAAQ,YAAY,OAAO;GAC7B,OAAO,MAAM,kDAAkD,KAAK;GACpE,MAAM,IAAI,MAAM,aAAa;EAC/B;EACA,UAAU,mBAAmB,OAAO;EACpC,MAAM,UAAU,QAAQ,WAAW;EACnC,QAAQ,UAAU;EAElB,IAAI;EACJ,IAAI,gBAAgB,QAAQ,eAC1B,gBAAgB,QAAQ;EAG1B,MAAM,cACJ,CAAC,QAAQ,IAAI,oCACb,CAAC,iBACD,QAAQ,aAAa,SACrB,eACI,KACE,OAAO,KAAK,UAAU;GACpB;GACA,SAAS,QAAQ;GACjB;EACF,CAAC,GACH,IACA;EAEN,IAAI,aAAoD;EAGxD,IAAI,aAAa;GACf,aAAaA,IAAa,WAAW;;GAGrC,IAAI,cAAc,CAAC,eACjB,uBAAuB,MAAM,GAAG;EAEpC;;EAGA,IAAI,CAAC,YAAY;GACf,IAAI,eACF,MAAM,cAAc,gBAAgB,QAAQ,KAAK,OAAO;GAG1D,MAAM,YAAY,KAAK,IAAI;GAC3B,MAAM,WAAoB,YAAY;IACpC,IAAI;IACJ,IAAI,cACF,cAAc,MAAM,YAClB,GAAG,QAAQ,OAAO,GAAG,OACrB,cACA,UAAU,CACZ;IAEF,IAAI;KACF,MAAM,iBAAiB,MAAM,eAAe,aAC1C,QAAQ,QACR,GACF;KACA,IAAI,gBACF,OAAO;KAGT,MAAM,UAAU,KAAK,IAAI,IAAI;KAC7B,OAAO,MAAM,KAAK,KAAK,kBAAkB,OAAO,GAAG,EACjD,QACF,CAAC;IACH,UAAU;KACR,cAAc;IAChB;GACF;GAEA,MAAM,WAAW,YAAY,GAAG;GAChC,MAAM,gBAAgB,iBAAiB,SAAS,IAAI,QAAQ,IAAI;GAEhE,MAAM,QAAQ,SAAS,GAAG;GAC1B,MAAM,aAAa,cAAc,MAAM,IAAI,aAAa,IAAI;GAE5D,MAAM,EAAE,gBAAgB,OAAO;GAC/B,aAAa,cAAc,YAAY,KAAK,eAAe,aAAa;GAExE,IAAI,aACF,IAAa,aAAa,UAAU;EAExC;EAEA,IAAI;GACF,MAAM,MAAM,MAAM;GAClB,MAAM,iBAAiB,CAAC,CAAC,eAAe,IAAI,eAAe;GAC3D,MAAM,UAAU,aAAa,KAAK,cAAc;GAChD,QAAQ,gBAAgB,CAAC,CAAC,SAAS,SAAS;GAE5C,KAAK,eAAe,aAAa,OAAO;GAExC,IAAI,eACF,OAAO,MAAM,cAAc,mBAAmB,QAAQ,KAAK,OAAO;GAGpE,OAAO;EACT,SAAS,KAAK;GACZ,MAAM,EAAE,cAAc,2BAA2B;GACjD,IAAI,gBAAgB,CAAC,wBAAwB,SAAS,IAAI,UAAU,GAClE,MAAM,IAAI,kBAAkB,GAAG;GAGjC,MAAM,gBAAgB,MAAM,eAAe,aAEzC,QAAQ,KAAK,IAAI;GACnB,IAAI,eAAe;IACjB,OAAO,MACL,EAAE,IAAI,GACN,oDAAoD,KACtD;IACA,OAAO;GACT;GAEA,KAAK,YAAY,YAAY,aAAa,GAAG;EAC/C;CACF;CAEA,kBAAiD,SAAe;EAC9D,OAAO,UAAU,SAAS,KAAK,aAAa,CAAC;CAC/C;;;;;CAMA,eAA4C;EAC1C,OAAO;GAAC;GAAW;GAAiB;EAAU;CAChD;CAEA,eAAyB,MAAW,UAAqC,CAEzE;CAEA,YACE,MACA,cACA,KACO;EACP,MAAM;CACR;CAEA,eAAyB,MAAW,MAAmC,CAEvE;CAEA,WAAW,YAA0B,SAA4B;EAC/D,IAAI,MAAM;EAEV,IAAI,eAAe,KAEjB,OAAO;EAGT,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,SACF,MAAM,eAAe,SAAS,GAAG;EAGnC,MAAM,YAAY,SAAS,GAAG;EAC9B,IAAI,CAAC,aAAa,CAAC,UAAU,SAAS,GAAG;GACvC,OAAO,MACL;IAAE,KAAK;IAAY;IAAS,aAAa;GAAI,GAC7C,iCACF;GACA,MAAM,IAAI,MAAM,aAAa;EAC/B;EACA,OAAO;CACT;CAEA,oBAA8B,EAAE,iBAAsC;EACpE,OAAO;CACT;CAEA,IACE,KACA,UAAuB,CAAC,GACoB;EAC5C,OAAO,KAAK,QAAQ,KAAK,OAAO;CAClC;CAEA,KAAK,KAAa,UAAuB,CAAC,GAAiC;EAEzE,OAAO,KAAK,QAAQ,KAAK;GACvB,GAAG;GACH,cAAc;GACd,QAAQ;EACV,CAAC;CACH;CAEA,QAAQ,KAAmB,UAAuB,CAAC,GAA0B;EAC3E,OAAO,KAAK,QAAQ,KAAK;GAAE,GAAG;GAAS,cAAc;EAAO,CAAC;CAC/D;CAEA,UACE,KACA,UAAuB,CAAC,GACW;EACnC,OAAO,KAAK,QAAQ,KAAK;GAAE,GAAG;GAAS,cAAc;EAAS,CAAC;CACjE;CAEA,kBACE,QACA,EAAE,KAAK,aAAa,kBACS;EAC7B,MAAM,EAAE,MAAM,MAAM,GAAG,gBAAgB,EAAE,GAAG,eAAe;EAC3D,MAAM,OAA4B;GAChC,GAAG;GACH;EACF;EAEA,KAAK,UAAU;GACb,QAAQ;GACR,GAAG,KAAK;EACV;EACA,IAAI,MACF,KAAK,OAAO;EAEd,OAAO,KAAK,QAAc,KAAK;GAAE,GAAG;GAAM,cAAc;EAAO,CAAC;CAClE;CAEA,MAAc,YAIZ,QACA,SAC6B;EAC7B,MAAM,MAAM,MAAM,KAAK,kBAAwB,QAAQ,OAAO;EAE9D,IAAI,QAAQ,QACV,IAAI,OAAO,MAAM,QAAQ,OAAO,WAAW,IAAI,IAAI;EAGrD,OAAO;CACT;CAEA,YACE,MACA,MACA,MACqC;EACrC,MAAM,MAA2C,EAAE,KAAK,KAAK;EAE7D,IAAI,gBAAgB,SAClB,IAAI,SAAS;OACR,IAAI,MACT,IAAI,cAAc;EAGpB,IAAI,MACF,IAAI,SAAS;EAGf,OAAO;CACT;CAEA,MAAM,SAAS,KAAa,SAAuC;EACjE,MAAM,MAAM,aAAa,OAAO;EAChC,OAAO,MAAM,KAAK,QAAQ,KAAK;GAC7B,SAAS,EACP,QAAQ,aACV;GACA,GAAG;EACL,CAAC;CACH;;;;CAKA,MAAM,iBACJ,KACA,SAC6B;EAC7B,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO;EAC3C,MAAM,OAAO,gBAAsB,IAAI,IAAI;EAC3C,OAAO;GAAE,GAAG;GAAK;EAAK;CACxB;CAWA,MAAM,QACJ,MACA,MACA,MACwC;EACxC,MAAM,MAAM;EACZ,IAAI;EACJ,IAAI;EACJ,IAAI,MAAM;GACR,SAAS;GACT,cAAc;EAChB,OACE,SAAS;EAGX,MAAM,OAA4B;GAChC,GAAG;GACH,QAAQ;EACV;EAEA,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EACxC,MAAM,OAAO,MAAM,OAAO,WAAW,gBAAgB,IAAI,IAAI,CAAC;EAC9D,OAAO;GAAE,GAAG;GAAK;EAAK;CACxB;CAcA,YAIE,MACA,MACA,MACkC;EAClC,MAAM,MAAM;EACZ,IAAI;EACJ,IAAI;EACJ,IAAI,MAAM;GACR,SAAS;GACT,cAAc;EAChB,OACE,SAAS;EAGX,IAAI;EACJ,IAAI,aACF,MAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,aAAa,MAAM,CAAC;OAExD,MAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,MAAM,CAAC;EAG7C,OAAO,IAAI,WAAW,aAAa,OAAO,GAAG,SAAS,IAAI,CAAC;CAC7D;;;;;;;;;;;CAYA,iBACE,KACA,SAC6B;EAC7B,OAAO,KAAK,YAAkB,OAAO;GAAE;GAAK,aAAa;EAAQ,CAAC;CACpE;CAkBA,QACE,MACA,MACA,MACwC;EACxC,MAAM,OAAO,KAAK,YAA6B,MAAM,MAAM,IAAI;EAC/D,OAAO,KAAK,YAA6B,OAAO,IAAI;CACtD;CAkBA,YACE,MACA,MACA,MACkC;EAClC,MAAM,OAAO,KAAK,YAAkB,MAAM,MAAM,IAAI;EACpD,OAAO,OAAO,KAAK,KAAK,YAAkB,OAAO,IAAI,CAAC,CAAC,CAAC,WACrD,aAAa,OAAO,GAAG,SAAS,IAAI,CACvC;CACF;;;;CAKA,SAAS,KAAa,aAAsD;EAC1E,OAAO,KAAK,YAAmB,QAAQ;GAAE;GAAK;EAAY,CAAC;CAC7D;CAYA,SACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAY,MAAM,MAAM,IAAI;EAC9C,OAAO,KAAK,YAAe,QAAQ,IAAI;CACzC;CAYA,QACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAe,MAAM,MAAM,IAAI;EACjD,OAAO,KAAK,YAAe,OAAO,IAAI;CACxC;CAYA,UACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAY,MAAM,MAAM,IAAI;EAC9C,OAAO,KAAK,YAAe,SAAS,IAAI;CAC1C;CAYA,WACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAY,MAAM,MAAM,IAAI;EAC9C,OAAO,KAAK,YAAe,UAAU,IAAI;CAC3C;CAEA,OAAO,KAAa,SAA8C;EAChE,IAAI,kBAGA;GACF,GAAG,KAAK;GACR,UAAU,KAAK;GACf,GAAG;GACH,QAAQ;EACV;EAEA,MAAM,cAAc,KAAK,WAAW,KAAK,OAAO,CAAC,CAAC,SAAS;EAE3D,oBAAoB,eAAe;;EAGnC,IACE,YAAY,gBAAgB,QAAQ,KACpC,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,gBAAgB,MAAM,GAE/C,gBAAgB,WAAW;EAG7B,MAAM,WAAW,iBAAiB,KAAK,eAAe;EACtD,kBAAkB,cAAc,aAAa,iBAAiB,QAAQ;EACtE,IAAI,gBAAgB,YAAY,OAC9B,MAAM,IAAI,MAAM,aAAa;EAE/B,kBAAkB,mBAAmB,eAAe;EAEpD,OAAO,OAAO,aAAa,KAAK,kBAAkB,eAAe,CAAC;CACpE;CAWA,MAAM,QACJ,MACA,MACA,MACwC;EACxC,MAAM,EAAE,KAAK,QAAQ,gBAAgB,KAAK,YACxC,MACA,MACA,IACF;EAEA,MAAM,OAA4B;GAChC,GAAG;GACH,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,GAAG,aAAa;GAClB;EACF;EAEA,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EACxC,IAAI,QACF,IAAI,OAAO,MAAM,KAAK,KAAK,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI;OAEtD,IAAI,OAAQ,MAAM,KAAK,WAAW,IAAI,IAAI;EAG5C,OAAO;CACT;AACF"}
+{"version":3,"file":"http.js","names":["memCache.get"],"sources":["../../../lib/util/http/http.ts"],"sourcesContent":["import { isPlainObject, isUndefined } from '@sindresorhus/is';\nimport merge from 'deepmerge';\nimport type { Options, OptionsInit, RetryObject } from 'got';\nimport type { SetRequired } from 'type-fest';\nimport type { z } from 'zod/v4';\nimport { ZodType } from 'zod/v4';\nimport { GlobalConfig } from '../../config/global.ts';\nimport { HOST_DISABLED } from '../../constants/error-messages.ts';\nimport { logger } from '../../logger/index.ts';\nimport { ExternalHostError } from '../../types/errors/external-host-error.ts';\nimport type { CombinedHostRule } from '../../types/index.ts';\nimport { coerceArray } from '../array.ts';\nimport * as memCache from '../cache/memory/index.ts';\nimport { getEnv } from '../env.ts';\nimport { hash } from '../hash.ts';\nimport { acquireLock } from '../mutex.ts';\nimport { coerceObject } from '../object.ts';\nimport { type AsyncResult, Result } from '../result.ts';\nimport { Toml } from '../schema-utils/index.ts';\nimport { ObsoleteCacheHitLogger } from '../stats.ts';\nimport { compile } from '../template/index.ts';\nimport { isHttpUrl, parseUrl, resolveBaseUrl } from '../url.ts';\nimport { parseSingleYaml } from '../yaml.ts';\nimport { applyAuthorization } from './auth.ts';\nimport type { HttpCacheProvider } from './cache/types.ts';\nimport { fetch, normalize, stream } from './got.ts';\nimport { applyHostGuard } from './host-guard.ts';\nimport { applyHostRule, findMatchingRule } from './host-rules.ts';\nimport { getQueue } from './queue.ts';\nimport { getRetryAfter, wrapWithRetry } from './retry-after.ts';\nimport { getThrottle } from './throttle.ts';\nimport type {\n  GotOptions,\n  GotTask,\n  HttpMethod,\n  HttpOptions,\n  HttpResponse,\n  SafeJsonError,\n} from './types.ts';\nimport { copyResponse } from './util.ts';\n\nexport interface InternalJsonUnsafeOptions<\n  Opts extends HttpOptions = HttpOptions,\n> {\n  url: string | URL;\n  httpOptions?: Opts;\n}\n\nexport interface InternalJsonOptions<\n  Opts extends HttpOptions,\n  ResT = unknown,\n  Schema extends ZodType<ResT, any> = ZodType<ResT, any>,\n> extends InternalJsonUnsafeOptions<Opts> {\n  schema?: Schema;\n}\n\nexport type InternalGotOptions = SetRequired<GotOptions, 'method' | 'context'>;\n\nexport interface InternalHttpOptions extends HttpOptions {\n  json?: HttpOptions['body'];\n\n  method?: HttpMethod;\n\n  parseJson?: Options['parseJson'];\n}\n\nexport function applyDefaultHeaders(options: OptionsInit): void {\n  const userAgentTemplate = GlobalConfig.get('userAgent');\n  options.headers = {\n    ...options.headers,\n    'user-agent': compile(userAgentTemplate, {}),\n  };\n}\n\nexport abstract class HttpBase<\n  JSONOpts extends HttpOptions = HttpOptions,\n  Opts extends HttpOptions = HttpOptions,\n> {\n  private readonly options: InternalGotOptions;\n\n  protected get baseUrl(): string | undefined {\n    return undefined;\n  }\n\n  protected hostType: string;\n\n  constructor(hostType: string, options: HttpOptions = {}) {\n    this.hostType = hostType;\n    const retryLimit = getEnv().NODE_ENV === 'test' ? 0 : 2;\n    this.options = merge<InternalGotOptions>(\n      options,\n      {\n        method: 'get',\n        context: { hostType },\n        retry: {\n          calculateDelay: (retryObject) =>\n            this.calculateRetryDelay(retryObject),\n          limit: retryLimit,\n          maxRetryAfter: 0, // Don't rely on `got` retry-after handling, just let it fail and then we'll handle it\n          enforceRetryRules: false,\n        },\n      },\n      { isMergeableObject: isPlainObject },\n    );\n  }\n\n  /**\n   * Builds the final got options for a request to a given `url`\n   *\n   * This merges instance options, applies default headers, host rules and authorization, and rejects requests to disabled hosts.\n   *\n   * Both the `request()` and `stream()` paths must use this single entry point so that policy applied here covers every outbound request.\n   */\n  private prepareOptions(\n    resolvedUrl: URL,\n    httpOptions: InternalHttpOptions,\n  ): {\n    options: InternalGotOptions & InternalHttpOptions;\n    hostRule: CombinedHostRule;\n  } {\n    const url = resolvedUrl.toString();\n\n    let options = merge<InternalGotOptions, InternalHttpOptions>(\n      {\n        ...this.options,\n        hostType: this.hostType,\n      },\n      httpOptions,\n      { isMergeableObject: isPlainObject },\n    );\n\n    applyDefaultHeaders(options);\n\n    if (\n      isUndefined(options.readOnly) &&\n      ['head', 'get'].includes(options.method.toLowerCase())\n    ) {\n      options.readOnly = true;\n    }\n\n    const hostRule = findMatchingRule(url, options);\n    options = applyHostRule(url, options, hostRule);\n    if (options.enabled === false) {\n      logger.debug(`Host is disabled - rejecting request. HostUrl: ${url}`);\n      throw new Error(HOST_DISABLED);\n    }\n    options = applyAuthorization(options);\n\n    // enforced here so it runs before anything else - including cache lookups - can act on the URL, and for the stream path too\n    const guard = applyHostGuard(\n      resolvedUrl,\n      options.hostType,\n      hostRule.internalHostGrant,\n      options.responseBecomesConfig,\n    );\n    options.dnsLookup = guard.dnsLookup;\n    options.hooks = {\n      ...options.hooks,\n      beforeRedirect: [\n        ...coerceArray(options.hooks?.beforeRedirect),\n        guard.beforeRedirect,\n      ],\n    };\n    if (guard.beforeRequest) {\n      options.hooks.beforeRequest = [\n        ...coerceArray(options.hooks.beforeRequest),\n        guard.beforeRequest,\n      ];\n    }\n\n    return { options, hostRule };\n  }\n\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions,\n  ): Promise<HttpResponse>;\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions & { responseType: 'text' },\n  ): Promise<HttpResponse>;\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions & { responseType: 'buffer' },\n  ): Promise<HttpResponse<Uint8Array>>;\n  private async request<T = unknown>(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions & { responseType: 'json' },\n  ): Promise<HttpResponse<T>>;\n\n  private async request(\n    requestUrl: string | URL,\n    httpOptions: InternalHttpOptions,\n  ): Promise<HttpResponse<unknown>> {\n    const resolvedUrl = this.resolveUrl(requestUrl, httpOptions);\n    const url = resolvedUrl.toString();\n\n    this.processOptions(resolvedUrl, httpOptions);\n\n    const { options, hostRule } = this.prepareOptions(resolvedUrl, httpOptions);\n\n    const method = options.method.toLowerCase();\n    const isReadMethod = ['head', 'get'].includes(method);\n\n    logger.trace(`HTTP request: ${method.toUpperCase()} ${url}`);\n\n    const timeout = options.timeout ?? 60000;\n    options.timeout = timeout;\n\n    let cacheProvider: HttpCacheProvider | undefined;\n    if (isReadMethod && options.cacheProvider) {\n      cacheProvider = options.cacheProvider;\n    }\n\n    const memCacheKey =\n      !process.env.RENOVATE_X_DISABLE_HTTP_MEMCACHE &&\n      !cacheProvider &&\n      options.memCache !== false &&\n      isReadMethod\n        ? hash(\n            `got-${JSON.stringify({\n              url,\n              headers: options.headers,\n              method,\n            })}`,\n          )\n        : null;\n\n    let resPromise: Promise<HttpResponse<unknown>> | null = null;\n\n    // Cache GET requests unless memCache=false\n    if (memCacheKey) {\n      resPromise = memCache.get(memCacheKey);\n\n      /* v8 ignore next: temporary code */\n      if (resPromise && !cacheProvider) {\n        ObsoleteCacheHitLogger.write(url);\n      }\n    }\n\n    // v8 ignore else -- TODO: add test #40625\n    if (!resPromise) {\n      if (cacheProvider) {\n        await cacheProvider.setCacheHeaders(method, url, options);\n      }\n\n      const startTime = Date.now();\n      const httpTask: GotTask = async () => {\n        let releaseLock: undefined | (() => void);\n        if (isReadMethod) {\n          releaseLock = await acquireLock(\n            `${options.method} ${url}`,\n            'http-mutex',\n            timeout * 2,\n          );\n        }\n        try {\n          const cachedResponse = await cacheProvider?.bypassServer<unknown>(\n            options.method,\n            url,\n          );\n          if (cachedResponse) {\n            return cachedResponse;\n          }\n\n          const queueMs = Date.now() - startTime;\n          return fetch(url, this._normalizeOptions(options), {\n            queueMs,\n          });\n        } finally {\n          releaseLock?.();\n        }\n      };\n\n      const throttle = getThrottle(url);\n      const throttledTask = throttle ? () => throttle.add(httpTask) : httpTask;\n\n      const queue = getQueue(url);\n      const queuedTask = queue ? () => queue.add(throttledTask) : throttledTask;\n\n      const { maxRetryAfter = 60 } = hostRule;\n      resPromise = wrapWithRetry(queuedTask, url, getRetryAfter, maxRetryAfter);\n\n      if (memCacheKey) {\n        memCache.set(memCacheKey, resPromise);\n      }\n    }\n\n    try {\n      const res = await resPromise;\n      const deepCopyNeeded = !!memCacheKey && res.statusCode !== 304;\n      const resCopy = copyResponse(res, deepCopyNeeded);\n      resCopy.authorization = !!options?.headers?.authorization;\n\n      this.handleResponse(resolvedUrl, resCopy);\n\n      if (cacheProvider) {\n        return await cacheProvider.wrapServerResponse(method, url, resCopy);\n      }\n\n      return resCopy;\n    } catch (err) {\n      const { abortOnError, abortIgnoreStatusCodes } = options;\n      if (abortOnError && !abortIgnoreStatusCodes?.includes(err.statusCode)) {\n        throw new ExternalHostError(err);\n      }\n\n      const staleResponse = await cacheProvider?.bypassServer<\n        string | Uint8Array\n      >(method, url, true);\n      if (staleResponse) {\n        logger.debug(\n          { err },\n          `Request error: returning stale cache instead for ${url}`,\n        );\n        return staleResponse;\n      }\n\n      this.handleError(requestUrl, httpOptions, err);\n    }\n  }\n\n  private _normalizeOptions<T extends OptionsInit>(options: T): T {\n    return normalize(options, this.extraOptions());\n  }\n\n  /**\n   * Returns Renovate extra options which needs to be removed before passing to got.\n   * @returns extra Renovate options.\n   */\n  protected extraOptions(): readonly string[] {\n    return [\n      'baseUrl',\n      'cacheProvider',\n      'readOnly',\n      'responseBecomesConfig',\n    ] as (keyof HttpOptions)[];\n  }\n\n  protected processOptions(_url: URL, _options: InternalHttpOptions): void {\n    // noop\n  }\n\n  protected handleError(\n    _url: string | URL,\n    _httpOptions: HttpOptions,\n    err: Error,\n  ): never {\n    throw err;\n  }\n\n  protected handleResponse(_url: URL, _res: HttpResponse<unknown>): void {\n    // noop\n  }\n\n  resolveUrl(requestUrl: string | URL, options?: HttpOptions): URL {\n    let url = requestUrl;\n\n    if (url instanceof URL) {\n      // already a aboslute URL\n      return url;\n    }\n\n    const baseUrl = options?.baseUrl ?? this.baseUrl;\n    if (baseUrl) {\n      url = resolveBaseUrl(baseUrl, url);\n    }\n\n    const parsedUrl = parseUrl(url);\n    if (!parsedUrl || !isHttpUrl(parsedUrl)) {\n      logger.error(\n        { url: requestUrl, baseUrl, resolvedUrl: url },\n        'Request Error: cannot parse url',\n      );\n      throw new Error('Invalid URL');\n    }\n    return parsedUrl;\n  }\n\n  protected calculateRetryDelay({ computedValue }: RetryObject): number {\n    return computedValue;\n  }\n\n  get(\n    url: string,\n    options: HttpOptions = {},\n  ): Promise<HttpResponse<string | Uint8Array>> {\n    return this.request(url, options);\n  }\n\n  head(url: string, options: HttpOptions = {}): Promise<HttpResponse<never>> {\n    // to complex to validate\n    return this.request(url, {\n      ...options,\n      responseType: 'text',\n      method: 'head',\n    }) as Promise<HttpResponse<never>>;\n  }\n\n  getText(url: string | URL, options: HttpOptions = {}): Promise<HttpResponse> {\n    return this.request(url, { ...options, responseType: 'text' });\n  }\n\n  getBuffer(\n    url: string | URL,\n    options: HttpOptions = {},\n  ): Promise<HttpResponse<Uint8Array>> {\n    return this.request(url, { ...options, responseType: 'buffer' });\n  }\n\n  protected requestJsonUnsafe<ResT>(\n    method: HttpMethod,\n    { url, httpOptions: requestOptions }: InternalJsonUnsafeOptions<JSONOpts>,\n  ): Promise<HttpResponse<ResT>> {\n    const { body: json, ...httpOptions } = { ...requestOptions };\n    const opts: InternalHttpOptions = {\n      ...httpOptions,\n      method,\n    };\n    // signal that we expect a json response\n    opts.headers = {\n      accept: 'application/json',\n      ...opts.headers,\n    };\n    if (json) {\n      opts.json = json;\n    }\n    return this.request<ResT>(url, { ...opts, responseType: 'json' });\n  }\n\n  private async requestJson<\n    ResT,\n    Schema extends ZodType<ResT, any> = ZodType<ResT, any>,\n  >(\n    method: HttpMethod,\n    options: InternalJsonOptions<JSONOpts, ResT, Schema>,\n  ): Promise<HttpResponse<ResT>> {\n    const res = await this.requestJsonUnsafe<ResT>(method, options);\n\n    if (options.schema) {\n      res.body = await options.schema.parseAsync(res.body);\n    }\n\n    return res;\n  }\n\n  private resolveArgs<ResT = unknown>(\n    arg1: string,\n    arg2: JSONOpts | ZodType<ResT> | undefined,\n    arg3: ZodType<ResT> | undefined,\n  ): InternalJsonOptions<JSONOpts, ResT> {\n    const res: InternalJsonOptions<JSONOpts, ResT> = { url: arg1 };\n\n    if (arg2 instanceof ZodType) {\n      res.schema = arg2;\n    } else if (arg2) {\n      res.httpOptions = arg2;\n    }\n\n    if (arg3) {\n      res.schema = arg3;\n    }\n\n    return res;\n  }\n\n  async getPlain(url: string, options?: Opts): Promise<HttpResponse> {\n    const opt = coerceObject(options);\n    return await this.getText(url, {\n      headers: {\n        Accept: 'text/plain',\n      },\n      ...opt,\n    });\n  }\n\n  /**\n   * @deprecated use `getYaml` instead\n   */\n  async getYamlUnchecked<ResT>(\n    url: string,\n    options?: Opts,\n  ): Promise<HttpResponse<ResT>> {\n    const res = await this.getText(url, options);\n    const body = parseSingleYaml<ResT>(res.body);\n    return { ...res, body };\n  }\n\n  async getYaml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getYaml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    options: Opts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getYaml<Schema extends ZodType<any, any, any>>(\n    arg1: string,\n    arg2?: Opts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>> {\n    const url = arg1;\n    let schema: Schema;\n    let httpOptions: Opts | undefined;\n    if (arg3) {\n      schema = arg3;\n      httpOptions = arg2 as Opts;\n    } else {\n      schema = arg2 as Schema;\n    }\n\n    const opts: InternalHttpOptions = {\n      ...httpOptions,\n      method: 'get',\n    };\n\n    const res = await this.getText(url, opts);\n    const body = await schema.parseAsync(parseSingleYaml(res.body));\n    return { ...res, body };\n  }\n\n  getYamlSafe<\n    ResT extends NonNullable<unknown>,\n    Schema extends ZodType<ResT> = ZodType<ResT>,\n  >(url: string, schema: Schema): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getYamlSafe<\n    ResT extends NonNullable<unknown>,\n    Schema extends ZodType<ResT> = ZodType<ResT>,\n  >(\n    url: string,\n    options: Opts,\n    schema: Schema,\n  ): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getYamlSafe<\n    ResT extends NonNullable<unknown>,\n    Schema extends ZodType<ResT> = ZodType<ResT>,\n  >(\n    arg1: string,\n    arg2: Opts | Schema,\n    arg3?: Schema,\n  ): AsyncResult<ResT, SafeJsonError> {\n    const url = arg1;\n    let schema: Schema;\n    let httpOptions: Opts | undefined;\n    if (arg3) {\n      schema = arg3;\n      httpOptions = arg2 as Opts;\n    } else {\n      schema = arg2 as Schema;\n    }\n\n    let res: AsyncResult<HttpResponse<ResT>, SafeJsonError>;\n    if (httpOptions) {\n      res = Result.wrap(this.getYaml(url, httpOptions, schema));\n    } else {\n      res = Result.wrap(this.getYaml(url, schema));\n    }\n\n    return res.transform((response) => Result.ok(response.body));\n  }\n\n  /**\n   * Request JSON and return the response without any validation.\n   *\n   * The usage of this method is discouraged, please use `getJson` instead.\n   *\n   * If you're new to Zod schema validation library:\n   * - consult the [documentation of Zod library](https://github.com/colinhacks/zod?tab=readme-ov-file#basic-usage)\n   * - search the Renovate codebase for 'zod' module usage\n   * - take a look at the `schema-utils.ts` file for Renovate-specific schemas and utilities\n   */\n  getJsonUnchecked<ResT = unknown>(\n    url: string,\n    options?: JSONOpts,\n  ): Promise<HttpResponse<ResT>> {\n    return this.requestJson<ResT>('get', { url, httpOptions: options });\n  }\n\n  /**\n   * Request JSON with a Zod schema for the response,\n   * throwing an error if the response is not valid.\n   *\n   * @param url\n   * @param schema Zod schema for the response\n   */\n  getJson<Schema extends ZodType<any, any, any>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  getJson<Schema extends ZodType<any, any, any>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  getJson<Schema extends ZodType<any, any, any>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>> {\n    const args = this.resolveArgs<z.infer<Schema>>(arg1, arg2, arg3);\n    return this.requestJson<z.infer<Schema>>('get', args);\n  }\n\n  /**\n   * Request JSON with a Zod schema for the response,\n   * wrapping response data in a `Result` class.\n   *\n   * @param url\n   * @param schema Zod schema for the response\n   */\n  getJsonSafe<ResT extends NonNullable<unknown>, Schema extends ZodType<ResT>>(\n    url: string,\n    schema: Schema,\n  ): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getJsonSafe<ResT extends NonNullable<unknown>, Schema extends ZodType<ResT>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): AsyncResult<z.infer<Schema>, SafeJsonError>;\n  getJsonSafe<ResT extends NonNullable<unknown>, Schema extends ZodType<ResT>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): AsyncResult<ResT, SafeJsonError> {\n    const args = this.resolveArgs<ResT>(arg1, arg2, arg3);\n    return Result.wrap(this.requestJson<ResT>('get', args)).transform(\n      (response) => Result.ok(response.body),\n    );\n  }\n\n  /**\n   * @deprecated use `head` instead\n   */\n  headJson(url: string, httpOptions?: JSONOpts): Promise<HttpResponse<never>> {\n    return this.requestJson<never>('head', { url, httpOptions });\n  }\n\n  postJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  postJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  postJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  postJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs(arg1, arg2, arg3);\n    return this.requestJson<T>('post', args);\n  }\n\n  putJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  putJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  putJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  putJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs<T>(arg1, arg2, arg3);\n    return this.requestJson<T>('put', args);\n  }\n\n  patchJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  patchJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  patchJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  patchJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs(arg1, arg2, arg3);\n    return this.requestJson<T>('patch', args);\n  }\n\n  deleteJson<T>(url: string, options?: JSONOpts): Promise<HttpResponse<T>>;\n  deleteJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  deleteJson<T, Schema extends ZodType<T> = ZodType<T>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  deleteJson<T = unknown, Schema extends ZodType<T> = ZodType<T>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<T>> {\n    const args = this.resolveArgs(arg1, arg2, arg3);\n    return this.requestJson<T>('delete', args);\n  }\n\n  stream(url: string, options?: HttpOptions): NodeJS.ReadableStream {\n    const resolvedUrl = this.resolveUrl(url, options);\n\n    const { options: combinedOptions } = this.prepareOptions(resolvedUrl, {\n      ...options,\n      method: 'get',\n    });\n\n    return stream(\n      resolvedUrl.toString(),\n      this._normalizeOptions(combinedOptions),\n    );\n  }\n\n  async getToml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    schema?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getToml<Schema extends ZodType<any, any, any>>(\n    url: string,\n    options: JSONOpts,\n    schema: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>>;\n  async getToml<Schema extends ZodType<any, any, any>>(\n    arg1: string,\n    arg2?: JSONOpts | Schema,\n    arg3?: Schema,\n  ): Promise<HttpResponse<z.infer<Schema>>> {\n    const { url, schema, httpOptions } = this.resolveArgs<z.infer<Schema>>(\n      arg1,\n      arg2,\n      arg3,\n    );\n\n    const opts: InternalHttpOptions = {\n      ...httpOptions,\n      method: 'get',\n      headers: {\n        'Content-Type': 'application/toml',\n        ...httpOptions?.headers,\n      },\n    };\n\n    const res = await this.getText(url, opts);\n    if (schema) {\n      res.body = await Toml.pipe(schema).parseAsync(res.body);\n    } else {\n      res.body = (await Toml.parseAsync(res.body)) as z.infer<Schema>;\n    }\n\n    return res as HttpResponse<z.infer<Schema>>;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,SAAgB,oBAAoB,SAA4B;CAC9D,MAAM,oBAAoB,aAAa,IAAI,WAAW;CACtD,QAAQ,UAAU;EAChB,GAAG,QAAQ;EACX,cAAc,QAAQ,mBAAmB,CAAC,CAAC;CAC7C;AACF;AAEA,IAAsB,WAAtB,MAGE;CACA;CAEA,IAAc,UAA8B,CAE5C;CAEA;CAEA,YAAY,UAAkB,UAAuB,CAAC,GAAG;EACvD,KAAK,WAAW;EAChB,MAAM,aAAa,OAAO,CAAC,CAAC,aAAa,SAAS,IAAI;EACtD,KAAK,UAAU,MACb,SACA;GACE,QAAQ;GACR,SAAS,EAAE,SAAS;GACpB,OAAO;IACL,iBAAiB,gBACf,KAAK,oBAAoB,WAAW;IACtC,OAAO;IACP,eAAe;IACf,mBAAmB;GACrB;EACF,GACA,EAAE,mBAAmB,cAAc,CACrC;CACF;;;;;;;;CASA,eACE,aACA,aAIA;EACA,MAAM,MAAM,YAAY,SAAS;EAEjC,IAAI,UAAU,MACZ;GACE,GAAG,KAAK;GACR,UAAU,KAAK;EACjB,GACA,aACA,EAAE,mBAAmB,cAAc,CACrC;EAEA,oBAAoB,OAAO;EAE3B,IACE,YAAY,QAAQ,QAAQ,KAC5B,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,QAAQ,OAAO,YAAY,CAAC,GAErD,QAAQ,WAAW;EAGrB,MAAM,WAAW,iBAAiB,KAAK,OAAO;EAC9C,UAAU,cAAc,KAAK,SAAS,QAAQ;EAC9C,IAAI,QAAQ,YAAY,OAAO;GAC7B,OAAO,MAAM,kDAAkD,KAAK;GACpE,MAAM,IAAI,MAAM,aAAa;EAC/B;EACA,UAAU,mBAAmB,OAAO;EAGpC,MAAM,QAAQ,eACZ,aACA,QAAQ,UACR,SAAS,mBACT,QAAQ,qBACV;EACA,QAAQ,YAAY,MAAM;EAC1B,QAAQ,QAAQ;GACd,GAAG,QAAQ;GACX,gBAAgB,CACd,GAAG,YAAY,QAAQ,OAAO,cAAc,GAC5C,MAAM,cACR;EACF;EACA,IAAI,MAAM,eACR,QAAQ,MAAM,gBAAgB,CAC5B,GAAG,YAAY,QAAQ,MAAM,aAAa,GAC1C,MAAM,aACR;EAGF,OAAO;GAAE;GAAS;EAAS;CAC7B;CAmBA,MAAc,QACZ,YACA,aACgC;EAChC,MAAM,cAAc,KAAK,WAAW,YAAY,WAAW;EAC3D,MAAM,MAAM,YAAY,SAAS;EAEjC,KAAK,eAAe,aAAa,WAAW;EAE5C,MAAM,EAAE,SAAS,aAAa,KAAK,eAAe,aAAa,WAAW;EAE1E,MAAM,SAAS,QAAQ,OAAO,YAAY;EAC1C,MAAM,eAAe,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,MAAM;EAEpD,OAAO,MAAM,iBAAiB,OAAO,YAAY,EAAE,GAAG,KAAK;EAE3D,MAAM,UAAU,QAAQ,WAAW;EACnC,QAAQ,UAAU;EAElB,IAAI;EACJ,IAAI,gBAAgB,QAAQ,eAC1B,gBAAgB,QAAQ;EAG1B,MAAM,cACJ,CAAC,QAAQ,IAAI,oCACb,CAAC,iBACD,QAAQ,aAAa,SACrB,eACI,KACE,OAAO,KAAK,UAAU;GACpB;GACA,SAAS,QAAQ;GACjB;EACF,CAAC,GACH,IACA;EAEN,IAAI,aAAoD;EAGxD,IAAI,aAAa;GACf,aAAaA,IAAa,WAAW;;GAGrC,IAAI,cAAc,CAAC,eACjB,uBAAuB,MAAM,GAAG;EAEpC;;EAGA,IAAI,CAAC,YAAY;GACf,IAAI,eACF,MAAM,cAAc,gBAAgB,QAAQ,KAAK,OAAO;GAG1D,MAAM,YAAY,KAAK,IAAI;GAC3B,MAAM,WAAoB,YAAY;IACpC,IAAI;IACJ,IAAI,cACF,cAAc,MAAM,YAClB,GAAG,QAAQ,OAAO,GAAG,OACrB,cACA,UAAU,CACZ;IAEF,IAAI;KACF,MAAM,iBAAiB,MAAM,eAAe,aAC1C,QAAQ,QACR,GACF;KACA,IAAI,gBACF,OAAO;KAGT,MAAM,UAAU,KAAK,IAAI,IAAI;KAC7B,OAAO,MAAM,KAAK,KAAK,kBAAkB,OAAO,GAAG,EACjD,QACF,CAAC;IACH,UAAU;KACR,cAAc;IAChB;GACF;GAEA,MAAM,WAAW,YAAY,GAAG;GAChC,MAAM,gBAAgB,iBAAiB,SAAS,IAAI,QAAQ,IAAI;GAEhE,MAAM,QAAQ,SAAS,GAAG;GAC1B,MAAM,aAAa,cAAc,MAAM,IAAI,aAAa,IAAI;GAE5D,MAAM,EAAE,gBAAgB,OAAO;GAC/B,aAAa,cAAc,YAAY,KAAK,eAAe,aAAa;GAExE,IAAI,aACF,IAAa,aAAa,UAAU;EAExC;EAEA,IAAI;GACF,MAAM,MAAM,MAAM;GAClB,MAAM,iBAAiB,CAAC,CAAC,eAAe,IAAI,eAAe;GAC3D,MAAM,UAAU,aAAa,KAAK,cAAc;GAChD,QAAQ,gBAAgB,CAAC,CAAC,SAAS,SAAS;GAE5C,KAAK,eAAe,aAAa,OAAO;GAExC,IAAI,eACF,OAAO,MAAM,cAAc,mBAAmB,QAAQ,KAAK,OAAO;GAGpE,OAAO;EACT,SAAS,KAAK;GACZ,MAAM,EAAE,cAAc,2BAA2B;GACjD,IAAI,gBAAgB,CAAC,wBAAwB,SAAS,IAAI,UAAU,GAClE,MAAM,IAAI,kBAAkB,GAAG;GAGjC,MAAM,gBAAgB,MAAM,eAAe,aAEzC,QAAQ,KAAK,IAAI;GACnB,IAAI,eAAe;IACjB,OAAO,MACL,EAAE,IAAI,GACN,oDAAoD,KACtD;IACA,OAAO;GACT;GAEA,KAAK,YAAY,YAAY,aAAa,GAAG;EAC/C;CACF;CAEA,kBAAiD,SAAe;EAC9D,OAAO,UAAU,SAAS,KAAK,aAAa,CAAC;CAC/C;;;;;CAMA,eAA4C;EAC1C,OAAO;GACL;GACA;GACA;GACA;EACF;CACF;CAEA,eAAyB,MAAW,UAAqC,CAEzE;CAEA,YACE,MACA,cACA,KACO;EACP,MAAM;CACR;CAEA,eAAyB,MAAW,MAAmC,CAEvE;CAEA,WAAW,YAA0B,SAA4B;EAC/D,IAAI,MAAM;EAEV,IAAI,eAAe,KAEjB,OAAO;EAGT,MAAM,UAAU,SAAS,WAAW,KAAK;EACzC,IAAI,SACF,MAAM,eAAe,SAAS,GAAG;EAGnC,MAAM,YAAY,SAAS,GAAG;EAC9B,IAAI,CAAC,aAAa,CAAC,UAAU,SAAS,GAAG;GACvC,OAAO,MACL;IAAE,KAAK;IAAY;IAAS,aAAa;GAAI,GAC7C,iCACF;GACA,MAAM,IAAI,MAAM,aAAa;EAC/B;EACA,OAAO;CACT;CAEA,oBAA8B,EAAE,iBAAsC;EACpE,OAAO;CACT;CAEA,IACE,KACA,UAAuB,CAAC,GACoB;EAC5C,OAAO,KAAK,QAAQ,KAAK,OAAO;CAClC;CAEA,KAAK,KAAa,UAAuB,CAAC,GAAiC;EAEzE,OAAO,KAAK,QAAQ,KAAK;GACvB,GAAG;GACH,cAAc;GACd,QAAQ;EACV,CAAC;CACH;CAEA,QAAQ,KAAmB,UAAuB,CAAC,GAA0B;EAC3E,OAAO,KAAK,QAAQ,KAAK;GAAE,GAAG;GAAS,cAAc;EAAO,CAAC;CAC/D;CAEA,UACE,KACA,UAAuB,CAAC,GACW;EACnC,OAAO,KAAK,QAAQ,KAAK;GAAE,GAAG;GAAS,cAAc;EAAS,CAAC;CACjE;CAEA,kBACE,QACA,EAAE,KAAK,aAAa,kBACS;EAC7B,MAAM,EAAE,MAAM,MAAM,GAAG,gBAAgB,EAAE,GAAG,eAAe;EAC3D,MAAM,OAA4B;GAChC,GAAG;GACH;EACF;EAEA,KAAK,UAAU;GACb,QAAQ;GACR,GAAG,KAAK;EACV;EACA,IAAI,MACF,KAAK,OAAO;EAEd,OAAO,KAAK,QAAc,KAAK;GAAE,GAAG;GAAM,cAAc;EAAO,CAAC;CAClE;CAEA,MAAc,YAIZ,QACA,SAC6B;EAC7B,MAAM,MAAM,MAAM,KAAK,kBAAwB,QAAQ,OAAO;EAE9D,IAAI,QAAQ,QACV,IAAI,OAAO,MAAM,QAAQ,OAAO,WAAW,IAAI,IAAI;EAGrD,OAAO;CACT;CAEA,YACE,MACA,MACA,MACqC;EACrC,MAAM,MAA2C,EAAE,KAAK,KAAK;EAE7D,IAAI,gBAAgB,SAClB,IAAI,SAAS;OACR,IAAI,MACT,IAAI,cAAc;EAGpB,IAAI,MACF,IAAI,SAAS;EAGf,OAAO;CACT;CAEA,MAAM,SAAS,KAAa,SAAuC;EACjE,MAAM,MAAM,aAAa,OAAO;EAChC,OAAO,MAAM,KAAK,QAAQ,KAAK;GAC7B,SAAS,EACP,QAAQ,aACV;GACA,GAAG;EACL,CAAC;CACH;;;;CAKA,MAAM,iBACJ,KACA,SAC6B;EAC7B,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO;EAC3C,MAAM,OAAO,gBAAsB,IAAI,IAAI;EAC3C,OAAO;GAAE,GAAG;GAAK;EAAK;CACxB;CAWA,MAAM,QACJ,MACA,MACA,MACwC;EACxC,MAAM,MAAM;EACZ,IAAI;EACJ,IAAI;EACJ,IAAI,MAAM;GACR,SAAS;GACT,cAAc;EAChB,OACE,SAAS;EAGX,MAAM,OAA4B;GAChC,GAAG;GACH,QAAQ;EACV;EAEA,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EACxC,MAAM,OAAO,MAAM,OAAO,WAAW,gBAAgB,IAAI,IAAI,CAAC;EAC9D,OAAO;GAAE,GAAG;GAAK;EAAK;CACxB;CAcA,YAIE,MACA,MACA,MACkC;EAClC,MAAM,MAAM;EACZ,IAAI;EACJ,IAAI;EACJ,IAAI,MAAM;GACR,SAAS;GACT,cAAc;EAChB,OACE,SAAS;EAGX,IAAI;EACJ,IAAI,aACF,MAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,aAAa,MAAM,CAAC;OAExD,MAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,MAAM,CAAC;EAG7C,OAAO,IAAI,WAAW,aAAa,OAAO,GAAG,SAAS,IAAI,CAAC;CAC7D;;;;;;;;;;;CAYA,iBACE,KACA,SAC6B;EAC7B,OAAO,KAAK,YAAkB,OAAO;GAAE;GAAK,aAAa;EAAQ,CAAC;CACpE;CAkBA,QACE,MACA,MACA,MACwC;EACxC,MAAM,OAAO,KAAK,YAA6B,MAAM,MAAM,IAAI;EAC/D,OAAO,KAAK,YAA6B,OAAO,IAAI;CACtD;CAkBA,YACE,MACA,MACA,MACkC;EAClC,MAAM,OAAO,KAAK,YAAkB,MAAM,MAAM,IAAI;EACpD,OAAO,OAAO,KAAK,KAAK,YAAkB,OAAO,IAAI,CAAC,CAAC,CAAC,WACrD,aAAa,OAAO,GAAG,SAAS,IAAI,CACvC;CACF;;;;CAKA,SAAS,KAAa,aAAsD;EAC1E,OAAO,KAAK,YAAmB,QAAQ;GAAE;GAAK;EAAY,CAAC;CAC7D;CAYA,SACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAY,MAAM,MAAM,IAAI;EAC9C,OAAO,KAAK,YAAe,QAAQ,IAAI;CACzC;CAYA,QACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAe,MAAM,MAAM,IAAI;EACjD,OAAO,KAAK,YAAe,OAAO,IAAI;CACxC;CAYA,UACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAY,MAAM,MAAM,IAAI;EAC9C,OAAO,KAAK,YAAe,SAAS,IAAI;CAC1C;CAYA,WACE,MACA,MACA,MAC0B;EAC1B,MAAM,OAAO,KAAK,YAAY,MAAM,MAAM,IAAI;EAC9C,OAAO,KAAK,YAAe,UAAU,IAAI;CAC3C;CAEA,OAAO,KAAa,SAA8C;EAChE,MAAM,cAAc,KAAK,WAAW,KAAK,OAAO;EAEhD,MAAM,EAAE,SAAS,oBAAoB,KAAK,eAAe,aAAa;GACpE,GAAG;GACH,QAAQ;EACV,CAAC;EAED,OAAO,OACL,YAAY,SAAS,GACrB,KAAK,kBAAkB,eAAe,CACxC;CACF;CAWA,MAAM,QACJ,MACA,MACA,MACwC;EACxC,MAAM,EAAE,KAAK,QAAQ,gBAAgB,KAAK,YACxC,MACA,MACA,IACF;EAEA,MAAM,OAA4B;GAChC,GAAG;GACH,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,GAAG,aAAa;GAClB;EACF;EAEA,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EACxC,IAAI,QACF,IAAI,OAAO,MAAM,KAAK,KAAK,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI;OAEtD,IAAI,OAAQ,MAAM,KAAK,WAAW,IAAI,IAAI;EAG5C,OAAO;CACT;AACF"}

package/dist/util/http/types.d.ts

@@ -65,6 +65,12 @@ interface HttpOptions {
   memCache?: boolean;
   cacheProvider?: HttpCacheProvider;
   readOnly?: boolean;
+  /**
+   * The response body becomes Renovate configuration, so an internal host must be permitted by a deliberately-scoped `allowInternal` grant rather than an implicit one - see `applyHostGuard`.
+   *
+   * Set it on any request whose response is interpreted as config, no matter which `hostType` the request is made with.
+   */
+  responseBecomesConfig?: boolean;
 }
 interface HttpHeaders extends IncomingHttpHeaders {
   link?: string | undefined;

package/dist/util/http/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../../lib/util/http/types.ts"],"sourcesContent":["import type { IncomingHttpHeaders } from 'node:http';\nimport type {\n  OptionsInit,\n  OptionsOfBufferResponseBody,\n  OptionsOfJSONResponseBody,\n  OptionsOfTextResponseBody,\n  RequestError,\n} from 'got';\nimport type { ZodError } from 'zod/v4';\nimport type { HttpCacheProvider } from './cache/types.ts';\nimport type { EmptyResultError } from './errors.ts';\n\nexport type GotContextOptions = {\n  authType?: string;\n} & Record<string, unknown>;\n\n// TODO: Move options to context\nexport type GotOptions = GotBufferOptions | GotTextOptions | GotJSONOptions;\nexport type GotBufferOptions = OptionsOfBufferResponseBody & GotExtraOptions;\nexport type GotTextOptions = OptionsOfTextResponseBody & GotExtraOptions;\nexport type GotJSONOptions = OptionsOfJSONResponseBody & GotExtraOptions;\n\nexport type GotStreamOptions = OptionsInit & GotExtraOptions;\n\n/**\n * Renovate extra options.\n */\nexport interface GotExtraOptions {\n  abortOnError?: boolean;\n  abortIgnoreStatusCodes?: number[];\n\n  token?: string;\n  hostType?: string;\n  enabled?: boolean;\n  memCache?: boolean;\n  noAuth?: boolean;\n  context?: GotContextOptions;\n\n  /**\n   * Got request timeout, overrides got interface.\n   * Do not delete in `normalizeGotOptions`.\n   */\n  timeout?: number;\n}\n\n/**\n * Renovate extra options that are not part of `got` options.\n */\nexport const GotExtraOptionKeys: (keyof GotExtraOptions)[] = [\n  'abortOnError',\n  'abortIgnoreStatusCodes',\n  'enabled',\n  'hostType',\n  'memCache',\n  'noAuth',\n  'token',\n];\n\nexport type OutgoingHttpHeaders = Record<string, string | string[] | undefined>;\n\nexport type GraphqlVariables = Record<string, unknown>;\n\nexport interface GraphqlOptions {\n  variables?: GraphqlVariables;\n  paginate?: boolean;\n  count?: number;\n  limit?: number;\n  cursor?: string | null;\n  acceptHeader?: string;\n  token?: string;\n  readOnly?: boolean;\n}\n\n/**\n * Renovate http options that are partly not part of `got` options.\n * Remember to delete these in `normalizeGotOptions` before passing to `got`.\n */\nexport interface HttpOptions {\n  body?: any;\n  username?: string;\n  password?: string;\n  baseUrl?: string;\n  headers?: OutgoingHttpHeaders;\n\n  /**\n   * Do not use authentication\n   */\n  noAuth?: boolean;\n\n  throwHttpErrors?: boolean;\n\n  token?: string;\n  memCache?: boolean;\n  cacheProvider?: HttpCacheProvider;\n  readOnly?: boolean;\n}\n\nexport interface HttpHeaders extends IncomingHttpHeaders {\n  link?: string | undefined;\n}\n\nexport type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete' | 'head';\n\nexport interface HttpResponse<T = string> {\n  statusCode: number;\n  body: T;\n  headers: HttpHeaders;\n  authorization?: boolean;\n  cached?: boolean;\n}\n\nexport type Task<T> = () => Promise<T>;\nexport type GotTask<T = unknown> = Task<HttpResponse<T>>;\n\nexport interface ThrottleLimitRule {\n  matchHost: string;\n  throttleMs: number;\n}\n\nexport interface ConcurrencyLimitRule {\n  matchHost: string;\n  concurrency: number;\n}\n\nexport type SafeJsonError = RequestError | ZodError | EmptyResultError;\n"],"mappings":";;;;AAgDA,MAAa,qBAAgD;CAC3D;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"types.js","names":[],"sources":["../../../lib/util/http/types.ts"],"sourcesContent":["import type { IncomingHttpHeaders } from 'node:http';\nimport type {\n  OptionsInit,\n  OptionsOfBufferResponseBody,\n  OptionsOfJSONResponseBody,\n  OptionsOfTextResponseBody,\n  RequestError,\n} from 'got';\nimport type { ZodError } from 'zod/v4';\nimport type { HttpCacheProvider } from './cache/types.ts';\nimport type { EmptyResultError } from './errors.ts';\n\nexport type GotContextOptions = {\n  authType?: string;\n} & Record<string, unknown>;\n\n// TODO: Move options to context\nexport type GotOptions = GotBufferOptions | GotTextOptions | GotJSONOptions;\nexport type GotBufferOptions = OptionsOfBufferResponseBody & GotExtraOptions;\nexport type GotTextOptions = OptionsOfTextResponseBody & GotExtraOptions;\nexport type GotJSONOptions = OptionsOfJSONResponseBody & GotExtraOptions;\n\nexport type GotStreamOptions = OptionsInit & GotExtraOptions;\n\n/**\n * Renovate extra options.\n */\nexport interface GotExtraOptions {\n  abortOnError?: boolean;\n  abortIgnoreStatusCodes?: number[];\n\n  token?: string;\n  hostType?: string;\n  enabled?: boolean;\n  memCache?: boolean;\n  noAuth?: boolean;\n  context?: GotContextOptions;\n\n  /**\n   * Got request timeout, overrides got interface.\n   * Do not delete in `normalizeGotOptions`.\n   */\n  timeout?: number;\n}\n\n/**\n * Renovate extra options that are not part of `got` options.\n */\nexport const GotExtraOptionKeys: (keyof GotExtraOptions)[] = [\n  'abortOnError',\n  'abortIgnoreStatusCodes',\n  'enabled',\n  'hostType',\n  'memCache',\n  'noAuth',\n  'token',\n];\n\nexport type OutgoingHttpHeaders = Record<string, string | string[] | undefined>;\n\nexport type GraphqlVariables = Record<string, unknown>;\n\nexport interface GraphqlOptions {\n  variables?: GraphqlVariables;\n  paginate?: boolean;\n  count?: number;\n  limit?: number;\n  cursor?: string | null;\n  acceptHeader?: string;\n  token?: string;\n  readOnly?: boolean;\n}\n\n/**\n * Renovate http options that are partly not part of `got` options.\n * Remember to delete these in `normalizeGotOptions` before passing to `got`.\n */\nexport interface HttpOptions {\n  body?: any;\n  username?: string;\n  password?: string;\n  baseUrl?: string;\n  headers?: OutgoingHttpHeaders;\n\n  /**\n   * Do not use authentication\n   */\n  noAuth?: boolean;\n\n  throwHttpErrors?: boolean;\n\n  token?: string;\n  memCache?: boolean;\n  cacheProvider?: HttpCacheProvider;\n  readOnly?: boolean;\n\n  /**\n   * The response body becomes Renovate configuration, so an internal host must be permitted by a deliberately-scoped `allowInternal` grant rather than an implicit one - see `applyHostGuard`.\n   *\n   * Set it on any request whose response is interpreted as config, no matter which `hostType` the request is made with.\n   */\n  responseBecomesConfig?: boolean;\n}\n\nexport interface HttpHeaders extends IncomingHttpHeaders {\n  link?: string | undefined;\n}\n\nexport type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete' | 'head';\n\nexport interface HttpResponse<T = string> {\n  statusCode: number;\n  body: T;\n  headers: HttpHeaders;\n  authorization?: boolean;\n  cached?: boolean;\n}\n\nexport type Task<T> = () => Promise<T>;\nexport type GotTask<T = unknown> = Task<HttpResponse<T>>;\n\nexport interface ThrottleLimitRule {\n  matchHost: string;\n  throttleMs: number;\n}\n\nexport interface ConcurrencyLimitRule {\n  matchHost: string;\n  concurrency: number;\n}\n\nexport type SafeJsonError = RequestError | ZodError | EmptyResultError;\n"],"mappings":";;;;AAgDA,MAAa,qBAAgD;CAC3D;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/util/http/util.js

@@ -1,3 +1,4 @@
+import "../../constants/error-messages.js";
 import { clone } from "../clone.js";
 //#region lib/util/http/util.ts
 function copyResponse({ statusCode, headers, body, cached }, deep) {
@@ -13,7 +14,15 @@ function copyResponse({ statusCode, headers, body, cached }, deep) {
 	if (cached) res.cached = true;
 	return res;
 }
+/**
+* The log message for a request the HTTP layer refused, distinguishing a host blocked by the internal-host policy from one an administrator disabled.
+*
+* Both are reported the same way by their callers - traced and swallowed - so only the wording tells them apart in the logs.
+*/
+function refusedHostMessage(err) {
+	return err.message === "host-blocked" ? "Host blocked" : "Host disabled";
+}
 //#endregion
-export { copyResponse };
+export { copyResponse, refusedHostMessage };
 
 //# sourceMappingURL=util.js.map

package/dist/util/http/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","names":[],"sources":["../../../lib/util/http/util.ts"],"sourcesContent":["import { clone } from '../clone.ts';\nimport type { HttpResponse } from './types.ts';\n\n// Copying will help to avoid circular structure\n// and mutation of the cached response.\nexport function copyResponse<T>(\n  { statusCode, headers, body, cached }: HttpResponse<T>,\n  deep: boolean,\n): HttpResponse<T> {\n  const res: HttpResponse<T> = { statusCode, headers, body };\n\n  if (deep) {\n    res.headers = clone(headers);\n    res.body =\n      body instanceof Uint8Array ? (body.subarray() as T) : clone<T>(body);\n  }\n\n  if (cached) {\n    res.cached = true;\n  }\n\n  return res;\n}\n"],"mappings":";;AAKA,SAAgB,aACd,EAAE,YAAY,SAAS,MAAM,UAC7B,MACiB;CACjB,MAAM,MAAuB;EAAE;EAAY;EAAS;CAAK;CAEzD,IAAI,MAAM;EACR,IAAI,UAAU,MAAM,OAAO;EAC3B,IAAI,OACF,gBAAgB,aAAc,KAAK,SAAS,IAAU,MAAS,IAAI;CACvE;CAEA,IAAI,QACF,IAAI,SAAS;CAGf,OAAO;AACT"}
+{"version":3,"file":"util.js","names":[],"sources":["../../../lib/util/http/util.ts"],"sourcesContent":["import { HOST_BLOCKED } from '../../constants/error-messages.ts';\nimport { clone } from '../clone.ts';\nimport type { HttpResponse } from './types.ts';\n\n// Copying will help to avoid circular structure\n// and mutation of the cached response.\nexport function copyResponse<T>(\n  { statusCode, headers, body, cached }: HttpResponse<T>,\n  deep: boolean,\n): HttpResponse<T> {\n  const res: HttpResponse<T> = { statusCode, headers, body };\n\n  if (deep) {\n    res.headers = clone(headers);\n    res.body =\n      body instanceof Uint8Array ? (body.subarray() as T) : clone<T>(body);\n  }\n\n  if (cached) {\n    res.cached = true;\n  }\n\n  return res;\n}\n\n/**\n * The log message for a request the HTTP layer refused, distinguishing a host blocked by the internal-host policy from one an administrator disabled.\n *\n * Both are reported the same way by their callers - traced and swallowed - so only the wording tells them apart in the logs.\n */\nexport function refusedHostMessage(err: Error): string {\n  return err.message === HOST_BLOCKED ? 'Host blocked' : 'Host disabled';\n}\n"],"mappings":";;;AAMA,SAAgB,aACd,EAAE,YAAY,SAAS,MAAM,UAC7B,MACiB;CACjB,MAAM,MAAuB;EAAE;EAAY;EAAS;CAAK;CAEzD,IAAI,MAAM;EACR,IAAI,UAAU,MAAM,OAAO;EAC3B,IAAI,OACF,gBAAgB,aAAc,KAAK,SAAS,IAAU,MAAS,IAAI;CACvE;CAEA,IAAI,QACF,IAAI,SAAS;CAGf,OAAO;AACT;;;;;;AAOA,SAAgB,mBAAmB,KAAoB;CACrD,OAAO,IAAI,YAAA,iBAA2B,iBAAiB;AACzD"}

package/dist/workers/repository/init/inherited.js

@@ -1,6 +1,7 @@
 import { CONFIG_INHERIT_NOT_FOUND, CONFIG_INHERIT_PARSE_ERROR, CONFIG_VALIDATION } from "../../../constants/error-messages.js";
 import { coerceObject } from "../../../util/object.js";
 import { setUserConfigFileNames } from "../../../config/app-strings.js";
+import { GlobalConfig } from "../../../config/global.js";
 import { logger } from "../../../logger/index.js";
 import { mergeChildConfig } from "../../../config/utils.js";
 import { InheritConfig } from "../../../config/inherit.js";
@@ -16,6 +17,28 @@ import { applyHostRules } from "./merge.js";
 import { isNonEmptyArray, isNullOrUndefined, isString } from "@sindresorhus/is";
 import { dequal } from "dequal";
 //#region lib/workers/repository/init/inherited.ts
+const inheritedConfigValidationError = "The inherited config contains some invalid settings";
+/**
+* Report an inherited config validation failure against the inherited config, rather than the repository being processed.
+*
+* The inherited config repository is managed by the organization's administrators, so a fault there is not one the repository's owners have introduced - and they may not even be able to read the file to see it.
+*/
+function throwInheritedConfigValidationError(validationSource, errors) {
+	const error = new Error(CONFIG_VALIDATION);
+	error.validationSource = validationSource;
+	error.validationError = inheritedConfigValidationError;
+	error.validationMessage = errors.map((err) => err.message).join(", ");
+	throw error;
+}
+/**
+* How the inherited config's `hostRules` are registered.
+*
+* The inherited config repository is controlled by the organization's administrators rather than by the self-hosted administrator, so its rules are untrusted unless the administrator has opted into trusting them.
+*/
+function inheritedHostRuleOptions() {
+	if (!GlobalConfig.get("inheritConfigTrusted")) return;
+	return { inherited: true };
+}
 async function mergeInheritedConfig(config) {
 	if (!config.repository || !config.inheritConfig) return config;
 	if (!isString(config.inheritConfigRepoName) || !isString(config.inheritConfigFileName)) {
@@ -55,12 +78,13 @@ async function mergeInheritedConfig(config) {
 		logger.debug({ parseResult }, "Error parsing inherited config.");
 		throw new Error(CONFIG_INHERIT_PARSE_ERROR);
 	}
+	const inheritedConfigSource = `Inherited config (\`${config.inheritConfigFileName}\` in \`${inheritConfigRepoName}\`)`;
 	const inheritedConfig = parseResult.parsedContents;
 	logger.debug({ config: inheritedConfig }, `Inherited config`);
 	const res = await validateConfig("inherit", inheritedConfig);
 	if (res.errors.length) {
 		logger.warn({ errors: res.errors }, "Found errors in inherited configuration.");
-		throw new Error(CONFIG_VALIDATION);
+		throwInheritedConfigValidationError(inheritedConfigSource, res.errors);
 	}
 	if (res.warnings.length) logger.warn({ warnings: res.warnings }, "Found warnings in inherited configuration.");
 	if (isNonEmptyArray(inheritedConfig.configFileNames)) {
@@ -80,7 +104,7 @@ async function mergeInheritedConfig(config) {
 			secrets: coerceObject(config.secrets),
 			variables: coerceObject(config.variables)
 		});
-		applyHostRules(filteredConfig);
+		applyHostRules(filteredConfig, inheritedHostRuleOptions());
 		filteredConfig = InheritConfig.set(filteredConfig);
 		return mergeChildConfig(config, filteredConfig);
 	}
@@ -90,7 +114,7 @@ async function mergeInheritedConfig(config) {
 	const validationRes = await validateConfig("inherit", resolvedConfig);
 	if (validationRes.errors.length) {
 		logger.warn({ errors: validationRes.errors }, "Found errors in presets inside the inherited configuration.");
-		throw new Error(CONFIG_VALIDATION);
+		throwInheritedConfigValidationError(inheritedConfigSource, validationRes.errors);
 	}
 	if (validationRes.warnings.length) logger.warn({ warnings: validationRes.warnings }, "Found warnings in presets inside the inherited configuration.");
 	decryptedConfig = await decryptConfig(resolvedConfig, config.repository);
@@ -104,7 +128,7 @@ async function mergeInheritedConfig(config) {
 		secrets: coerceObject(config.secrets),
 		variables: coerceObject(config.variables)
 	});
-	applyHostRules(filteredConfig);
+	applyHostRules(filteredConfig, inheritedHostRuleOptions());
 	filteredConfig = InheritConfig.set(filteredConfig);
 	return mergeChildConfig(config, filteredConfig);
 }

package/dist/workers/repository/init/inherited.js.map

@@ -1 +1 @@
-{"version":3,"file":"inherited.js","names":["template.compile"],"sources":["../../../../lib/workers/repository/init/inherited.ts"],"sourcesContent":["import { isNonEmptyArray, isNullOrUndefined, isString } from '@sindresorhus/is';\nimport { dequal } from 'dequal';\nimport { setUserConfigFileNames } from '../../../config/app-strings.ts';\nimport { decryptConfig } from '../../../config/decrypt.ts';\nimport { mergeChildConfig, removeGlobalConfig } from '../../../config/index.ts';\nimport { InheritConfig } from '../../../config/inherit.ts';\nimport { parseFileConfig } from '../../../config/parse.ts';\nimport { resolveConfigPresets } from '../../../config/presets/index.ts';\nimport { applySecretsAndVariablesToConfig } from '../../../config/secrets.ts';\nimport type { RenovateConfig } from '../../../config/types.ts';\nimport { validateConfig } from '../../../config/validation.ts';\nimport {\n  CONFIG_INHERIT_NOT_FOUND,\n  CONFIG_INHERIT_PARSE_ERROR,\n  CONFIG_VALIDATION,\n} from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { platform } from '../../../modules/platform/index.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport * as template from '../../../util/template/index.ts';\nimport { applyHostRules } from './merge.ts';\n\nexport async function mergeInheritedConfig(\n  config: RenovateConfig,\n): Promise<RenovateConfig> {\n  // typescript doesn't know that repo is defined\n  if (!config.repository || !config.inheritConfig) {\n    return config;\n  }\n  if (\n    !isString(config.inheritConfigRepoName) ||\n    !isString(config.inheritConfigFileName)\n  ) {\n    // Config validation should prevent this error\n    logger.error(\n      {\n        inheritConfigRepoName: config.inheritConfigRepoName,\n        inheritConfigFileName: config.inheritConfigFileName,\n      },\n      'Invalid inherited config.',\n    );\n    return config;\n  }\n  const templateConfig = {\n    topLevelOrg: config.topLevelOrg,\n    parentOrg: config.parentOrg,\n    repository: config.repository,\n  };\n  const inheritConfigRepoName = template.compile(\n    config.inheritConfigRepoName,\n    templateConfig,\n    false,\n  );\n  logger.trace(\n    { templateConfig, inheritConfigRepoName },\n    'Compiled inheritConfigRepoName result.',\n  );\n  logger.debug(\n    `Checking for inherited config file ${config.inheritConfigFileName} in repo ${inheritConfigRepoName}.`,\n  );\n  let configFileRaw: string | null = null;\n  try {\n    configFileRaw = await platform.getRawFile(\n      config.inheritConfigFileName,\n      inheritConfigRepoName,\n    );\n  } catch (err) {\n    if (config.inheritConfigStrict) {\n      logger.debug({ err }, 'Error getting inherited config.');\n      throw new Error(CONFIG_INHERIT_NOT_FOUND);\n    }\n    logger.trace({ err }, `Error getting inherited config.`);\n  }\n  if (!configFileRaw) {\n    logger.debug(`No inherited config found in ${inheritConfigRepoName}.`);\n    return config;\n  }\n  const parseResult = parseFileConfig(\n    config.inheritConfigFileName,\n    configFileRaw,\n  );\n  if (!parseResult.success) {\n    logger.debug({ parseResult }, 'Error parsing inherited config.');\n    throw new Error(CONFIG_INHERIT_PARSE_ERROR);\n  }\n  const inheritedConfig = parseResult.parsedContents as RenovateConfig;\n  logger.debug({ config: inheritedConfig }, `Inherited config`);\n  const res = await validateConfig('inherit', inheritedConfig);\n  if (res.errors.length) {\n    logger.warn(\n      { errors: res.errors },\n      'Found errors in inherited configuration.',\n    );\n    throw new Error(CONFIG_VALIDATION);\n  }\n  if (res.warnings.length) {\n    logger.warn(\n      { warnings: res.warnings },\n      'Found warnings in inherited configuration.',\n    );\n  }\n\n  // set user config file name here\n  if (isNonEmptyArray(inheritedConfig.configFileNames)) {\n    logger.debug(\n      { configFileNames: inheritedConfig.configFileNames },\n      'Updated the config filenames list',\n    );\n    setUserConfigFileNames(inheritedConfig.configFileNames);\n    delete config.configFileNames;\n  }\n\n  let decryptedConfig = await decryptConfig(inheritedConfig, config.repository);\n\n  let filteredConfig = removeGlobalConfig(decryptedConfig, true);\n  if (!dequal(decryptedConfig, filteredConfig)) {\n    logger.debug(\n      { inheritedConfig: decryptedConfig, filteredConfig },\n      'Removed global config from inherited config.',\n    );\n  }\n\n  if (isNullOrUndefined(filteredConfig.extends)) {\n    filteredConfig = applySecretsAndVariablesToConfig({\n      config: filteredConfig,\n      secrets: coerceObject(config.secrets),\n      variables: coerceObject(config.variables),\n    });\n    applyHostRules(filteredConfig);\n    filteredConfig = InheritConfig.set(filteredConfig);\n    return mergeChildConfig(config, filteredConfig);\n  }\n\n  logger.debug('Resolving presets found in inherited config');\n  const { config: resolvedConfig } = await resolveConfigPresets(\n    filteredConfig,\n    config,\n    config.ignorePresets,\n  );\n  logger.trace({ config: resolvedConfig }, 'Resolved inherited config');\n\n  const validationRes = await validateConfig('inherit', resolvedConfig);\n  if (validationRes.errors.length) {\n    logger.warn(\n      { errors: validationRes.errors },\n      'Found errors in presets inside the inherited configuration.',\n    );\n    throw new Error(CONFIG_VALIDATION);\n  }\n  if (validationRes.warnings.length) {\n    logger.warn(\n      { warnings: validationRes.warnings },\n      'Found warnings in presets inside the inherited configuration.',\n    );\n  }\n\n  // decrypt again, as resolved presets could contain encrypted values\n  decryptedConfig = await decryptConfig(resolvedConfig, config.repository);\n\n  // remove global config options once again, as resolved presets could have added some\n  filteredConfig = removeGlobalConfig(decryptedConfig, true);\n  if (!dequal(decryptedConfig, filteredConfig)) {\n    logger.debug(\n      { inheritedConfig: decryptedConfig, filteredConfig },\n      'Removed global config from inherited config presets.',\n    );\n  }\n\n  filteredConfig = applySecretsAndVariablesToConfig({\n    config: filteredConfig,\n    secrets: coerceObject(config.secrets),\n    variables: coerceObject(config.variables),\n  });\n  applyHostRules(filteredConfig);\n  filteredConfig = InheritConfig.set(filteredConfig);\n  return mergeChildConfig(config, filteredConfig);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsBA,eAAsB,qBACpB,QACyB;CAEzB,IAAI,CAAC,OAAO,cAAc,CAAC,OAAO,eAChC,OAAO;CAET,IACE,CAAC,SAAS,OAAO,qBAAqB,KACtC,CAAC,SAAS,OAAO,qBAAqB,GACtC;EAEA,OAAO,MACL;GACE,uBAAuB,OAAO;GAC9B,uBAAuB,OAAO;EAChC,GACA,2BACF;EACA,OAAO;CACT;CACA,MAAM,iBAAiB;EACrB,aAAa,OAAO;EACpB,WAAW,OAAO;EAClB,YAAY,OAAO;CACrB;CACA,MAAM,wBAAwBA,QAC5B,OAAO,uBACP,gBACA,KACF;CACA,OAAO,MACL;EAAE;EAAgB;CAAsB,GACxC,wCACF;CACA,OAAO,MACL,sCAAsC,OAAO,sBAAsB,WAAW,sBAAsB,EACtG;CACA,IAAI,gBAA+B;CACnC,IAAI;EACF,gBAAgB,MAAM,SAAS,WAC7B,OAAO,uBACP,qBACF;CACF,SAAS,KAAK;EACZ,IAAI,OAAO,qBAAqB;GAC9B,OAAO,MAAM,EAAE,IAAI,GAAG,iCAAiC;GACvD,MAAM,IAAI,MAAM,wBAAwB;EAC1C;EACA,OAAO,MAAM,EAAE,IAAI,GAAG,iCAAiC;CACzD;CACA,IAAI,CAAC,eAAe;EAClB,OAAO,MAAM,gCAAgC,sBAAsB,EAAE;EACrE,OAAO;CACT;CACA,MAAM,cAAc,gBAClB,OAAO,uBACP,aACF;CACA,IAAI,CAAC,YAAY,SAAS;EACxB,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAC/D,MAAM,IAAI,MAAM,0BAA0B;CAC5C;CACA,MAAM,kBAAkB,YAAY;CACpC,OAAO,MAAM,EAAE,QAAQ,gBAAgB,GAAG,kBAAkB;CAC5D,MAAM,MAAM,MAAM,eAAe,WAAW,eAAe;CAC3D,IAAI,IAAI,OAAO,QAAQ;EACrB,OAAO,KACL,EAAE,QAAQ,IAAI,OAAO,GACrB,0CACF;EACA,MAAM,IAAI,MAAM,iBAAiB;CACnC;CACA,IAAI,IAAI,SAAS,QACf,OAAO,KACL,EAAE,UAAU,IAAI,SAAS,GACzB,4CACF;CAIF,IAAI,gBAAgB,gBAAgB,eAAe,GAAG;EACpD,OAAO,MACL,EAAE,iBAAiB,gBAAgB,gBAAgB,GACnD,mCACF;EACA,uBAAuB,gBAAgB,eAAe;EACtD,OAAO,OAAO;CAChB;CAEA,IAAI,kBAAkB,MAAM,cAAc,iBAAiB,OAAO,UAAU;CAE5E,IAAI,iBAAiB,mBAAmB,iBAAiB,IAAI;CAC7D,IAAI,CAAC,OAAO,iBAAiB,cAAc,GACzC,OAAO,MACL;EAAE,iBAAiB;EAAiB;CAAe,GACnD,8CACF;CAGF,IAAI,kBAAkB,eAAe,OAAO,GAAG;EAC7C,iBAAiB,iCAAiC;GAChD,QAAQ;GACR,SAAS,aAAa,OAAO,OAAO;GACpC,WAAW,aAAa,OAAO,SAAS;EAC1C,CAAC;EACD,eAAe,cAAc;EAC7B,iBAAiB,cAAc,IAAI,cAAc;EACjD,OAAO,iBAAiB,QAAQ,cAAc;CAChD;CAEA,OAAO,MAAM,6CAA6C;CAC1D,MAAM,EAAE,QAAQ,mBAAmB,MAAM,qBACvC,gBACA,QACA,OAAO,aACT;CACA,OAAO,MAAM,EAAE,QAAQ,eAAe,GAAG,2BAA2B;CAEpE,MAAM,gBAAgB,MAAM,eAAe,WAAW,cAAc;CACpE,IAAI,cAAc,OAAO,QAAQ;EAC/B,OAAO,KACL,EAAE,QAAQ,cAAc,OAAO,GAC/B,6DACF;EACA,MAAM,IAAI,MAAM,iBAAiB;CACnC;CACA,IAAI,cAAc,SAAS,QACzB,OAAO,KACL,EAAE,UAAU,cAAc,SAAS,GACnC,+DACF;CAIF,kBAAkB,MAAM,cAAc,gBAAgB,OAAO,UAAU;CAGvE,iBAAiB,mBAAmB,iBAAiB,IAAI;CACzD,IAAI,CAAC,OAAO,iBAAiB,cAAc,GACzC,OAAO,MACL;EAAE,iBAAiB;EAAiB;CAAe,GACnD,sDACF;CAGF,iBAAiB,iCAAiC;EAChD,QAAQ;EACR,SAAS,aAAa,OAAO,OAAO;EACpC,WAAW,aAAa,OAAO,SAAS;CAC1C,CAAC;CACD,eAAe,cAAc;CAC7B,iBAAiB,cAAc,IAAI,cAAc;CACjD,OAAO,iBAAiB,QAAQ,cAAc;AAChD"}
+{"version":3,"file":"inherited.js","names":["template.compile"],"sources":["../../../../lib/workers/repository/init/inherited.ts"],"sourcesContent":["import { isNonEmptyArray, isNullOrUndefined, isString } from '@sindresorhus/is';\nimport { dequal } from 'dequal';\nimport { setUserConfigFileNames } from '../../../config/app-strings.ts';\nimport { decryptConfig } from '../../../config/decrypt.ts';\nimport { GlobalConfig } from '../../../config/global.ts';\nimport { mergeChildConfig, removeGlobalConfig } from '../../../config/index.ts';\nimport { InheritConfig } from '../../../config/inherit.ts';\nimport { parseFileConfig } from '../../../config/parse.ts';\nimport { resolveConfigPresets } from '../../../config/presets/index.ts';\nimport { applySecretsAndVariablesToConfig } from '../../../config/secrets.ts';\nimport type {\n  RenovateConfig,\n  ValidationMessage,\n} from '../../../config/types.ts';\nimport { validateConfig } from '../../../config/validation.ts';\nimport {\n  CONFIG_INHERIT_NOT_FOUND,\n  CONFIG_INHERIT_PARSE_ERROR,\n  CONFIG_VALIDATION,\n} from '../../../constants/error-messages.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { platform } from '../../../modules/platform/index.ts';\nimport type { AddHostRuleOptions } from '../../../util/host-rules.ts';\nimport { coerceObject } from '../../../util/object.ts';\nimport * as template from '../../../util/template/index.ts';\nimport { applyHostRules } from './merge.ts';\n\nconst inheritedConfigValidationError =\n  'The inherited config contains some invalid settings';\n\n/**\n * Report an inherited config validation failure against the inherited config, rather than the repository being processed.\n *\n * The inherited config repository is managed by the organization's administrators, so a fault there is not one the repository's owners have introduced - and they may not even be able to read the file to see it.\n */\nfunction throwInheritedConfigValidationError(\n  validationSource: string,\n  errors: ValidationMessage[],\n): never {\n  const error = new Error(CONFIG_VALIDATION);\n  error.validationSource = validationSource;\n  error.validationError = inheritedConfigValidationError;\n  error.validationMessage = errors.map((err) => err.message).join(', ');\n  throw error;\n}\n\n/**\n * How the inherited config's `hostRules` are registered.\n *\n * The inherited config repository is controlled by the organization's administrators rather than by the self-hosted administrator, so its rules are untrusted unless the administrator has opted into trusting them.\n */\nfunction inheritedHostRuleOptions(): AddHostRuleOptions | undefined {\n  if (!GlobalConfig.get('inheritConfigTrusted')) {\n    return undefined;\n  }\n  return { inherited: true };\n}\n\nexport async function mergeInheritedConfig(\n  config: RenovateConfig,\n): Promise<RenovateConfig> {\n  // typescript doesn't know that repo is defined\n  if (!config.repository || !config.inheritConfig) {\n    return config;\n  }\n  if (\n    !isString(config.inheritConfigRepoName) ||\n    !isString(config.inheritConfigFileName)\n  ) {\n    // Config validation should prevent this error\n    logger.error(\n      {\n        inheritConfigRepoName: config.inheritConfigRepoName,\n        inheritConfigFileName: config.inheritConfigFileName,\n      },\n      'Invalid inherited config.',\n    );\n    return config;\n  }\n  const templateConfig = {\n    topLevelOrg: config.topLevelOrg,\n    parentOrg: config.parentOrg,\n    repository: config.repository,\n  };\n  const inheritConfigRepoName = template.compile(\n    config.inheritConfigRepoName,\n    templateConfig,\n    false,\n  );\n  logger.trace(\n    { templateConfig, inheritConfigRepoName },\n    'Compiled inheritConfigRepoName result.',\n  );\n  logger.debug(\n    `Checking for inherited config file ${config.inheritConfigFileName} in repo ${inheritConfigRepoName}.`,\n  );\n  let configFileRaw: string | null = null;\n  try {\n    configFileRaw = await platform.getRawFile(\n      config.inheritConfigFileName,\n      inheritConfigRepoName,\n    );\n  } catch (err) {\n    if (config.inheritConfigStrict) {\n      logger.debug({ err }, 'Error getting inherited config.');\n      throw new Error(CONFIG_INHERIT_NOT_FOUND);\n    }\n    logger.trace({ err }, `Error getting inherited config.`);\n  }\n  if (!configFileRaw) {\n    logger.debug(`No inherited config found in ${inheritConfigRepoName}.`);\n    return config;\n  }\n  const parseResult = parseFileConfig(\n    config.inheritConfigFileName,\n    configFileRaw,\n  );\n  if (!parseResult.success) {\n    logger.debug({ parseResult }, 'Error parsing inherited config.');\n    throw new Error(CONFIG_INHERIT_PARSE_ERROR);\n  }\n  const inheritedConfigSource = `Inherited config (\\`${config.inheritConfigFileName}\\` in \\`${inheritConfigRepoName}\\`)`;\n  const inheritedConfig = parseResult.parsedContents as RenovateConfig;\n  logger.debug({ config: inheritedConfig }, `Inherited config`);\n  const res = await validateConfig('inherit', inheritedConfig);\n  if (res.errors.length) {\n    logger.warn(\n      { errors: res.errors },\n      'Found errors in inherited configuration.',\n    );\n    throwInheritedConfigValidationError(inheritedConfigSource, res.errors);\n  }\n  if (res.warnings.length) {\n    logger.warn(\n      { warnings: res.warnings },\n      'Found warnings in inherited configuration.',\n    );\n  }\n\n  // set user config file name here\n  if (isNonEmptyArray(inheritedConfig.configFileNames)) {\n    logger.debug(\n      { configFileNames: inheritedConfig.configFileNames },\n      'Updated the config filenames list',\n    );\n    setUserConfigFileNames(inheritedConfig.configFileNames);\n    delete config.configFileNames;\n  }\n\n  let decryptedConfig = await decryptConfig(inheritedConfig, config.repository);\n\n  let filteredConfig = removeGlobalConfig(decryptedConfig, true);\n  if (!dequal(decryptedConfig, filteredConfig)) {\n    logger.debug(\n      { inheritedConfig: decryptedConfig, filteredConfig },\n      'Removed global config from inherited config.',\n    );\n  }\n\n  if (isNullOrUndefined(filteredConfig.extends)) {\n    filteredConfig = applySecretsAndVariablesToConfig({\n      config: filteredConfig,\n      secrets: coerceObject(config.secrets),\n      variables: coerceObject(config.variables),\n    });\n    applyHostRules(filteredConfig, inheritedHostRuleOptions());\n    filteredConfig = InheritConfig.set(filteredConfig);\n    return mergeChildConfig(config, filteredConfig);\n  }\n\n  logger.debug('Resolving presets found in inherited config');\n  const { config: resolvedConfig } = await resolveConfigPresets(\n    filteredConfig,\n    config,\n    config.ignorePresets,\n  );\n  logger.trace({ config: resolvedConfig }, 'Resolved inherited config');\n\n  const validationRes = await validateConfig('inherit', resolvedConfig);\n  if (validationRes.errors.length) {\n    logger.warn(\n      { errors: validationRes.errors },\n      'Found errors in presets inside the inherited configuration.',\n    );\n    throwInheritedConfigValidationError(\n      inheritedConfigSource,\n      validationRes.errors,\n    );\n  }\n  if (validationRes.warnings.length) {\n    logger.warn(\n      { warnings: validationRes.warnings },\n      'Found warnings in presets inside the inherited configuration.',\n    );\n  }\n\n  // decrypt again, as resolved presets could contain encrypted values\n  decryptedConfig = await decryptConfig(resolvedConfig, config.repository);\n\n  // remove global config options once again, as resolved presets could have added some\n  filteredConfig = removeGlobalConfig(decryptedConfig, true);\n  if (!dequal(decryptedConfig, filteredConfig)) {\n    logger.debug(\n      { inheritedConfig: decryptedConfig, filteredConfig },\n      'Removed global config from inherited config presets.',\n    );\n  }\n\n  filteredConfig = applySecretsAndVariablesToConfig({\n    config: filteredConfig,\n    secrets: coerceObject(config.secrets),\n    variables: coerceObject(config.variables),\n  });\n  applyHostRules(filteredConfig, inheritedHostRuleOptions());\n  filteredConfig = InheritConfig.set(filteredConfig);\n  return mergeChildConfig(config, filteredConfig);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2BA,MAAM,iCACJ;;;;;;AAOF,SAAS,oCACP,kBACA,QACO;CACP,MAAM,QAAQ,IAAI,MAAM,iBAAiB;CACzC,MAAM,mBAAmB;CACzB,MAAM,kBAAkB;CACxB,MAAM,oBAAoB,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI;CACpE,MAAM;AACR;;;;;;AAOA,SAAS,2BAA2D;CAClE,IAAI,CAAC,aAAa,IAAI,sBAAsB,GAC1C;CAEF,OAAO,EAAE,WAAW,KAAK;AAC3B;AAEA,eAAsB,qBACpB,QACyB;CAEzB,IAAI,CAAC,OAAO,cAAc,CAAC,OAAO,eAChC,OAAO;CAET,IACE,CAAC,SAAS,OAAO,qBAAqB,KACtC,CAAC,SAAS,OAAO,qBAAqB,GACtC;EAEA,OAAO,MACL;GACE,uBAAuB,OAAO;GAC9B,uBAAuB,OAAO;EAChC,GACA,2BACF;EACA,OAAO;CACT;CACA,MAAM,iBAAiB;EACrB,aAAa,OAAO;EACpB,WAAW,OAAO;EAClB,YAAY,OAAO;CACrB;CACA,MAAM,wBAAwBA,QAC5B,OAAO,uBACP,gBACA,KACF;CACA,OAAO,MACL;EAAE;EAAgB;CAAsB,GACxC,wCACF;CACA,OAAO,MACL,sCAAsC,OAAO,sBAAsB,WAAW,sBAAsB,EACtG;CACA,IAAI,gBAA+B;CACnC,IAAI;EACF,gBAAgB,MAAM,SAAS,WAC7B,OAAO,uBACP,qBACF;CACF,SAAS,KAAK;EACZ,IAAI,OAAO,qBAAqB;GAC9B,OAAO,MAAM,EAAE,IAAI,GAAG,iCAAiC;GACvD,MAAM,IAAI,MAAM,wBAAwB;EAC1C;EACA,OAAO,MAAM,EAAE,IAAI,GAAG,iCAAiC;CACzD;CACA,IAAI,CAAC,eAAe;EAClB,OAAO,MAAM,gCAAgC,sBAAsB,EAAE;EACrE,OAAO;CACT;CACA,MAAM,cAAc,gBAClB,OAAO,uBACP,aACF;CACA,IAAI,CAAC,YAAY,SAAS;EACxB,OAAO,MAAM,EAAE,YAAY,GAAG,iCAAiC;EAC/D,MAAM,IAAI,MAAM,0BAA0B;CAC5C;CACA,MAAM,wBAAwB,uBAAuB,OAAO,sBAAsB,UAAU,sBAAsB;CAClH,MAAM,kBAAkB,YAAY;CACpC,OAAO,MAAM,EAAE,QAAQ,gBAAgB,GAAG,kBAAkB;CAC5D,MAAM,MAAM,MAAM,eAAe,WAAW,eAAe;CAC3D,IAAI,IAAI,OAAO,QAAQ;EACrB,OAAO,KACL,EAAE,QAAQ,IAAI,OAAO,GACrB,0CACF;EACA,oCAAoC,uBAAuB,IAAI,MAAM;CACvE;CACA,IAAI,IAAI,SAAS,QACf,OAAO,KACL,EAAE,UAAU,IAAI,SAAS,GACzB,4CACF;CAIF,IAAI,gBAAgB,gBAAgB,eAAe,GAAG;EACpD,OAAO,MACL,EAAE,iBAAiB,gBAAgB,gBAAgB,GACnD,mCACF;EACA,uBAAuB,gBAAgB,eAAe;EACtD,OAAO,OAAO;CAChB;CAEA,IAAI,kBAAkB,MAAM,cAAc,iBAAiB,OAAO,UAAU;CAE5E,IAAI,iBAAiB,mBAAmB,iBAAiB,IAAI;CAC7D,IAAI,CAAC,OAAO,iBAAiB,cAAc,GACzC,OAAO,MACL;EAAE,iBAAiB;EAAiB;CAAe,GACnD,8CACF;CAGF,IAAI,kBAAkB,eAAe,OAAO,GAAG;EAC7C,iBAAiB,iCAAiC;GAChD,QAAQ;GACR,SAAS,aAAa,OAAO,OAAO;GACpC,WAAW,aAAa,OAAO,SAAS;EAC1C,CAAC;EACD,eAAe,gBAAgB,yBAAyB,CAAC;EACzD,iBAAiB,cAAc,IAAI,cAAc;EACjD,OAAO,iBAAiB,QAAQ,cAAc;CAChD;CAEA,OAAO,MAAM,6CAA6C;CAC1D,MAAM,EAAE,QAAQ,mBAAmB,MAAM,qBACvC,gBACA,QACA,OAAO,aACT;CACA,OAAO,MAAM,EAAE,QAAQ,eAAe,GAAG,2BAA2B;CAEpE,MAAM,gBAAgB,MAAM,eAAe,WAAW,cAAc;CACpE,IAAI,cAAc,OAAO,QAAQ;EAC/B,OAAO,KACL,EAAE,QAAQ,cAAc,OAAO,GAC/B,6DACF;EACA,oCACE,uBACA,cAAc,MAChB;CACF;CACA,IAAI,cAAc,SAAS,QACzB,OAAO,KACL,EAAE,UAAU,cAAc,SAAS,GACnC,+DACF;CAIF,kBAAkB,MAAM,cAAc,gBAAgB,OAAO,UAAU;CAGvE,iBAAiB,mBAAmB,iBAAiB,IAAI;CACzD,IAAI,CAAC,OAAO,iBAAiB,cAAc,GACzC,OAAO,MACL;EAAE,iBAAiB;EAAiB;CAAe,GACnD,sDACF;CAGF,iBAAiB,iCAAiC;EAChD,QAAQ;EACR,SAAS,aAAa,OAAO,OAAO;EACpC,WAAW,aAAa,OAAO,SAAS;CAC1C,CAAC;CACD,eAAe,gBAAgB,yBAAyB,CAAC;CACzD,iBAAiB,cAAc,IAAI,cAAc;CACjD,OAAO,iBAAiB,QAAQ,cAAc;AAChD"}

package/dist/workers/repository/init/merge.js

@@ -37,7 +37,7 @@ import { getOnboardingConfig } from "../onboarding/branch/config.js";
 import { getOnboardingConfigFromCache, getOnboardingFileNameFromCache, setOnboardingConfigDetails } from "../onboarding/branch/onboarding-branch-cache.js";
 import { OnboardingState, getDefaultConfigFileName } from "../onboarding/common.js";
 import { filterAllowedEnv } from "./filter-allowed-env.js";
-import { isNonEmptyArray, isNonEmptyObject, isNonEmptyString, isString } from "@sindresorhus/is";
+import { isNonEmptyArray, isNonEmptyObject, isNonEmptyString, isString, isUndefined } from "@sindresorhus/is";
 import { dequal } from "dequal";
 //#region lib/workers/repository/init/merge.ts
 async function detectConfigFile() {
@@ -237,17 +237,26 @@ function migratedHostRules(rules) {
 function adminSuppliedValues(adminConfigs) {
 	const env = /* @__PURE__ */ new Set();
 	const headers = /* @__PURE__ */ new Map();
+	const internalGrants = /* @__PURE__ */ new Map();
 	for (const adminConfig of adminConfigs) for (const source of [adminConfig, adminConfig.force]) {
 		for (const [name, value] of Object.entries(coerceObject(source?.env))) env.add(nameValueIdentity(name, value));
-		for (const [identity, matchHosts] of headersByIdentity(migratedHostRules(source?.hostRules))) {
+		const rules = migratedHostRules(source?.hostRules);
+		for (const [identity, matchHosts] of headersByIdentity(rules)) {
 			const hosts = headers.get(identity) ?? /* @__PURE__ */ new Set();
 			for (const matchHost of matchHosts) hosts.add(matchHost);
 			headers.set(identity, hosts);
 		}
+		for (const rule of rules) if (!isUndefined(rule.allowInternal)) {
+			const key = rule.allowInternal.toString();
+			const hosts = internalGrants.get(key) ?? /* @__PURE__ */ new Set();
+			hosts.add(rule.matchHost ?? null);
+			internalGrants.set(key, hosts);
+		}
 	}
 	return {
 		env,
-		headers
+		headers,
+		internalGrants
 	};
 }
 /**
@@ -260,15 +269,22 @@ function adminSuppliedValues(adminConfigs) {
 function withoutAdminSuppliedValues(resolved, admin) {
 	const result = { ...resolved };
 	if (result.env) result.env = Object.fromEntries(Object.entries(result.env).filter(([name, value]) => !admin.env.has(nameValueIdentity(name, value))));
-	if (result.hostRules) result.hostRules = result.hostRules.map((rule) => ({
-		...rule,
-		headers: Object.fromEntries(Object.entries(coerceObject(rule.headers)).filter(([name, value]) => {
-			const adminHosts = admin.headers.get(nameValueIdentity(name, value));
-			if (!adminHosts) return true;
-			if (adminHosts.has(null)) return false;
-			return !(rule.matchHost && [...adminHosts].some((adminHost) => adminHost !== null && isWithinHost(rule.matchHost, adminHost)));
-		}))
-	}));
+	if (result.hostRules) result.hostRules = result.hostRules.map((rule) => {
+		const filtered = {
+			...rule,
+			headers: Object.fromEntries(Object.entries(coerceObject(rule.headers)).filter(([name, value]) => {
+				const adminHosts = admin.headers.get(nameValueIdentity(name, value));
+				if (!adminHosts) return true;
+				if (adminHosts.has(null)) return false;
+				return !(rule.matchHost && [...adminHosts].some((adminHost) => adminHost !== null && isWithinHost(rule.matchHost, adminHost)));
+			}))
+		};
+		if (!isUndefined(filtered.allowInternal)) {
+			const adminHosts = admin.internalGrants.get(filtered.allowInternal.toString());
+			if (adminHosts && (adminHosts.has(null) || !!filtered.matchHost && [...adminHosts].some((adminHost) => adminHost !== null && isWithinHost(filtered.matchHost, adminHost)))) delete filtered.allowInternal;
+		}
+		return filtered;
+	});
 	if (result.force) result.force = withoutAdminSuppliedValues(result.force, admin);
 	return result;
 }