versions-le-mcp 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +226 -0
- package/package.json +56 -0
- package/server.js +19 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 nolindnaidoo
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,226 @@
|
|
|
1
|
+
# versions-le-mcp
|
|
2
|
+
|
|
3
|
+
<p align="center">
|
|
4
|
+
<a href="https://marketplace.visualstudio.com/items?itemName=nolindnaidoo.versions-le">
|
|
5
|
+
<img src="https://img.shields.io/badge/Install%20from-VS%20Code-blue?style=for-the-badge&logo=visualstudiocode" alt="Install from VS Code Marketplace" />
|
|
6
|
+
</a>
|
|
7
|
+
<a href="https://open-vsx.org/extension/OffensiveEdge/versions-le">
|
|
8
|
+
<img src="https://img.shields.io/open-vsx/dt/OffensiveEdge/versions-le?style=for-the-badge&label=Open%20VSX&color=blue" alt="Open VSX downloads" />
|
|
9
|
+
</a>
|
|
10
|
+
<a href="https://www.npmjs.com/package/versions-le-mcp">
|
|
11
|
+
<img src="https://img.shields.io/npm/v/versions-le-mcp?style=for-the-badge&label=MCP%20server&color=blue&logo=npm" alt="versions-le-mcp on npm" />
|
|
12
|
+
</a>
|
|
13
|
+
<a href="https://letools.dev/tools/versions-le">
|
|
14
|
+
<img src="https://img.shields.io/badge/LE%20Tools-letools.dev-blue?style=for-the-badge" alt="LE Tools" />
|
|
15
|
+
</a>
|
|
16
|
+
</p>
|
|
17
|
+
|
|
18
|
+
An [MCP](https://modelcontextprotocol.io) server that compares the version
|
|
19
|
+
constraints in a set of manifests — `package.json`, `Cargo.toml`,
|
|
20
|
+
`pyproject.toml`, `go.mod` and GitHub workflows — and reports where one
|
|
21
|
+
dependency is constrained differently, and where two constraints cannot both
|
|
22
|
+
be satisfied by any version. It is the engine behind the
|
|
23
|
+
[Versions-LE](https://letools.dev/tools/versions-le) editor extension, exposed
|
|
24
|
+
as a tool an agent can call.
|
|
25
|
+
|
|
26
|
+
**Comparison never crosses an ecosystem.** An npm `semver` and a Cargo
|
|
27
|
+
`semver` are unrelated packages that share a word, and a bare `"1.0.200"` means
|
|
28
|
+
exactly that version in npm and anything below 2 in Cargo.
|
|
29
|
+
|
|
30
|
+
**A constraint in a grammar it does not model is refused by name, never
|
|
31
|
+
approximated** — a git or path specifier, a workspace inheritance, a PEP 440
|
|
32
|
+
compatible-release clause. It is reported in `refusals` and left out of every
|
|
33
|
+
comparison.
|
|
34
|
+
|
|
35
|
+
No dependencies, no network calls, no filesystem access. Content goes in,
|
|
36
|
+
structured results come out.
|
|
37
|
+
|
|
38
|
+
## Use it
|
|
39
|
+
|
|
40
|
+
Point any MCP host at `npx versions-le-mcp`.
|
|
41
|
+
|
|
42
|
+
**Claude Code**
|
|
43
|
+
|
|
44
|
+
```bash
|
|
45
|
+
claude mcp add versions-le -- npx -y versions-le-mcp
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
**Anything with a JSON config** — Cursor, Windsurf, Claude Desktop:
|
|
49
|
+
|
|
50
|
+
```json
|
|
51
|
+
{
|
|
52
|
+
"mcpServers": {
|
|
53
|
+
"versions-le": {
|
|
54
|
+
"command": "npx",
|
|
55
|
+
"args": ["-y", "versions-le-mcp"]
|
|
56
|
+
}
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
**VS Code and Zed** need nothing here. Install the extension instead — it
|
|
62
|
+
carries this server and registers it for you:
|
|
63
|
+
[VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=nolindnaidoo.versions-le)
|
|
64
|
+
· [Open VSX](https://open-vsx.org/extension/OffensiveEdge/versions-le)
|
|
65
|
+
· [Zed](https://zed.dev/docs/ai/mcp) *(no listing yet — add it by hand)*
|
|
66
|
+
|
|
67
|
+
**No Node?** The same `compare_versions` tool ships in a static Rust binary:
|
|
68
|
+
`cargo install versions-le`, then `versions-le mcp`
|
|
69
|
+
([crates.io](https://crates.io/crates/versions-le)). The two servers answer
|
|
70
|
+
identically — one corpus runs against both, and a differential test feeds both
|
|
71
|
+
thousands of generated manifest sets, broken JSON and TOML included, and
|
|
72
|
+
compares every answer. The binary additionally offers `versions_le_check`,
|
|
73
|
+
which walks a tree; **this server reads no files**.
|
|
74
|
+
|
|
75
|
+
Prefer a global install to `npx` on every launch:
|
|
76
|
+
|
|
77
|
+
```bash
|
|
78
|
+
npm install -g versions-le-mcp
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
No environment variables, no API key, no configuration of its own. To check it
|
|
82
|
+
before wiring it into anything:
|
|
83
|
+
|
|
84
|
+
```bash
|
|
85
|
+
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | npx -y versions-le-mcp
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
If that prints the tool name, the server works.
|
|
89
|
+
|
|
90
|
+
## The tool
|
|
91
|
+
|
|
92
|
+
### `compare_versions`
|
|
93
|
+
|
|
94
|
+
| argument | type | |
|
|
95
|
+
|---|---|---|
|
|
96
|
+
| `files` | `{ path, content }[]` | **required.** The manifests. The path decides the grammar and labels every finding: `package.json`, `Cargo.toml`, `pyproject.toml`, `go.mod`, or a `.yml`/`.yaml` under `.github/workflows/`. |
|
|
97
|
+
| `maxResults` | number | Default `500`, ceiling `5000`. |
|
|
98
|
+
|
|
99
|
+
Findings are `disjoint-constraint`, `malformed-constraint` (errors),
|
|
100
|
+
`constraint-conflict`, `msrv-mismatch`, `prerelease-in-production` (warnings)
|
|
101
|
+
and `floating-pin` (info), each with every site that produced it. Refusals are
|
|
102
|
+
`unknown_grammar`, `ambiguous_version_string`, `cross_ecosystem` and
|
|
103
|
+
`per_job_tool_version`. A manifest that does not parse is a diagnostic, and
|
|
104
|
+
`ok` is `false` while one is present:
|
|
105
|
+
|
|
106
|
+
```json
|
|
107
|
+
{
|
|
108
|
+
"ok": true,
|
|
109
|
+
"data": {
|
|
110
|
+
"schema": 1,
|
|
111
|
+
"manifests": [
|
|
112
|
+
{
|
|
113
|
+
"path": "api/Cargo.toml",
|
|
114
|
+
"ecosystem": "cargo",
|
|
115
|
+
"entries": 1
|
|
116
|
+
},
|
|
117
|
+
{
|
|
118
|
+
"path": "web/Cargo.toml",
|
|
119
|
+
"ecosystem": "cargo",
|
|
120
|
+
"entries": 1
|
|
121
|
+
}
|
|
122
|
+
],
|
|
123
|
+
"findings": [
|
|
124
|
+
{
|
|
125
|
+
"code": "disjoint-constraint",
|
|
126
|
+
"severity": "error",
|
|
127
|
+
"ecosystem": "cargo",
|
|
128
|
+
"name": "regex",
|
|
129
|
+
"message": "\"1\" (api/Cargo.toml) and \"2\" (web/Cargo.toml) cannot both be satisfied by one version",
|
|
130
|
+
"sites": [
|
|
131
|
+
{
|
|
132
|
+
"file": "api/Cargo.toml",
|
|
133
|
+
"key": "dependencies.regex",
|
|
134
|
+
"constraint": "1"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"file": "web/Cargo.toml",
|
|
138
|
+
"key": "dependencies.regex",
|
|
139
|
+
"constraint": "2"
|
|
140
|
+
}
|
|
141
|
+
]
|
|
142
|
+
}
|
|
143
|
+
],
|
|
144
|
+
"refusals": [],
|
|
145
|
+
"summary": {
|
|
146
|
+
"manifests": 2,
|
|
147
|
+
"entries": 2,
|
|
148
|
+
"findings": 1,
|
|
149
|
+
"refusals": 0,
|
|
150
|
+
"errors": 1,
|
|
151
|
+
"warnings": 0,
|
|
152
|
+
"infos": 0
|
|
153
|
+
}
|
|
154
|
+
},
|
|
155
|
+
"diagnostics": [],
|
|
156
|
+
"meta": {
|
|
157
|
+
"tool": "compare_versions",
|
|
158
|
+
"count": 1,
|
|
159
|
+
"truncated": false
|
|
160
|
+
}
|
|
161
|
+
}
|
|
162
|
+
```
|
|
163
|
+
|
|
164
|
+
## Also in the MCP registry
|
|
165
|
+
|
|
166
|
+
`io.github.nolindnaidoo/versions-le` —
|
|
167
|
+
[registry.modelcontextprotocol.io](https://registry.modelcontextprotocol.io)
|
|
168
|
+
|
|
169
|
+
## Fourteen more like it
|
|
170
|
+
|
|
171
|
+
One tool each, same shape: content in, structured data out, no network and no
|
|
172
|
+
filesystem. Every one is on npm as `<name>-mcp` and in the MCP registry as
|
|
173
|
+
`io.github.nolindnaidoo/<name>`.
|
|
174
|
+
|
|
175
|
+
| Package | Tool | Does |
|
|
176
|
+
|---|---|---|
|
|
177
|
+
| [`urls-le-mcp`](https://www.npmjs.com/package/urls-le-mcp) | `extract_urls` | URLs, with protocol and position |
|
|
178
|
+
| [`colors-le-mcp`](https://www.npmjs.com/package/colors-le-mcp) | `extract_colors` | colors from stylesheets and code |
|
|
179
|
+
| [`dates-le-mcp`](https://www.npmjs.com/package/dates-le-mcp) | `extract_dates` | dates and timestamps |
|
|
180
|
+
| [`numbers-le-mcp`](https://www.npmjs.com/package/numbers-le-mcp) | `extract_numbers` | numeric values |
|
|
181
|
+
| [`paths-le-mcp`](https://www.npmjs.com/package/paths-le-mcp) | `extract_paths` | file and directory paths |
|
|
182
|
+
| [`string-le-mcp`](https://www.npmjs.com/package/string-le-mcp) | `extract_strings` | string values |
|
|
183
|
+
| [`regex-le-mcp`](https://www.npmjs.com/package/regex-le-mcp) | `extract_patterns` | regexes, with a ReDoS verdict |
|
|
184
|
+
| [`secrets-le-mcp`](https://www.npmjs.com/package/secrets-le-mcp) | `detect_secrets` | credentials, masked — never the value |
|
|
185
|
+
| [`envsync-le-mcp`](https://www.npmjs.com/package/envsync-le-mcp) | `compare_env_files` | dotenv key drift, names only |
|
|
186
|
+
| [`scrape-le-mcp`](https://www.npmjs.com/package/scrape-le-mcp) | `analyze_robots_txt` | whether a path may be crawled |
|
|
187
|
+
| [`unicode-le-mcp`](https://www.npmjs.com/package/unicode-le-mcp) | `detect_unicode_risks` | Unicode that hides meaning, as codepoints |
|
|
188
|
+
| [`i18n-le-mcp`](https://www.npmjs.com/package/i18n-le-mcp) | `check_catalogues` | translation catalogues, keys only |
|
|
189
|
+
| [`ids-le-mcp`](https://www.npmjs.com/package/ids-le-mcp) | `extract_ids` | UUIDs, ULIDs and Snowflakes, with the time inside |
|
|
190
|
+
| [`ips-le-mcp`](https://www.npmjs.com/package/ips-le-mcp) | `extract_ips` | IP addresses, CIDR blocks and MACs, normalized |
|
|
191
|
+
|
|
192
|
+
Every tool in the family, one page: **[letools.dev](https://letools.dev)**
|
|
193
|
+
|
|
194
|
+
## Built by
|
|
195
|
+
|
|
196
|
+
**[Nolin Naidoo](https://nolindnaidoo.com)** — Chief Engineer, AI/ML & Platform
|
|
197
|
+
Architecture. [nolindnaidoo.com](https://nolindnaidoo.com) ·
|
|
198
|
+
[GitHub](https://github.com/nolindnaidoo) ·
|
|
199
|
+
[LinkedIn](https://www.linkedin.com/in/nolindnaidoo/)
|
|
200
|
+
|
|
201
|
+
### Also from the same workshop
|
|
202
|
+
|
|
203
|
+
Twelve Rust tools built the same way: small, single-purpose, and driven by a
|
|
204
|
+
machine rather than a person. pixelcoords and pixelactions make up one loop —
|
|
205
|
+
pixelcoords answers *where*, pixelactions *acts* there. The ten LE crates are
|
|
206
|
+
the terminal half of the extensions they sit in: the same detection, held to
|
|
207
|
+
the extension's own corpus, and an exit code instead of a results editor.
|
|
208
|
+
|
|
209
|
+
| | | |
|
|
210
|
+
|---|---|---|
|
|
211
|
+
| **[pixelcoords](https://github.com/nolindnaidoo/pixelcoords)** | Freeze your screen, mark regions, get pixel-exact coordinates and crops | [site](https://pixelcoords.dev) · [crates.io](https://crates.io/crates/pixelcoords) · [docs.rs](https://docs.rs/pixelcoords) |
|
|
212
|
+
| **[pixelactions](https://github.com/nolindnaidoo/pixelactions)** | Consume human-verified coordinates, perform the interaction, confirm it landed | [site](https://pixelactions.dev) · [crates.io](https://crates.io/crates/pixelactions) · [docs.rs](https://docs.rs/pixelactions) |
|
|
213
|
+
| **[paths-le](https://github.com/nolindnaidoo/paths-le/tree/main/crate)** | Find every path in a codebase and report whether it still points at anything | [crates.io](https://crates.io/crates/paths-le) |
|
|
214
|
+
| **[secrets-le](https://github.com/nolindnaidoo/secrets-le/tree/main/crate)** | Find hardcoded credentials, and never print one | [crates.io](https://crates.io/crates/secrets-le) |
|
|
215
|
+
| **[urls-le](https://github.com/nolindnaidoo/urls-le/tree/main/crate)** | Extract every URL from a codebase, with its protocol and exact position | [crates.io](https://crates.io/crates/urls-le) |
|
|
216
|
+
| **[regex-le](https://github.com/nolindnaidoo/regex-le/tree/main/crate)** | Find every regex in a codebase and report which can be driven into catastrophic backtracking | [crates.io](https://crates.io/crates/regex-le) |
|
|
217
|
+
| **[string-le](https://github.com/nolindnaidoo/string-le/tree/main/crate)** | Get every string in a codebase out where a person can read them | [crates.io](https://crates.io/crates/string-le) |
|
|
218
|
+
| **[numbers-le](https://github.com/nolindnaidoo/numbers-le/tree/main/crate)** | Find every hardcoded number in a codebase so a person can check them | [crates.io](https://crates.io/crates/numbers-le) |
|
|
219
|
+
| **[envsync-le](https://github.com/nolindnaidoo/envsync-le/tree/main/crate)** | Compare the dotenv files in a tree and say which keys are missing from which | [crates.io](https://crates.io/crates/envsync-le) |
|
|
220
|
+
| **[colors-le](https://github.com/nolindnaidoo/colors-le/tree/main/crate)** | Find every colour in a codebase, and say which are not in your palette | [crates.io](https://crates.io/crates/colors-le) |
|
|
221
|
+
| **[dates-le](https://github.com/nolindnaidoo/dates-le/tree/main/crate)** | Extract every date and timestamp, and the exact instant each one resolves to | [crates.io](https://crates.io/crates/dates-le) |
|
|
222
|
+
| **[scrape-le](https://github.com/nolindnaidoo/scrape-le/tree/main/crate)** | Check whether a page is scrapeable before the scraper is written | [crates.io](https://crates.io/crates/scrape-le) |
|
|
223
|
+
|
|
224
|
+
## Licence
|
|
225
|
+
|
|
226
|
+
MIT © [Nolin Naidoo](https://nolindnaidoo.com)
|
package/package.json
ADDED
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "versions-le-mcp",
|
|
3
|
+
"version": "1.0.0",
|
|
4
|
+
"mcpName": "io.github.nolindnaidoo/versions-le",
|
|
5
|
+
"description": "Find where one dependency is constrained differently across a repository's manifests.",
|
|
6
|
+
"keywords": [
|
|
7
|
+
"mcp",
|
|
8
|
+
"modelcontextprotocol",
|
|
9
|
+
"model-context-protocol",
|
|
10
|
+
"mcp-server",
|
|
11
|
+
"ai-agent",
|
|
12
|
+
"claude",
|
|
13
|
+
"cursor",
|
|
14
|
+
"zed",
|
|
15
|
+
"vscode",
|
|
16
|
+
"llm-tools",
|
|
17
|
+
"versions-le",
|
|
18
|
+
"versions-le-mcp",
|
|
19
|
+
"nolindnaidoo",
|
|
20
|
+
"letools",
|
|
21
|
+
"versions",
|
|
22
|
+
"dependencies",
|
|
23
|
+
"semver",
|
|
24
|
+
"monorepo"
|
|
25
|
+
],
|
|
26
|
+
"license": "MIT",
|
|
27
|
+
"author": {
|
|
28
|
+
"name": "Nolin Naidoo",
|
|
29
|
+
"url": "https://nolindnaidoo.com"
|
|
30
|
+
},
|
|
31
|
+
"homepage": "https://letools.dev/tools/versions-le",
|
|
32
|
+
"repository": {
|
|
33
|
+
"type": "git",
|
|
34
|
+
"url": "https://github.com/nolindnaidoo/versions-le.git",
|
|
35
|
+
"directory": "mcp"
|
|
36
|
+
},
|
|
37
|
+
"bugs": {
|
|
38
|
+
"url": "https://github.com/nolindnaidoo/versions-le/issues"
|
|
39
|
+
},
|
|
40
|
+
"type": "commonjs",
|
|
41
|
+
"bin": {
|
|
42
|
+
"versions-le-mcp": "server.js"
|
|
43
|
+
},
|
|
44
|
+
"files": [
|
|
45
|
+
"server.js",
|
|
46
|
+
"README.md",
|
|
47
|
+
"LICENSE"
|
|
48
|
+
],
|
|
49
|
+
"engines": {
|
|
50
|
+
"node": ">=20"
|
|
51
|
+
},
|
|
52
|
+
"publishConfig": {
|
|
53
|
+
"access": "public",
|
|
54
|
+
"provenance": true
|
|
55
|
+
}
|
|
56
|
+
}
|
package/server.js
ADDED
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
"use strict";var Ve="versions-le",Ie="1.0.0";var An=0xffffffffffffffffn,X=class extends Error{},g=()=>{throw new X};function C(n){let e=0,t=0n;for(;e<n.length&&n.charAt(e)>="0"&&n.charAt(e)<="9";)t===0n&&e>0&&g(),t=t*10n+BigInt(n.charCodeAt(e)-48),t>An&&g(),e++;return e===0&&g(),[t,n.slice(e)]}function De(n){return n.startsWith(".")||g(),n.slice(1)}function re(n){return n.startsWith("*")||n.startsWith("x")||n.startsWith("X")?n.slice(1):void 0}function I(n,e){let t=0,r=0,i=!1;for(;;){let s=n.charAt(t+r);if(/^[A-Za-z-]$/.test(s))r++,i=!0;else if(/^[0-9]$/.test(s))r++;else{let o=s;if(r===0){if(t===0&&o!==".")return["",n];g()}if(e&&r>1&&!i&&n.slice(t).startsWith("0")&&g(),t+=r,o===".")t++,r=0,i=!1;else return[n.slice(0,t),n.slice(t)]}}}function se(n){try{return n()}catch(e){if(e instanceof X)return;throw e}}function Fe(n){return se(()=>{n===""&&g();let[e,t]=C(n);t=De(t);let[r,i]=C(t);t=De(i);let[s,o]=C(t);if(t=o,t==="")return{major:e,minor:r,patch:s,pre:"",build:""};let a="";t.startsWith("-")&&([a,t]=I(t.slice(1),!0),a===""&&g());let c="";return t.startsWith("+")&&([c,t]=I(t.slice(1),!1),c===""&&g()),t!==""&&g(),{major:e,minor:r,patch:s,pre:a,build:c}})}function oe(n){return se(()=>{let[e,t]=I(n,!0);return t!==""&&g(),e})}function Cn(n){return n.startsWith("=")?["exact",n.slice(1)]:n.startsWith(">=")?["greaterEq",n.slice(2)]:n.startsWith(">")?["greater",n.slice(1)]:n.startsWith("<=")?["lessEq",n.slice(2)]:n.startsWith("<")?["less",n.slice(1)]:n.startsWith("~")?["tilde",n.slice(1)]:n.startsWith("^")?["caret",n.slice(1)]:["caret",n]}var V=n=>n.replace(/^ +/,"");function Mn(n){let[e,t]=Cn(n),r=n.length===t.length;t=V(t);let[i,s]=C(t);t=s;let o=!1,a,c;if(t.startsWith(".")){t=t.slice(1);let f=re(t);f!==void 0?(o=!0,r&&(e="wildcard"),t=f):[a,t]=C(t)}if(t.startsWith(".")){t=t.slice(1);let f=re(t);f!==void 0?(r&&(e="wildcard"),t=f):o?g():[c,t]=C(t)}let d="";if(c!==void 0&&t.startsWith("-")&&([d,t]=I(t.slice(1),!0),d===""&&g()),c!==void 0&&t.startsWith("+")){let f;[f,t]=I(t.slice(1),!1),f===""&&g()}return[{op:e,major:i,minor:a,patch:c,pre:d},V(t)]}var Pn=32;function qe(n){return se(()=>{let e=V(n),t=re(e);if(t!==void 0){if(V(t)==="")return[];g()}let r=[],i=e;for(;;){let[s,o]=Mn(i);if(r.push(s),o==="")return r;o.startsWith(",")||g(),r.length===Pn&&g(),i=V(o.slice(1))}})}var J=n=>/^[0-9]*$/.test(n);function h(n,e){let t=Array.from(n),r=Array.from(e);for(let i=0;i<Math.min(t.length,r.length);i++){let s=t[i].codePointAt(0),o=r[i].codePointAt(0);if(s!==o)return s<o?-1:1}return t.length===r.length?0:t.length<r.length?-1:1}var Wn=n=>n<0?-1:n>0?1:0,ie=(n,e)=>Wn(n-e),te=(n,e)=>n<e?-1:n>e?1:0;function Vn(n,e){if(n===e)return 0;if(n==="")return 1;if(e==="")return-1;let t=n.split("."),r=e.split(".");for(let i=0;i<t.length;i++){let s=t[i],o=r[i];if(o===void 0)return 1;let[a,c]=[J(s),J(o)],d;if(a&&c)d=ie(s.length,o.length)||h(s,o);else{if(a)return-1;if(c)return 1;d=h(s,o)}if(d!==0)return d}return r.length>t.length?-1:0}function In(n,e){if(n===e)return 0;let t=n.split("."),r=e.split(".");for(let i=0;i<t.length;i++){let s=t[i],o=r[i];if(o===void 0)return 1;let[a,c]=[J(s),J(o)],d;if(a&&c){let[f,m]=[s.replace(/^0+/,""),o.replace(/^0+/,"")];d=ie(f.length,m.length)||h(f,m)||ie(s.length,o.length)}else{if(a)return-1;if(c)return 1;d=h(s,o)}if(d!==0)return d}return r.length>t.length?-1:0}function E(n,e){return te(n.major,e.major)||te(n.minor,e.minor)||te(n.patch,e.patch)||Vn(n.pre,e.pre)||In(n.build,e.build)}var Le=(n,e)=>E(n,e)===0;function ae(n){let e=`${n.major}.${n.minor}.${n.patch}`;return n.pre!==""&&(e+=`-${n.pre}`),n.build!==""&&(e+=`+${n.build}`),e}var Z="\\t\\n\\v\\f\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000",Dn=new RegExp(`^[${Z}]+`),Fn=new RegExp(`[${Z}]+$`),qn=new RegExp(`^[${Z}]$`,"u"),Be=n=>qn.test(n),Ln=n=>n.replace(Dn,""),Bn=n=>n.replace(Fn,""),p=n=>Bn(Ln(n)),rr=new TextEncoder;var Un=new RegExp(`[${Z}]+`),Ue=n=>n.split(Un).filter(e=>e!=="");function ce(n){if(n==="")return[];let e=n.split(`
|
|
3
|
+
`);return e.at(-1)===""&&e.pop(),e.map(t=>t.endsWith("\r")?t.slice(0,-1):t)}var R=n=>({kind:"range",range:{intervals:n}}),w=n=>({kind:"unknown",reason:n}),v=n=>({kind:"malformed",reason:n}),j={lower:void 0,upper:void 0},S=n=>n.kind==="range"?n.range:void 0,le=n=>n.kind==="malformed"?n.reason:void 0;function fe(n){if(n.intervals.some(t=>t.lower===void 0))return;let e;for(let t of n.intervals){let r=t.lower.version;(e===void 0||E(r,e)<0)&&(e=r)}return e}function Xe(n){return n.intervals.some(e=>[e.lower,e.upper].some(t=>t!==void 0&&t.version.pre!==""))}var ze=(n,e)=>n===void 0||e===void 0?n===e:n.inclusive===e.inclusive&&Le(n.version,e.version);function Je(n,e){return n.intervals.length===e.intervals.length&&n.intervals.every((t,r)=>{let i=e.intervals[r];return ze(t.lower,i.lower)&&ze(t.upper,i.upper)})}function Ze(n,e){return!n.intervals.some(t=>e.intervals.some(r=>H(t,r)!==void 0))}function H(n,e){let t=zn(n.lower,e.lower),r=Kn(n.upper,e.upper),i=!0;if(t!==void 0&&r!==void 0){let s=E(t.version,r.version);i=s<0||s===0&&t.inclusive&&r.inclusive}return i?{lower:t,upper:r}:void 0}function zn(n,e){if(n===void 0||e===void 0)return n??e;let t=E(n.version,e.version);return t>0?n:t<0?e:{version:n.version,inclusive:n.inclusive&&e.inclusive}}function Kn(n,e){if(n===void 0||e===void 0)return n??e;let t=E(n.version,e.version);return t<0?n:t>0?e:{version:n.version,inclusive:n.inclusive&&e.inclusive}}function pe(n){let e=p(n);if(e==="")return v("an empty version requirement");let t=qe(e);if(t===void 0)return v("not a Cargo version requirement");if(t.length===0)return R([j]);let r=j;for(let i of t){let s=H(r,Xn(i));if(s===void 0)return v("a requirement no version can satisfy");r=s}return R([r])}function Xn(n){let e={major:n.major,minor:n.minor,patch:n.patch,pre:n.pre};switch(n.op){case"exact":case"wildcard":return Ee(e);case"greater":return Ye(e);case"greaterEq":return q(e);case"less":return we(e);case"lessEq":return ke(e);case"tilde":return Qe(e);case"caret":return en(e)}}function me(n){let e=M(p(n));return e===void 0?v("not a version"):e.major===void 0?w("a wildcard minimum version"):R([q(e)])}function D(n){let e=p(n);if(e==="")return R([j]);let t=Qn(e);if(t!==void 0)return w(t);let r=[];for(let i of e.split("||")){let s=Jn(p(i));if("kind"in s)return s;s.interval!==void 0&&r.push(s.interval)}return r.length===0?v("a range no version can satisfy"):R(r)}function Jn(n){let e=Hn(n);if(e.length===0)return{interval:j};if(e.length===3&&e[1]==="-"){let r=M(e[0]),i=M(e[2]);return r===void 0||i===void 0?v("not a version range"):{interval:{lower:q(r).lower,upper:ke(i).upper}}}let t=j;for(let r of e){let i=Gn(r);if("kind"in i)return i;let s=H(t,i);if(s===void 0)return{interval:void 0};t=s}return{interval:t}}var Zn=Object.freeze([">=","<=",">","<","=","~"]);function Hn(n){let e=[],t;for(let r of Ue(n)){if(t!==void 0){e.push(`${t}${r}`),t=void 0;continue}if(Zn.includes(r)||r==="^"){t=r;continue}e.push(r)}return t!==void 0&&e.push(t),e}function Gn(n){let[e,t]=Ge(n);if(e!==""&&p(t)==="")return v("an operator with no version");let r=M(t);if(r===void 0)return Yn(n);if(r.major===void 0)return j;switch(e){case"^":return en(r);case"~":return Qe(r);case">=":return q(r);case">":return Ye(r);case"<=":return ke(r);case"<":return we(r);default:return Ee(r)}}function Yn(n){return/^[A-Za-z][A-Za-z0-9-]*$/.test(n)?w("a dist tag is a moving target, not a version range"):v("not an npm version range")}function Qn(n){if(n.includes("://")||n.startsWith("git@"))return"a URL or git specifier resolves outside the registry";if(n.includes(":"))return"a protocol specifier resolves outside the registry";if(n.includes("/")||n.startsWith("."))return"a path or repository shorthand resolves outside the registry"}function he(n){let e=p(n);if(e==="")return R([j]);let t=j;for(let r of e.split(",")){let i=p(r);if(i==="")return v("an empty version clause");let s=et(i);if("kind"in s)return s;let o=H(t,s);if(o===void 0)return v("a specifier no version can satisfy");t=o}return R([t])}function et(n){for(let[s,o]of[["~=","PEP 440 compatible-release (~=)"],["!=","PEP 440 version exclusion (!=)"],["===","PEP 440 arbitrary equality (===)"]])if(n.startsWith(s))return w(o);let[e,t]=Ge(n),r=p(t);if(r.includes("*"))return w("a PEP 440 wildcard release clause");let i=tt(r);if(i===void 0)return nt(r);switch(e){case">=":return q(i);case">":return ot(i);case"<=":return at(i);case"<":return we(i);case"==":return st(i);default:return w("a PEP 440 clause with no operator")}}function nt(n){for(let e of["!","+","post","dev","*"])if(n.includes(e))return w("a PEP 440 version form this tool does not model");return v("not a PEP 440 version")}function tt(n){let e=rt(n);if(e===void 0)return;let t=M(e[0]);if(t!==void 0)return{...t,pre:e[1]}}function rt(n){let e=n.search(/[A-Za-z]/);if(e===-1)return[n,""];let t=n.slice(0,e),r=n.slice(e),i=r.search(/[0-9]/),s=i===-1?0:i,o=r.slice(0,s),a=r.slice(s);if(!["a","b","rc"].includes(o)||a==="")return;let c=oe(`${o}.${a}`);if(c!==void 0)return[t.replace(/\.+$/,""),c]}function He(n){let e=Fe(p(n).replace(/^v+/,""));return e===void 0?v("not a go module version"):R([be(e)])}function ge(n){let e=p(n);if(ye(e))return w("a commit SHA is a pin, but not a version");let t=M(e);return t===void 0?w("a branch or tag name is a moving reference, not a version"):t.major===void 0?w("a wildcard action reference"):R([Ee(t)])}function ye(n){return/^[0-9A-Fa-f]*$/.test(n)&&(n.length===40||n.length>=7&&/[A-Fa-f]/.test(n))}var F=Object.freeze(["latest","stable","nightly","beta","current","node","lts"]);function xe(n){let e=p(n);return F.includes(e)||e.startsWith("lts/")?w("a channel name is a moving target, not a version"):D(e)}var de=0xffffffffffffffffn,Ke=n=>n==="*"||n==="x"||n==="X";function it(n){if(!/^\+?[0-9]+$/.test(n))return;let e=BigInt(n.replace(/^\+/,""));return e>de?void 0:e}function M(n){let e=p(n);if((e.startsWith("v")||e.startsWith("V"))&&(e=e.slice(1)),e===""||Ke(e))return{major:void 0,minor:void 0,patch:void 0,pre:""};e=e.split("+")[0];let t=e,r="",i=e.indexOf("-");if(i!==-1){t=e.slice(0,i);let d=oe(e.slice(i+1));if(d===void 0)return;r=d}let s=[void 0,void 0,void 0],o=t.split("."),a=0;for(;a<3;a++){let d=o[a];if(d===void 0||Ke(d)){d!==void 0&&a++;break}let f=it(d);if(f===void 0)return;s[a]=f}let c=o[a];if(!(c!==void 0&&c!=="")&&s[0]!==void 0)return{major:s[0],minor:s[1],patch:s[2],pre:r}}function Ge(n){for(let e of[">=","<=","==","^","~",">","<","="])if(n.startsWith(e))return[e,n.slice(e.length)];return["",n]}var T=n=>n+1n>de?de:n+1n,N=(n,e,t,r)=>({major:n,minor:e,patch:t,pre:r,build:""}),b=n=>N(n.major??0n,n.minor??0n,n.patch??0n,n.pre);function ve(n){if(n.major!==void 0){if(n.minor===void 0)return N(T(n.major),0n,0n,"");if(n.patch===void 0)return N(n.major,T(n.minor),0n,"")}}var be=n=>({lower:{version:n,inclusive:!0},upper:{version:n,inclusive:!0}}),q=n=>({lower:{version:b(n),inclusive:!0},upper:void 0});function Ye(n){let e=ve(n);return e!==void 0?{lower:{version:e,inclusive:!0},upper:void 0}:{lower:{version:b(n),inclusive:!1},upper:void 0}}var we=n=>({lower:void 0,upper:{version:b(n),inclusive:!1}});function ke(n){let e=ve(n);return e!==void 0?{lower:void 0,upper:{version:e,inclusive:!1}}:{lower:void 0,upper:{version:b(n),inclusive:!0}}}function Ee(n){let e=ve(n);return e!==void 0?{lower:{version:b(n),inclusive:!0},upper:{version:e,inclusive:!1}}:be(b(n))}var st=n=>be(b(n)),ot=n=>({lower:{version:b(n),inclusive:!1},upper:void 0}),at=n=>({lower:void 0,upper:{version:b(n),inclusive:!0}});function Qe(n){let e=n.major??0n,t=n.minor!==void 0?N(e,T(n.minor),0n,""):N(T(e),0n,0n,"");return ue(b(n),t)}function en(n){let e=n.major??0n;if(e>0n)return ue(b(n),N(T(e),0n,0n,""));let t;return n.minor===0n&&n.patch!==void 0?t=N(0n,0n,T(n.patch),""):n.minor!==void 0?t=N(0n,T(n.minor),0n,""):t=N(1n,0n,0n,""),ue(b(n),t)}var ue=(n,e)=>({lower:{version:n,inclusive:!0},upper:{version:e,inclusive:!1}});var Ne=Object.freeze(["cargo","ci","go","npm","python"]),L=n=>Ne.indexOf(n),nn=Object.freeze({"package-json":"npm","cargo-toml":"cargo","pyproject-toml":"python","go-mod":"go",workflow:"ci"});function dt(n){return n.split(/[/\\]/).at(-1)}function tn(n){let e=n.replace(/\\/g,"/");if((e.startsWith(".github/workflows/")||e.includes("/.github/workflows/"))&&(e.endsWith(".yml")||e.endsWith(".yaml")))return"workflow";switch(dt(e)){case"package.json":return"package-json";case"Cargo.toml":return"cargo-toml";case"pyproject.toml":return"pyproject-toml";case"go.mod":return"go-mod";default:return}}function rn(n){let e=p(n);return e===""||e.includes("${{")||e.includes(",")||e.startsWith("[")?!1:e.startsWith("v")||e.startsWith("V")?/^[0-9]/.test(e.slice(1)):/^[0-9^~><=*]/.test(e)?!0:F.includes(e)||e.startsWith("lts/")}function sn(n){let e=n.startsWith("/"),t=n.split("/").filter((r,i)=>r!==""&&(r!=="."||i===0));return(e?"/":"")+t.join("/")}var P=Object.freeze({kind:"other"}),B=class extends Error{},l=Object.freeze({eofList:"EOF while parsing a list",eofObject:"EOF while parsing an object",eofString:"EOF while parsing a string",eofValue:"EOF while parsing a value",colon:"expected `:`",listCommaOrEnd:"expected `,` or `]`",objectCommaOrEnd:"expected `,` or `}`",ident:"expected ident",value:"expected value",escape:"invalid escape",number:"invalid number",range:"number out of range",control:"control character (\\u0000-\\u001F) found while parsing a string",key:"key must be a string",loneSurrogate:"lone leading surrogate in hex escape",hexEnd:"unexpected end of hex escape",trailingComma:"trailing comma",trailingCharacters:"trailing characters",recursion:"recursion limit exceeded"}),Re=0xffffffffffffffffn,G=2147483647,ut=Array.from({length:309},(n,e)=>+`1e${e}`),on=new TextDecoder("utf-8",{ignoreBOM:!0});function dn(n){let e=new Se(new TextEncoder().encode(n));try{let t=e.value();return e.end(),t}catch(t){throw t instanceof B?new Error(t.message):t}}var Se=class{constructor(e){this.bytes=e}bytes;index=0;remainingDepth=128;at(e){let t=0,r=1;for(let i=0;i<e;i++)this.bytes[i]===10&&(r++,t=i+1);return`at line ${r} column ${e-t}`}error(e){return new B(`${e} ${this.at(this.index)}`)}peekError(e){return new B(`${e} ${this.at(Math.min(this.bytes.length,this.index+1))}`)}peek(){return this.bytes[this.index]}peekOrNull(){return this.bytes[this.index]??0}next(){if(!(this.index>=this.bytes.length))return this.bytes[this.index++]}whitespace(){for(;;){let e=this.peek();if(e!==32&&e!==10&&e!==9&&e!==13)return e;this.index++}}end(){if(this.whitespace()!==void 0)throw this.peekError(l.trailingCharacters)}value(){let e=this.whitespace();if(e===void 0)throw this.peekError(l.eofValue);switch(e){case 110:return this.index++,this.ident("ull"),P;case 116:return this.index++,this.ident("rue"),P;case 102:return this.index++,this.ident("alse"),P;case 45:return this.index++,this.integer(),P;case 34:return this.index++,{kind:"text",text:this.string()};case 91:return this.descend(),this.index++,this.sequence(),this.remainingDepth++,this.endSequence(),P;case 123:{this.descend(),this.index++;let t=this.map();return this.remainingDepth++,this.endMap(),{kind:"object",entries:lt(t)}}default:if(e>=48&&e<=57)return this.integer(),P;throw this.peekError(l.value)}}descend(){if(this.remainingDepth--,this.remainingDepth===0)throw this.peekError(l.recursion)}ident(e){for(let t of e){let r=this.next();if(r===void 0)throw this.error(l.eofValue);if(r!==t.charCodeAt(0))throw this.error(l.ident)}}map(){let e=[],t=!0;for(;;){let r=this.whitespace();if(r===void 0)throw this.peekError(l.eofObject);if(r===125)return e;if(t){if(t=!1,r!==34)throw this.peekError(l.key)}else if(r===44){this.index++;let s=this.whitespace();if(s===125)throw this.peekError(l.trailingComma);if(s===void 0)throw this.peekError(l.eofValue);if(s!==34)throw this.peekError(l.key)}else throw this.peekError(l.objectCommaOrEnd);this.index++;let i=this.string();this.colon(),e.push([i,this.value()])}}colon(){let e=this.whitespace();if(e===58){this.index++;return}throw e===void 0?this.peekError(l.eofObject):this.peekError(l.colon)}endMap(){let e=this.whitespace();if(e===125){this.index++;return}throw e===44?this.peekError(l.trailingComma):e===void 0?this.peekError(l.eofObject):this.peekError(l.trailingCharacters)}sequence(){let e=!0;for(;;){let t=this.whitespace();if(t===void 0)throw this.peekError(l.eofList);if(t===93)return;if(e)e=!1;else if(t===44){this.index++;let r=this.whitespace();if(r===93)throw this.peekError(l.trailingComma);if(r===void 0)throw this.peekError(l.eofValue)}else throw this.peekError(l.listCommaOrEnd);this.value()}}endSequence(){let e=this.whitespace();if(e===93){this.index++;return}throw e===44?(this.index++,this.whitespace()===93?this.peekError(l.trailingComma):this.peekError(l.trailingCharacters)):e===void 0?this.peekError(l.eofList):this.peekError(l.trailingCharacters)}integer(){let e=this.next();if(e===void 0)throw this.error(l.eofValue);if(e===48){if(_(this.peekOrNull()))throw this.peekError(l.number);this.number(0n);return}if(e<49||e>57)throw this.error(l.number);let t=BigInt(e-48);for(;;){let r=this.peekOrNull();if(!_(r)){this.number(t);return}let i=BigInt(r-48);if(an(t,i)){this.longInteger(t);return}this.index++,t=t*10n+i}}number(e){let t=this.peekOrNull();t===46?this.decimal(e,0):(t===101||t===69)&&this.exponent(e,0)}decimal(e,t){this.index++;let r=e,i=0;for(;;){let a=this.peekOrNull();if(!_(a))break;let c=BigInt(a-48);if(an(r,c)){this.decimalOverflow(r,t+i);return}this.index++,r=r*10n+c,i--}if(i===0)throw this.peek()!==void 0?this.peekError(l.number):this.peekError(l.eofValue);let s=t+i,o=this.peekOrNull();o===101||o===69?this.exponent(r,s):this.fromParts(r,s)}exponent(e,t){this.index++;let r=!0,i=this.peekOrNull();i===43?this.index++:i===45&&(this.index++,r=!1);let s=this.next();if(s===void 0)throw this.error(l.eofValue);if(!_(s))throw this.error(l.number);let o=s-48;for(;;){let c=this.peekOrNull();if(!_(c))break;this.index++;let d=c-48;if(o>=Math.floor(G/10)&&(o>Math.floor(G/10)||d>G%10)){this.exponentOverflow(e===0n,r);return}o=o*10+d}let a=cn(r?t+o:t-o);this.fromParts(e,a)}longInteger(e){let t=0;for(;;){let r=this.peekOrNull();if(_(r)){this.index++,t++;continue}if(r===46){this.decimal(e,t);return}if(r===101||r===69){this.exponent(e,t);return}this.fromParts(e,t);return}}decimalOverflow(e,t){for(;_(this.peekOrNull());)this.index++;let r=this.peekOrNull();r===101||r===69?this.exponent(e,t):this.fromParts(e,t)}exponentOverflow(e,t){if(!e&&t)throw this.error(l.range);for(;_(this.peekOrNull());)this.index++}fromParts(e,t){let r=Number(e),i=t;for(;;){let s=ut[Math.abs(i)];if(s!==void 0){if(i>=0&&(r*=s,!Number.isFinite(r)))throw this.error(l.range);return}if(r===0)return;if(i>=0)throw this.error(l.range);r/=1e308,i+=308}}string(){let e=this.bytes,t=this.index,r=[];for(;;){for(;this.index<e.length;){let s=e[this.index];if(s===34||s===92||s<32)break;this.index++}if(this.index===e.length)throw this.error(l.eofString);let i=e[this.index];if(i===34)return r.push(on.decode(e.subarray(t,this.index))),this.index++,r.join("");if(i===92){r.push(on.decode(e.subarray(t,this.index))),this.index++,r.push(this.escape()),t=this.index;continue}throw this.index++,this.error(l.control)}}escape(){let e=this.next();if(e===void 0)throw this.error(l.eofString);switch(e){case 34:return'"';case 92:return"\\";case 47:return"/";case 98:return"\b";case 102:return"\f";case 110:return`
|
|
4
|
+
`;case 114:return"\r";case 116:return" ";case 117:return this.unicodeEscape();default:throw this.error(l.escape)}}unicodeEscape(){let e=this.hex();if(e>=56320&&e<=57343)throw this.error(l.loneSurrogate);if(e<55296||e>56319)return String.fromCharCode(e);if(this.peekOrEof()!==92)throw this.index++,this.error(l.hexEnd);if(this.index++,this.peekOrEof()!==117)throw this.index++,this.error(l.hexEnd);this.index++;let t=this.hex();if(t<56320||t>57343)throw this.error(l.loneSurrogate);return String.fromCharCode(e,t)}peekOrEof(){let e=this.peek();if(e===void 0)throw this.error(l.eofString);return e}hex(){if(this.bytes.length-this.index<4)throw this.index=this.bytes.length,this.error(l.eofString);let e=0,t=!0;for(let r=0;r<4;r++){let i=ft(this.bytes[this.index+r]);i<0&&(t=!1),e=e*16+i}if(this.index+=4,!t)throw this.error(l.escape);return e}};function lt(n){let e=new Map;for(let[t,r]of n)e.set(t,r);return[...e.entries()].sort(([t],[r])=>h(t,r))}function _(n){return n>=48&&n<=57}function ft(n){return n>=48&&n<=57?n-48:n>=65&&n<=70?n-65+10:n>=97&&n<=102?n-97+10:-1}function an(n,e){return n>=Re/10n&&(n>Re/10n||e>Re%10n)}function cn(n){return Math.max(-2147483648,Math.min(G,n))}var Y=class extends Error{},u=()=>{throw new Y},A=()=>({kind:"table",implicit:!1,dotted:!1,inline:!1,entries:new Map}),pt=n=>/^[A-Za-z0-9_-]$/.test(n),$e=n=>n===" "||n===" ";function mt(n){return n===9||n>=32&&n<=126||n>=128}var je=class{constructor(e){this.text=e;e.startsWith("\uFEFF")&&(this.at=1)}text;at=0;root=A();current=A();header;peek(e=0){return this.text.charAt(this.at+e)}eof(){return this.at>=this.text.length}skipWs(){for(;$e(this.peek());)this.at++}comment(){if(this.peek()==="#")for(this.at++;!this.eof();){let e=this.text.codePointAt(this.at);if(e===10||e===13&&this.peek(1)===`
|
|
5
|
+
`)return;mt(e)||u(),this.at+=e>65535?2:1}}newline(){return this.peek()===`
|
|
6
|
+
`?(this.at++,!0):this.peek()==="\r"?(this.peek(1)!==`
|
|
7
|
+
`&&u(),this.at+=2,!0):!1}skipWsCommentNewline(){for(;;)if(this.skipWs(),this.comment(),!this.newline())return}parse(){for(;!this.eof();){this.skipWs();let e=this.peek();e==="["?this.tableHeader():e!=="#"&&e!==`
|
|
8
|
+
`&&e!=="\r"&&e!==""&&this.keyval(),this.skipWs(),this.comment(),!this.newline()&&!this.eof()&&u()}return this.finishTable(),this.root.entries}simpleKey(){let e=this.peek();if(e==='"')return this.basicString();if(e==="'")return this.literalString();let t=this.at;for(;pt(this.peek());)this.at++;return this.at===t&&u(),this.text.slice(t,this.at)}key(){let e=[this.simpleKey()];for(;;){let t=this.at;if(this.skipWs(),this.peek()!==".")return this.at=t,e;this.at++,this.skipWs(),e.push(this.simpleKey())}}tableHeader(){let e=this.peek(1)==="[";this.at+=e?2:1,this.skipWs();let t=this.key();this.skipWs(),e?((this.peek()!=="]"||this.peek(1)!=="]")&&u(),this.at+=2):(this.peek()!=="]"&&u(),this.at++),this.finishTable(),this.startTable({path:t.slice(0,-1),key:t.at(-1),array:e})}startTable(e){if(!e.array){let t=Oe(this.root,e.path,!1),r=t.entries.get(e.key);r!==void 0&&(t.entries.delete(e.key),r.kind==="table"&&r.implicit&&!r.dotted?this.current=r:u())}this.current.implicit=!1,this.current.dotted=!1,this.header=e}finishTable(){let e=this.current;this.current=A();let t=this.header;if(this.header=void 0,t===void 0){this.root=e;return}let r=Oe(this.root,t.path,!1);if(t.array){let i=r.entries.get(t.key);i===void 0&&(i={kind:"array",tables:!0,items:[]},r.entries.set(t.key,i)),(i.kind!=="array"||!i.tables)&&u(),i.items.push(e);return}r.entries.set(t.key,e)}keyval(){let e=this.key();this.skipWs(),this.peek()!=="="&&u(),this.at++,this.skipWs();let t=this.value(),r=e.length>1,i=Oe(this.current,e.slice(0,-1),r);r&&!i.implicit&&u();let s=e.at(-1);i.entries.has(s)&&u(),i.entries.set(s,t)}value(){let e=this.peek();return e==='"'?{kind:"value",value:{type:"string",value:this.text.startsWith('"""',this.at)?this.mlBasicString():this.basicString()}}:e==="'"?{kind:"value",value:{type:"string",value:this.text.startsWith("'''",this.at)?this.mlLiteralString():this.literalString()}}:e==="["?this.array():e==="{"?this.inlineTable():{kind:"value",value:this.scalar()}}array(){this.at++;let e=[];for(this.skipWsCommentNewline();this.peek()!=="]";)e.push(this.value()),this.skipWsCommentNewline(),this.peek()===","?(this.at++,this.skipWsCommentNewline()):this.peek()!=="]"&&u();return this.at++,{kind:"array",tables:!1,items:e}}inlineTable(){this.at++;let e=A();for(e.inline=!0,this.skipWsCommentNewline();this.peek()!=="}";){let t=this.key();this.skipWs(),this.peek()!=="="&&u(),this.at++,this.skipWs();let r=this.value(),i=ht(e,t.slice(0,-1));i.dotted===(t.length===1)&&u();let s=t.at(-1);i.entries.has(s)&&u(),i.entries.set(s,r),this.skipWsCommentNewline(),this.peek()===","?(this.at++,this.skipWsCommentNewline()):this.peek()!=="}"&&u()}return this.at++,e}basicString(){this.at++;let e="";for(;;){this.eof()&&u();let t=this.text.codePointAt(this.at),r=String.fromCodePoint(t);if(r==='"')return this.at++,e;if(r==="\\"){e+=this.escape();continue}t===9||t===32||t===33||t>=35&&t<=126||t>=128||u(),e+=r,this.at+=r.length}}escape(){this.at++;let e=this.peek();this.at++;let t={b:"\b",e:"\x1B",f:"\f",n:`
|
|
9
|
+
`,r:"\r",t:" ","\\":"\\",'"':'"'};if(t[e]!==void 0)return t[e];let r=e==="x"?2:e==="u"?4:e==="U"?8:0;r===0&&u();let i=this.text.slice(this.at,this.at+r);new RegExp(`^[0-9A-Fa-f]{${r}}$`).test(i)||u(),this.at+=r;let s=Number.parseInt(i,16);return(s>1114111||s>=55296&&s<=57343)&&u(),String.fromCodePoint(s)}mlBasicString(){this.at+=3,this.newline();let e="";for(;;){if(this.eof()&&u(),this.text.startsWith('"""',this.at)){let i=3;for(;this.peek(i)==='"';)i++;return i>5&&u(),e+='"'.repeat(i-3),this.at+=i,e}let t=this.text.codePointAt(this.at),r=String.fromCodePoint(t);if(r==="\\"){let i=this.at+1;for(;$e(this.text.charAt(i));)i++;let s=this.text.charAt(i);if(s===`
|
|
10
|
+
`||s==="\r"&&this.text.charAt(i+1)===`
|
|
11
|
+
`){for(this.at=i;;){let o=this.peek();if($e(o))this.at++;else if(!this.newline())break}continue}e+=this.escape();continue}if(r===`
|
|
12
|
+
`||r==="\r"){this.newline(),e+=`
|
|
13
|
+
`;continue}t===9||t>=32&&t<=126||t>=128||u(),e+=r,this.at+=r.length}}literalString(){this.at++;let e=this.at;for(;;){this.eof()&&u();let t=this.text.codePointAt(this.at);if(t===39){let r=this.text.slice(e,this.at);return this.at++,r}t===9||t>=32&&t<=126||t>=128||u(),this.at+=t>65535?2:1}}mlLiteralString(){this.at+=3,this.newline();let e="";for(;;){if(this.eof()&&u(),this.text.startsWith("'''",this.at)){let i=3;for(;this.peek(i)==="'";)i++;return i>5&&u(),e+="'".repeat(i-3),this.at+=i,e}let t=this.text.codePointAt(this.at);if(t===10||t===13){this.newline(),e+=`
|
|
14
|
+
`;continue}t===9||t>=32&&t<=126||t>=128||u();let r=String.fromCodePoint(t);e+=r,this.at+=r.length}}scalar(){let e=this.text.slice(this.at),t=(o,a)=>{let c=e.charAt(o);return c!==""&&!/^[ \t\r\n,\]}#]$/.test(c)&&u(),this.at+=o,a},r=/^(true|false)/.exec(e);if(r)return t(r[0].length,{type:"boolean",value:r[0]==="true"});if(r=/^[0-9]{4}-[0-9]{2}-[0-9]{2}(?:[Tt ][0-9]{2}:[0-9]{2}(?::[0-9]{2}(?:\.[0-9]+)?)?(?:[Zz]|[+-][0-9]{2}:[0-9]{2})?)?/.exec(e),r){let o=r[0];return o.length>10&&o.charAt(10)===" "&&!/^[0-9]{2}:/.test(o.slice(11))&&(o=o.slice(0,10)),t(o.length,{type:"datetime",value:un(o)})}if(r=/^[0-9]{2}:[0-9]{2}(?::[0-9]{2}(?:\.[0-9]+)?)?/.exec(e),r)return t(r[0].length,{type:"datetime",value:un(r[0])});if(r=/^[+-]?(?:inf|nan)/.exec(e),r){let o=r[0],a=o.endsWith("nan")?Number.NaN:o.startsWith("-")?-1/0:1/0;return t(o.length,{type:"float",value:a})}if(r=/^0x[0-9A-Fa-f](?:_?[0-9A-Fa-f])*|^0o[0-7](?:_?[0-7])*|^0b[01](?:_?[01])*/.exec(e),r){let o=r[0],a=BigInt(`0${o.charAt(1)}${o.slice(2).replace(/_/g,"")}`);return a>0x7fffffffffffffffn&&u(),t(o.length,{type:"integer",value:a})}let i="[+-]?(?:0|[1-9](?:_?[0-9])*)",s="[0-9](?:_?[0-9])*";if(r=new RegExp(`^${i}(?:\\.${s})?(?:[eE][+-]?${s})?`).exec(e),r){let o=r[0],a=o.replace(/_/g,"");if(/[.eE]/.test(o)){let d=Number(a);return Number.isFinite(d)||u(),t(o.length,{type:"float",value:d})}let c=BigInt(a);return(c>0x7fffffffffffffffn||c<-0x8000000000000000n)&&u(),t(o.length,{type:"integer",value:c})}return u()}};function Oe(n,e,t){let r=n;for(let i of e){let s=r.entries.get(i);if(s===void 0){let o=A();o.implicit=!0,o.dotted=t,r.entries.set(i,o),r=o}else if(s.kind==="array"){s.tables||u();let o=s.items.at(-1);if(o?.kind!=="table")return u();r=o}else s.kind==="table"?(s.inline&&u(),t&&s.implicit&&(s.dotted=!0),t&&!s.implicit&&u(),r=s):u()}return r}function ht(n,e){let t=n;for(let r of e){let i=t.entries.get(r);if(i===void 0){let s=A();s.implicit=!0,s.dotted=!0,s.inline=!0,t.entries.set(r,s),t=s}else i.kind==="table"?(i.implicit||u(),t=i):u()}return t}function un(n){let e=/^([0-9]{4})-([0-9]{2})-([0-9]{2})/.exec(n),t=n,r={};if(e){let[x,y,ne]=[Number(e[1]),Number(e[2]),Number(e[3])];(y<1||y>12)&&u();let _n=x%4===0&&(x%100!==0||x%400===0),Tn=y===2?_n?29:28:[4,6,9,11].includes(y)?30:31;if((ne<1||ne>Tn)&&u(),r={date:{year:x,month:y,day:ne}},t=n.slice(10),t==="")return r;t=t.slice(1)}let i=/^([0-9]{2}):([0-9]{2})(?::([0-9]{2})(?:\.([0-9]+))?)?/.exec(t),[s,o]=[Number(i[1]),Number(i[2])],a=i[3]===void 0?void 0:Number(i[3]),c=i[4]===void 0?void 0:Number(`${i[4]}000000000`.slice(0,9));if((s>23||o>59||(a??0)>60)&&u(),r.time={hour:s,minute:o,...a===void 0?{}:{second:a},...c===void 0?{}:{nanosecond:c}},t=t.slice(i[0].length),t==="")return r;if(r.date||u(),t==="Z"||t==="z")return{...r,offset:"Z"};let d=/^([+-])([0-9]{2}):([0-9]{2})$/.exec(t);if(!d)return u();let[f,m]=[Number(d[2]),Number(d[3])];return(f>23||m>59)&&u(),{...r,offset:(d[1]==="-"?-1:1)*(f*60+m)}}function _e(n){if(n.kind==="value")return n.value;if(n.kind==="array")return{type:"array",value:n.items.map(_e)};let e=[...n.entries.entries()].sort(([t],[r])=>h(t,r));return{type:"table",value:new Map(e.map(([t,r])=>[t,_e(r)]))}}function Te(n){try{let e=new je(n).parse(),t=_e({...A(),entries:e});return t.type==="table"?t.value:void 0}catch(e){if(e instanceof Y)return;throw e}}var $=(n,e)=>String(n).padStart(e,"0");function gt(n){let e="";if(n.date&&(e+=`${$(n.date.year,4)}-${$(n.date.month,2)}-${$(n.date.day,2)}`),n.time){n.date&&(e+="T");let t=n.time;e+=`${$(t.hour,2)}:${$(t.minute,2)}`;let r=t.second??(t.nanosecond!==void 0?0:void 0);r!==void 0&&(e+=`:${$(r,2)}`),t.nanosecond!==void 0&&(e+=`.${$(t.nanosecond,9).replace(/0+$/,"")||"0"}`)}if(n.offset==="Z")e+="Z";else if(n.offset!==void 0){let t=n.offset<0?"-":"+",r=Math.abs(n.offset);e+=`${t}${$(Math.trunc(r/60),2)}:${$(r%60,2)}`}return e}function ln(n){if(Number.isNaN(n))return"NaN";if(!Number.isFinite(n))return n<0?"-inf":"inf";let[e,t]=Math.abs(n).toExponential().split("e"),r=e.replace(".",""),i=Number(t),s;return i>=r.length-1?s=r+"0".repeat(i-r.length+1):i>=0?s=`${r.slice(0,i+1)}.${r.slice(i+1)}`:s=`0.${"0".repeat(-i-1)}${r}`,(n<0||Object.is(n,-0)?"-":"")+s}function yt(n){return Number.isNaN(n)?"nan":n===0?Object.is(n,-0)?"-0.0":"0.0":Number.isFinite(n)&&n%1===0?`${ln(n)}.0`:ln(n)}function xt(n){let e={singles:0,doubles:0,codes:!1,escape:!1,newline:!1},t=0,r=0;for(let i of new TextEncoder().encode(n))t=i===39?t+1:0,r=i===34?r+1:0,e.singles=Math.max(e.singles,t),e.doubles=Math.max(e.doubles,r),i===92?e.escape=!0:i===10?e.newline=!0:i!==9&&(i<=31||i===127)&&(e.codes=!0);return e}function U(n,e){let t="",r=0;for(let i of n){let s=i.codePointAt(0);if(s===34){if(r++,r>(e?2:0)){t+='\\"',r=0;continue}t+=i;continue}r=0;let o={8:"\\b",9:"\\t",12:"\\f",13:"\\r",92:"\\\\"};o[s]!==void 0?t+=o[s]:s===10?t+=e?`
|
|
15
|
+
`:"\\n":s<=31||s===127?t+=`\\u${s.toString(16).toUpperCase().padStart(4,"0")}`:t+=i}return t}function vt(n){let e=xt(n);if(!e.codes&&!e.escape&&e.doubles===0&&!e.newline)return`"${U(n,!1)}"`;if(!e.codes&&e.singles===0&&!e.newline)return`'${n}'`;let t=e.newline?`
|
|
16
|
+
`:"";return!e.codes&&!e.escape&&e.doubles<=2?`"""${t}${U(n,!0)}"""`:!e.codes&&e.singles<=2?`'''${t}${n}'''`:e.newline?`"""${t}${U(n,!0)}"""`:`"${U(n,!1)}"`}function bt(n){if(/^[A-Za-z0-9_-]+$/.test(n))return n;let e=new TextEncoder().encode(n),t=i=>e.some(i),r=t(i=>i!==9&&(i<=31||i===127));return!r&&!t(i=>i===92)&&!t(i=>i===34)?`"${n}"`:!r&&!t(i=>i===39)?`'${n}'`:`"${U(n,!1)}"`}function Q(n){switch(n.type){case"string":return vt(n.value);case"integer":return n.value.toString();case"float":return yt(n.value);case"boolean":return String(n.value);case"datetime":return gt(n.value);case"array":return`[${n.value.map(Q).join(", ")}]`;case"table":{let e=[...n.value.entries()].map(([t,r])=>` ${bt(t)} = ${Q(r)}`);return e.length===0?"{}":`{${e.join(",")} }`}}}var hn=n=>n==="dev"||n==="build";function k(n,e,t,r){return r===void 0?{file:n,key:e,constraint:t}:{file:n,key:e,constraint:t,line:r}}var Pe=class{entries=[];refusals=[];errors=[];push(e){e.constraint.kind==="unknown"&&this.refusals.push({reason:"unknown_grammar",ecosystem:e.ecosystem,name:e.name,message:`${e.constraint.reason}; excluded from comparison`,sites:[e.site]}),this.entries.push(e)}ambiguous(e,t,r,i){this.refusals.push({reason:"ambiguous_version_string",ecosystem:e,name:t,message:`${i}; excluded from comparison`,sites:[r]})}error(e){this.errors.push(e)}};function gn(n,e,t){let r=new Pe;return n==="package-json"?kt(r,e,t):n==="cargo-toml"?Et(r,e,t):n==="pyproject-toml"?$t(r,e,t):n==="go-mod"?jt(r,e,t):Tt(r,e,t),r}var wt=[["dependencies","runtime"],["devDependencies","dev"],["peerDependencies","peer"],["optionalDependencies","optional"]],Ae=(n,e)=>n.kind==="object"?n.entries.find(([t])=>t===e)?.[1]:void 0;function kt(n,e,t){let r;try{r=dn(t)}catch{n.error("not valid JSON");return}for(let[d,f]of wt){let m=Ae(r,d);if(m?.kind==="object")for(let[x,y]of m.entries){if(y.kind!=="text"){n.error(`${d}.${x} is not a version string`);continue}n.push({ecosystem:"npm",name:x,kind:f,site:k(e,`${d}.${x}`,y.text),constraint:D(y.text),floats:Ce(y.text)})}}let i=Ae(r,"engines");if(i?.kind==="object")for(let[d,f]of i.entries){if(f.kind!=="text"){n.error(`engines.${d} is not a version string`);continue}n.push({ecosystem:"npm",name:d,kind:"engine",site:k(e,`engines.${d}`,f.text),constraint:D(f.text),floats:Ce(f.text)})}let s=Ae(r,"packageManager");if(s?.kind!=="text")return;let o=s.text.indexOf("@");if(o===-1){n.error("packageManager is not <name>@<version>");return}let a=s.text.slice(0,o),c=s.text.slice(o+1).split("+")[0];n.push({ecosystem:"npm",name:a,kind:"tool",site:k(e,"packageManager",c),constraint:D(c),floats:Ce(c)})}function Ce(n){let e=p(n);return e===""||["*","x","X"].includes(e)?"an unbounded range accepts any future major":e==="latest"||e==="next"?"a dist tag resolves to whatever is newest at install time":yn(e)}function yn(n){return n.startsWith("^")&&n.slice(1).split(/[.-]/)[0]==="0"?"a caret on a 0.x version, which promises no stability":void 0}var fn=[["dependencies","runtime"],["dev-dependencies","dev"],["build-dependencies","build"]],W=(n,e)=>n?.type==="table"?n.value.get(e):void 0,ee=(n,e)=>e.split(".").reduce((t,r)=>W(t,r),n);function Et(n,e,t){let r=Te(t);if(r===void 0){n.error("not valid TOML");return}let i={type:"table",value:r};for(let[o,a]of fn)Me(n,e,W(i,o),o,a),Me(n,e,W(W(i,"workspace"),o),`workspace.${o}`,a);let s=W(i,"target");if(s?.type==="table")for(let[o,a]of s.value)for(let[c,d]of fn)Me(n,e,W(a,c),`target.${o}.${c}`,d);for(let o of["package.rust-version","workspace.package.rust-version"]){let a=ee(i,o);a?.type==="string"&&n.push({ecosystem:"cargo",name:"rust",kind:"msrv",site:k(e,o,a.value),constraint:me(a.value),floats:void 0})}}function Me(n,e,t,r,i){if(t?.type==="table")for(let[s,o]of t.value){let[a,c,d]=Nt(s,o),f=d.kind==="range"?St(c):void 0;n.push({ecosystem:"cargo",name:a,kind:i,site:k(e,`${r}.${s}`,c),constraint:d,floats:f})}}function Nt(n,e){if(e.type==="string")return[n,e.value,pe(e.value)];if(e.type!=="table")return[n,Q(e),{kind:"malformed",reason:"not a version string or a dependency table"}];let t=e.value.get("package"),r=t?.type==="string"?t.value:n,i=e.value.get("version");return i?.type==="string"?[r,i.value,pe(i.value)]:[r,"",{kind:"unknown",reason:Rt(e.value)}]}function Rt(n){return n.has("workspace")?"an inherited workspace dependency carries its version elsewhere":n.has("git")?"a git dependency resolves outside the registry":n.has("path")?"a path dependency with no version has no registry requirement":"a dependency table with no version"}function St(n){let e=p(n);if(e===""||["*","x","X"].includes(e))return"an unbounded range accepts any future major";let t=yn(e);return t!==void 0?t:/^[0-9]/.test(e)&&e.startsWith("0")?"a caret on a 0.x version, which promises no stability":void 0}function $t(n,e,t){let r=Te(t);if(r===void 0){n.error("not valid TOML");return}let i={type:"table",value:r},s=ee(i,"project.requires-python");s?.type==="string"&&n.push({ecosystem:"python",name:"python",kind:"engine",site:k(e,"project.requires-python",s.value),constraint:he(s.value),floats:xn(s.value)}),pn(n,e,ee(i,"project.dependencies"),"project.dependencies","runtime");let o=ee(i,"project.optional-dependencies");if(o?.type==="table")for(let[a,c]of o.value)pn(n,e,c,`project.optional-dependencies.${a}`,"dev")}function pn(n,e,t,r,i){if(t?.type==="array")for(let s of t.value){if(s.type!=="string"){n.error(`${r} holds something that is not a requirement`);continue}let o=s.value,[a,c,d]=Ot(o);if(a===""){n.error(`${r}: "${o}" names no distribution`);continue}let f=d.kind==="range"?xn(c):void 0;n.push({ecosystem:"python",name:a,kind:i,site:k(e,`${r}.${o}`,c),constraint:d,floats:f})}}function Ot(n){let e=p(n),t=/^[A-Za-z0-9._-]*/.exec(e)?.[0]??"",r=p(e.slice(t.length));if(e.includes(";"))return[t,"",{kind:"unknown",reason:"an environment marker"}];if(r.startsWith("@"))return[t,"",{kind:"unknown",reason:"a direct URL reference"}];let i=r;if(r.startsWith("[")){let o=r.indexOf("]",1);if(o===-1)return[t,r,{kind:"malformed",reason:"an extras group with no closing bracket"}];i=p(r.slice(o+1))}let s=p(i.replace(/^\(+/,"").replace(/\)+$/,""));return[t,s,he(s)]}var xn=n=>p(n)===""?"no version specifier at all":void 0;function jt(n,e,t){let r=!1;ce(t).forEach((i,s)=>{let o=p(_t(i));if(o===""||i.includes("// indirect"))return;let a=s+1;if(o===")"){r=!1;return}if(o.startsWith("go ")){let y=p(o.slice(3));n.push(mn(e,"go","engine","go",me(y),y,a));return}if(o.startsWith("require (")){r=!0;return}let c;if(o.startsWith("require "))c=p(o.slice(8));else if(r)c=o;else return;let d=Array.from(c).findIndex(Be);if(d===-1){n.error(`${c} is a require with no version`);return}let f=Array.from(c),m=f.slice(0,d).join(""),x=p(f.slice(d+1).join(""));n.push(mn(e,m,"runtime","require",He(x),x,a))})}function mn(n,e,t,r,i,s,o){return{ecosystem:"go",name:e,kind:t,site:k(n,r,s,o),constraint:i,floats:void 0}}function _t(n){let e=n.indexOf("//");return e===-1?n:n.slice(0,e)}function Tt(n,e,t){ce(t).forEach((r,i)=>{let s=p(r);for(;s.startsWith("- ");)s=s.slice(2);if(s=p(s),s.startsWith("#"))return;let o=s.indexOf(":");if(o===-1)return;let a=p(s.slice(0,o)),c=Pt(s.slice(o+1)),d=i+1;if(a==="uses"){Ct(n,e,c,d);return}let f=At(a);if(f===void 0)return;let m=k(e,a,c,d);if(!rn(c)){n.ambiguous("ci",f,m,"not evidently a version");return}n.push({ecosystem:"ci",name:f,kind:f==="rust"?"msrv":"tool",site:m,constraint:xe(c),floats:vn(c)})})}function At(n){if(n==="toolchain")return"rust";if(!n.endsWith("-version"))return;let e=n.slice(0,-8);return e!==""&&/^[A-Za-z0-9-]+$/.test(e)?e:void 0}function Ct(n,e,t,r){let i=t.lastIndexOf("@");if(i===-1)return;let s=t.slice(0,i),o=t.slice(i+1),a=s.endsWith("rust-toolchain")&&!ye(o),c=k(e,a?"toolchain":"uses",o,r);if(a){n.push({ecosystem:"ci",name:"rust",kind:"msrv",site:c,constraint:xe(o),floats:vn(o)});return}n.push({ecosystem:"ci",name:s,kind:"action",site:c,constraint:ge(o),floats:Mt(o)})}function vn(n){let e=p(n);if(["*","x","X"].includes(e))return"an unbounded range accepts any future major";if(F.includes(e)||e.startsWith("lts/"))return"an unpinned tool version installs whatever is newest that day"}function Mt(n){if(ge(n).kind==="unknown"&&!/^[0-9A-Fa-f]*$/.test(n))return"a branch or tag reference moves under the workflow"}function Pt(n){let e=p(n);if(!(e.startsWith('"')||e.startsWith("'"))){let t=e.indexOf(" #");t!==-1&&(e=e.slice(0,t))}return p(p(e).replace(/^["']+|["']+$/g,""))}var bn=n=>n==="error"?0:n==="warning"?1:2;function wn(n){let e=[...It(n),...qt(n),...Lt(n),...Bt(n),...Ut(n)];return e.sort((t,r)=>bn(t.severity)-bn(r.severity)||h(t.code,r.code)||L(t.ecosystem)-L(r.ecosystem)||h(t.name,r.name)),{findings:e,refusals:[...zt(n),...Dt(n)]}}function z(n,e){let t=new Map;for(let r of n.filter(e)){let i=`${r.ecosystem}\0${r.name}`,s=t.get(i);s?s[2].push(r):t.set(i,[r.ecosystem,r.name,[r]])}return[...t.values()].sort((r,i)=>L(r[0])-L(i[0])||h(r[1],i[1]))}var Wt=(n,e)=>n.file===e.file&&n.key===e.key&&n.constraint===e.constraint&&n.line===e.line;function O(n){let e=n.map(t=>t.site).sort((t,r)=>h(t.file,r.file)||h(t.key,r.key));return e.filter((t,r)=>r===0||!Wt(t,e[r-1]))}function K(n){let e=n.map(t=>t.site.constraint).sort(h);return e.filter((t,r)=>r===0||t!==e[r-1])}function We(n){let e=[];for(let t of n){let r=S(t.constraint);r!==void 0&&!e.some(i=>Je(i,r))&&e.push(r)}return e.length}var Vt=n=>new Set(n.map(e=>e.site.file)).size,kn=n=>n.ecosystem==="ci"&&n.kind==="tool";function It(n){let e=r=>r.kind!=="msrv"&&!kn(r)&&S(r.constraint)!==void 0,t=[];for(let[r,i,s]of z(n,e)){if(We(s)<2)continue;let o=K(s),a=Ft(s);t.push(a?{code:"disjoint-constraint",severity:"error",ecosystem:r,name:i,message:`"${a[0].site.constraint}" (${a[0].site.file}) and "${a[1].site.constraint}" (${a[1].site.file}) cannot both be satisfied by one version`,sites:O(s)}:{code:"constraint-conflict",severity:"warning",ecosystem:r,name:i,message:`constrained ${o.length} different ways across ${Vt(s)} files: ${o.join(", ")}`,sites:O(s)})}return t}function Dt(n){return z(n,e=>kn(e)&&S(e.constraint)!==void 0).filter(([,,e])=>We(e)>1).map(([e,t,r])=>({reason:"per_job_tool_version",ecosystem:e,name:t,message:`installed as ${K(r).join(" and ")} by different jobs; a CI tool version belongs to the job that installs it, so these were not compared`,sites:O(r)}))}function Ft(n){for(let e=0;e<n.length;e++)for(let t=e+1;t<n.length;t++){let[r,i]=[n[e],n[t]],[s,o]=[S(r.constraint),S(i.constraint)];if(s!==void 0&&o!==void 0&&Ze(s,o))return[r,i]}}function qt(n){let e=n.filter(i=>i.kind==="msrv"&&i.ecosystem==="cargo"),t=[];if(We(e)>1){let i=K(e);t.push({code:"msrv-mismatch",severity:"warning",ecosystem:"cargo",name:"rust",message:`rust-version is declared ${i.length} different ways: ${i.join(", ")}`,sites:O(e)})}let r;for(let i of e){let s=S(i.constraint),o=s===void 0?void 0:fe(s);o!==void 0&&(r===void 0||E(o,r[0])>=0)&&(r=[o,i])}if(r===void 0)return t;for(let i of n.filter(s=>s.kind==="msrv"&&s.ecosystem==="ci")){let s=S(i.constraint),o=s===void 0?void 0:fe(s);o===void 0||E(o,r[0])>=0||t.push({code:"msrv-mismatch",severity:"warning",ecosystem:"ci",name:"rust",message:`CI builds on ${ae(o)}, below the declared minimum ${ae(r[0])} in ${r[1].site.file}`,sites:O([i,r[1]])})}return t}function Lt(n){return z(n,t=>{let r=S(t.constraint);return!hn(t.kind)&&r!==void 0&&Xe(r)}).map(([t,r,i])=>({code:"prerelease-in-production",severity:"warning",ecosystem:t,name:r,message:`a prerelease constraint outside dev dependencies: ${K(i).join(", ")}`,sites:O(i)}))}function Bt(n){let e=[];for(let[t,r,i]of z(n,s=>le(s.constraint)!==void 0)){let s=i.map(o=>le(o.constraint)).find(o=>o!==void 0);s!==void 0&&e.push({code:"malformed-constraint",severity:"error",ecosystem:t,name:r,message:`${s}: ${K(i).join(", ")}`,sites:O(i)})}return e}function Ut(n){let e=[];for(let[t,r,i]of z(n,s=>s.floats!==void 0)){let s=i.map(o=>o.floats).find(o=>o!==void 0);s!==void 0&&e.push({code:"floating-pin",severity:"info",ecosystem:t,name:r,message:s,sites:O(i)})}return e}function zt(n){let e=new Map;for(let t of n.filter(r=>r.kind!=="msrv")){let r=e.get(t.name);r||(r=new Map,e.set(t.name,r)),r.has(t.ecosystem)||r.set(t.ecosystem,t)}return[...e.entries()].sort(([t],[r])=>h(t,r)).filter(([,t])=>t.size>1).map(([t,r])=>{let i=Ne.filter(s=>r.has(s));return{reason:"cross_ecosystem",ecosystem:null,name:t,message:`appears in ${i.join(" and ")}; different ecosystems name different things, so these were not compared`,sites:O(i.map(s=>r.get(s)))}})}function En(n){let e=[],t=[],r=[],i=[];for(let c of n){let d=gn(c.kind,c.label,c.content);i.push({path:c.label,ecosystem:nn[c.kind],entries:d.entries.length});for(let f of d.errors)r.push({severity:"error",code:"parse-error",file:c.label,message:f});e.push(...d.entries),t.push(...d.refusals)}let s=wn(e),o=Kt([...t,...s.refusals]),a=c=>s.findings.filter(d=>d.severity===c).length+r.filter(d=>d.severity===c).length;return{schema:1,manifests:i,findings:s.findings,refusals:o,diagnostics:r,summary:{manifests:i.length,entries:e.length,findings:s.findings.length,refusals:o.length,errors:a("error"),warnings:a("warning"),infos:a("info")}}}function Kt(n){let e=[];for(let t of n){let r=e.find(i=>i.reason===t.reason&&i.name===t.name&&i.ecosystem===t.ecosystem&&i.message===t.message);r?r.sites.push(...t.sites):e.push({...t,sites:[...t.sites]})}return e.sort((t,r)=>h(t.reason,r.reason)||h(t.name,r.name))}function Nn(n){let e=n.maxResults;if(e===void 0)return 500;if(typeof e!="number"||!Number.isInteger(e)||e<1)throw new Error("maxResults must be a positive integer");return Math.min(e,5e3)}var Jt="Compare the version constraints in a set of manifests and report where the same dependency is constrained inconsistently \u2014 including where two constraints cannot both be satisfied. Takes file contents directly and reads no filesystem. Comparison never crosses an ecosystem: an npm `semver` and a Cargo `semver` are unrelated packages that share a word. A constraint in a grammar the tool does not model is reported in `refusals` and excluded from comparison rather than guessed at.",Sn="files is required and must be a non-empty array of { path, content }",Zt=n=>typeof n=="object"&&n!==null&&!Array.isArray(n);function $n(n,e,t){if(!Zt(n))throw new Error(`${t} takes an object of arguments`);let r=Object.keys(n).sort(h).find(i=>!e.includes(i));if(r!==void 0)throw new Error(`${r} is not an argument ${t} takes. It takes ${e.join(", ")}.`);return n}function Ht(n){let e=n.files;if(!Array.isArray(e)||e.length===0)throw new Error(Sn);return e.map(t=>{let r=$n(t,["path","content"],"a file");if(typeof r.path!="string"||typeof r.content!="string")throw new Error(Sn);let i=tn(sn(r.path));if(i===void 0)throw new Error(`${r.path} is not a manifest this tool reads. It reads package.json, Cargo.toml, pyproject.toml, go.mod, and .yml or .yaml under .github/workflows/.`);return{kind:i,label:r.path,content:r.content}})}function Gt(n){let e=$n(n,["files","maxResults"],"this tool"),t=Ht(e),r=Nn(e),i=En(t),s=i.findings.length>r,o=i.findings.slice(0,r),a=i.diagnostics.map(c=>({severity:c.severity,code:c.code,message:`${c.file}: ${c.message}`}));return Promise.resolve({ok:!a.some(c=>c.severity==="error"),data:{schema:i.schema,manifests:i.manifests,findings:o,refusals:i.refusals,summary:i.summary},diagnostics:a,meta:{tool:"compare_versions",count:o.length,truncated:s}})}var On=Object.freeze([Object.freeze({name:"compare_versions",description:Jt,inputSchema:{type:"object",properties:{files:{type:"array",minItems:1,description:"The manifests to compare.",items:{type:"object",properties:{path:{type:"string",description:'Path or filename, e.g. "crates/api/Cargo.toml". It decides which grammar the content is read with, and labels every finding. Recognised: package.json, Cargo.toml, pyproject.toml, go.mod, and any .yml or .yaml under .github/workflows/.'},content:{type:"string",description:"The file contents."}},required:["path","content"],additionalProperties:!1}},maxResults:{type:"integer",minimum:1,maximum:5e3,default:500,description:`Cap on returned findings (default ${500}). meta.truncated reports whether any were dropped.`}},required:["files"],additionalProperties:!1},handler:Gt})]);var Yt="2025-06-18";function Qt(n){if(typeof n!="object"||n===null)return!1;let e=n;return e.jsonrpc==="2.0"&&typeof e.method=="string"}function er(n,e){let t=new Map(e.map(s=>[s.name,s])),r=e.map(s=>({name:s.name,description:s.description,inputSchema:s.inputSchema}));async function i(s){let o=s?.name;if(typeof o!="string")throw Object.assign(new Error("tools/call requires a string `name`"),{code:-32602});let a=t.get(o);if(!a)throw Object.assign(new Error(`Unknown tool: ${o}`),{code:-32602});let c=s?.arguments??{};try{let d=await a.handler(c);return{content:[{type:"text",text:JSON.stringify(d,null,2)}],structuredContent:d,isError:!1}}catch(d){return{content:[{type:"text",text:d instanceof Error?d.message:String(d)}],isError:!0}}}return async function(o){let{method:a,params:c}=o,d=o.id??null,f=o.id===void 0||o.id===null;try{if(a==="initialize"){let m=c?.protocolVersion;return{jsonrpc:"2.0",id:d,result:{protocolVersion:typeof m=="string"?m:Yt,capabilities:{tools:{listChanged:!1}},serverInfo:n}}}return a==="notifications/initialized"||f?null:a==="ping"?{jsonrpc:"2.0",id:d,result:{}}:a==="tools/list"?{jsonrpc:"2.0",id:d,result:{tools:r}}:a==="tools/call"?{jsonrpc:"2.0",id:d,result:await i(c)}:{jsonrpc:"2.0",id:d,error:{code:-32601,message:`Unknown method: ${a}`}}}catch(m){let x=typeof m?.code=="number"?m.code:-32603,y=m instanceof Error?m.message:String(m);return{jsonrpc:"2.0",id:d,error:{code:x,message:y}}}}}function jn(n,e,t=process.stdin,r=process.stdout){let i=er(n,e),s="",o=a=>{r.write(`${JSON.stringify(a)}
|
|
17
|
+
`)};t.setEncoding?.("utf8"),t.on("data",a=>{s+=a;let c=s.indexOf(`
|
|
18
|
+
`);for(;c!==-1;){let d=s.slice(0,c).trim();if(s=s.slice(c+1),c=s.indexOf(`
|
|
19
|
+
`),!d)continue;let f;try{f=JSON.parse(d)}catch{o({jsonrpc:"2.0",id:null,error:{code:-32700,message:"Invalid JSON"}});continue}if(!Qt(f)){o({jsonrpc:"2.0",id:null,error:{code:-32700,message:"Not a JSON-RPC 2.0 request"}});continue}i(f).then(m=>{m&&o(m)})}})}jn({name:Ve,version:Ie},On);
|