@automattic/vip 4.1.5 → 4.1.8

package/Gemfile.lock

@@ -1,377 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    CFPropertyList (3.0.8)
-    abbrev (0.1.2)
-    addressable (2.9.0)
-      public_suffix (>= 2.0.2, < 8.0)
-    artifactory (3.0.17)
-    atomos (0.1.3)
-    aws-eventstream (1.4.0)
-    aws-partitions (1.1287.0)
-    aws-sdk-core (3.257.0)
-      aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.992.0)
-      aws-sigv4 (~> 1.9)
-      base64
-      bigdecimal
-      jmespath (~> 1, >= 1.6.1)
-      logger
-      rexml (~> 3.4, >= 3.4.2)
-    aws-sdk-kms (1.132.0)
-      aws-sdk-core (~> 3, >= 3.256.0)
-      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.232.1)
-      aws-sdk-core (~> 3, >= 3.256.0)
-      aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.12.1)
-      aws-eventstream (~> 1, >= 1.0.2)
-    babosa (1.0.4)
-    base64 (0.3.0)
-    benchmark (0.5.0)
-    bigdecimal (4.1.3)
-    cgi (0.5.2)
-    claide (1.1.0)
-    colored (1.2)
-    colored2 (3.1.2)
-    commander (4.6.0)
-      highline (~> 2.0.0)
-    csv (3.3.6)
-    declarative (0.0.20)
-    digest-crc (0.7.0)
-      rake (>= 12.0.0, < 14.0.0)
-    domain_name (0.6.20260907)
-    dotenv (2.8.1)
-    emoji_regex (3.2.3)
-    erb (6.0.7)
-    excon (1.7.1)
-      logger
-    faraday (2.14.4)
-      faraday-net_http (>= 2.0, < 3.5)
-      json
-      logger
-    faraday-cookie_jar (0.0.8)
-      faraday (>= 0.8.0)
-      http-cookie (>= 1.0.0)
-    faraday-follow_redirects (0.5.0)
-      faraday (>= 1, < 3)
-    faraday-multipart (1.2.0)
-      multipart-post (~> 2.0)
-    faraday-net_http (3.4.4)
-      net-http (~> 0.5)
-    faraday-retry (2.4.0)
-      faraday (~> 2.0)
-    fastimage (2.4.1)
-    fastlane (2.240.1)
-      CFPropertyList (>= 2.3, < 5.0.0)
-      abbrev (~> 0.1)
-      addressable (>= 2.9.0, < 3.0.0)
-      artifactory (~> 3.0)
-      aws-sdk-s3 (~> 1.197)
-      babosa (>= 1.0.3, < 2.0.0)
-      base64 (~> 0.2)
-      benchmark (>= 0.1.0)
-      bundler (>= 2.4.0, < 5.0.0)
-      cgi (~> 0.4)
-      colored (~> 1.2)
-      commander (~> 4.6)
-      csv (~> 3.3)
-      dotenv (>= 2.1.1, < 3.0.0)
-      emoji_regex (>= 0.1, < 4.0)
-      excon (>= 0.71.0, < 2.0.0)
-      faraday (~> 2.7)
-      faraday-cookie_jar (~> 0.0.8)
-      faraday-follow_redirects (~> 0.3)
-      faraday-multipart (~> 1.0)
-      faraday-retry (~> 2.0)
-      fastimage (>= 2.1.0, < 3.0.0)
-      fastlane-sirp (>= 1.1.0)
-      gh_inspector (>= 1.1.2, < 2.0.0)
-      google-apis-androidpublisher_v3 (~> 0.99)
-      google-apis-playcustomapp_v1 (~> 0.1)
-      google-cloud-env (>= 1.6.0, < 2.4.0)
-      google-cloud-storage (~> 1.31)
-      highline (~> 2.0)
-      irb (>= 1.8)
-      json (< 3.0.0)
-      jwt (>= 2.10.3, < 4)
-      logger (>= 1.6, < 2.0)
-      mini_magick (>= 4.9.4, < 5.0.0)
-      multi_json (~> 1.12)
-      multipart-post (>= 2.0.0, < 3.0.0)
-      mutex_m (~> 0.3)
-      naturally (~> 2.2)
-      nkf (~> 0.2)
-      optparse (>= 0.1.1, < 1.0.0)
-      ostruct (>= 0.1.0)
-      plist (>= 3.1.0, < 4.0.0)
-      rubyzip (>= 3.4.0, < 4.0.0)
-      security (~> 0.3)
-      simctl (~> 1.6.3)
-      terminal-notifier (>= 2.0.0, < 3.0.0)
-      terminal-table (~> 4)
-      tty-screen (>= 0.6.3, < 1.0.0)
-      tty-spinner (>= 0.8.0, < 1.0.0)
-      word_wrap (~> 1.0.0)
-      xcodeproj (>= 1.13.0, < 2.0.0)
-      xcpretty (~> 0.4.1)
-      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
-    fastlane-sirp (1.1.0)
-    gh_inspector (1.1.3)
-    google-apis-androidpublisher_v3 (0.108.0)
-      google-apis-core (>= 0.15.0, < 2.a)
-    google-apis-core (1.2.5)
-      addressable (~> 2.9)
-      faraday (~> 2.13)
-      faraday-follow_redirects (~> 0.3)
-      googleauth (~> 1.14)
-      mini_mime (~> 1.1)
-      multi_json (~> 1.11)
-      representable (~> 3.0)
-      retriable (>= 3.1, < 5.0)
-    google-apis-iamcredentials_v1 (0.28.0)
-      google-apis-core (>= 0.15.0, < 2.a)
-    google-apis-playcustomapp_v1 (0.18.0)
-      google-apis-core (>= 0.15.0, < 2.a)
-    google-apis-storage_v1 (0.67.0)
-      google-apis-core (>= 0.15.0, < 2.a)
-    google-cloud-core (1.9.0)
-      google-cloud-env (>= 1.0, < 3.a)
-      google-cloud-errors (~> 1.0)
-    google-cloud-env (2.3.1)
-      base64 (~> 0.2)
-      faraday (>= 1.0, < 3.a)
-    google-cloud-errors (1.7.0)
-    google-cloud-storage (1.62.0)
-      addressable (~> 2.8)
-      digest-crc (~> 0.4)
-      google-apis-core (>= 0.18, < 2)
-      google-apis-iamcredentials_v1 (~> 0.18)
-      google-apis-storage_v1 (>= 0.42)
-      google-cloud-core (~> 1.6)
-      googleauth (~> 1.9)
-      mini_mime (~> 1.0)
-    google-logging-utils (0.2.0)
-    googleauth (1.17.4)
-      faraday (>= 1.0, < 3.a)
-      google-cloud-env (~> 2.2)
-      google-logging-utils (~> 0.1)
-      jwt (>= 1.4, < 4.0)
-      os (>= 0.9, < 2.0)
-      pstore (~> 0.1)
-      signet (>= 0.16, < 2.a)
-    highline (2.0.3)
-    http-cookie (1.1.6)
-      domain_name (~> 0.5)
-    io-console (0.9.4)
-    irb (1.18.0)
-      pp (>= 0.6.0)
-      prism (>= 1.3.0)
-      rdoc (>= 4.0.0)
-      reline (>= 0.4.2)
-    jmespath (1.6.2)
-    json (2.21.2)
-    jwt (3.3.0)
-      base64
-    logger (1.7.0)
-    mini_magick (4.13.2)
-    mini_mime (1.1.5)
-    multi_json (1.21.2)
-    multipart-post (2.4.1)
-    mutex_m (0.3.0)
-    nanaimo (0.4.0)
-    naturally (2.3.0)
-    net-http (0.9.1)
-      uri (>= 0.11.1)
-    nkf (0.3.0)
-    openssl (4.0.2)
-    optparse (0.8.1)
-    os (1.1.4)
-    ostruct (0.6.3)
-    plist (3.7.2)
-    pp (0.6.4)
-      prettyprint
-    prettyprint (0.2.0)
-    prism (1.9.0)
-    pstore (0.2.1)
-    public_suffix (7.0.5)
-    rake (13.4.2)
-    rbs (4.2.0)
-      logger
-      prism (>= 1.6.0)
-      tsort
-    rdoc (8.0.0)
-      erb
-      prism (>= 1.6.0)
-      rbs (>= 4.0.0)
-      tsort
-    reline (0.7.0)
-      io-console (~> 0.5)
-    representable (3.2.0)
-      declarative (< 0.1.0)
-      trailblazer-option (>= 0.1.1, < 0.2.0)
-      uber (< 0.2.0)
-    retriable (4.2.0)
-    rexml (3.4.4)
-    rouge (3.28.0)
-    rubyzip (3.6.0)
-    security (0.3.0)
-    signet (0.22.0)
-      addressable (~> 2.8)
-      faraday (>= 0.17.5, < 3.a)
-      jwt (>= 1.5, < 4.0)
-    simctl (1.6.10)
-      CFPropertyList
-      naturally
-    terminal-notifier (2.0.0)
-    terminal-table (4.0.0)
-      unicode-display_width (>= 1.1.1, < 4)
-    trailblazer-option (0.1.2)
-    tsort (0.2.0)
-    tty-cursor (0.7.1)
-    tty-screen (0.8.2)
-    tty-spinner (0.9.3)
-      tty-cursor (~> 0.7)
-    uber (0.1.0)
-    unicode-display_width (3.2.0)
-      unicode-emoji (~> 4.1)
-    unicode-emoji (4.2.0)
-    uri (1.1.1)
-    word_wrap (1.0.0)
-    xcodeproj (1.28.1)
-      CFPropertyList (>= 2.3.3, < 4.0)
-      atomos (~> 0.1.3)
-      base64
-      claide (>= 1.0.2, < 2.0)
-      colored2 (~> 3.1)
-      nanaimo (~> 0.4.0)
-      nkf
-      rexml (>= 3.3.6, < 4.0)
-    xcpretty (0.4.1)
-      rouge (~> 3.28.0)
-    xcpretty-travis-formatter (1.0.1)
-      xcpretty (~> 0.2, >= 0.0.7)
-
-PLATFORMS
-  aarch64-linux-gnu
-  aarch64-linux-musl
-  arm-linux-gnu
-  arm-linux-musl
-  arm64-darwin
-  x86_64-darwin
-  x86_64-linux-gnu
-  x86_64-linux-musl
-
-DEPENDENCIES
-  fastlane (~> 2.238)
-  openssl (~> 4.0)
-
-CHECKSUMS
-  CFPropertyList (3.0.8) sha256=2c99d0d980536d3d7ab252f7bd59ac8be50fbdd1ff487c98c949bb66bb114261
-  abbrev (0.1.2) sha256=ad1b4eaaaed4cb722d5684d63949e4bde1d34f2a95e20db93aecfe7cbac74242
-  addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
-  artifactory (3.0.17) sha256=3023d5c964c31674090d655a516f38ca75665c15084140c08b7f2841131af263
-  atomos (0.1.3) sha256=7d43b22f2454a36bace5532d30785b06de3711399cb1c6bf932573eda536789f
-  aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b
-  aws-partitions (1.1287.0) sha256=76f4c73011654553566c5db5bbef0f24738bb016e923910e8b1b3f9cb7d989ca
-  aws-sdk-core (3.257.0) sha256=a92ad19c7ff668cec6688ee3200ee562da80647a3bbeed9fda02e8b0ca6492c6
-  aws-sdk-kms (1.132.0) sha256=094b0097bb3be9d5c1ac87e971ca7f5aebb746801dfb5f0f576480bf98dca69c
-  aws-sdk-s3 (1.232.1) sha256=124440f3a44fbc28cc3a2dec6eaeeea2a236bfc33772005010a19baa62654870
-  aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00
-  babosa (1.0.4) sha256=18dea450f595462ed7cb80595abd76b2e535db8c91b350f6c4b3d73986c5bc99
-  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
-  benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c
-  bigdecimal (4.1.3) sha256=61ebe1e5e559bdc3cc6f2c0ee7f427321fc838f59611c294356eb04d6e21cf66
-  bundler (4.0.18) sha256=02d9a17429de1847b4e0c9f27a9ee4b20c0a74c0a641b4e77195d6019e3618ac
-  cgi (0.5.2) sha256=61ca30298171190fd4fa0d8018e57ada456eae9b7a2b78526debf7f0a0e6f8bb
-  claide (1.1.0) sha256=6d3c5c089dde904d96aa30e73306d0d4bd444b1accb9b3125ce14a3c0183f82e
-  colored (1.2) sha256=9d82b47ac589ce7f6cab64b1f194a2009e9fd00c326a5357321f44afab2c1d2c
-  colored2 (3.1.2) sha256=b13c2bd7eeae2cf7356a62501d398e72fde78780bd26aec6a979578293c28b4a
-  commander (4.6.0) sha256=7d1ddc3fccae60cc906b4131b916107e2ef0108858f485fdda30610c0f2913d9
-  csv (3.3.6) sha256=aba61e7e507a66f03d45cb1f3c4b6359861c3504038b422962875dce099e4456
-  declarative (0.0.20) sha256=8021dd6cb17ab2b61233c56903d3f5a259c5cf43c80ff332d447d395b17d9ff9
-  digest-crc (0.7.0) sha256=64adc23a26a241044cbe6732477ca1b3c281d79e2240bcff275a37a5a0d78c07
-  domain_name (0.6.20260907) sha256=5517a7f82c4464a61fc17133c3f6a02833faa13533c16c07e8f73b11d872cb03
-  dotenv (2.8.1) sha256=c5944793349ae03c432e1780a2ca929d60b88c7d14d52d630db0508c3a8a17d8
-  emoji_regex (3.2.3) sha256=ecd8be856b7691406c6bf3bb3a5e55d6ed683ffab98b4aa531bb90e1ddcc564b
-  erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92
-  excon (1.7.1) sha256=dd2d870eece1b5ce4e4f9efd938e67a69ccd8c003c3825b638b937e1082eaac2
-  faraday (2.14.4) sha256=9bb4408c44621b0dbaaaa39e5dbfc4dbe58cc6751b6eb94d16ae9e1f2f2fab6e
-  faraday-cookie_jar (0.0.8) sha256=0140605823f8cc63c7028fccee486aaed8e54835c360cffc1f7c8c07c4299dbb
-  faraday-follow_redirects (0.5.0) sha256=5cde93c894b30943a5d2b93c2fe9284216a6b756f7af406a1e55f211d97d10ad
-  faraday-multipart (1.2.0) sha256=7d89a949693714176f612323ca13746a2ded204031a6ba528adee788694ef757
-  faraday-net_http (3.4.4) sha256=0e78af151747ed1b00f33e25973b4bc220d7f16c00c39676817c8b12331eb588
-  faraday-retry (2.4.0) sha256=7b79c48fb7e56526faf247b12d94a680071ff40c9fda7cf1ec1549439ad11ebe
-  fastimage (2.4.1) sha256=c64bebd46b6fd8943ab70c1e6e85ff728f970f2e48f92ecd249b6bc3a540ad20
-  fastlane (2.240.1) sha256=cf792bc99ec6af6574ea416cda6530f519c8b4b3a46b1a3b52488ebf1696aa5c
-  fastlane-sirp (1.1.0) sha256=10bc94f9682efd8e1badfb31452a76dd8981f1f3a33717c765fde6d75b54d847
-  gh_inspector (1.1.3) sha256=04cca7171b87164e053aa43147971d3b7f500fcb58177698886b48a9fc4a1939
-  google-apis-androidpublisher_v3 (0.108.0) sha256=11a8b1885dce62ef28d8b7f16225d67e60c77b5baf16310a31d33fb1dc3c2d4e
-  google-apis-core (1.2.5) sha256=e21562b5627a0fc6a0c3165e429c3afed0f6a628eaa514e83f7204dda1adff69
-  google-apis-iamcredentials_v1 (0.28.0) sha256=0a92ffe6cc39c569554af2a77a25dfc61519ed8bbb64ab04cffdd352dc5ef106
-  google-apis-playcustomapp_v1 (0.18.0) sha256=44b277b9dee4a59ac5e9d98be1485edc5e382d2f9d73c79ae8908a455786a254
-  google-apis-storage_v1 (0.67.0) sha256=13befc89bf03512783f535d214590f15993b0c56411155fd8090ca607e1b8d20
-  google-cloud-core (1.9.0) sha256=ab55409f51488e8deefb6edcc1ce4771dfb5da2fe7b3bc075709a030c2b682a4
-  google-cloud-env (2.3.1) sha256=0faac01eb27be78c2591d64433663b1a114f8f7af55a4f819755426cac9178e7
-  google-cloud-errors (1.7.0) sha256=6e682f42d89aae08689f36f28495de629d756da076bafff0003bac7f8042ebb3
-  google-cloud-storage (1.62.0) sha256=e2c3c08bf8fd40d50be92304084942203314d4fc0ee52028e99f9359c3ad1330
-  google-logging-utils (0.2.0) sha256=675462b4ea5affa825a3442694ca2d75d0069455a1d0956127207498fca3df7b
-  googleauth (1.17.4) sha256=acc2cac2a6011048f149c922cbc6c9675719e165aa5000c7fa3876c480fe9ae3
-  highline (2.0.3) sha256=2ddd5c127d4692721486f91737307236fe005352d12a4202e26c48614f719479
-  http-cookie (1.1.6) sha256=ba4b82be64de61dc281243dac70e3c382c45142f20268ed9276a3670c93feaa9
-  io-console (0.9.4) sha256=a403304f32928ee85e56d457b4612ca43f2703b561a3258844992bd24085fbb1
-  irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
-  jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1
-  json (2.21.2) sha256=1f1d3b7cf2b3ba1a69beca0bb6db13d5438b80bff3cd54cdaaa620b9b07c1c6a
-  jwt (3.3.0) sha256=44cc34fbc341c148233cf66641522b4bce0dfb1ce55e8073f05c56f44f4ee546
-  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
-  mini_magick (4.13.2) sha256=71d6258e0e8a3d04a9a0a09784d5d857b403a198a51dd4f882510435eb95ddd9
-  mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
-  multi_json (1.21.2) sha256=245531eaf54bdba57aba515ff08b4503505c5e09911daa89c5a561e2f85bea8e
-  multipart-post (2.4.1) sha256=9872d03a8e552020ca096adadbf5e3cb1cd1cdd6acd3c161136b8a5737cdb4a8
-  mutex_m (0.3.0) sha256=cfcb04ac16b69c4813777022fdceda24e9f798e48092a2b817eb4c0a782b0751
-  nanaimo (0.4.0) sha256=faf069551bab17f15169c1f74a1c73c220657e71b6e900919897a10d991d0723
-  naturally (2.3.0) sha256=459923cf76c2e6613048301742363200c3c7e4904c324097d54a67401e179e01
-  net-http (0.9.1) sha256=25ba0b67c63e89df626ed8fac771d0ad24ad151a858af2cc8e6a716ca4336996
-  nkf (0.3.0) sha256=357a8dbeba38b727b75930f665146546076a394a1c243faf634ff176e3588895
-  openssl (4.0.2) sha256=1037ad2868ae58df9ad917891c0c0f9815a1172f6846d4bcdd508e4c2ee747c2
-  optparse (0.8.1) sha256=42bea10d53907ccff4f080a69991441d611fbf8733b60ed1ce9ee365ce03bd1a
-  os (1.1.4) sha256=57816d6a334e7bd6aed048f4b0308226c5fb027433b67d90a9ab435f35108d3f
-  ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912
-  plist (3.7.2) sha256=d37a4527cc1116064393df4b40e1dbbc94c65fa9ca2eec52edf9a13616718a42
-  pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570
-  prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
-  prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
-  pstore (0.2.1) sha256=03904d0f2c66579e96d1e6704cdabc0c88df7ea8ed8782d9f3569f6f6c702c1a
-  public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
-  rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
-  rbs (4.2.0) sha256=51f7b886dcc05bc09e10b901daa6a81829f6adc03101d6ca9ea4aac6103e0674
-  rdoc (8.0.0) sha256=03bf8c08a9639658855a0cfd77c0abca8325c227693f7f33f82957811348c469
-  reline (0.7.0) sha256=5b012d8e55dbf9d450f12bde2cf7d15ff546ae80b3f8f3b30e570d431815583d
-  representable (3.2.0) sha256=cc29bf7eebc31653586849371a43ffe36c60b54b0a6365b5f7d95ec34d1ebace
-  retriable (4.2.0) sha256=90c3b257472a1c02f2a3dfa64dd35a420f7a624cef1a5981e20fdac5730f8cdc
-  rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
-  rouge (3.28.0) sha256=0d6de482c7624000d92697772ab14e48dca35629f8ddf3f4b21c99183fd70e20
-  rubyzip (3.6.0) sha256=268994d44d62282d1cfd99bf10eae48d7267199158ad7ea3e1fee2da9458b695
-  security (0.3.0) sha256=bc9d06718258a96c8552ce4044bfe69144491b10d3403d74c4753a03a720ecf0
-  signet (0.22.0) sha256=b76d495ccb07ad35dbc89f3e920665a9d8ed717141955034005d7843dcfe4780
-  simctl (1.6.10) sha256=b99077f4d13ad81eace9f86bf5ba4df1b0b893a4d1b368bd3ed59b5b27f9236b
-  terminal-notifier (2.0.0) sha256=7a0d2b2212ab9835c07f4b2e22a94cff64149dba1eed203c04835f7991078cea
-  terminal-table (4.0.0) sha256=f504793203f8251b2ea7c7068333053f0beeea26093ec9962e62ea79f94301d2
-  trailblazer-option (0.1.2) sha256=20e4f12ea4e1f718c8007e7944ca21a329eee4eed9e0fa5dde6e8ad8ac4344a3
-  tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
-  tty-cursor (0.7.1) sha256=79534185e6a777888d88628b14b6a1fdf5154a603f285f80b1753e1908e0bf48
-  tty-screen (0.8.2) sha256=c090652115beae764336c28802d633f204fb84da93c6a968aa5d8e319e819b50
-  tty-spinner (0.9.3) sha256=0e036f047b4ffb61f2aa45f5a770ec00b4d04130531558a94bfc5b192b570542
-  uber (0.1.0) sha256=5beeb407ff807b5db994f82fa9ee07cfceaa561dad8af20be880bc67eba935dc
-  unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
-  unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
-  uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
-  word_wrap (1.0.0) sha256=f556d4224c812e371000f12a6ee8102e0daa724a314c3f246afaad76d82accc7
-  xcodeproj (1.28.1) sha256=6f12670f00739d9817ca27ac89d6ef01cc86050e22a0bc08a3131487e5b5cddc
-  xcpretty (0.4.1) sha256=b14c50e721f6589ee3d6f5353e2c2cfcd8541fa1ea16d6c602807dd7327f3892
-  xcpretty-travis-formatter (1.0.1) sha256=aacc332f17cb7b2cba222994e2adc74223db88724fe76341483ad3098e232f93
-
-BUNDLED WITH
-  4.0.18

package/Makefile

@@ -1,293 +0,0 @@
-# vip-next Makefile
-
-GO           ?= go
-GOFLAGS      ?=
-LDFLAGS   := -s -w \
-             -X github.com/Automattic/vip/internal/version.Version=$(shell GOFLAGS=-mod=mod $(GO) run ./cmd/stamp-version) \
-             -X github.com/Automattic/vip/internal/version.Commit=$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
-
-BIN_DIR   := bin
-BIN_NAME  := vip-next
-
-# The Node CLI entrypoint the differential parity scenario diffs vip-next
-# against. It is a BUILT artifact (`npm ci && npm run build`); when it is
-# absent the scenario skips with a banner naming what is missing rather than
-# failing a developer who has no node_modules.
-NODE_VIP_BIN ?= $(CURDIR)/dist/bin/vip.js
-
-.PHONY: build search-replace-bin test test-parity test-parity-unit test-parity-unit-hostile lint tidy tidy-gql verify-gql-stale clean node-vip-bin-status require-node-vip-bin
-
-build:
-	mkdir -p $(BIN_DIR)
-	CGO_ENABLED=0 $(GO) build -buildvcs=false -trimpath -ldflags="$(LDFLAGS)" -o $(BIN_DIR)/$(BIN_NAME) ./cmd/vip-next
-	@$(MAKE) --no-print-directory search-replace-bin
-
-# Bundle the host's go-search-replace binary next to vip-next so `import sql`
-# (--search-replace) and `dev-env sync sql` resolve it without a runtime
-# download. Uses the real per-platform binaries vendored under __fixtures__;
-# proper release-tarball bundling of official binaries is the M8 task.
-#
-# This FAILS the build on a platform we have no binary for, rather than warning
-# and exiting 0. Exiting 0 produced a vip-next that built fine and then died
-# only when the user reached `search-replace`, `import sql --search-replace` or
-# `dev-env sync sql` — i.e. the discovery moment was moved from `make build` to
-# the middle of someone's import. linux/arm64 is the live gap (Graviton, ARM CI,
-# Docker on Apple Silicon), and windows/arm64.
-#
-# Two deliberate escape hatches, because neither case is a broken setup:
-#   VIP_SEARCH_REPLACE_BIN=<path>  the user supplied their own binary; that is
-#                                  the first entry in searchreplace.ResolveBinary
-#                                  and it makes the bundle irrelevant.
-#   ALLOW_MISSING_SEARCH_REPLACE=1 the user knowingly wants a build without
-#                                  search-replace support.
-#
-# NOTE: __fixtures__/ is a vendored mirror of Automattic/vip and must stay
-# byte-identical to it, so a new architecture CANNOT simply be dropped in there
-# — the next sync would revert it. See docs/BUILD-SIGNING.md for the third_party
-# plan that fixes this properly.
-GSR_DIR := third_party/go-search-replace
-GSR_REPO := Automattic/go-search-replace
-
-# Fetch the pinned go-search-replace release into $(GSR_DIR)/<goos>-<goarch>/,
-# verifying every file against the sha256 in $(GSR_DIR)/MANIFEST.
-#
-# Those digests are the SLSA provenance subjects from the upstream release
-# (go-search-replace.intoto.jsonl), not values we computed. Upstream ships the
-# assets GZIPPED but attests the UNCOMPRESSED binaries, so we gunzip first and
-# then hash — verified against release 0.0.11.
-#
-# Binaries are gitignored; only MANIFEST is tracked. Upgrade by editing
-# MANIFEST (tag + digests) then `make vendor-search-replace`.
-#
-# ALL is the release build's entry point: bundling every platform is what makes
-# the shipped tarball self-contained.
-vendor-search-replace:
-	@if [ -n "$$ALL" ]; then \
-		set -- $$(awk '/^(darwin|linux|windows)\//{print $$1}' $(GSR_DIR)/MANIFEST); \
-	elif [ -n "$$TARGETS" ]; then \
-		set -- $$TARGETS; \
-	else \
-		set -- "$$($(GO) env GOOS)/$$($(GO) env GOARCH)"; \
-	fi; \
-	.buildkite/fetch-search-replace.sh "$$@"
-
-search-replace-bin:
-	@os=$$($(GO) env GOOS); arch=$$($(GO) env GOARCH); \
-	case "$$os/$$arch" in \
-		darwin/arm64) f=go-search-replace-test-darwin-arm64;; \
-		darwin/amd64) f=go-search-replace-test-darwin-x64;; \
-		linux/amd64)  f=go-search-replace-test-linux-x64;; \
-		windows/amd64) f=go-search-replace-test-win32-x64.exe;; \
-		*) f="";; \
-	esac; \
-	dest=$(BIN_DIR)/go-search-replace; \
-	if [ "$$os" = "windows" ]; then dest=$$dest.exe; fi; \
-	vendored=$(GSR_DIR)/$${os}-$${arch}/go-search-replace; \
-	if [ "$$os" = "windows" ]; then vendored=$$vendored.exe; fi; \
-	src=""; \
-	if [ -f "$$vendored" ]; then src=$$vendored; \
-	elif [ -n "$$f" ]; then src=__fixtures__/search-replace-binaries/$$f; fi; \
-	if [ -n "$$src" ] && [ -f "$$src" ]; then \
-		cp "$$src" "$$dest" && chmod +x "$$dest" && echo "bundled go-search-replace -> $$dest (from $$src)"; \
-	elif [ -n "$$VIP_SEARCH_REPLACE_BIN" ]; then \
-		echo "no bundled go-search-replace for $$os/$$arch; using VIP_SEARCH_REPLACE_BIN=$$VIP_SEARCH_REPLACE_BIN"; \
-	elif [ -n "$$ALLOW_MISSING_SEARCH_REPLACE" ]; then \
-		echo "WARNING: no go-search-replace for $$os/$$arch; search-replace, import sql --search-replace and dev-env sync sql will fail at runtime (ALLOW_MISSING_SEARCH_REPLACE set)"; \
-	else \
-		if [ -z "$$f" ]; then \
-			echo "ERROR: no bundled go-search-replace for $$os/$$arch." >&2; \
-		else \
-			echo "ERROR: bundled go-search-replace fixture is missing: $$src" >&2; \
-		fi; \
-		echo "" >&2; \
-		echo "  vip-next would build, then fail at runtime on: search-replace," >&2; \
-		echo "  import sql --search-replace, dev-env sync sql." >&2; \
-		echo "" >&2; \
-		echo "  Fix one of:" >&2; \
-		echo "    make vendor-search-replace                  # fetch + verify from upstream" >&2; \
-		echo "    VIP_SEARCH_REPLACE_BIN=/path/to/go-search-replace make build" >&2; \
-		echo "    ALLOW_MISSING_SEARCH_REPLACE=1 make build   # build without it" >&2; \
-		echo "" >&2; \
-		echo "  Pinned release: $(GSR_DIR)/MANIFEST" >&2; \
-		exit 1; \
-	fi
-
-# Proxy variables are scrubbed for the same reason internal/parity's
-# scenarioEnvPinned and BuildParkerEnv scrub them: internal/httpproxy honours
-# VIP_PROXY unconditionally and applies no loopback exemption (neither does
-# Node's proxy-from-env), so a developer with the VIP SOCKS proxy exported would
-# have every httptest server in the suite dialled through it. NO_PROXY is
-# cleared too — with it set, the ported coveredInNoProxy suppresses a
-# SOCKS_PROXY-only configuration, which would mask a real regression.
-# `test-parity-unit-hostile` deliberately does the opposite and is a separate
-# target; do not scrub there.
-PROXY_SCRUB = VIP_PROXY= vip_proxy= SOCKS_PROXY= socks_proxy= \
-              HTTPS_PROXY= https_proxy= HTTP_PROXY= http_proxy= \
-              ALL_PROXY= all_proxy= NO_PROXY= no_proxy= VIP_USE_SYSTEM_PROXY=
-
-# The Go package list, discovered rather than hardcoded so a new top-level
-# tree is picked up automatically, with node_modules removed.
-#
-# node_modules matters because CI now runs `npm ci` — the parity job diffs
-# vip-next against the built Node CLI. An npm dependency ships real Go source,
-# node_modules/flatted/golang/pkg/flatted, which lands inside this module, so a
-# bare `./...` compiles and vets third-party Go pulled from the npm registry.
-# (Verified on Go 1.27: `go list ./...` does include it.)
-#
-# The empty guard is not paranoia: `go test` with no package arguments tests
-# the current directory and exits 0. A silently-empty list would look exactly
-# like a passing suite, which is the failure mode this whole area exists to
-# remove.
-#
-# -buildvcs=false keeps `go list` working when the checkout sits under another
-# VCS's working copy.
-GO_PKG_LIST = pkgs="$$($(GO) list -buildvcs=false ./... | grep -v '/node_modules/')"; \
-              [ -n "$$pkgs" ] || { echo 'go list produced no packages; refusing to report success' >&2; exit 1; }
-
-test:
-	@$(GO_PKG_LIST); \
-	$(PROXY_SCRUB) $(GO) test $$pkgs
-
-# The three host checks that decide whether the Node CLI can be executed.
-# Shared verbatim by the warn-only and the fail-hard targets below so the two
-# can never disagree about what "ready" means. Mirrors ResolveNodeVipBin in
-# internal/parity/nodebin.go (see the comment on LoudSkip for why the check is
-# duplicated in shell at all).
-define NODE_VIP_BIN_PROBE
-missing=''; \
-[ -f "$(NODE_VIP_BIN)" ] || missing="$$missing\n    - $(NODE_VIP_BIN) does not exist; run 'npm run build'"; \
-[ -d "$(CURDIR)/node_modules" ] || missing="$$missing\n    - $(CURDIR)/node_modules is absent; run 'npm ci'"; \
-command -v node >/dev/null 2>&1 || missing="$$missing\n    - 'node' is not on PATH; install Node 22.19+ (package.json engines)";
-endef
-
-# Reports whether the Node CLI can be executed, and if not, exactly what is
-# missing. `go test` buffers a passing package's output, so a t.Skip inside the
-# suite is invisible without -v — this banner is what keeps a skipped
-# differential scenario from looking like a passing one.
-#
-# This target WARNS and succeeds: a contributor who has never run `npm ci` must
-# still be able to run `make test-parity-unit`. CI calls require-node-vip-bin
-# instead, which fails.
-node-vip-bin-status:
-	@$(NODE_VIP_BIN_PROBE) \
-	if [ -z "$$missing" ]; then \
-	  echo "parity: Node-vs-Go differential coverage ON (NODE_VIP_BIN=$(NODE_VIP_BIN))"; \
-	else \
-	  printf '\n%s\n' "================================================================================"; \
-	  printf '  WARNING: Node-vs-Go differential coverage is OFF.\n'; \
-	  printf '  The Node-vs-Go differential scenarios are the ONLY tests that run the real\n'; \
-	  printf '  Node CLI; they will SKIP. Every other scenario compares vip-next against a\n'; \
-	  printf '  mock.\n'; \
-	  printf '  Missing:%b\n' "$$missing"; \
-	  printf '%s\n\n' "================================================================================"; \
-	fi
-
-# The CI counterpart of node-vip-bin-status: same probe, non-zero exit.
-#
-# Without this, the failure mode that made the differential worthless is
-# invisible and permanent — if dist/ stops being built, every Node-vs-Go
-# scenario silently skips and the job still goes green. A skipped differential
-# must never be indistinguishable from a passing one in CI.
-require-node-vip-bin:
-	@$(NODE_VIP_BIN_PROBE) \
-	if [ -n "$$missing" ]; then \
-	  printf '\n%s\n' "================================================================================"; \
-	  printf '  ERROR: the Node CLI cannot be executed, so every Node-vs-Go differential\n'; \
-	  printf '  scenario would SKIP. In CI that is a failure, not a degradation.\n'; \
-	  printf '  Missing:%b\n' "$$missing"; \
-	  printf '%s\n\n' "================================================================================"; \
-	  exit 1; \
-	fi; \
-	echo "parity: Node-vs-Go differential coverage ON (NODE_VIP_BIN=$(NODE_VIP_BIN))"
-
-# Lists the scenarios whose Node-vs-Go divergence has been accepted as
-# intentional, straight from the YAML that records the decision.
-#
-# It exists for the same reason node-vip-bin-status does: `go test` without -v
-# discards a PASSING package's output, so the banner the differential writes
-# when it meets a blessed divergence is invisible in a green run. A divergence
-# nobody ever sees is indistinguishable from parity, and this list is the thing
-# a reviewer should be arguing with.
-.PHONY: blessed-drift-status
-blessed-drift-status:
-	@names=$$(grep -l '^expected_drift:' testdata/parity/*.yaml 2>/dev/null | \
-	          sed 's|testdata/parity/||; s|\.yaml$$||' | sort); \
-	if [ -n "$$names" ]; then \
-	  printf 'parity: %s scenario(s) carry an accepted Node-vs-Go divergence:\n' "$$(echo "$$names" | wc -l | tr -d ' ')"; \
-	  echo "$$names" | sed 's/^/    - /'; \
-	  printf '  Each records its reason and normalized-output signature in testdata/parity/<name>.yaml (expected_drift).\n'; \
-	fi
-
-# -count=1 disables the test cache: these scenarios spawn the built binaries
-# and read the environment, so a cached "ok" would hide exactly the ambient
-# dependence this suite is meant to detect.
-test-parity-unit: node-vip-bin-status blessed-drift-status
-	NODE_VIP_BIN="$(NODE_VIP_BIN)" \
-	$(GO) test -tags=parity -count=1 ./internal/parity/...
-
-# Proof that the fixture suite is ambient-independent (see internal/parity/env.go).
-# Exports credentials, an API host, and proxies that would break or falsely
-# satisfy scenarios if any of them leaked into a subprocess; results MUST be
-# identical to `make test-parity-unit`. Run both after touching the harness.
-#
-# NODE_VIP_BIN is passed through deliberately: the Node-vs-Go scenario must
-# stay ambient-independent too.
-test-parity-unit-hostile:
-	VIP_TOKEN_OVERRIDE=hostile.ambient.token \
-	WPVIP_DEPLOY_TOKEN=hostile-ambient-deploy-token \
-	API_HOST=https://hostile.invalid \
-	HTTP_PROXY=http://127.0.0.1:9 HTTPS_PROXY=http://127.0.0.1:9 ALL_PROXY=socks5://127.0.0.1:9 \
-	http_proxy=http://127.0.0.1:9 https_proxy=http://127.0.0.1:9 all_proxy=socks5://127.0.0.1:9 \
-	VIP_PROXY=socks5://127.0.0.1:9 SOCKS_PROXY=socks5://127.0.0.1:9 VIP_USE_SYSTEM_PROXY=1 \
-	NODE_ENV=production DO_NOT_TRACK=0 NO_COLOR=1 DEBUG='*' \
-	XDG_DATA_HOME=/nonexistent/vip-parity-hostile \
-	VIP_SEARCH_REPLACE_BIN=/nonexistent/go-search-replace \
-	$(MAKE) --no-print-directory test-parity-unit
-
-test-parity:
-	npm run build
-	@$(MAKE) --no-print-directory build
-	NODE_VIP_BIN="$(NODE_VIP_BIN)" \
-	GO_VIP_BIN=$(CURDIR)/bin/vip-next \
-	$(GO) test -tags='parity parker_parity' ./internal/parity \
-		-run '^TestLocalParkerParity$$' -count=1 -v
-
-lint:
-	@$(GO_PKG_LIST); \
-	$(GO) vet $$pkgs
-
-tidy:
-	$(GO) mod tidy
-
-clean:
-	rm -rf $(BIN_DIR)
-
-# Regenerate internal/gql/generated.go from schema.gql + operations/*.graphql.
-tidy-gql:
-	cd internal/gql && $(GO) run github.com/Khan/genqlient
-
-# Fail if internal/gql/generated.go on disk doesn't match what genqlient
-# would produce from schema.gql + operations/*.graphql. The recipe never
-# leaves the on-disk file altered: it stashes the contributor's copy to a
-# temp file, runs genqlient (which writes to the configured generated.go),
-# compares, and ALWAYS restores the stashed copy via a shell trap -- so
-# even on errors or interrupts the working tree is left exactly as the
-# contributor had it. (genqlient v0.8.1 does not support --output, so we
-# can't redirect codegen directly; the trap-based restore is reliable
-# because it always uses the saved file, unlike the prior recipe which
-# restored from the post-regen file.)
-verify-gql-stale:
-	@cd internal/gql && \
-	  stash=$$(mktemp) && fresh=$$(mktemp) && \
-	  trap 'mv -f "$$stash" generated.go 2>/dev/null; rm -f "$$fresh"' EXIT INT TERM HUP; \
-	  cp generated.go "$$stash" && \
-	  $(GO) run github.com/Khan/genqlient && \
-	  cp generated.go "$$fresh" && \
-	  if cmp -s "$$stash" "$$fresh"; then \
-	    echo "internal/gql/generated.go is up to date"; \
-	  else \
-	    echo ""; \
-	    echo "ERROR: internal/gql/generated.go is stale relative to schema.gql / operations/*.graphql."; \
-	    echo "Run 'make tidy-gql' and commit the regenerated file."; \
-	    exit 1; \
-	  fi