packtory 0.0.8 → 0.0.9

package/bundle-emitter/registry-client.js

@@ -1,73 +1,246 @@
 import { Maybe } from 'true-myth';
 import { z } from 'zod/mini';
-import { safeParse } from '@schema-hub/zod-error-formatter';
-function isFetchError(error) {
-    return typeof error === 'object' && error !== null && Object.hasOwn(error, 'statusCode');
-}
-function encodePackageName(name) {
-    return name.replace('/', '%2F');
-}
-const distTagsSchema = z.object({
-    latest: z.optional(z.string())
-});
-const versionDataSchema = z.object({
-    dist: z.object({ shasum: z.string(), tarball: z.string() })
+import { buildPublishOptionsForPublishSettings, remapPublishError } from "./publish-settings-bridge.js";
+const notFoundStatusCode = 404;
+const unauthorizedStatusCode = 401;
+const forbiddenStatusCode = 403;
+const npmRegistryUrl = 'https://registry.npmjs.org/';
+const oidcExchangeRefreshThresholdInMilliseconds = 60_000;
+const packageVersionDetailsSchema = z.object({
+    dist: z.object({
+        tarball: z.string()
+    })
 });
 const abbreviatedPackageResponseSchema = z.object({
     name: z.string(),
-    'dist-tags': distTagsSchema,
-    versions: z.record(z.string(), versionDataSchema)
+    'dist-tags': z.object({
+        latest: z.optional(z.string())
+    }),
+    versions: z.record(z.string(), packageVersionDetailsSchema)
 });
-const httpStatusCode = {
-    notFound: 404,
-    forbidden: 403
-};
+const oidcExchangeResponseSchema = z.object({
+    token_type: z.string(),
+    token: z.string(),
+    created: z.string(),
+    expires: z.string()
+});
+function encodePackageName(name) {
+    return name.replace('/', '%2F');
+}
+function isRecord(value) {
+    return value instanceof Object;
+}
+function parseAbbreviatedPackageResponse(response) {
+    const result = abbreviatedPackageResponseSchema.safeParse(response);
+    return result.success ? result.data : undefined;
+}
+function toPublishManifest(manifest) {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- libnpmpublish expects @npm/types PackageJson, which is structurally compatible with our validated manifest
+    return manifest;
+}
+function resolveRegistryUrl(registrySettings) {
+    return registrySettings.registryUrl;
+}
+function isNpmRegistry(registry) {
+    return new URL(registry ?? npmRegistryUrl).href === npmRegistryUrl;
+}
+function normalizeAuthConfig(registrySettings) {
+    if ('type' in registrySettings.auth) {
+        return {
+            publish: registrySettings.auth,
+            metadata: undefined
+        };
+    }
+    return {
+        publish: registrySettings.auth.publish,
+        metadata: registrySettings.auth.metadata
+    };
+}
+function resolvePublishAuth(registrySettings) {
+    return normalizeAuthConfig(registrySettings).publish;
+}
+function createBaseOptions(registrySettings) {
+    return {
+        alwaysAuth: true,
+        registry: resolveRegistryUrl(registrySettings)
+    };
+}
+function buildAuthOptions(auth, registrySettings) {
+    const registry = resolveRegistryUrl(registrySettings);
+    const options = createBaseOptions(registrySettings);
+    if (auth.type === 'bearer-token') {
+        return {
+            allowsAutomaticRetry: false,
+            registry,
+            options: {
+                ...options,
+                forceAuth: {
+                    token: auth.token
+                }
+            }
+        };
+    }
+    return {
+        allowsAutomaticRetry: false,
+        registry,
+        options: {
+            ...options,
+            forceAuth: {
+                _auth: Buffer.from(`${auth.username}:${auth.password}`).toString('base64')
+            },
+            ...(auth.email === undefined ? {} : { email: auth.email })
+        }
+    };
+}
+function createAnonymousAuthResolution(registrySettings) {
+    return {
+        allowsAutomaticRetry: false,
+        registry: resolveRegistryUrl(registrySettings),
+        options: createBaseOptions(registrySettings)
+    };
+}
+function parseOidcExchangeResponse(response) {
+    const result = oidcExchangeResponseSchema.safeParse(response);
+    return result.success ? result.data : undefined;
+}
+async function parseJsonResponse(response) {
+    return response.json();
+}
 export function createRegistryClient(dependencies) {
-    const { npmFetch, publish } = dependencies;
+    const { npmFetch, publish, fetch: fetchImplementation, clock, promptForOneTimePassword, resolveIdToken } = dependencies;
+    const oidcExchangeTokenCache = new Map();
+    async function exchangeOidcToken(packageName, registrySettings, auth) {
+        const cacheKey = `${resolveRegistryUrl(registrySettings) ?? npmRegistryUrl}::${packageName}`;
+        const cachedToken = oidcExchangeTokenCache.get(cacheKey);
+        const currentTime = clock.getCurrentTimeInMilliseconds();
+        if (cachedToken !== undefined &&
+            cachedToken.expiresAt - currentTime > oidcExchangeRefreshThresholdInMilliseconds) {
+            return cachedToken.token;
+        }
+        if (!isNpmRegistry(resolveRegistryUrl(registrySettings))) {
+            throw new Error('npm-oidc auth is only supported with the npmjs.org registry');
+        }
+        const idToken = await resolveIdToken(auth);
+        const exchangeResponse = await fetchImplementation(`${npmRegistryUrl}-/npm/v1/oidc/token/exchange/package/${encodePackageName(packageName)}`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${idToken}` }
+        });
+        if (!exchangeResponse.ok) {
+            throw new Error(`OIDC token exchange failed with status ${exchangeResponse.status}`);
+        }
+        const body = parseOidcExchangeResponse(await parseJsonResponse(exchangeResponse));
+        if (body === undefined) {
+            throw new TypeError('OIDC token exchange returned an invalid response');
+        }
+        const expiresAt = Date.parse(body.expires);
+        if (!Number.isFinite(expiresAt)) {
+            throw new TypeError('OIDC token exchange returned an invalid expiry timestamp');
+        }
+        oidcExchangeTokenCache.set(cacheKey, {
+            token: body.token,
+            expiresAt
+        });
+        return body.token;
+    }
+    async function resolveWriteAuthOptions(packageName, registrySettings) {
+        const auth = resolvePublishAuth(registrySettings);
+        if (auth.type !== 'npm-oidc') {
+            return buildAuthOptions(auth, registrySettings).options;
+        }
+        const token = await exchangeOidcToken(packageName, registrySettings, auth);
+        return {
+            ...createBaseOptions(registrySettings),
+            forceAuth: {
+                token
+            }
+        };
+    }
+    function resolveMetadataAuthOptions(registrySettings) {
+        const { metadata: metadataMode, publish: publishAuth } = normalizeAuthConfig(registrySettings);
+        if (metadataMode === undefined || metadataMode === 'inherit-publish-auth') {
+            if (publishAuth.type === 'npm-oidc') {
+                return createAnonymousAuthResolution(registrySettings);
+            }
+            return buildAuthOptions(publishAuth, registrySettings);
+        }
+        if (metadataMode === 'auto') {
+            return {
+                ...createAnonymousAuthResolution(registrySettings),
+                allowsAutomaticRetry: true
+            };
+        }
+        if (typeof metadataMode !== 'object') {
+            return createAnonymousAuthResolution(registrySettings);
+        }
+        return buildAuthOptions(metadataMode, registrySettings);
+    }
+    async function retryAutoMetadataAuth(registrySettings, auth, run) {
+        try {
+            return await run(auth.options);
+        }
+        catch (error) {
+            const statusCode = isRecord(error) ? error.statusCode : undefined;
+            if (!auth.allowsAutomaticRetry ||
+                (statusCode !== forbiddenStatusCode && statusCode !== unauthorizedStatusCode)) {
+                throw error;
+            }
+            const publishAuth = resolvePublishAuth(registrySettings);
+            if (publishAuth.type === 'npm-oidc') {
+                throw error;
+            }
+            return run(buildAuthOptions(publishAuth, registrySettings).options);
+        }
+    }
     async function fetchRegistryEndpoint(endpoint, registrySettings) {
         const acceptHeaderForFetchingAbbreviatedResponse = 'application/vnd.npm.install-v1+json';
-        return npmFetch.json(endpoint, {
-            forceAuth: {
-                alwaysAuth: true,
-                token: registrySettings.token
-            },
-            registry: registrySettings.registryUrl,
-            headers: { accept: acceptHeaderForFetchingAbbreviatedResponse }
+        const auth = resolveMetadataAuthOptions(registrySettings);
+        return retryAutoMetadataAuth(registrySettings, auth, async (options) => {
+            return npmFetch.json(endpoint, {
+                ...options,
+                headers: { accept: acceptHeaderForFetchingAbbreviatedResponse }
+            });
         });
     }
     async function fetchPackage(packageName, registrySettings) {
         const endpointUri = `/${encodePackageName(packageName)}`;
         try {
             const response = await fetchRegistryEndpoint(endpointUri, registrySettings);
-            const result = safeParse(abbreviatedPackageResponseSchema, response);
-            if (!result.success) {
+            const result = parseAbbreviatedPackageResponse(response);
+            if (result === undefined) {
                 throw new Error('Got an invalid response from registry API');
             }
-            return Maybe.just(result.data);
+            return Maybe.just(result);
         }
         catch (error) {
-            if (isFetchError(error) &&
-                (error.statusCode === httpStatusCode.notFound || error.statusCode === httpStatusCode.forbidden)) {
+            const statusCode = isRecord(error) ? error.statusCode : undefined;
+            if (statusCode === notFoundStatusCode || statusCode === forbiddenStatusCode) {
                 return Maybe.nothing();
             }
             throw error;
         }
     }
     return {
-        async fetchTarball(tarballUrl) {
-            const response = await npmFetch(tarballUrl);
+        async fetchTarball(tarballUrl, registrySettings) {
+            const auth = resolveMetadataAuthOptions(registrySettings);
+            const response = await retryAutoMetadataAuth(registrySettings, auth, async (options) => {
+                return npmFetch(tarballUrl, options);
+            });
             return response.buffer();
         },
-        async publishPackage(manifest, tarData, registrySettings) {
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- ok in this case
-            await publish(manifest, tarData, {
-                defaultTag: 'latest',
-                forceAuth: {
-                    alwaysAuth: true,
-                    token: registrySettings.token
-                },
-                registry: registrySettings.registryUrl
-            });
+        async publishPackage(manifest, tarData, registrySettings, publishSettings) {
+            const authOptions = await resolveWriteAuthOptions(manifest.name, registrySettings);
+            const publishOptionsFromSettings = buildPublishOptionsForPublishSettings(publishSettings);
+            try {
+                await publish(toPublishManifest(manifest), tarData, {
+                    defaultTag: 'latest',
+                    ...authOptions,
+                    ...publishOptionsFromSettings,
+                    ...(promptForOneTimePassword === undefined ? {} : { otpPrompt: promptForOneTimePassword })
+                });
+            }
+            catch (error) {
+                throw remapPublishError(error, publishSettings);
+            }
         },
         async fetchLatestVersion(packageName, registrySettings) {
             const packageResponse = await fetchPackage(packageName, registrySettings);
@@ -78,11 +251,10 @@ export function createRegistryClient(dependencies) {
             if (latestVersion !== undefined) {
                 const versionData = packageResponse.value.versions[latestVersion];
                 if (versionData === undefined) {
-                    throw new Error(`Version "${latestVersion}" for package "${packageName}" is missing a shasum`);
+                    throw new Error(`Version "${latestVersion}" for package "${packageName}" has no entry in the registry response`);
                 }
                 return Maybe.just({
                     version: latestVersion,
-                    shasum: versionData.dist.shasum,
                     tarballUrl: versionData.dist.tarball
                 });
             }

package/bundle-emitter/registry-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.js","sourceRoot":"","sources":["../../../../source/bundle-emitter/registry-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAqB5D,SAAS,YAAY,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,cAAc;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC;CACpD,CAAC,CAAC;AAIH,MAAM,cAAc,GAAG;IACnB,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE,GAAG;CACjB,CAAC;AAWF,MAAM,UAAU,oBAAoB,CAAC,YAAkD;IACnF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;IAE3C,KAAK,UAAU,qBAAqB,CAChC,QAAgB,EAChB,gBAA4C;QAE5C,MAAM,0CAA0C,GAAG,qCAAqC,CAAC;QAEzF,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC3B,SAAS,EAAE;gBACP,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,gBAAgB,CAAC,KAAK;aAChC;YACD,QAAQ,EAAE,gBAAgB,CAAC,WAAW;YACtC,OAAO,EAAE,EAAE,MAAM,EAAE,0CAA0C,EAAE;SAClE,CAAC,CAAC;IACP,CAAC;IAED,KAAK,UAAU,YAAY,CACvB,WAAmB,EACnB,gBAAkC;QAElC,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC;YAErE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,IACI,YAAY,CAAC,KAAK,CAAC;gBACnB,CAAC,KAAK,CAAC,UAAU,KAAK,cAAc,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,cAAc,CAAC,SAAS,CAAC,EACjG,CAAC;gBACC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,KAAK,CAAC,YAAY,CAAC,UAAU;YACzB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5C,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB;YACpD,0FAA0F;YAC1F,MAAM,OAAO,CAAC,QAAsC,EAAE,OAAO,EAAE;gBAC3D,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE;oBACP,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,gBAAgB,CAAC,KAAK;iBAChC;gBACD,QAAQ,EAAE,gBAAgB,CAAC,WAAW;aACzC,CAAC,CAAC;QACP,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,gBAAgB;YAClD,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAE1E,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YAChE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAClE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,aAAa,kBAAkB,WAAW,uBAAuB,CAAC,CAAC;gBACnG,CAAC;gBAED,OAAO,KAAK,CAAC,IAAI,CAAC;oBACd,OAAO,EAAE,aAAa;oBACtB,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM;oBAC/B,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO;iBACvC,CAAC,CAAC;YACP,CAAC;YAED,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACJ,CAAC;AACN,CAAC"}
+{"version":3,"file":"registry-client.js","sourceRoot":"","sources":["../../../../source/bundle-emitter/registry-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAU7B,OAAO,EAAE,qCAAqC,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,MAAM,0CAA0C,GAAG,MAAM,CAAC;AAyC1D,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC;CACL,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAUD,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,+BAA+B,CAAC,QAAiB;IACtD,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AASD,SAAS,iBAAiB,CAAC,QAAqC;IAC5D,qLAAqL;IACrL,OAAO,QAAsC,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,gBAA4C;IACpE,OAAO,gBAAgB,CAAC,WAAW,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IAC/C,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAAC,gBAA4C;IAIrE,IAAI,MAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO;YACH,OAAO,EAAE,gBAAgB,CAAC,IAAI;YAC9B,QAAQ,EAAE,SAAS;SACtB,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO;QACtC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ;KAC3C,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,gBAA4C;IACpE,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,gBAA4C;IACnE,OAAO;QACH,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;KACjD,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA0B,EAAE,gBAA4C;IAC9F,MAAM,QAAQ,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO;YACH,oBAAoB,EAAE,KAAK;YAC3B,QAAQ;YACR,OAAO,EAAE;gBACL,GAAG,OAAO;gBACV,SAAS,EAAE;oBACP,KAAK,EAAE,IAAI,CAAC,KAAK;iBACpB;aACJ;SACJ,CAAC;IACN,CAAC;IAED,OAAO;QACH,oBAAoB,EAAE,KAAK;QAC3B,QAAQ;QACR,OAAO,EAAE;YACL,GAAG,OAAO;YACV,SAAS,EAAE;gBACP,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC7E;YACD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAC7D;KACJ,CAAC;AACN,CAAC;AAED,SAAS,6BAA6B,CAAC,gBAA4C;IAC/E,OAAO;QACH,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;QAC9C,OAAO,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;KAC/C,CAAC;AACN,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAiB;IAChD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IAC/C,OAAO,QAAQ,CAAC,IAAI,EAAsB,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAkD;IACnF,MAAM,EACF,QAAQ,EACR,OAAO,EACP,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EACL,wBAAwB,EACxB,cAAc,EACjB,GAAG,YAAY,CAAC;IACjB,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEpE,KAAK,UAAU,iBAAiB,CAC5B,WAAmB,EACnB,gBAA4C,EAC5C,IAAwD;QAExD,MAAM,QAAQ,GAAG,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QAC7F,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,4BAA4B,EAAE,CAAC;QACzD,IACI,WAAW,KAAK,SAAS;YACzB,WAAW,CAAC,SAAS,GAAG,WAAW,GAAG,0CAA0C,EAClF,CAAC;YACC,OAAO,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAC9C,GAAG,cAAc,wCAAwC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EACzF;YACI,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE;SAC5B,CAC1B,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAClF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CAAC,0DAA0D,CAAC,CAAC;QACpF,CAAC;QAED,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS;SACZ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,UAAU,uBAAuB,CAClC,WAAmB,EACnB,gBAA4C;QAE5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC;QAC5D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO;YACH,GAAG,iBAAiB,CAAC,gBAAgB,CAAC;YACtC,SAAS,EAAE;gBACP,KAAK;aACR;SACJ,CAAC;IACN,CAAC;IAED,SAAS,0BAA0B,CAAC,gBAA4C;QAC5E,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC/F,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,sBAAsB,EAAE,CAAC;YACxE,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO;gBACH,GAAG,6BAA6B,CAAC,gBAAgB,CAAC;gBAClD,oBAAoB,EAAE,IAAI;aAC7B,CAAC;QACN,CAAC;QAED,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,UAAU,qBAAqB,CAChC,gBAA4C,EAC5C,IAAoB,EACpB,GAA6C;QAE7C,IAAI,CAAC;YACD,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,IACI,CAAC,IAAI,CAAC,oBAAoB;gBAC1B,CAAC,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,sBAAsB,CAAC,EAC/E,CAAC;gBACC,MAAM,KAAK,CAAC;YAChB,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YAChB,CAAC;YAED,OAAO,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;IAED,KAAK,UAAU,qBAAqB,CAChC,QAAgB,EAChB,gBAA4C;QAE5C,MAAM,0CAA0C,GAAG,qCAAqC,CAAC;QACzF,MAAM,IAAI,GAAG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QAE1D,OAAO,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAC3B,GAAG,OAAO;gBACV,OAAO,EAAE,EAAE,MAAM,EAAE,0CAA0C,EAAE;aAClE,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,UAAU,YAAY,CACvB,WAAmB,EACnB,gBAAkC;QAElC,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;YAEzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,IAAI,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,gBAAgB;YAC3C,MAAM,IAAI,GAAG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnF,OAAO,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,eAAe;YACrE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACnF,MAAM,0BAA0B,GAAG,qCAAqC,CAAC,eAAe,CAAC,CAAC;YAC1F,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE;oBAChD,UAAU,EAAE,QAAQ;oBACpB,GAAG,WAAW;oBACd,GAAG,0BAA0B;oBAC7B,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;iBAC7F,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACtB,MAAM,iBAAiB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACpD,CAAC;QACL,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,gBAAgB;YAClD,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAE1E,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YAChE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAClE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACX,YAAY,aAAa,kBAAkB,WAAW,yCAAyC,CAClG,CAAC;gBACN,CAAC;gBAED,OAAO,KAAK,CAAC,IAAI,CAAC;oBACd,OAAO,EAAE,aAAa;oBACtB,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO;iBACvC,CAAC,CAAC;YACP,CAAC;YAED,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACJ,CAAC;AACN,CAAC"}

package/bundle-emitter/repository-coherence.js

@@ -0,0 +1,54 @@
+import { normalizeRepositoryUrl } from "./repository-url-normalizer.js";
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+export function readCiEnvironment(env) {
+    return {
+        githubServerUrl: env.GITHUB_SERVER_URL,
+        githubRepository: env.GITHUB_REPOSITORY,
+        gitlabProjectUrl: env.CI_PROJECT_URL
+    };
+}
+export function getCiRepositoryUrl(env) {
+    if (isNonEmptyString(env.githubServerUrl) && isNonEmptyString(env.githubRepository)) {
+        return `${env.githubServerUrl}/${env.githubRepository}`;
+    }
+    if (isNonEmptyString(env.gitlabProjectUrl)) {
+        return env.gitlabProjectUrl;
+    }
+    return undefined;
+}
+const noRepositoryDeclaredMessage = [
+    'Provenance is enabled but the package has no repository declared.',
+    'Add a "repository" entry to additionalPackageJsonAttributes',
+    "so consumers can verify the attestation's source claim."
+].join('\n');
+const noCiDetectedMessage = [
+    'Provenance auto mode is enabled but no CI repository was detected.',
+    'Provenance auto mode requires GitHub Actions or GitLab CI; expected',
+    'one of GITHUB_SERVER_URL+GITHUB_REPOSITORY or CI_PROJECT_URL.'
+].join('\n');
+function buildMismatchMessage(configuredUrl, ciUrl) {
+    return [
+        "Provenance is enabled but the package's repository URL does not match",
+        'the CI repository.',
+        `Configured repository: ${configuredUrl}`,
+        `CI repository:         ${ciUrl}`,
+        'Either correct the package.json repository field, or disable provenance',
+        'if the mismatch is intentional.'
+    ].join('\n');
+}
+export function assertRepositoryCoherence(manifest, ciRepositoryUrl) {
+    const normalizedManifestUrl = normalizeRepositoryUrl(manifest.repository);
+    if (normalizedManifestUrl === undefined) {
+        throw new Error(noRepositoryDeclaredMessage);
+    }
+    const normalizedCiUrl = normalizeRepositoryUrl(ciRepositoryUrl);
+    if (normalizedCiUrl === undefined) {
+        throw new Error(noCiDetectedMessage);
+    }
+    if (normalizedCiUrl !== normalizedManifestUrl) {
+        throw new Error(buildMismatchMessage(normalizedManifestUrl, normalizedCiUrl));
+    }
+}
+//# sourceMappingURL=repository-coherence.js.map

package/bundle-emitter/repository-coherence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-coherence.js","sourceRoot":"","sources":["../../../../source/bundle-emitter/repository-coherence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAQxE,SAAS,gBAAgB,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAiD;IAC/E,OAAO;QACH,eAAe,EAAE,GAAG,CAAC,iBAAiB;QACtC,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;QACvC,gBAAgB,EAAE,GAAG,CAAC,cAAc;KACvC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACjD,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClF,OAAO,GAAG,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG,CAAC,gBAAgB,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,MAAM,2BAA2B,GAAG;IAChC,mEAAmE;IACnE,6DAA6D;IAC7D,yDAAyD;CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,mBAAmB,GAAG;IACxB,oEAAoE;IACpE,qEAAqE;IACrE,+DAA+D;CAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,oBAAoB,CAAC,aAAqB,EAAE,KAAa;IAC9D,OAAO;QACH,uEAAuE;QACvE,oBAAoB;QACpB,0BAA0B,aAAa,EAAE;QACzC,0BAA0B,KAAK,EAAE;QACjC,yEAAyE;QACzE,iCAAiC;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACrC,QAA2C,EAC3C,eAAmC;IAEnC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,eAAe,KAAK,qBAAqB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAC,CAAC;IAClF,CAAC;AACL,CAAC"}

package/bundle-emitter/repository-url-normalizer.js

@@ -0,0 +1,38 @@
+import HostedGitInfo from 'hosted-git-info';
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function extractRawUrl(input) {
+    if (isNonEmptyString(input)) {
+        return input;
+    }
+    if (isRecord(input) && isNonEmptyString(input.url)) {
+        return input.url;
+    }
+    return undefined;
+}
+function manualNormalize(url) {
+    let normalized = url.startsWith('git+') ? url.slice('git+'.length) : url;
+    if (normalized.endsWith('.git')) {
+        normalized = normalized.slice(0, -'.git'.length);
+    }
+    if (normalized.endsWith('/')) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized.toLowerCase();
+}
+export function normalizeRepositoryUrl(input) {
+    const rawUrl = extractRawUrl(input);
+    if (rawUrl === undefined) {
+        return undefined;
+    }
+    const hosted = HostedGitInfo.fromUrl(rawUrl);
+    if (hosted !== undefined) {
+        return manualNormalize(hosted.https({ noCommittish: true }));
+    }
+    return manualNormalize(rawUrl);
+}
+//# sourceMappingURL=repository-url-normalizer.js.map

package/bundle-emitter/repository-url-normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-url-normalizer.js","sourceRoot":"","sources":["../../../../source/bundle-emitter/repository-url-normalizer.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAE5C,SAAS,gBAAgB,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACjC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAChC,IAAI,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzE,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/checks/check-runner.js

@@ -1,13 +1,7 @@
-import { noDuplicatedFilesRule } from "./rules/no-duplicated-files.js";
-const checkRules = [noDuplicatedFilesRule];
+import { allRules } from "./rules/registry.js";
 export function runChecks(params) {
-    const { settings, bundles: packages } = params;
-    return checkRules
-        .filter((rule) => {
-        return rule.isEnabled(settings);
-    })
-        .flatMap((rule) => {
-        return rule.run({ bundles: packages }, settings);
+    return allRules.flatMap((rule) => {
+        return rule.run(params);
     });
 }
 //# sourceMappingURL=check-runner.js.map

package/checks/check-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-runner.js","sourceRoot":"","sources":["../../../../source/checks/check-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,MAAM,UAAU,GAAyB,CAAC,qBAAqB,CAAC,CAAC;AAEjE,MAAM,UAAU,SAAS,CAAC,MAAyB;IAC/C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAE/C,OAAO,UAAU;SACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC;SACD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"check-runner.js","sourceRoot":"","sources":["../../../../source/checks/check-runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAS/C,MAAM,UAAU,SAAS,CAAC,MAAyB;IAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/checks/rule.js

@@ -0,0 +1,13 @@
+import { z } from 'zod/mini';
+import { nonEmptyStringSchema } from "../config/base-validations.js";
+export const enabledOnlyGlobalSchema = z.strictObject({ enabled: z.boolean() });
+export const emptyPerPackageSchema = z.strictObject({});
+const pathAllowListShape = {
+    allowList: z.optional(z.readonly(z.array(nonEmptyStringSchema)))
+};
+export const pathAllowListGlobalSchema = z.strictObject({
+    enabled: z.boolean(),
+    ...pathAllowListShape
+});
+export const pathAllowListPerPackageSchema = z.strictObject(pathAllowListShape);
+//# sourceMappingURL=rule.js.map

package/checks/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../../../source/checks/rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAoB,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAExD,MAAM,kBAAkB,GAAG;IACvB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,GAAG,kBAAkB;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC"}

package/checks/rules/max-bundle-size.js

@@ -0,0 +1,44 @@
+import { z } from 'zod/mini';
+const ruleName = 'maxBundleSize';
+const byteLimitSchema = z.number().check(z.int(), z.nonnegative());
+const globalSchema = z.strictObject({
+    enabled: z.boolean(),
+    bytes: z.optional(byteLimitSchema)
+});
+const perPackageSchema = z.strictObject({
+    bytes: z.optional(byteLimitSchema)
+});
+function bundleSizeBytes(bundle) {
+    let total = 0;
+    for (const resource of bundle.contents) {
+        total += Buffer.byteLength(resource.fileDescription.content);
+    }
+    return total;
+}
+function checkBundle(bundle, threshold) {
+    if (threshold === undefined) {
+        return [];
+    }
+    const size = bundleSizeBytes(bundle);
+    if (size <= threshold) {
+        return [];
+    }
+    return [`Package "${bundle.name}" exceeds the maximum bundle size: ${size} bytes (limit: ${threshold} bytes)`];
+}
+function run(params) {
+    const globalConfig = params.settings?.maxBundleSize;
+    if (globalConfig?.enabled !== true) {
+        return [];
+    }
+    return params.bundles.flatMap((bundle) => {
+        const override = params.perPackageSettings.get(bundle.name)?.maxBundleSize?.bytes;
+        return checkBundle(bundle, override ?? globalConfig.bytes);
+    });
+}
+export const maxBundleSizeRule = {
+    name: ruleName,
+    globalSchema,
+    perPackageSchema,
+    run
+};
+//# sourceMappingURL=max-bundle-size.js.map

package/checks/rules/max-bundle-size.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"max-bundle-size.js","sourceRoot":"","sources":["../../../../../source/checks/rules/max-bundle-size.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAI7B,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAEnE,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;CACrC,CAAC,CAAC;AAMH,SAAS,eAAe,CAAC,MAAsB;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,MAAsB,EAAE,SAA6B;IACtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,CAAC,YAAY,MAAM,CAAC,IAAI,sCAAsC,IAAI,kBAAkB,SAAS,SAAS,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,GAAG,CAAC,MAAiB;IAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;IACpD,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC;QAClF,OAAO,WAAW,CAAC,MAAM,EAAE,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAyE;IACnG,IAAI,EAAE,QAAQ;IACd,YAAY;IACZ,gBAAgB;IAChB,GAAG;CACN,CAAC"}

package/checks/rules/no-dev-dependency-imports.js

@@ -0,0 +1,37 @@
+import { emptyPerPackageSchema, enabledOnlyGlobalSchema } from "../rule.js";
+const ruleName = 'noDevDependencyImports';
+function findLeakedDevDependencies(bundle, packageConfig) {
+    const mainPackageJson = packageConfig?.mainPackageJson;
+    if (mainPackageJson === undefined) {
+        return [];
+    }
+    const runtimeDependencyNames = new Set([
+        ...Object.keys(mainPackageJson.dependencies ?? {}),
+        ...Object.keys(mainPackageJson.peerDependencies ?? {})
+    ]);
+    const devDependencyNames = new Set(Object.keys(mainPackageJson.devDependencies ?? {}));
+    return Array.from(bundle.externalDependencies.keys())
+        .filter((name) => {
+        return devDependencyNames.has(name) && !runtimeDependencyNames.has(name);
+    })
+        .map((name) => {
+        const reason = 'is only declared in devDependencies of the main package.json';
+        return `Package "${bundle.name}" imports "${name}" which ${reason}`;
+    });
+}
+function run(params) {
+    const globalConfig = params.settings?.noDevDependencyImports;
+    if (globalConfig?.enabled !== true) {
+        return [];
+    }
+    return params.bundles.flatMap((bundle) => {
+        return findLeakedDevDependencies(bundle, params.packageConfigs?.[bundle.name]);
+    });
+}
+export const noDevDependencyImportsRule = {
+    name: ruleName,
+    globalSchema: enabledOnlyGlobalSchema,
+    perPackageSchema: emptyPerPackageSchema,
+    run
+};
+//# sourceMappingURL=no-dev-dependency-imports.js.map

package/checks/rules/no-dev-dependency-imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-dev-dependency-imports.js","sourceRoot":"","sources":["../../../../../source/checks/rules/no-dev-dependency-imports.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,qBAAqB,EACrB,uBAAuB,EAI1B,MAAM,YAAY,CAAC;AAEpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAM1C,SAAS,yBAAyB,CAC9B,MAAsB,EACtB,aAA4C;IAE5C,MAAM,eAAe,GAAG,aAAa,EAAE,eAAe,CAAC;IACvD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;QACnC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,IAAI,EAAE,CAAC;QAClD,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,gBAAgB,IAAI,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACV,MAAM,MAAM,GAAG,8DAA8D,CAAC;QAC9E,OAAO,YAAY,MAAM,CAAC,IAAI,cAAc,IAAI,WAAW,MAAM,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACX,CAAC;AAED,SAAS,GAAG,CAAC,MAAiB;IAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC7D,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,OAAO,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAyE;IAC5G,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE,uBAAuB;IACrC,gBAAgB,EAAE,qBAAqB;IACvC,GAAG;CACN,CAAC"}