putitoutthere 0.1.43 → 0.1.45

package/dist/templates.js

@@ -1,310 +0,0 @@
-/**
- * Workflow templates emitted by `putitoutthere init`.
- *
- * Per plan.md §9.2 (immediate), §9.4 (scheduled), §9.5 (PR check).
- *
- * The `release.yml` templates follow the three-job shape
- * (plan → build → publish) so users can drop their build tooling into
- * the middle job without forking the orchestrator. Build steps are
- * keyed on `matrix.kind` (crates | pypi | npm) and `matrix.build`
- * (vanilla | maturin | napi | bundled-cli) so the right builder runs
- * per row.
- *
- * Issue #25. Plan: §9.
- */
-const TOML_SKELETON_BODY = `# Put It Out There — release orchestration config.
-# Docs: https://github.com/thekevinscott/put-it-out-there
-
-[putitoutthere]
-version = 1
-
-# Declare one [[package]] block per releasable artifact. Examples:
-#
-# [[package]]
-# name = "my-crate"
-# kind = "crates"
-# path = "crates/my-crate"                 # dir containing Cargo.toml
-# paths = ["crates/my-crate/**", "**/Cargo.toml", "**/Cargo.lock"]
-# first_version = "0.1.0"
-# # tag_format defaults to "{name}-v{version}". Single-package repos
-# # often want "v{version}" to keep the existing v0.1.0-style timeline.
-# # tag_format = "v{version}"
-#
-# [[package]]
-# name = "my-py"
-# kind = "pypi"
-# path = "py/my-py"                        # dir containing pyproject.toml
-# paths = ["py/my-py/**"]
-# first_version = "0.1.0"
-#
-# [[package]]
-# name = "my-pkg"
-# kind = "npm"
-# path = "packages/my-pkg"                 # dir containing package.json
-# paths = ["packages/my-pkg/**"]
-# first_version = "0.1.0"
-`;
-/**
- * Emit the `putitoutthere.toml` skeleton. When `seeds.tag_format` is
- * set, prepend a short comment explaining why plus a commented
- * `# tag_format = "..."` hint inside the crates example block.
- *
- * Kept as a function (not a constant) so init can bake in
- * per-repo detection results (#204). Callers without seeds get the
- * plain skeleton.
- */
-export function tomlSkeleton(seeds = null) {
-    if (seeds === null || seeds.tag_format === undefined) {
-        return TOML_SKELETON_BODY;
-    }
-    const reason = seeds.tag_format_reason ?? 'single-package repo';
-    const banner = `# piot init detected ${reason}; set tag_format = "${seeds.tag_format}" on\n` +
-        `# each [[package]] block below to keep that timeline, or remove this comment\n` +
-        `# to use the default "{name}-v{version}".\n` +
-        `# See https://thekevinscott.github.io/put-it-out-there/guide/configuration\n\n`;
-    return banner + TOML_SKELETON_BODY;
-}
-/** @deprecated use {@link tomlSkeleton}; kept for external consumers of the constant. */
-export const TOML_SKELETON = TOML_SKELETON_BODY;
-export const AGENTS_MD = `# Release signaling for Put It Out There
-
-When you finish a unit of work and are preparing a PR or commit, add a git
-trailer to the commit message body to signal a release:
-
-    release: <patch|minor|major|skip>
-
-Rules:
-- Omit the trailer for docs-only, CI-only, or internal-only changes.
-- \`patch\` for bug fixes or internal refactors that don't change public API.
-- \`minor\` for new features that are backwards-compatible.
-- \`major\` for breaking changes.
-- \`skip\` to suppress release when path filters would otherwise cascade.
-
-The trailer on the merge commit determines the release. If merging via
-"Squash and merge," include the trailer in the PR description so it ends up
-in the squashed commit body.
-
-## Scoping a release to specific packages
-
-To release a subset of packages in a polyglot repo, append a bracketed list:
-
-    release: minor [my-crate, my-py]
-
-Packages named in the list are bumped with the specified version. Other
-packages cascaded by path filters still get a \`patch\`. Packages in the
-list that *aren't* cascaded are force-included.
-`;
-const BUILD_JOB = `  build:
-    needs: plan
-    if: fromJSON(needs.plan.outputs.matrix || '[]')[0] != null
-    strategy:
-      fail-fast: false
-      matrix:
-        include: \${{ fromJSON(needs.plan.outputs.matrix) }}
-    runs-on: \${{ matrix.runs_on }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Setup Rust (if crates)
-        if: matrix.kind == 'crates'
-        uses: dtolnay/rust-toolchain@stable
-      - name: Build crate
-        if: matrix.kind == 'crates'
-        run: cargo package --manifest-path \${{ matrix.path }}/Cargo.toml --target-dir \${{ matrix.path }}/target
-      - name: Setup Python (if pypi)
-        if: matrix.kind == 'pypi'
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      # #217: when [package.bundle_cli] is declared, compile the CLI
-      # for this target and stage it into the package source tree so
-      # maturin includes it in the wheel that's built next.
-      - name: Setup Rust (if pypi bundle_cli)
-        if: matrix.kind == 'pypi' && matrix.bundle_cli.bin != '' && matrix.target != 'sdist'
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: \${{ matrix.target }}
-      - name: Build + stage bundled CLI
-        if: matrix.kind == 'pypi' && matrix.bundle_cli.bin != '' && matrix.target != 'sdist'
-        shell: bash
-        run: |
-          set -euo pipefail
-          cd "\${{ matrix.bundle_cli.crate_path }}"
-          cargo build --release --bin "\${{ matrix.bundle_cli.bin }}" --target "\${{ matrix.target }}"
-          cd "\${{ github.workspace }}"
-          dest="\${{ matrix.path }}/\${{ matrix.bundle_cli.stage_to }}"
-          mkdir -p "$dest"
-          # Windows targets produce .exe; Unix don't. Copy whatever's
-          # there matching the bin name.
-          src_dir="\${{ matrix.bundle_cli.crate_path }}/target/\${{ matrix.target }}/release"
-          if [[ -f "$src_dir/\${{ matrix.bundle_cli.bin }}.exe" ]]; then
-            cp "$src_dir/\${{ matrix.bundle_cli.bin }}.exe" "$dest/"
-          elif [[ -f "$src_dir/\${{ matrix.bundle_cli.bin }}" ]]; then
-            cp "$src_dir/\${{ matrix.bundle_cli.bin }}" "$dest/"
-          else
-            echo "bundle_cli: built binary not found at $src_dir/\${{ matrix.bundle_cli.bin }}[.exe]" >&2
-            exit 1
-          fi
-      - name: Build wheel (maturin)
-        if: matrix.kind == 'pypi' && matrix.build == 'maturin'
-        uses: PyO3/maturin-action@v1
-        with:
-          command: build
-          args: --release --out \${{ matrix.path }}/dist \${{ matrix.target == 'sdist' && '--sdist' || format('--target {0}', matrix.target) }}
-          working-directory: \${{ matrix.path }}
-      - name: Build sdist (setuptools/hatch)
-        if: matrix.kind == 'pypi' && matrix.build != 'maturin' && matrix.target == 'sdist'
-        run: |
-          cd \${{ matrix.path }}
-          python -m pip install build
-          python -m build --sdist --outdir dist
-      - name: Setup Node (if npm)
-        if: matrix.kind == 'npm'
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-      - name: Build npm package
-        if: matrix.kind == 'npm'
-        run: |
-          cd \${{ matrix.path }}
-          npm ci
-          npm run build --if-present
-      - uses: actions/upload-artifact@v4
-        with:
-          name: \${{ matrix.artifact_name }}
-          path: \${{ matrix.artifact_path }}
-`;
-const PUBLISH_JOB = `  publish:
-    needs: [plan, build]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          registry-url: 'https://registry.npmjs.org'
-      # PyPI publish shells out to \`twine\`. Hosted runners don't ship it;
-      # install it here so the publish job has twine on PATH regardless of
-      # whether the config has a pypi package today.
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-      - name: Install twine
-        run: pip install twine
-      # piot cuts an annotated tag per publish (\`git tag -a\`). Hosted
-      # runners have no committer identity set; configure one before the
-      # piot step or tag creation fails with "Please tell me who you are."
-      - name: Configure git identity
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-      - uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-      - uses: thekevinscott/put-it-out-there@v0
-        with:
-          command: publish
-          dry_run: \${{ inputs.dry_run || 'false' }}
-        env:
-          # NODE_AUTH_TOKEN (not NPM_TOKEN) matches the .npmrc template that
-          # actions/setup-node writes when registry-url is set. putitoutthere's
-          # preflight also accepts NPM_TOKEN as a fallback, but npm itself
-          # reads this name. Store your npm secret under any name — we map it
-          # here.
-          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
-          CARGO_REGISTRY_TOKEN: \${{ secrets.CARGO_TOKEN }}
-          PYPI_API_TOKEN: \${{ secrets.PYPI_API_TOKEN }}
-`;
-const PLAN_JOB = `  plan:
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: \${{ steps.plan.outputs.matrix }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - id: plan
-        uses: thekevinscott/put-it-out-there@v0
-        with:
-          command: plan
-`;
-const IMMEDIATE_HEADER = `name: Release
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Dry-run: compute plan, skip publish + tag'
-        type: boolean
-        default: false
-
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-`;
-const SCHEDULED_HEADER = `name: Release (scheduled)
-
-on:
-  schedule:
-    - cron: '0 2 * * *'
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Dry-run: compute plan, skip publish + tag'
-        type: boolean
-        default: false
-
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-`;
-export const RELEASE_YML_IMMEDIATE = IMMEDIATE_HEADER + PLAN_JOB + '\n' + BUILD_JOB + '\n' + PUBLISH_JOB;
-export const RELEASE_YML_SCHEDULED = SCHEDULED_HEADER + PLAN_JOB + '\n' + BUILD_JOB + '\n' + PUBLISH_JOB;
-export const CHECK_YML = `name: Putitoutthere check
-
-on:
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  dry-run:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: thekevinscott/put-it-out-there@v0
-        with:
-          command: plan
-          dry_run: true
-          fail_on_error: true
-`;
-export function releaseYml(cadence) {
-    /* v8 ignore next -- exhaustive switch */
-    return cadence === 'scheduled' ? RELEASE_YML_SCHEDULED : RELEASE_YML_IMMEDIATE;
-}
-//# sourceMappingURL=templates.js.map

package/dist/templates.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAeH,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAA8B,IAAI;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IAChE,MAAM,MAAM,GACV,wBAAwB,MAAM,uBAAuB,KAAK,CAAC,UAAU,QAAQ;QAC7E,gFAAgF;QAChF,6CAA6C;QAC7C,gFAAgF,CAAC;IACnF,OAAO,MAAM,GAAG,kBAAkB,CAAC;AACrC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BxB,CAAC;AAEF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgFjB,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CnB,CAAC;AAEF,MAAM,QAAQ,GAAG;;;;;;;;;;;;CAYhB,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBxB,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBxB,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,CAAC;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,CAAC;AAEzG,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBxB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,yCAAyC;IACzC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACjF,CAAC"}

package/dist/token-scope.d.ts

@@ -1,65 +0,0 @@
-/**
- * Token scope checking — compares what a token is allowed to publish
- * against what `putitoutthere.toml` says the package is.
- *
- * Runs as a deep extension of `doctor` (#110) and as an opt-in gate in
- * `publish --preflight-check`. Per registry:
- *
- *   - PyPI: project-name macaroon caveats. Full-scope tokens pass; any
- *     restriction list that excludes the package name is a hard
- *     mismatch.
- *   - npm:  granular `pkg:<name>` scopes on the matched tokens row. A
- *     bare `@scope` grant still counts when the package name lives
- *     under that scope. Legacy (non-granular) tokens are treated as
- *     full-scope (`match: 'ok'`, note surfaced).
- *   - crates.io: the bearer row is not identifiable, so we can never
- *     prove mismatch. Always `match: 'unknown'` — callers that need a
- *     block/warn decision should treat `unknown` as warn-only.
- *
- * Never logs or returns token values. Digests are threaded through from
- * `inspect` for traceability.
- */
-import type { InspectOptions, InspectResult } from './token.js';
-import type { Package } from './config.js';
-import type { Kind } from './types.js';
-export type ScopeMatch = 'ok' | 'mismatch' | 'unknown' | 'error';
-export interface DeepCheckRow {
-    package: string;
-    kind: Kind;
-    scope: string;
-    match: ScopeMatch;
-    /** Populated on mismatch or error; omitted when `ok` / `unknown`. */
-    detail?: string;
-}
-export type InspectFn = (opts: InspectOptions) => Promise<InspectResult>;
-/**
- * Registry-facing publish name. Handlers use the override field when
- * present; we mirror that so the scope check talks about the same name
- * the upload will use.
- */
-export declare function publishNameFor(pkg: Package): string;
-export interface ScopeFromResult {
-    scope: string;
-    match: ScopeMatch;
-    detail?: string;
-}
-/**
- * Translate an `InspectResult` + the package it's meant to publish into
- * a scope display + match verdict. Pure; never hits the network.
- */
-export declare function scopeFromInspect(result: InspectResult, pkg: Package): ScopeFromResult;
-export interface DeepCheckOptions {
-    packages: readonly Package[];
-    /** envVar-per-package mapping, as computed by preflight.checkAuth. */
-    envVarForPackage: Map<string, string>;
-    env?: NodeJS.ProcessEnv;
-    /** Override for tests; defaults to the real `inspect`. */
-    inspect?: InspectFn;
-}
-/**
- * Call `inspect` for every package that has a resolvable token in the
- * env, and return one `DeepCheckRow` per package. Packages whose env
- * var is absent or empty are emitted with `match: 'error'`.
- */
-export declare function deepCheck(opts: DeepCheckOptions): Promise<DeepCheckRow[]>;
-//# sourceMappingURL=token-scope.d.ts.map

package/dist/token-scope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-scope.d.ts","sourceRoot":"","sources":["../src/token-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EAGd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAInD;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,CASrF;AAyFD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,sEAAsE;IACtE,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA6B/E"}

package/dist/token-scope.js

@@ -1,163 +0,0 @@
-/**
- * Token scope checking — compares what a token is allowed to publish
- * against what `putitoutthere.toml` says the package is.
- *
- * Runs as a deep extension of `doctor` (#110) and as an opt-in gate in
- * `publish --preflight-check`. Per registry:
- *
- *   - PyPI: project-name macaroon caveats. Full-scope tokens pass; any
- *     restriction list that excludes the package name is a hard
- *     mismatch.
- *   - npm:  granular `pkg:<name>` scopes on the matched tokens row. A
- *     bare `@scope` grant still counts when the package name lives
- *     under that scope. Legacy (non-granular) tokens are treated as
- *     full-scope (`match: 'ok'`, note surfaced).
- *   - crates.io: the bearer row is not identifiable, so we can never
- *     prove mismatch. Always `match: 'unknown'` — callers that need a
- *     block/warn decision should treat `unknown` as warn-only.
- *
- * Never logs or returns token values. Digests are threaded through from
- * `inspect` for traceability.
- */
-import { inspect as realInspect, isError } from './token.js';
-/**
- * Registry-facing publish name. Handlers use the override field when
- * present; we mirror that so the scope check talks about the same name
- * the upload will use.
- */
-export function publishNameFor(pkg) {
-    if (pkg.kind === 'pypi')
-        return pkg.pypi ?? pkg.name;
-    if (pkg.kind === 'npm')
-        return pkg.npm ?? pkg.name;
-    return pkg.crate ?? pkg.name;
-}
-/**
- * Translate an `InspectResult` + the package it's meant to publish into
- * a scope display + match verdict. Pure; never hits the network.
- */
-export function scopeFromInspect(result, pkg) {
-    if (isError(result)) {
-        return { scope: '(inspect failed)', match: 'error', detail: result.error };
-    }
-    if (result.registry === 'pypi')
-        return scopeFromPypi(result, pkg);
-    if (result.registry === 'npm')
-        return scopeFromNpm(result, pkg);
-    // crates.io: we can't prove mismatch.
-    return { scope: 'unknown (see account tokens)', match: 'unknown' };
-}
-function scopeFromPypi(result, pkg) {
-    const allowed = collectPypiProjectNames(result);
-    if (allowed === null) {
-        return { scope: '(full-scope)', match: 'ok' };
-    }
-    const want = publishNameFor(pkg);
-    if (allowed.includes(want)) {
-        return { scope: `projects=[${allowed.join(', ')}]`, match: 'ok' };
-    }
-    return {
-        scope: `projects=[${allowed.join(', ')}]`,
-        match: 'mismatch',
-        detail: `PyPI token restricted to [${allowed.join(', ')}] but config publishes '${want}'`,
-    };
-}
-function collectPypiProjectNames(result) {
-    const names = [];
-    let sawProjectRestriction = false;
-    for (const r of result.restrictions) {
-        if (r.type === 'ProjectNames') {
-            sawProjectRestriction = true;
-            for (const n of r.names)
-                names.push(n);
-        }
-    }
-    return sawProjectRestriction ? dedupe(names) : null;
-}
-function scopeFromNpm(result, pkg) {
-    const want = publishNameFor(pkg);
-    const row = result.scope_row;
-    if (row === null) {
-        // Legacy UUID or non-granular token: we can't introspect scope.
-        // Treat as full-scope ok; doctor will still flag via note.
-        return { scope: `(${result.format}; no scope row)`, match: 'ok' };
-    }
-    const allowedPkgs = row.packages ?? [];
-    const allowedScopes = (row.scopes ?? []).map((s) => (s.startsWith('@') ? s : `@${s}`));
-    const allowedOrgs = row.orgs ?? [];
-    const noRestrictions = allowedPkgs.length === 0 && allowedScopes.length === 0 && allowedOrgs.length === 0;
-    if (noRestrictions) {
-        return { scope: '(account-wide)', match: 'ok' };
-    }
-    if (allowedPkgs.includes(want)) {
-        return { scope: renderNpmScope(row), match: 'ok' };
-    }
-    const atScope = scopeOf(want);
-    if (atScope !== null && allowedScopes.includes(atScope)) {
-        return { scope: renderNpmScope(row), match: 'ok' };
-    }
-    // Orgs aren't a pre-publish allowlist at the name level (npm doesn't
-    // bind "org:foo" to a package name directly), so we don't use them to
-    // prove a match. We still render them for visibility.
-    return {
-        scope: renderNpmScope(row),
-        match: 'mismatch',
-        detail: `npm token allowlist [${[...allowedPkgs, ...allowedScopes].join(', ')}] does not include '${want}'`,
-    };
-}
-function renderNpmScope(row) {
-    const parts = [];
-    if (row.packages && row.packages.length > 0)
-        parts.push(`pkgs=[${row.packages.join(', ')}]`);
-    if (row.scopes && row.scopes.length > 0)
-        parts.push(`scopes=[${row.scopes.join(', ')}]`);
-    if (row.orgs && row.orgs.length > 0)
-        parts.push(`orgs=[${row.orgs.join(', ')}]`);
-    /* v8 ignore next -- caller only invokes this when at least one list is populated */
-    return parts.length === 0 ? '(empty)' : parts.join(' ');
-}
-function scopeOf(name) {
-    if (!name.startsWith('@'))
-        return null;
-    const slash = name.indexOf('/');
-    /* v8 ignore next -- scoped npm names always carry a slash separator */
-    return slash === -1 ? null : name.slice(0, slash);
-}
-function dedupe(arr) {
-    return Array.from(new Set(arr));
-}
-/**
- * Call `inspect` for every package that has a resolvable token in the
- * env, and return one `DeepCheckRow` per package. Packages whose env
- * var is absent or empty are emitted with `match: 'error'`.
- */
-export async function deepCheck(opts) {
-    const env = opts.env ?? process.env;
-    const inspectFn = opts.inspect ?? realInspect;
-    const rows = [];
-    for (const pkg of opts.packages) {
-        const envVar = opts.envVarForPackage.get(pkg.name);
-        const tokenValue = envVar !== undefined ? env[envVar] : undefined;
-        if (tokenValue === undefined || tokenValue.trim() === '') {
-            rows.push({
-                package: pkg.name,
-                kind: pkg.kind,
-                scope: '(no token resolved)',
-                match: 'error',
-                detail: `no token value found in ${envVar ?? '<unknown env var>'}`,
-            });
-            continue;
-        }
-        const result = await inspectFn({ token: tokenValue, registry: pkg.kind });
-        const verdict = scopeFromInspect(result, pkg);
-        rows.push({
-            package: pkg.name,
-            kind: pkg.kind,
-            scope: verdict.scope,
-            match: verdict.match,
-            ...(verdict.detail !== undefined ? { detail: verdict.detail } : {}),
-        });
-    }
-    return rows;
-}
-//# sourceMappingURL=token-scope.js.map

package/dist/token-scope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-scope.js","sourceRoot":"","sources":["../src/token-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAuB7D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC;AAC/B,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,GAAY;IAClE,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChE,sCAAsC;IACtC,OAAO,EAAE,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB,EAAE,GAAY;IAC5D,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACzC,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,IAAI,GAAG;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAyB;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC9B,qBAAqB,GAAG,IAAI,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,MAAwB,EAAE,GAAY;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,gEAAgE;QAChE,2DAA2D;QAC3D,OAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAEnC,MAAM,cAAc,GAClB,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;IACrF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,qEAAqE;IACrE,sEAAsE;IACtE,sDAAsD;IACtD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC;QAC1B,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,wBAAwB,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,GAAG;KAC5G,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA+C;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzF,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,oFAAoF;IACpF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,uEAAuE;IACvE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,MAAM,CAAI,GAAiB;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAE9C,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC;gBACR,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,qBAAqB;gBAC5B,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,2BAA2B,MAAM,IAAI,mBAAmB,EAAE;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC;YACR,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}