putitoutthere 0.1.43 → 0.1.45

package/dist/auth.js

@@ -1,285 +0,0 @@
-/**
- * `auth login/logout/status` — OAuth Device Flow against the
- * `putitoutthere-cli` GitHub App (client ID committed to
- * docs/guide/auth.md).
- *
- * Scope: optional. The rest of the CLI authenticates to registries
- * via env vars; this subcommand exists so `token list` (and later
- * features) can read repo-secret metadata from GitHub on behalf of
- * the user. If `auth login` has never been run, those features
- * degrade gracefully — see #98.
- *
- * Token values are never logged or written to stdout. They flow
- * through the `Keyring` abstraction (see `src/keyring.ts`); in logs
- * a token is identified by the first 8 hex chars of its SHA-256.
- */
-import { defaultKeyring } from './keyring.js';
-/** Public client ID of the `putitoutthere-cli` GitHub App (#104). */
-export const CLIENT_ID = 'Iv23lio0NtN1koa0Rwle';
-const GITHUB_DEVICE_URL = 'https://github.com/login/device/code';
-const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
-const GITHUB_API_USER = 'https://api.github.com/user';
-const GRANT_DEVICE = 'urn:ietf:params:oauth:grant-type:device_code';
-const GRANT_REFRESH = 'refresh_token';
-/** Seconds of slack to refresh a token before it actually expires. */
-const REFRESH_SKEW_SECONDS = 60;
-/** Bumped when GitHub returns `slow_down`. */
-const SLOW_DOWN_BUMP_SECONDS = 5;
-// ---- login -------------------------------------------------------------
-export async function login(opts = {}) {
-    const clientId = opts.clientId ?? CLIENT_ID;
-    const fetchFn = opts.fetchFn ?? fetch;
-    const keyring = opts.keyring ?? defaultKeyring();
-    const now = opts.now ?? epochSeconds;
-    const sleep = opts.sleep ?? realSleep;
-    const onPrompt = opts.onPrompt ?? (() => undefined);
-    const device = await requestDeviceCode(fetchFn, clientId);
-    onPrompt({
-        userCode: device.user_code,
-        verificationUri: device.verification_uri,
-        expiresInSeconds: device.expires_in,
-    });
-    const tokens = await pollForToken(fetchFn, sleep, clientId, device);
-    const account = await fetchLogin(fetchFn, tokens.access_token);
-    const issuedAt = now();
-    const stored = {
-        account,
-        access_token: tokens.access_token,
-        refresh_token: tokens.refresh_token,
-        access_token_expires_at: issuedAt + tokens.expires_in,
-        refresh_token_expires_at: issuedAt + tokens.refresh_token_expires_in,
-    };
-    await keyring.set(stored);
-    return { account, expiresAt: stored.access_token_expires_at };
-}
-// ---- logout ------------------------------------------------------------
-export async function logout(opts = {}) {
-    const keyring = opts.keyring ?? defaultKeyring();
-    const existing = await keyring.get();
-    if (!existing)
-        return { wiped: false };
-    await keyring.delete();
-    return { wiped: true };
-}
-// ---- status ------------------------------------------------------------
-export async function status(opts = {}) {
-    const fetchFn = opts.fetchFn ?? fetch;
-    const keyring = opts.keyring ?? defaultKeyring();
-    const now = opts.now ?? epochSeconds;
-    const stored = await keyring.get();
-    if (!stored) {
-        return {
-            authenticated: false,
-            reason: 'not_logged_in',
-            message: 'Not logged in. Run `putitoutthere auth login`.',
-        };
-    }
-    let working = stored;
-    const soonExpired = now() >= stored.access_token_expires_at - REFRESH_SKEW_SECONDS;
-    if (soonExpired) {
-        const refreshed = await tryRefresh(fetchFn, keyring, working, now);
-        if (!refreshed) {
-            return {
-                authenticated: false,
-                reason: 'refresh_failed',
-                message: 'Session expired. Run `putitoutthere auth login`.',
-            };
-        }
-        working = refreshed;
-    }
-    const probe = await probeUser(fetchFn, working.access_token);
-    if (probe.ok) {
-        return {
-            authenticated: true,
-            account: probe.login,
-            expiresAt: working.access_token_expires_at,
-        };
-    }
-    if (probe.status !== 401) {
-        // Network or 5xx — don't wipe credentials over a transient blip.
-        return {
-            authenticated: false,
-            reason: 'refresh_failed',
-            message: `GitHub /user probe failed (${probe.status}).`,
-        };
-    }
-    // 401 with a still-unexpired token => credential actually revoked.
-    // Try one refresh before giving up, in case the server clock drifted.
-    const refreshed = await tryRefresh(fetchFn, keyring, working, now);
-    if (!refreshed) {
-        return {
-            authenticated: false,
-            reason: 'revoked',
-            message: 'Token rejected by GitHub. Run `putitoutthere auth login`.',
-        };
-    }
-    const reprobe = await probeUser(fetchFn, refreshed.access_token);
-    if (!reprobe.ok) {
-        return {
-            authenticated: false,
-            reason: 'revoked',
-            message: 'Token rejected by GitHub. Run `putitoutthere auth login`.',
-        };
-    }
-    return {
-        authenticated: true,
-        account: reprobe.login,
-        expiresAt: refreshed.access_token_expires_at,
-    };
-}
-async function requestDeviceCode(fetchFn, clientId) {
-    const res = await fetchFn(GITHUB_DEVICE_URL, {
-        method: 'POST',
-        headers: {
-            accept: 'application/json',
-            'content-type': 'application/x-www-form-urlencoded',
-        },
-        body: new URLSearchParams({ client_id: clientId }).toString(),
-    });
-    if (!res.ok) {
-        throw new Error(`device code request failed: HTTP ${res.status}`);
-    }
-    const body = await res.json();
-    /* v8 ignore next 3 -- defensive; GitHub always returns the documented fields on 2xx. */
-    if (!isDeviceCodeResponse(body)) {
-        throw new Error('device code response missing expected fields');
-    }
-    return body;
-}
-async function pollForToken(fetchFn, sleep, clientId, device) {
-    let intervalSec = device.interval;
-    const deadline = Date.now() + device.expires_in * 1000;
-    while (Date.now() < deadline) {
-        await sleep(intervalSec * 1000);
-        const res = await fetchFn(GITHUB_TOKEN_URL, {
-            method: 'POST',
-            headers: {
-                accept: 'application/json',
-                'content-type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                client_id: clientId,
-                device_code: device.device_code,
-                grant_type: GRANT_DEVICE,
-            }).toString(),
-        });
-        const body = (await res.json());
-        if (isTokenResponse(body))
-            return body;
-        const error = typeof body.error === 'string' ? body.error : 'unknown_error';
-        if (error === 'authorization_pending')
-            continue;
-        if (error === 'slow_down') {
-            intervalSec += SLOW_DOWN_BUMP_SECONDS;
-            continue;
-        }
-        if (error === 'access_denied') {
-            throw new Error('authorization denied by user');
-        }
-        if (error === 'expired_token') {
-            throw new Error('device code expired before approval');
-        }
-        /* v8 ignore start -- unknown error codes + wall-clock deadline are both defensive; GitHub's error set is exhaustive and the server's expired_token fires first. */
-        throw new Error(`device flow error: ${error}`);
-    }
-    throw new Error('device code expired before approval');
-}
-/* v8 ignore stop */
-async function tryRefresh(fetchFn, keyring, current, now) {
-    const res = await fetchFn(GITHUB_TOKEN_URL, {
-        method: 'POST',
-        headers: {
-            accept: 'application/json',
-            'content-type': 'application/x-www-form-urlencoded',
-        },
-        body: new URLSearchParams({
-            client_id: CLIENT_ID,
-            refresh_token: current.refresh_token,
-            grant_type: GRANT_REFRESH,
-        }).toString(),
-    });
-    if (!res.ok)
-        return null;
-    const body = (await res.json());
-    if (!isTokenResponse(body))
-        return null;
-    const issuedAt = now();
-    const next = {
-        account: current.account,
-        access_token: body.access_token,
-        refresh_token: body.refresh_token,
-        access_token_expires_at: issuedAt + body.expires_in,
-        refresh_token_expires_at: issuedAt + body.refresh_token_expires_in,
-    };
-    await keyring.set(next);
-    return next;
-}
-async function fetchLogin(fetchFn, accessToken) {
-    const res = await fetchFn(GITHUB_API_USER, {
-        headers: {
-            authorization: `Bearer ${accessToken}`,
-            accept: 'application/vnd.github+json',
-            'user-agent': 'putitoutthere',
-        },
-    });
-    /* v8 ignore next 3 -- fetchLogin runs only after a successful token grant; the happy-path is covered. */
-    if (!res.ok) {
-        throw new Error(`GitHub /user failed: HTTP ${res.status}`);
-    }
-    const body = (await res.json());
-    /* v8 ignore next 3 -- defensive: GitHub has never shipped /user without a login field. */
-    if (typeof body.login !== 'string') {
-        throw new Error('GitHub /user response missing login');
-    }
-    return body.login;
-}
-async function probeUser(fetchFn, accessToken) {
-    try {
-        const res = await fetchFn(GITHUB_API_USER, {
-            headers: {
-                authorization: `Bearer ${accessToken}`,
-                accept: 'application/vnd.github+json',
-                'user-agent': 'putitoutthere',
-            },
-        });
-        if (!res.ok)
-            return { ok: false, status: res.status };
-        const body = (await res.json());
-        /* v8 ignore next -- defensive: GitHub has never shipped /user without a login field. */
-        if (typeof body.login !== 'string')
-            return { ok: false, status: res.status };
-        return { ok: true, login: body.login };
-        /* v8 ignore next 3 -- network-throw catch; msw can't model a pre-HTTP throw cleanly. */
-    }
-    catch {
-        return { ok: false, status: 0 };
-    }
-}
-// ---- helpers -----------------------------------------------------------
-function isDeviceCodeResponse(v) {
-    if (!v || typeof v !== 'object')
-        return false;
-    const o = v;
-    return (typeof o.device_code === 'string' &&
-        typeof o.user_code === 'string' &&
-        typeof o.verification_uri === 'string' &&
-        typeof o.expires_in === 'number' &&
-        typeof o.interval === 'number');
-}
-function isTokenResponse(v) {
-    if (!v || typeof v !== 'object')
-        return false;
-    const o = v;
-    return (typeof o.access_token === 'string' &&
-        typeof o.expires_in === 'number' &&
-        typeof o.refresh_token === 'string' &&
-        typeof o.refresh_token_expires_in === 'number');
-}
-function epochSeconds() {
-    return Math.floor(Date.now() / 1000);
-}
-/* v8 ignore next 3 -- real timer; every test injects `sleep`. */
-function realSleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
-}
-//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAiC,MAAM,cAAc,CAAC;AAE7E,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEhD,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACjE,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AACvE,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,MAAM,YAAY,GAAG,8CAA8C,CAAC;AACpE,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,8CAA8C;AAC9C,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAkDjC,2EAA2E;AAE3E,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB,EAAE;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC;QACP,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACpC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAe;QACzB,OAAO;QACP,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,uBAAuB,EAAE,QAAQ,GAAG,MAAM,CAAC,UAAU;QACrD,wBAAwB,EAAE,QAAQ,GAAG,MAAM,CAAC,wBAAwB;KACrE,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,uBAAuB,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAE3E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAsB,EAAE;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,2EAA2E;AAE3E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAsB,EAAE;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,gDAAgD;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,MAAM,WAAW,GAAG,GAAG,EAAE,IAAI,MAAM,CAAC,uBAAuB,GAAG,oBAAoB,CAAC;IACnF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,kDAAkD;aAC5D,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,KAAK,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,uBAAuB;SAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,iEAAiE;QACjE,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,8BAA8B,KAAK,CAAC,MAAM,IAAI;SACxD,CAAC;IACJ,CAAC;IACD,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,uBAAuB;KAC7C,CAAC;AACJ,CAAC;AAqBD,KAAK,UAAU,iBAAiB,CAC9B,OAAqB,EACrB,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC9D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,wFAAwF;IACxF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAqB,EACrB,KAAoC,EACpC,QAAgB,EAChB,MAA0B;IAE1B,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IACvD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,IAAI,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5E,IAAI,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAChD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,WAAW,IAAI,sBAAsB,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,mKAAmK;QACnK,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACzD,CAAC;AACD,oBAAoB;AAEpB,KAAK,UAAU,UAAU,CACvB,OAAqB,EACrB,OAAgB,EAChB,OAAmB,EACnB,GAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAe;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,uBAAuB,EAAE,QAAQ,GAAG,IAAI,CAAC,UAAU;QACnD,wBAAwB,EAAE,QAAQ,GAAG,IAAI,CAAC,wBAAwB;KACnE,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAqB,EAAE,WAAmB;IAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE;QACzC,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,eAAe;SAC9B;KACF,CAAC,CAAC;IACH,yGAAyG;IACzG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,0FAA0F;IAC1F,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAMD,KAAK,UAAU,SAAS,CAAC,OAAqB,EAAE,WAAmB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE;YACzC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,eAAe;aAC9B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,wFAAwF;QACxF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,wFAAwF;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,2EAA2E;AAE3E,SAAS,oBAAoB,CAAC,CAAU;IACtC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ;QACtC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,wBAAwB,KAAK,QAAQ,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,iEAAiE;AACjE,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/doctor.d.ts

@@ -1,115 +0,0 @@
-/**
- * `putitoutthere doctor` — pre-flight validator.
- *
- * Validates: config parses; every package has a resolvable kind; every
- * package has usable credentials (OIDC or per-kind token). Returns a
- * structured report rather than throwing so the CLI can render it as
- * a table.
- *
- * When `checkArtifacts` is on, also walks the plan and checks each
- * expected artifact directory. Silent-skips when plan can't run (no
- * git state / no commits) so `doctor` stays useful in contexts that
- * don't have a release history yet.
- *
- * Issue #23. Plan: §21.1, §16.4.7. Artifact check: #89.
- */
-import { type WorkflowFile } from './oidc-policy.js';
-import { fetchCratesTrustPolicy, type CratesTrustMismatch } from './registries/crates-trust.js';
-import { type AuthResult } from './preflight.js';
-import { type DeepCheckRow, type InspectFn } from './token-scope.js';
-export interface DoctorOptions {
-    cwd: string;
-    configPath?: string;
-    /** When true, walks the plan and checks each artifact dir exists. */
-    checkArtifacts?: boolean;
-    /**
-     * When true, resolve each package's token and run a live `inspect`
-     * to cross-check publish scope against the config. Slower (hits the
-     * registries); off by default. See #110.
-     */
-    deep?: boolean;
-    /** Override for tests; defaults to the real `inspect`. */
-    inspectFn?: InspectFn;
-    /**
-     * Override for tests of the crates.io trust-policy cross-check.
-     * Defaults to the real `fetchCratesTrustPolicy`. Accepting `null`
-     * here means "use the default".
-     */
-    cratesIoFetch?: typeof fetchCratesTrustPolicy;
-}
-export interface DoctorReport {
-    ok: boolean;
-    issues: string[];
-    packages: Array<{
-        name: string;
-        kind: string;
-        auth: AuthResult['via'];
-        /** Populated when `deep: true`. */
-        scope?: string;
-        scope_match?: DeepCheckRow['match'];
-    }>;
-    artifacts?: Array<{
-        package: string;
-        target: string;
-        artifact_name: string;
-        present: boolean;
-        expected: string;
-    }>;
-    /**
-     * Trust-policy (local) check results. See `checkTrustPolicyLocal`.
-     * `undefined` when no publish workflow was found (e.g. a bare repo
-     * with no `.github/workflows/` yet — no signal, no noise).
-     */
-    trustPolicy?: TrustPolicyReport;
-    /**
-     * Trust-policy (declared) check results. See #189. `undefined` when
-     * no package has a `[package.trust_policy]` block.
-     */
-    trustPolicyDeclared?: TrustPolicyDeclaredReport;
-    /**
-     * Trust-policy (crates.io) cross-check. `undefined` when the phase
-     * didn't run (e.g. no `CRATES_IO_DOCTOR_TOKEN`, or no crates with
-     * `trust_policy` declared).
-     */
-    trustPolicyCratesIo?: TrustPolicyCratesIoReport;
-}
-export interface TrustPolicyReport {
-    workflows: Array<{
-        filename: string;
-        permissions_ok: boolean;
-        environment_ok: boolean;
-        invocation_ok: boolean;
-        issues: string[];
-    }>;
-}
-export interface TrustPolicyDeclaredReport {
-    /** One entry per package with a `[package.trust_policy]` block. */
-    packages: Array<{
-        name: string;
-        workflow_ok: boolean;
-        environment_ok: boolean;
-        ref_ok: boolean;
-        issues: string[];
-    }>;
-}
-export interface TrustPolicyCratesIoReport {
-    /** `'skipped'` when the token was missing; other values are per-crate statuses. */
-    status: 'ran' | 'skipped';
-    reason?: string;
-    crates: Array<{
-        name: string;
-        status: 'ok' | 'mismatch' | 'skip-transient' | 'auth-failed';
-        reason?: string;
-        mismatches?: CratesTrustMismatch[];
-    }>;
-}
-export declare function doctor(opts: DoctorOptions): Promise<DoctorReport>;
-/**
- * Exported for CLI rendering: the explicit "what's NOT checked" line
- * we surface below the trust-policy phase so a green doctor output
- * doesn't imply the filename landmine is caught.
- */
-export declare const TRUST_POLICY_SCOPE_NOTE = "note: declare `[package.trust_policy]` to have `doctor` diff workflow + environment against the config. Registry cross-check is crates.io-only (set `CRATES_IO_DOCTOR_TOKEN`); PyPI and npm are declaration-only.";
-/** Re-exported for callers that want to construct a `TrustPolicyReport` or inspect workflows directly. */
-export type { WorkflowFile };
-//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,OAAO,EASL,KAAK,YAAY,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,sBAAsB,EACtB,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,sBAAsB,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,mCAAmC;QACnC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;KACrC,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IAChD;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;CACjD;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,KAAK,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,OAAO,CAAC;QACxB,cAAc,EAAE,OAAO,CAAC;QACxB,aAAa,EAAE,OAAO,CAAC;QACvB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,EAAE,OAAO,CAAC;QACxB,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IACxC,mFAAmF;IACnF,MAAM,EAAE,KAAK,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAC;QAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACpC,CAAC,CAAC;CACJ;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAuFvE;AAkDD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,sNACiL,CAAC;AAqItN,0GAA0G;AAC1G,YAAY,EAAE,YAAY,EAAE,CAAC"}