putitoutthere 0.1.43 → 0.1.45

package/dist/keyring.js

@@ -1,88 +0,0 @@
-/**
- * Keyring — persistent storage for the user access token obtained
- * through `auth login`.
- *
- * Ships with a file-backed implementation (chmod 0600 in an XDG-
- * compliant config dir). The `Keyring` interface is the seam for
- * swapping in an OS keychain binding (e.g. `keytar`) later; see #105.
- *
- * Token values are never logged. Callers pass the whole `StoredAuth`
- * in and out; this module does not expose a "read just the access
- * token" affordance that could encourage stringification.
- */
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-export function fileKeyring(opts = {}) {
-    const dir = opts.dir ?? defaultConfigDir();
-    const path = join(dir, 'auth.json');
-    return {
-        get() {
-            if (!existsSync(path))
-                return Promise.resolve(null);
-            const raw = readFileSync(path, 'utf8');
-            return Promise.resolve(tryParse(raw));
-        },
-        set(auth) {
-            if (!existsSync(dir)) {
-                mkdirSync(dir, { recursive: true, mode: 0o700 });
-            }
-            else {
-                // Best-effort tighten; harmless if we don't own the dir.
-                /* v8 ignore next -- catch only fires when another process owns the dir; not reachable in unit tests. */
-                try {
-                    chmodSync(dir, 0o700);
-                }
-                catch { /* ignore */ }
-            }
-            writeFileSync(path, JSON.stringify(auth, null, 2) + '\n', { mode: 0o600 });
-            // writeFileSync honors `mode` only on create. Re-chmod to catch
-            // the overwrite-an-existing-file case where the old mode sticks.
-            chmodSync(path, 0o600);
-            return Promise.resolve();
-        },
-        delete() {
-            if (existsSync(path))
-                rmSync(path);
-            return Promise.resolve();
-        },
-    };
-}
-/** Returned for production callers. */
-export function defaultKeyring() {
-    return fileKeyring();
-}
-/* v8 ignore next 5 -- resolves the user's config dir; tests inject `dir` directly so this branch is only taken in production. */
-function defaultConfigDir() {
-    const xdg = process.env.XDG_CONFIG_HOME;
-    if (xdg && xdg.length > 0)
-        return join(xdg, 'putitoutthere');
-    return join(homedir(), '.config', 'putitoutthere');
-}
-function tryParse(raw) {
-    let v;
-    try {
-        v = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    if (!v || typeof v !== 'object')
-        return null;
-    const o = v;
-    if (typeof o.account !== 'string' ||
-        typeof o.access_token !== 'string' ||
-        typeof o.refresh_token !== 'string' ||
-        typeof o.access_token_expires_at !== 'number' ||
-        typeof o.refresh_token_expires_at !== 'number') {
-        return null;
-    }
-    return {
-        account: o.account,
-        access_token: o.access_token,
-        refresh_token: o.refresh_token,
-        access_token_expires_at: o.access_token_expires_at,
-        refresh_token_expires_at: o.refresh_token_expires_at,
-    };
-}
-//# sourceMappingURL=keyring.js.map

package/dist/keyring.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../src/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAwBjC,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpC,OAAO;QACL,GAAG;YACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,CAAC,IAAgB;YAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,yDAAyD;gBACzD,wGAAwG;gBACxG,IAAI,CAAC;oBAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;YACD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,gEAAgE;YAChE,iEAAiE;YACjE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM;YACJ,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,iIAAiI;AACjI,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IACE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,uBAAuB,KAAK,QAAQ;QAC7C,OAAO,CAAC,CAAC,wBAAwB,KAAK,QAAQ,EAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,uBAAuB,EAAE,CAAC,CAAC,uBAAuB;QAClD,wBAAwB,EAAE,CAAC,CAAC,wBAAwB;KACrD,CAAC;AACJ,CAAC"}

package/dist/oidc-policy.d.ts

@@ -1,145 +0,0 @@
-/**
- * OIDC trust-policy local validation.
- *
- * `doctor` uses this module to check the locally-knowable structural
- * prerequisites of OIDC trusted publishing:
- *
- *   1. At least one `.github/workflows/*.yml` file invokes either
- *      `putitoutthere publish` (as a `run:` command) or the composite
- *      action `thekevinscott/put-it-out-there@...` with a `command:`
- *      input that implies publishing.
- *   2. That workflow's publishing job has `permissions: id-token: write`
- *      and `contents: write` (either job-level or workflow-level).
- *   3. The publishing job has an `environment:` key set. We cannot
- *      validate the *value* against the registry's trust policy — that
- *      requires a registry-policy-read API per registry, which is
- *      deferred (Option C, see follow-up to #162).
- *   4. A clearly-identifiable publish step exists — defends against
- *      edge cases like commented-out steps slipping past (1).
- *
- * The parser is intentionally regex/line-based rather than a full YAML
- * parse: the four checks above all reduce to substring/indentation
- * matches within a single jobs block. Adding a YAML dependency would
- * buy us very little here. If the check set grows beyond this (e.g.
- * "validate the environment value against a registry's trust policy"),
- * revisit.
- *
- * Issue #162 — Option D (locally-knowable checks only).
- */
-export interface WorkflowFile {
-    /** Absolute path to the workflow file on disk. */
-    path: string;
-    /** Basename, e.g. `release.yml`. */
-    filename: string;
-    /** Full file contents. */
-    source: string;
-    /** Parsed jobs (best-effort; top-level job keys + their raw bodies). */
-    jobs: WorkflowJob[];
-    /** Workflow-level `permissions:` block contents (empty if none). */
-    workflowPermissions: string;
-}
-export interface WorkflowJob {
-    /** Job key, e.g. `publish`. */
-    name: string;
-    /** Raw source of just that job block (everything indented under it). */
-    source: string;
-}
-export interface PermissionIssue {
-    kind: 'missing-permission';
-    workflow: string;
-    job: string;
-    permission: 'id-token: write' | 'contents: write';
-}
-export interface EnvironmentIssue {
-    kind: 'missing-environment';
-    workflow: string;
-    job: string;
-}
-export interface InvocationIssue {
-    kind: 'no-publish-step';
-    workflow: string;
-}
-/** Issue: declared `trust_policy.workflow` does not match the workflow we found. */
-export interface WorkflowFilenameMismatch {
-    kind: 'workflow-filename-mismatch';
-    declared: string;
-    actual: string;
-    /** Where `actual` came from — used to refine the error message. */
-    source: 'local-workflow' | 'github-workflow-ref';
-}
-/** Issue: declared `trust_policy.environment` does not match the workflow. */
-export interface EnvironmentMismatch {
-    kind: 'environment-mismatch';
-    workflow: string;
-    declared: string;
-    actual: string | null;
-}
-/**
- * Scan `.github/workflows/*.yml` and `*.yaml` for workflows that invoke
- * `putitoutthere publish` or the composite action in a publish mode.
- *
- * Permissive by design: if a workflow *mentions* piot in any way that
- * looks like publishing, include it. Downstream checks then report
- * specifically. The cost of a false-positive is a spurious pass/fail
- * line in `doctor`; the cost of a false-negative is silently missing
- * the user's real publish workflow.
- */
-export declare function findPublishWorkflows(repoRoot: string): WorkflowFile[];
-/**
- * Best-effort jobs parser. Finds the top-level `jobs:` block and
- * extracts each direct-child key + its body. We use the two-space
- * indent convention GitHub Actions workflows follow. Workflows that
- * deviate (tabs, four-space) would miss — but `init` emits two-space,
- * which is what we're validating.
- */
-export declare function parseJobs(source: string): WorkflowJob[];
-/**
- * Check that the publishing job has (or inherits) the two permissions
- * that OIDC trusted publishing requires. The permissions may be set at
- * workflow level (top-level `permissions:`) and/or job level; this
- * function reports a missing permission only if *neither* scope
- * declares it. `write-all` satisfies both.
- */
-export declare function checkPermissions(workflow: WorkflowFile): PermissionIssue[];
-/**
- * Return `{ kind: 'missing' }` when the publish job lacks an
- * `environment:` key. Does NOT inspect the value — diff-vs-registry is
- * Option C.
- */
-export declare function checkEnvironment(workflow: WorkflowFile): EnvironmentIssue | null;
-/**
- * Sanity check: confirm the workflow has at least one clearly-
- * identifiable publish step. `findPublishWorkflows` already filters,
- * but this catches weird states like a `run:` that's been edited into
- * a comment while the composite-action `uses:` line still matches.
- */
-export declare function checkPublishInvocation(workflow: WorkflowFile): InvocationIssue | null;
-/**
- * Compare `trust_policy.workflow` against the filename of the workflow
- * that `findPublishWorkflows` identified. The declaration is always a
- * bare filename (Zod enforces that at parse time); the comparison is
- * case-sensitive. Returns `null` on match.
- */
-export declare function diffWorkflowFilename(declared: string, workflowFilename: string): WorkflowFilenameMismatch | null;
-/**
- * Compare `trust_policy.environment` against the workflow's job-level
- * `environment:` value. Absence of a declared environment is not an
- * error — the caller decides whether to invoke this. Returns `null` on
- * match.
- */
-export declare function diffEnvironment(declared: string, workflow: WorkflowFile): EnvironmentMismatch | null;
-/**
- * Read `process.env.GITHUB_WORKFLOW_REF` (populated by GitHub Actions)
- * and parse out the workflow filename. Shape:
- *
- *   `owner/repo/.github/workflows/release.yml@refs/heads/main`
- *
- * Returns `null` when the env var is absent (we're not running inside
- * Actions) OR when the value doesn't parse — we'd rather neutral-skip
- * the check than false-positive on an unexpected shape.
- */
-export declare function inferFromGithubWorkflowRef(env?: NodeJS.ProcessEnv): {
-    workflow: string;
-    repository: string;
-} | null;
-//# sourceMappingURL=oidc-policy.d.ts.map

package/dist/oidc-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-policy.d.ts","sourceRoot":"","sources":["../src/oidc-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;CACnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,4BAA4B,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,gBAAgB,GAAG,qBAAqB,CAAC;CAClD;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CA8BrE;AAgBD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CA6BvD;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,EAAE,CAyB1E;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,gBAAgB,GAAG,IAAI,CAShF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,IAAI,CAiBrF;AAeD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,wBAAwB,GAAG,IAAI,CASjC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,YAAY,GACrB,mBAAmB,GAAG,IAAI,CAS5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUjD"}

package/dist/oidc-policy.js

@@ -1,383 +0,0 @@
-/**
- * OIDC trust-policy local validation.
- *
- * `doctor` uses this module to check the locally-knowable structural
- * prerequisites of OIDC trusted publishing:
- *
- *   1. At least one `.github/workflows/*.yml` file invokes either
- *      `putitoutthere publish` (as a `run:` command) or the composite
- *      action `thekevinscott/put-it-out-there@...` with a `command:`
- *      input that implies publishing.
- *   2. That workflow's publishing job has `permissions: id-token: write`
- *      and `contents: write` (either job-level or workflow-level).
- *   3. The publishing job has an `environment:` key set. We cannot
- *      validate the *value* against the registry's trust policy — that
- *      requires a registry-policy-read API per registry, which is
- *      deferred (Option C, see follow-up to #162).
- *   4. A clearly-identifiable publish step exists — defends against
- *      edge cases like commented-out steps slipping past (1).
- *
- * The parser is intentionally regex/line-based rather than a full YAML
- * parse: the four checks above all reduce to substring/indentation
- * matches within a single jobs block. Adding a YAML dependency would
- * buy us very little here. If the check set grows beyond this (e.g.
- * "validate the environment value against a registry's trust policy"),
- * revisit.
- *
- * Issue #162 — Option D (locally-knowable checks only).
- */
-import { readdirSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-/**
- * Scan `.github/workflows/*.yml` and `*.yaml` for workflows that invoke
- * `putitoutthere publish` or the composite action in a publish mode.
- *
- * Permissive by design: if a workflow *mentions* piot in any way that
- * looks like publishing, include it. Downstream checks then report
- * specifically. The cost of a false-positive is a spurious pass/fail
- * line in `doctor`; the cost of a false-negative is silently missing
- * the user's real publish workflow.
- */
-export function findPublishWorkflows(repoRoot) {
-    const dir = join(repoRoot, '.github', 'workflows');
-    let entries;
-    try {
-        entries = readdirSync(dir);
-    }
-    catch {
-        return [];
-    }
-    const workflows = [];
-    for (const entry of entries) {
-        if (!/\.ya?ml$/i.test(entry))
-            continue;
-        const path = join(dir, entry);
-        let source;
-        try {
-            source = readFileSync(path, 'utf8');
-            /* v8 ignore next 3 -- defensive fallback for an unreadable workflow file (permissions, TOCTOU); can't produce in tests without mocking the fs module. */
-        }
-        catch {
-            continue;
-        }
-        if (!looksLikePublishWorkflow(source))
-            continue;
-        workflows.push({
-            path,
-            filename: entry,
-            source,
-            jobs: parseJobs(source),
-            workflowPermissions: extractTopLevelBlock(source, 'permissions') ?? '',
-        });
-    }
-    return workflows;
-}
-/**
- * Heuristic filter. Matches:
- *   - a `run:` step that contains `putitoutthere publish`
- *   - `uses: thekevinscott/put-it-out-there@...` combined with
- *     `command: publish` somewhere in the file (the composite action
- *     defaults to `plan`, so we only flag explicit `publish`)
- */
-function looksLikePublishWorkflow(source) {
-    if (/\bputitoutthere\s+publish\b/.test(source))
-        return true;
-    const usesPiot = /uses:\s*thekevinscott\/put-it-out-there@/.test(source);
-    const commandPublish = /command:\s*['"]?publish['"]?/.test(source);
-    return usesPiot && commandPublish;
-}
-/**
- * Best-effort jobs parser. Finds the top-level `jobs:` block and
- * extracts each direct-child key + its body. We use the two-space
- * indent convention GitHub Actions workflows follow. Workflows that
- * deviate (tabs, four-space) would miss — but `init` emits two-space,
- * which is what we're validating.
- */
-export function parseJobs(source) {
-    const lines = source.split('\n');
-    // Find the `jobs:` top-level key (unindented).
-    let jobsStart = -1;
-    for (let i = 0; i < lines.length; i++) {
-        if (/^jobs\s*:\s*$/.test(lines[i])) {
-            jobsStart = i + 1;
-            break;
-        }
-    }
-    if (jobsStart === -1)
-        return [];
-    const jobs = [];
-    let current = null;
-    for (let i = jobsStart; i < lines.length; i++) {
-        const line = lines[i];
-        // Another top-level key ends the jobs block.
-        if (/^\S/.test(line) && line.trim().length > 0)
-            break;
-        // A direct child job key: exactly 2-space indent + `name:`.
-        const match = /^ {2}([A-Za-z_][\w-]*)\s*:\s*$/.exec(line);
-        if (match) {
-            if (current)
-                jobs.push({ name: current.name, source: current.lines.join('\n') });
-            current = { name: match[1], lines: [] };
-            continue;
-        }
-        if (current)
-            current.lines.push(line);
-    }
-    if (current)
-        jobs.push({ name: current.name, source: current.lines.join('\n') });
-    return jobs;
-}
-/**
- * Extract a top-level block's body (everything indented beneath a
- * given unindented key up to the next top-level key). Returns the
- * concatenated indented body, or `null` if the key is absent.
- */
-function extractTopLevelBlock(source, key) {
-    const lines = source.split('\n');
-    const re = new RegExp(`^${key}\\s*:\\s*(.*)$`);
-    for (let i = 0; i < lines.length; i++) {
-        const m = re.exec(lines[i]);
-        if (!m)
-            continue;
-        // Inline form: `permissions: read-all`. Return the inline value.
-        if (m[1] && m[1].trim().length > 0)
-            return m[1].trim();
-        const body = [];
-        for (let j = i + 1; j < lines.length; j++) {
-            const line = lines[j];
-            if (/^\S/.test(line) && line.trim().length > 0)
-                break;
-            body.push(line);
-        }
-        return body.join('\n');
-    }
-    return null;
-}
-/**
- * Check that the publishing job has (or inherits) the two permissions
- * that OIDC trusted publishing requires. The permissions may be set at
- * workflow level (top-level `permissions:`) and/or job level; this
- * function reports a missing permission only if *neither* scope
- * declares it. `write-all` satisfies both.
- */
-export function checkPermissions(workflow) {
-    const publishJob = findPublishJob(workflow);
-    if (publishJob === null)
-        return [];
-    const jobPerms = extractBlockFromJob(publishJob.source, 'permissions') ?? '';
-    const combined = `${workflow.workflowPermissions}\n${jobPerms}`;
-    const issues = [];
-    if (!hasPermission(combined, 'id-token', 'write')) {
-        issues.push({
-            kind: 'missing-permission',
-            workflow: workflow.filename,
-            job: publishJob.name,
-            permission: 'id-token: write',
-        });
-    }
-    if (!hasPermission(combined, 'contents', 'write')) {
-        issues.push({
-            kind: 'missing-permission',
-            workflow: workflow.filename,
-            job: publishJob.name,
-            permission: 'contents: write',
-        });
-    }
-    return issues;
-}
-function hasPermission(block, name, level) {
-    // `write-all` shortcut: every scope is `write`.
-    if (/\bwrite-all\b/.test(block))
-        return true;
-    const re = new RegExp(`\\b${name}\\s*:\\s*${level}\\b`);
-    return re.test(block);
-}
-/**
- * Return `{ kind: 'missing' }` when the publish job lacks an
- * `environment:` key. Does NOT inspect the value — diff-vs-registry is
- * Option C.
- */
-export function checkEnvironment(workflow) {
-    const publishJob = findPublishJob(workflow);
-    if (publishJob === null)
-        return null;
-    if (hasKeyAtJobLevel(publishJob.source, 'environment'))
-        return null;
-    return {
-        kind: 'missing-environment',
-        workflow: workflow.filename,
-        job: publishJob.name,
-    };
-}
-/**
- * Sanity check: confirm the workflow has at least one clearly-
- * identifiable publish step. `findPublishWorkflows` already filters,
- * but this catches weird states like a `run:` that's been edited into
- * a comment while the composite-action `uses:` line still matches.
- */
-export function checkPublishInvocation(workflow) {
-    // Strip comment-only lines and blank lines before matching. A
-    // commented-out `run: putitoutthere publish` step shouldn't count.
-    const uncommented = workflow.source
-        .split('\n')
-        .filter((l) => !/^\s*#/.test(l))
-        .join('\n');
-    const hasRunCmd = /\bputitoutthere\s+publish\b/.test(uncommented);
-    if (hasRunCmd)
-        return null;
-    // Composite-action form with `command: publish` explicitly.
-    const usesPiot = /uses:\s*thekevinscott\/put-it-out-there@/.test(uncommented);
-    const commandPublish = /command:\s*['"]?publish['"]?/.test(uncommented);
-    if (usesPiot && commandPublish)
-        return null;
-    return { kind: 'no-publish-step', workflow: workflow.filename };
-}
-/* ---------------------- #189: declared diff ---------------------- */
-/**
- * Extract the basename (no directory) from a bare or path-shaped string.
- * Normalizes both slash styles so a caller feeding in a
- * `.github/workflows/release.yml` still gets `release.yml` back.
- */
-function basename(p) {
-    const normalized = p.replace(/\\/g, '/');
-    const idx = normalized.lastIndexOf('/');
-    return idx === -1 ? normalized : normalized.slice(idx + 1);
-}
-/**
- * Compare `trust_policy.workflow` against the filename of the workflow
- * that `findPublishWorkflows` identified. The declaration is always a
- * bare filename (Zod enforces that at parse time); the comparison is
- * case-sensitive. Returns `null` on match.
- */
-export function diffWorkflowFilename(declared, workflowFilename) {
-    const actual = basename(workflowFilename);
-    if (declared === actual)
-        return null;
-    return {
-        kind: 'workflow-filename-mismatch',
-        declared,
-        actual,
-        source: 'local-workflow',
-    };
-}
-/**
- * Compare `trust_policy.environment` against the workflow's job-level
- * `environment:` value. Absence of a declared environment is not an
- * error — the caller decides whether to invoke this. Returns `null` on
- * match.
- */
-export function diffEnvironment(declared, workflow) {
-    const actual = extractJobEnvironment(workflow);
-    if (actual === declared)
-        return null;
-    return {
-        kind: 'environment-mismatch',
-        workflow: workflow.filename,
-        declared,
-        actual,
-    };
-}
-/**
- * Read `process.env.GITHUB_WORKFLOW_REF` (populated by GitHub Actions)
- * and parse out the workflow filename. Shape:
- *
- *   `owner/repo/.github/workflows/release.yml@refs/heads/main`
- *
- * Returns `null` when the env var is absent (we're not running inside
- * Actions) OR when the value doesn't parse — we'd rather neutral-skip
- * the check than false-positive on an unexpected shape.
- */
-export function inferFromGithubWorkflowRef(env = process.env) {
-    const ref = env.GITHUB_WORKFLOW_REF;
-    if (ref === undefined || ref.length === 0)
-        return null;
-    // Strip the `@ref` suffix, then match
-    // `<owner>/<repo>/.github/workflows/<file>`.
-    const atIdx = ref.indexOf('@');
-    const pathPart = atIdx === -1 ? ref : ref.slice(0, atIdx);
-    const m = /^([^/\s]+\/[^/\s]+)\/\.github\/workflows\/(.+)$/.exec(pathPart);
-    if (!m)
-        return null;
-    return { repository: m[1], workflow: m[2] };
-}
-/**
- * Extract the job-level `environment:` value from a workflow's publish
- * job. Supports the inline form (`environment: release`) and the nested
- * form (`environment:\n  name: release`). Returns `null` when no
- * environment is declared (or no publish job is found).
- */
-function extractJobEnvironment(workflow) {
-    const publishJob = findPublishJob(workflow);
-    /* v8 ignore next -- caller only invokes this for workflows that have a publish job */
-    if (publishJob === null)
-        return null;
-    const raw = extractBlockFromJob(publishJob.source, 'environment');
-    if (raw === null)
-        return null;
-    const trimmed = raw.trim();
-    // Inline form: `environment: release`. Nested form: `environment:\n  name: release`.
-    // The inline regex matches when the value is a single line; for nested
-    // blocks, look for the `name:` key inside the body. When neither
-    // matches the block is structurally malformed — null propagates.
-    if (!trimmed.includes('\n')) {
-        const inline = /^['"]?([^'"\n]+?)['"]?$/.exec(trimmed);
-        return inline ? inline[1].trim() : null;
-    }
-    const nested = /^\s*name\s*:\s*['"]?([^'"\n]+?)['"]?\s*$/m.exec(trimmed);
-    return nested ? nested[1].trim() : null;
-}
-/* ---------------------------- helpers ---------------------------- */
-/**
- * Pick the job within a workflow that runs publish. If only one job
- * matches, return it. If multiple match, prefer the one whose name
- * contains `publish`; otherwise return the first.
- */
-function findPublishJob(workflow) {
-    const matches = workflow.jobs.filter((j) => jobRunsPublish(j));
-    if (matches.length === 0)
-        return null;
-    const named = matches.find((j) => /publish/i.test(j.name));
-    return named ?? matches[0];
-}
-function jobRunsPublish(job) {
-    if (/\bputitoutthere\s+publish\b/.test(job.source))
-        return true;
-    const usesPiot = /uses:\s*thekevinscott\/put-it-out-there@/.test(job.source);
-    const commandPublish = /command:\s*['"]?publish['"]?/.test(job.source);
-    return usesPiot && commandPublish;
-}
-/**
- * Whether the given job's source declares the key at the job scope
- * (exactly 4-space indent, matching the 2-space job indent + one level
- * further). Inline or block form both accepted.
- */
-function hasKeyAtJobLevel(jobSource, key) {
-    const re = new RegExp(`^ {4}${key}\\s*:`, 'm');
-    return re.test(jobSource);
-}
-/**
- * Extract a nested block from inside a job source — `permissions:` or
- * `environment:` below the 4-space indent.
- */
-function extractBlockFromJob(jobSource, key) {
-    const lines = jobSource.split('\n');
-    const headRe = new RegExp(`^ {4}${key}\\s*:\\s*(.*)$`);
-    for (let i = 0; i < lines.length; i++) {
-        const m = headRe.exec(lines[i]);
-        if (!m)
-            continue;
-        if (m[1] && m[1].trim().length > 0)
-            return m[1].trim();
-        const body = [];
-        for (let j = i + 1; j < lines.length; j++) {
-            const line = lines[j];
-            // Any line indented 4 spaces or less (and non-empty) ends the block.
-            if (line.trim().length > 0 && /^ {0,4}\S/.test(line))
-                break;
-            body.push(line);
-        }
-        return body.join('\n');
-    }
-    return null;
-}
-//# sourceMappingURL=oidc-policy.js.map

package/dist/oidc-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-policy.js","sourceRoot":"","sources":["../src/oidc-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyDjC;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,yJAAyJ;QAC3J,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;YAAE,SAAS;QAChD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC;YACvB,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,0CAA0C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,QAAQ,IAAI,cAAc,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,+CAA+C;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACpC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,OAAO,GAA6C,IAAI,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,6CAA6C;QAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QACtD,4DAA4D;QAC5D,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAAc,EAAE,GAAW;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,iEAAiE;QACjE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;YACtD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAsB;IACrD,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,EAAE,UAAU,CAAC,IAAI;YACpB,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,EAAE,UAAU,CAAC,IAAI;YACpB,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,KAAc;IAChE,gDAAgD;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,KAAK,KAAK,CAAC,CAAC;IACxD,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAsB;IACrD,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,EAAE,UAAU,CAAC,IAAI;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAsB;IAC3D,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM;SAChC,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,SAAS,GAAG,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3B,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,0CAA0C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,8BAA8B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxE,IAAI,QAAQ,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,gBAAwB;IAExB,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,QAAQ;QACR,MAAM;QACN,MAAM,EAAE,gBAAgB;KACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,QAAsB;IAEtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,sCAAsC;IACtC,6CAA6C;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,iDAAiD,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,QAAsB;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,sFAAsF;IACtF,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,qFAAqF;IACrF,uEAAuE;IACvE,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAsB;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,KAAK,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,GAAgB;IACtC,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,QAAQ,GAAG,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,QAAQ,IAAI,cAAc,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IACtD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,qEAAqE;YACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM;YAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}