putitoutthere 0.1.44 → 0.1.45

package/dist/token.d.ts

@@ -1,211 +0,0 @@
-/**
- * `putitoutthere token inspect` — decode/introspect registry tokens.
- *
- * Scaffolding and PyPI offline decode: #107.
- * npm live probe: #108 (whoami + SHA-512 match against /-/npm/v1/tokens).
- * crates.io live probe: #109 (/api/v1/me + /api/v1/me/tokens).
- *
- * Dispatch is driven by token format, not by a hardcoded registry list:
- *   - `pypi-` prefix  → PyPI macaroon decode (offline, full scope)
- *   - `npm_` prefix   → npm (live probe)
- *   - otherwise       → crates.io (live probe), unless `--registry` overrides
- *
- * Token values are never logged. Logs identify a token by the first 8
- * hex chars of its SHA-256. Live probes are timeboxed at 5s per request.
- */
-import { type Package } from './config.js';
-import { type Keyring } from './keyring.js';
-export type Registry = 'pypi' | 'npm' | 'crates';
-export interface InspectOptions {
-    token: string;
-    registry?: Registry;
-    /** Override live-probe base URL. Tests only. */
-    baseUrl?: string;
-    /** Override live-probe timeout in ms (default 5000). Tests only. */
-    timeoutMs?: number;
-}
-export type InspectResult = PypiInspectResult | NpmInspectResult | CratesInspectResult | InspectErrorResult;
-interface BaseResult {
-    registry: Registry;
-    source_digest: string;
-}
-export interface PypiInspectResult extends BaseResult {
-    registry: 'pypi';
-    format: 'macaroon';
-    identifier: Record<string, unknown> | null;
-    restrictions: Restriction[];
-    expired: boolean;
-}
-export type Restriction = {
-    type: 'ProjectNames';
-    names: string[];
-} | {
-    type: 'ProjectIDs';
-    ids: string[];
-} | {
-    type: 'Date';
-    not_before?: number;
-    not_after?: number;
-} | {
-    type: 'Unknown';
-    raw: Record<string, unknown>;
-};
-export interface NpmScopeRow {
-    readonly: boolean;
-    automation: boolean;
-    packages: string[] | null;
-    scopes: string[] | null;
-    orgs: string[] | null;
-    expires_at: string | null;
-    cidr_whitelist: string[] | null;
-    created: string | null;
-}
-export interface NpmInspectResult extends BaseResult {
-    registry: 'npm';
-    format: 'granular' | 'legacy' | 'unknown';
-    username: string;
-    scope_row: NpmScopeRow | null;
-    note?: string;
-}
-export interface CratesTokenRow {
-    name: string;
-    endpoint_scopes: string[] | null;
-    crate_scopes: string[] | null;
-    expired_at: string | null;
-}
-export interface CratesInspectResult extends BaseResult {
-    registry: 'crates';
-    username: string;
-    account_tokens: CratesTokenRow[] | null;
-    bearer_row: null;
-    note: string;
-}
-export interface InspectErrorResult {
-    registry: Registry | 'unknown';
-    source_digest: string;
-    error: string;
-}
-export declare function isError(r: InspectResult): r is InspectErrorResult;
-export declare function inspect(opts: InspectOptions): Promise<InspectResult>;
-export declare function detectRegistry(token: string): Registry;
-export interface TokenListRow {
-    registry: Registry;
-    source: 'env' | 'repo-secret' | 'environment-secret';
-    name: string;
-    details: string;
-    /** Populated only when source = 'environment-secret'. */
-    environment?: string;
-}
-export interface TokenListOptions {
-    /** Working dir used to locate putitoutthere.toml when no `packages` is passed. */
-    cwd?: string;
-    configPath?: string;
-    /** Env to scan. Defaults to process.env. */
-    env?: NodeJS.ProcessEnv;
-    /**
-     * Override the packages list (skips config load). Tests pass this
-     * directly; the CLI path loads it from disk.
-     */
-    packages?: readonly Package[];
-}
-/**
- * Enumerate registry tokens discoverable to the CLI from the environment.
- *
- * Classification is by *value format*:
- *   - `pypi-` prefix → PyPI macaroon
- *   - `npm_`  prefix → npm granular
- *   - opaque value under a crates-recognized env var, iff the config has a
- *     crates package → crates.io
- *
- * Token values are never returned or logged.
- *
- * Issue #106. Ships env-only; `--secrets` (repo/env/org secret listing via
- * the stored GitHub user access token) is gated on #105.
- */
-export declare function tokenList(opts?: TokenListOptions): TokenListRow[];
-/**
- * Classify a GitHub Actions secret *by name* to a registry. The API never
- * exposes secret values, so prefix-by-value classification (the env-var
- * path) is unavailable here. Conservative: unrecognized names return
- * `null` and are omitted from the listing rather than dumping every
- * secret on the repo.
- *
- * Exact matches line up with `src/preflight.ts#TOKEN_ENV`, plus the
- * common `TWINE_PASSWORD` / `PYPI_TOKEN` aliases used in the wild.
- * Prefixed names (`NPM_FOO`, `PYPI_BAR`, `CARGO_FOO`, `TWINE_FOO`)
- * are treated as likely-registry.
- */
-export declare function classifySecretName(name: string): Registry | null;
-export interface SecretListOptions {
-    /** Working dir used to resolve the git remote when `repo` is omitted. */
-    cwd?: string;
-    /** Repo as "owner/name". Defaults to $GITHUB_REPOSITORY or parsed from `git remote get-url origin`. */
-    repo?: string;
-    keyring?: Keyring;
-    fetchFn?: typeof fetch;
-    /** Per-request timeout. Defaults to 5000ms. */
-    timeoutMs?: number;
-    env?: NodeJS.ProcessEnv;
-}
-/**
- * Internal options type that additionally allows overriding the GitHub
- * API base URL. Kept off the public surface so an SDK caller cannot
- * redirect the request (which carries the stored user access token) to
- * an attacker-controlled host (#139). Only the `__testOnly` export
- * honors this field.
- */
-interface SecretListOptionsInternal extends SecretListOptions {
-    apiBase?: string;
-}
-export interface EnvSecretError {
-    environment: string;
-    message: string;
-}
-export type SecretListOutcome = {
-    kind: 'not_logged_in';
-    message: string;
-} | {
-    kind: 'no_repo';
-    message: string;
-} | {
-    kind: 'error';
-    message: string;
-    rows: TokenListRow[];
-} | {
-    kind: 'ok';
-    rows: TokenListRow[];
-    envErrors?: EnvSecretError[];
-};
-/**
- * List GitHub Actions secrets (repo + environment) whose names look like
- * registry credentials. Uses the stored user access token from the
- * `Keyring` (populated by `auth login`).
- *
- * Secret *values* are never returned — the GitHub API doesn't expose
- * them. Classification is by name (see `classifySecretName`).
- *
- * Degrades gracefully: missing keyring, unresolvable repo, 401/403 from
- * GitHub, and network errors all become outcome kinds rather than
- * thrown errors. The caller decides whether to surface them.
- */
-export declare function tokenListSecrets(opts?: SecretListOptions): Promise<SecretListOutcome>;
-/**
- * Test-only entry point. Accepts an `apiBase` override so tests can
- * point at a mocked GitHub API. Not part of the public SDK surface —
- * do not re-export from the SDK index (#139).
- *
- * @internal
- */
-export declare function __tokenListSecretsForTests(opts: SecretListOptionsInternal): Promise<SecretListOutcome>;
-/**
- * Resolve "owner/repo" from, in order:
- *   1. `GITHUB_REPOSITORY` env var (CI case)
- *   2. `git remote get-url origin`, parsing common GitHub URL shapes:
- *      - `https://github.com/owner/repo(.git)?`
- *      - `git@github.com:owner/repo(.git)?`
- *      - `ssh://git@github.com/owner/repo(.git)?`
- */
-export declare function resolveRepo(env: NodeJS.ProcessEnv, cwd: string): string | null;
-export declare function parseGithubRemote(url: string): string | null;
-export {};
-//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,CAAC;AAEvB,UAAU,UAAU;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,QAAQ,EAAE,KAAK,CAAC;IAChB,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,IAAI,kBAAkB,CAEjE;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAW1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAItD;AA2cD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,KAAK,GAAG,aAAa,GAAG,oBAAoB,CAAC;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC/B;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,gBAAqB,GAAG,YAAY,EAAE,CAqBrE;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAQhE;AAED,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;;;;GAMG;AACH,UAAU,yBAA0B,SAAQ,iBAAiB;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,EAAE,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC;AAIvE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAI/F;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAwID;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB9E;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW5D"}