putitoutthere 0.1.44 → 0.1.46

package/dist/doctor.js

@@ -1,292 +0,0 @@
-/**
- * `putitoutthere doctor` — pre-flight validator.
- *
- * Validates: config parses; every package has a resolvable kind; every
- * package has usable credentials (OIDC or per-kind token). Returns a
- * structured report rather than throwing so the CLI can render it as
- * a table.
- *
- * When `checkArtifacts` is on, also walks the plan and checks each
- * expected artifact directory. Silent-skips when plan can't run (no
- * git state / no commits) so `doctor` stays useful in contexts that
- * don't have a release history yet.
- *
- * Issue #23. Plan: §21.1, §16.4.7. Artifact check: #89.
- */
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { expectedLayout } from './completeness.js';
-import { loadConfig } from './config.js';
-import { checkEnvironment, checkPermissions, checkPublishInvocation, diffEnvironment, diffWorkflowFilename, findPublishWorkflows, inferFromGithubWorkflowRef, } from './oidc-policy.js';
-import { diffCratesTrust, fetchCratesTrustPolicy, } from './registries/crates-trust.js';
-import { plan } from './plan.js';
-import { checkAuth } from './preflight.js';
-import { deepCheck } from './token-scope.js';
-export async function doctor(opts) {
-    const issues = [];
-    let config = null;
-    /* v8 ignore next -- tests always pass an explicit cwd */
-    const cfgPath = opts.configPath ?? `${opts.cwd.replace(/\/+$/, '')}/putitoutthere.toml`;
-    try {
-        config = loadConfig(cfgPath);
-        /* v8 ignore start -- non-Error catch fallback path */
-    }
-    catch (err) {
-        issues.push(`config: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    /* v8 ignore stop */
-    const packages = [];
-    if (config) {
-        const auth = checkAuth(config.packages);
-        for (const pkg of config.packages) {
-            const row = auth.results.find((r) => r.package === pkg.name);
-            /* v8 ignore next -- every cascaded package has a row in checkAuth */
-            const via = row?.via ?? 'missing';
-            packages.push({ name: pkg.name, kind: pkg.kind, auth: via });
-            if (via === 'missing') {
-                issues.push(`auth: ${pkg.name} (${pkg.kind}) needs ${row?.acceptedEnvVars.join(' or ') ?? '<env-var>'} or OIDC`);
-            }
-        }
-        if (opts.deep) {
-            const scopable = config.packages.filter((p) => {
-                const r = auth.results.find((x) => x.package === p.name);
-                return r !== undefined && r.via === 'token';
-            });
-            const envVarForPackage = new Map();
-            for (const p of scopable) {
-                const r = auth.results.find((x) => x.package === p.name);
-                /* v8 ignore next -- filter above guarantees a row */
-                if (r !== undefined)
-                    envVarForPackage.set(p.name, r.envVar);
-            }
-            const rows = await deepCheck({
-                packages: scopable,
-                envVarForPackage,
-                ...(opts.inspectFn !== undefined ? { inspect: opts.inspectFn } : {}),
-            });
-            for (const row of rows) {
-                const pkgEntry = packages.find((p) => p.name === row.package);
-                /* v8 ignore next -- deepCheck rows always correspond to a scoped package */
-                if (pkgEntry === undefined)
-                    continue;
-                pkgEntry.scope = row.scope;
-                pkgEntry.scope_match = row.match;
-                if (row.match === 'mismatch' || row.match === 'error') {
-                    issues.push(`scope: ${row.package} (${row.kind}) — ${row.detail ?? 'token scope does not match config'}`);
-                }
-            }
-        }
-    }
-    const artifacts = opts.checkArtifacts && config
-        ? await checkArtifacts(opts, cfgPath, issues)
-        : undefined;
-    const workflows = findPublishWorkflows(opts.cwd);
-    const trustPolicy = checkTrustPolicyLocal(workflows, issues);
-    const trustPolicyDeclared = config
-        ? checkTrustPolicyDeclared(config.packages, workflows, issues)
-        : undefined;
-    const trustPolicyCratesIo = config
-        ? await checkTrustPolicyCratesIo(config.packages, issues, opts.cratesIoFetch)
-        : undefined;
-    return {
-        ok: issues.length === 0,
-        issues,
-        packages,
-        ...(artifacts !== undefined ? { artifacts } : {}),
-        ...(trustPolicy !== undefined ? { trustPolicy } : {}),
-        ...(trustPolicyDeclared !== undefined ? { trustPolicyDeclared } : {}),
-        ...(trustPolicyCratesIo !== undefined ? { trustPolicyCratesIo } : {}),
-    };
-}
-/**
- * Trust-policy (local) phase. Additive; runs after auth-availability.
- * Deferred to a follow-up: filename-vs-registry diff and environment-
- * name-vs-registry diff (Option C of #162).
- */
-function checkTrustPolicyLocal(workflows, issues) {
-    if (workflows.length === 0)
-        return undefined;
-    const report = { workflows: [] };
-    for (const wf of workflows) {
-        const wfIssues = [];
-        const invocation = checkPublishInvocation(wf);
-        if (invocation !== null) {
-            wfIssues.push(`trust-policy: ${wf.filename}: no clearly-identifiable publish step (commented out?)`);
-        }
-        const perms = checkPermissions(wf);
-        for (const p of perms) {
-            wfIssues.push(`trust-policy: ${wf.filename}: job \`${p.job}\` is missing \`${p.permission}\` permission — add it to the job or to workflow-level \`permissions:\``);
-        }
-        const env = checkEnvironment(wf);
-        if (env !== null) {
-            wfIssues.push(`trust-policy: ${wf.filename}: job \`${env.job}\` has no \`environment:\` key — many trust policies pin an environment; add one (e.g. \`environment: release\`) matching the registry registration`);
-        }
-        for (const line of wfIssues)
-            issues.push(line);
-        report.workflows.push({
-            filename: wf.filename,
-            permissions_ok: perms.length === 0,
-            environment_ok: env === null,
-            invocation_ok: invocation === null,
-            issues: wfIssues,
-        });
-    }
-    return report;
-}
-/**
- * Exported for CLI rendering: the explicit "what's NOT checked" line
- * we surface below the trust-policy phase so a green doctor output
- * doesn't imply the filename landmine is caught.
- */
-export const TRUST_POLICY_SCOPE_NOTE = 'note: declare `[package.trust_policy]` to have `doctor` diff workflow + environment against the config. Registry cross-check is crates.io-only (set `CRATES_IO_DOCTOR_TOKEN`); PyPI and npm are declaration-only.';
-/**
- * Declared-diff phase (#189). For each package with a `[package.trust_policy]`
- * block, diffs the declaration against:
- *  - the local workflow file that `findPublishWorkflows` identified
- *  - `GITHUB_WORKFLOW_REF` when running inside Actions
- * Returns `undefined` when no package has a declaration.
- */
-function checkTrustPolicyDeclared(packages, workflows, issues) {
-    const declared = packages.filter((p) => p.trust_policy !== undefined);
-    if (declared.length === 0)
-        return undefined;
-    const report = { packages: [] };
-    const localWorkflow = workflows[0]?.filename;
-    const inferred = inferFromGithubWorkflowRef();
-    for (const pkg of declared) {
-        const policy = pkg.trust_policy;
-        /* v8 ignore next -- filter guarantees trust_policy is set */
-        if (policy === undefined)
-            continue;
-        const pkgIssues = [];
-        let workflowOk = true;
-        let environmentOk = true;
-        let refOk = true;
-        if (localWorkflow !== undefined) {
-            const mismatch = diffWorkflowFilename(policy.workflow, localWorkflow);
-            if (mismatch !== null) {
-                workflowOk = false;
-                pkgIssues.push(renderWorkflowMismatch(pkg.name, mismatch));
-            }
-        }
-        if (policy.environment !== undefined) {
-            for (const wf of workflows) {
-                const envMismatch = diffEnvironment(policy.environment, wf);
-                if (envMismatch !== null) {
-                    environmentOk = false;
-                    pkgIssues.push(renderEnvironmentMismatch(pkg.name, envMismatch));
-                    break;
-                }
-            }
-        }
-        if (inferred !== null && inferred.workflow !== policy.workflow) {
-            refOk = false;
-            pkgIssues.push(`trust-policy: ${pkg.name}: GITHUB_WORKFLOW_REF says the running workflow is ${inferred.workflow}, but [package.trust_policy].workflow is ${policy.workflow}`);
-        }
-        for (const line of pkgIssues)
-            issues.push(line);
-        report.packages.push({
-            name: pkg.name,
-            workflow_ok: workflowOk,
-            environment_ok: environmentOk,
-            ref_ok: refOk,
-            issues: pkgIssues,
-        });
-    }
-    return report;
-}
-function renderWorkflowMismatch(pkgName, m) {
-    return `trust-policy: ${pkgName}: declared workflow ${m.declared} does not match local workflow ${m.actual} — update [package.trust_policy].workflow or rename the workflow file back`;
-}
-function renderEnvironmentMismatch(pkgName, m) {
-    const actual = m.actual ?? '(none)';
-    return `trust-policy: ${pkgName}: declared environment ${m.declared} does not match workflow ${m.workflow}'s environment ${actual}`;
-}
-/**
- * Opt-in crates.io cross-check (#189). Silent-skip when
- * `CRATES_IO_DOCTOR_TOKEN` is unset. For each `kind = "crates"` package
- * with a declared `trust_policy`, fetches the registered configs and
- * diffs against the declaration. Transient failures are neutral-skipped
- * so a bad crates.io minute doesn't turn doctor red; 401 fails.
- */
-async function checkTrustPolicyCratesIo(packages, issues, fetchFn = fetchCratesTrustPolicy) {
-    const crates = packages.filter((p) => p.kind === 'crates' && p.trust_policy !== undefined);
-    if (crates.length === 0)
-        return undefined;
-    const token = process.env.CRATES_IO_DOCTOR_TOKEN;
-    if (token === undefined || token.length === 0) {
-        return {
-            status: 'skipped',
-            reason: 'set CRATES_IO_DOCTOR_TOKEN to enable crates.io trust-policy cross-check',
-            crates: [],
-        };
-    }
-    const report = { status: 'ran', crates: [] };
-    for (const pkg of crates) {
-        const crateName = pkg.name;
-        const result = await fetchFn(crateName, token);
-        if (result.kind === 'skip-transient') {
-            report.crates.push({ name: crateName, status: 'skip-transient', reason: result.reason });
-            continue;
-        }
-        if (result.kind === 'auth-failed') {
-            report.crates.push({ name: crateName, status: 'auth-failed', reason: result.reason });
-            issues.push(`trust-policy: ${crateName}: ${result.reason}`);
-            continue;
-        }
-        const policy = pkg.trust_policy;
-        const mismatches = diffCratesTrust(crateName, {
-            workflow: policy.workflow,
-            ...(policy.environment !== undefined ? { environment: policy.environment } : {}),
-            ...(policy.repository !== undefined ? { repository: policy.repository } : {}),
-        }, result.configs);
-        if (mismatches.length === 0) {
-            report.crates.push({ name: crateName, status: 'ok' });
-        }
-        else {
-            report.crates.push({ name: crateName, status: 'mismatch', mismatches });
-            for (const m of mismatches) {
-                issues.push(`trust-policy: ${crateName}: crates.io has ${m.field} = ${m.registered ?? '(none)'}, config declares ${m.declared}`);
-            }
-        }
-    }
-    return report;
-}
-async function checkArtifacts(opts, cfgPath, issues) {
-    let matrix;
-    try {
-        matrix = (await plan({ cwd: opts.cwd, configPath: cfgPath }));
-    }
-    catch (err) {
-        // Plan needs a git repo with at least one commit. In a scratch
-        // checkout (no git state yet) we can't walk the plan at all, so
-        // we note it as a soft issue and move on.
-        /* v8 ignore next -- non-Error catch fallback path */
-        const message = err instanceof Error ? err.message : String(err);
-        issues.push(`artifacts: cannot walk plan (${message})`);
-        return [];
-    }
-    const root = join(opts.cwd, 'artifacts');
-    const rows = [];
-    for (const row of matrix) {
-        // Vanilla npm publishes from the source tree; there's no separate
-        // artifact dir to check. Mirrors completeness.ts's carve-out.
-        if (row.kind === 'npm' && row.target === 'noarch')
-            continue;
-        const dir = join(root, row.artifact_name);
-        const present = existsSync(dir);
-        const expected = expectedLayout(row);
-        rows.push({
-            package: row.name,
-            target: row.target,
-            artifact_name: row.artifact_name,
-            present,
-            expected,
-        });
-        if (!present) {
-            issues.push(`artifacts: ${row.name} (${row.target}) missing; expected ${expected}`);
-        }
-    }
-    return rows;
-}
-//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAI3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,sBAAsB,GAEvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAqC,MAAM,kBAAkB,CAAC;AA6FhF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAmB;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAmC,IAAI,CAAC;IAElD,yDAAyD;IACzD,MAAM,OAAO,GACX,IAAI,CAAC,UAAU,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;IAE1E,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,sDAAsD;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,oBAAoB;IAEpB,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAE9C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,qEAAqE;YACrE,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,SAAS,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CACT,SAAS,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,WAAW,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,WAAW,UAAU,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzD,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzD,qDAAqD;gBACrD,IAAI,CAAC,KAAK,SAAS;oBAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB;gBAChB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9D,4EAA4E;gBAC5E,IAAI,QAAQ,KAAK,SAAS;oBAAE,SAAS;gBACrC,QAAQ,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;gBAC3B,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC;gBACjC,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;oBACtD,MAAM,CAAC,IAAI,CACT,UAAU,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,IAAI,mCAAmC,EAAE,CAC7F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM;QAC7C,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,MAAM;QAChC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,mBAAmB,GAAG,MAAM;QAChC,CAAC,CAAC,MAAM,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC;QAC7E,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,SAAkC,EAClC,MAAgB;IAEhB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,MAAM,GAAsB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,UAAU,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,iBAAiB,EAAE,CAAC,QAAQ,yDAAyD,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CACX,iBAAiB,EAAE,CAAC,QAAQ,WAAW,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,UAAU,yEAAyE,CACrJ,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CACX,iBAAiB,EAAE,CAAC,QAAQ,WAAW,GAAG,CAAC,GAAG,qJAAqJ,CACpM,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YACpB,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,cAAc,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC;YAClC,cAAc,EAAE,GAAG,KAAK,IAAI;YAC5B,aAAa,EAAE,UAAU,KAAK,IAAI;YAClC,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,mNAAmN,CAAC;AAEtN;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,QAA4B,EAC5B,SAAkC,EAClC,MAAgB;IAEhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,MAAM,GAA8B,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IAC7C,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAChC,6DAA6D;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACtE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,UAAU,GAAG,KAAK,CAAC;gBACnB,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAC5D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACzB,aAAa,GAAG,KAAK,CAAC;oBACtB,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;oBACjE,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/D,KAAK,GAAG,KAAK,CAAC;YACd,SAAS,CAAC,IAAI,CACZ,iBAAiB,GAAG,CAAC,IAAI,sDAAsD,QAAQ,CAAC,QAAQ,4CAA4C,MAAM,CAAC,QAAQ,EAAE,CAC9J,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,aAAa;YAC7B,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe,EAAE,CAA2B;IAC1E,OAAO,iBAAiB,OAAO,uBAAuB,CAAC,CAAC,QAAQ,kCAAkC,CAAC,CAAC,MAAM,4EAA4E,CAAC;AACzL,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe,EAAE,CAAsB;IACxE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC;IACpC,OAAO,iBAAiB,OAAO,0BAA0B,CAAC,CAAC,QAAQ,4BAA4B,CAAC,CAAC,QAAQ,kBAAkB,MAAM,EAAE,CAAC;AACtI,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB,CACrC,QAA4B,EAC5B,MAAgB,EAChB,UAAyC,sBAAsB;IAE/D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAyF,EAAE,CAC3F,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CACtD,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,yEAAyE;YACjF,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA8B,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC,iBAAiB,SAAS,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAChC,MAAM,UAAU,GAAG,eAAe,CAChC,SAAS,EACT;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,EACD,MAAM,CAAC,OAAO,CACf,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CACT,iBAAiB,SAAS,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,UAAU,IAAI,QAAQ,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CACpH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAKD,KAAK,UAAU,cAAc,CAC3B,IAAmB,EACnB,OAAe,EACf,MAAgB;IAEhB,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAgB,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,gEAAgE;QAChE,0CAA0C;QAC1C,qDAAqD;QACrD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,gCAAgC,OAAO,GAAG,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,IAAI,GAA2C,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,kEAAkE;QAClE,8DAA8D;QAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC;YACR,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,OAAO;YACP,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,uBAAuB,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/keyring.d.ts

@@ -1,35 +0,0 @@
-/**
- * Keyring — persistent storage for the user access token obtained
- * through `auth login`.
- *
- * Ships with a file-backed implementation (chmod 0600 in an XDG-
- * compliant config dir). The `Keyring` interface is the seam for
- * swapping in an OS keychain binding (e.g. `keytar`) later; see #105.
- *
- * Token values are never logged. Callers pass the whole `StoredAuth`
- * in and out; this module does not expose a "read just the access
- * token" affordance that could encourage stringification.
- */
-export interface StoredAuth {
-    /** GitHub login of the account that approved the Device Flow. */
-    account: string;
-    access_token: string;
-    refresh_token: string;
-    /** Epoch seconds. */
-    access_token_expires_at: number;
-    /** Epoch seconds. */
-    refresh_token_expires_at: number;
-}
-export interface Keyring {
-    get(): Promise<StoredAuth | null>;
-    set(auth: StoredAuth): Promise<void>;
-    delete(): Promise<void>;
-}
-export interface FileKeyringOptions {
-    /** Override the resolved config dir. Tests inject a tmp path. */
-    dir?: string;
-}
-export declare function fileKeyring(opts?: FileKeyringOptions): Keyring;
-/** Returned for production callers. */
-export declare function defaultKeyring(): Keyring;
-//# sourceMappingURL=keyring.d.ts.map

package/dist/keyring.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../src/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB;IACrB,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,WAAW,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CA4BlE;AAED,uCAAuC;AACvC,wBAAgB,cAAc,IAAI,OAAO,CAExC"}

package/dist/keyring.js

@@ -1,88 +0,0 @@
-/**
- * Keyring — persistent storage for the user access token obtained
- * through `auth login`.
- *
- * Ships with a file-backed implementation (chmod 0600 in an XDG-
- * compliant config dir). The `Keyring` interface is the seam for
- * swapping in an OS keychain binding (e.g. `keytar`) later; see #105.
- *
- * Token values are never logged. Callers pass the whole `StoredAuth`
- * in and out; this module does not expose a "read just the access
- * token" affordance that could encourage stringification.
- */
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-export function fileKeyring(opts = {}) {
-    const dir = opts.dir ?? defaultConfigDir();
-    const path = join(dir, 'auth.json');
-    return {
-        get() {
-            if (!existsSync(path))
-                return Promise.resolve(null);
-            const raw = readFileSync(path, 'utf8');
-            return Promise.resolve(tryParse(raw));
-        },
-        set(auth) {
-            if (!existsSync(dir)) {
-                mkdirSync(dir, { recursive: true, mode: 0o700 });
-            }
-            else {
-                // Best-effort tighten; harmless if we don't own the dir.
-                /* v8 ignore next -- catch only fires when another process owns the dir; not reachable in unit tests. */
-                try {
-                    chmodSync(dir, 0o700);
-                }
-                catch { /* ignore */ }
-            }
-            writeFileSync(path, JSON.stringify(auth, null, 2) + '\n', { mode: 0o600 });
-            // writeFileSync honors `mode` only on create. Re-chmod to catch
-            // the overwrite-an-existing-file case where the old mode sticks.
-            chmodSync(path, 0o600);
-            return Promise.resolve();
-        },
-        delete() {
-            if (existsSync(path))
-                rmSync(path);
-            return Promise.resolve();
-        },
-    };
-}
-/** Returned for production callers. */
-export function defaultKeyring() {
-    return fileKeyring();
-}
-/* v8 ignore next 5 -- resolves the user's config dir; tests inject `dir` directly so this branch is only taken in production. */
-function defaultConfigDir() {
-    const xdg = process.env.XDG_CONFIG_HOME;
-    if (xdg && xdg.length > 0)
-        return join(xdg, 'putitoutthere');
-    return join(homedir(), '.config', 'putitoutthere');
-}
-function tryParse(raw) {
-    let v;
-    try {
-        v = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    if (!v || typeof v !== 'object')
-        return null;
-    const o = v;
-    if (typeof o.account !== 'string' ||
-        typeof o.access_token !== 'string' ||
-        typeof o.refresh_token !== 'string' ||
-        typeof o.access_token_expires_at !== 'number' ||
-        typeof o.refresh_token_expires_at !== 'number') {
-        return null;
-    }
-    return {
-        account: o.account,
-        access_token: o.access_token,
-        refresh_token: o.refresh_token,
-        access_token_expires_at: o.access_token_expires_at,
-        refresh_token_expires_at: o.refresh_token_expires_at,
-    };
-}
-//# sourceMappingURL=keyring.js.map

package/dist/keyring.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../src/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAwBjC,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpC,OAAO;QACL,GAAG;YACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,CAAC,IAAgB;YAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,yDAAyD;gBACzD,wGAAwG;gBACxG,IAAI,CAAC;oBAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;YACD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,gEAAgE;YAChE,iEAAiE;YACjE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM;YACJ,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,iIAAiI;AACjI,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IACE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,uBAAuB,KAAK,QAAQ;QAC7C,OAAO,CAAC,CAAC,wBAAwB,KAAK,QAAQ,EAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,uBAAuB,EAAE,CAAC,CAAC,uBAAuB;QAClD,wBAAwB,EAAE,CAAC,CAAC,wBAAwB;KACrD,CAAC;AACJ,CAAC"}

package/dist/oidc-policy.d.ts

@@ -1,145 +0,0 @@
-/**
- * OIDC trust-policy local validation.
- *
- * `doctor` uses this module to check the locally-knowable structural
- * prerequisites of OIDC trusted publishing:
- *
- *   1. At least one `.github/workflows/*.yml` file invokes either
- *      `putitoutthere publish` (as a `run:` command) or the composite
- *      action `thekevinscott/putitoutthere@...` with a `command:`
- *      input that implies publishing.
- *   2. That workflow's publishing job has `permissions: id-token: write`
- *      and `contents: write` (either job-level or workflow-level).
- *   3. The publishing job has an `environment:` key set. We cannot
- *      validate the *value* against the registry's trust policy — that
- *      requires a registry-policy-read API per registry, which is
- *      deferred (Option C, see follow-up to #162).
- *   4. A clearly-identifiable publish step exists — defends against
- *      edge cases like commented-out steps slipping past (1).
- *
- * The parser is intentionally regex/line-based rather than a full YAML
- * parse: the four checks above all reduce to substring/indentation
- * matches within a single jobs block. Adding a YAML dependency would
- * buy us very little here. If the check set grows beyond this (e.g.
- * "validate the environment value against a registry's trust policy"),
- * revisit.
- *
- * Issue #162 — Option D (locally-knowable checks only).
- */
-export interface WorkflowFile {
-    /** Absolute path to the workflow file on disk. */
-    path: string;
-    /** Basename, e.g. `release.yml`. */
-    filename: string;
-    /** Full file contents. */
-    source: string;
-    /** Parsed jobs (best-effort; top-level job keys + their raw bodies). */
-    jobs: WorkflowJob[];
-    /** Workflow-level `permissions:` block contents (empty if none). */
-    workflowPermissions: string;
-}
-export interface WorkflowJob {
-    /** Job key, e.g. `publish`. */
-    name: string;
-    /** Raw source of just that job block (everything indented under it). */
-    source: string;
-}
-export interface PermissionIssue {
-    kind: 'missing-permission';
-    workflow: string;
-    job: string;
-    permission: 'id-token: write' | 'contents: write';
-}
-export interface EnvironmentIssue {
-    kind: 'missing-environment';
-    workflow: string;
-    job: string;
-}
-export interface InvocationIssue {
-    kind: 'no-publish-step';
-    workflow: string;
-}
-/** Issue: declared `trust_policy.workflow` does not match the workflow we found. */
-export interface WorkflowFilenameMismatch {
-    kind: 'workflow-filename-mismatch';
-    declared: string;
-    actual: string;
-    /** Where `actual` came from — used to refine the error message. */
-    source: 'local-workflow' | 'github-workflow-ref';
-}
-/** Issue: declared `trust_policy.environment` does not match the workflow. */
-export interface EnvironmentMismatch {
-    kind: 'environment-mismatch';
-    workflow: string;
-    declared: string;
-    actual: string | null;
-}
-/**
- * Scan `.github/workflows/*.yml` and `*.yaml` for workflows that invoke
- * `putitoutthere publish` or the composite action in a publish mode.
- *
- * Permissive by design: if a workflow *mentions* piot in any way that
- * looks like publishing, include it. Downstream checks then report
- * specifically. The cost of a false-positive is a spurious pass/fail
- * line in `doctor`; the cost of a false-negative is silently missing
- * the user's real publish workflow.
- */
-export declare function findPublishWorkflows(repoRoot: string): WorkflowFile[];
-/**
- * Best-effort jobs parser. Finds the top-level `jobs:` block and
- * extracts each direct-child key + its body. We use the two-space
- * indent convention GitHub Actions workflows follow. Workflows that
- * deviate (tabs, four-space) would miss — but `init` emits two-space,
- * which is what we're validating.
- */
-export declare function parseJobs(source: string): WorkflowJob[];
-/**
- * Check that the publishing job has (or inherits) the two permissions
- * that OIDC trusted publishing requires. The permissions may be set at
- * workflow level (top-level `permissions:`) and/or job level; this
- * function reports a missing permission only if *neither* scope
- * declares it. `write-all` satisfies both.
- */
-export declare function checkPermissions(workflow: WorkflowFile): PermissionIssue[];
-/**
- * Return `{ kind: 'missing' }` when the publish job lacks an
- * `environment:` key. Does NOT inspect the value — diff-vs-registry is
- * Option C.
- */
-export declare function checkEnvironment(workflow: WorkflowFile): EnvironmentIssue | null;
-/**
- * Sanity check: confirm the workflow has at least one clearly-
- * identifiable publish step. `findPublishWorkflows` already filters,
- * but this catches weird states like a `run:` that's been edited into
- * a comment while the composite-action `uses:` line still matches.
- */
-export declare function checkPublishInvocation(workflow: WorkflowFile): InvocationIssue | null;
-/**
- * Compare `trust_policy.workflow` against the filename of the workflow
- * that `findPublishWorkflows` identified. The declaration is always a
- * bare filename (Zod enforces that at parse time); the comparison is
- * case-sensitive. Returns `null` on match.
- */
-export declare function diffWorkflowFilename(declared: string, workflowFilename: string): WorkflowFilenameMismatch | null;
-/**
- * Compare `trust_policy.environment` against the workflow's job-level
- * `environment:` value. Absence of a declared environment is not an
- * error — the caller decides whether to invoke this. Returns `null` on
- * match.
- */
-export declare function diffEnvironment(declared: string, workflow: WorkflowFile): EnvironmentMismatch | null;
-/**
- * Read `process.env.GITHUB_WORKFLOW_REF` (populated by GitHub Actions)
- * and parse out the workflow filename. Shape:
- *
- *   `owner/repo/.github/workflows/release.yml@refs/heads/main`
- *
- * Returns `null` when the env var is absent (we're not running inside
- * Actions) OR when the value doesn't parse — we'd rather neutral-skip
- * the check than false-positive on an unexpected shape.
- */
-export declare function inferFromGithubWorkflowRef(env?: NodeJS.ProcessEnv): {
-    workflow: string;
-    repository: string;
-} | null;
-//# sourceMappingURL=oidc-policy.d.ts.map

package/dist/oidc-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-policy.d.ts","sourceRoot":"","sources":["../src/oidc-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;CACnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,4BAA4B,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,gBAAgB,GAAG,qBAAqB,CAAC;CAClD;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CA8BrE;AAsBD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CA6BvD;AA0BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,EAAE,CAyB1E;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,gBAAgB,GAAG,IAAI,CAShF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,IAAI,CAiBrF;AAeD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,wBAAwB,GAAG,IAAI,CASjC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,YAAY,GACrB,mBAAmB,GAAG,IAAI,CAS5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUjD"}