putitoutthere 0.1.44 → 0.1.46

package/dist/oidc-policy.js

@@ -1,388 +0,0 @@
-/**
- * OIDC trust-policy local validation.
- *
- * `doctor` uses this module to check the locally-knowable structural
- * prerequisites of OIDC trusted publishing:
- *
- *   1. At least one `.github/workflows/*.yml` file invokes either
- *      `putitoutthere publish` (as a `run:` command) or the composite
- *      action `thekevinscott/putitoutthere@...` with a `command:`
- *      input that implies publishing.
- *   2. That workflow's publishing job has `permissions: id-token: write`
- *      and `contents: write` (either job-level or workflow-level).
- *   3. The publishing job has an `environment:` key set. We cannot
- *      validate the *value* against the registry's trust policy — that
- *      requires a registry-policy-read API per registry, which is
- *      deferred (Option C, see follow-up to #162).
- *   4. A clearly-identifiable publish step exists — defends against
- *      edge cases like commented-out steps slipping past (1).
- *
- * The parser is intentionally regex/line-based rather than a full YAML
- * parse: the four checks above all reduce to substring/indentation
- * matches within a single jobs block. Adding a YAML dependency would
- * buy us very little here. If the check set grows beyond this (e.g.
- * "validate the environment value against a registry's trust policy"),
- * revisit.
- *
- * Issue #162 — Option D (locally-knowable checks only).
- */
-import { readdirSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-/**
- * Scan `.github/workflows/*.yml` and `*.yaml` for workflows that invoke
- * `putitoutthere publish` or the composite action in a publish mode.
- *
- * Permissive by design: if a workflow *mentions* piot in any way that
- * looks like publishing, include it. Downstream checks then report
- * specifically. The cost of a false-positive is a spurious pass/fail
- * line in `doctor`; the cost of a false-negative is silently missing
- * the user's real publish workflow.
- */
-export function findPublishWorkflows(repoRoot) {
-    const dir = join(repoRoot, '.github', 'workflows');
-    let entries;
-    try {
-        entries = readdirSync(dir);
-    }
-    catch {
-        return [];
-    }
-    const workflows = [];
-    for (const entry of entries) {
-        if (!/\.ya?ml$/i.test(entry))
-            continue;
-        const path = join(dir, entry);
-        let source;
-        try {
-            source = readFileSync(path, 'utf8');
-            /* v8 ignore next 3 -- defensive fallback for an unreadable workflow file (permissions, TOCTOU); can't produce in tests without mocking the fs module. */
-        }
-        catch {
-            continue;
-        }
-        if (!looksLikePublishWorkflow(source))
-            continue;
-        workflows.push({
-            path,
-            filename: entry,
-            source,
-            jobs: parseJobs(source),
-            workflowPermissions: extractTopLevelBlock(source, 'permissions') ?? '',
-        });
-    }
-    return workflows;
-}
-/**
- * Heuristic filter. Matches:
- *   - a `run:` step that contains `putitoutthere publish`
- *   - `uses: thekevinscott/putitoutthere@...` combined with
- *     `command: publish` somewhere in the file (the composite action
- *     defaults to `plan`, so we only flag explicit `publish`)
- *
- * Also accepts the pre-rename slug `put-it-out-there` so workflows
- * pinned to the old name (still routed via GitHub's redirect) continue
- * to be recognised by `doctor`.
- */
-const USES_PIOT_RE = /uses:\s*thekevinscott\/(?:putitoutthere|put-it-out-there)@/;
-function looksLikePublishWorkflow(source) {
-    if (/\bputitoutthere\s+publish\b/.test(source))
-        return true;
-    const usesPiot = USES_PIOT_RE.test(source);
-    const commandPublish = /command:\s*['"]?publish['"]?/.test(source);
-    return usesPiot && commandPublish;
-}
-/**
- * Best-effort jobs parser. Finds the top-level `jobs:` block and
- * extracts each direct-child key + its body. We use the two-space
- * indent convention GitHub Actions workflows follow. Workflows that
- * deviate (tabs, four-space) would miss — but `init` emits two-space,
- * which is what we're validating.
- */
-export function parseJobs(source) {
-    const lines = source.split('\n');
-    // Find the `jobs:` top-level key (unindented).
-    let jobsStart = -1;
-    for (let i = 0; i < lines.length; i++) {
-        if (/^jobs\s*:\s*$/.test(lines[i])) {
-            jobsStart = i + 1;
-            break;
-        }
-    }
-    if (jobsStart === -1)
-        return [];
-    const jobs = [];
-    let current = null;
-    for (let i = jobsStart; i < lines.length; i++) {
-        const line = lines[i];
-        // Another top-level key ends the jobs block.
-        if (/^\S/.test(line) && line.trim().length > 0)
-            break;
-        // A direct child job key: exactly 2-space indent + `name:`.
-        const match = /^ {2}([A-Za-z_][\w-]*)\s*:\s*$/.exec(line);
-        if (match) {
-            if (current)
-                jobs.push({ name: current.name, source: current.lines.join('\n') });
-            current = { name: match[1], lines: [] };
-            continue;
-        }
-        if (current)
-            current.lines.push(line);
-    }
-    if (current)
-        jobs.push({ name: current.name, source: current.lines.join('\n') });
-    return jobs;
-}
-/**
- * Extract a top-level block's body (everything indented beneath a
- * given unindented key up to the next top-level key). Returns the
- * concatenated indented body, or `null` if the key is absent.
- */
-function extractTopLevelBlock(source, key) {
-    const lines = source.split('\n');
-    const re = new RegExp(`^${key}\\s*:\\s*(.*)$`);
-    for (let i = 0; i < lines.length; i++) {
-        const m = re.exec(lines[i]);
-        if (!m)
-            continue;
-        // Inline form: `permissions: read-all`. Return the inline value.
-        if (m[1] && m[1].trim().length > 0)
-            return m[1].trim();
-        const body = [];
-        for (let j = i + 1; j < lines.length; j++) {
-            const line = lines[j];
-            if (/^\S/.test(line) && line.trim().length > 0)
-                break;
-            body.push(line);
-        }
-        return body.join('\n');
-    }
-    return null;
-}
-/**
- * Check that the publishing job has (or inherits) the two permissions
- * that OIDC trusted publishing requires. The permissions may be set at
- * workflow level (top-level `permissions:`) and/or job level; this
- * function reports a missing permission only if *neither* scope
- * declares it. `write-all` satisfies both.
- */
-export function checkPermissions(workflow) {
-    const publishJob = findPublishJob(workflow);
-    if (publishJob === null)
-        return [];
-    const jobPerms = extractBlockFromJob(publishJob.source, 'permissions') ?? '';
-    const combined = `${workflow.workflowPermissions}\n${jobPerms}`;
-    const issues = [];
-    if (!hasPermission(combined, 'id-token', 'write')) {
-        issues.push({
-            kind: 'missing-permission',
-            workflow: workflow.filename,
-            job: publishJob.name,
-            permission: 'id-token: write',
-        });
-    }
-    if (!hasPermission(combined, 'contents', 'write')) {
-        issues.push({
-            kind: 'missing-permission',
-            workflow: workflow.filename,
-            job: publishJob.name,
-            permission: 'contents: write',
-        });
-    }
-    return issues;
-}
-function hasPermission(block, name, level) {
-    // `write-all` shortcut: every scope is `write`.
-    if (/\bwrite-all\b/.test(block))
-        return true;
-    const re = new RegExp(`\\b${name}\\s*:\\s*${level}\\b`);
-    return re.test(block);
-}
-/**
- * Return `{ kind: 'missing' }` when the publish job lacks an
- * `environment:` key. Does NOT inspect the value — diff-vs-registry is
- * Option C.
- */
-export function checkEnvironment(workflow) {
-    const publishJob = findPublishJob(workflow);
-    if (publishJob === null)
-        return null;
-    if (hasKeyAtJobLevel(publishJob.source, 'environment'))
-        return null;
-    return {
-        kind: 'missing-environment',
-        workflow: workflow.filename,
-        job: publishJob.name,
-    };
-}
-/**
- * Sanity check: confirm the workflow has at least one clearly-
- * identifiable publish step. `findPublishWorkflows` already filters,
- * but this catches weird states like a `run:` that's been edited into
- * a comment while the composite-action `uses:` line still matches.
- */
-export function checkPublishInvocation(workflow) {
-    // Strip comment-only lines and blank lines before matching. A
-    // commented-out `run: putitoutthere publish` step shouldn't count.
-    const uncommented = workflow.source
-        .split('\n')
-        .filter((l) => !/^\s*#/.test(l))
-        .join('\n');
-    const hasRunCmd = /\bputitoutthere\s+publish\b/.test(uncommented);
-    if (hasRunCmd)
-        return null;
-    // Composite-action form with `command: publish` explicitly.
-    const usesPiot = USES_PIOT_RE.test(uncommented);
-    const commandPublish = /command:\s*['"]?publish['"]?/.test(uncommented);
-    if (usesPiot && commandPublish)
-        return null;
-    return { kind: 'no-publish-step', workflow: workflow.filename };
-}
-/* ---------------------- #189: declared diff ---------------------- */
-/**
- * Extract the basename (no directory) from a bare or path-shaped string.
- * Normalizes both slash styles so a caller feeding in a
- * `.github/workflows/release.yml` still gets `release.yml` back.
- */
-function basename(p) {
-    const normalized = p.replace(/\\/g, '/');
-    const idx = normalized.lastIndexOf('/');
-    return idx === -1 ? normalized : normalized.slice(idx + 1);
-}
-/**
- * Compare `trust_policy.workflow` against the filename of the workflow
- * that `findPublishWorkflows` identified. The declaration is always a
- * bare filename (Zod enforces that at parse time); the comparison is
- * case-sensitive. Returns `null` on match.
- */
-export function diffWorkflowFilename(declared, workflowFilename) {
-    const actual = basename(workflowFilename);
-    if (declared === actual)
-        return null;
-    return {
-        kind: 'workflow-filename-mismatch',
-        declared,
-        actual,
-        source: 'local-workflow',
-    };
-}
-/**
- * Compare `trust_policy.environment` against the workflow's job-level
- * `environment:` value. Absence of a declared environment is not an
- * error — the caller decides whether to invoke this. Returns `null` on
- * match.
- */
-export function diffEnvironment(declared, workflow) {
-    const actual = extractJobEnvironment(workflow);
-    if (actual === declared)
-        return null;
-    return {
-        kind: 'environment-mismatch',
-        workflow: workflow.filename,
-        declared,
-        actual,
-    };
-}
-/**
- * Read `process.env.GITHUB_WORKFLOW_REF` (populated by GitHub Actions)
- * and parse out the workflow filename. Shape:
- *
- *   `owner/repo/.github/workflows/release.yml@refs/heads/main`
- *
- * Returns `null` when the env var is absent (we're not running inside
- * Actions) OR when the value doesn't parse — we'd rather neutral-skip
- * the check than false-positive on an unexpected shape.
- */
-export function inferFromGithubWorkflowRef(env = process.env) {
-    const ref = env.GITHUB_WORKFLOW_REF;
-    if (ref === undefined || ref.length === 0)
-        return null;
-    // Strip the `@ref` suffix, then match
-    // `<owner>/<repo>/.github/workflows/<file>`.
-    const atIdx = ref.indexOf('@');
-    const pathPart = atIdx === -1 ? ref : ref.slice(0, atIdx);
-    const m = /^([^/\s]+\/[^/\s]+)\/\.github\/workflows\/(.+)$/.exec(pathPart);
-    if (!m)
-        return null;
-    return { repository: m[1], workflow: m[2] };
-}
-/**
- * Extract the job-level `environment:` value from a workflow's publish
- * job. Supports the inline form (`environment: release`) and the nested
- * form (`environment:\n  name: release`). Returns `null` when no
- * environment is declared (or no publish job is found).
- */
-function extractJobEnvironment(workflow) {
-    const publishJob = findPublishJob(workflow);
-    /* v8 ignore next -- caller only invokes this for workflows that have a publish job */
-    if (publishJob === null)
-        return null;
-    const raw = extractBlockFromJob(publishJob.source, 'environment');
-    if (raw === null)
-        return null;
-    const trimmed = raw.trim();
-    // Inline form: `environment: release`. Nested form: `environment:\n  name: release`.
-    // The inline regex matches when the value is a single line; for nested
-    // blocks, look for the `name:` key inside the body. When neither
-    // matches the block is structurally malformed — null propagates.
-    if (!trimmed.includes('\n')) {
-        const inline = /^['"]?([^'"\n]+?)['"]?$/.exec(trimmed);
-        return inline ? inline[1].trim() : null;
-    }
-    const nested = /^\s*name\s*:\s*['"]?([^'"\n]+?)['"]?\s*$/m.exec(trimmed);
-    return nested ? nested[1].trim() : null;
-}
-/* ---------------------------- helpers ---------------------------- */
-/**
- * Pick the job within a workflow that runs publish. If only one job
- * matches, return it. If multiple match, prefer the one whose name
- * contains `publish`; otherwise return the first.
- */
-function findPublishJob(workflow) {
-    const matches = workflow.jobs.filter((j) => jobRunsPublish(j));
-    if (matches.length === 0)
-        return null;
-    const named = matches.find((j) => /publish/i.test(j.name));
-    return named ?? matches[0];
-}
-function jobRunsPublish(job) {
-    if (/\bputitoutthere\s+publish\b/.test(job.source))
-        return true;
-    const usesPiot = USES_PIOT_RE.test(job.source);
-    const commandPublish = /command:\s*['"]?publish['"]?/.test(job.source);
-    return usesPiot && commandPublish;
-}
-/**
- * Whether the given job's source declares the key at the job scope
- * (exactly 4-space indent, matching the 2-space job indent + one level
- * further). Inline or block form both accepted.
- */
-function hasKeyAtJobLevel(jobSource, key) {
-    const re = new RegExp(`^ {4}${key}\\s*:`, 'm');
-    return re.test(jobSource);
-}
-/**
- * Extract a nested block from inside a job source — `permissions:` or
- * `environment:` below the 4-space indent.
- */
-function extractBlockFromJob(jobSource, key) {
-    const lines = jobSource.split('\n');
-    const headRe = new RegExp(`^ {4}${key}\\s*:\\s*(.*)$`);
-    for (let i = 0; i < lines.length; i++) {
-        const m = headRe.exec(lines[i]);
-        if (!m)
-            continue;
-        if (m[1] && m[1].trim().length > 0)
-            return m[1].trim();
-        const body = [];
-        for (let j = i + 1; j < lines.length; j++) {
-            const line = lines[j];
-            // Any line indented 4 spaces or less (and non-empty) ends the block.
-            if (line.trim().length > 0 && /^ {0,4}\S/.test(line))
-                break;
-            body.push(line);
-        }
-        return body.join('\n');
-    }
-    return null;
-}
-//# sourceMappingURL=oidc-policy.js.map

package/dist/oidc-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-policy.js","sourceRoot":"","sources":["../src/oidc-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyDjC;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,yJAAyJ;QAC3J,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;YAAE,SAAS;QAChD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC;YACvB,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,4DAA4D,CAAC;AAElF,SAAS,wBAAwB,CAAC,MAAc;IAC9C,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,QAAQ,IAAI,cAAc,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,+CAA+C;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACpC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,OAAO,GAA6C,IAAI,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,6CAA6C;QAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QACtD,4DAA4D;QAC5D,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAAc,EAAE,GAAW;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,iEAAiE;QACjE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;YACtD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAsB;IACrD,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,EAAE,UAAU,CAAC,IAAI;YACpB,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,EAAE,UAAU,CAAC,IAAI;YACpB,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,KAAc;IAChE,gDAAgD;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,KAAK,KAAK,CAAC,CAAC;IACxD,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAsB;IACrD,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,EAAE,UAAU,CAAC,IAAI;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAsB;IAC3D,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM;SAChC,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,SAAS,GAAG,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3B,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,8BAA8B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxE,IAAI,QAAQ,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,gBAAwB;IAExB,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,QAAQ;QACR,MAAM;QACN,MAAM,EAAE,gBAAgB;KACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,QAAsB;IAEtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,sCAAsC;IACtC,6CAA6C;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,iDAAiD,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,QAAsB;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,sFAAsF;IACtF,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,qFAAqF;IACrF,uEAAuE;IACvE,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAsB;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,KAAK,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,GAAgB;IACtC,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,QAAQ,IAAI,cAAc,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IACtD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,qEAAqE;YACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM;YAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/preflight-run.d.ts

@@ -1,47 +0,0 @@
-/**
- * `putitoutthere preflight` — run every pre-publish check against every
- * package, without side effects.
- *
- * Lives alongside (not inside) `preflight.ts` because that module is
- * scoped to auth-only checks that handlers delegate to. This one is
- * the cross-cutting orchestrator that `doctor` and `publish` each use
- * pieces of.
- *
- * Issue #93. Plan: §16.4.7.
- *
- * Check catalogue:
- *   - path:       pkg.path exists on disk (resolved against opts.cwd).
- *   - manifest:   the per-kind manifest file exists under pkg.path.
- *   - auth:       OIDC or the per-kind token env var is set.
- *   - repository: package.json has `repository` (npm --provenance requirement).
- *   - artifact:   when the package is in the cascaded plan, its artifact
- *                 dir exists.
- *
- * Default scope is "packages cascaded by the plan". `--all` widens to
- * every configured package (useful pre-commit or when plan can't run
- * in a scratch checkout).
- */
-import type { Kind } from './types.js';
-export interface PreflightOptions {
-    cwd: string;
-    configPath?: string;
-    /** When true, widen scope from cascaded-only to every configured package. */
-    all?: boolean;
-}
-export type CheckStatus = 'ok' | 'fail' | 'skip';
-export type CheckName = 'path' | 'manifest' | 'auth' | 'repository' | 'artifact';
-export interface PreflightCheck {
-    package: string;
-    kind: Kind;
-    check: CheckName;
-    status: CheckStatus;
-    detail?: string;
-}
-export interface PreflightReport {
-    ok: boolean;
-    checks: PreflightCheck[];
-    /** Top-level issues not scoped to a package (e.g. config parse failure). */
-    issues: string[];
-}
-export declare function runPreflight(opts: PreflightOptions): Promise<PreflightReport>;
-//# sourceMappingURL=preflight-run.d.ts.map

package/dist/preflight-run.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"preflight-run.d.ts","sourceRoot":"","sources":["../src/preflight-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AACjD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgEnF"}

package/dist/preflight-run.js

@@ -1,197 +0,0 @@
-/**
- * `putitoutthere preflight` — run every pre-publish check against every
- * package, without side effects.
- *
- * Lives alongside (not inside) `preflight.ts` because that module is
- * scoped to auth-only checks that handlers delegate to. This one is
- * the cross-cutting orchestrator that `doctor` and `publish` each use
- * pieces of.
- *
- * Issue #93. Plan: §16.4.7.
- *
- * Check catalogue:
- *   - path:       pkg.path exists on disk (resolved against opts.cwd).
- *   - manifest:   the per-kind manifest file exists under pkg.path.
- *   - auth:       OIDC or the per-kind token env var is set.
- *   - repository: package.json has `repository` (npm --provenance requirement).
- *   - artifact:   when the package is in the cascaded plan, its artifact
- *                 dir exists.
- *
- * Default scope is "packages cascaded by the plan". `--all` widens to
- * every configured package (useful pre-commit or when plan can't run
- * in a scratch checkout).
- */
-import { existsSync, readFileSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
-import { expectedLayout } from './completeness.js';
-import { loadConfig } from './config.js';
-import { plan } from './plan.js';
-import { checkAuth } from './preflight.js';
-export async function runPreflight(opts) {
-    const issues = [];
-    const checks = [];
-    /* v8 ignore next -- tests always pass an explicit configPath or cwd */
-    const cfgPath = opts.configPath ?? `${opts.cwd.replace(/\/+$/, '')}/putitoutthere.toml`;
-    let config;
-    try {
-        config = loadConfig(cfgPath);
-        /* v8 ignore start -- non-Error catch fallback path */
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        issues.push(`config: ${message}`);
-        return { ok: false, checks, issues };
-    }
-    /* v8 ignore stop */
-    // Anchor pkg.path to opts.cwd so every downstream fs op points at the
-    // right tree (mirror src/publish.ts).
-    for (const p of config.packages) {
-        if (!isAbsolute(p.path))
-            p.path = resolve(opts.cwd, p.path);
-    }
-    let matrix = [];
-    try {
-        matrix = (await plan({ cwd: opts.cwd, configPath: cfgPath }));
-    }
-    catch (err) {
-        /* v8 ignore next -- non-Error catch fallback path */
-        const message = err instanceof Error ? err.message : String(err);
-        issues.push(`plan: cannot compute matrix (${message})`);
-    }
-    const cascaded = new Set(matrix.map((r) => r.name));
-    const scope = opts.all
-        ? config.packages
-        : config.packages.filter((p) => cascaded.has(p.name));
-    const auth = checkAuth(scope);
-    for (const pkg of scope) {
-        checks.push(pathCheck(pkg));
-        checks.push(manifestCheck(pkg));
-        checks.push(authCheckFor(pkg, auth));
-        if (pkg.kind === 'npm') {
-            checks.push(repositoryCheck(pkg));
-        }
-    }
-    // Artifact check runs only against matrix rows — non-cascaded packages
-    // have no rows, and adding a per-row check against them is misleading.
-    const artifactsRoot = join(opts.cwd, 'artifacts');
-    for (const row of matrix) {
-        // Vanilla npm publishes from source; no artifact dir exists.
-        if (row.kind === 'npm' && row.target === 'noarch')
-            continue;
-        // If the cascaded row's package isn't in scope (unusual but possible
-        // with external filters), still report — artifact issues block
-        // publish regardless of `--all`.
-        checks.push(artifactCheck(row, artifactsRoot));
-    }
-    const ok = issues.length === 0 && checks.every((c) => c.status !== 'fail');
-    return { ok, checks, issues };
-}
-/* ----------------------------- internals ----------------------------- */
-function pathCheck(pkg) {
-    if (existsSync(pkg.path)) {
-        return { package: pkg.name, kind: pkg.kind, check: 'path', status: 'ok', detail: pkg.path };
-    }
-    return {
-        package: pkg.name,
-        kind: pkg.kind,
-        check: 'path',
-        status: 'fail',
-        detail: `pkg.path does not exist: ${pkg.path}`,
-    };
-}
-function manifestFor(kind) {
-    switch (kind) {
-        case 'crates': return 'Cargo.toml';
-        case 'pypi': return 'pyproject.toml';
-        case 'npm': return 'package.json';
-    }
-}
-function manifestCheck(pkg) {
-    const manifest = manifestFor(pkg.kind);
-    const full = join(pkg.path, manifest);
-    if (existsSync(full)) {
-        return { package: pkg.name, kind: pkg.kind, check: 'manifest', status: 'ok', detail: manifest };
-    }
-    return {
-        package: pkg.name,
-        kind: pkg.kind,
-        check: 'manifest',
-        status: 'fail',
-        detail: `missing ${manifest} at ${full}`,
-    };
-}
-function authCheckFor(pkg, auth) {
-    const row = auth.results.find((r) => r.package === pkg.name);
-    /* v8 ignore start -- every scoped package gets a row in checkAuth */
-    if (row === undefined) {
-        return { package: pkg.name, kind: pkg.kind, check: 'auth', status: 'skip', detail: 'no auth row' };
-    }
-    /* v8 ignore stop */
-    if (row.via === 'missing') {
-        return {
-            package: pkg.name,
-            kind: pkg.kind,
-            check: 'auth',
-            status: 'fail',
-            detail: `needs ${row.acceptedEnvVars.join(' or ')} or OIDC`,
-        };
-    }
-    return { package: pkg.name, kind: pkg.kind, check: 'auth', status: 'ok', detail: row.via };
-}
-function repositoryCheck(pkg) {
-    const pkgJsonPath = join(pkg.path, 'package.json');
-    if (!existsSync(pkgJsonPath)) {
-        return {
-            package: pkg.name,
-            kind: pkg.kind,
-            check: 'repository',
-            status: 'skip',
-            detail: 'no package.json',
-        };
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
-    }
-    catch (err) {
-        /* v8 ignore next -- non-Error catch fallback */
-        const message = err instanceof Error ? err.message : String(err);
-        return {
-            package: pkg.name,
-            kind: pkg.kind,
-            check: 'repository',
-            status: 'fail',
-            detail: `package.json parse error: ${message}`,
-        };
-    }
-    if (!parsed.repository) {
-        return {
-            package: pkg.name,
-            kind: pkg.kind,
-            check: 'repository',
-            status: 'fail',
-            detail: '`repository` field required for `npm publish --provenance`',
-        };
-    }
-    return { package: pkg.name, kind: pkg.kind, check: 'repository', status: 'ok' };
-}
-function artifactCheck(row, artifactsRoot) {
-    const dir = join(artifactsRoot, row.artifact_name);
-    if (existsSync(dir)) {
-        return {
-            package: row.name,
-            kind: row.kind,
-            check: 'artifact',
-            status: 'ok',
-            detail: row.artifact_name,
-        };
-    }
-    return {
-        package: row.name,
-        kind: row.kind,
-        check: 'artifact',
-        status: 'fail',
-        detail: `missing ${row.artifact_name}/; expected ${expectedLayout(row)}`,
-    };
-}
-//# sourceMappingURL=preflight-run.js.map

package/dist/preflight-run.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"preflight-run.js","sourceRoot":"","sources":["../src/preflight-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA4B3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,uEAAuE;IACvE,MAAM,OAAO,GACX,IAAI,CAAC,UAAU,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;IAE1E,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,sDAAsD;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IACD,oBAAoB;IAEpB,sEAAsE;IACtE,sCAAsC;IACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,MAAM,GAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAgB,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qDAAqD;QACrD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,gCAAgC,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG;QACpB,CAAC,CAAC,MAAM,CAAC,QAAQ;QACjB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,6DAA6D;QAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC5D,qEAAqE;QACrE,+DAA+D;QAC/D,iCAAiC;QACjC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,2EAA2E;AAE3E,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,4BAA4B,GAAG,CAAC,IAAI,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAU;IAC7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACrC,KAAK,KAAK,CAAC,CAAC,OAAO,cAAc,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClG,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,WAAW,QAAQ,OAAO,IAAI,EAAE;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,GAAY,EACZ,IAAkC;IAElC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,qEAAqE;IACrE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrG,CAAC;IACD,oBAAoB;IACpB,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,SAAS,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iBAAiB;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAA6B,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gDAAgD;QAChD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,6BAA6B,OAAO,EAAE;SAC/C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4DAA4D;SACrE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,GAAc,EAAE,aAAqB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,GAAG,CAAC,aAAa;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,WAAW,GAAG,CAAC,aAAa,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;KACzE,CAAC;AACJ,CAAC"}