putitoutthere 0.1.44 → 0.1.46

package/dist/registries/crates-trust.d.ts

@@ -1,69 +0,0 @@
-/**
- * crates.io trusted-publishing read API.
- *
- * Issue #189. crates.io exposes `GET /api/v1/trusted_publishing/github_configs?crate=<name>`
- * that returns each registered GitHub trust-policy config — enough to
- * diff against a local `[package.trust_policy]` declaration and catch
- * the `release.yml → patch-release.yml` rename landmine before it
- * breaks a live publish.
- *
- * PyPI and npm do NOT have a usable read API from CI: PyPI has no
- * current-policy endpoint (only past provenance via PEP 740), and
- * npm's equivalent requires 2FA/OTP on every call and rejects
- * bypass-2FA tokens. See `docs/guide/auth.md` for the full matrix.
- */
-/** One `GitHubConfig` entry from crates.io's trust-policy API. */
-export interface CratesGithubConfig {
-    id: number;
-    repository_owner: string;
-    repository_name: string;
-    workflow_filename: string;
-    environment: string | null;
-}
-export type CratesTrustFetchResult = {
-    kind: 'ok';
-    configs: CratesGithubConfig[];
-}
-/** Transient failure — timeout, network error, or 5xx. Neutral-skip in doctor. */
- | {
-    kind: 'skip-transient';
-    reason: string;
-}
-/** Token rejected (401). Fails the phase; user must fix the token. */
- | {
-    kind: 'auth-failed';
-    reason: string;
-};
-export interface FetchOptions {
-    /** Override for tests; defaults to `API_BASE`. */
-    apiBase?: string;
-    /** Override for tests; defaults to `AbortSignal.timeout(5000)`. */
-    signal?: AbortSignal;
-}
-/**
- * Fetches the crates.io trust-policy configs for a crate. Wraps the
- * network call in a 5s timeout; transient failures (timeout, 5xx,
- * network error) return `skip-transient` so `doctor` doesn't turn red
- * because crates.io is having a bad minute. A 401 returns
- * `auth-failed` — the token is the user's responsibility to fix.
- */
-export declare function fetchCratesTrustPolicy(crate: string, token: string, opts?: FetchOptions): Promise<CratesTrustFetchResult>;
-/** Issue emitted when a declared trust policy disagrees with crates.io. */
-export interface CratesTrustMismatch {
-    crate: string;
-    field: 'workflow_filename' | 'environment' | 'repository';
-    declared: string;
-    registered: string | null;
-}
-/**
- * Compare a `[package.trust_policy]` declaration against each registered
- * crates.io config for the same crate. Returns one mismatch per field
- * per config; empty when every field agrees across every registered
- * config.
- */
-export declare function diffCratesTrust(crate: string, declared: {
-    workflow: string;
-    environment?: string | undefined;
-    repository?: string | undefined;
-}, configs: readonly CratesGithubConfig[]): CratesTrustMismatch[];
-//# sourceMappingURL=crates-trust.d.ts.map

package/dist/registries/crates-trust.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crates-trust.d.ts","sourceRoot":"","sources":["../../src/registries/crates-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAAE;AAC/C,kFAAkF;GAChF;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC5C,sEAAsE;GACpE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,sBAAsB,CAAC,CA8BjC;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,mBAAmB,GAAG,aAAa,GAAG,YAAY,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACjG,OAAO,EAAE,SAAS,kBAAkB,EAAE,GACrC,mBAAmB,EAAE,CAgCvB"}

package/dist/registries/crates-trust.js

@@ -1,95 +0,0 @@
-/**
- * crates.io trusted-publishing read API.
- *
- * Issue #189. crates.io exposes `GET /api/v1/trusted_publishing/github_configs?crate=<name>`
- * that returns each registered GitHub trust-policy config — enough to
- * diff against a local `[package.trust_policy]` declaration and catch
- * the `release.yml → patch-release.yml` rename landmine before it
- * breaks a live publish.
- *
- * PyPI and npm do NOT have a usable read API from CI: PyPI has no
- * current-policy endpoint (only past provenance via PEP 740), and
- * npm's equivalent requires 2FA/OTP on every call and rejects
- * bypass-2FA tokens. See `docs/guide/auth.md` for the full matrix.
- */
-import { USER_AGENT } from '../version.js';
-const API_BASE = 'https://crates.io';
-/**
- * Fetches the crates.io trust-policy configs for a crate. Wraps the
- * network call in a 5s timeout; transient failures (timeout, 5xx,
- * network error) return `skip-transient` so `doctor` doesn't turn red
- * because crates.io is having a bad minute. A 401 returns
- * `auth-failed` — the token is the user's responsibility to fix.
- */
-export async function fetchCratesTrustPolicy(crate, token, opts = {}) {
-    const base = opts.apiBase ?? API_BASE;
-    const url = `${base}/api/v1/trusted_publishing/github_configs?crate=${encodeURIComponent(crate)}`;
-    const signal = opts.signal ?? AbortSignal.timeout(5000);
-    let res;
-    try {
-        res = await fetch(url, {
-            method: 'GET',
-            headers: {
-                'user-agent': USER_AGENT,
-                authorization: `Bearer ${token}`,
-            },
-            signal,
-        });
-    }
-    catch (err) {
-        /* v8 ignore next -- fetch always throws an Error; the String(err) fallback is defensive */
-        const message = err instanceof Error ? err.message : String(err);
-        return { kind: 'skip-transient', reason: message };
-    }
-    if (res.status === 401) {
-        return { kind: 'auth-failed', reason: 'crates.io rejected CRATES_IO_DOCTOR_TOKEN (401)' };
-    }
-    if (res.status >= 500) {
-        return { kind: 'skip-transient', reason: `crates.io returned HTTP ${res.status}` };
-    }
-    if (res.status !== 200) {
-        return { kind: 'skip-transient', reason: `crates.io returned unexpected HTTP ${res.status}` };
-    }
-    const body = (await res.json());
-    return { kind: 'ok', configs: body.github_configs ?? [] };
-}
-/**
- * Compare a `[package.trust_policy]` declaration against each registered
- * crates.io config for the same crate. Returns one mismatch per field
- * per config; empty when every field agrees across every registered
- * config.
- */
-export function diffCratesTrust(crate, declared, configs) {
-    const out = [];
-    for (const cfg of configs) {
-        if (cfg.workflow_filename !== declared.workflow) {
-            out.push({
-                crate,
-                field: 'workflow_filename',
-                declared: declared.workflow,
-                registered: cfg.workflow_filename,
-            });
-        }
-        if (declared.environment !== undefined && cfg.environment !== declared.environment) {
-            out.push({
-                crate,
-                field: 'environment',
-                declared: declared.environment,
-                registered: cfg.environment,
-            });
-        }
-        if (declared.repository !== undefined) {
-            const registeredRepo = `${cfg.repository_owner}/${cfg.repository_name}`;
-            if (registeredRepo !== declared.repository) {
-                out.push({
-                    crate,
-                    field: 'repository',
-                    declared: declared.repository,
-                    registered: registeredRepo,
-                });
-            }
-        }
-    }
-    return out;
-}
-//# sourceMappingURL=crates-trust.js.map

package/dist/registries/crates-trust.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crates-trust.js","sourceRoot":"","sources":["../../src/registries/crates-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAyBrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,KAAa,EACb,OAAqB,EAAE;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,IAAI,mDAAmD,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,YAAY,EAAE,UAAU;gBACxB,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;YACD,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2FAA2F;QAC3F,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,2BAA2B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,sCAAsC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;IAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;AAC5D,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,QAAiG,EACjG,OAAsC;IAEtC,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC;gBACP,KAAK;gBACL,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,GAAG,CAAC,iBAAiB;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YACnF,GAAG,CAAC,IAAI,CAAC;gBACP,KAAK;gBACL,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE,QAAQ,CAAC,WAAW;gBAC9B,UAAU,EAAE,GAAG,CAAC,WAAW;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxE,IAAI,cAAc,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC3C,GAAG,CAAC,IAAI,CAAC;oBACP,KAAK;oBACL,KAAK,EAAE,YAAY;oBACnB,QAAQ,EAAE,QAAQ,CAAC,UAAU;oBAC7B,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/release.d.ts

@@ -1,36 +0,0 @@
-/**
- * GitHub Release creation.
- *
- * After a successful tag push (§13.6), create a Release on GitHub so
- * the new version shows up in the repo's Releases UI with body notes
- * generated from the commit history since the previous tag.
- *
- * No external action dependency -- uses the GitHub REST API via
- * fetch with the caller-supplied GITHUB_TOKEN (or the default
- * GITHUB_TOKEN available to every Actions run).
- *
- * Issue #26. Plan: §15.
- */
-export interface CreateReleaseOptions {
-    tag: string;
-    title: string;
-    body: string;
-    /** Override for tests. Defaults to global fetch. */
-    fetchFn?: typeof fetch;
-}
-export interface ReleaseResult {
-    url: string;
-}
-/**
- * Generate release notes from `git log <prev_tag>..<this_tag>` subject
- * lines. If no prior tag exists for this package, falls back to the
- * full history (first release).
- *
- * The filter is subject-only -- commit bodies add noise and are
- * already available on the tag itself.
- */
-export declare function generateReleaseNotes(packageName: string, tagName: string, opts: {
-    cwd: string;
-}): string;
-export declare function createGitHubRelease(opts: CreateReleaseOptions): Promise<ReleaseResult | null>;
-//# sourceMappingURL=release.d.ts.map

package/dist/release.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GACpB,MAAM,CAKR;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAiC/B"}

package/dist/release.js

@@ -1,102 +0,0 @@
-/**
- * GitHub Release creation.
- *
- * After a successful tag push (§13.6), create a Release on GitHub so
- * the new version shows up in the repo's Releases UI with body notes
- * generated from the commit history since the previous tag.
- *
- * No external action dependency -- uses the GitHub REST API via
- * fetch with the caller-supplied GITHUB_TOKEN (or the default
- * GITHUB_TOKEN available to every Actions run).
- *
- * Issue #26. Plan: §15.
- */
-import { execFileSync } from 'node:child_process';
-/**
- * Generate release notes from `git log <prev_tag>..<this_tag>` subject
- * lines. If no prior tag exists for this package, falls back to the
- * full history (first release).
- *
- * The filter is subject-only -- commit bodies add noise and are
- * already available on the tag itself.
- */
-export function generateReleaseNotes(packageName, tagName, opts) {
-    const prev = findPreviousTag(packageName, tagName, opts.cwd);
-    const range = prev ? `${prev}..${tagName}` : tagName;
-    const out = runGit(['log', range, '--format=- %s', '--no-merges'], opts.cwd);
-    return out.trim();
-}
-export async function createGitHubRelease(opts) {
-    const token = process.env.GITHUB_TOKEN;
-    const repository = process.env.GITHUB_REPOSITORY;
-    if (!token || !repository) {
-        // Local runs (putitoutthere doctor, operator on laptop) don't have
-        // these. Silent-skip so we don't confuse operators with a failure
-        // that doesn't matter outside Actions.
-        return null;
-    }
-    const fetchFn = opts.fetchFn ?? fetch;
-    const url = `https://api.github.com/repos/${repository}/releases`;
-    const res = await fetchFn(url, {
-        method: 'POST',
-        headers: {
-            authorization: `Bearer ${token}`,
-            'content-type': 'application/json',
-            accept: 'application/vnd.github+json',
-            'user-agent': 'putitoutthere',
-        },
-        body: JSON.stringify({
-            tag_name: opts.tag,
-            name: opts.title,
-            body: opts.body,
-            draft: false,
-            prerelease: isPrerelease(opts.tag),
-        }),
-    });
-    if (!res.ok) {
-        const msg = await res.text().catch(() => '');
-        throw new Error(`GitHub release API ${res.status}: ${msg}`);
-    }
-    const data = (await res.json());
-    return { url: data.html_url ?? '' };
-}
-/* ------------------------------ internals ------------------------------ */
-function isPrerelease(tag) {
-    return /-(rc|beta|alpha)(\.|$)/.test(tag);
-}
-function runGit(args, cwd) {
-    try {
-        return execFileSync('git', args, { cwd, encoding: 'utf8' });
-        /* v8 ignore start -- defensive wrap */
-    }
-    catch (err) {
-        const stderr = err.stderr?.toString('utf8') ?? '';
-        throw new Error(`git ${args.join(' ')} failed: ${stderr.trim()}`, { cause: err });
-    }
-    /* v8 ignore stop */
-}
-function findPreviousTag(packageName, currentTag, cwd) {
-    const prefix = `${packageName}-v`;
-    const tags = runGit(['tag', '-l', `${prefix}*.*.*`], cwd)
-        .split('\n')
-        .filter((t) => t && t !== currentTag)
-        .sort(compareSemverTags(prefix));
-    return tags.length > 0 ? tags[tags.length - 1] : null;
-}
-function compareSemverTags(prefix) {
-    return (a, b) => {
-        const [am, an, ap] = parseVer(a.slice(prefix.length));
-        const [bm, bn, bp] = parseVer(b.slice(prefix.length));
-        if (am !== bm)
-            return am - bm;
-        if (an !== bn)
-            return an - bn;
-        return ap - bp;
-    };
-}
-function parseVer(v) {
-    const parts = v.split('.').map((n) => parseInt(n, 10));
-    /* v8 ignore next -- tag-glob filter already enforces x.y.z shape */
-    return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
-}
-//# sourceMappingURL=release.js.map

package/dist/release.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"release.js","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAclD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,OAAe,EACf,IAAqB;IAErB,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,mEAAmE;QACnE,kEAAkE;QAClE,uCAAuC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,GAAG,GAAG,gCAAgC,UAAU,WAAW,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,eAAe;SAC9B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;SACnC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;IACzD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,6EAA6E;AAE7E,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,IAAc,EAAE,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,uCAAuC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,oBAAoB;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,WAAmB,EACnB,UAAkB,EAClB,GAAW;IAEX,MAAM,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,CAAC;SACtD,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;SACpC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACd,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9B,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,oEAAoE;IACpE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/token-scope.d.ts

@@ -1,65 +0,0 @@
-/**
- * Token scope checking — compares what a token is allowed to publish
- * against what `putitoutthere.toml` says the package is.
- *
- * Runs as a deep extension of `doctor` (#110) and as an opt-in gate in
- * `publish --preflight-check`. Per registry:
- *
- *   - PyPI: project-name macaroon caveats. Full-scope tokens pass; any
- *     restriction list that excludes the package name is a hard
- *     mismatch.
- *   - npm:  granular `pkg:<name>` scopes on the matched tokens row. A
- *     bare `@scope` grant still counts when the package name lives
- *     under that scope. Legacy (non-granular) tokens are treated as
- *     full-scope (`match: 'ok'`, note surfaced).
- *   - crates.io: the bearer row is not identifiable, so we can never
- *     prove mismatch. Always `match: 'unknown'` — callers that need a
- *     block/warn decision should treat `unknown` as warn-only.
- *
- * Never logs or returns token values. Digests are threaded through from
- * `inspect` for traceability.
- */
-import type { InspectOptions, InspectResult } from './token.js';
-import type { Package } from './config.js';
-import type { Kind } from './types.js';
-export type ScopeMatch = 'ok' | 'mismatch' | 'unknown' | 'error';
-export interface DeepCheckRow {
-    package: string;
-    kind: Kind;
-    scope: string;
-    match: ScopeMatch;
-    /** Populated on mismatch or error; omitted when `ok` / `unknown`. */
-    detail?: string;
-}
-export type InspectFn = (opts: InspectOptions) => Promise<InspectResult>;
-/**
- * Registry-facing publish name. Handlers use the override field when
- * present; we mirror that so the scope check talks about the same name
- * the upload will use.
- */
-export declare function publishNameFor(pkg: Package): string;
-export interface ScopeFromResult {
-    scope: string;
-    match: ScopeMatch;
-    detail?: string;
-}
-/**
- * Translate an `InspectResult` + the package it's meant to publish into
- * a scope display + match verdict. Pure; never hits the network.
- */
-export declare function scopeFromInspect(result: InspectResult, pkg: Package): ScopeFromResult;
-export interface DeepCheckOptions {
-    packages: readonly Package[];
-    /** envVar-per-package mapping, as computed by preflight.checkAuth. */
-    envVarForPackage: Map<string, string>;
-    env?: NodeJS.ProcessEnv;
-    /** Override for tests; defaults to the real `inspect`. */
-    inspect?: InspectFn;
-}
-/**
- * Call `inspect` for every package that has a resolvable token in the
- * env, and return one `DeepCheckRow` per package. Packages whose env
- * var is absent or empty are emitted with `match: 'error'`.
- */
-export declare function deepCheck(opts: DeepCheckOptions): Promise<DeepCheckRow[]>;
-//# sourceMappingURL=token-scope.d.ts.map

package/dist/token-scope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-scope.d.ts","sourceRoot":"","sources":["../src/token-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EAGd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAInD;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,CASrF;AAyFD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7B,sEAAsE;IACtE,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA6B/E"}

package/dist/token-scope.js

@@ -1,163 +0,0 @@
-/**
- * Token scope checking — compares what a token is allowed to publish
- * against what `putitoutthere.toml` says the package is.
- *
- * Runs as a deep extension of `doctor` (#110) and as an opt-in gate in
- * `publish --preflight-check`. Per registry:
- *
- *   - PyPI: project-name macaroon caveats. Full-scope tokens pass; any
- *     restriction list that excludes the package name is a hard
- *     mismatch.
- *   - npm:  granular `pkg:<name>` scopes on the matched tokens row. A
- *     bare `@scope` grant still counts when the package name lives
- *     under that scope. Legacy (non-granular) tokens are treated as
- *     full-scope (`match: 'ok'`, note surfaced).
- *   - crates.io: the bearer row is not identifiable, so we can never
- *     prove mismatch. Always `match: 'unknown'` — callers that need a
- *     block/warn decision should treat `unknown` as warn-only.
- *
- * Never logs or returns token values. Digests are threaded through from
- * `inspect` for traceability.
- */
-import { inspect as realInspect, isError } from './token.js';
-/**
- * Registry-facing publish name. Handlers use the override field when
- * present; we mirror that so the scope check talks about the same name
- * the upload will use.
- */
-export function publishNameFor(pkg) {
-    if (pkg.kind === 'pypi')
-        return pkg.pypi ?? pkg.name;
-    if (pkg.kind === 'npm')
-        return pkg.npm ?? pkg.name;
-    return pkg.crate ?? pkg.name;
-}
-/**
- * Translate an `InspectResult` + the package it's meant to publish into
- * a scope display + match verdict. Pure; never hits the network.
- */
-export function scopeFromInspect(result, pkg) {
-    if (isError(result)) {
-        return { scope: '(inspect failed)', match: 'error', detail: result.error };
-    }
-    if (result.registry === 'pypi')
-        return scopeFromPypi(result, pkg);
-    if (result.registry === 'npm')
-        return scopeFromNpm(result, pkg);
-    // crates.io: we can't prove mismatch.
-    return { scope: 'unknown (see account tokens)', match: 'unknown' };
-}
-function scopeFromPypi(result, pkg) {
-    const allowed = collectPypiProjectNames(result);
-    if (allowed === null) {
-        return { scope: '(full-scope)', match: 'ok' };
-    }
-    const want = publishNameFor(pkg);
-    if (allowed.includes(want)) {
-        return { scope: `projects=[${allowed.join(', ')}]`, match: 'ok' };
-    }
-    return {
-        scope: `projects=[${allowed.join(', ')}]`,
-        match: 'mismatch',
-        detail: `PyPI token restricted to [${allowed.join(', ')}] but config publishes '${want}'`,
-    };
-}
-function collectPypiProjectNames(result) {
-    const names = [];
-    let sawProjectRestriction = false;
-    for (const r of result.restrictions) {
-        if (r.type === 'ProjectNames') {
-            sawProjectRestriction = true;
-            for (const n of r.names)
-                names.push(n);
-        }
-    }
-    return sawProjectRestriction ? dedupe(names) : null;
-}
-function scopeFromNpm(result, pkg) {
-    const want = publishNameFor(pkg);
-    const row = result.scope_row;
-    if (row === null) {
-        // Legacy UUID or non-granular token: we can't introspect scope.
-        // Treat as full-scope ok; doctor will still flag via note.
-        return { scope: `(${result.format}; no scope row)`, match: 'ok' };
-    }
-    const allowedPkgs = row.packages ?? [];
-    const allowedScopes = (row.scopes ?? []).map((s) => (s.startsWith('@') ? s : `@${s}`));
-    const allowedOrgs = row.orgs ?? [];
-    const noRestrictions = allowedPkgs.length === 0 && allowedScopes.length === 0 && allowedOrgs.length === 0;
-    if (noRestrictions) {
-        return { scope: '(account-wide)', match: 'ok' };
-    }
-    if (allowedPkgs.includes(want)) {
-        return { scope: renderNpmScope(row), match: 'ok' };
-    }
-    const atScope = scopeOf(want);
-    if (atScope !== null && allowedScopes.includes(atScope)) {
-        return { scope: renderNpmScope(row), match: 'ok' };
-    }
-    // Orgs aren't a pre-publish allowlist at the name level (npm doesn't
-    // bind "org:foo" to a package name directly), so we don't use them to
-    // prove a match. We still render them for visibility.
-    return {
-        scope: renderNpmScope(row),
-        match: 'mismatch',
-        detail: `npm token allowlist [${[...allowedPkgs, ...allowedScopes].join(', ')}] does not include '${want}'`,
-    };
-}
-function renderNpmScope(row) {
-    const parts = [];
-    if (row.packages && row.packages.length > 0)
-        parts.push(`pkgs=[${row.packages.join(', ')}]`);
-    if (row.scopes && row.scopes.length > 0)
-        parts.push(`scopes=[${row.scopes.join(', ')}]`);
-    if (row.orgs && row.orgs.length > 0)
-        parts.push(`orgs=[${row.orgs.join(', ')}]`);
-    /* v8 ignore next -- caller only invokes this when at least one list is populated */
-    return parts.length === 0 ? '(empty)' : parts.join(' ');
-}
-function scopeOf(name) {
-    if (!name.startsWith('@'))
-        return null;
-    const slash = name.indexOf('/');
-    /* v8 ignore next -- scoped npm names always carry a slash separator */
-    return slash === -1 ? null : name.slice(0, slash);
-}
-function dedupe(arr) {
-    return Array.from(new Set(arr));
-}
-/**
- * Call `inspect` for every package that has a resolvable token in the
- * env, and return one `DeepCheckRow` per package. Packages whose env
- * var is absent or empty are emitted with `match: 'error'`.
- */
-export async function deepCheck(opts) {
-    const env = opts.env ?? process.env;
-    const inspectFn = opts.inspect ?? realInspect;
-    const rows = [];
-    for (const pkg of opts.packages) {
-        const envVar = opts.envVarForPackage.get(pkg.name);
-        const tokenValue = envVar !== undefined ? env[envVar] : undefined;
-        if (tokenValue === undefined || tokenValue.trim() === '') {
-            rows.push({
-                package: pkg.name,
-                kind: pkg.kind,
-                scope: '(no token resolved)',
-                match: 'error',
-                detail: `no token value found in ${envVar ?? '<unknown env var>'}`,
-            });
-            continue;
-        }
-        const result = await inspectFn({ token: tokenValue, registry: pkg.kind });
-        const verdict = scopeFromInspect(result, pkg);
-        rows.push({
-            package: pkg.name,
-            kind: pkg.kind,
-            scope: verdict.scope,
-            match: verdict.match,
-            ...(verdict.detail !== undefined ? { detail: verdict.detail } : {}),
-        });
-    }
-    return rows;
-}
-//# sourceMappingURL=token-scope.js.map

package/dist/token-scope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-scope.js","sourceRoot":"","sources":["../src/token-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAuB7D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC;AAC/B,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,GAAY;IAClE,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChE,sCAAsC;IACtC,OAAO,EAAE,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB,EAAE,GAAY;IAC5D,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACzC,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,IAAI,GAAG;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAyB;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC9B,qBAAqB,GAAG,IAAI,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,MAAwB,EAAE,GAAY;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,gEAAgE;QAChE,2DAA2D;QAC3D,OAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAEnC,MAAM,cAAc,GAClB,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;IACrF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,qEAAqE;IACrE,sEAAsE;IACtE,sDAAsD;IACtD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC;QAC1B,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,wBAAwB,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,GAAG;KAC5G,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA+C;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzF,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,oFAAoF;IACpF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,uEAAuE;IACvE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,MAAM,CAAI,GAAiB;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAE9C,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC;gBACR,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,qBAAqB;gBAC5B,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,2BAA2B,MAAM,IAAI,mBAAmB,EAAE;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC;YACR,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}