putitoutthere 0.2.9 → 0.2.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +2 -0
- package/MIGRATIONS.md +127 -0
- package/README.md +61 -10
- package/dist/error-codes.d.ts +7 -0
- package/dist/error-codes.d.ts.map +1 -1
- package/dist/error-codes.js +8 -0
- package/dist/error-codes.js.map +1 -1
- package/dist/handlers/npm.d.ts.map +1 -1
- package/dist/handlers/npm.js +24 -5
- package/dist/handlers/npm.js.map +1 -1
- package/dist/preflight.d.ts +51 -10
- package/dist/preflight.d.ts.map +1 -1
- package/dist/preflight.js +104 -10
- package/dist/preflight.js.map +1 -1
- package/dist/publish.d.ts.map +1 -1
- package/dist/publish.js +6 -1
- package/dist/publish.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -12,6 +12,8 @@ are prefixed `**BREAKING**` and link to the matching section in
|
|
|
12
12
|
|
|
13
13
|
### Added
|
|
14
14
|
|
|
15
|
+
- **Reusable workflow accepts a caller-provided `CARGO_REGISTRY_TOKEN` via `secrets:`.** OIDC trusted publishers remain the default and recommended path, but Trusted Publishing on crates.io binds to an *already-published* crate — so the first publish of a brand-new crate has no OIDC path available, and consumers were forced to either fork the workflow or run `cargo publish` outside it. The `workflow_call` surface now declares an optional `CARGO_REGISTRY_TOKEN` secret; when set, the `rust-lang/crates-io-auth-action` OIDC exchange is skipped and the caller-provided token is exported to `$GITHUB_ENV` for the engine's crates handler to read. Callers without a token keep the OIDC path unchanged. The "Auth: OIDC trusted publishers ... Long-lived registry tokens are explicitly NOT supported" framing in `release.yml`'s header has been softened to match. See [README → Trusted publishers → crates.io](./README.md#cratesio) and [MIGRATIONS.md](./MIGRATIONS.md#crates-token-fallback). #283.
|
|
16
|
+
- **Preflight check: every cascaded `kind = "npm"` package must declare a non-empty `repository` field in `package.json`.** `putitoutthere` invokes `npm publish --provenance` on the OIDC trusted-publisher path, and the npm CLI hard-requires this field so the registry can verify the artifact was built from the repo the trusted publisher declares. A missing or empty field previously surfaced as a confusing tail-end npm error after the runner had spun up, OIDC had been negotiated, and the artifact had been built — wasting a full release run on a precondition checkable in milliseconds. The new `requireProvenanceMetadata` runs alongside `requireAuth` in `src/publish.ts`, before any side effects, and reports every failing package in one error rather than failing on the first. Surfaces a new stable error code, `PIOT_NPM_MISSING_REPOSITORY`. Both the canonical object form (`{ type, url, directory? }`) and the legacy single-string form are accepted; only an empty `url` (or no `url` at all) fails. The npm handler's inline backstop is also tightened to match the same predicate (previously `!pkg.repository` slipped `{}`, `{ type: 'git' }`, and whitespace strings through). Documented in [README → `kind = "npm"`](./README.md#kind--npm). See [MIGRATIONS.md](./MIGRATIONS.md#npm-package-json-must-declare-repository). #280.
|
|
15
17
|
- **Reusable workflow `.github/workflows/build.yml` (`workflow_call`).** PR-time build verification: runs the same plan + build matrix that `release.yml` runs, calling a shared internal `_matrix.yml` reusable workflow so action pins, per-target build steps, and runner selection cannot drift between the two paths. `build.yml` declares only `permissions: contents: read` and contains no publish job, no `id-token: write`, no OIDC trusted-publisher exchange, and no registry auth — the bytes required to publish do not exist on this code path. Two optional inputs forwarded to `_matrix.yml`: `node_version` (default `24`), `python_version` (default `3.12`). Concurrency is keyed on `github.ref` with `cancel-in-progress: true` so PR pushes supersede stale runs (release.yml's repository-keyed group with `cancel-in-progress: false` is unchanged). An `actionlint`-job grep assertion rejects any future patch that adds `id-token: write` to `build.yml` or `_matrix.yml`. See [README → Build check](./README.md#1b-optional-drop-in-githubworkflowsbuild-checkyml) and [MIGRATIONS.md](./MIGRATIONS.md#new-buildyml-reusable-workflow-for-pr-time-build-verification).
|
|
16
18
|
- **`PIOT_PUBLISH_EMPTY_PLAN` error code.** Surfaced when `publish` is invoked with an empty matrix. Joins `PIOT_AUTH_NO_TOKEN` in the stable error-code vocabulary; foreign agents debugging a failed publish can fingerprint on the code without parsing prose.
|
|
17
19
|
- **`kind = "npm"` `build` accepts an array of entries with consumer-defined platform-package name templates.** For packages that ship both a napi-rs Node addon and a CLI binary from the same npm package (the `@swc/core` shape), declare `build = [{ mode = "napi", name = "@scope/lib-{triple}" }, { mode = "bundled-cli", name = "@scope/cli-{triple}" }]`. Each entry contributes its own per-platform package family; the main package's `optionalDependencies` spans both. Entries can be bare mode strings (`"napi"`, defaults to `{name}-{triple}` template) or `{ mode, name }` objects. Variables surfaced in `name` templates: `{name}`, `{scope}`, `{base}`, `{triple}`, `{mode}`. `{version}` is intentionally not surfaced. Single-mode string form (`build = "napi"`) preserved byte-for-byte — same artifact-name layout, same platform-package names, no migration pressure on existing consumers. See [README → Recipes → Multi-mode npm family](./README.md#multi-mode-npm-family) and [MIGRATIONS.md](./MIGRATIONS.md#npm-build-accepts-array-of-entries).
|
package/MIGRATIONS.md
CHANGED
|
@@ -21,6 +21,133 @@ Each section covers five things, in order:
|
|
|
21
21
|
|
|
22
22
|
## Unreleased
|
|
23
23
|
|
|
24
|
+
### Crates token fallback
|
|
25
|
+
|
|
26
|
+
**Summary.** The reusable workflow now accepts an optional
|
|
27
|
+
`CARGO_REGISTRY_TOKEN` via `secrets:`. Trusted Publishing on
|
|
28
|
+
crates.io binds to an *already-published* crate, so the very
|
|
29
|
+
first publish of a brand-new crate has no OIDC path available;
|
|
30
|
+
without this fallback consumers had to either fork the workflow
|
|
31
|
+
or publish once outside it. OIDC trusted publishers remain the
|
|
32
|
+
default and recommended path — when the secret is unset,
|
|
33
|
+
behavior is byte-for-byte unchanged. When the secret is set,
|
|
34
|
+
the `rust-lang/crates-io-auth-action` OIDC exchange is skipped
|
|
35
|
+
and the caller-provided token is exported to `$GITHUB_ENV` as
|
|
36
|
+
`CARGO_REGISTRY_TOKEN` for the engine's crates handler to read.
|
|
37
|
+
The header comment in `.github/workflows/release.yml` has been
|
|
38
|
+
softened to match: previously *"Long-lived registry tokens are
|
|
39
|
+
explicitly NOT supported via this workflow"*; now OIDC is
|
|
40
|
+
described as the default with the token fallback called out for
|
|
41
|
+
first-publish bootstrap. #283.
|
|
42
|
+
|
|
43
|
+
**Required changes.** None for consumers already on the OIDC
|
|
44
|
+
path. To bootstrap a brand-new crate or to use the workflow on
|
|
45
|
+
an account where Trusted Publishing isn't available, wire the
|
|
46
|
+
secret in the caller's `release.yml`:
|
|
47
|
+
|
|
48
|
+
| Before | After |
|
|
49
|
+
| -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
50
|
+
| `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0` | `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0`<br>`secrets:`<br>` CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}` |
|
|
51
|
+
|
|
52
|
+
The repo-level secret holding the crates.io API token can be
|
|
53
|
+
named anything; the *workflow* secret it gets passed as must
|
|
54
|
+
be `CARGO_REGISTRY_TOKEN` exactly — the reusable workflow keys
|
|
55
|
+
on that name. Drop the `secrets:` block from the caller's
|
|
56
|
+
`release.yml` once Trusted Publishing is registered against
|
|
57
|
+
the now-existing crate; subsequent publishes are zero-secret.
|
|
58
|
+
|
|
59
|
+
**Deprecations removed.** None.
|
|
60
|
+
|
|
61
|
+
**Behavior changes without code changes.** None when the secret
|
|
62
|
+
is unset (OIDC path unchanged). When the secret is set, the
|
|
63
|
+
publish job's "Authenticate with crates.io (OIDC)" step is
|
|
64
|
+
conditionally skipped and a new "Export CARGO_REGISTRY_TOKEN
|
|
65
|
+
(caller-provided)" step writes the secret to `$GITHUB_ENV`
|
|
66
|
+
gated on the same condition. The gate reads the secret through a
|
|
67
|
+
job-level `CALLER_CARGO_REGISTRY_TOKEN` env var because GitHub
|
|
68
|
+
Actions does not allow the `secrets` context inside step-level
|
|
69
|
+
`if:` conditions ([context availability](https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability));
|
|
70
|
+
this is an internal mechanism — consumers don't see or set
|
|
71
|
+
`CALLER_CARGO_REGISTRY_TOKEN` themselves.
|
|
72
|
+
|
|
73
|
+
**Verification.** Wire `CARGO_REGISTRY_TOKEN` to a valid
|
|
74
|
+
crates.io API token in the caller repo and trigger a release.
|
|
75
|
+
The publish-job logs should show "Authenticate with crates.io
|
|
76
|
+
(OIDC)" as `skipped`, "Export CARGO_REGISTRY_TOKEN (OIDC)" as
|
|
77
|
+
`skipped`, and "Export CARGO_REGISTRY_TOKEN (caller-provided)"
|
|
78
|
+
as `success`. The crate publishes; the only difference visible
|
|
79
|
+
in the registry is the publish was authorised against the
|
|
80
|
+
caller-provided token rather than an OIDC-minted ephemeral one.
|
|
81
|
+
|
|
82
|
+
---
|
|
83
|
+
|
|
84
|
+
### npm package.json must declare `repository`
|
|
85
|
+
|
|
86
|
+
**Summary.** Every cascaded `kind = "npm"` package's `package.json`
|
|
87
|
+
must now carry a non-empty `repository` field. The new preflight
|
|
88
|
+
check (`requireProvenanceMetadata` in `src/preflight.ts`) runs in
|
|
89
|
+
`src/publish.ts` immediately after `requireAuth` and rejects the
|
|
90
|
+
run with `PIOT_NPM_MISSING_REPOSITORY` before any runner work.
|
|
91
|
+
Why: `putitoutthere` invokes `npm publish --provenance` on the OIDC
|
|
92
|
+
trusted-publisher path; the npm CLI hard-requires this field so the
|
|
93
|
+
registry can verify the artifact was built from the repo the trusted
|
|
94
|
+
publisher declares. A missing or empty field previously surfaced
|
|
95
|
+
only after the runner had spun up, OIDC had been negotiated, and
|
|
96
|
+
the artifact had been built — wasting a full release run on a
|
|
97
|
+
precondition checkable in milliseconds. Hit in the wild on
|
|
98
|
+
`coaxer@0.1.1`'s first npm release; tracked in #280.
|
|
99
|
+
|
|
100
|
+
The npm handler's inline backstop (`assertRepositoryField` in
|
|
101
|
+
`src/handlers/npm.ts`) is also tightened. Previously it used
|
|
102
|
+
`if (!pkg.repository)` — falsy-only — which let three real shapes
|
|
103
|
+
slip through: an object without `url` (`{ type: 'git' }`), an
|
|
104
|
+
empty object (`{}`), and a whitespace-only string (`' '`). All
|
|
105
|
+
three are now rejected; the error message also carries the stable
|
|
106
|
+
`PIOT_NPM_MISSING_REPOSITORY` code and the path of the offending
|
|
107
|
+
file, matching the preflight error.
|
|
108
|
+
|
|
109
|
+
**Required changes.** Add a `repository` block to every
|
|
110
|
+
`package.json` declared as `kind = "npm"` in
|
|
111
|
+
`putitoutthere.toml`. Canonical shape:
|
|
112
|
+
|
|
113
|
+
| Before | After |
|
|
114
|
+
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
115
|
+
| `{ "name": "@scope/lib", "version": "0.1.0" }` | `{ "name": "@scope/lib", "version": "0.1.0", "repository": { "type": "git", "url": "git+https://github.com/<owner>/<repo>.git", "directory": "<path/to/package>" } }` |
|
|
116
|
+
|
|
117
|
+
`directory` is needed for monorepo packages so npm can locate the
|
|
118
|
+
source within the repo. Both the object form and the legacy single-
|
|
119
|
+
string form (`"repository": "git+https://github.com/<owner>/<repo>.git"`)
|
|
120
|
+
are accepted; only a missing field, an empty string, or an object
|
|
121
|
+
without a non-empty `url` fails the check.
|
|
122
|
+
|
|
123
|
+
No `release.yml` or `putitoutthere.toml` changes are required.
|
|
124
|
+
|
|
125
|
+
**Deprecations removed.** None.
|
|
126
|
+
|
|
127
|
+
**Behavior changes without code changes.** `putitoutthere publish`
|
|
128
|
+
now fails fast at preflight with
|
|
129
|
+
`[PIOT_NPM_MISSING_REPOSITORY] npm publish requires a non-empty
|
|
130
|
+
\`repository\` field in package.json` for any cascaded npm package
|
|
131
|
+
whose `package.json` lacks the field. Previously the same shape
|
|
132
|
+
ran through plan + build + auth-negotiation + artifact-staging
|
|
133
|
+
and failed inside `npm publish` with `npm publish --provenance
|
|
134
|
+
requires a \`repository\` field in package.json`. Well-formed
|
|
135
|
+
packages are unaffected.
|
|
136
|
+
|
|
137
|
+
The error message names every failing package and its
|
|
138
|
+
`package.json` path so consumers fix all of them in one round-trip
|
|
139
|
+
rather than discovering them one at a time across multiple release
|
|
140
|
+
attempts.
|
|
141
|
+
|
|
142
|
+
**Verification.** Drop the `repository` field from one of your
|
|
143
|
+
`package.json` files locally and run `pnpm test:integration` (or
|
|
144
|
+
the engine against a local fixture); the failure should arrive at
|
|
145
|
+
preflight with `PIOT_NPM_MISSING_REPOSITORY` in the message, no
|
|
146
|
+
platform packages should be published, and no git tag should be
|
|
147
|
+
created. Restore the field; the next run completes normally.
|
|
148
|
+
|
|
149
|
+
---
|
|
150
|
+
|
|
24
151
|
### pypi/maturin version bump at build
|
|
25
152
|
|
|
26
153
|
**Summary.** `pypi` packages built with `build = "maturin"` now ship
|
package/README.md
CHANGED
|
@@ -183,6 +183,32 @@ version = 1 # required; only 1 is valid today
|
|
|
183
183
|
| `build` | string \| array | `"napi"` \| `"bundled-cli"` (single mode), or an array of entries (each: a bare mode string or `{ mode, name }` with a [name template](#multi-mode-npm-family)). Omitted = vanilla. See [Recipes → Bundled-CLI npm family](#bundled-cli-npm-family). |
|
|
184
184
|
| `targets` | (string \| object)[] | Required when `build` is set. |
|
|
185
185
|
|
|
186
|
+
> [!IMPORTANT]
|
|
187
|
+
> **`package.json` MUST declare a non-empty `repository` field.** `putitoutthere`
|
|
188
|
+
> publishes npm packages with `npm publish --provenance` on the OIDC
|
|
189
|
+
> trusted-publisher path; the npm CLI hard-requires `repository` so the
|
|
190
|
+
> registry can verify the artifact was built from the repo the trusted
|
|
191
|
+
> publisher declares. Preflight rejects the run with
|
|
192
|
+
> `PIOT_NPM_MISSING_REPOSITORY` when the field is missing or empty.
|
|
193
|
+
>
|
|
194
|
+
> Canonical shape (use this in every npm `package.json` you publish through
|
|
195
|
+
> `putitoutthere`):
|
|
196
|
+
>
|
|
197
|
+
> ```json
|
|
198
|
+
> {
|
|
199
|
+
> "repository": {
|
|
200
|
+
> "type": "git",
|
|
201
|
+
> "url": "git+https://github.com/<owner>/<repo>.git",
|
|
202
|
+
> "directory": "<path/to/package>"
|
|
203
|
+
> }
|
|
204
|
+
> }
|
|
205
|
+
> ```
|
|
206
|
+
>
|
|
207
|
+
> `directory` is needed for monorepo packages so npm can locate the source
|
|
208
|
+
> within the repo. The legacy single-string form
|
|
209
|
+
> (`"repository": "git+https://github.com/<owner>/<repo>.git"`) is also
|
|
210
|
+
> accepted.
|
|
211
|
+
|
|
186
212
|
### Example: polyglot Rust library
|
|
187
213
|
|
|
188
214
|
One Rust crate feeds three artifacts:
|
|
@@ -275,23 +301,48 @@ releases without fighting registry-immutable-publish semantics.
|
|
|
275
301
|
|
|
276
302
|
## Trusted publishers
|
|
277
303
|
|
|
278
|
-
OIDC trusted publishers
|
|
279
|
-
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
|
|
304
|
+
OIDC trusted publishers are the default and recommended auth path.
|
|
305
|
+
The reusable workflow also accepts a long-lived `CARGO_REGISTRY_TOKEN`
|
|
306
|
+
via `secrets:` for cases where Trusted Publishing isn't reachable —
|
|
307
|
+
most commonly the very first publish of a brand-new crate, since
|
|
308
|
+
Trusted Publishing on crates.io binds to an *already-published* crate
|
|
309
|
+
and there's no pending-publisher equivalent. When set, the OIDC
|
|
310
|
+
exchange is skipped and the caller-provided token is used instead.
|
|
311
|
+
Drop the secret once Trusted Publishing is registered against the
|
|
312
|
+
existing crate.
|
|
313
|
+
|
|
314
|
+
For all three registries the OIDC fields are the same: **your**
|
|
315
|
+
repository owner/name, **your** workflow filename (`release.yml`),
|
|
316
|
+
and optionally a GitHub environment name. Note: you register against
|
|
317
|
+
your *own* repository, not against `thekevinscott/putitoutthere` —
|
|
318
|
+
see "How auth flows" below for the why.
|
|
286
319
|
|
|
287
320
|
### crates.io
|
|
288
321
|
|
|
289
|
-
1.
|
|
290
|
-
|
|
322
|
+
1. **First publish (brand-new crate).** Trusted Publishing binds to
|
|
323
|
+
an existing crate, so the first `cargo publish` has no OIDC path.
|
|
324
|
+
Either run `cargo publish` once locally with your account's API
|
|
325
|
+
token, or pass `CARGO_REGISTRY_TOKEN` to the reusable workflow via
|
|
326
|
+
`secrets:` to bootstrap through this workflow:
|
|
327
|
+
|
|
328
|
+
```yaml
|
|
329
|
+
jobs:
|
|
330
|
+
release:
|
|
331
|
+
uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0
|
|
332
|
+
secrets:
|
|
333
|
+
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
|
|
334
|
+
```
|
|
335
|
+
|
|
336
|
+
When `CARGO_REGISTRY_TOKEN` is set, the OIDC step
|
|
337
|
+
(`rust-lang/crates-io-auth-action`) is skipped and the caller-
|
|
338
|
+
provided token is exported to the publish step's environment.
|
|
291
339
|
2. Go to `https://crates.io/crates/<crate>/settings` → **Trusted Publishing**
|
|
292
340
|
→ **Add**.
|
|
293
341
|
3. Fill in: your repo owner, your repo name, workflow filename
|
|
294
342
|
(`release.yml`), environment (optional).
|
|
343
|
+
4. Drop the `CARGO_REGISTRY_TOKEN` secret from the workflow once
|
|
344
|
+
Trusted Publishing is registered; subsequent publishes are
|
|
345
|
+
zero-secret on the OIDC path.
|
|
295
346
|
|
|
296
347
|
### PyPI
|
|
297
348
|
|
package/dist/error-codes.d.ts
CHANGED
|
@@ -29,6 +29,13 @@ export declare const ErrorCodes: {
|
|
|
29
29
|
* prevent this from being reached; if it fires, the gate was
|
|
30
30
|
* bypassed or the engine is inconsistent. */
|
|
31
31
|
readonly PUBLISH_EMPTY_PLAN: "PIOT_PUBLISH_EMPTY_PLAN";
|
|
32
|
+
/** An npm package's `package.json` is missing a non-empty
|
|
33
|
+
* `repository` field. `npm publish --provenance` (the OIDC
|
|
34
|
+
* trusted-publisher path) requires it so the registry can verify
|
|
35
|
+
* the artifact was built from the repo the trusted publisher
|
|
36
|
+
* declares. Failing at preflight prevents wasting a build run on
|
|
37
|
+
* a precondition checkable in milliseconds. #280. */
|
|
38
|
+
readonly NPM_MISSING_REPOSITORY: "PIOT_NPM_MISSING_REPOSITORY";
|
|
32
39
|
};
|
|
33
40
|
export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
|
|
34
41
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;
|
|
1
|
+
{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;IAE9C;;;;;0DAKsD;;CAE9C,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EAI/C,CAAC"}
|
package/dist/error-codes.js
CHANGED
|
@@ -29,6 +29,13 @@ export const ErrorCodes = {
|
|
|
29
29
|
* prevent this from being reached; if it fires, the gate was
|
|
30
30
|
* bypassed or the engine is inconsistent. */
|
|
31
31
|
PUBLISH_EMPTY_PLAN: 'PIOT_PUBLISH_EMPTY_PLAN',
|
|
32
|
+
/** An npm package's `package.json` is missing a non-empty
|
|
33
|
+
* `repository` field. `npm publish --provenance` (the OIDC
|
|
34
|
+
* trusted-publisher path) requires it so the registry can verify
|
|
35
|
+
* the artifact was built from the repo the trusted publisher
|
|
36
|
+
* declares. Failing at preflight prevents wasting a build run on
|
|
37
|
+
* a precondition checkable in milliseconds. #280. */
|
|
38
|
+
NPM_MISSING_REPOSITORY: 'PIOT_NPM_MISSING_REPOSITORY',
|
|
32
39
|
};
|
|
33
40
|
/**
|
|
34
41
|
* Iterable form of the codes. Walked by tests for uniqueness/format
|
|
@@ -37,5 +44,6 @@ export const ErrorCodes = {
|
|
|
37
44
|
export const ALL_ERROR_CODES = [
|
|
38
45
|
ErrorCodes.AUTH_NO_TOKEN,
|
|
39
46
|
ErrorCodes.PUBLISH_EMPTY_PLAN,
|
|
47
|
+
ErrorCodes.NPM_MISSING_REPOSITORY,
|
|
40
48
|
];
|
|
41
49
|
//# sourceMappingURL=error-codes.js.map
|
package/dist/error-codes.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;
|
|
1
|
+
{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;IAC7C;;;;;0DAKsD;IACtD,sBAAsB,EAAE,6BAA6B;CAC7C,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,UAAU,CAAC,aAAa;IACxB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,sBAAsB;CAClC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAA6B,KAAK,OAAO,EAAwC,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAA6B,KAAK,OAAO,EAAwC,MAAM,aAAa,CAAC;AAgN5G;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBvE;AAYD,eAAO,MAAM,GAAG,EAAE,OAKjB,CAAC"}
|
package/dist/handlers/npm.js
CHANGED
|
@@ -13,6 +13,7 @@ import { join } from 'node:path';
|
|
|
13
13
|
import { normalizeTarget } from '../types.js';
|
|
14
14
|
import { looksLikePublishOverRace, normalizeBuild, publishPlatforms, } from './npm-platform.js';
|
|
15
15
|
import { buildSubprocessEnv, nonEmpty } from '../env.js';
|
|
16
|
+
import { ErrorCodes } from '../error-codes.js';
|
|
16
17
|
import { USER_AGENT } from '../version.js';
|
|
17
18
|
function npmNameFor(pkg) {
|
|
18
19
|
return pkg.npm ?? pkg.name;
|
|
@@ -88,9 +89,12 @@ async function publishImpl(pkg, version, ctx) {
|
|
|
88
89
|
}
|
|
89
90
|
const hasOidc = Boolean(nonEmpty(ctx.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) ??
|
|
90
91
|
nonEmpty(process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN));
|
|
91
|
-
// npm provenance requires a `repository` field in
|
|
92
|
-
// that matches the git remote.
|
|
93
|
-
//
|
|
92
|
+
// npm provenance requires a non-empty `repository` field in
|
|
93
|
+
// package.json that matches the git remote. The primary check is
|
|
94
|
+
// `requireProvenanceMetadata` in src/preflight.ts (#280), which
|
|
95
|
+
// runs before any runner work. This inline assertion is a
|
|
96
|
+
// defensive backstop for direct handler calls that bypass the
|
|
97
|
+
// publish pipeline.
|
|
94
98
|
if (hasOidc) {
|
|
95
99
|
assertRepositoryField(pkg.path);
|
|
96
100
|
}
|
|
@@ -150,8 +154,23 @@ function assertRepositoryField(path) {
|
|
|
150
154
|
const pkgJsonPath = join(path, 'package.json');
|
|
151
155
|
const raw = readFileSync(pkgJsonPath, 'utf8');
|
|
152
156
|
const pkg = JSON.parse(raw);
|
|
153
|
-
|
|
154
|
-
|
|
157
|
+
const repository = pkg.repository;
|
|
158
|
+
// Accept either the canonical object form (`{ type, url, … }`) or
|
|
159
|
+
// the legacy single-string form. Both shapes must carry a non-empty
|
|
160
|
+
// URL after trimming. `!pkg.repository` would pass `{}` and
|
|
161
|
+
// `{ type: 'git' }` since both are truthy — that's the bug #280
|
|
162
|
+
// is closing.
|
|
163
|
+
let ok = false;
|
|
164
|
+
if (typeof repository === 'string') {
|
|
165
|
+
ok = repository.trim().length > 0;
|
|
166
|
+
}
|
|
167
|
+
else if (repository !== null && typeof repository === 'object') {
|
|
168
|
+
const url = repository.url;
|
|
169
|
+
ok = typeof url === 'string' && url.trim().length > 0;
|
|
170
|
+
}
|
|
171
|
+
if (!ok) {
|
|
172
|
+
throw new Error(`[${ErrorCodes.NPM_MISSING_REPOSITORY}] npm publish --provenance requires a non-empty \`repository\` field in ${pkgJsonPath}. ` +
|
|
173
|
+
'See https://github.com/thekevinscott/putitoutthere#kind--npm.');
|
|
155
174
|
}
|
|
156
175
|
}
|
|
157
176
|
/** Heuristic match on npm's auth-related stderr shapes. */
|
package/dist/handlers/npm.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAgE,MAAM,aAAa,CAAC;AAC5G,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAmB3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAS;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC/D,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,YAAY;YACnB,iEAAiE;YACjE,kEAAkE;YAClE,6DAA6D;YAC7D,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAC3D,CAAC;QACF,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CACvD,CAAC;IAEF
|
|
1
|
+
{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAgE,MAAM,aAAa,CAAC;AAC5G,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAmB3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAS;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC/D,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,YAAY;YACnB,iEAAiE;YACjE,kEAAkE;YAClE,6DAA6D;YAC7D,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAC3D,CAAC;QACF,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CACvD,CAAC;IAEF,4DAA4D;IAC5D,iEAAiE;IACjE,gEAAgE;IAChE,0DAA0D;IAC1D,8DAA8D;IAC9D,oBAAoB;IACpB,IAAI,OAAO,EAAE,CAAC;QACZ,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;IACtC,MAAM,IAAI,GAAa,CAAC,SAAS,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,gEAAgE;YAChE,2CAA2C;YAC3C,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,GAAG,EAAE,iCAAiC,IAAI,MAAM,OAAO,EAAE;aAC1D,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,kCAAkC;QAClC,IAAI,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb;oBACE,yBAAyB,IAAI,6CAA6C;oBAC1E,6DAA6D;oBAC7D,+GAA+G;iBAChH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,iCAAiC,UAAU,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,kEAAkE;IAClE,oEAAoE;IACpE,4DAA4D;IAC5D,gEAAgE;IAChE,cAAc;IACd,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,GAAG,GAAI,UAAgC,CAAC,GAAG,CAAC;QAClD,EAAE,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,sBAAsB,2EAA2E,WAAW,IAAI;YAC7H,+DAA+D,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,qFAAqF,CAAC,IAAI,CAC/F,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,IAAI,CAAC;QACH,mEAAmE;QACnE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAC/E;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CACF,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,gEAAgE;QAChE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,0GAA0G;IAC1G,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAY;IAC1B,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,WAAW;CACrB,CAAC"}
|
package/dist/preflight.d.ts
CHANGED
|
@@ -1,17 +1,24 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Pre-flight
|
|
3
|
-
* every cascaded package has usable credentials.
|
|
2
|
+
* Pre-flight checks. Run before any publish side effect.
|
|
4
3
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
* OIDC
|
|
8
|
-
*
|
|
4
|
+
* Auth (`requireAuth` / `checkAuth`) — every cascaded package has a
|
|
5
|
+
* viable credentials path. Per plan.md §16.3: each handler accepts
|
|
6
|
+
* OIDC (detected by `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific
|
|
7
|
+
* long-lived env var.
|
|
9
8
|
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
9
|
+
* npm provenance metadata (`requireProvenanceMetadata` /
|
|
10
|
+
* `checkProvenanceMetadata`) — every npm package's `package.json`
|
|
11
|
+
* carries a non-empty `repository` field. `npm publish --provenance`
|
|
12
|
+
* (the OIDC trusted-publisher path) hard-requires this; failing
|
|
13
|
+
* here, before runner work, beats failing deep inside the npm CLI
|
|
14
|
+
* after artifact upload + OIDC negotiation. #280.
|
|
13
15
|
*
|
|
14
|
-
*
|
|
16
|
+
* Each function reports; callers decide whether to throw. The
|
|
17
|
+
* `require*` variants are the publish path; the `check*` variants
|
|
18
|
+
* exist so future diagnostic surfaces can render tables instead of
|
|
19
|
+
* aborting.
|
|
20
|
+
*
|
|
21
|
+
* Issue #14, #280.
|
|
15
22
|
*/
|
|
16
23
|
import type { Package } from './config.js';
|
|
17
24
|
import type { Kind } from './types.js';
|
|
@@ -30,4 +37,38 @@ export interface AuthStatus {
|
|
|
30
37
|
}
|
|
31
38
|
export declare function checkAuth(packages: readonly Package[]): AuthStatus;
|
|
32
39
|
export declare function requireAuth(packages: readonly Package[]): void;
|
|
40
|
+
export interface ProvenanceFinding {
|
|
41
|
+
package: string;
|
|
42
|
+
/** Pkg-relative `package.json` path examined. */
|
|
43
|
+
packageJsonPath: string;
|
|
44
|
+
/** Why the field is unusable: missing entirely, or empty/no-url. */
|
|
45
|
+
reason: 'missing' | 'empty';
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Scan every npm package's `package.json` for a non-empty `repository`
|
|
49
|
+
* field. Returns the list of findings; an empty list means every npm
|
|
50
|
+
* package is well-formed.
|
|
51
|
+
*
|
|
52
|
+
* `repository` is accepted in either the canonical object form
|
|
53
|
+
* (`{ type, url, directory? }`) or the legacy single-string form
|
|
54
|
+
* (`"git+https://…"`). The string form must be non-empty after
|
|
55
|
+
* trimming; the object form must carry a non-empty `url`.
|
|
56
|
+
*
|
|
57
|
+
* Non-npm packages and a malformed `package.json` (parse error) are
|
|
58
|
+
* skipped — other parts of the pipeline already cover those failure
|
|
59
|
+
* modes; this check is scoped to the `repository` field alone.
|
|
60
|
+
*/
|
|
61
|
+
export declare function checkProvenanceMetadata(packages: readonly Package[]): ProvenanceFinding[];
|
|
62
|
+
/**
|
|
63
|
+
* Throw with an actionable error when any npm package's `package.json`
|
|
64
|
+
* lacks a non-empty `repository` field. Reports every failing package
|
|
65
|
+
* in one error rather than failing on the first, so consumers fix
|
|
66
|
+
* them all in one round-trip.
|
|
67
|
+
*
|
|
68
|
+
* Always runs (not OIDC-gated): the README demands the field for
|
|
69
|
+
* every npm publish, and `npm publish --provenance` is putitoutthere's
|
|
70
|
+
* blessed publish mode. Even on the token path, missing `repository`
|
|
71
|
+
* is a misconfiguration — fail fast.
|
|
72
|
+
*/
|
|
73
|
+
export declare function requireProvenanceMetadata(packages: readonly Package[]): void;
|
|
33
74
|
//# sourceMappingURL=preflight.d.ts.map
|
package/dist/preflight.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAqBvC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAClC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAgBlE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAiB9D;AAcD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAC3B,iBAAiB,EAAE,CA0BrB;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CA8B5E"}
|
package/dist/preflight.js
CHANGED
|
@@ -1,18 +1,28 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Pre-flight
|
|
3
|
-
* every cascaded package has usable credentials.
|
|
2
|
+
* Pre-flight checks. Run before any publish side effect.
|
|
4
3
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
* OIDC
|
|
8
|
-
*
|
|
4
|
+
* Auth (`requireAuth` / `checkAuth`) — every cascaded package has a
|
|
5
|
+
* viable credentials path. Per plan.md §16.3: each handler accepts
|
|
6
|
+
* OIDC (detected by `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific
|
|
7
|
+
* long-lived env var.
|
|
9
8
|
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
9
|
+
* npm provenance metadata (`requireProvenanceMetadata` /
|
|
10
|
+
* `checkProvenanceMetadata`) — every npm package's `package.json`
|
|
11
|
+
* carries a non-empty `repository` field. `npm publish --provenance`
|
|
12
|
+
* (the OIDC trusted-publisher path) hard-requires this; failing
|
|
13
|
+
* here, before runner work, beats failing deep inside the npm CLI
|
|
14
|
+
* after artifact upload + OIDC negotiation. #280.
|
|
13
15
|
*
|
|
14
|
-
*
|
|
16
|
+
* Each function reports; callers decide whether to throw. The
|
|
17
|
+
* `require*` variants are the publish path; the `check*` variants
|
|
18
|
+
* exist so future diagnostic surfaces can render tables instead of
|
|
19
|
+
* aborting.
|
|
20
|
+
*
|
|
21
|
+
* Issue #14, #280.
|
|
15
22
|
*/
|
|
23
|
+
import { readFileSync } from 'node:fs';
|
|
24
|
+
import { join } from 'node:path';
|
|
25
|
+
import { ErrorCodes } from './error-codes.js';
|
|
16
26
|
// Per-kind accepted env var names, primary first. `checkAuth` scans left
|
|
17
27
|
// to right and reports the first that has a non-empty value. npm takes
|
|
18
28
|
// two names because ecosystems have split on the convention:
|
|
@@ -67,4 +77,88 @@ export function requireAuth(packages) {
|
|
|
67
77
|
function nonEmpty(v) {
|
|
68
78
|
return typeof v === 'string' && v.trim().length > 0;
|
|
69
79
|
}
|
|
80
|
+
/* ----------------------- npm provenance metadata ----------------------- */
|
|
81
|
+
// Anchor for the README section that documents the field requirement.
|
|
82
|
+
// Surfaced verbatim in the thrown error so users have something
|
|
83
|
+
// actionable to follow rather than a code-search target.
|
|
84
|
+
const REPOSITORY_DOC_POINTER = 'https://github.com/thekevinscott/putitoutthere#kind--npm';
|
|
85
|
+
/**
|
|
86
|
+
* Scan every npm package's `package.json` for a non-empty `repository`
|
|
87
|
+
* field. Returns the list of findings; an empty list means every npm
|
|
88
|
+
* package is well-formed.
|
|
89
|
+
*
|
|
90
|
+
* `repository` is accepted in either the canonical object form
|
|
91
|
+
* (`{ type, url, directory? }`) or the legacy single-string form
|
|
92
|
+
* (`"git+https://…"`). The string form must be non-empty after
|
|
93
|
+
* trimming; the object form must carry a non-empty `url`.
|
|
94
|
+
*
|
|
95
|
+
* Non-npm packages and a malformed `package.json` (parse error) are
|
|
96
|
+
* skipped — other parts of the pipeline already cover those failure
|
|
97
|
+
* modes; this check is scoped to the `repository` field alone.
|
|
98
|
+
*/
|
|
99
|
+
export function checkProvenanceMetadata(packages) {
|
|
100
|
+
const findings = [];
|
|
101
|
+
for (const p of packages) {
|
|
102
|
+
if (p.kind !== 'npm')
|
|
103
|
+
continue;
|
|
104
|
+
const pkgJsonPath = join(p.path, 'package.json');
|
|
105
|
+
let raw;
|
|
106
|
+
try {
|
|
107
|
+
raw = readFileSync(pkgJsonPath, 'utf8');
|
|
108
|
+
}
|
|
109
|
+
catch {
|
|
110
|
+
findings.push({ package: p.name, packageJsonPath: pkgJsonPath, reason: 'missing' });
|
|
111
|
+
continue;
|
|
112
|
+
}
|
|
113
|
+
let parsed;
|
|
114
|
+
try {
|
|
115
|
+
parsed = JSON.parse(raw);
|
|
116
|
+
}
|
|
117
|
+
catch {
|
|
118
|
+
// A malformed package.json is a different failure surface;
|
|
119
|
+
// leave it to the publish step to bubble up. This check only
|
|
120
|
+
// owns the `repository` field.
|
|
121
|
+
continue;
|
|
122
|
+
}
|
|
123
|
+
if (!hasNonEmptyRepository(parsed.repository)) {
|
|
124
|
+
findings.push({ package: p.name, packageJsonPath: pkgJsonPath, reason: 'empty' });
|
|
125
|
+
}
|
|
126
|
+
}
|
|
127
|
+
return findings;
|
|
128
|
+
}
|
|
129
|
+
function hasNonEmptyRepository(value) {
|
|
130
|
+
if (typeof value === 'string')
|
|
131
|
+
return value.trim().length > 0;
|
|
132
|
+
if (value !== null && typeof value === 'object') {
|
|
133
|
+
const url = value.url;
|
|
134
|
+
return typeof url === 'string' && url.trim().length > 0;
|
|
135
|
+
}
|
|
136
|
+
return false;
|
|
137
|
+
}
|
|
138
|
+
/**
|
|
139
|
+
* Throw with an actionable error when any npm package's `package.json`
|
|
140
|
+
* lacks a non-empty `repository` field. Reports every failing package
|
|
141
|
+
* in one error rather than failing on the first, so consumers fix
|
|
142
|
+
* them all in one round-trip.
|
|
143
|
+
*
|
|
144
|
+
* Always runs (not OIDC-gated): the README demands the field for
|
|
145
|
+
* every npm publish, and `npm publish --provenance` is putitoutthere's
|
|
146
|
+
* blessed publish mode. Even on the token path, missing `repository`
|
|
147
|
+
* is a misconfiguration — fail fast.
|
|
148
|
+
*/
|
|
149
|
+
export function requireProvenanceMetadata(packages) {
|
|
150
|
+
const findings = checkProvenanceMetadata(packages);
|
|
151
|
+
if (findings.length === 0)
|
|
152
|
+
return;
|
|
153
|
+
const lines = [
|
|
154
|
+
`[${ErrorCodes.NPM_MISSING_REPOSITORY}] npm publish requires a non-empty \`repository\` field in package.json.`,
|
|
155
|
+
'',
|
|
156
|
+
'Failing packages:',
|
|
157
|
+
];
|
|
158
|
+
for (const f of findings) {
|
|
159
|
+
lines.push(` - ${f.package}: ${f.packageJsonPath} (${f.reason})`);
|
|
160
|
+
}
|
|
161
|
+
lines.push('', 'Why: `npm publish --provenance` (used by putitoutthere on the OIDC trusted-publisher', 'path) hard-requires this field so npm can verify the package was built from the repo', 'the trusted publisher declares.', '', 'Fix: add a `repository` block to each failing package.json. Canonical shape:', '', ' {', ' "repository": {', ' "type": "git",', ' "url": "git+https://github.com/<owner>/<repo>.git",', ' "directory": "<path/to/package>"', ' }', ' }', '', `See ${REPOSITORY_DOC_POINTER}.`);
|
|
162
|
+
throw new Error(lines.join('\n'));
|
|
163
|
+
}
|
|
70
164
|
//# sourceMappingURL=preflight.js.map
|
package/dist/preflight.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,kEAAkE;AAClE,yDAAyD;AACzD,uEAAuE;AACvE,uCAAuC;AACvC,MAAM,SAAS,GAAoC;IACjD,MAAM,EAAE,CAAC,sBAAsB,CAAC;IAChC,IAAI,EAAE,CAAC,gBAAgB,CAAC;IACxB,GAAG,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;CACtC,CAAC;AAEF,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,uEAAuE;AACvE,UAAU;AACV,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAiBhF,MAAM,UAAU,SAAS,CAAC,QAA4B;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAW,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,IAAI,iBAAiB,QAAQ,GAAG,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb;QACE,+BAA+B;QAC/B,GAAG,KAAK;QACR,EAAE;QACF,mFAAmF;QACnF,OAAO,YAAY,GAAG;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,6EAA6E;AAE7E,sEAAsE;AACtE,gEAAgE;AAChE,yDAAyD;AACzD,MAAM,sBAAsB,GAC1B,0DAA0D,CAAC;AAU7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA4B;IAE5B,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,6DAA6D;YAC7D,+BAA+B;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA4B;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,KAAK,GAAa;QACtB,IAAI,UAAU,CAAC,sBAAsB,0EAA0E;QAC/G,EAAE;QACF,mBAAmB;KACpB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,sFAAsF,EACtF,sFAAsF,EACtF,iCAAiC,EACjC,EAAE,EACF,8EAA8E,EAC9E,EAAE,EACF,KAAK,EACL,qBAAqB,EACrB,sBAAsB,EACtB,2DAA2D,EAC3D,wCAAwC,EACxC,OAAO,EACP,KAAK,EACL,EAAE,EACF,OAAO,sBAAsB,GAAG,CACjC,CAAC;IACF,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}
|
package/dist/publish.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,
|
|
1
|
+
{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAyI1E"}
|
package/dist/publish.js
CHANGED
|
@@ -24,7 +24,7 @@ import { handlerFor as defaultHandlerFor } from './handlers/index.js';
|
|
|
24
24
|
import { createLogger } from './log.js';
|
|
25
25
|
import { plan } from './plan.js';
|
|
26
26
|
import { formatTag } from './tag-template.js';
|
|
27
|
-
import { requireAuth } from './preflight.js';
|
|
27
|
+
import { requireAuth, requireProvenanceMetadata } from './preflight.js';
|
|
28
28
|
import { withRetry } from './retry.js';
|
|
29
29
|
import { readHandlerMeta } from './types.js';
|
|
30
30
|
import { dumpFailure } from './verbose.js';
|
|
@@ -66,6 +66,11 @@ export async function publish(opts) {
|
|
|
66
66
|
// auth path (OIDC env or env-var token) before any side effects.
|
|
67
67
|
const selectedPackages = [...perPackage.keys()].map((name) => mustGet(config.packages, name));
|
|
68
68
|
requireAuth(selectedPackages);
|
|
69
|
+
// 2b. Pre-flight npm provenance metadata: every selected npm package's
|
|
70
|
+
// package.json must carry a non-empty `repository` field. Without
|
|
71
|
+
// it, `npm publish --provenance` fails deep inside the npm CLI
|
|
72
|
+
// after the runner has spun up — checkable in milliseconds. #280.
|
|
73
|
+
requireProvenanceMetadata(selectedPackages);
|
|
69
74
|
// 3. Artifact completeness.
|
|
70
75
|
const completeness = checkCompleteness(matrix, artifactsRoot(cwd));
|
|
71
76
|
const incomplete = [...completeness.entries()].filter(([, r]) => !r.ok);
|
package/dist/publish.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,kBAAkB,+CAA+C;YAChF,8DAA8D;YAC9D,6EAA6E;YAC7E,+EAA+E;YAC/E,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,8DAA8D;YAC9D,8DAA8D;YAC9D,iDAAiD;YACjD,mBAAmB,EAAE,MAAM,CAAC,QAAQ;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}
|