putitoutthere 0.3.26 → 0.3.27

package/dist/verify/bundle-cli/read-python-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-python-source.js","sourceRoot":"","sources":["../../../src/verify/bundle-cli/read-python-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAMxD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAgC,CAAC;IACxF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,OAAO,EAAE,aAAa,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"read-python-source.js","sourceRoot":"","sources":["../../../src/verify/bundle-cli/read-python-source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAMxD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAgC,CAAC;IACxF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,OAAO,EAAE,aAAa,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/verify/crate/find-crate-file.d.ts

@@ -1,12 +1,8 @@
 /**
  * The path to a non-empty `<name>-<version>.crate` under `registryRoot`, or
  * null when none exists (or the only match is empty) (#449).
- *
- * The synchronous analogue of the bash
- * `find "$REG_ROOT" -name "${name}-${version}.crate" -type f -print -quit`
- * followed by the `[ -z … ] || [ ! -s … ]` non-empty guard. `cargo-http-
- * registry` stores `.crate` files nested under the root, so the search
- * recurses.
+ * `cargo-http-registry` stores `.crate` files nested under the root, so the
+ * search recurses.
  */
 export declare function findCrateFile(registryRoot: string, name: string, version: string): Promise<string | null>;
 //# sourceMappingURL=find-crate-file.d.ts.map

package/dist/verify/crate/find-crate-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find-crate-file.d.ts","sourceRoot":"","sources":["../../../src/verify/crate/find-crate-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB"}
+{"version":3,"file":"find-crate-file.d.ts","sourceRoot":"","sources":["../../../src/verify/crate/find-crate-file.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB"}

package/dist/verify/crate/find-crate-file.js

@@ -1,12 +1,8 @@
 /**
  * The path to a non-empty `<name>-<version>.crate` under `registryRoot`, or
  * null when none exists (or the only match is empty) (#449).
- *
- * The synchronous analogue of the bash
- * `find "$REG_ROOT" -name "${name}-${version}.crate" -type f -print -quit`
- * followed by the `[ -z … ] || [ ! -s … ]` non-empty guard. `cargo-http-
- * registry` stores `.crate` files nested under the root, so the search
- * recurses.
+ * `cargo-http-registry` stores `.crate` files nested under the root, so the
+ * search recurses.
  */
 import { stat } from 'node:fs/promises';
 import { basename } from 'node:path';

package/dist/verify/crate/find-crate-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"find-crate-file.js","sourceRoot":"","sources":["../../../src/verify/crate/find-crate-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAoB,EACpB,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,QAAQ,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"find-crate-file.js","sourceRoot":"","sources":["../../../src/verify/crate/find-crate-file.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAoB,EACpB,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,QAAQ,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/crate/has-crate-source.d.ts

@@ -1,10 +1,8 @@
 /**
  * Whether the extracted crate tree surfaces `src/lib.rs` or `src/main.rs`
- * (#449). cargo packs into `<name>-<version>/{Cargo.toml,src/…}`, so any
- * file path ending in `/src/lib.rs` or `/src/main.rs` counts — the
- * analogue of the bash `find … -path` check on those two source entries.
- * This is the crates-side of the npm verify's "files[] dir is populated"
- * check: proof the publish shipped the source tree, not an empty tarball.
+ * (#449). cargo packs into `<name>-<version>/{Cargo.toml,src/…}`, so any path
+ * ending `/src/lib.rs` or `/src/main.rs` counts. This is proof the publish
+ * shipped the source tree, not an empty tarball.
  */
 export declare function hasCrateSource(dir: string): Promise<boolean>;
 //# sourceMappingURL=has-crate-source.d.ts.map

package/dist/verify/crate/has-crate-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"has-crate-source.d.ts","sourceRoot":"","sources":["../../../src/verify/crate/has-crate-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASlE"}
+{"version":3,"file":"has-crate-source.d.ts","sourceRoot":"","sources":["../../../src/verify/crate/has-crate-source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASlE"}

package/dist/verify/crate/has-crate-source.js

@@ -1,10 +1,8 @@
 /**
  * Whether the extracted crate tree surfaces `src/lib.rs` or `src/main.rs`
- * (#449). cargo packs into `<name>-<version>/{Cargo.toml,src/…}`, so any
- * file path ending in `/src/lib.rs` or `/src/main.rs` counts — the
- * analogue of the bash `find … -path` check on those two source entries.
- * This is the crates-side of the npm verify's "files[] dir is populated"
- * check: proof the publish shipped the source tree, not an empty tarball.
+ * (#449). cargo packs into `<name>-<version>/{Cargo.toml,src/…}`, so any path
+ * ending `/src/lib.rs` or `/src/main.rs` counts. This is proof the publish
+ * shipped the source tree, not an empty tarball.
  */
 import { basename, dirname } from 'node:path';
 import { listFilesRecursive } from '../../utils/list-files-recursive.js';

package/dist/verify/crate/has-crate-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"has-crate-source.js","sourceRoot":"","sources":["../../../src/verify/crate/has-crate-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,8DAA8D;IAC9D,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,OAAO,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"has-crate-source.js","sourceRoot":"","sources":["../../../src/verify/crate/has-crate-source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,8DAA8D;IAC9D,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,OAAO,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/verify/crate/index.d.ts

@@ -1,20 +1,8 @@
 /**
- * `putitoutthere verify crate` — assert each published `.crate` ships its
- * source tree (#449, epic #442).
- *
- * Extraction of the inline "Verify published .crate tarballs honor expected
- * files" bash block (#334) in `.github/workflows/e2e-fixture-job.yml`. The
- * crates-side sibling of `verify npm-tarball` (#443): where npm downloads
- * the tarball over HTTP, crates reads the `.crate` straight off the
- * `cargo-http-registry` disk root the engine just published to — same host,
- * same job, no fetch. For each crates row it finds `<name>-<version>.crate`
- * under the registry root, asserts it is present and non-empty, extracts it
- * with the real `tar`, and asserts `src/lib.rs` or `src/main.rs` surfaces.
- *
- * The diagnostic this gate gives (the rust-vanilla-first-publish fixture):
- * without it, a publish that silently no-op'd or produced an empty `.crate`
- * would still go green. Async throughout, per the engine convention.
- * Returns the process exit code (0 ok, 1 on any miss).
+ * `putitoutthere verify crate` — assert each published `.crate` ships its source
+ * tree (#449, #334): read it off the `cargo-http-registry` disk root just
+ * published to (no fetch, unlike `verify npm-tarball`, #443), extract with real
+ * `tar`, assert `src/lib.rs` or `src/main.rs`. An empty `.crate` would go green.
  */
 import type { VerifyCrateOptions } from './types.js';
 export declare function verifyCrate(opts: VerifyCrateOptions): Promise<number>;

package/dist/verify/crate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/verify/crate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,KAAK,EAAY,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/verify/crate/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAY,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B3E"}

package/dist/verify/crate/index.js

@@ -1,20 +1,8 @@
 /**
- * `putitoutthere verify crate` — assert each published `.crate` ships its
- * source tree (#449, epic #442).
- *
- * Extraction of the inline "Verify published .crate tarballs honor expected
- * files" bash block (#334) in `.github/workflows/e2e-fixture-job.yml`. The
- * crates-side sibling of `verify npm-tarball` (#443): where npm downloads
- * the tarball over HTTP, crates reads the `.crate` straight off the
- * `cargo-http-registry` disk root the engine just published to — same host,
- * same job, no fetch. For each crates row it finds `<name>-<version>.crate`
- * under the registry root, asserts it is present and non-empty, extracts it
- * with the real `tar`, and asserts `src/lib.rs` or `src/main.rs` surfaces.
- *
- * The diagnostic this gate gives (the rust-vanilla-first-publish fixture):
- * without it, a publish that silently no-op'd or produced an empty `.crate`
- * would still go green. Async throughout, per the engine convention.
- * Returns the process exit code (0 ok, 1 on any miss).
+ * `putitoutthere verify crate` — assert each published `.crate` ships its source
+ * tree (#449, #334): read it off the `cargo-http-registry` disk root just
+ * published to (no fetch, unlike `verify npm-tarball`, #443), extract with real
+ * `tar`, assert `src/lib.rs` or `src/main.rs`. An empty `.crate` would go green.
  */
 import { rm } from 'node:fs/promises';
 import { extractCrate } from './extract-crate.js';

package/dist/verify/crate/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/verify/crate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,2CAA2C,IAAI,CAAC,YAAY,IAAI,CACrG,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,SAAS,uCAAuC,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,0EAA0E,OAAO,IAAI,CAC1H,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/verify/crate/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,2CAA2C,IAAI,CAAC,YAAY,IAAI,CACrG,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,SAAS,uCAAuC,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,0EAA0E,OAAO,IAAI,CAC1H,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/npm-tarball/download.d.ts

@@ -1,14 +1,8 @@
 /**
- * Download a published npm tarball and extract it, returning the path to
- * the unpacked `package/` directory (#443).
- *
- * `curl --retry 5 --retry-all-errors` absorbs the tarball-blob CDN race
- * that is independent of the packument race `resolveNpmTarballUrl` handles:
- * a cold-edge tarball miss surfaces as HTTP 404, which curl's default
+ * Download a published npm tarball and extract it, returning the unpacked
+ * `package/` directory (#443). `curl --retry 5 --retry-all-errors` absorbs the
+ * tarball-blob CDN race: a cold-edge miss is an HTTP 404, which curl's default
  * `--retry` ignores, so `--retry-all-errors` is load-bearing (PR #323).
- * `retryDelay` seconds matches the call site's original schedule.
- *
- * Caller owns cleanup of the returned `root`.
  */
 export interface ExtractedTarball {
     /** Temp dir to `rm` when done. */

package/dist/verify/npm-tarball/download.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAUnG"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/download.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAUnG"}

package/dist/verify/npm-tarball/download.js

@@ -1,14 +1,8 @@
 /**
- * Download a published npm tarball and extract it, returning the path to
- * the unpacked `package/` directory (#443).
- *
- * `curl --retry 5 --retry-all-errors` absorbs the tarball-blob CDN race
- * that is independent of the packument race `resolveNpmTarballUrl` handles:
- * a cold-edge tarball miss surfaces as HTTP 404, which curl's default
+ * Download a published npm tarball and extract it, returning the unpacked
+ * `package/` directory (#443). `curl --retry 5 --retry-all-errors` absorbs the
+ * tarball-blob CDN race: a cold-edge miss is an HTTP 404, which curl's default
  * `--retry` ignores, so `--retry-all-errors` is load-bearing (PR #323).
- * `retryDelay` seconds matches the call site's original schedule.
- *
- * Caller owns cleanup of the returned `root`.
  */
 import { mkdir, mkdtemp } from 'node:fs/promises';
 import { tmpdir } from 'node:os';

package/dist/verify/npm-tarball/download.js.map

@@ -1 +1 @@
-{"version":3,"file":"download.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAS1D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,UAAkB;IACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,WAAW,CAAC,MAAM,EAAE;QACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG;KACnG,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/download.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAS1D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,UAAkB;IACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,WAAW,CAAC,MAAM,EAAE;QACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG;KACnG,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/verify/npm-tarball/index.d.ts

@@ -1,17 +1,8 @@
 /**
- * `putitoutthere verify npm-tarball` — assert a published npm tarball
- * honors the shape it declared (#443, epic #442).
- *
- * Extraction of the two inline bash blocks in
- * `.github/workflows/e2e-fixture-job.yml` into one tested engine command,
- * invoked from both former sites. Default mode verifies main/noarch
- * `package.json` `files[]` directories are present in the tarball;
- * `--per-triple` verifies synthesized platform packages ship a
- * non-`package.json` file.
- *
- * Reads the same plan matrix the workflow already carries; downloads each
- * tarball back from the registry (`npm view` → `curl` → `tar`) and inspects
- * it. Returns the process exit code (0 ok, 1 on any mismatch).
+ * `putitoutthere verify npm-tarball` — assert a published npm tarball honors the
+ * shape it declared (#443, epic #442). Default mode verifies the main/noarch
+ * `package.json` `files[]` dirs are in the tarball; `--per-triple` verifies a
+ * platform package ships a non-`package.json` file. Downloads each back.
  */
 import type { VerifyNpmTarballOptions } from './types.js';
 export declare function verifyNpmTarball(opts: VerifyNpmTarballOptions): Promise<number>;

package/dist/verify/npm-tarball/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAc,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAc,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrF"}

package/dist/verify/npm-tarball/index.js

@@ -1,17 +1,8 @@
 /**
- * `putitoutthere verify npm-tarball` — assert a published npm tarball
- * honors the shape it declared (#443, epic #442).
- *
- * Extraction of the two inline bash blocks in
- * `.github/workflows/e2e-fixture-job.yml` into one tested engine command,
- * invoked from both former sites. Default mode verifies main/noarch
- * `package.json` `files[]` directories are present in the tarball;
- * `--per-triple` verifies synthesized platform packages ship a
- * non-`package.json` file.
- *
- * Reads the same plan matrix the workflow already carries; downloads each
- * tarball back from the registry (`npm view` → `curl` → `tar`) and inspects
- * it. Returns the process exit code (0 ok, 1 on any mismatch).
+ * `putitoutthere verify npm-tarball` — assert a published npm tarball honors the
+ * shape it declared (#443, epic #442). Default mode verifies the main/noarch
+ * `package.json` `files[]` dirs are in the tarball; `--per-triple` verifies a
+ * platform package ships a non-`package.json` file. Downloads each back.
  */
 import { verifyNpmTarballMain } from './main.js';
 import { verifyNpmTarballTriple } from './triple.js';

package/dist/verify/npm-tarball/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA6B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAiB,CAAC;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChG,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA6B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAiB,CAAC;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChG,CAAC"}

package/dist/verify/npm-tarball/local-dir-state.d.ts

@@ -1,12 +1,8 @@
 /**
- * Diagnostic string for a declared `files[]` directory that is missing
- * from a published tarball: is it present in the local source tree, and
- * with how many files? (#443)
- *
- * A present-locally-but-absent-in-tarball state is the fingerprint of the
- * cachetta 0.3.x bug — the build produced the dir, the publish shipped
- * without it. Absent locally points at a different misconfiguration. The
- * string is appended to the tarball-missing `::error::`.
+ * Diagnostic string for a declared `files[]` directory missing from a published
+ * tarball: is it present in the local source tree, and with how many files?
+ * (#443) Present-locally-but-absent-in-tarball is the cachetta 0.3.x
+ * fingerprint — the build produced the dir, the publish shipped without it.
  */
 export declare function localDirState(localPath: string): Promise<string>;
 //# sourceMappingURL=local-dir-state.d.ts.map

package/dist/verify/npm-tarball/local-dir-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-dir-state.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/local-dir-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtE"}
+{"version":3,"file":"local-dir-state.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/local-dir-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtE"}

package/dist/verify/npm-tarball/local-dir-state.js

@@ -1,12 +1,8 @@
 /**
- * Diagnostic string for a declared `files[]` directory that is missing
- * from a published tarball: is it present in the local source tree, and
- * with how many files? (#443)
- *
- * A present-locally-but-absent-in-tarball state is the fingerprint of the
- * cachetta 0.3.x bug — the build produced the dir, the publish shipped
- * without it. Absent locally points at a different misconfiguration. The
- * string is appended to the tarball-missing `::error::`.
+ * Diagnostic string for a declared `files[]` directory missing from a published
+ * tarball: is it present in the local source tree, and with how many files?
+ * (#443) Present-locally-but-absent-in-tarball is the cachetta 0.3.x
+ * fingerprint — the build produced the dir, the publish shipped without it.
  */
 import { stat } from 'node:fs/promises';
 import { listFilesRecursive } from '../../utils/list-files-recursive.js';

package/dist/verify/npm-tarball/local-dir-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-dir-state.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/local-dir-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,IAAI,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,SAAS,SAAS,cAAc,KAAK,CAAC,MAAM,cAAc,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtF,CAAC;IACD,OAAO,SAAS,SAAS,WAAW,CAAC;AACvC,CAAC"}
+{"version":3,"file":"local-dir-state.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/local-dir-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,IAAI,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,SAAS,SAAS,cAAc,KAAK,CAAC,MAAM,cAAc,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtF,CAAC;IACD,OAAO,SAAS,SAAS,WAAW,CAAC;AACvC,CAAC"}

package/dist/verify/npm-tarball/main.d.ts

@@ -1,18 +1,8 @@
 /**
- * Verify each published main/noarch npm tarball contains the directory
- * entries its `package.json` `files[]` declares (#443).
- *
- * The load-bearing check: the build job produces `dist/`, the publish job
- * ships from a fresh source tree, and `npm publish` returns 0 even when
- * that tree is missing the compiled output — so the registry receives a
- * tarball without `dist/` and nothing upstream complains. This step
- * downloads the published tarball back and asserts the declared dirs are
- * present and non-empty. Extracted verbatim from the "Verify published npm
- * tarballs honor package.json files" bash block.
- *
- * `files[]` entries without a dot are treated as directories (`dist`,
- * `lib`); dotted entries (`README.md`) are individual files and need no
- * per-tree assertion. Returns the process exit code (0 ok, 1 on any miss).
+ * Verify each published main/noarch npm tarball contains the directory entries
+ * its `package.json` `files[]` declares (#443) — `npm publish` returns 0 even
+ * when the tree it ships from lacks the compiled output. Dotless `files[]`
+ * entries are treated as directories; dotted ones are individual files.
  */
 import type { TarballRow, VerifyNpmTarballOptions } from './types.js';
 export declare function verifyNpmTarballMain(rows: TarballRow[], opts: VerifyNpmTarballOptions): Promise<number>;

package/dist/verify/npm-tarball/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAUH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,UAAU,EAAE,EAClB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA2DjB"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/main.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,UAAU,EAAE,EAClB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA2DjB"}

package/dist/verify/npm-tarball/main.js

@@ -1,18 +1,8 @@
 /**
- * Verify each published main/noarch npm tarball contains the directory
- * entries its `package.json` `files[]` declares (#443).
- *
- * The load-bearing check: the build job produces `dist/`, the publish job
- * ships from a fresh source tree, and `npm publish` returns 0 even when
- * that tree is missing the compiled output — so the registry receives a
- * tarball without `dist/` and nothing upstream complains. This step
- * downloads the published tarball back and asserts the declared dirs are
- * present and non-empty. Extracted verbatim from the "Verify published npm
- * tarballs honor package.json files" bash block.
- *
- * `files[]` entries without a dot are treated as directories (`dist`,
- * `lib`); dotted entries (`README.md`) are individual files and need no
- * per-tree assertion. Returns the process exit code (0 ok, 1 on any miss).
+ * Verify each published main/noarch npm tarball contains the directory entries
+ * its `package.json` `files[]` declares (#443) — `npm publish` returns 0 even
+ * when the tree it ships from lacks the compiled output. Dotless `files[]`
+ * entries are treated as directories; dotted ones are individual files.
  */
 import { readFile, rm, stat } from 'node:fs/promises';
 import { join } from 'node:path';

package/dist/verify/npm-tarball/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGxD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAkB,EAClB,IAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEjE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGnF,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,OAAO,gDAAgD,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,OAAO,IAAI,OAAO,0BAA0B,aAAa,cAAc,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAC9F,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,OAAO,IAAI,OAAO,iBAAiB,aAAa,uCAAuC,MAAM,CAAC,MAAM,GAAG,CAAC,iHAAiH,CACvO,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACnC,kEAAkE;YAClE,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtH,MAAM,KAAK,GAAG,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,OAAO,IAAI,OAAO,sBAAsB,CAAC,MAAM,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1G,CAAC;gBACF,IAAI,GAAG,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/main.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGxD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAkB,EAClB,IAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEjE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGnF,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,OAAO,gDAAgD,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,OAAO,IAAI,OAAO,0BAA0B,aAAa,cAAc,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAC9F,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,OAAO,IAAI,OAAO,iBAAiB,aAAa,uCAAuC,MAAM,CAAC,MAAM,GAAG,CAAC,iHAAiH,CACvO,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACnC,kEAAkE;YAClE,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtH,MAAM,KAAK,GAAG,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,OAAO,IAAI,OAAO,sBAAsB,CAAC,MAAM,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1G,CAAC;gBACF,IAAI,GAAG,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/npm-tarball/resolve-url.d.ts

@@ -1,16 +1,9 @@
 /**
  * Resolve a published package's tarball URL via `npm view … dist.tarball`,
- * absorbing packument lag with a bounded retry schedule (#443).
- *
- * `npm view`'s packument index propagates across the registry CDN
- * asynchronously, so an immediate read after publish can return empty
- * before the metadata lands. `sleeps` (seconds) drives the backoff: N
- * sleeps means N+1 attempts, no sleep after the last. Returns the tarball
- * URL, or `null` when every attempt came back empty — the caller emits the
- * mode-specific `::error::`.
- *
- * `npm view` is the sole subprocess; `--registry` (when set) is appended
- * after the positional args so it stays out of the `name@version` slot.
+ * absorbing packument lag with a bounded retry (#443): the packument index
+ * propagates across the registry CDN asynchronously, so an immediate read after
+ * publish can come back empty. N `sleeps` means N+1 attempts; `null` if all
+ * empty. `--registry` goes after the positional args, clear of `name@version`.
  */
 interface ResolveOptions {
     registry?: string | undefined;

package/dist/verify/npm-tarball/resolve-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-url.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/resolve-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,UAAU,cAAc;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB"}
+{"version":3,"file":"resolve-url.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/resolve-url.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,UAAU,cAAc;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB"}

package/dist/verify/npm-tarball/resolve-url.js

@@ -1,16 +1,9 @@
 /**
  * Resolve a published package's tarball URL via `npm view … dist.tarball`,
- * absorbing packument lag with a bounded retry schedule (#443).
- *
- * `npm view`'s packument index propagates across the registry CDN
- * asynchronously, so an immediate read after publish can return empty
- * before the metadata lands. `sleeps` (seconds) drives the backoff: N
- * sleeps means N+1 attempts, no sleep after the last. Returns the tarball
- * URL, or `null` when every attempt came back empty — the caller emits the
- * mode-specific `::error::`.
- *
- * `npm view` is the sole subprocess; `--registry` (when set) is appended
- * after the positional args so it stays out of the `name@version` slot.
+ * absorbing packument lag with a bounded retry (#443): the packument index
+ * propagates across the registry CDN asynchronously, so an immediate read after
+ * publish can come back empty. N `sleeps` means N+1 attempts; `null` if all
+ * empty. `--registry` goes after the positional args, clear of `name@version`.
  */
 import { execCapture } from '../../utils/exec-capture.js';
 async function viewTarballUrl(spec, registry) {

package/dist/verify/npm-tarball/resolve-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-url.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/resolve-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAO1D,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAiB;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,OAAe,EACf,IAAoB;IAEpB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,GAAG,EAAE,CAAC;YAAA,OAAO,GAAG,CAAC;QAAA,CAAC;QACtB,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qDAAqD,OAAO,IAAI,QAAQ,kBAAkB,IAAI,KAAK,CACpG,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"resolve-url.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/resolve-url.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAO1D,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAiB;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,OAAe,EACf,IAAoB;IAEpB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,GAAG,EAAE,CAAC;YAAA,OAAO,GAAG,CAAC;QAAA,CAAC;QACtB,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qDAAqD,OAAO,IAAI,QAAQ,kBAAkB,IAAI,KAAK,CACpG,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/npm-tarball/triple.d.ts

@@ -1,30 +1,8 @@
 /**
- * Verify each published per-triple npm tarball ships a synthesized binary,
- * not just metadata (#443).
- *
- * `npm-platform`'s `synthesizePlatformPackage` emits `files: <readdir of
- * the artifact dir>`, so an empty artifact dir yields a tarball with only
- * `package.json` and `npm publish` still returns 0. This step downloads the
- * published platform tarball back and asserts at least one non-`package.json`
- * file is present — shipping that binary is the whole point of the
- * synthesis. Extracted verbatim from the "Verify published per-triple npm
- * tarballs honor expected files" bash block.
- *
- * The count is RECURSIVE (#633). A consumer whose build stages the binary
- * nested — `artifacts/<name>-<triple>/bin/<binary>` rather than flat —
- * publishes a tarball whose top level is `package.json` plus the `bin/`
- * directory, and a top-level file count discards that directory along with
- * the payload inside it. The nested layout is legal all the way to publish
- * (`checkCompleteness` lists recursively, so it accepts either shape), so
- * this check has to see it too. Paths are reported relative to `package/`,
- * which is what makes a nested payload legible in the log. One walk decides
- * the verdict, so the failure message can no longer name a file the verdict
- * called absent.
- *
- * The platform package name is reconstructed as `{name}-{triple}` — the
- * default template every fixture uses — because the matrix row carries the
- * main package name (synthesis is a publish-time concern). Returns the
- * process exit code (0 ok, 1 on any metadata-only tarball).
+ * Verify each published per-triple npm tarball ships a synthesized binary, not
+ * just metadata (#443): an empty artifact dir yields a `package.json`-only
+ * tarball and `npm publish` still returns 0. The count is RECURSIVE (#633) — a
+ * nested `bin/<binary>` layout is legal to publish, and a flat count misses it.
  */
 import type { TarballRow, VerifyNpmTarballOptions } from './types.js';
 export declare function verifyNpmTarballTriple(rows: TarballRow[], opts: VerifyNpmTarballOptions): Promise<number>;

package/dist/verify/npm-tarball/triple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"triple.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AASH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,UAAU,EAAE,EAClB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+CjB"}
+{"version":3,"file":"triple.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,UAAU,EAAE,EAClB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/verify/npm-tarball/triple.js

@@ -1,30 +1,8 @@
 /**
- * Verify each published per-triple npm tarball ships a synthesized binary,
- * not just metadata (#443).
- *
- * `npm-platform`'s `synthesizePlatformPackage` emits `files: <readdir of
- * the artifact dir>`, so an empty artifact dir yields a tarball with only
- * `package.json` and `npm publish` still returns 0. This step downloads the
- * published platform tarball back and asserts at least one non-`package.json`
- * file is present — shipping that binary is the whole point of the
- * synthesis. Extracted verbatim from the "Verify published per-triple npm
- * tarballs honor expected files" bash block.
- *
- * The count is RECURSIVE (#633). A consumer whose build stages the binary
- * nested — `artifacts/<name>-<triple>/bin/<binary>` rather than flat —
- * publishes a tarball whose top level is `package.json` plus the `bin/`
- * directory, and a top-level file count discards that directory along with
- * the payload inside it. The nested layout is legal all the way to publish
- * (`checkCompleteness` lists recursively, so it accepts either shape), so
- * this check has to see it too. Paths are reported relative to `package/`,
- * which is what makes a nested payload legible in the log. One walk decides
- * the verdict, so the failure message can no longer name a file the verdict
- * called absent.
- *
- * The platform package name is reconstructed as `{name}-{triple}` — the
- * default template every fixture uses — because the matrix row carries the
- * main package name (synthesis is a publish-time concern). Returns the
- * process exit code (0 ok, 1 on any metadata-only tarball).
+ * Verify each published per-triple npm tarball ships a synthesized binary, not
+ * just metadata (#443): an empty artifact dir yields a `package.json`-only
+ * tarball and `npm publish` still returns 0. The count is RECURSIVE (#633) — a
+ * nested `bin/<binary>` layout is legal to publish, and a flat count misses it.
  */
 import { rm } from 'node:fs/promises';
 import { relative } from 'node:path';

package/dist/verify/npm-tarball/triple.js.map

@@ -1 +1 @@
-{"version":3,"file":"triple.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAkB,EAClB,IAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACrG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,IAAI,OAAO,0BAA0B,QAAQ,IAAI,CAAC,CAAC;QAExF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,iBAAiB,QAAQ,mKAAmK,CACjO,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9D,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,8EAA8E,CACnH,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"triple.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAkB,EAClB,IAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACrG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,IAAI,OAAO,0BAA0B,QAAQ,IAAI,CAAC,CAAC;QAExF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,iBAAiB,QAAQ,mKAAmK,CACjO,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9D,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,8EAA8E,CACnH,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/posture.d.ts

@@ -1,17 +1,8 @@
 /**
- * `putitoutthere verify` — per-package publish/trust posture (#414).
- *
- * Answers "do I still need the registry token, or is OIDC trusted
- * publishing active?" For each package it reads the latest published
- * version (the same `latestVersion` `status` uses) and then that release's
- * trust attribution via the handler's `trustPosture` primitive — from
- * PUBLIC registry data, no secrets. Classifies `oidc` (trusted publisher /
- * provenance) / `token` / `unpublished` (no release) / `unreachable`.
- *
- * Shared engine, no parallel logic (design-commitments #7): a thin reader
- * over the per-kind handlers, reusing the exact registry-name resolution
- * the publish path runs. The read degrades — an unreachable registry
- * yields `unreachable`, never an abort — matching `status`.
+ * `putitoutthere verify` — per-package publish/trust posture (#414): "do I still
+ * need the registry token, or is OIDC trusted publishing active?", answered from
+ * PUBLIC registry data via the handler's `trustPosture`. Classifies `oidc` /
+ * `token` / `unpublished` / `unreachable`; unreachable degrades, never aborts.
  */
 import type { VerifyOptions, VerifyRow } from './posture-types.js';
 export declare function computeVerify(opts: VerifyOptions): Promise<VerifyRow[]>;

package/dist/verify/posture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/verify/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,KAAK,EAAW,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA6B7E"}
+{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/verify/posture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAW,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA6B7E"}

package/dist/verify/posture.js

@@ -1,17 +1,8 @@
 /**
- * `putitoutthere verify` — per-package publish/trust posture (#414).
- *
- * Answers "do I still need the registry token, or is OIDC trusted
- * publishing active?" For each package it reads the latest published
- * version (the same `latestVersion` `status` uses) and then that release's
- * trust attribution via the handler's `trustPosture` primitive — from
- * PUBLIC registry data, no secrets. Classifies `oidc` (trusted publisher /
- * provenance) / `token` / `unpublished` (no release) / `unreachable`.
- *
- * Shared engine, no parallel logic (design-commitments #7): a thin reader
- * over the per-kind handlers, reusing the exact registry-name resolution
- * the publish path runs. The read degrades — an unreachable registry
- * yields `unreachable`, never an abort — matching `status`.
+ * `putitoutthere verify` — per-package publish/trust posture (#414): "do I still
+ * need the registry token, or is OIDC trusted publishing active?", answered from
+ * PUBLIC registry data via the handler's `trustPosture`. Classifies `oidc` /
+ * `token` / `unpublished` / `unreachable`; unreachable degrades, never aborts.
  */
 import { join } from 'node:path';
 import { loadConfig } from '../config.js';