youiyoux 0.1.12 → 0.1.13

package/dist/chunks/{chunk-VXR7FMM7.js → chunk-EV62TUDV.js}

@@ -1307,9 +1307,10 @@ function recordWorkflowText(input) {
   return `${RECORD_HEADER}
 # Sends where each product here stands with its System to your team's hosted hub
 # (youiyoux hub serve): youiyoux record, redacted as the shareable report is, with no code.
-# Set two repository secrets: YOUIYOUX_HUB_URL (the hub's https address) and
-# YOUIYOUX_HUB_TOKEN (the hub's ingest token). Pinned to youiyoux ${input.version}; change it here.
-# Only GitHub's own actions run here: the record step holds the token.
+# Set the repository secret YOUIYOUX_HUB_URL (the hub's https address). The record proves this
+# repository with GitHub's OIDC token (id-token: write), so a hub that takes GitHub's needs no
+# other secret; a hub on a shared ingest token also needs YOUIYOUX_HUB_TOKEN.
+# Pinned to youiyoux ${input.version}; change it here. Only GitHub's own actions run here.
 name: youiyoux record
 on:
   push:
@@ -1317,6 +1318,7 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+  id-token: write
 concurrency:
   group: youiyoux-record
   cancel-in-progress: true
@@ -1346,7 +1348,7 @@ async function installRecordWorkflow(dir, version, force) {
   const file = join8(top, RECORD_WORKFLOW);
   const before = await readTextOrNull(file);
   if (before !== null && !before.startsWith(RECORD_HEADER) && !force) throw new Error(`${file} exists and was not written by youiyoux; pass --force to replace it`);
-  return write(file, recordWorkflowText({ branch, version, install: await installStep(top) }), before, `sends this repository's record (redacted, no code) to the hub in YOUIYOUX_HUB_URL on each push to ${branch}; set YOUIYOUX_HUB_URL and YOUIYOUX_HUB_TOKEN as repository secrets`);
+  return write(file, recordWorkflowText({ branch, version, install: await installStep(top) }), before, `sends this repository's record (redacted, no code) to the hub in YOUIYOUX_HUB_URL on each push to ${branch}, proving the repository with GitHub's OIDC token; set YOUIYOUX_HUB_URL as a repository secret (and YOUIYOUX_HUB_TOKEN for a hub on a shared token)`);
 }
 
 // ../cli/src/check-repo.ts
@@ -2888,14 +2890,308 @@ function renderUpgrade(r, showDiff) {
 // ../cli/src/record.ts
 import { execFile as execFile5 } from "node:child_process";
 import { readFileSync as readFileSync2 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
+// ../cli/src/org-hub.ts
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { readFile as readFile6 } from "node:fs/promises";
+import { createServer } from "node:http";
+import { extname, join as join17, normalize, sep as sep3 } from "node:path";
+
+// ../cli/src/github-oidc.ts
+import { createPublicKey, verify } from "node:crypto";
+var GITHUB_ISSUER = "https://token.actions.githubusercontent.com";
+var JWKS_URL = `${GITHUB_ISSUER}/.well-known/jwks`;
+var LEEWAY_SECONDS = 60;
+var JWKS_TTL_MS = 60 * 60 * 1e3;
+var JWKS_RETRY_MS = 60 * 1e3;
+var audienceOf = (hub) => hub.trim().replace(/\/+$/, "");
+async function requestGithubToken(audience, env = process.env, fetcher = fetch) {
+  const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const bearer2 = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  if (!url || !bearer2) return null;
+  const request = new URL(url);
+  request.searchParams.set("audience", audience);
+  const response = await fetcher(request, { headers: { authorization: `bearer ${bearer2}` }, signal: AbortSignal.timeout(15e3) });
+  if (!response.ok) throw new Error(`GitHub Actions did not give an OIDC token (${response.status}): does the workflow have permissions: id-token: write?`);
+  const { value } = await response.json();
+  if (typeof value !== "string") throw new Error("GitHub Actions answered without an OIDC token");
+  return value;
+}
+var decode = (part) => JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+var DEFAULT_BRANCHES = ["main", "master"];
+function githubVerifier(options) {
+  const listed = options.owners.map((o) => o.trim().toLowerCase()).filter(Boolean);
+  const ownerIds = new Set(listed.filter((o) => /^\d+$/.test(o)));
+  const ownerNames = new Set(listed.filter((o) => !/^\d+$/.test(o)));
+  const branches = new Set(options.branches && options.branches.length > 0 ? options.branches : DEFAULT_BRANCHES);
+  const issuer = options.issuer ?? GITHUB_ISSUER;
+  const audience = audienceOf(options.audience);
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  let cached = null;
+  let lastFetch = 0;
+  const fetchKeys = options.jwks ?? (async () => await (await fetch(JWKS_URL, { signal: AbortSignal.timeout(15e3) })).json());
+  const keyFor = async (kid) => {
+    const find = (jwks) => jwks.keys.find((k) => k.kid === kid && k.kty === "RSA") ?? null;
+    const fresh = cached && Date.now() - cached.at < JWKS_TTL_MS ? find(cached.keys) : null;
+    if (fresh) return fresh;
+    if (cached && Date.now() - lastFetch < JWKS_RETRY_MS) return find(cached.keys);
+    lastFetch = Date.now();
+    cached = { keys: await fetchKeys(), at: Date.now() };
+    return find(cached.keys);
+  };
+  return async (token) => {
+    const parts = token.split(".");
+    if (parts.length !== 3) throw new Error("not a JSON Web Token");
+    const [head, body, signature] = parts;
+    let header;
+    let claims;
+    try {
+      header = decode(head);
+      claims = decode(body);
+    } catch {
+      throw new Error("not a JSON Web Token");
+    }
+    if (header.alg !== "RS256") throw new Error(`signed with ${String(header.alg)}, not GitHub's RS256`);
+    const jwk = await keyFor(typeof header.kid === "string" ? header.kid : void 0);
+    if (!jwk) throw new Error("not signed by a key GitHub publishes");
+    if (!verify("RSA-SHA256", Buffer.from(`${head}.${body}`), createPublicKey({ key: { kty: "RSA", n: String(jwk.n), e: String(jwk.e) }, format: "jwk" }), Buffer.from(signature, "base64url"))) throw new Error("its signature is not GitHub's");
+    if (claims.iss !== issuer) throw new Error(`issued by ${String(claims.iss)}, not GitHub Actions`);
+    const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (!audiences.some((a) => typeof a === "string" && audienceOf(a) === audience)) throw new Error(`issued for ${audiences.map(String).join(", ")}, not this hub (${audience})`);
+    const seconds = now().getTime() / 1e3;
+    if (typeof claims.exp !== "number" || claims.exp < seconds - LEEWAY_SECONDS) throw new Error("expired");
+    if (typeof claims.nbf === "number" && claims.nbf > seconds + LEEWAY_SECONDS) throw new Error("not valid yet");
+    const { repository, repository_owner: owner, repository_owner_id: ownerId, sha, ref, event_name: event } = claims;
+    if (typeof repository !== "string" || typeof owner !== "string" || typeof sha !== "string" || typeof ref !== "string") throw new Error("missing its repository, owner, commit or ref");
+    if (!(typeof ownerId === "string" && ownerIds.has(ownerId)) && !ownerNames.has(owner.toLowerCase())) throw new Error(`from ${owner}${typeof ownerId === "string" ? ` (id ${ownerId})` : ""}, which this hub does not take records from`);
+    if (!ref.startsWith("refs/heads/") || !branches.has(ref.slice("refs/heads/".length))) throw new Error(`from ${ref}: this hub takes records from ${[...branches].join(" and ")} only (YOUIYOUX_HUB_BRANCHES)`);
+    return { repository, repository_owner: owner, sha, ref, ...typeof event === "string" ? { event_name: event } : {} };
+  };
+}
+function recordMismatch(claims, record) {
+  if (claims.repository.toLowerCase() !== record.repo.toLowerCase()) return `the record names ${record.repo}, but it was sent from ${claims.repository}`;
+  if (record.commit !== claims.sha) return `the record names commit ${record.commit ?? "none"}, but it was sent from ${claims.sha}`;
+  if (!claims.ref.startsWith("refs/heads/")) return `it was sent from ${claims.ref}, not a branch`;
+  if (claims.event_name !== void 0 && claims.event_name.startsWith("pull_request")) return `it was sent from a ${claims.event_name} run, not a push to the branch`;
+  const branch = claims.ref.slice("refs/heads/".length);
+  if (record.ref !== branch) return `the record names ${record.ref ?? "no branch"}, but it was sent from ${branch}`;
+  return null;
+}
+
+// ../cli/src/org-hub.ts
+var VIEW_KEY_ENV = "YOUIYOUX_HUB_VIEW_KEY";
+var GITHUB_OWNERS_ENV = "YOUIYOUX_HUB_GITHUB_OWNERS";
+var AUDIENCE_ENV = "YOUIYOUX_HUB_AUDIENCE";
+var GITHUB_TOKEN_HEADER = "x-youi-github-oidc";
+var FUTURE_MS = 5 * 60 * 1e3;
+var ORG_META = "youi-org";
+var COOKIE = "youi_hub_session";
+var MAX_RECORD = 2 * 1024 * 1024;
+var MIN_SECRET = 24;
+var SESSION_DAYS = 30;
+function secretsProblem(ingest, view, github = false) {
+  const missing = [!github && !ingest && "YOUIYOUX_HUB_TOKEN", !view && VIEW_KEY_ENV].filter(Boolean);
+  if (missing.length > 0) return `set ${missing.join(" and ")} in the environment: a random string of ${MIN_SECRET} characters or more${missing.length > 1 ? " each" : ""} (openssl rand -base64 32)${github ? "" : `, the token for CI and the view key for people; or ${GITHUB_OWNERS_ENV} and ${AUDIENCE_ENV}, so GitHub Actions proves each record's repository and no CI token is shared`}`;
+  if (ingest !== void 0 && ingest.length < MIN_SECRET || view.length < MIN_SECRET) return `${ingest !== void 0 ? "YOUIYOUX_HUB_TOKEN and " : ""}${VIEW_KEY_ENV} must be ${MIN_SECRET} characters or more (openssl rand -base64 32)`;
+  if (ingest === view) return `YOUIYOUX_HUB_TOKEN and ${VIEW_KEY_ENV} must differ: whoever can read the hub must not be able to write to it`;
+  return null;
+}
+var digest = (text) => createHash("sha256").update(text).digest();
+var same = (given, expected) => timingSafeEqual(digest(given), digest(expected));
+var bearer = (req) => /^Bearer (.+)$/.exec(req.headers.authorization ?? "")?.[1] ?? null;
+var cookie = (req, name) => {
+  for (const part of (req.headers.cookie ?? "").split(";")) {
+    const [key2, ...value] = part.trim().split("=");
+    if (key2 === name) return value.join("=");
+  }
+  return null;
+};
+var HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "Referrer-Policy": "no-referrer",
+  "X-Frame-Options": "DENY",
+  "X-Robots-Tag": "noindex, nofollow",
+  "Content-Security-Policy": csp([])
+};
+function csp(inline) {
+  const hashes = inline.map((script) => ` 'sha256-${createHash("sha256").update(script).digest("base64")}'`).join("");
+  return `default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; script-src 'self'${hashes}; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'`;
+}
+function send(res, status, body, extra = {}) {
+  res.writeHead(status, { ...HEADERS, "Content-Type": "application/json", "Cache-Control": "no-store", ...extra });
+  res.end(JSON.stringify(body));
+}
+async function readBody(req, limit) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk2 of req) {
+    size += chunk2.length;
+    if (size > limit) throw Object.assign(new Error(`a record is at most ${limit / 1024 / 1024} MB`), { status: 413 });
+    chunks.push(chunk2);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function unredacted(record) {
+  const found = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    if (typeof node === "string") {
+      if (/(?:^|[\s"'`(=,:;])(?:~\/|\/(?:Users|home|root)\/)|[A-Za-z]:\\Users\\/.test(node)) found.add("a path outside the repository");
+      if (/\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:"'<>]+(?::[^\s/@"'<>]*)?@/i.test(node) && !node.includes("[redacted]@")) found.add("a URL with credentials");
+    } else if (Array.isArray(node)) node.forEach(walk);
+    else if (node && typeof node === "object") Object.values(node).forEach(walk);
+  };
+  walk(record.products);
+  return [...found];
+}
+var failed = (p) => "error" in p;
+function orgView(latest, now) {
+  const systems = /* @__PURE__ */ new Map();
+  let products = 0;
+  let unreadable = 0;
+  for (const { record } of latest) {
+    for (const product2 of record.products) {
+      products++;
+      if (failed(product2)) {
+        unreadable++;
+        continue;
+      }
+      const system = systems.get(product2.system.id) ?? { name: product2.system.name, latest: product2.system.version, versions: /* @__PURE__ */ new Map() };
+      if (compareVersions(product2.system.version, system.latest) > 0) system.latest = product2.system.version;
+      const version = product2.lock?.systemVersion ?? null;
+      system.versions.set(version, [...system.versions.get(version) ?? [], { repo: record.repo, id: product2.id }]);
+      systems.set(product2.system.id, system);
+    }
+  }
+  const statuses = latest.flatMap(({ record }) => record.products.filter((p) => !failed(p)));
+  const behind = statuses.filter((p) => p.lock === null || p.lock.systemVersion !== systems.get(p.system.id).latest).length;
+  return {
+    schema: "youi.org/v1",
+    generatedAt: now.toISOString(),
+    repos: latest.map(({ record, receivedAt }) => ({ repo: record.repo, commit: record.commit, ref: record.ref, generatedAt: record.generatedAt, receivedAt, products: record.products })),
+    systems: [...systems].sort(([a], [b]) => a.localeCompare(b)).map(([id, s]) => ({
+      id,
+      name: s.name,
+      latest: s.latest,
+      versions: [...s.versions].sort(([a], [b]) => a === null ? 1 : b === null ? -1 : compareVersions(b, a)).map(([version, list]) => ({ version, products: list }))
+    })),
+    totals: { repos: latest.length, products, unreadable, behind, failing: statuses.filter((p) => p.check.errors > 0 || p.check.incomplete).length }
+  };
+}
+var TYPES = { ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".svg": "image/svg+xml", ".woff2": "font/woff2", ".png": "image/png", ".webp": "image/webp", ".json": "application/json" };
+async function startOrgHub(options) {
+  const problem = secretsProblem(options.github ? void 0 : options.ingestToken, options.viewKey, Boolean(options.github));
+  if (problem) throw new Error(problem);
+  const host = options.host ?? "127.0.0.1";
+  const local = ["127.0.0.1", "localhost", "::1"].includes(host);
+  const secure = options.secureCookies ?? !local;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const session = createHmac("sha256", options.viewKey).update("youiyoux hub viewer").digest("base64url");
+  const page = options.dist ? (await readFile6(join17(options.dist, "index.html"), "utf8")).replace("</head>", `    <meta name="${ORG_META}" content="/api/org" />
+  </head>`) : null;
+  const pagePolicy = csp(page ? [...page.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]) : []);
+  const viewer = (req) => {
+    const given = cookie(req, COOKIE) ?? null;
+    const key2 = bearer(req);
+    return given !== null && same(given, session) || key2 !== null && same(key2, options.viewKey);
+  };
+  const cookieHeader = (value, maxAge) => `${COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secure ? "; Secure" : ""}`;
+  const serveFile = async (res, path) => {
+    const root = join17(options.dist, "assets");
+    const file = normalize(join17(options.dist, path));
+    if (!(file.startsWith(`${root}${sep3}`) || file === join17(options.dist, "favicon.svg"))) return send(res, 404, { error: "not found" });
+    const body = await readFile6(file).catch(() => null);
+    if (!body) return send(res, 404, { error: "not found" });
+    res.writeHead(200, { ...HEADERS, "Content-Type": TYPES[extname(file)] ?? "application/octet-stream", "Cache-Control": path.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache" });
+    res.end(body);
+  };
+  const server = createServer((req, res) => {
+    void (async () => {
+      const path = (req.url ?? "/").split("?")[0];
+      const method = req.method ?? "GET";
+      try {
+        if (path === "/api/health" && method === "GET") return send(res, 200, { ok: true });
+        if (path === "/api/records" && method === "POST") {
+          const oidc = req.headers[GITHUB_TOKEN_HEADER];
+          let sender = null;
+          if (options.github) {
+            if (typeof oidc !== "string") return send(res, 401, { error: "this hub takes records from GitHub Actions with its OIDC token: give the workflow permissions: id-token: write (youiyoux hooks install --record does)" });
+            try {
+              sender = await options.github(oidc);
+            } catch (error) {
+              return send(res, 401, { error: `the GitHub Actions token was refused: ${error instanceof Error ? error.message : String(error)}` });
+            }
+          } else {
+            const token = bearer(req);
+            if (token === null || !same(token, options.ingestToken)) return send(res, 401, { error: "this hub takes records only with its ingest token (YOUIYOUX_HUB_TOKEN)" });
+          }
+          if (!(req.headers["content-type"] ?? "").startsWith("application/json")) return send(res, 415, { error: "a record is JSON (content-type: application/json)" });
+          let parsed;
+          try {
+            parsed = JSON.parse(await readBody(req, MAX_RECORD));
+          } catch (error) {
+            const status = error.status;
+            return send(res, status ?? 400, { error: status ? error.message : "a record is JSON" });
+          }
+          const record = CiRecord.safeParse(parsed);
+          if (!record.success) return send(res, 422, { error: `not a youi.record/v1: ${record.error.issues.slice(0, 3).map((i) => `${i.path.join(".") || "record"}: ${i.message}`).join("; ")}` });
+          if (sender) {
+            const mismatch = recordMismatch(sender, record.data);
+            if (mismatch) return send(res, 403, { error: `${mismatch}: a repository's CI sends only its own record` });
+          }
+          const received = now();
+          if (Date.parse(record.data.generatedAt) > received.getTime() + FUTURE_MS) return send(res, 422, { error: `the record is dated ${record.data.generatedAt}, after the hub's clock (${received.toISOString()}) by more than five minutes: it would stay its repository's latest, so it was not kept` });
+          const leaks = unredacted(record.data);
+          if (leaks.length > 0) return send(res, 422, { error: `the record holds ${leaks.join(" and ")}, so it was not kept: youiyoux record redacts these` });
+          await options.store.putRecord(record.data, received.toISOString());
+          return send(res, 201, { kept: record.data.repo, products: record.data.products.length });
+        }
+        if (path === "/api/session" && method === "POST") {
+          let key2;
+          try {
+            key2 = JSON.parse(await readBody(req, 4096)).key;
+          } catch {
+            return send(res, 400, { error: 'send { "key": "\u2026" }' });
+          }
+          if (typeof key2 !== "string" || !same(key2, options.viewKey)) return send(res, 401, { error: "that is not this hub's view key" });
+          return send(res, 200, { ok: true }, { "Set-Cookie": cookieHeader(session, SESSION_DAYS * 86400) });
+        }
+        if (path === "/api/session" && method === "DELETE") return send(res, 200, { ok: true }, { "Set-Cookie": cookieHeader("", 0) });
+        if (path === "/api/org" && method === "GET") {
+          if (!viewer(req)) return send(res, 401, { error: "sign in with the hub's view key" });
+          return send(res, 200, orgView(await options.store.latestRecords(), now()));
+        }
+        if (path.startsWith("/api/")) return send(res, 404, { error: "this hub is read-only: it shows the organisation, and takes records from CI" });
+        if (method !== "GET" && method !== "HEAD") return send(res, 405, { error: "read-only" });
+        if (!page) return send(res, 404, { error: "the hub's page is not built here; the API answers at /api/org" });
+        if (path.startsWith("/assets/") || path === "/favicon.svg") return await serveFile(res, path);
+        res.writeHead(200, { ...HEADERS, "Content-Security-Policy": pagePolicy, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
+        res.end(page);
+      } catch (error) {
+        process.stderr.write(`youiyoux hub: ${method} ${path} failed: ${error instanceof Error ? error.message : String(error)}
+`);
+        send(res, 500, { error: "the hub could not read its store; its log says why" });
+      }
+    })();
+  });
+  await new Promise((done, fail) => {
+    server.once("error", fail);
+    server.listen(options.port ?? 0, host, done);
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  return {
+    url: `http://${host.includes(":") ? `[${host}]` : host}:${port}`,
+    close: () => new Promise((done) => server.close(() => done()))
+  };
+}
+
 // ../cli/src/report/safe.ts
 import { realpathSync } from "node:fs";
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 import { homedir as homedir2, userInfo as userInfo2 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 
 // ../cli/src/report/filters.ts
 var SHOWCASE_GLOBS = ["**/{__stories__,.storybook,storybook,storybook-static,example,examples,demo,demos,playground,showcase,showcases}/**", "**/*.stories.*", "**/*.story.*"];
@@ -3032,7 +3328,7 @@ async function dotenvValues(root) {
   const files = await findFiles(root, [".env", ".env.*", "**/.env", "**/.env.*"]).catch(() => []);
   const values = [];
   for (const file of files) {
-    const text = await readFile6(join17(root, file), "utf8").catch(() => "");
+    const text = await readFile7(join18(root, file), "utf8").catch(() => "");
     for (const line of text.split(/\r?\n/)) {
       const match = /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.-]*\s*=\s*(.*)$/.exec(line);
       if (!match) continue;
@@ -3151,7 +3447,7 @@ var Redactor = class _Redactor {
 
 // ../cli/src/status.ts
 import { realpath as realpath5 } from "node:fs/promises";
-import { dirname as dirname9, join as join18, relative as relative8, resolve as resolve10 } from "node:path";
+import { dirname as dirname9, join as join19, relative as relative8, resolve as resolve10 } from "node:path";
 var placeOf = (cwd, root) => {
   const rel = relative8(cwd, root) || ".";
   return rel.split(/[\\/]/).filter((part) => part === "..").length > 1 ? resolve10(root) : rel;
@@ -3210,7 +3506,7 @@ async function statusTargets(cwd, named2) {
   if (product2) return { roots: [product2], workspace: null };
   const at = findUp(cwd, WORKSPACE_FILE);
   if (at) {
-    const file = join18(at, WORKSPACE_FILE);
+    const file = join19(at, WORKSPACE_FILE);
     const workspace = await readDefinition(file, WorkspaceConfig);
     return { roots: workspace.projects.map((p) => resolve10(at, p)), workspace: file };
   }
@@ -3232,12 +3528,12 @@ async function workspaceStatus(cwd, named2) {
       projects.push(await projectStatus(await loadProject(root), cwd));
     } catch (error) {
       const label = placeOf(cwd, root);
-      projects.push({ root: label, error: error instanceof Error ? error.message : String(error), next: await readTextOrNull(join18(root, PROJECT_FILE)) === null ? `youiyoux adopt or youiyoux init --design <dir> in ${label}` : `fix ${join18(label, PROJECT_FILE)}` });
+      projects.push({ root: label, error: error instanceof Error ? error.message : String(error), next: await readTextOrNull(join19(root, PROJECT_FILE)) === null ? `youiyoux adopt or youiyoux init --design <dir> in ${label}` : `fix ${join19(label, PROJECT_FILE)}` });
     }
   }
   return { schema: "youi.status/v1", generatedAt: (/* @__PURE__ */ new Date()).toISOString(), workspace: workspace ? relative8(cwd, workspace) || WORKSPACE_FILE : null, projects };
 }
-var failed = (p) => "error" in p;
+var failed2 = (p) => "error" in p;
 function projectLines(s) {
   const row = (label, text) => `  ${padEnd(label, 11)} ${text}`;
   const synced = s.lock ? `synced ${s.lock.syncedAt.slice(0, 10)}${s.lock.systemVersion !== s.system.version ? ` at v${s.lock.systemVersion}` : ""}` : "never synced";
@@ -3261,11 +3557,11 @@ function projectLines(s) {
 function renderStatus(report) {
   if (report.projects.length === 0) return `${style.warn("!")} no product here: no ${PROJECT_FILE} upward, no ${WORKSPACE_FILE}, and none in this repository below here
 Next: youiyoux adopt makes this product's own UI its design system, or youiyoux init --design <dir> follows one`;
-  const blocks = report.projects.map((p) => failed(p) ? [`${style.bold(p.root)} ${style.error("\u2716")} ${p.error}`, `${style.bold("Next:")} ${p.next}`] : projectLines(p));
+  const blocks = report.projects.map((p) => failed2(p) ? [`${style.bold(p.root)} ${style.error("\u2716")} ${p.error}`, `${style.bold("Next:")} ${p.next}`] : projectLines(p));
   const head = report.projects.length > 1 ? [`${style.bold("workspace")} ${style.dim(`\xB7 ${plural(report.projects.length, "product")}${report.workspace ? ` from ${report.workspace}` : " in this repository"}`)}`, ""] : [];
   return [...head, ...blocks.flatMap((b, i) => i === 0 ? b : ["", ...b])].join("\n");
 }
-var statusExitCode = (report) => report.projects.some((p) => failed(p) || p.check.incomplete || p.check.errors > 0 || p.sync.state === "conflict") ? 1 : 0;
+var statusExitCode = (report) => report.projects.some((p) => failed2(p) || p.check.incomplete || p.check.errors > 0 || p.sync.state === "conflict") ? 1 : 0;
 
 // ../cli/src/record.ts
 var run6 = promisify5(execFile5);
@@ -3273,7 +3569,7 @@ var git3 = async (cwd, args) => run6("git", args, { cwd }).then((r) => r.stdout.
 var HUB_URL_ENV = "YOUIYOUX_HUB_URL";
 var HUB_TOKEN_ENV = "YOUIYOUX_HUB_TOKEN";
 function toolVersion(root = TOOL_ROOT) {
-  for (const file of [join19(root, "packages/youiyoux/package.json"), join19(root, "../package.json")]) {
+  for (const file of [join20(root, "packages/youiyoux/package.json"), join20(root, "../package.json")]) {
     try {
       const pkg = JSON.parse(readFileSync2(file, "utf8"));
       if (pkg.name === "youiyoux" && pkg.version) return pkg.version;
@@ -3308,9 +3604,10 @@ function recordsUrl(hub) {
   if (url.username || url.password) throw new Error(`${HUB_URL_ENV} carries a user name or password: the token goes in ${HUB_TOKEN_ENV}`);
   return new URL(`${url.pathname.replace(/\/+$/, "")}/api/records`, url.origin);
 }
-async function sendRecord(record, hub, token, fetcher = fetch) {
+async function sendRecord(record, hub, credentials, fetcher = fetch) {
   const url = recordsUrl(hub);
-  const response = await fetcher(url, { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${token}` }, body: JSON.stringify(record), redirect: "error", signal: AbortSignal.timeout(3e4) }).catch((error) => {
+  const headers = { "content-type": "application/json", ...credentials.token ? { authorization: `Bearer ${credentials.token}` } : {}, ...credentials.github ? { [GITHUB_TOKEN_HEADER]: credentials.github } : {} };
+  const response = await fetcher(url, { method: "POST", headers, body: JSON.stringify(record), redirect: "error", signal: AbortSignal.timeout(3e4) }).catch((error) => {
     throw new Error(`could not reach the hub at ${url.origin}: ${error instanceof Error ? error.message : String(error)}`);
   });
   if (response.ok) return url.origin;
@@ -3324,196 +3621,6 @@ function renderRecord(record, sentTo) {
   return [head, style.dim("  redacted as the shareable report is: repo-relative paths, no home, username, env values or credentials; no code")].join("\n");
 }
 
-// ../cli/src/org-hub.ts
-import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-import { readFile as readFile7 } from "node:fs/promises";
-import { createServer } from "node:http";
-import { extname, join as join20, normalize, sep as sep3 } from "node:path";
-var VIEW_KEY_ENV = "YOUIYOUX_HUB_VIEW_KEY";
-var ORG_META = "youi-org";
-var COOKIE = "youi_hub_session";
-var MAX_RECORD = 2 * 1024 * 1024;
-var MIN_SECRET = 24;
-var SESSION_DAYS = 30;
-function secretsProblem(ingest, view) {
-  const missing = [!ingest && "YOUIYOUX_HUB_TOKEN", !view && VIEW_KEY_ENV].filter(Boolean);
-  if (missing.length > 0) return `set ${missing.join(" and ")} in the environment: a random string of ${MIN_SECRET} characters or more each (openssl rand -base64 32), the token for CI and the view key for people`;
-  if (ingest.length < MIN_SECRET || view.length < MIN_SECRET) return `YOUIYOUX_HUB_TOKEN and ${VIEW_KEY_ENV} must be ${MIN_SECRET} characters or more (openssl rand -base64 32)`;
-  if (ingest === view) return `YOUIYOUX_HUB_TOKEN and ${VIEW_KEY_ENV} must differ: whoever can read the hub must not be able to write to it`;
-  return null;
-}
-var digest = (text) => createHash("sha256").update(text).digest();
-var same = (given, expected) => timingSafeEqual(digest(given), digest(expected));
-var bearer = (req) => /^Bearer (.+)$/.exec(req.headers.authorization ?? "")?.[1] ?? null;
-var cookie = (req, name) => {
-  for (const part of (req.headers.cookie ?? "").split(";")) {
-    const [key2, ...value] = part.trim().split("=");
-    if (key2 === name) return value.join("=");
-  }
-  return null;
-};
-var HEADERS = {
-  "X-Content-Type-Options": "nosniff",
-  "Referrer-Policy": "no-referrer",
-  "X-Frame-Options": "DENY",
-  "X-Robots-Tag": "noindex, nofollow",
-  "Content-Security-Policy": csp([])
-};
-function csp(inline) {
-  const hashes = inline.map((script) => ` 'sha256-${createHash("sha256").update(script).digest("base64")}'`).join("");
-  return `default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; script-src 'self'${hashes}; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'`;
-}
-function send(res, status, body, extra = {}) {
-  res.writeHead(status, { ...HEADERS, "Content-Type": "application/json", "Cache-Control": "no-store", ...extra });
-  res.end(JSON.stringify(body));
-}
-async function readBody(req, limit) {
-  const chunks = [];
-  let size = 0;
-  for await (const chunk2 of req) {
-    size += chunk2.length;
-    if (size > limit) throw Object.assign(new Error(`a record is at most ${limit / 1024 / 1024} MB`), { status: 413 });
-    chunks.push(chunk2);
-  }
-  return Buffer.concat(chunks).toString("utf8");
-}
-function unredacted(record) {
-  const found = /* @__PURE__ */ new Set();
-  const walk = (node) => {
-    if (typeof node === "string") {
-      if (/(?:^|[\s"'`(=,:;])(?:~\/|\/(?:Users|home|root)\/)|[A-Za-z]:\\Users\\/.test(node)) found.add("a path outside the repository");
-      if (/\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:"'<>]+(?::[^\s/@"'<>]*)?@/i.test(node) && !node.includes("[redacted]@")) found.add("a URL with credentials");
-    } else if (Array.isArray(node)) node.forEach(walk);
-    else if (node && typeof node === "object") Object.values(node).forEach(walk);
-  };
-  walk(record.products);
-  return [...found];
-}
-var failed2 = (p) => "error" in p;
-function orgView(latest, now) {
-  const systems = /* @__PURE__ */ new Map();
-  let products = 0;
-  let unreadable = 0;
-  for (const { record } of latest) {
-    for (const product2 of record.products) {
-      products++;
-      if (failed2(product2)) {
-        unreadable++;
-        continue;
-      }
-      const system = systems.get(product2.system.id) ?? { name: product2.system.name, latest: product2.system.version, versions: /* @__PURE__ */ new Map() };
-      if (compareVersions(product2.system.version, system.latest) > 0) system.latest = product2.system.version;
-      const version = product2.lock?.systemVersion ?? null;
-      system.versions.set(version, [...system.versions.get(version) ?? [], { repo: record.repo, id: product2.id }]);
-      systems.set(product2.system.id, system);
-    }
-  }
-  const statuses = latest.flatMap(({ record }) => record.products.filter((p) => !failed2(p)));
-  const behind = statuses.filter((p) => p.lock === null || p.lock.systemVersion !== systems.get(p.system.id).latest).length;
-  return {
-    schema: "youi.org/v1",
-    generatedAt: now.toISOString(),
-    repos: latest.map(({ record, receivedAt }) => ({ repo: record.repo, commit: record.commit, ref: record.ref, generatedAt: record.generatedAt, receivedAt, products: record.products })),
-    systems: [...systems].sort(([a], [b]) => a.localeCompare(b)).map(([id, s]) => ({
-      id,
-      name: s.name,
-      latest: s.latest,
-      versions: [...s.versions].sort(([a], [b]) => a === null ? 1 : b === null ? -1 : compareVersions(b, a)).map(([version, list]) => ({ version, products: list }))
-    })),
-    totals: { repos: latest.length, products, unreadable, behind, failing: statuses.filter((p) => p.check.errors > 0 || p.check.incomplete).length }
-  };
-}
-var TYPES = { ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".svg": "image/svg+xml", ".woff2": "font/woff2", ".png": "image/png", ".webp": "image/webp", ".json": "application/json" };
-async function startOrgHub(options) {
-  const problem = secretsProblem(options.ingestToken, options.viewKey);
-  if (problem) throw new Error(problem);
-  const host = options.host ?? "127.0.0.1";
-  const local = ["127.0.0.1", "localhost", "::1"].includes(host);
-  const secure = options.secureCookies ?? !local;
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const session = createHmac("sha256", options.viewKey).update("youiyoux hub viewer").digest("base64url");
-  const page = options.dist ? (await readFile7(join20(options.dist, "index.html"), "utf8")).replace("</head>", `    <meta name="${ORG_META}" content="/api/org" />
-  </head>`) : null;
-  const pagePolicy = csp(page ? [...page.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]) : []);
-  const viewer = (req) => {
-    const given = cookie(req, COOKIE) ?? null;
-    const key2 = bearer(req);
-    return given !== null && same(given, session) || key2 !== null && same(key2, options.viewKey);
-  };
-  const cookieHeader = (value, maxAge) => `${COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secure ? "; Secure" : ""}`;
-  const serveFile = async (res, path) => {
-    const root = join20(options.dist, "assets");
-    const file = normalize(join20(options.dist, path));
-    if (!(file.startsWith(`${root}${sep3}`) || file === join20(options.dist, "favicon.svg"))) return send(res, 404, { error: "not found" });
-    const body = await readFile7(file).catch(() => null);
-    if (!body) return send(res, 404, { error: "not found" });
-    res.writeHead(200, { ...HEADERS, "Content-Type": TYPES[extname(file)] ?? "application/octet-stream", "Cache-Control": path.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache" });
-    res.end(body);
-  };
-  const server = createServer((req, res) => {
-    void (async () => {
-      const path = (req.url ?? "/").split("?")[0];
-      const method = req.method ?? "GET";
-      try {
-        if (path === "/api/health" && method === "GET") return send(res, 200, { ok: true });
-        if (path === "/api/records" && method === "POST") {
-          const token = bearer(req);
-          if (token === null || !same(token, options.ingestToken)) return send(res, 401, { error: "this hub takes records only with its ingest token (YOUIYOUX_HUB_TOKEN)" });
-          if (!(req.headers["content-type"] ?? "").startsWith("application/json")) return send(res, 415, { error: "a record is JSON (content-type: application/json)" });
-          let parsed;
-          try {
-            parsed = JSON.parse(await readBody(req, MAX_RECORD));
-          } catch (error) {
-            const status = error.status;
-            return send(res, status ?? 400, { error: status ? error.message : "a record is JSON" });
-          }
-          const record = CiRecord.safeParse(parsed);
-          if (!record.success) return send(res, 422, { error: `not a youi.record/v1: ${record.error.issues.slice(0, 3).map((i) => `${i.path.join(".") || "record"}: ${i.message}`).join("; ")}` });
-          const leaks = unredacted(record.data);
-          if (leaks.length > 0) return send(res, 422, { error: `the record holds ${leaks.join(" and ")}, so it was not kept: youiyoux record redacts these` });
-          await options.store.putRecord(record.data, now().toISOString());
-          return send(res, 201, { kept: record.data.repo, products: record.data.products.length });
-        }
-        if (path === "/api/session" && method === "POST") {
-          let key2;
-          try {
-            key2 = JSON.parse(await readBody(req, 4096)).key;
-          } catch {
-            return send(res, 400, { error: 'send { "key": "\u2026" }' });
-          }
-          if (typeof key2 !== "string" || !same(key2, options.viewKey)) return send(res, 401, { error: "that is not this hub's view key" });
-          return send(res, 200, { ok: true }, { "Set-Cookie": cookieHeader(session, SESSION_DAYS * 86400) });
-        }
-        if (path === "/api/session" && method === "DELETE") return send(res, 200, { ok: true }, { "Set-Cookie": cookieHeader("", 0) });
-        if (path === "/api/org" && method === "GET") {
-          if (!viewer(req)) return send(res, 401, { error: "sign in with the hub's view key" });
-          return send(res, 200, orgView(await options.store.latestRecords(), now()));
-        }
-        if (path.startsWith("/api/")) return send(res, 404, { error: "this hub is read-only: it shows the organisation, and takes records from CI" });
-        if (method !== "GET" && method !== "HEAD") return send(res, 405, { error: "read-only" });
-        if (!page) return send(res, 404, { error: "the hub's page is not built here; the API answers at /api/org" });
-        if (path.startsWith("/assets/") || path === "/favicon.svg") return await serveFile(res, path);
-        res.writeHead(200, { ...HEADERS, "Content-Security-Policy": pagePolicy, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
-        res.end(page);
-      } catch (error) {
-        process.stderr.write(`youiyoux hub: ${method} ${path} failed: ${error instanceof Error ? error.message : String(error)}
-`);
-        send(res, 500, { error: "the hub could not read its store; its log says why" });
-      }
-    })();
-  });
-  await new Promise((done, fail) => {
-    server.once("error", fail);
-    server.listen(options.port ?? 0, host, done);
-  });
-  const address = server.address();
-  const port = typeof address === "object" && address ? address.port : 0;
-  return {
-    url: `http://${host.includes(":") ? `[${host}]` : host}:${port}`,
-    close: () => new Promise((done) => server.close(() => done()))
-  };
-}
-
 // ../cli/src/workspace-hub.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { createServer as createServer2 } from "node:http";
@@ -5522,11 +5629,14 @@ ${style.bold("In a product repo")}
   record [--send [--hub url]] [--repo owner/name] [--out file] [--json]
                            this repository's record for the team's hosted hub (youi.record/v1): each
                            product's status, redacted as the shareable report is, no code; --send
-                           posts it to YOUIYOUX_HUB_URL with YOUIYOUX_HUB_TOKEN (environment only)
+                           posts it to YOUIYOUX_HUB_URL, proved by GitHub Actions' OIDC token
+                           (id-token: write), else with YOUIYOUX_HUB_TOKEN (environment only)
   hub serve [--port n] [--host h] [--db file]
                            the team's hosted hub, read-only: CI sends records, people sign in with
                            YOUIYOUX_HUB_VIEW_KEY and see every repository and each System's adoption
-                           by version. Records are kept in Postgres (DATABASE_URL) or a SQLite file
+                           by version. YOUIYOUX_HUB_GITHUB_OWNERS and YOUIYOUX_HUB_AUDIENCE: GitHub
+                           Actions proves each record's repository (else YOUIYOUX_HUB_TOKEN, shared).
+                           Records are kept in Postgres (DATABASE_URL) or a SQLite file
 
 ${style.bold("System")}  ${style.dim("approved elements: build only with these")}
   show <component>         the contract: import, legal prop values, guidance, examples
@@ -5976,13 +6086,14 @@ async function cmdUpgrade(values) {
 }
 async function cmdRecord(values) {
   const hub = values.hub ?? process.env[HUB_URL_ENV];
-  const token = process.env[HUB_TOKEN_ENV];
+  const token = process.env[HUB_TOKEN_ENV] || null;
   if (values.send && !hub) throw new UsageError(`youiyoux record --send needs the hub's address: set ${HUB_URL_ENV} (or pass --hub <url>)`);
-  if (values.send && !token) throw new UsageError(`youiyoux record --send needs the hub's ingest token in ${HUB_TOKEN_ENV} (from the environment only, never a flag)`);
+  const github = values.send ? await requestGithubToken(audienceOf(hub)) : null;
+  if (values.send && !token && !github) throw new UsageError(`youiyoux record --send needs a way to prove where the record comes from: in GitHub Actions, permissions: id-token: write; elsewhere, the hub's ingest token in ${HUB_TOKEN_ENV} (from the environment only, never a flag)`);
   const record = await buildRecord(values.project ?? process.cwd(), values.repo ? { repo: values.repo } : {});
   if (values.out) await writeFileAtomic(resolve15(values.out), `${JSON.stringify(record, null, 2)}
 `);
-  const sentTo = values.send ? await sendRecord(record, hub, token) : null;
+  const sentTo = values.send ? await sendRecord(record, hub, { token, github }) : null;
   if (values.json) json3(record);
   else print([renderRecord(record, sentTo), ...values.out ? [style.dim(`  written to ${values.out}`)] : [], ...!values.send && !values.out ? [style.dim(`  youiyoux record --send posts it to the hub in ${HUB_URL_ENV}; --out <file> writes it; --json prints it`)] : []].join("\n"));
   return 0;
@@ -5993,7 +6104,12 @@ function builtHub() {
 }
 async function cmdHubServe(values, positionals) {
   if (positionals[0] !== "serve" || positionals.length > 1) throw new UsageError("youiyoux hub serve [--port n] [--host h] [--db file]   (the team's hosted hub: read-only, fed by youiyoux record in CI)");
-  const problem = secretsProblem(process.env[HUB_TOKEN_ENV], process.env[VIEW_KEY_ENV]);
+  const owners = (process.env[GITHUB_OWNERS_ENV] ?? "").split(",").map((o) => o.trim()).filter(Boolean);
+  const audience = process.env[AUDIENCE_ENV];
+  if (owners.length > 0 && !audience) throw new UsageError(`${GITHUB_OWNERS_ENV} needs ${AUDIENCE_ENV}: the hub's address, exactly as CI's ${HUB_URL_ENV} names it (GitHub's token is issued for it)`);
+  const branches = (process.env.YOUIYOUX_HUB_BRANCHES ?? "").split(",").map((b) => b.trim()).filter(Boolean);
+  const github = owners.length > 0 ? githubVerifier({ owners, audience, branches }) : void 0;
+  const problem = secretsProblem(github ? void 0 : process.env[HUB_TOKEN_ENV], process.env[VIEW_KEY_ENV], Boolean(github));
   if (problem) throw new UsageError(problem);
   const port = Number(values.port ?? process.env.PORT ?? 8080);
   if (!Number.isInteger(port) || port < 0 || port > 65535) throw new UsageError(`--port ${JSON.stringify(values.port ?? process.env.PORT)}: expected a port number`);
@@ -6001,8 +6117,9 @@ async function cmdHubServe(values, positionals) {
   const path = resolve15(values.db ?? process.env.YOUI_HUB_DB ?? join28(process.env.XDG_DATA_HOME || join28(homedir4(), ".local/share"), "youiyoux/hub.db"));
   const store = await openStore({ path });
   const dist = builtHub();
-  const hub = await startOrgHub({ store, ingestToken: process.env[HUB_TOKEN_ENV], viewKey: process.env[VIEW_KEY_ENV], dist, host: values.host ?? "127.0.0.1", port });
-  print([`${style.ok("youiyoux hub")} ${hub.url}  ${style.dim(`read-only \xB7 records kept in ${where2({ path })}`)}`, ...dist ? [] : [style.warn("! the hub's page is not built here (pnpm --filter web build): the API answers at /api/org")], style.dim(`  CI sends records with ${HUB_TOKEN_ENV}; people sign in with ${VIEW_KEY_ENV}. Put it behind https; --host 0.0.0.0 to listen beyond this machine`)].join("\n"));
+  const hub = await startOrgHub({ store, ...github ? { github } : { ingestToken: process.env[HUB_TOKEN_ENV] }, viewKey: process.env[VIEW_KEY_ENV], dist, host: values.host ?? "127.0.0.1", port });
+  const senders = github ? `CI sends records from GitHub Actions in ${owners.join(", ")}, on ${(branches.length > 0 ? branches : DEFAULT_BRANCHES).join(" or ")}, each proving its repository (OIDC, for ${audienceOf(audience)})${process.env[HUB_TOKEN_ENV] ? `; ${HUB_TOKEN_ENV} is not used` : ""}` : `CI sends records with ${HUB_TOKEN_ENV}, which can name any repository (${GITHUB_OWNERS_ENV} makes GitHub Actions prove each one's)`;
+  print([`${style.ok("youiyoux hub")} ${hub.url}  ${style.dim(`read-only \xB7 records kept in ${where2({ path })}`)}`, ...dist ? [] : [style.warn("! the hub's page is not built here (pnpm --filter web build): the API answers at /api/org")], style.dim(`  ${senders}; people sign in with ${VIEW_KEY_ENV}. Put it behind https; --host 0.0.0.0 to listen beyond this machine`)].join("\n"));
   await new Promise((done) => {
     const stop = () => done();
     process.once("SIGINT", stop);

package/dist/youi.js

@@ -2,7 +2,7 @@
 import { createRequire as __youiRequire } from "node:module"; import { dirname as __youiDir } from "node:path"; import { fileURLToPath as __youiPath } from "node:url"; const require = __youiRequire(import.meta.url); const __youiDirname = __youiDir(__youiPath(import.meta.url));
 import {
   main
-} from "./chunks/chunk-VXR7FMM7.js";
+} from "./chunks/chunk-EV62TUDV.js";
 import "./chunks/chunk-PCLXMWZ2.js";
 import "./chunks/chunk-42YJX3W5.js";
 import "./chunks/chunk-5I2VHSEN.js";

package/dist/youiyoux.js

@@ -3,7 +3,7 @@ import { createRequire as __youiRequire } from "node:module"; import { dirname a
 import {
   COMMAND_NAMES,
   main
-} from "./chunks/chunk-VXR7FMM7.js";
+} from "./chunks/chunk-EV62TUDV.js";
 import "./chunks/chunk-PCLXMWZ2.js";
 import "./chunks/chunk-42YJX3W5.js";
 import "./chunks/chunk-5I2VHSEN.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "youiyoux",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Your agent rebuilds components you already have. youiyoux catches it: npx youiyoux turns any repo into a shareable report of near-duplicate components, hardcoded token values and off-library imports, with the fixes.",
   "license": "MIT",
   "repository": {
@@ -46,9 +46,9 @@
     "typescript": "6.0.3"
   },
   "devDependencies": {
-    "@youiyoux/cli": "0.1.12",
-    "@youiyoux/core": "0.1.12",
-    "@youiyoux/scanner": "0.1.12"
+    "@youiyoux/core": "0.1.13",
+    "@youiyoux/scanner": "0.1.13",
+    "@youiyoux/cli": "0.1.13"
   },
   "exports": {
     "./package.json": "./package.json"