+ 2jt a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t H t H t ^RIHtHtHt^RIHt^RIHtHtHt^RIHt^RIt^R IHt^R IHtHt^R IH t ^R I!H"t"^R I#H$t$^RI%H&t&^RI'H(t(H)t)^RI*H+t+^RI,H-t-^RI.H/t/^RI0H1t1^RI2H3t3H4t4^RI5H6t6H7t7^RI8H9t9^RI:H;t;Ht>H?t?H@t@HAtAHBtBHCtCHDtDHEtE^RIFHGtGHHtHHItI^RIJHKtK^RILHMtMHNtNHOtOHPtPHQtQHRtRHStSHTtTHUtUHVtV^RIWHXtXHYtYHZtZH[t[H\t\^RI]H^t^H_t_H`t`HataHbtbHctc^RIdHeteHftfHgtgHhthHiti]'d^RIjHktkHltl^RIjHmtn^R IoHptp^R!IqHrtr.EROts]P!R.4tu]v!0ER m4tw]v!R3R404tx^tyR5tzR6t{] !R7R7R87!R9R*44t|] !R7R7R87!R:R(44t}!R;R%]P4t!R<R#]P4t] !R7R7R87!R=R$44t] !R7R7R87!R>R'44tR?R@ltRARBlt] !R7R7R87!RCR"44t] !R7R7R87!RDR-44t] !R7R7R87!RER)44t^tER!RFRGllt] !R7R7R87!RHR+44tRIRJlt!RKR&];4t!RLR,];4tRMRNltRORPltRQRRltRSR7RTRRUR/RVRWlltRXR/RYRZlltR[R\ltR]R^lt]EP*!]4tR_R`ltRaRbltRcRdltReRfltRgRhltRiRjltRkRlltRmRnltRoRpltRqRrltRsRtltRuRvltRwRxltRyRzltR{R|ltR}R~ltRRltRRltRRltRRltRRltRRltRRltRRltRRltRRltRRltRRlt]v!RR04tRRltRRltRRltRRlt]v!0ER"m4tRRltRRltRRltER#tER$tER%tER&tR1RR2R/t]^EP!4UUu/uFwrVR/,VR0,3VbK upptR]R&RRltRRltRRlt]v!0ER'm4tRRltRRlt]v!0ER(m4t]v!R04],t]v!0ER)m4t]v!0ER*m4tER+tRRltRRltRRltRRltRRltRRltRRltRR7/RRlltRRltRRltRRltRRltRRltRRltRRltRRltRRltRRltRRltRRlt]v!0ER,m4tRRltRRlt]v!RR04tRRlt]v!RR04tRRltRRltRRltRRltRRltRRlt^t]Uu/uFq"EPVbK upt]v!RR04tRRltRRltER-RRlltRRltRRltRRltERERltERERlt^tERERlt]v!0ER.m4t]!ER ]v!ERER04ER ]v!ER04/4tER ]ER &ER ERlEtERERlEtERERlEtERERlEtERERlEtERERlEt]v!0ER/m4EtERERlEtERERlEtER0Et ERERlEt R#uuppiuupi(1aRead ``[tool.nab]`` from a ``pyproject.toml`` into a typed config. The CLI is intentionally narrow: anything that defines *what* gets resolved lives in ``[tool.nab]``; anything about *how this run executes* lives on the CLI. This module owns the project side. ) annotationsN) defaultdict) dataclassfieldreplace)datetime timedeltatimezone)MappingProxyType) TYPE_CHECKINGAnycast)urlsplit)override)ArchiveRequestArchiveRequestError) is_file_url) IndexConfig)SimpleSerialization)subdirectory_escapes) KIND_EXTRA KIND_GROUP)parse_iso_datetime)tool_nab_section)known_vcs_schemes) Requirement)InvalidSpecifier SpecifierSet) InvalidNamecanonicalize_name)Version) ConfigErrorEffectiveValue SourceKind SourceRootsbuild_cli_layerdiscover_layerspyproject_registry_keysread_env_layerreject_user_keys_in_pyprojectresolve_anchorresolve_config)DEFAULT_INDEX_NAMEDEFAULT_INDEX_URL IndexRoute) resolve_path) ArchiveSource BuildPolicy DecisionOrder DistPolicy LocalSourceResolutionStrategy ResolveMode VcsConfig VcsPolicy VcsSource) DEFAULT_LIBC LIBC_MAJORLibc PlatformSpec platform_kind)PLATFORM_MARKERSMatrix ResolveTargetcheck_free_threadedhost_environmentpython_axis_environment)WorkspaceConfigdiscover_workspace_rootmerge_workspace_local_sourcesread_workspace_membersworkspace_local_sources)MappingSequence)Set)Path) VersionRange ConflictFork ConflictKindConflictMemberConflictPolicyConflictSelectionError ConflictSetEnvironmentConfig IndexOverride MatrixConfigNabProjectConfigOverrideConflictErrorPackageOverridez ^P(\d+)D$ sys_platformplatform_machineplatform_releaseplatform_versionpython_versionpython_full_versionrequires-pythonz[project] requires-pythonT)frozenslotscZ]tRt^t$RtR]R&R]R&RtR]R&RtR ]R &RtR ]R &R t R#)rWz3User-declared matrix axes for universal resolution.strpythontuple[PlatformSpec, ...] platformsasc python_orderNzMapping[str, str] | Nonepython_patchestuple[str, ...]implementationscpython) __name__ __module__ __qualname____firstlineno____doc____annotations__rjrkrm__static_attributes__rn\/home/user/billing-ledger-validation/.venv/lib/python3.14/site-packages/nab_python/config.pyrWrWs/= K''L#/3N,3'3O_3rxcF]tRt^t$RtRtR]R&RtR]R&RtR]R&Rt R#) rUaThe single environment ``[tool.nab.environment]`` declares. The axes a target is made of, the same ones a matrix entry carries. An unset axis takes the host's value, so an empty table is the host and a table naming only ``python`` is the host machine running another Python. ``platform`` is the same :class:`~nab_python.tags.PlatformSpec` a ``matrix.platforms`` entry parses to, so the wheel-tag knobs (the libc family, the libc and macOS the lock must run on, the kernel marker values, the free-threaded build) are declarable here too. N str | NonerfzPlatformSpec | Noneplatformimplementationrn) rqrrrsrtrurfrvr|r}rwrnrxryrUrUs( FJ$(H!(!%NJ%rxc&]tRt^tRtRtRtRtRtR#)rRaHow exclusive the members of a :class:`ConflictSet` are. Mirrors Gentoo's ``REQUIRED_USE`` group operators. ``AT_MOST_ONE`` (``??``) is the default for a bare uv-style set: the members are mutually exclusive but selecting none is fine, which suits opt-in extras. ``EXACTLY_ONE`` (``^^``) additionally requires one to be chosen. ``AT_LEAST_ONE`` (``||``) only forbids the empty selection; it is rarely useful for extras and is included for completeness. z at-most-onez exactly-onez at-least-onernN) rqrrrsrtru AT_MOST_ONE EXACTLY_ONE AT_LEAST_ONErwrnrxryrRrRs  KK!Lrxc"]tRt^tRt]t]tRt R#)rPz&ConflictSet.__str__..s8..=*Q66<<(*.0N)rrRr frozensetrrcss& ryr,conflict_exclusion_groups..s=B 99N77 7 > ="**===s A $A tuplers&ryconflict_exclusion_groupsrs6 555 rxc V^8dQhRRRR/#rrn)rs"ryrrs  $ + rxcZ\;QJd.RV4FNK 5#!RV44#)aVProject every conflict set (any policy) to ``(kind, name)`` member sets. Distinct from :func:`conflict_exclusion_groups`, which drops :attr:`ConflictPolicy.AT_LEAST_ONE` because that policy permits co-selection. The disjointness validator uses this projection to tell already-declared collisions from undeclared ones when shaping the hint. c3Z"TF!p\RVP44xK# R#5i)c3d"TF&qPPVP3xK( R#5irrrs& ryr3conflict_member_groups...rrN)rrrs& ryr)conflict_member_groups..s%HQ" ="**=== s)+rrs&ryconflict_member_groupsrs6 5HQ55HQ rxcH]tRtRt$RtR]R&R]R&R]R&R tR]R&R tR #) rOiaOne fork of a conflict-driven universal resolve. ``selection`` is the active conflicting members as ``(kind, name)`` pairs. ``active_extras`` and ``active_groups`` are the selections this fork resolves with, the non-conflicting ones plus its own chosen members, and hold only names the project declares. A name ``[tool.nab]`` configures is on ``active_configured`` instead. An unforked resolve is a single fork with an empty ``selection``. ztuple[tuple[str, str], ...] selectionrl active_extras active_groupsactive_configuredrnN)rqrrrsrtrurvrrwrnrxryrOrOs++*"""")++*rxc]tRtRt$RtR]R&R]R&R]R&R tR ]R &R tR ]R &R tR]R&R t R]R&Rt R]R&R t R]R&R t R]R&R t R]R&R tR]R&]!RRR7tR]R&RtR #) rZi+aOne per-package override: a requirement plus a body. Built from either ``[tool.nab.packages.]`` (the name-keyed sugar table) or a ``[[tool.nab.package-rules]]`` entry (one body across the requirements in its ``match`` selector). The selector is a single PEP 508 ``requirement`` (name plus an optional version specifier; no extras, marker, or URL); ``name`` is its canonical package name and ``version_range`` its range, so a policy field applies only to candidate versions inside it. The *body* sets any combination of ``dist_policy`` (with ``dist_trust_unverified_deps`` folding in the sdist-trust flag), ``build_policy``, the ``uploaded_prior_to`` cutoff (or ``uploaded_prior_to_disabled`` for the ``false`` form), the routing ``index``, and the metadata-override fields. An entry that sets ``index`` must use a bare-name requirement (full range), because routing decides where to fetch a listing before any version is known. The metadata-override fields ``dependencies``, ``requires_python``, and ``provides_extra`` substitute for what nab would parse from the distribution, keyed to the matched version range (uv ``dependency-metadata`` parity). Each replaces its field independently: ``dependencies`` becomes the whole runtime ``Requires-Dist`` list, ``requires_python`` the Python specifier, and ``provides_extra`` the declared extras. For every one, ``None`` means the entry does not set it; a present-but-empty value (``()`` for the two tuples) is a distinct, first-class value meaning "replace with nothing". r requirementrerrN version_rangeNDistPolicy | None dist_policy bool | Nonedist_trust_unverified_depsBuildPolicy | None build_policydatetime | Noneuploaded_prior_toFbooluploaded_prior_to_disabledr{indextuple[Requirement, ...] | None dependenciesrequires_pythontuple[str, ...] | Noneprovides_extra)defaultcompare source_labelrn)rqrrrsrtrurvrrrrrrrrrrrrwrnrxryrZrZ+s6 I%)K").2 2'+L$+)--',,E:37L07"&OZ&-1N*1 b%8L#8rxcp]tRtRt$RtRtR]R&RtR]R&RtR]R &Rt R ]R &R t R ]R&Rt R]R&Rt R#)rVi[aOne ``[tool.nab.index.]`` entry: policy for an index. Keyed by a declared index name. The body sets any combination of ``dist_policy`` (with ``dist_trust_unverified_deps``), ``build_policy``, the ``uploaded_prior_to`` cutoff (or ``uploaded_prior_to_disabled`` for the ``false`` form), and ``assume_fresh_seconds``, a read-time freshness floor on the index's Simple listing. It applies to every package served from that index; it carries no routing and no version scope. NrrrrrrrrFrr int | Noneassume_fresh_secondsrn) rqrrrsrtrurrvrrrrrrwrnrxryrVrV[sK &*K").2 2'+L$+)--',,'+*+rxc ,V^8dQhRRRRRRRRRR/#) rselected_extras Sequence[str]selected_groupsrrconfigured_groupsrzlist[ConflictFork]rn)rs"ryrrvsARR"R"R%R% R  Rrxc zVUu.uFp\V4NK ppVUu.uFp\V4NK pp\\PRV444p\ V4p \ V4p \ V4V ,p .p \ 4p \ 4pVFpVP \ PJdK#VPUu.uFp\VW4'gKVNK pp\V4\8dKhV PV4VF@pVP\PJdT MTpVP!VP"4KB K V 'g,\%R\'V4\'V4\'V4R7.#VUu.uF qDV 9gK VNK ppVUu.uF qfV9gK VNK ppVUu.uF qfV9gK VNK pp.p\(P*!V !EFpVUu.uF/pVP\PJgK#VP"NK1 ppVUu.uF/pVP\P,JgK#VP"NK1 ppVUu.uF qfV 9gK VNK ppVUu.uF qfV 9gK VNK ppVP\%\'\/RV444\'VV,4\'VV,4\'VV,4R74EK V#uupiuupiuupiuupiuupiuupiuupiuupiuupiuupi)a|Split a selection into one fork per mutually-exclusive combination. A conflict set is *engaged* when the selection activates two or more of its members under an exclusivity policy (at-most-one or exactly-one); only an engaged set forces a fork. Each engaged set contributes one chosen member per fork, and the forks are the cartesian product across engaged sets. Members of engaged sets are dropped from the shared base; non-conflicting selections stay active in every fork. With no engaged set the result is a single unforked fork carrying the whole selection. A declared group is active when the selection names it. A ``configured_groups`` name is active whenever it is set, since the context it names is part of every resolve rather than something a run asks for, so a set naming one engages on every run. Those names come back on :attr:`ConflictFork.active_configured` rather than ``active_groups``, which stays what the ``[dependency-groups]`` loader can resolve. Names compare and emit canonicalised; the extra and group loaders normalise on lookup, so a canonical active set resolves the same requirements the user's spelling would. c38"TFp\V4xK R#5irr)rgs& ryr!conflict_forks..s#TBSQ$5a$8$8BSr)rrrrc3d"TF&qPPVP3xK( R#5irrrs& ryrrs&Mu! aff'=urrn)rlistdictfromkeyssetrrRrr_member_activelen_MIN_ENGAGED_MEMBERSappendrrPraddrrOr itertoolsproductrsorted)rrrre base_extrasr base_groups configuredconfigured_set extra_set group_setengaged drop_extras drop_groups conflict_setrrmembertarget rest_extras rest_groupsrest_configuredforkscombo chosen_extraschosen chosen_groupschosen_configureds&&&& ryconflict_forksrvs:2AAA$Q'KA1@AA$Q'KAdmm#TBS#TTUJ_NK IK >1I+-GEKEK!   ."="= = #++ +!~a/VAA+   w<. . wF$*KK<3E3E$E[;F JJv{{ #"  #K0#K0"' "3    *Bkk-A11kKB)Bkk-A11kKB",E*Q0Dqq*OE "E""G,).OA!&&L. s@@s )rrr)r<s&ryconfigured_group_namesrAsX 5 ++V-?-?@55 ++V-?-?@ rxc]tRtRtRtRtR#)rSialA requested extra/group selection violates a declared conflict. Raised when one resolve cannot serve the selection: a project resolving for a single environment cannot install two mutually-exclusive members at once. A declared matrix forks the resolve instead of raising, and only raises when one fork still reaches two members (through an umbrella extra, say). rnNrqrrrsrtrurwrnrxryrSrSrxc]tRtRtRtRtR#)rYiaA per-package and a per-index override set the same field for one candidate. Raised at resolve time when a candidate ``(package, version)`` served from an index is governed by both a per-package override (whose range contains the version) and a per-index override that each set the same policy field. The two surfaces are deliberately not ranked, so an overlap is an error rather than a precedence call. rnNrCrnrxryrYrYrDrxc(V^8dQhRRRRRRRR/#)rrrQrzAbstractSet[str]rrrrn)rs"ryrr&s0(( (#($( (rxczVP\PJdVPV9#VPV9#)z=Return True when ``member`` is in the selected extras/groups.rrPrr)rrrs&&&ryrr&s4 {{l((({{m++ ;;- ''rxc(V^8dQhRRRRRRRR/#rrrrrrrNonern)rs"ryrr1s0"*"*$"*""*#"* "*rxcha a VUu0uFp\V4kK upo VUu0uFp\V4kK upo VFp\;QJd*V V 3RlVP4F 'gK RM RM!V V 3RlVP44pV'dK]VP\P JdK}RP RVP44pVP\PJdRMRpV RV R VPP R 2p \V 4h R #uupiuupi) aVRaise when a require-one set has no active member. Enforces only the "must select one" policies: an exactly-one set and an at-least-one set each require at least one active member. Names compare under canonicalisation. Universal mode calls this to apply the minimums without the co-selection rejection, which it handles by forking instead. c3><"TFp\VSS4xK R#5ir)r)rrrrs& ryr-validate_conflict_minimums..As$ ) 1m] ; ;)sTFrc38"TFp\V4xK R#5irrrs& ryrrNIsA,@qCFF,@rz exactly onez at least onez of z must be selected: declared z in [tool.nab].conflictsN) ranyrrrRrrrrrS) rrrrrr any_activer quantifiermsgrrs &&& @@ryvalidate_conflict_minimumsrT1s 4CC?a&q)?CM3BC?a&q)?CM! S !)) SSS !))       ."<"< < ))AL,@,@AA""n&@&@@   l$wi(##))**B D %S))'"DCs D*D/c(V^8dQhRRRRRRRR/#rJrn)rs"ryrrVs0..$.".#. .rxc VUu0uFp\V4kK ppVUu0uFp\V4kK pp\P\P0pVFpVPU u.uFp \ WV4'gKV NK p p \ V 4^8gKDVPV9gKWRPRV 44p V RVPP R2p \V 4h R#uupiuupiuup i)aRaise when a selection co-activates two members of an exclusive set. An at-most-one or exactly-one set cannot have two active members at once. Names compare under canonicalisation. Universal mode applies this per fork, against the self-reference- and include-expanded active set, to catch members an umbrella selection reaches only transitively (one fork cannot serve two of them disjointly). rc38"TFp\V4xK R#5irrrs& ryr/validate_conflict_exclusions..ms6v!s1vvvrz; cannot be selected together: declared mutually exclusive (z) in [tool.nab].conflictsN) rrRrrrrrrrrrS) rrrrrrr exclusiverractiverrSs &&& ryvalidate_conflict_exclusionsr[Vs4CC?a&q)?MC3BC?a&q)?MC++^-G-GHI! ")) )a > A)  v;?|22i?YY6v66F(+228899RT )- -"DC sC1C6(C;C;discover_workspaceanchor cli_overridesc ,V^8dQhRRRRRRRRR R /#) rpathrMr\rr]rr^zMapping[str, Any] | NonerrXrn)rs"ryrrusCTT TT  T , T  TrxcVf%\P!\P4pVPP 4p\ V4\V4p\WDVP, R7p\V4;_uu_4\V4p\T;'g/4p\V\/4V4p RRR4\X VVVR7p \!V R,V4\#V R,V R,4\%V R,V R,V4V'd)\'W V R,P(P*R7p V # +'giL;i)aQParse ``[tool.nab]`` from ``path`` into :class:`NabProjectConfig`. Returns the default ``NabProjectConfig`` when the table is absent. Unknown keys at the top level are rejected so typos fail loud. When ``discover_workspace`` is true (the default), the merged ``workspace`` table drives discovery and its members resolve against the project directory. A project that declares no workspace of its own walks up from ``path`` for the first ancestor project file that declares one. Either way every member is materialised as an additional :class:`LocalSource` (explicit ``[[tool.nab.local-sources]]`` entries win on collision). A workspace does not change the effective ``build-policy``: a member with dynamic metadata needs a build, and under ``never`` it is refused like any other source. Pass ``discover_workspace=False`` to skip discovery; useful for tests or for callers that layer their own workspace logic on top of a base config. The ``[tool.nab]``-config portion is sourced from the registry merged ladder (pyproject ``[tool.nab]`` plus a project-dir ``nab.toml``, merged by :func:`config_sources.resolve_config` with its per-key merge, cross-file conflict check, and category gate), so a project-dir ``nab.toml`` value configures the resolve exactly as the inspector reports it. The cross-field transforms (mode/matrix, the build-policy host-build gate, universal marker-environment ban, source-name uniqueness, declared index references) then run on the merged config; workspace discovery runs last. ``anchor`` is the timestamp ``PD`` durations resolve against. Defaults to ``datetime.now(UTC)`` when not supplied, which gives fresh-resolve semantics. The ``nab lock`` CLI passes the anchor captured in any existing lockfile so re-locks reproduce the same cutoff for relative durations. ``cli_overrides`` carries the ``--project-*`` overrides for the PROJECT options that take a CLI flag, keyed by registry key. They layer as the highest-precedence source, so a flag wins over both project files and an array flag appends after them. ``None`` (the default) is a file-only resolve, byte-identical to before. N) project_dir pyproject)r] pyproject_dirproject_requires_python base-group build-groupr-) declared_in)rnowr utcparentresolve_reject_unknown_pyproject_keys_read_project_requires_pythonr$rr*r&r%r+r(_config_from_effective_validate_base_group_is_free&_validate_build_group_has_a_base_group_validate_build_group_is_free_apply_workspace_discoveryoriginlabel) r`r\r]r^rdrerootslayers cli_layer effectiver<s &$$$ ryread_pyproject_configrzus'`~hll+KK'')M"4(;DA MTYY=V WE    '#M$7$7R8 "6>"+=yI  $# 7 F !.s$=WVVWrpackagesz package-rulesrz[tool.nab.matrix] and [tool.nab.environment] cannot both be set: the matrix declares one environment per tuple, so a single declared environment would contradict it. Drop one. build-policytargetsrbuild_policy_setr0r2razdefault-groupsrrfrgz local-sourcesz vcs-sourceszarchive-sourcesr!rrrrrrruploaded-prior-torrrzbuild-requires-depthrrr#r%r'r*r+zdecision-orderr-r0r2rn)rr6 UNIVERSALrtrr#CLIr!r5outranksr_check_package_override_overlap_validate_routes_declared"_validate_index_overrides_declared_environment_from_effective _plan_targets enforce_build_policy_for_targetsDEFAULTr6_PROJECT_REQUIRES_PYTHON*_validate_default_groups_against_conflicts"_validate_configured_conflict_sets_reject_duplicate_source_names_reject_vcs_sources_under_blockrX)ryr]rdre mode_value matrix_valuerr)rSrtrust_unverifiedrdeclared_index_namesr0r2rrrrrrrr#r%r' vcs_configs&$$$ ryroros. 6"JX&L"((D"."4"4F {$$$    ! !Z^^ 3 2 # {###(:  )),*=*=>>C  c" "$-m$<$B$B!K'0';'A'AG$$=W$== :  $ $ ? # ) )$$56/F3299>>!!"+' L 1288O6#:#F1!9/066N+&,,I. 9\#:#@#@'9\*00)M2J2P2Po.44MM*00K 1288O"=+O5!''J#K<    m,22 & \*00   m,22   (   6 $$78>>   " ''=>DD %5       $! " # $(% &' (\*00) *!!1288+ ,K(..- ./ 0,1 2(3 rxc$V^8dQhRRRRRR/#)rr0r/rr3rrKrn)rs"ryrrYs&##2#(# #rxcVFGpVPpVfKW19gK\V4pVP RV: RV: 2p\V4h R#)a?Reject a routing override that names an index not in ``indexes``. A per-package surface is parsed without the declared index set, so the route-points-at-a-real-index check runs here, after the index list is known. The error names the surface the route was declared on (``packages.''`` or ``package-rules[N]``). Nz".index routes to undeclared index ; declared indexes are )rrrr!)r0r pkg_overrideroutevalidrSs&& ryrrYsc* ""  !B/0E,,-.93E9> c" "*rxc$V^8dQhRRRRRR/#)rr2r1rr3rrKrn)rs"ryrros&##0#(# #rxcjVF,pW!9gK \V4pRV RV: RV: 2p\V4h R#)zReject a ``[tool.nab.index.]`` key naming an undeclared index. The registry parses this surface with ``declared_index_names=None``, so the cross-key check runs post-merge with the single-file message. index.z names undeclared index rN)rr!)r2rrrrSs&& ryrrosN   +/0E6th?)). 3 c" " rxc(V^8dQhRRRRRRRR/#)rr`rMr<rXrhrerrn)rs"ryrrs,%% %(%:=%%rxcaVPe<\VPPVPP 4VR7pM\ V4pVfV#\ V4pV'gV#\VPV4p\WQPVP4VPUu0uFp\VP4kK upo\VV\V3RlV44R7#uupi)aqMaterialise the workspace members as local sources. The project's own ``workspace`` table wins, whichever project file declared it (``declared_in`` names that file), and its members resolve against the project directory. A project that declares none walks up for an ancestor project file that does, so ``nab lock `` still resolves against the workspace root. )root_dirrhc3<"TF6p\VP4S9gK\VP4xK8 R#5ir)rr)rsrcexplicit_namess& ryr-_apply_workspace_discovery..s8) ! *.@ ( chh ' '!s AA)r#r4)r-rIrrkrlrFrHrGr#rr%r'rrrr)r`r<rh discovered root_filemergedrrs&&$ @ryrsrss#,    $ $[[((*# ,D1  M+I6  *6+?+? LF"6+=+=v?U?UV=C=Q=QR=Qc'1=QRN () !)   Ss5C7c V^8dQhRRRR/#)rr`rMrrKrn)rs"ryrrs!!!$!rxcVPR4;_uu_4p\P!V4pRRR4\X4p\T\4'g$R\T4P 2p\ T4h\T4\4p\\T4T, 4pT'dRT: R\T4: 2p\ T4hR# +'giL;i \\P3dpT RT 2p\ T4ThRp?i\ dpRT RT 2p\ T4ThRp?ii;i) a)Reject a USER-scope or unknown key in pyproject ``[tool.nab]``. Run before the registry merge so the resolve reports a typo'd ``[tool.nab]`` key and a USER-scope key set in pyproject with the established messages. A USER-scope option (``offline``, ``cache-dir``) surfaces the category error; an unknown key fails loud rather than being silently dropped. Reads the pyproject raw directly; the registry merge reads the same file again, and this keeps the unknown-key error a ``ConfigError`` on the pyproject surface for everything that is a known key. rbNz is not valid TOML: z cannot read : z [tool.nab] must be a table, got zunknown [tool.nab] keys: ; expected one of )opentomliloadUnicodeDecodeErrorTOMLDecodeErrorr!OSErrorr isinstancertyperqr)r'rr)r`fdataexcrSrawknownunknowns& ryrmrms( YYt__::a=D 4 C c4 0c1C1C0DE#"#& # %ESX%&G)'4Fve}FWX#%_  5 5 6(*3%0#C' (TF"SE*#C'(sEC)CC) C& !C)&C))D>D D>$D>%D99D>c V^8dQhRRRR/#)rr<rXrtuple[ResolveTarget, ...]rn)rs"ryrrs"")".G"rxc"\VPVP4pVPe)\VPV^,P34VF2p\ VP VVPVPRJR7K4 V#)aReturn every environment ``config`` resolves against, in matrix order. The host is the target unless the project says otherwise: a declared matrix expands to one target per tuple, ``[tool.nab.environment]`` names a single target (declared when it moves the platform axis, the host machine on another Python when it names only ``python``), and a project that declares neither resolves against the running interpreter, like pip. The ``requires-python`` declaration and the free-threaded floor are checked here rather than at parse time because ``--python`` moves the target after the config is read, and it is the flag that rescues a project whose declaration excludes the host. Every target is checked, matrix included: the lock records the declaration at top level and the targets in ``environments``, so a target the declaration excludes would be a lock that contradicts itself and that a PEP 751 installer refuses. N)sourcer))rr)r _check_free_threaded_environmentr_$_check_requires_python_admits_targetrr)r<rrs& ry plan_targetsrs(FMM6+=+=>G %(   !:!: < ,  " " 00==,   Nrxc$V^8dQhRRRRRR/#)rr)r(rrrrrn)rs"ryrrs)@@ @.F@@rxcVe#\\V4P44#Vf\P!43#VP e \ V43#VPfQh\P!VP43#)zPlan the targets from the two declaring surfaces, pre-assembly. Takes the pieces rather than a :class:`NabProjectConfig` so the config parse can plan (and enforce the build policy) while it is still assembling one. ) rmatrix_from_configexpandrAfor_hostr|_declared_targetrffor_host_python)r)rs&&ryrrs'/66899&&(**' -//    )) )  ) )+*<*< = ??rxc V^8dQhRRRR/#)rrrUrrArn)rs"ryrr s"3 rxcVPfQhVP;'g\4R,p\V4pVP;'gRp\ YP'd VR,3MR4\ \V4P4\8p\P!VR,VPTV'dVR,R7#RR7#)a(Build the one target ``[tool.nab.environment]`` declares. The platform is named, so the target's markers and wheel tags are synthesized from it rather than read off the host. An unset ``python`` takes the host's release, and an unset ``implementation`` is CPython, matching the matrix default. Nr`rpr_)r_specr}r`rn) r|rfrCrDr}rrr release_PYTHON_MINOR_PARTSrA for_declared)rrfaxisr} pinned_micros& ryrr s    ++ +    L L#3#56K#LF "6 *D //<<9N$2D2D2Dd+,."wv../2EEL  % %,-  ! !%;GD!67  NR  rxc$V^8dQhRRRRRR/#)rrrUpython_versionsrrrKrn)rs"ryrr)s$(("(5B( (rxcVPfR#\VP3VP;'gR3VR7R# \dpRT 2p\ T4ThRp?ii;i)a8Hold ``[tool.nab.environment]`` to the free-threaded interpreter floor. ``python_versions`` is empty for a table that names no python, since ``--python`` can still move that axis after the parse. The parse then checks only the implementation, and :func:`plan_targets` checks the python the target ended up on. Nrp)rhrmrz invalid [tool.nab.environment]: )r|rBr} ValueErrorr!)rrrrSs&& ryrr)sn#("++-(77DD9F+ (06#C'(s#A A A# AA#c V^8dQhRRRR/#)rr)rWrr@rn)rs"ryrr@s  |  rxc\VPVPVPVPe\ VP4MRVP R7#)zBBuild the expandable :class:`Matrix` from its parsed config table.Nrfrhrjrkrm)r@rfrhrjrkrrm)r)s&ryrr@sM }}""((+1+@+@+LD&& 'RV.. rxc V^8dQhRRRR/#)rrSequence[ResolveTarget]rrrn)rs"ryrrMsGG"9GdGrxcj\;QJdRV4F 'gK R# R#!RV44#)zWhether any target impersonates a machine other than the host's. A declared target (a matrix tuple, or an environment naming a platform or implementation) carries a :class:`PlatformSpec`; the host and a host-python retarget do not. c3<"TFqPRJxK R#5ir) platform_specrrs& ryr'_forbids_host_builds..TsFgF##4/gTF)rP)rs&ry_forbids_host_buildsrMs- 3FgF33F3F3FgF FFrxc 0V^8dQhRRRRRRRRR R R R/#) rrrrr1rrr0Sequence[PackageOverride]r2r1rrn)rs"ryrrWsF22 $22 2 1 2 1 22rxcx\V4'dH\VVVVR7pV'd!RRPV4 R2p\V4h\P #\ ;QJdRV4F 'dK RM RM !RV44'g(\PRV^,P4V#) aiReturn the build policy the planned targets permit, or raise. A PEP 517 backend only ever runs on the host interpreter, so what a build reports is the host's metadata. Two tiers follow: * A target that moves the platform axis (a matrix, or an environment naming a ``platform`` or ``implementation``) forbids host builds: ``build-policy`` is forced to ``never`` and an explicit non-``never`` value, global or in any override, is an error. This matches pip, which requires ``--only-binary=:all:`` under ``--platform``. * A python-axis-only retarget on the host machine warns and permits: the machine is still the host, so a build can run at all, and refusing every one of them would take the default case with it. A deliberate deviation from pip. Set ``build-policy = "never"`` to forbid it. The host target permits, so the default case builds freely. )rrr0r2zQa declared target cannot build on the host, so build-policy must be 'never'; got rz. A PEP 517 backend runs on the host and reports the host's metadata, not the target's. Remove the setting (it defaults to 'never' for a declared target) or set it to 'never'.c38"TFqPxK R#5ir) host_faithfulrs& ryr3enforce_build_policy_for_targets..s:'##'rFTzthe resolve targets Python %s but a build would run on the host interpreter and report its metadata; set build-policy = 'never' to forbid builds) r_explicit_host_buildsrr!r1NEVERall_loggerwarningr`)rrrr0r2 offendingrSs$$$$$ ryrrWs4G$$)-%/+  ))-9)=(>?HH c" "   3:':333:': : :  AJ * *  rxc ,V^8dQhRRRRRRRRR R /#) rrrrr1r0rr2r1rz list[str]rn)rs"ryrrs<1  1   rxc.pV'd4V\PJd VPRVP: 24VFWpVPpVfKV\PJgK+VPRVP RVP: 24KY VP 4FOwrxVPpVfKV\PJgK-VPRV RVP: 24KQ V#)zName every surface that explicitly asks for a non-``never`` build. An unset global is not offending: ``build-policy`` defaults to ``never`` for a target that forbids host builds rather than failing a project that never mentioned it. zbuild-policy = packages.z build-policy = r)r1rrrrritems) rrr0r2rpkgbprindex_overrides $$$$ ryrrsIL 0A0AA?<+=+=*@AB     >b (9(99   y(99I"((V W!!0 5 5 7  ( ( >b (9(99   vdV+;BHH<H I!8 rxc$V^8dQhRRRRRR/#)rr<rXrfr{rrn)rs"ryrrs$22 2&022rxcVfV#VPeRp\V4h\V4TPf \ TR7M\ TPTR7p\\TPT4TPRTPTPR7p\ YTR7p\T4T# \dpRT: 2p\T4ThRp?ii;i)aMReturn ``config`` with its resolve target moved onto ``python``. The ``--python`` flag (and the ``python_version`` argument of :func:`~nab_python.resolve.resolve_for_targets`) retargets the python axis for one run, leaving any declared platform in place. The build-policy guard runs again over the new plan, so a runtime retarget is held to the same rule as a declared one. ``None`` is a no-op. A matrix already declares the python axis for every target it names, so retargeting one of them would resolve for a python the matrix does not model and record it under that target's label. Nz--python cannot retarget a resolve that declares [tool.nab.matrix]: the matrix names the python axis of every target. Narrow matrix.python instead.z8--python must be a version like '3.12' or '3.12.4', got )rfTr)rr) r)r!r rrrUrrrrr0r2r)r<rfrSrrr retargeteds&& rywith_python_overriders~  }}  6 #(    % ( V'' 7 4fmm[9(( 22..L|TJ / (H S#C'(s B;; CCCc ,V^8dQhRRRRRRRRR R /#) rrr{rrArrer)rrrKrn)rs"ryrrs:/// /  /  /  /rxcVfR#VP\V44'dR#V RV: RVP RVP R2pV'dV R2pMV R2p\ V4h)a2Reject a ``requires-python`` declaration that excludes the resolve target. ``requires-python`` declares the Python range the project supports; it does not steer the resolve. Resolving for a Python the project says it does not support would produce a lock the project's own metadata rejects, so it fails loud and names the knob that moves the target. A minor-interval target is admitted when ``requires-python`` overlaps its whole minor, so a micro floor like ``>= "3.11.4"`` admits the 3.11 minor rather than excluding it at the synthetic ``.0`` floor. Which knob the error names depends on the target. A matrix declares the python axis of every target it expands, and both ``--python`` and ``[tool.nab.environment]`` are themselves errors alongside one, so a matrix target is moved by ``matrix.python`` instead. Nz = z$ excludes the resolve target Python rz).z [tool.nab.matrix] declares the python axis of every target it expands: narrow matrix.python to drop the version, or widen requires-python.z nab resolves for the host interpreter unless told otherwise; pass --python with a version the declaration admits, set [tool.nab.environment] python to one, or widen requires-python.)admits_requires_pythonrr`rur!)rrrr)excludesrSs&&$$ ryrrs, $$\/%BCC (#o()--.bb B j& & jO O c rxc V^8dQhRRRR/#)rrobjectrr6rn)rs"ryrrs ( (v (+ (rxc \V\4'g$R\V4P 2p\ V4h\ V4# \ d2p\R\ 44pRT: RT: 2p\ T4ThRp?ii;i)zmode must be a string, got c38"TFqPxK R#5irrrs& ryr_parse_mode..s4 1ww rzmode must be one of , got N)rrerrqr!r6rr)rrSrrs& ry _parse_moder s eS ! !+DK,@,@+AB#(5!! (4 44$UIVE9=#C'(s A B,A==Bc$V^8dQhRRRRRR/#)rkeyrerrrrlrn)rs"ryrrs!  C  ? rxcX\V\4'g&V R\V4P 2p\ V4h.p\ V4FTwrE\V\ 4'g)V RV R\V4P 2p\ V4hVPV4KV \V4#)z must be a list of strings, got [] must be a string, got ) rrrrqr! enumeratererr)r rrSoutritems&& ry_parse_string_listrs eT " "5d5k6J6J5KL#CU#$$$E1#5d4j6I6I5JKCc" " 4 $ :rxc$V^8dQhRRRRRR/#)rr rerrrKrn)rs"ryrr's!Srxc&\V4pVPP4TP 'dT RT 2p\ T4hTP eT RT 2p\ T4hR# \dpT RT 2p\ T4ThRp?ii;i)zValidate one ``constraints`` entry's shape. A constraint is a name with an optional specifier and marker; it bounds versions but never pulls a package in, so extras and direct-reference URLs are rejected here rather than only at resolve. z is not a valid requirement: Nz cannot have extras: z% cannot be a direct reference (URL): )r specifierto_rangerr!extrasurl)r rreqrrSs&& ry_require_constraintr's($   zzz*4&1# ww:4&A# (23%8#C'(s%A-- B8B  Bc V^8dQhRRRR/#rrrrrlrn)rs"ryrr?sfrxcf\RV4p\V4Fwr#\RV R2V4K V#)rz constraints[])rrr)rrrrs& ry_parse_constraintsr ?s7 }e 4EU#l1#Q/6$ Lrxc$V^8dQhRRRRRR/#)rr rerrlrrKrn)rs"ryrrFs!CDrxc\4pVF-pW29dV RV: 2p\V4hVPV4K/ R#)z has duplicate entry: N)rr!r)r rseenrrSs&& ry_reject_duplicatesr$Fs?UD <E/x8Cc" "  rxc$V^8dQhRRRRRR/#)rr rerrrrn)rs"ryrrOs!SCrxc|\V\4'g&V R\V4P 2p\ V4hV#) must be a string, got )rrerrqr!)r rrSs&& ry_parse_string_valuer(Os; eS ! !,T%[-A-A,BC# Lrxc V^8dQhRRRR/#rrrrr{rn)rs"ryrrVs  V  rxc\RV4p\VRR7p\ T4# \dpRT: RT 2p\T4ThRp?ii;i)zParse ``[tool.nab].base-group`` as a PEP 735 group name. Names the group a lock gives the project's own dependencies, so an installer can ask for one group without them. Unset leaves them unconditional. rfTvalidatez base-group  is not a valid group name: Nr(rrr!rerr canonicalrrSs& ry_parse_base_groupr2Vs_ lE 2C&%cD9  y> &C7">qcB#A%& & A AA c V^8dQhRRRR/#r*rn)rs"ryrrfs  f  rxc\RV4p\VRR7p\ T4# \dpRT: RT 2p\T4ThRp?ii;i)aParse ``[tool.nab].build-group`` as a PEP 735 group name. Names the group a lock gives ``[build-system].requires``, so one lock can describe the environment the project is built in as well as the one it runs in. Unset, a lock says nothing about how it is built. rgTr,z build-group r.Nr/r0s& ry_parse_build_groupr6fs_ mU 3C&%cD9  y> &SG#?sC#A%&r3c V^8dQhRRRR/#r*rn)rs"ryrrvs&Zrxc\RV4p\V4P4V# \dpRT: R2p\ T4ThRp?ii;i)a:Parse ``[tool.nab].requires-python`` as a PEP 440 specifier. A declaration, not a target: it is recorded as the lock's top-level ``requires-python`` and checked against the resolve target, and the target itself comes from ``[tool.nab.environment]`` (the host by default). Stored as the raw specifier string so the lockfile writer can pass it straight to :class:`SpecifierSet`. Raises :class:`ConfigError` for invalid specifiers and for well-meaning bare versions like ``"3.13"``; those are not valid specifiers and must be written ``"==3.13"`` or ``">=3.13,<3.14"``. raz1requires-python must be a PEP 440 specifier, got z(. Did you mean ==X.Y or >=X.Y,.s#!'X+s& ryr0_validate_build_group_is_free..s6H h $ ):8)D)L s < < <rc38"TFp\V4xK R#5irrBrDs& ryrrTrErrrGrH)rrtrr#rr!rrrrIrrrr) rrr`r otherrSrrrJrKrLrs &&& @ryrrrrsE#((D |    " "jnn 4   z  %%7 #  U5'D83PQ# 4Azz!}  XX) *F fd # #  E  II;U; ;E %q1%9' ' c # s -E E c V^8dQhRRRR/#)rr`rMrr{rn)rs"ryrrs>>>>rxcVPR4;_uu_4p\P!V4pRRR4XPR4p\ V\ 4'dRV9dR#\ VR,4# +'giLR;i)aTRead ``[project].requires-python``, the fallback declaration source. ``[tool.nab].requires-python`` (and ``--project-requires-python``) wins when set; otherwise the project's own declaration is what the lock records. The file has already been parsed as TOML by :func:`_reject_unknown_pyproject_keys`, so a decode error cannot reach here. rNprojectra)rrrrIrrr9)r`rrrYs& ryrnrnsd 4Azz!} hhy!G gt $ $(9(H !'*;"< == s A;; B c V^8dQhRRRR/#)rr<rXrzlist[IndexRoute]rn)rs"ryrr s  %5 :J rxcVPUu.uF4pVPfK\VPVPR7NK6 up#uupi)aProject the routing package overrides into coordinator :class:`IndexRoute`s. Each per-package override that sets ``index`` contributes one route, keyed by its bare package name. A routing entry always uses a bare-name requirement (parse-time guarantee), and the parse-time non-overlap check forbids two routes for one package, so the resulting route map has at most one entry per name. )rr)r0rr.r)r<rs& ryindex_routes_from_configr\ sG00 0H >> =  X^^<0  s A %A c V^8dQhRRRR/#)rr<rXrzdict[str, int]rn)rs"ryrrs+;rxcVPP4UUu/uF!wrVPfKWPbK# upp#uuppi)z>Project per-index cache-freshness floors, keyed by index name.)r2rr)r<rrs& ryindex_cache_floors_from_configr_sN%44::< D``). Naive datetimes are rejected so lockfiles read identically across timezones. ``PD`` (a nab extension) is resolved against ``anchor`` so re-locks reproduce the same cutoff. Callers only reach here with a present value (the absent case is handled upstream). Nzfuploaded-prior-to TOML datetime must have an explicit timezone offset (e.g. ``Z`` or ``+00:00``); got zwuploaded-prior-to must be a TOML offset-date-time, an ISO 8601 datetime string with timezone, or a 'PnD' duration; got )daysz)uploaded-prior-to duration is too large: zuploaded-prior-to must be an ISO 8601 datetime with timezone (e.g. '2026-05-01T00:00:00Z') or a 'PnD' duration (e.g. 'P4D'); got zduploaded-prior-to ISO datetime must include an explicit timezone offset (e.g. 'Z' or '+00:00'); got )rrtzinfor!rerrq_DURATION_PATTERNmatchrrgroup OverflowErrorrr)rr]rSduration_matchdtrs&$ ry_parse_uploaded_prior_torj#sY%"" << 9  c" " eS ! ! K(() + #&,,U3N! -I3~/C/CA/F+GHH H(  & yy y  # I'z* -=eYGCc" , - ( ++0) 5 #C' (s$ *C#7 D #$D D,D''D,rtrust-unverified-depsc V^8dQhRRRR/#)rrrrztuple[DistPolicy, bool]rn)rs"ryrr[sV0Grxc\V\4'g#\RV\\P4R3#\ \ V4\, 4pV'd#RV: R\ \4: 2p\V4hRV9dRp\V4h\RVR,\\P4p\RVPR 4RR 7pW43#) zParse the global ``dist-policy``: an enum string or a policy table. The table form ``{ policy = "...", trust-unverified-deps = bool }`` folds the sdist-trust flag into the dist body. Returns ``(policy, trust_unverified)``. r~Fz%dist-policy table has unknown key(s) ; expected rz#dist-policy table must set 'policy'zdist-policy.policy!dist-policy.trust-unverified-depsrkr) rr _parse_enumr3r7rr_DIST_POLICY_TABLE_KEYSr! _parse_boolrI)rrrSrtrusts& ry_parse_dist_policy_globalru[s eT " "  uj*:S:S T   SZ"99:G3G;? 78; = #u3# eHoz:;T;TF + )* E ?rxc(V^8dQhRRRRRRRR/#)rr rerrrrrrn)rs"ryrr|s(STdrxcVfV#\V\4'g&V R\V4P 2p\ V4hV#)Nz must be a boolean, got )rrrrqr!)r rrrSs&&$ ryrsrs|sE } eT " "-d5k.B.B-CD# Lrxc ,V^8dQhRRRRRRRRR R /#) rr rerrenum_clsztype[enum.Enum]rz enum.Enumrr rn)rs"ryrrs:(( ( (( (  (rxcVfV#\V\4'g&V R\V4P 2p\ V4hV!V4# \ d0p\ RT44pT RT: RT: 2p\ T4ThRp?ii;i)Nr'c38"TFqPxK R#5irrrs& ryr_parse_enum..s11wwr must be one of r )rrerrqr!rr)r rryrrSrrs&&&& ryrqrqs  } eS ! !,T%[-A-A,BC#( (111%eYfUI>#C'(sA B*BBc V^8dQhRRRR/#)rrrrzdict[str, str]rn)rs"ryrrsVrxc\V\4'g$R\V4P 2p\ V4h/pVP 4Fwr4\V\ 4'd\V\ 4'gRV: RV: 2p\ V4hV\9d%\\4pRV: RV: 2p\ V4hV\9d \V4WBV&K V# \dpRT RT: 2p\ T4ThRp?ii;i)z string, got z9marker-environment entries must be string -> string, got rz$unknown marker-environment variable z-; expected a PEP 508 marker variable, one of zmarker-environment.z must be a PEP 440 version, got N) rrrrqr!rre_PEP508_MARKER_VARIABLESr_VERSION_MARKER_VARIABLESr r)rrSrkvrrs& ry_parse_marker_environmentrs# eT " " K(() + #C !S!!As););KA5PRSTRWX c" " , ,34E6qe<,,196 c" " ) ) 0 A'( J  0+A3.NqeT!#&C/ 0s C"" D-DDc V^8dQhRRRR/#)rrrrdict[str, Any]rn)rs"ryrrsfrxc \V\4'g$R\V4P 2p\ V4h\ \ V4\, 4pV'd#RV: R\ \4: 2p\ V4hVP4UUu/uFwr4TVR8XdTM\RV 2V4bK ppp\V4V#uuppi)aParse ``[tool.nab.environment]``: the one environment to resolve for. Kept as the raw table so the registry merges it sub-key by sub-key across the config sources; :func:`_environment_from_effective` turns the merged whole into an :class:`EnvironmentConfig`. ``platform`` takes the two shapes a ``matrix.platforms`` entry takes, a bare id or a table of the wheel-tag knobs, so a dict value passes through here. z,[tool.nab.environment] must be a table, got z%unknown [tool.nab.environment] keys: rnr|z environment.) rrrrqr!rr_ENVIRONMENT_KEYSrr(_validate_environment_values)rrSrr rrs& ry_parse_environmentrs eT " ".Vs")>A )>TF#[tool.nab.marker-environment] sets z without (sys_platform, platform_machine), which is the pair that names the machine. Declare [tool.nab.environment] platform instead: half a machine would keep the other half of the host's.c3,<"TF qS9xK R#5irrn)rr rs& ryrras F0E$ $0Err[rr\zF[tool.nab.marker-environment] sets (sys_platform, platform_machine) = zX, which names no platform nab models. Declare [tool.nab.environment] platform = one of ze; both markers must name one machine, because half a machine would keep the other half of the host's.idr|)rr_MARKER_PYTHON_KEYS_MARKER_IMPLEMENTATION_KEYS_MARKER_PLATFORM_KEYS_MARKER_PLATFORM_IMPLIED_KEYS_MARKER_PLATFORM_KNOBSrrrr!lowerrPrIrr?_check_implied_platform_markersrr) r translatableuntranslatablerSrr rneeds_platformpairrrknobs f ry$_environment_from_marker_environmentr!s OO ;   $  '  LC 23lBCN88JK(),-K K #"$K" $ $$6s$;K ! #+ $ $,>s,C,I,I,KK( )  +K0J3IJJA " " J cc")>"ccc")>"2.1CDG G # s F0E Fsss F0E FFF  " ">2 6  " "#5r : .11$7  +,E((,x09FF c" "'(:KH +# "8!=!=!?!?IC,,.(--!?# J!- UFs! I/I) I!9I!c$V^8dQhRRRRRR/#)rrrrrerrKrn)rs"ryrr~s$)8; rxc\V,p\Uu/uF)pW09gK W,W#,8wgK W0V,bK+ ppV'd2VUu/uF q3W#,bK ppRV: RV: RV: R2p\V4hR#uupiuupi)zReject an overlay whose implied markers contradict the platform it names. The platform id carries ``platform_system`` and ``os_name``, so an overlay that repeats them is translatable; one that disagrees with them names two machines at once. rz, which contradicts platform z, where they are z!. One overlay names one machine.N)r?rr!)rrr?r  conflictingexpectedrSs&& ryrr~s ,H10C  $ %);)@HM)Q % $$0 2=>+3&+>1+A%%0O4|< > #  ?sBB BBc V^8dQhRRRR/#)rryr|rrrn)rs"ryrrs''+''rxcVR,PpVR,PpV'd!V'dRp\V4h\V4pV'gR#VPR4p\ VPR4VfRM \ V4VPR4R7pVP e0VPf"\\4pR V: R 2p\V4hV#) aFold the environment surfaces into the one declared environment. ``[tool.nab.environment]`` is the surface; ``[tool.nab.marker-environment]`` is its deprecated predecessor and is translated into it. Declaring both is an error: the two would have to agree, and a silent precedence between them is exactly the ambiguity the replacement removes. Returns ``None`` when neither is declared, which is the host. rzmarker-environmentzx[tool.nab.environment] and the deprecated [tool.nab.marker-environment] are both set; drop the marker-environment table.Nr|rfr})rfr|r}z[tool.nab.environment].implementation needs a platform: an interpreter is modelled on a declared machine, not on the host's. Add platform = one of .) rr!rrIrUrr}r|rr?)ryr?rrSr|rrs& ryrrs#,M":"@"@H,56J,K,Q,Q -  c" "78JK ||J'H#||H%!)/I(/S||$45K !!-+2F2F2N'( '',iq 2 # rxrrc V^8dQhRRRR/#)rrrrrrn)rs"ryrrs--&-%<-rxc \V\4'g$R\V4P 2p\ V4hV'gRp\ V4h.p\ V4EFZwr4\V\ 4'g'RV R\V4P 2p\ V4h\\V4\, 4pV'd&RV RV: R\\4: 2p\ V4hVR,pVR,p\T\4'd\T\4'gRT R 2p\ T4hR T9d'\T4'dRT R T: R2p\ T4h\RT R2TPR 4\\P 4p TP#\%YgT R74EK] \'V4\)V4# \dpRT R T: 2p\ T4R hR p?ii;i)z(indexes must be an array of tables, got z4indexes must contain at least one entry when presentzindexes[] must be a table, got zunknown indexes[] keys: rnrr] missing required key N] name and url must be strings serializationz].serialization is not settable on a file:// index: a local index is read from disk with no Accept negotiation, so the pin would do nothing. Drop it from index rz].serialization)rrr)rrrrqr!rrrr _INDEX_KEYSKeyErrorrerrqrIr NEGOTIATErr_check_index_name_uniquenessr) rrSrrentryrrrmissingrs & ry_parse_indexesrs eT " "8e9M9M8NO# D#Ce$%&&QC6tE{7K7K6LMCc" "Uk12 "1#Xg[9#K035 c" " -=D,C$$$JsC,@,@QC=>Cc" " e # C(8(81#EEIHAO  c" "#qc ) IIo &   ) )  ;DOPC%D!% :+ -QC6wkBCc" , -s+G G6G11G6c V^8dQhRRRR/#)rrzSequence[IndexConfig]rrKrn)rs"ryrrs*?Drxc\4pVFJpVPV9dRVP: 2p\V4hVPVP4KL R#)z/Reject two indexes declared with the same name.zduplicate index name: N)rrr!r)rr#rrSs& ryrrsJUD :: *5::.9Cc" "  rxrec$V^8dQhRRRRRR/#rrrr]rrlist[PackageOverride]rn)rs"ryrr$s(00 0 0 0rxc v\V\4'dRp\V4h\V\4'g$R\ V4P 2p\V4h.pVP 4FwrERV: 2p\WF4p\V\4'g&V R\ V4P 2p\V4h\WV4\\V4\, 4pV'd%V RV: R\\4: 2p\V4hVP\V3VVVR74K V#)a;Parse ``[tool.nab.packages.]`` into per-package overrides. Each key is a PEP 508 requirement (a bare name, or a name plus a version specifier in a quoted key such as ``"numpy <= 1.21"``) and the sub-table is the override body. The key is the whole selector, so the sugar form carries no inner selector key. z[tool.nab.packages] is the name-keyed table form ([tool.nab.packages.]); for one body across several requirements use [[tool.nab.package-rules]] with match = [...]z?[tool.nab.packages] must be a table keyed by package name, got r must be a table, got : unknown override key(s) ; expected body keys r])rrr!rrrqr_requirement_from_selector_reject_deferredrr_PACKAGE_OVERRIDE_BODY_KEYSextend_build_package_overrides) rr]rSrr bodyrrrs &$ ry_parse_packages_sugarr$s@% N # eT " " U $$% ' #!#C[[] C7#0< $%%G1$t*2E2E1FGCc" "%T%@@A '3G;? ;<?A c" " $   #, Jrxc$V^8dQhRRRRRR/#rrn)rs"ryrrWs(   rxc \V\4'g$R\V4P 2p\ V4h.p\ V4F!wrEVP \WTVR74K# V#)aParse ``[[tool.nab.package-rules]]`` into per-package overrides. Each entry's ``match`` selector lists PEP 508 requirements (name plus an optional version specifier); the body applies to every one, so a single rule can cover many packages (e.g. routing a namespace to one index). z[tool.nab.package-rules] must be an array of tables ([[tool.nab.package-rules]]); for per-package policy keyed by name use [tool.nab.packages.]. Got r)rrrrqr!rr_parse_package_rule_entry)rr]rSrrrs&$ ry_parse_package_rulesrWsm eT " " ::>u+:N:N9O Q #!#Ce$ ,UfEF% Jrxc(V^8dQhRRRRRRRR/#) rrrrrr]rrrrn)rs"ryrrps6NN N N  N  NrxcRV R2p\V\4'g&V R\V4P 2p\ V4h\ W4\ \V4\, 4pV'd%V RV: R\ \4: 2p\ V4h\VPR4V4pV'gV R2p\ V4hVP4UUu/uFwrxVR8wgKWxbK p pp\WiW2R7#uuppi)zpackage-rules[rrrz!; expected 'match' and body keys rezG must carry a 'match' selector listing at least one PEP 508 requirementr)rrrrqr!rrr_PACKAGE_RULE_KEYSr _parse_matchrIrr) rrr]rrSr requirementsr valrs &&$ ryrrps  UG1 %E eT " "-d5k.B.B-CD#U"SZ"445Gg/{;$%@AD F # ' 2E:L g# # #%*[[] E]cWnHCH]D E #L MM Fs  D.Dc ,V^8dQhRRRRRRRRR R /#) rrtuple[Requirement, ...]rrrrer]rrrrn)rs"ryrrsALL)L L L  L  Lrxc\VPR4V4wrERV9d+\V R2VR,\\P4MRp\ VPR4VVRV9R7wrx\ W4p \VPR4V4p \VPR4V4p \VPR 4V4p VRJ;'gWVRJ;'gKVRJ;'g?VRJ;'g3T;'g)V RJ;'gV RJ;'gV RJ;'gV RJp V 'g!V R \\4: 2p\V4hV eBVF;p\VP4'gK V R \V4: R 2p\V4h VUu.uFFp\V\!VP"4VPP%4VVVVVV V V V VR 7 NKH up#uupi)zETurn a validated selector and body into one override per requirement.r~r .build-policyNrr]presentrraprovides-extra3 sets no policy; an entry must set at least one of z.index routing requires bare-name requirements (no version specifier); routing decides where to fetch a listing before any version is known, but z is version-scoped) rrrrrrrrrrrrr)_parse_override_distrIrqr1r!_parse_override_uploaded_prior_to_parse_override_index_parse_override_dependencies_parse_override_requires_python_parse_override_provides_extrarrr!rerrZrrr)rrrr]r dist_trustrruploaded_disabledrrrrhas_bodyrSrs&&&$ ryrrsp3488M3JERK T ! g] #       ,M $% #t+ ,( "$ .E/0H%PL5 "#UO4DHH=M4NPUVN4 & & T ! & & t # & & D ( & &   & &    & & t #  & & $ & & &  %  g236 8 # 'K;(())gK(++=? "#&&(4(!  (K #";#3#34%//88:#'1%/'8%+) (!  s#A G2c$V^8dQhRRRRRR/#)rrrerrrrn)rs"ryrrs!C rxc.\V4pVPP4TP 'g!TP fTP'dT RT: R2p\ T4hT# \dpT RT: R2p\ T4ThRp?ii;i)zParse one selector into a name-plus-optional-specifier requirement. Extras, markers, and URLs are rejected: a selector carries only a package name and an optional version specifier. z entry z# is not a valid PEP 508 requirementNz} may carry only a name and an optional version specifier; extras, markers, and URLs are not supported on the override surface)rrrrr!rmarkerr)rrrrrSs&& ryrrs (!#& &&([//;{gWSG$' ' #  (wsg%HI#C'(s%A// B:BBc V^8dQhRRRR/#)r overridesr/rrKrn)rs"ryrrs++*+ +rxc \Fwr\\4pVF7p\WB4'gKW4P,P V4K9 VP 4FwrV\P!V^4FvwrxVPVP,P'dK4RV: RV: R\VP4: R\VP4: R2 p \V 4h K K R#)aReject two per-package entries setting one field for overlapping ranges. For each (canonical name, policy field) the entries that set the field must have pairwise-disjoint version ranges. Two ranges overlap when ``not (range_a & range_b).is_empty``. A bare-name requirement is the full range, so it overlaps every range for that package; in particular two routing entries for one package always conflict. ztwo per-package overrides for z both set z for overlapping versions: rRzJ. Per-package overrides for one field must cover disjoint version ranges.N)_PACKAGE_POLICY_FIELDSrr_override_setsrrrr combinationsris_emptyrerr!) r_fieldattrby_namerrentriesleftrightrSs & ryrrs/ ;Ft;LEe** #**51%]]_MD(55gqA **U-@-@@JJJ8A":& 0 0145 1 1256II&c** B- /rxc$V^8dQhRRRRRR/#)rrrZrrerrrn)rs"ryrr s! / /_ /C /D /rxcnVR8Xd#VPRJ;'g VP#\W4RJ#)zWhether ``override`` carries the policy field tracked by ``attr``. uploaded-prior-to counts as set by either a cutoff datetime or the ``false`` disable form, so a cutoff entry and a disable entry for one package with overlapping ranges still conflict. rN)rrgetattr)rrs&&ryrr sE ""))5   / /  8 "$ ..rxflat_metadata_advicec(V^8dQhRRRRRRRR/#) rrrrrerrrrKrn)rs"ryrr s, "%@D rxc\\V4\,4pV'd-V RV: R2pV'dRV9d VR, p\V4hR#)zReject override-body keys that are not supported. ``flat_metadata_advice`` gates the package-surface hint to set metadata via the flat body keys; the index surface passes ``False`` since those keys are rejected there too. z : key(s) z are not supportedmetadatazd; set metadata as the flat body keys 'dependencies', 'requires-python', and 'provides-extra' insteadN)rr_OVERRIDE_DEFERRED_KEYSr!)rrrdeferredrSs&&$ ryrr sZc%j#::;Hy ,>? J($: C C#rxc$V^8dQhRRRRRR/#)rrrr]rrzdict[str, IndexOverride]rn)rs"ryrr2 s(   rxc\V\4'g$R\V4P 2p\ V4h/pVP 4FwrERV 2p\ WVVR7W4&K V#)aParse ``[tool.nab.index.]`` into a name-keyed policy map. Each key must name a declared ``[[tool.nab.indexes]]`` entry; that cross-key check is a resolve-path concern run post-merge by :func:`_validate_index_overrides_declared` (the surface is parsed in isolation from the ``indexes`` row, so this parser does not see the declared set). The body sets policy fields only (no routing, no version scope); the override applies to every package served from that index. z:[tool.nab.index] must be a table keyed by index name, got rr)rrrrqr!r_parse_index_override_body)rr]rSrrrrs&$ ry_parse_index_overridesr2 st eT " " U $$% ' #$&Ckkm .t6J $ Jrxc(V^8dQhRRRRRRRR/#) rrrrrer]rrrVrn)rs"ryrrN s,88 88)188rxc 4\V\4'g&V R\V4P 2p\ V4h\ WRR7\ \V4\, 4pV'd&V RV: R\ \4: R2p\ V4h\VPR4V4wrVRV9d+\V R2VR,\\P4MR p\VPR 4VVR V9R 7wr\VPR 4V4p VR J;'g3VR J;'g'VR J;'gVR J;'gT ;'gV R Jp V 'g!V R \ \4: 2p\ V4h\!VVVVV V R7#)rF)rrrz< (per-index overrides carry no routing and no version scope)r~rrNrrassume-fresh-secondsr)rrrrrr)rrrrqr!rrr_INDEX_OVERRIDE_KEYSrrIrqr1rr_parse_index_assume_freshrV) rrr]rSrrrrrrrrs &&$ ryrrN s dD ! !-d4j.A.A-BC#Tu=SY!556Gg/{;+,/0- - #2488M3JERK T ! g] #       ,M $% #t+ ,( 5 '(% 4 , , T ! , , t # , , D ( , ,   , , t +   g+,/ 1 # #-!+#41  rxc$V^8dQhRRRRRR/#)rrrrrerrrn)rs"ryrr s' U U Us U/F UrxcaVfR#\S R2V4p\;QJd.V3RlV4FNK 5#!V3RlV44#)zParse a ``match`` selector into PEP 508 requirements. Each entry is a requirement of name plus an optional version specifier; extras, markers, and URLs are rejected. A bare name means all versions; a version specifier scopes the entry to matching ones. .matchc3B<"TFp\VS R24xK R#5i)rN)r)rrrs& ryr_parse_match.. s#Tes+CE7&1ABBern)rr)rrrLs&f ryrr sD } %/ 7E 5TeT5T5TeT TTrxc$V^8dQhRRRRRR/#)rrrrrerz%tuple[DistPolicy | None, bool | None]rn)rs"ryrr s$++ ++*+rxcVfR #\V\4'd&\V R2V\\P4R3#\V\ 4'g&V R\ V4P 2p\V4h\\V4\, 4pV'd%V RV: R\\4: 2p\V4hRV9dV R2p\V4h\V R2VR,\\P4pVPR 4pVe'\V\4'gV R 2p\V4hWE3#) zParse the ``dist-policy`` body: an enum string or a policy table. The table form ``{ policy = ..., trust-unverified-deps = bool }`` folds the sdist-trust flag into the dist body. Nz .dist-policyzW.dist-policy must be a policy string or a table { policy, trust-unverified-deps }, got z .dist-policy has unknown key(s) rnrz$.dist-policy table must set 'policy'z.dist-policy.policyrkz4.dist-policy.trust-unverified-deps must be a boolean)NN)rrerqr3r7rrrqr!rrrrrIr)rrrSrrrts&& ryrr sa }% '&z:;T;T     eT " "g99=e9M9M8N P #SZ"99:Gg5g[A 78; = #u;<#  '$% h!! F II- .E E4!8!8KL# ?rxc ,V^8dQhRRRRRRRRR R /#) rrrrrer]rrrrztuple[datetime | None, bool]rn)rs"ryrr s4 *2=A!rxcV'gR#VRJdR#VRJdV R2p\V4h\WR7pVR3# \dpT RT 2p\T4ThRp?ii;i) zHParse the ``uploaded-prior-to`` body: ``false`` disables, else a cutoff.NFTz.uploaded-prior-to: ``true`` is not a valid value; use ``false`` to disable the cutoff or a datetime / 'PnD' duration to set a windowrz.uploaded-prior-to: )NF)NT)r!rj)rrr]rrScutoffrs&&$$ ryrr s  ~ }g  #()%? E? (+C51#C'(s : AAAc$V^8dQhRRRRRR/#)rrrrrerrrn)rs"ryrr s!  V C J rxcVfR#\V\4'g\V\4'dV^8:dV RV: 2p\V4hV#)zEParse ``assume-fresh-seconds``: a positive integer number of seconds.NzH.assume-fresh-seconds must be a positive integer number of seconds, got )rrrr!rs&& ryrr sT }%j&<&< g"I ' # Lrxc$V^8dQhRRRRRR/#)rrrrrerr{rn)rs"ryrr s!((6(#(*(rxcrVfR#\V4# \dpT RT 2p\T4ThRp?ii;i)aParse a per-package ``requires-python`` override, naming the entry. An absent key (``None``) means no override; a present value delegates to :func:`_parse_requires_python` for PEP 440 validation, prefixing the ``where`` selector on failure so the message names the offending entry. Nr)r9r!)rrrrSs&& ryrr sI }(%e,, (q#C'(s  616c$V^8dQhRRRRRR/#)rrrrrerrrn)rs"ryrr s$)) ))#)rxcVfR#\V\4'g&V R\V4P 2p\ V4h.p\ V4FzwrE\V\ 4'g)V RV R\V4P 2p\ V4h\V4pVPP4TPT4K| \V4# \dpT RT RT: 2p\ T4ThRp?ii;i)aParse the ``dependencies`` body: PEP 508 strings that replace deps. The list replaces a package's declared runtime dependencies for the matched version range. Each item is a full PEP 508 dependency *value*, so extras, markers, and version specifiers are all legal (unlike the override *key*, which :func:`_requirement_from_selector` restricts to a name plus specifier). A present-but-empty list is stored as ``()`` (replace with zero deps), distinct from the key being absent (``None``). NzA.dependencies must be a list of PEP 508 requirement strings, got z.dependencies[rz&] is not a valid PEP 508 requirement: ) rrrrqr!rrerrrrrr)rrrSrrrrrs&& ryrr s } eT " "g!%[112 4 #CU#$$$'s*B4:CVCVBWX c" " ,%d+K  ! ! * * , ;!$" : ,'s+!!%* c" +  ,s%C C?#C::C?c$V^8dQhRRRRRR/#)rrrrrerrrn)rs"ryrr% s"&AWrxcvVfR#\V\4'g&V R\V4P 2p\ V4h.p\ V4F]wrE\V\ 4'g)V RV R\V4P 2p\ V4hVP\V44K_ \V4#)aFParse the ``provides-extra`` body: the extras the override declares. A TOML array of extra names, each normalised per PEP 685 like a parsed ``Provides-Extra``, so an extra compares equal regardless of spelling. A present-but-empty list is stored as ``()`` (declares no extras), distinct from the key being absent (``None``). Nz3.provides-extra must be a list of extra names, got z.provides-extra[r) rrrrqr!rrerrr)rrrSrrrs&& ryrr% s } eT " "gU $$% ' #CU#$$$')!-J''(* c" " $T*+$ :rxc$V^8dQhRRRRRR/#)rrrrrerr{rn)rs"ryrrC s! rxcVPR4pVe<\V\4'g&V R\V4P 2p\ V4hRV9dV#VfV R2p\ V4hVR,p\V\ 4'g&V R\V4P 2p\ V4hV'gV R2p\ V4hV#)aParse the routing ``index`` body and validate its ``strict`` flag. The route is always a strict pin to one index, so ``strict`` only accepts ``true``. ``strict = false`` is rejected: fallthrough on a miss is not cleanly wireable through the single-index-pin router this release ships. The route-names-a-declared-index check is a resolve-path concern run post-merge by :func:`_validate_routes_declared`, since this parser sees the override surface in isolation from the ``indexes`` row. rz.index must be a string, got strictz5.strict is only meaningful alongside an 'index' routez.strict must be a boolean, got zn.strict = false (fallthrough routing) is not supported in this release; the index route is always a strict pin)rIrrerrqr!r)rrrrSr*s&& ryrrC s IIg E E3!7!74T%[5I5I4JK#u  }LM# 8_F fd # #6tF|7L7L6MN# gD D # Lrxc V^8dQhRRRR/#)rrrrr7rn)rs"ryrre s""f""rxc\V\4'g$R\V4P 2p\ V4h\ 0Rm4p\ \ V4\ V4, 4pV'dRV: RV: 2p\ V4h\RVPR4\\P4p\RVPR.44p\ \ V4\4, 4pV'd'R V: R \ \44: 2p\ V4h\R VPR.44pVFp\V4K VPRR 4p \V \4'g$R \V 4P 2p\ V4h\V\!V4\#V4V R7#)z$[tool.nab.vcs] must be a table, got rallowed-schemes allowed-repos require-pinzunknown [tool.nab.vcs] keys: rnz vcs.policyzvcs.allowed-schemeszunknown vcs.allowed-schemes: z; nab recognises zvcs.allowed-reposTz'vcs.require-pin must be a boolean, got )rallowed_schemes allowed_repos require_pin>rr/r.r-)rrrrqr!rrrqrIr8BLOCKrr_validate_allowed_reporr7rr) rrSallowedrrr0unknown_schemesr1reporequire_pin_raws & ry _parse_vcsr9e s eT " "4T%[5I5I4JK#RSGSZ#g,./G-g[ G;O# uyy':Iy WF(uyy):B?OS14E4GGHO+O+>?(*+. 0 #&UYY;Mt$ii t4O ot , ,7_8M8V8V7WX# !/2M*#  rxc V^8dQhRRRR/#)rr7rerrKrn)rs"ryrr s ( ( ( (rxcn\V4R# \dpRT: RT 2p\T4ThRp?ii;i)zReject an ``allowed-repos`` entry whose authority does not parse. :func:`urlsplit` raises ValueError on an authority it cannot parse, such as an unterminated IPv6 bracket. zvcs.allowed-repos entry  does not parse: N)rrr!)r7rrSs& ryr4r4 s> ( ((0A#G#C'(s  4/4c(V^8dQhRRRRRRRR/#) rrrrrrdrMrr4rn)rs"ryrr s(00v0#00+0rxc\V\4'g'RV R\V4P 2p\ V4h\ \ V4\, 4pV'd&RV RV: R\ \4: 2p\ V4hVR,pVR,p\T\4'd\T\4'gRT R 2p\ T4hTPR R 4p\T\4'gRT R 2p\ T4hTPR 4p T e(\T \4'gRT R2p\ T4hT e'\T 4'dRT RT : R2p\ T4h\Y&4p T fRT RT: R2p\ T4h\T\T 4TT R7# \dpRT RT: 2p\ T4RhRp?ii;i)zlocal-sources[rzunknown local-sources[rrnrr`rNz] name and path must be stringseditableFz] editable must be a boolean subdirectoryz] subdirectory must be a stringz] subdirectory z escapes the source treez] path z is not a usable filesystem path)rr`r?r@)rrrrqr!rr_LOCAL_SOURCE_KEYSrrerIrrr/r4) rrrdrSrr path_valuerr?r@resolveds &&$ ry_parse_local_sourcerD s eT " "qc!8e9M9M8NO#SZ"445G$QCx{; 236 8 #)V}6]  dC :s(C(Cqc!@A#yyU+H h % %qc!=>#99^,L <(E(Eqc!@A#$8$F$FQC|.>>V W #M6Hqc6VW#   ]!  7 )qc!8 D#D()s F44 G?GGc$V^8dQhRRRRRR/#)rrrrdrMrr"rn)rs"ryrr s$    %)  rxca\V\4'g$R\V4P 2p\ V4h\ ;QJd .V3Rl\ V44FNK 5#!V3Rl\ V444#)z.local-sources must be an array of tables, got c3B<"TFwr\W!SR7xK R#5i))rdN)rD)rrrrds& ryr'_parse_local_sources.. s$(HA EMBB(r)rrrrqr!rr)rrdrSs&d ry_parse_local_sourcesrI sp eT " ">tE{?S?S>TU# 5!%(55!%( rxc V^8dQhRRRR/#)rrrrr$rn)rs"ryrr sf)>rxc \V\4'g$R\V4P 2p\ V4h.p\ V4Fwr4\V\ 4'g'RV R\V4P 2p\ V4h\\V4\, 4pV'd&RV RV: R\\4: 2p\ V4hVR,pVR,p\T\4'd\T\4'gRT R 2p\ T4hTP\YgR 74K \V4# \dpRT RT: 2p\ T4R hR p?ii;i) z,vcs-sources must be an array of tables, got z vcs-sources[rzunknown vcs-sources[rrnrrrNrrr)rrrrqr!rrrr_VCS_SOURCE_KEYSrrerr9r rrSrrrrrrrs & ry_parse_vcs_sourcesrO sd eT " "tE{?S?S>TUCc" "U&::; *1#Xg[A#$89<> c" " -=D,C$$$JsC,@,@$QC'EFCc" "a% =d45+%, : -$QC'>wkJCc" , -sE F&E;;Fc$V^8dQhRRRRRR/#)rrrrrerrKrn)rs"ryrr s!"""3"4"rxc\P!V4pTP'gRT RT: R2p\T4h\ TP 4PpTPR4'gRT RT: R2p\T4hR# \dpRT RT 2p\T4ThRp?ii;i \dpRT RT: RT 2p\T4ThRp?ii;i) aReject an archive URL that is malformed, has no hash, or is not a .tar.gz. PEP 751 ``packages.archive.hashes`` is required, so nab requires the hash in the URL fragment and verifies the download against it. Only ``.tar.gz`` source archives are supported today; wheels and zips are refused loudly rather than mis-handled. :func:`urlsplit` raises ValueError on an authority it cannot parse, such as an unterminated IPv6 bracket, so that surfaces as a ConfigError here too. rRz] url: Nz] url zO has no hash; add a '#sha256=' fragment (PEP 751 requires an archive hash)r<z.tar.gzzE is not a .tar.gz archive; only .tar.gz source archives are supported) rparserr!has_usable_hashrrr`rendswith)rrrequestrrSr`s&& ryrTrT s( &&s+  " " "ugVC73K K #( $)) == # #ugVC73: : # $# ( wse4#C'( ( vcW4EcUK#C'(s/B B4 B1B,,B14 C?CCc(V^8dQhRRRRRRRR/#) rr#r"r%r$r'r&rrKrn)rs"ryrr? s0&&*&&&/& &rxc/p.VOVOVOFUp\VP4pWS9d*RV: RW5,: RVP: 2p\V4hVPW5&KW R#)zReject a canonical name claimed by more than one declared source. The provider enforces this while indexing, but as a bare ValueError raised after the resolve starts; raising ConfigError here surfaces it at parse time like every other config error. zV[tool.nab] local-sources/vcs-sources/archive-sources declare duplicate canonical name z via rRN)rrr!)r#r%r'r#rr1rSs&&& ryrr? swDBMBKB/B%fkk2  --6Mt>Q (  c" " ++Crxc$V^8dQhRRRRRR/#)rr%r$rr7rrKrn)rs"ryrrW s&& rxcV'dGVP\PJd'RVPP: R2p\ V4hR#R#)aReject vcs-sources declared while the VCS policy blocks cloning. Cloning is opt-in, so a ``[[tool.nab.vcs-sources]]`` entry under the default ``policy = "block"`` is contradictory. Raising ConfigError here fails at parse time and names the token to set. ``policy = "allow"`` opens the gate but does not on its own admit a URL: ``allowed-schemes`` and ``allowed-repos`` are empty by default and each denies every URL until an entry is added, so the message points at the whole gate rather than promising that one key is enough. zB[[tool.nab.vcs-sources]] is declared but [tool.nab.vcs].policy is z, which refuses every clone; remove the sources, or set [tool.nab.vcs].policy = "allow" and open the rest of the gate (vcs.allowed-schemes and vcs.allowed-repos are empty by default and each denies every URL)N)rr8r3rr!)r%rrSs&& ryrrW sRz((IOO; !!''*+; ; #<{rxc V^8dQhRRRR/#)rrrrzdict[str, str] | Nonern)rs"ryrrq s,Arxc@VfR#\V\4'g$R\V4P 2p\ V4h/pVP 4Fwr4\V\ 4'd\V\ 4'gRV: RV: 2p\ V4h\V4p\V4pTPR,TPR,8wdRT: RT: 2p\ T4hYBT&K V# \dpRT: RT: 2p\ T4ThRp?ii;i)NzDmatrix.python-patches must be a table of minor -> full version, got z string, got rz3matrix.python-patches expects version strings, got :NrNzmatrix.python-patches value z is not a patch release of ) rrrrqr!rrer rr)rrSrrrminorfullrs& ry_parse_python_patchesrdq s, } eT " " U $$% ' #C !S!!As););**+b7 c" " ,AJE1:D << u}}R0 005PQRPUVCc" "A#$ J ,GuBqeTCc" + ,sC77 DDDc V^8dQhRRRR/#)rrrrr,rn)rs"ryrr s,,F,'=,rxcL\V\4'g$R\V4P 2p\ V4hR0p\ \ V4V, 4pV'dRV: R\ V4: 2p\ V4h\RVPR.44p\VR7#)aUParse the optional ``[tool.nab.workspace]`` table. Schema today is a single ``members`` field listing literal paths. Globs and member-existence checks happen in :func:`nab_python.workspace.workspace_local_sources`; this layer only validates the table shape so typos like ``member = ...`` (missing the ``s``) fail loud at config-parse time. z*[tool.nab.workspace] must be a table, got rz#unknown [tool.nab.workspace] keys: rnzworkspace.members)r) rrrrqr!rrrrIrE)rrSr5rrs& ry_parse_workspacerg s eT " ":4;;O;O:PQ#kGSZ')*G1'=+ - # !4eii 26NOG 7 ++rxrc V^8dQhRRRR/#)rrrrr.rn)rs"ryrr sF'>rxc \V\4'g$R\V4P 2p\ V4h\ ;QJd.R\ V44FNK 5M!R\ V444p\V4V#)a{Parse the optional ``[tool.nab].conflicts`` array. Each item is either a bare array of members (uv-compatible; the members are mutually exclusive under the default at-most-one policy) or a table ``{ members = [...], policy = "..." }`` whose ``policy`` value is ``at-most-one`` / ``exactly-one`` / ``at-least-one``. A member is ``{ extra = "NAME" }`` or ``{ group = "NAME" }``. z1conflicts must be an array of conflict sets, got c3<"TFwr\W!4xK R#5ir)_parse_conflict_set)rrrs& ryr#_parse_conflicts.. sN=M'!$T--=Mr)rrrrqr!rr!_check_conflict_member_uniqueness)rrSsetss& ry_parse_conflictsro sh eT " "A$u+BVBVAWX# 5NYu=MN55NYu=MN ND%d+ Krxc V^8dQhRRRR/#)rrnrrrKrn)rs"ryrr s  ,A d rxc\4pVF>pVPF+pW19dRV R2p\V4hVPV4K- K@ R#)z7Reject a member declared in more than one conflict set.zconflicts declares zF in more than one set; a member may belong to at most one conflict setN)rrr!r)rnr#rrrSs& ryrmrm sY #D "**F~)&2GG"#&& HHV +rxc(V^8dQhRRRRRRRR/#) rrrrrrr{rrKrn)rs"ryrr s0..!.$.. .rxca a VfRM \V4o VUu0uFp\V4kK upo S eS PS 4\V4Fp\V 3RlV44p\ V4\ 8dK.S V9d'RP V 3RlV44pRV RV: R2pMRP RV44pRV R 2p\V4h R#uupi) aXReject a default install that co-activates an exclusive conflict set. A default install activates every default group with no user selection, but the emit-time disjointness validator prunes any context that activates two members of an exclusive set, so it never enumerates that install. Two members co-active by default would silently violate the declared conflict; catch it at parse time. ``base_group`` counts as a default: PEP 751 seeds ``dependency_groups`` from ``default-groups``, and the lock puts that name there so an install asking for nothing still gets the project's own dependencies. Nc3<"TF3wrV\PP8XgK&VS9gK/VxK5 R#5ir)rPrr)rrrrZs& ryr=_validate_default_groups_against_conflicts.. s< # |))/// 48FN D#s #>> >rc3J<"TFqS8wgK \V4xK R#5irrB)rrrs& ryrru sVid:CUztDzzis##zdefault-groups activates z, and base-group z names the project's own dependencies, which every default install activates too; they are declared mutually exclusive in [tool.nab].conflicts, so an installer given no selection would install neitherc38"TFp\V4xK R#5irrBr?s& ryrru s@idtDzzirz?, which are declared mutually exclusive in [tool.nab].conflicts)rrrrrrrr!) rrrrrf co_activeothersrSrrZrs &&& @@ryrr s"$+1B:1NJ,: ;Nq"N ;F :*95 #  y>0 0   "YYViVVF+F84>"<< YY@i@@F+F84>> #16 . sA%F;;,"4"449?9M %s AAArc38"TFp\V4xK R#5irrBr?s& ryrr~# s"@%$4::%rz[tool.nab].conflicts declares z in an at-least-one set, but a group named by base-group or build-group is active on every run, so the set can never fail and decides nothingc3<"TF8pVP\PJ;'dVPS8HxK: R#5irr})rrcanonical_bases& ryrr~0 s; ! KK<-- - O O&++2O O!s 'AATFc3x"TF0qP\PJgK"VPxK2 R#5irrH)rrs& ryrr~4 s( &-F @R@R1RKFKKgs::c38"TFp\V4xK R#5irrBr?s& ryrr~8 s=fdtDzzfrz)[tool.nab].conflicts declares base-group z# mutually exclusive with the extra z~, but an extra installs on top of the project's own dependencies and never deselects them, so nothing could install that extra) rrrrRrrrr!rP) rrrrrrinertrrS holds_mainrrrLs &&& @@ryrr sZ* - -D  $- E " &&   ."="= =%E "@%"@@4VH='' "#&&    *:6S ! SSS !   &-   :&&YY=f==F;J>5fX>GG  c" "K"  s D?D?c$V^8dQhRRRRRR/#)rrrrrrrTrn)rs"ryrrB s!fS[rxc:RV R2p\V\4'd%\\W4\P R7#\V\ 4'd\\V4\, 4pV'd(\\4pV RV: RV: R2p\V4hRV9dV R2p\V4h\VPR4V4p\\VR,V R 24VR7#V R \V4P 2p\V4h) z conflicts[r)rrz: unknown conflict-set key(s) zJ; expected a table { members = [...], policy = '...' } with policy one of z, or a bare array of membersrz): a conflict-set table must set 'members'rz.membersz: must be an array of members or a conflict-set table, got )rrrT_parse_conflict_membersrRrrrr_CONFLICT_SET_KEYS_CONFLICT_POLICY_VALUESr!_parse_conflict_policyrIrrq)rrrrrrSrs&& ryrkrkB s*q !E$+D8!--  $T%778 23E'7{C98:  c" " D GDECc" "'(:EB+DOwh=OP  ' J    " c rxc$V^8dQhRRRRRR/#)rrrrrerrRrn)rs"ryrrb s!  &   rxc"Vf\P#\V\4'g&V R\ V4P 2p\ V4h\PV4pVf'\\4pV RV: RV: 2p\ V4hV#)zHParse the ``policy`` value of a conflict-set table; default at-most-one.z.policy must be a string, got z.policy must be one of r ) rRrrrerrqr!rrIr)rrrSrrs&& ryrrb s }))) eS ! !5d5k6J6J5KL# $ ( ( /F ~./.uiveYG# Mrxc$V^8dQhRRRRRR/#)rrrrrerrrn)rs"ryrrq s"6#:Trxca\V\4'g&S R\V4P 2p\ V4h\ ;QJd .V3Rl\ V44FNK 5M!V3Rl\ V444p\V4\8d#S R\ R\V4 2p\ V4h\\V44\V48wdS R2p\ V4hV#)z" must be an array of members, got c3L<"TFwr\VS RV R24xK R#5i)rrN)_parse_conflict_member)rrrrs& ryr*_parse_conflict_members..u s.EU'!twas!_55EUs!$z must list at least z members to be a conflict; got z lists a member more than once) rrrrqr!rrr_MIN_CONFLICT_MEMBERSr)rrrSrs&f ryrrq s eT " "9$u+:N:N9OP#eENuEUeeENuEUG 7|++g)*?)@A #G ~ / # 3w<CL(56# Nrxc$V^8dQhRRRRRR/#)rrrrrerrQrn)rs"ryrr s!55555rxc L\V\4'g&V R\V4P 2p\ V4h\ Uu0uFq3P kK pp\\V4V, 4pV'd!V RV: R\V4: 2p\ V4h\\V4V,4p\V4^8wd!V R\V4: RV: 2p\ V4h\ V^,4pW^,,p\V\4'd V'g!V RVP RV: 2p\ V4h\VRR7p \YyR 7#uupi \d3\T4p T RTP R T: R T : R 2p\ T4R hi;i)z9 must be a table { extra = ... } or { group = ... }, got z: unknown member key(s) rnz must name exactly one of r rz! must be a non-empty string, got Tr,z" is not a valid extra/group name: z (canonicalises to rN)rr)rrrrqr!rPrrrrrerrrQ) rrrSrkindsrrrrr1s && ryrr s dD ! !gJ''( * #* +lWWlE +SY&'G/{+fUmEVW#SY&'G 7|q1&-1B& T#  #D  D dC q $EdXN#)%dT:  t 44/ , )%d+ gQtzzl"DTH!)a 1 #D( )sE! E&&=F#c V^8dQhRRRR/#)rrrerrKrn)rs"ryrr s # ## #$ #rxc\V4pTFp\TPP R44pTP^8gTPRJTPRJTPRJTPRJ3p\TP4\8g\T4'gKRT R2p\T4h R# \dpRT: 2p\T4ThRp?ii;i \ dpRT R2p\T4ThRp?ii;i)zReject a matrix.python axis finer than major.minor. The axis lists language (minor) Python versions; patch pins belong in [tool.nab.matrix.python-patches]. z/matrix.python must be a PEP 440 specifier, got Nz.*zmatrix.python clause z is not a valid versionz7matrix.python axis is a language (minor) version only; zS is finer than major.minor. Put patch versions in [tool.nab.matrix.python-patches].)rrr!r version removesuffixrepochprepostdevlocalrr_MINOR_RELEASE_PARTSrP)r specifier_setrrSclauserfiners& ry_validate_matrix_pythonr s ($T*   ,fnn99$?@G MMQ  KKt # LL $ KKt # MM %   w "6 6#e**I(44  c" "+  (?xH#C'(  ,)&1HICc" + ,s. C$C& C# CC#& D1DDlibc runs-on-libc runs-on-macoslinuxmacoszMapping[str, frozenset[str]]_PLATFORM_KNOB_OWNERc V^8dQhRRRR/#)rrrrrgrn)rs"ryrr s6.Frxc\V\4'g$R\V4P 2p\ V4h.p\ V4Fwr4RV R2p\V\ 4'dVP\WTR74K>\V\4'dVP\WT44KpV R\V4P 2p\ V4h \V4#)aCParse ``matrix.platforms``: bare ids, tables, or a mix of both. A bare id takes the platform's default tag knobs; the table form declares them (libc family, the libc and macOS the lock must run on, kernel marker values, free-threaded build). Both become a :class:`PlatformSpec`, so everything downstream reads one shape. z%matrix.platforms must be a list, got zmatrix.platforms[rrr) rrrrqr!rrerrrrr)rrSrhrrrs& ry_parse_matrix_platformsr s eT " "5d5k6J6J5KL#$&IU##A3a( dC   ^ED E d # #   25? @GB4:CVCVBWXCc" "$  rxc$V^8dQhRRRRRR/#)rrreknobsr rr=rn)rs"ryrr s!((#(( (rxc h\R/VB# \dpRT RT 2p\T4ThRp?ii;i)zJBuild a :class:`PlatformSpec`, reporting its knob check as a config error.zinvalid rNrn)r=rr!)rrrrSs&, ryrr sD($e$$ (r#'#C'(s 1,1c$V^8dQhRRRRRR/#)rrrerrrr=rn)rs"ryrr s!###^# #rxc\\V4\, 4pV'd&RV RV: R\\4: 2p\V4hRV9dV R2p\V4h\ V R2VR,4p\ WV4\ VV\V R2VPR44\V R 2VPR 44\V R 2VPR 44\ V R 2VPRR44\ V R2VPRR44\V R2VPR4RR7R7#)zHParse one ``matrix.platforms`` table entry into a :class:`PlatformSpec`.zunknown z keys: rnrz missing required key 'id'z.idz.libcrz .runs-on-libcrz.runs-on-macosrz.platform-releaserrz.platform-versionrz.free-threaded free-threadedFrp)rr runs_on_libc runs_on_macosr]r^ free_threaded) rr_PLATFORM_TABLE_KEYSr!r(_reject_foreign_knobsr _parse_libcrI_parse_major_minorrs)rrrrSrs&& ryrr s]SZ"667GugWWK0 458 : # 512#%smU4[AK% 4   E7%%))F*; <'g] #UYY~%> )g^ $eii&@ -g& '3Er)J -g& '3Er)J "g^ $eii&@% ! rxc(V^8dQhRRRRRRRR/#)rrrerrrrrKrn)rs"ryrr& s)###^###RV#rxc\V4pVfR#\P4FJwrEW48XdK \V\ V4,4pV'gK2V RV: RV RV: 2p\ V4h R#)amReject a knob key the declared platform's kind cannot read. :class:`PlatformSpec` refuses a knob whose *value* moves a platform that ignores it, but it cannot see a key written at its own default. The table can, and a key that selects no wheel is a mistake either way. An unknown ``platform_id`` is left to the matrix, which names the whole unknown set at once. Nz declares z, which only a z platform reads, but its id is )r>rrrrr!)rrrrownerkeysforeignrSs&&& ryrr& s~  %D |+113  = E *+ 7'G;oeWE))49 c" "4rxc$V^8dQhRRRRRR/#)rr rerrrr<rn)rs"ryrr> s!SDrxcVf\#\W4pV\9d%V R\\4: RV: 2p\ V4h\ RV4#)zAParse a libc family name; an absent key takes the default family.r}r r<)r:r(r;rr!r )r rtextrSs&& ryrr> sT } s *D :%fZ&8%;6$J#  rxc$V^8dQhRRRRRR/#)rr rerrrztuple[int, int] | Nonern)rs"ryrrI s"$$C$$3I$rxcfVfR#\W4p\V4pTPp\ T4\ 8HpT'd$\T4T^, RT^, 28wdT RT: 2p\T4hT^,T^,3# \dpT RT: 2p\T4ThRp?ii;i)zDParse a ``major.minor`` string into a pair; ``None`` passes through.Nz& must be a 'major.minor' version, got rz$ must be exactly 'major.minor', got )r(r rr!rrrre)r rrrrrSrtwo_parts&& ryrrI s } s *D($-ooG7|33H s7|'!*Qwqzl'CC9$B# AJ ## (;D8D#C'(s B B0B++B0c V^8dQhRRRR/#)rrrrr(rn)rs"ryrrh s---$7-rxc\V\4'g$R\V4P 2p\ V4h\ \ V4\, 4pV'd#RV: R\ \4: 2p\ V4hVR,pVR,p\T\4'gRp\ T4h\T4\T4pT'gRp\ T4h\R \;QJd.R T4FNK 5M !R T444\R TPR R 44pTR9dRT: 2p\ T4h\!TPR44p\#TPR44p \%TTTTT R7p \'T 4T # \dpRT: 2p\ T4RhRp?ii;i)z'[tool.nab.matrix] must be a table, got z unknown [tool.nab.matrix] keys: rnrfrhz'[tool.nab.matrix] missing required key Nz0matrix.python must be a string PEP 440 specifierz3matrix.platforms must list at least one platform idzmatrix.platformsc38"TFqPxK R#5irr)rps& ryr _parse_matrix.. s0R 1 rzmatrix.python-order python-orderriz1matrix.python-order must be 'asc' or 'desc', got python-patchesrmr>ridesc)rrrrqr!rr _MATRIX_KEYSrrerrr$rr(rIrd_parse_implementationsrW_validate_matrix_axes) rrSrrf platforms_rawrrhrjpatchesrmr<s & ry _parse_matrixrh s eT " "7U 8L8L7MN#SZ,./G.wk: -0 2 #)xk*  fc " "@#F#' 6I C#)550R 0R550R 0R+RS&uyy?L?*A,AQR##EII.>$?@G,UYY7H-IJO !' F&! M? )7{C#D()sF G*F<<Gc V^8dQhRRRR/#)rr<rWrrKrn)rs"ryrr s((,(4(rxc\V4pVP4R# \dpRT 2p\T4ThRp?ii;i)z:Expand the matrix eagerly to catch bad axes at parse time.zinvalid [tool.nab.matrix]: N)rrrr!)r<r)rrSs& ryrr sC  'F(  (+C51#C'(s A;Ac V^8dQhRRRR/#rrn)rs"ryrr s&_rxcVfR#\RV4pV'gRp\V4h\RV4\\ V4\ \ 4, 4pV'd#RV: R\ \ 4: 2p\V4hV#)Nzmatrix.implementationszG.wk:347 9 # Lrx)r!rOrPrQrRrSrTrUrVrWrXrYrZr6rArrrrr_r\rrrzr[rTr> os_namer[r_platform_systemr\r]r^implementation_namer`implementation_versionplatform_python_implementation)rn>rfr|r})r`r_)rr)r[r\)rr>rrr>rr*rr~rrrar>r~rrr>r!rrr r* prereleases))r~r)ror)rr)rr)rr)rr)rar)rr>rr`r?r@r>rrrrrrr>rfrhrmrr)rppypy( __conditional_annotations__ru __future__renumrloggingre collectionsr dataclassesrrrrrr typesr typingr r r urllib.parserrtyping_extensionsrnab_index.archiverrnab_index.local_indexrnab_index.multi_indexrnab_index.serializationrnab_index.subdirr_conflict_kindrr_iso8601r_tomlr_vcs_admissionr_vendor.packaging.requirementsr_vendor.packaging.specifiersrr_vendor.packaging.utilsrr_vendor.packaging.versionr config_sourcesr!r"r#r$r%r&r'r(r)r*r+fetchr,r-r.pathsr/providerr0r1r2r3r4r5r6r7r8r9tagsr:r;r<r=r>rr?r@rArBrCrDr-rErFrGrHrIcollections.abcrJrKrL AbstractSetpathlibrM_vendor.packaging.rangesrN__all__compilerdrrrrr6rrWrUEnumrRrPrQrTrrrOrZrVrrrXrArSrYrrTr[rzrorr getLoggerrqrrsrmrrrrrrrrrrr rrr r$r(r2r6r9rprqrrrnr\r_rjrrrursrqrrrrrrrrrrrrrvrrrrrrrrrr rrrrrrrrrrrrrrrrrrrr9r4rArDrIrMrOrSrUrTrrrdrgrrrrrormrrrkrrrrrrrrrrrrrrrrrr)rmarkersrrs000@ryrs#  #1122"++! &A--712(#-7HC.    ED   NM126 >JJ|,% "&'79N&OP .6 $d#44$4 $d#&&$&&"TYY""499 $d#22$2$ $d# 1 1$ 1(   $d#**$*( $d#,9,9$,9^ $d#,,$,.RRj $d#4N4N$4Nn [K("*J.>T $T# T /3 TnJ +/ JZ#,#&   H %%P!H"J@*<(. G2j62j/d ( 0   2B6+\>"  2j$X/F$GHB(&>FG:  "N@W<!?**!1 6 6 87 8  ^g&89:KG 873 Zz2'T89 -`(  y),GG P $H 0f2N:L^.+: /GK(88v U+\. (")X<D"J (KL0f fe_-:!&%1<"J&04@,6/=>~!77A:~> 845$ ..b=#@@ &5B #F! 6FFN34O,-620((##L##0$$( --`((-U47d$?s X/6X5