+ 2jQa0t$Rt^RIHt^RIt^RIHtHtHt^RI H t H t ^RI H t HtHtHtHtHt^RIHt^RIHt^RIHtHtHtHt^R IHtHt^R IH t H!t!H"t"H#t#H$t$^R I%H&t&^R I'H(t(^R I)H*t*] 'd)^RI+H,t,H-t-^RI.H.t.^RI/H0t0^RI1H2t2^RI3H4t4H5t5^RI6H7t7.RNRNRNRNRNRNRNRNRNRNRNRNR NR!NR"NR#NR$NR%NR&NR'NR(NR)NR*NR+NR,NR-NR.NR/NR0NR1NR2NR3NR4NR5NR6Nt8]Pr!]:4t;R7tR&R9R:lt?]!R;R;R<7!R=R)44t@]!R;R;R<7!R>R&44tA]!R;R;R<7!R?R44tB]!R;R;R<7!R@R44tC]!R;R;R<7!RAR(44tD]!R;R;R<7!RBR44tE]B]C,]D,]E,tF]!R;R;R<7!RCR$44tGRDREltH]!R;R;R<7!RFR'44tI]!RGR44tJRHRIltKRJRKltLRLRMltMR#)OaPEP 751 lockfile (``pylock.toml``) emission for nab-python. Public surface for producing lockfiles from a resolve. The three emitters are :func:`write_lock` (PEP 751 ``pylock.toml``), :func:`write_requirements_with_hashes`, and :func:`write_requirements_without_hashes`. A resolve contributes one :class:`TargetLock` per environment it ran against; the writer collapses them into one ``Package`` per distinct ``(name, version, source)`` with a marker disjoining the targets that chose it, and drops the marker when every target agrees. ) annotationsN) dataclassfieldreplace) TYPE_CHECKINGAny)MissingHashErrorMissingSdistErrorMissingVcsCommitErrorbuild_target_lockread_lockfile_anchorread_lockfile_packages)DisjointnessError) BASE_MEMBER)DivergentBaseDependencyError build_pylock render_lock write_lock)write_requirements_with_hashes!write_requirements_without_hashes)InvalidLockfileErrorLockDisqualificationLockfileSyntaxErrorRootRequirement check_locked)is_valid_pylock_pathcanonicalize_name)Version)MappingSequence)datetime)Path)Marker) ConflictSetPackageOverride) ResolveTargetACCEPTED_HASH_ALGORITHMSr LOCK_VERSION ArchivePinrrIndexPinrLocalPinr LockInputrrr r PinShape Provenancer SdistArtifact TargetLockVcsPin WheelArtifactrr rdrop_workspace_pinsr!package_metadata_override_recordsr r rsummarize_lockrrrz1.0tuple[str, ...]c V^8dQhRRRR/#)hashestuple[tuple[str, str], ...]returnztuple[str, str] | None)formats"^/home/user/billing-ledger-validation/.venv/lib/python3.14/site-packages/nab_python/lockfile.py __annotate__r?ls 'cZ\V4p\FpW!9gK W!V,3u# R#N)dictr')r9by_algoalgos& r>_select_primary_digestrFls.6lG( ?& &) r@T)frozenslotscz]tRt^vt$RtR]R&R]R&R]R&RtR]R &RtR ]R &RtR ]R &] RRl4t Rt R#)r2aA single wheel file to record in the lockfile. ``hashes`` is the set of (algorithm, digest) pairs the index published. PEP 751 mandates at least one hash per artefact; nab requires at least one of ``sha256``, ``sha384``, ``sha512`` so the lockfile is consumable by pip's hash-checking mode. ``upload_time`` is the index's upload timestamp when available; informational provenance per PEP 751 ``packages.wheels.upload-time``. ``local_path`` is the on-disk path of a wheel from a local find-links directory; the lockfile writer emits it as a relative ``path`` instead of ``url`` so the lockfile is portable. ``None`` for a wheel fetched from a remote index. strfilenameurlr:r9N int | Nonesizedatetime | None upload_time Path | None local_pathcV^8dQhRR/#r8r;ztuple[str, str]r<)r=s"r>r?WheelArtifact.__annotate__r@c l\VP4pVfVP R2p\V4hV#EReturn ``(algo, digest)`` for the first acceptable algorithm present.z has no acceptable hashrFr9rK ValueErrorselfchosenmsgs& r>primary_digestWheelArtifact.primary_digest7( 4 >]]O#:;CS/ ! r@r< __name__ __module__ __qualname____firstlineno____doc____annotations__rNrPrRpropertyr`__static_attributes__r<r@r>r2r2vsI M H ''D*#'K'"J " r@cz]tRt^t$RtR]R&R]R&R]R&RtR]R &RtR ]R &RtR ]R &] RRl4t Rt R#)r/zAn sdist tarball to record in the lockfile. See :class:`WheelArtifact` for the meaning of ``hashes``, ``upload_time`` and ``local_path``. rJrKrLr:r9NrMrNrOrPrQrRcV^8dQhRR/#rTr<)r=s"r>r?SdistArtifact.__annotate__rVr@c l\VP4pVfVP R2p\V4hV#rXrZr\s& r>r`SdistArtifact.primary_digestrbr@r<rcr<r@r>r/r/sI M H ''D*#'K'"J " r@cd]tRt^t$RtR]R&R]R&R]R&RtR]R&R tR ]R &RtR ]R &R t R#)r*zA package resolved from a Simple-API index. ``index`` is the URL of the Simple-API root that served the package, matching what PEP 751 expects for ``packages.index``. rJnameversionindexNzSdistArtifact | Nonesdistztuple[WheelArtifact, ...]wheels str | Nonerequires_pythonr<) rdrerfrgrhrirurvrxrkr<r@r>r*r*s8 I L J"&E &(*F %*"&OZ&r@cV]tRt^t$RtR]R&R]R&R]R&RtR]R&R tR ]R &R tR #) r+aWA package resolved from a local checkout. ``path`` is the absolute filesystem path the resolver was pointed at. Lockfile consumers walk the same tree to install. ``editable`` records a PEP 660 editable install request; ``subdirectory`` is a path under ``path`` for monorepo layouts. Both come from the ``[[tool.nab.local-sources]]`` entry. rJrrrspathFbooleditableNrw subdirectoryr<) rdrerfrgrhrir|r}rkr<r@r>r+r+s, I L IHd#L*#r@cx]tRt^t$RtR]R&R]R&R]R&R]R&R]R&RtR ]R &RtR ]R &R tR]R &Rt R#)r1a+A package resolved from a VCS clone. ``repo_url`` is the reproducible pip-style installable URL: the ``git+`` prefix, the bare repository URL, ``@``, and any ``#subdirectory=`` fragment. The requirements.txt emitter writes it verbatim, so a branch or tag pin installs the locked commit rather than a moving ref. ``bare_repo_url`` is the plain repository URL with none of those parts, captured when the source URL is parsed and written to PEP 751 ``packages.vcs.url``. ``requested_revision`` is the human-readable ref (tag or branch) the user pinned, recorded only when it differs from ``commit_id``; informational per PEP 751 ``packages.vcs.requested-revision``. ``vcs_type`` is the PEP 751 ``packages.vcs.type`` backend (``git``/``hg``/``svn``/``bzr``), taken from the URL's ``+`` scheme. rJrrrsrepo_url bare_repo_url commit_idNrwr}requested_revisiongitvcs_typer<) rdrerfrgrhrir}rrrkr<r@r>r1r1sB& I LMN#L*#%) )Hcr@ch]tRt^t$RtR]R&R]R&R]R&R]R&RtR ]R &]R R l4tR t R#)r)aA package resolved from a direct-URL archive. ``url`` is the archive URL with the hash fragment stripped, written to PEP 751 ``packages.archive.url``. ``hashes`` are the verified ``(algorithm, digest)`` pairs; PEP 751 requires at least one, and nab verifies the download against them before the archive is used. Unlike a VCS or directory source, an archive is content-pinned by its hash, so the pin carries a real ``version`` and the emitter records it (see :func:`_pin_to_package`). rJrrrsrLr:r9Nrwr}cV^8dQhRR/#rTr<)r=s"r>r?ArchivePin.__annotate__ rVr@c l\VP4pVfVP R2p\V4hV#)rYz archive has no acceptable hash)rFr9rrr[r\s& r>r`ArchivePin.primary_digests7( 4 >YYK>?CS/ ! r@r<) rdrerfrgrhrir}rjr`rkr<r@r>r)r)s:  I L H ''#L*# r@c]tRtRt$RtR]R&R]R&R]R&R]R &R]R &R tR ]R &RtR]R&RtR]R&Rt R]R&RRlt Rt R #)r.iaOptional ``[tool.nab]`` provenance block written into the lock. PEP 751 lets tools record any additional metadata under ``[tool.]`` so long as it does not affect installation. nab uses the slot to record the inputs that produced the lock: a reader can audit a committed lockfile without re-running. Every field is informational. The lockfile reader MUST NOT feed any of it into the install path. rJ nab_versionr! created_atr6 command_line input_pathmodeNrwpython_specifier platformsr:cli_project_overrides'tuple[tuple[str, tuple[str, ...]], ...]package_metadata_overridescV^8dQhRR/#)r8r;zdict[str, Any]r<)r=s"r>r?Provenance.__annotate__1s.r@c  @RVPRVPR\VP4RVPRVP /pVP eVP VR&VP'd\VP4VR&VP'd)VPUUu.uF wr#V RV 2NK uppVR &VP'd8VPUUu.uFwrEV R R PV4 2NK uppVR &V#uuppiuuppi) z>Render to the dict the TOML writer drops under ``[tool.nab]``.z nab-versionz created-atz command-linez input-pathrzpython-specifierr=zcli-project-overrides: , zpackage-metadata-overrides) rrlistrrrrrrrjoin)r]blockflagvalue requirementfieldss& r>to_blockProvenance.to_block1s 4++ $// D!2!23 $// DII !   ,(,(=(=E$ % >>>!%dnn!5E+   % % %595O5O.5Okd4&%!5O.E) *  * * *,0+J+J3+J'K-r$))F"3!45+J3E. / .3s 0D*!Dr<) rdrerfrgrhrirrrrrrkr<r@r>r.r.sb !!O I#'j'!#I#:<6;KM GLr@c V^8dQhRRRR/#)r8 overrideszSequence[PackageOverride]r;rr<)r=s"r>r?r?Js(,r@c^.pVFp.pVPeVPR4VPeVPR4VPeVPR4V'gKlVP\ VP 4\ V434K \ V4#)aSummarise the configured per-package metadata overrides for provenance. Each returned pair is a requirement string and the metadata fields the entry set (``dependencies``, ``requires-python``, ``provides-extra``). Entries that set no metadata field are skipped. This records every configured override as input provenance, including any scoped to a version no candidate has (a documented no-op), so an entry here is not a claim that it shaped the lock. Strictly informational: the reader must not feed it into the install path. dependencieszrequires-pythonzprovides-extra)rappendrxprovides_extrarJrtuple)rrecordsoverriders& r>r4r4Js24G  , MM. )  # # / MM+ ,  " " . MM* + 6 NNC 4 45uV}E F >r@c]tRtRt$RtR]R&R]R&]!]R7tR]R &]!]R7t R]R &]!]R7t R ]R &R t R#)r0ifa_What one target contributed to the lock. ``pins`` is keyed by canonical package name; each value is the pin that target resolved to. ``dependencies`` is the forward edge set among those pins, keyed the same way, which the writer emits as PEP 751 ``packages.dependencies``. ``base_dependencies`` is its unconditional subset: the edges from each package's own metadata, before any activated extra folds its deps in. The writer closes a conflict environment's no-member base-name set over these edges only. ``target`` is the environment the pins hold for. The writer reads its markers and its :attr:`~nab_python.target.ResolveTarget.selection` rather than being handed a projection of them, so a lock entry and the environment it was resolved for cannot drift apart. ``package_gates`` maps a package this target locked to every install context that reaches it, as ``(kind, name)`` members: each selected extra and group, including the conflict fork's own selection, and :data:`BASE_MEMBER` for the project's own dependencies, which the writer renames to ``[tool.nab].base-group``. The writer disjoins them into ``'name' in extras`` / ``'name' in dependency_groups`` clauses on that package's marker. With no ``base-group`` set there is no name to give the project's own dependencies, so the writer drops the gate of every package they reach and it stays unconditional. r&targetzMapping[str, PinShape]pinsdefault_factoryzMapping[str, tuple[str, ...]]rbase_dependenciesz)Mapping[str, tuple[tuple[str, str], ...]] package_gatesr<N) rdrerfrgrhrirrCrrrrkr<r@r>r0r0fsL8   272ML/M7r?LockInput.__annotate__s   r@c \P.VPOVPO54pVPVP 3F pVfK RW&K \ V4#)a@Every group an install context can activate. PEP 751 keeps the ``default-groups`` names out of ``dependency-groups``, and an installer that selects nothing still activates the defaults, so the group axis of an install context is the union of the two arrays, plus the name the lock gives the project's own dependencies. N)rCfromkeysrrrrr)r]namesnameds& r> active_groupsLockInput.active_groupss[ M 6 6M9L9LMNoot'7'78E # 9U|r@cV^8dQhRR/#)r8r;zdict[str, Mapping[str, str]]r<)r=s"r>r?rsWW9Wr@c VPP4UUu/uFwrWPPbK upp#uuppi)z:The PEP 508 marker environment each target resolved under.)ritemsr marker_env)r]labellocks& r> marker_envsLockInput.marker_envss<BFASASAUVAU+%{{---AUVVVs!Ar<)rdrerfrgrhrrCrrirrrrxrrrrrrrrrjrrrkr<r@r>r,r,s!F).d(CG %CKPLNH"'t!r?r?s! 0 0I 0 09 0r@caa S'gV#RV3Rllo VPP4UUUUUUu/uEFwr#T\TVPP4UUu/uFwrES !V4'gKWEbK uppVPP4UUu/uFSwrFS !V4'gK\ ;QJd.V 3RlV4FNK 5M!V 3RlV44;p'gKQWHbKU uppVP P4UUu/uFwrGS !V4'gKWGbK uppR7bEK p pppppp\W R7#uuppiuuppiuuppiuuppppppi)a/Return a copy of ``lock_input`` with the ``exclude`` pins removed. ``exclude`` holds canonical workspace member names; pin keys are already canonical. An empty set returns ``lock_input`` unchanged. Each target's pins are filtered, and its forward dependency graph and membership gates with them, so no emitted edge or gate names a dropped member with no ``[[packages]]`` entry. ``base_dependencies`` carries through untouched: it is never emitted, and cutting the member out of it would strip base status from everything reached only through that member. c V^8dQhRRRR/#)r8rrrJr;r{r<)r=s"r>r?)drop_workspace_pins..__annotate__s663646r@c <\V4S9#rBr)rrrs&r>keep!drop_workspace_pins..keeps &g55r@c3H<"TFpS!V4'gKVxK R#5irBr<).0deprs& r> &drop_workspace_pins..s0RS s" ")rrr)r)rrrrrrr) rrrrrrpindepsgatekeptrrs &f @r>r3r3sH 66 &--3356KE w -1YY__->M-> $t*)$)->M#'"3"3"9"9";";JD:+050R0R550R0R+R#R4#R "; .2-?-?-E-E-G-Gzt4PT:  -G  6  : //N sM,E)#E:E E) E 7 E ,E 3E 9 E)E#"0E#"6E)E)c$V^8dQhRRRRRR/#)r8rr,priorMapping[str, Version] | Noner;rJr<)r=s"r>r?r?s(DDyD1MDRUDr@c \VP4^8d\VP4 R2#VPP4UUUu/uF(pVPP 4Fwr4W4bK K* ppppVP 4UUu/uF9wr4\ V\ \34'gK#V\VP4bK; ppp\V4 R\W4 2#uupppiuuppi)a!Summarise what was written: a package diff, or the tuple count. A matrix pins a package once per tuple, and two tuples may disagree, so there is no one version to diff against the prior lock; it reports the tuples it covered instead. ``prior`` comes from :func:`read_lockfile_packages`. z tuplesz packages) lenrvaluesrr isinstancer*r)rrs _diff_summary)rrrrrrr versioneds&& r>r5r5s :  "j(()*'22&&--/ /D*ID * /  %ID cHj1 2 #gckk""% $i[ -"A!B CC s.C1 C8;C8c$V^8dQhRRRRRR/#)r8rrcurrentzMapping[str, Version]r;rJr<)r=s"r>r?r?s$ 4 4 ' 42G 4 4r@caaSfR#\V3RlS44p\V3RlS44p^;rESP4F<wrgSPV4pVeW8XdK"Wx8d V^, pK3V^, pK> VR3VR3VR3VR33U U u.uFwrV 'gKV RV 2NK p p p V 'dR R PV 4 2#R#uup p i) zReturn a ``: A added, B upgraded, ...`` suffix for a re-lock. ``prior`` is the previous pylock's pins or ``None`` (first lock or an unparseable prior file); both fall back to an empty suffix. An unchanged pin set also yields an empty suffix. c3,<"TF qS9xK R#5irBr<)rrrrs& r>r _diff_summary..(s6gdE!gc3,<"TF qS9xK R#5irBr<)rrrrs& r>rr)s8%$g%%raddedupgraded downgradedremoved rr)sumrgetr) rrrrrrrrrsoldcountrpartss ff r>rrs } 6g6 6E8%88GH  iio ;#.  = MH !OJ)G  z "  & i    LE  5'5'  ',R % ! "33 s  C( C)sha256sha384sha512)N__conditional_annotations__rh __future__rlogging dataclassesrrrtypingrr_lockfile.builderrr r r r r _lockfile.disjointnessr_lockfile.groupsr_lockfile.pylockrrrr_lockfile.requirementsrr_lockfile.validaterrrrr_vendor.packaging.pylockr_vendor.packaging.utilsr_vendor.packaging.versionrcollections.abcrr r!pathlibr"_vendor.packaging.markersr#configr$r%rr&__all__ getLoggerrdloggerr(r'rirFr2r/r*r+r1r)r-r.r4r0r,r3r5r)rs@r>rsJ #11%6) ;6.1!14%$ $ $ $  $   $  # $ $ $ $ $ $ $ $ $ $  !$ "#$ $%$ &'$ ()$ * +$ ,-$ ./$ 01$ 23$ 45$ 67$ 8(9$ :;$ <=$ >?$ @A$ BC$ D%E$ F(G$ N   8 $ -K/J $d#$D $d#$0 $d# ' '$ ' $d#$$$$$ $d#$< $d#$: h  '* 4 $d#11$1h8 $d###$#L MWMW MW` 0FD8 4r@