+ 2jpRt^RIHt^RIt^RIHt^RIHtHt^RIH t ^RI H t H t H t ^RIHtHtHt^RIt^RIHtHt^R IHt^R IHt^R IHtHt^R IHt^R IH t ^RI!H"t"^RI#H$t$^RI%H&t&] 'd=^RI'H(t(H)t)H*t*^RI+H,t,^RI-H.t.^RI/H0t0H1t1H2t2H3t3H4t4H5t5H6t6H7t7^RI8H9t9H:t:H;t;Ht>]P~!]@4tA.RIOtB!RR] 4tC!RR] 4tD!RR] 4tE!R R]F4tG!R!R]F4tH!R"R]F4tIR#R$ltJR%R&ltKR'R(ltLR)RJR*RJR+RR,R/R-R.lltMR/R0ltNR1R2ltOR3R4ltPR5R6ltQ] R7R8l4tR] R9R:l4tRR;R<ltRR=R>ltSR?R@ltTRARBltURCRDltVRERFltWRGRHltXR#)KajBuild a :class:`LockInput` from a finished resolve. The provider's caches still hold the listings the resolver consumed when this runs, so artefact hashes and per-file Requires-Python can be read directly without a second fetch. This module also owns the ``read_lockfile_anchor`` helper used by ``nab lock`` to keep ``PD`` durations stable across re-locks. ) annotationsN) defaultdict)datetimetimezone)Path) TYPE_CHECKINGProtocoloverload)quoteurlsplit urlunsplit) SdistFile WheelFile)parse_iso_datetime)tool_nab_section)PylockPylockValidationError) SpecifierSetcanonicalize_name)validate_specifier_versions) path_state) BASE_MEMBER)IterableMappingSequence) IndexConfig)Version) ArchivePinIndexPin LockInputPinShape SdistArtifact TargetLockVcsPin WheelArtifact) ArchiveSource DistPolicy LocalSource VcsSource) ResolveTargetMissingHashErrorMissingSdistErrorMissingVcsCommitErrorc&]tRt^BtRtRRltRtR#)_LockInputIndexz7Protocol for the InMemoryIndex slice the builder reads.c V^8dQhRRRR/#)packagestrreturn str | None)formats"g/home/user/billing-ledger-validation/.venv/lib/python3.14/site-packages/nab_python/_lockfile/builder.py __annotate___LockInputIndex.__annotate__Es    c R#)z9Return the configured index name that served ``package``.Nr6)selfr2s&&r8get_listing_index!_LockInputIndex.get_listing_indexE r;r6N)__name__ __module__ __qualname____firstlineno____doc__r>__static_attributes__r6r;r8r/r/BsA  r;r/c0]tRt^JtRt]RRl4tRtR#)_LockInputCoordinatorz:Protocol for the FetchCoordinator slice the builder reads.cV^8dQhRR/#)r1r4r/r6)r7s"r8r9"_LockInputCoordinator.__annotate__Ns   r;c R#)z:The underlying index used to look up serving-index labels.Nr6r=s&r8index_LockInputCoordinator.indexM r;r6N)rArBrCrDrEpropertyrMrFr6r;r8rHrHJsD   r;rHc]tRt^St$RtR]R&R]R&]RRl4tRR ltR R lt R R lt RRlt RRlt RRRllt RRltRRltRtR#)LockInputProviderzStructural protocol for the provider slice the builder reads. Mirrors the public surface :class:`~nab_python.provider.Provider` exposes that :func:`build_target_lock` consumes; tests may supply a stub without inheriting the full Provider class. z2Mapping[tuple[str, Version], Mapping[str, object]] deps_cachez@Mapping[tuple[str, Version], Mapping[str, Mapping[str, object]]]extra_deps_mapcV^8dQhRR/#)r1r4rHr6)r7s"r8r9LockInputProvider.__annotate__bs  2 r;c R#)zD`` durations stable across re-locks: the anchor used for the previous resolve is read back and reused unless the user passes ``--upgrade``. Returns ``None`` when ``path`` does not exist, cannot be read, is not valid TOML, is not a PEP 751-shaped pylock, or is missing the ``[tool.nab]`` block. Naive timestamps (no offset) are coerced to UTC for symmetry with the writer; this is informational provenance, so a missing offset is recoverable rather than fatal. Nrbz created-at)tzinfo)r should_readopentomliloadOSErrorUnicodeDecodeErrorTOMLDecodeErrorr isinstancedictgetrrreplacerutcr3r ValueError)rfdatanabrawdts& r8read_lockfile_anchorrs d  ' ' ' YYt__::a=D 4 C#-c4#8#8#'', dC#x  jjjsFckkk&FF#s #C(BYYYrCBJJhllJ$CC _ ')>)> ?  s@ED-E, E'- D= 8E=E E$#E$' E65E6c V^8dQhRRRR/#)r1rrr4zdict[str, Version] | Noner6)r7s"r8r9r9s*Cr;c\V4P'gR#VPR4;_uu_4p\P!V4pRRR4\ P !X4pTPUu/uF2qDPfK\TP4TPbK4 up# +'giLo;i \\\P\3dR#i;iuupi)aReturn the ``name -> version`` map from a prior pylock at ``path``. Used by ``nab lock`` to diff a re-lock against the previous result. Packages without a recorded version (direct-reference entries that omit it) are skipped. Returns ``None`` when ``path`` does not exist, cannot be read, is not valid TOML, or is not a spec-compliant PEP 751 lockfile; the caller falls back to a no-diff summary line. Nr)rrrrrr from_dictrrrrpackagesrmr3name)rrrpylockpkgs& r8read_lockfile_packagesrs d  ' ' ' YYt__::a=D!!$'/5oo .=s"CHH s{{"o  _ ')>)>@U V s4C B6C ;C5$C56 C C %C21C2c V^8dQhRRRR/#)r1urlr3r4r6)r7s"r8r9r9s3333r;c \V4pVPPR4wr#pV'gV#VPP R4'd!VP R^4^,pV RV 2p\ VPVR74#)aReturn ``url`` with credential userinfo removed. Lockfiles are committed to version control, so an index or VCS URL carrying an embedded ``user:password`` must not be written verbatim. An SSH login such as ``git@`` is the protocol login, not a secret, and is required to clone, so it is kept (only an embedded password is dropped); host case and port are preserved. A no-op for URLs without userinfo. @ssh:)netloc)r r rpartitionschemeendswithsplitr _replace)rpartsuserinfosephostlogins& r8_strip_userinfors~ SME,,11#6H4   ||U##sA&q)$  ennDn1 22r;indexes resolved_keys base_rootsselector_rootsc8V^8dQhRRRRRRRRR R R R R RRR/#)r1providerrRtargetr*pinsMapping[str, Version]rSequence[IndexConfig]r Iterable[str]rzIterable[str] | Nonerz.Mapping[tuple[str, str], Iterable[str]] | Noner4r#r6)r7s"r8r9r9scccc c c # c ! c%cCccr;c ^RIHpHpVfV'dRp \V 4hRp/p VP 4EFwr\ V 4p VP W4pV'd\PRV V V4VPV 4pVeYV!V \V 4\\VP4P44VPVPR7W&KVP!V 4pVe#\#V V VVP%V 4R7W&KVP'V 4pVe\)WV4W&EK \+W W4W&EK \-WV4wppT!TT TT\/TTTT;'g/R7R7#) a:Build one target's :class:`~nab_python.lockfile.TargetLock`. ``provider`` is the :class:`Provider` that drove the resolve for ``target``; its caches still hold the listings the resolver consumed. ``pins`` is the canonical-name -> :class:`Version` mapping returned by the resolver after extras keys have been stripped. ``resolved_keys`` is the full set of resolver result keys, including ``name[extra]`` proxies; it is read to find which extras activated so their edges join the forward dependency graph. ``base_roots`` and ``selector_roots`` are the resolver keys each install context requires directly: the project's own dependencies, and those of each selected extra and each selected group, keyed by its ``(kind, name)`` member. :func:`_membership_gates` walks the resolve from each to find which contexts reach each package. An empty ``base_roots`` is a project with no dependencies of its own, so it does not stand in for ``None``: omitting it while passing selector roots raises. Every wheel the target can install, plus the sdist, is recorded for each pinned version. )LocalPinr#zNselector_roots need base_roots: without them every package looks selector-onlyz4%s==%s: %d wheel(s) omitted from lock by target tags)rrmreditable subdirectory) resolved_sha)rr)rr dependenciesbase_dependencies package_gatesr6)lockfilerr#ritemsrrloggerdebugr^r3rrresolverrrb_vcs_pin_from_sourcerjrf_archive_pin_from_source_index_pin_from_listing_forward_dependency_graph_membership_gates)rrrrrrrrr#msg lock_pinsraw_namerm canonicalpruned local_source vcs_sourcearchive_sourcerrs&&&$$$$ r8build_target_lockrsD0 B S/ ! %'I!ZZ\%h/ 229F  LLF    00;  ##+G l//088:;%..)66 $I  ,,Y7  !#7%11)< $I !44Y?  %#;N$I  6  G*N'@ '#L#  !+'  !)//R   r;c ,V^8dQhRRRRRRRRR R /#) r1rrRrrrrrz'Mapping[tuple[str, str], Iterable[str]]r4z&dict[str, tuple[tuple[str, str], ...]]r6)r7s"r8r9r9dsA"M"M"M "M "M < "M , "Mr;c VP4UUu/uFwrE\V4VbK ppp\\4p\ WV4FpWt,P \ 4K VP4F/wr\ WV 4FpWt,P V4K K1 VP4UU u/uFwrJV\\V 44bK up p#uuppiuup pi)aName every install context that reaches each package. A selected extra or group is folded into the resolve that produces the lock, so its requirements pin packages a default install must not receive. PEP 751 decides per package from ``packages.marker``, so a package has to name every context that reaches it; the writer turns each ``(kind, name)`` member into ``'name' in extras`` / ``'name' in dependency_groups``. The project's own dependencies are one such context, recorded as :data:`~nab_python.lockfile.BASE_MEMBER` until the writer knows what to call it, so a package both they and a group reach installs for either. Reachability is over this target's resolved graph, so an extras proxy (an extra requiring ``pkg[fancy]`` while the project requires plain ``pkg``) gates what ``fancy`` adds without gating ``pkg``. Empty roots on both sides gate nothing, which is a lock with no selection and no name for the project's own dependencies. ) rrrset_reachable_namesaddrtuplesorted) rrrrrrmpinnedreachmemberrootsmemberss &&$$ r8rrds4EIJJL QL=4%w.LF Q4?4DE :>  $?'--/ $Xu=D KOOF #>0?Dkkm Lm]TD%w( (m LLR Ms C% C+c(V^8dQhRRRRRRRR/#) r1rrRrrrrr4zset[str]r6)r7s"r8r9r9s0""" !" " "r;c^RIHp\4p\4p\V4pV'dVP 4pWu9dK VP V4V!V4wr\ V4p VPV 4p V fK]VP V 4W3p VPVPPV /44V fKVPVPPV /4PV /44KV#)zReturn the pinned names reachable from ``roots`` at their pinned versions. The walk is over resolver keys, so a ``name[extra]`` root pulls in that extra's dependencies on top of the package's own.  split_extra) rrrlistpoprrrextendrSrT) rrrrreachedseenstackkeyrextrarrm cache_keys &&& r8rrs'GUD KE iik ;   %c*%h/ **Y' ?  I(  X((,,Y;<   LL0044YCGGrR S Nr;c(V^8dQhRRRRRRRR/#) r1rrRrrrrr4z=tuple[dict[str, tuple[str, ...]], dict[str, tuple[str, ...]]]r6)r7s"r8r9r9s1444 4!4C 4r;c a^RIHo\\4pVF4pS!V4wrVVfKV\ V4,P V4K6 VUu0uFp\ V4kK pp/p /p VP 4EF3wr\ V 4p W3pVPPV/4Uu0uFp\ S!V4^,4kK pp\V4pVPPV/4pVPV R4F.pVPV3RlVPV/444K0 VV,pVV,pVPV 4VPV 4V'd\\V44W&V'gEK\\V44W&EK6 W3#uupiuupi)aJBuild the forward dependency graph among the locked packages. Returns ``(full, base)``. ``full`` maps each pinned package to the canonical names of its direct dependencies that are themselves pinned; an activated extra (a ``name[extra]`` key in ``resolved_keys``) folds that extra's dependencies in. ``base`` is the subset from each package's own metadata (``deps_cache``), before any extra is folded in, so it holds only the edges that fire regardless of which extra was activated. Names not in ``pins`` are dropped from both so every edge points at a real ``[[packages]]`` entry. rc3T<"TFp\S!V4^,4xK R#5i)Nr).0deprs& r8 ,_forward_dependency_graph..s*3C"+c"21"5663s%(r6)rrrrrrrrSrrTupdatediscardrr)rrractivated_extrasrbaserrrgraph base_graphrrmrrr base_depsall_deps extra_maprs&&& @r8rrs"'3>s3C!#&    .t4 5 9 9% @ 37 7$$%$F 7(*E-/J!ZZ\%h/ (  **..y"= = k#.q1 2=  y>++// 2> %)))R8E OO$==3 9 V F )$# $VH%56E  9$)&*;$. s;U:a++UsTFz==zx has no sdist, but its dist-policy is 'sdist-install'; pick a version that publishes an sdist or change dist-policy for c3l<"TF)p\V\4'gK\VS4xK+ R#5ir)rr_build_artifact)rrr%s& r8rrs*38aJq)rv SDIST_INSTALLrranyr,rnextrrz_common_requires_pythonrrrAssertionErrorr3r)rrrmrr rr"r'filesservingrrr sdist_filer override_rpr serving_nameixby_name index_urlr%s&&&& @r8rrs 4*AA% ((< =E""((::9EG&&y7C  # # $"BEqAy)AEBs;U;sss;U;;;+Ry)**36  $C( ( U38UU38FD%DdKJ6@6L 2RV 44YHK". 4KE4R''--?? JL)012rwwG1-9-E L)4I +6|6FG44 !% %%  G i('  IC.2s;H H  Hc$V^8dQhRRRRRR/#)r1sourceWheelFile | SdistFileclsztype[WheelArtifact]r4r%r6)r7s"r8r9r98& ! r;cR#rr6r'r)s&&r8rr7r;c$V^8dQhRRRRRR/#)r1r'r(r)ztype[SdistArtifact]r4r"r6)r7s"r8r9r9=r*r;cR#rr6r,s&&r8rr<r-r;c$V^8dQhRRRRRR/#)r1r'r(r)z#type[WheelArtifact | SdistArtifact]r4zWheelArtifact | SdistArtifactr6)r7s"r8r9r9As&   !  , # r;c \VP4pV!VP\VP4VVP \ VP4VPR7#))filenamerhashessize upload_time local_path) _filter_acceptable_hashesr3r2rrr4_parse_upload_timer5r6)r'r)r3s&& r8rrAsS'v}} 5F  FJJ ' [[&v'9'9:$$  r;c V^8dQhRRRR/#)r1rr5r4rr6)r7s"r8r9r9Ps++J+?+r;cVfR#\V4pTPfR#TP\P 4# \dR#i;i)aqParse an index ``upload-time`` string to a UTC ``datetime``. Accepts the RFC 3339 form the Simple/JSON API serves (``Z`` or an explicit offset) and normalizes it to UTC (PEP 751 requires UTC for the emitted field). Returns ``None`` when the field is absent, unparseable, or has no timezone; the timestamp is informational, so a bad value is dropped rather than fatal. N)rrr astimezonerr)rparseds& r8r8r8PsS {#C(}}   X\\ ** s A AAc V^8dQhRRRR/#)r1r3ztuple[tuple[str, str], ...]r4r6)r7s"r8r9r9ds ' r;ca^RIHo\;QJd .V3Rl\V44FNK 5#!V3Rl\V444#)aReturn the subset of ``hashes`` whose algorithm is consumable. Pip's hash-checking mode and PEP 751 both accept any of sha256, sha384, or sha512; nab forwards every recorded entry so consumers can pick. Unacceptable algorithms (e.g. md5) are dropped, so the result may be empty. )ACCEPTED_HASH_ALGORITHMSc3@<"TFwrVS9gKW3xK R#5irr6)ralgodigestr?s& r8r,_filter_acceptable_hashes..ps'*LD + + *s  )rr?rr)r3r?s&@r8r7r7dsB4 5"6N55"6N r;c V^8dQhRRRR/#)r1 lock_inputr r4Noner6)r7s"r8r9r9ws00 0d0r;c ^RIHpHpVPP 4FpVP P 4Fp\ WB4'gK.VPOVPeVP3MRO5pVFJpVP'dKVP RVP: R\V4: R2p\V4h K K R#)zRaise :class:`MissingHashError` if a pinned artefact has no hash. PEP 751 and pip's hash-checking mode each need at least one of sha256/sha384/sha512 per artefact. The plain ``name==version`` writer records no hash and does not call this. )r?rNz : artefact z% has no acceptable hash (need one of )r6)rr?rtargetsvaluesrrrrr3rr2rr+)rEr?rlockpin artefactsartefactrs& r8require_artifact_hashesrOws>""))+99##%Cc,,W#**W 8M SUWI%88*K0A0A/DE8 89``, kept only when it is a named ref that differs from ``commit_id`` (i.e. the user did not pin the bare SHA). ``subdirectory`` carries the ``#subdirectory=`` fragment so an installer can locate the project inside the repo. ``bare_repo_url`` comes from ``parsed.repo_url``, which :meth:`VcsRequest.parse` has already separated from the ref and the fragment. ``repo_url`` re-pins that bare URL to ``commit_id`` (the ``git+`` prefix, ``@``, and any ``#subdirectory=`` fragment) so the requirements.txt line installs the locked commit, not the ref the user supplied. ) VcsRequest)r$Nz: VCS source pinned without a resolved commit SHA; materialize_vcs_source records the post-clone SHA before any version can be pinned, so this is an internal invariant violation+rz#subdirectory=/)safe)rrmrepo_url bare_repo_url commit_idrrequested_revisionvcs_type) nab_index.vcsrVrr$r-parserrefrrZrrr r3) rrmr'rrVr$rr<r]r[rZs &&&$ r8rrs:)!k  $C((   fjj )FjjjVZZ<%? T $FOO4M---,@H nU6+>+>S%I$JKK  G #((00D-  r;c(V^8dQhRRRRRRRR/#) r1rr3rmrr'r&r4rr6)r7s"r8r9r9s0   r;c^RIHp^RIHpVP VP 4pT!T\ V4\VP 4VPVP;'gRR7#)abBuild an :class:`ArchivePin` from an :class:`ArchiveSource`. The URL, hashes, and subdirectory come from the source declaration, which config parse validated (a hash is required), so the pin records the exact archive the resolve used. The URL is stripped of any credential userinfo, like every other pin, so a committed lockfile never carries a token. )ArchiveRequest)rN)rrmrr3r) nab_index.archiverdrrr`rr3rr3r)rrmr'rdrrequests&&& r8rrsY1%""6::.G  G GKK (~~))11T  r;)r+r,r-rrrrOr6)YrE __future__rlogging collectionsrrrpathlibrtypingrrr urllib.parser r r rnab_index.clientr r_iso8601r_tomlr_vendor.packaging.pylockrr_vendor.packaging.specifiersr_vendor.packaging.utilsrmetadatarpathsrgroupsrcollections.abcrrrnab_index.multi_indexr_vendor.packaging.versionrrrrr r!r"r#r$r%rr&r'r(r)rr* getLoggerrAr__all__r/rHrRrr+r,r-rrrrrrrrrr8r7rOrrrr6r;r8r{s|##'4444 1)$D772;;13   ML&   8 $  h  H 7 7 t z    J B03(c &( c $& c(,cFJcL"MJ"J4nOd     +(&008?Dr;