+ 2j@ Rt^RIHt^RIHt^RIHt^RIt^RIH t H t ^RI H t ^RI HtHt^RIHt^R IHt^R IHt^R IHt^R IHtHt]'d)^R IHtHtHt^RIH t ^RI H!t!^RI H"t"^RI#H$t$^RIH%t%!RR]&4t'!RR]&4t(]!RRR7!RR44t)]!RRR7!RR44t*RRRR/RR llt+R!R"lt,R#R$lt-R%R&lt.R'R(lt/R)R/R*R+llt0R)R/R,R-llt1R.R/lt2R0R1lt3R2R3lt4R4R5lt5R6R7lt6R8R9lt7R:R;lt8RRRRR]9!4/R?R@llt:R#)BaResolver-free disqualification checks for ``nab lock --locked``. These run before the fresh resolve. Each function is a disqualifier: it returns a :class:`LockDisqualification` when it can prove a fresh resolve could not reproduce the committed lock, or ``None`` to fall through to the full re-resolve. There is no success verdict here; only the full re-resolve reports a lock as up to date. nab is non-sticky, so a lock can satisfy every input yet be stale once a newer admissible version exists, and only a fresh resolve tells the two apart. The envelope checks (:func:`check_envelope`) cover the lockfile fields the writer computes straight from the inputs: ``requires-python``, ``extras``, ``dependency-groups`` and ``default-groups``. The validity checks (:func:`check_direct_requirements`, :func:`check_constraints`) cover what every successful resolve renders: each active direct requirement is present and its specifier met, and each pin satisfies every active constraint. A pre-release pin is never disqualified for being a pre-release: the resolver picks from the intersection of every requirement on a name, so a fresh resolve can land on a pre-release the requirement checked here does not opt into on its own. The validity checks read one marker environment. A target standing for a whole Python minor synthesizes ``{minor}.0`` as its ``python_full_version`` while the resolve answers one micro slice at a time, so a marker cutting a boundary inside the minor is indeterminate here rather than decided at that floor. :func:`check_locked` is the entry point the CLI calls: it reads the committed lock and runs both stages, so a caller never handles a parsed lock itself. ) annotations) dataclass) TYPE_CHECKINGN)UnevaluableMarkerErrordependency_marker_holds)UndefinedEnvironmentName)PylockPylockValidationError) Requirement) SpecifierSetcanonicalize_name)validate_specifier_versions)NonIntervalMarkerErrormicro_boundary_points)IterableMappingSequence)Path)Marker)Package)Version) ResolveTargetc]tRt^:tRtRtR#)LockfileSyntaxErrorz2A committed lockfile that is not readable as TOML.N__name__ __module__ __qualname____firstlineno____doc____static_attributes__rh/home/user/billing-ledger-validation/.venv/lib/python3.14/site-packages/nab_python/_lockfile/validate.pyrr:stRtRtR#)InvalidLockfileErrorzsFr#r&T)frozenslotsc&]tRt^Bt$RtR]R&RtR#)LockDisqualificationzsA proven reason the committed lock is out of date. ``reason`` is a plain-language clause naming the disqualifier. strreasonrNrrrr r!__annotations__r"rr#r$r*r*Bs Kr#r*c0]tRt^Lt$RtR]R&R]R&RtR#)RootRequirementzOne active direct requirement plus the pyproject clause it came from. ``source`` is the plain-language origin named in a disqualification reason, for example ``[project].dependencies`` or a selected extra or group. r requirementr+sourcerNr-rr#r$r0r0Ls  Kr#r0 base_group build_groupc8V^8dQhRRRRRRRRRRR RR RR R /#)  committedrrequires_python str | Noneextrastuple[str, ...]dependency_groupsdefault_groupsr3r4returnLockDisqualification | Noner)formats"r$ __annotate__rAXsZ555 5  5 ' 5 $ 555!5r#cD\VPV4pVeV#VR3VR33Fwr\WV 4p V fKV u# RVPV3R\ VP WV4V3R\ VP V4V33Fwrp \WV 4pVfKVu# R#)alCompare the current envelope against the committed lock. ``requires-python`` compares as ``SpecifierSet`` equality and each selection as a set of normalized names, so reformatting or reordering does not fire and an empty selection matches the ``None`` the writer commits. Returns the first difference, or ``None`` when every field agrees. ``base_group`` and ``build_group`` are the names this run would give the project's own dependencies and its build requirements. No run selects either, so both are checked before the arrays are compared and then dropped from them: a reason names only groups the caller asked for. Nzthe project's own dependencieszthe build requirementsr:zdependency-groupszdefault-groups)_check_requires_pythonr8_check_configured_groupr:_withoutr<r=_check_name_set)r7r8r:r<r=r3r4requires_python_resultnamesubject named_resultkindcommitted_names current_namesresults&$$$$$$ r$check_enveloperOXs,4!!?)%% 56 ./ /yH  #   9##V,  Y00* J   Y--z :   1,}! F  M 1" r#c$V^8dQhRRRRRR/#)r6namesSequence[str] | Nonedroppedr9r>z list[str]r)r@s"r$rArAs'QQ(QJQ9Qr#cVUu0uFq"fK\V4kK ppT;'gRUu.uFp\V4V9gKVNK up#uupiuupi)zGReturn ``names`` without any of ``dropped``, comparing canonical names.rr )rQrSrHdrops&* r$rErEsT07 L # d #D L"[[b[ P[T,=d,C4,ODD[ PP M PsAAAAc(V^8dQhRRRRRRRR/#) r6r7rrHr9rIr+r>r?r)r@s"r$rArAs,'25 r#c aSfR#\;QJd3V3RlVP;'gR 4F 'gK RM( RM$!V3RlVP;'gR 44'dR#\RS: RV R2R7#) zWhether the lock offers ``name`` for ``subject`` as this run would. A committed name looks like any other group, so which one an earlier run gave to what cannot be read back. The reason says only what this run would write and the lock does not have. Nc3R<"TFp\V4\S48HxK R#5iNr ).0committed_namerHs& r$ *_check_configured_group..s( ?N .)->t-DD?s$'TFzthe lockfile does not name z for z, which this run doesr,r)anyr<r*)r7rHrIs&f&r$rDrDs | s '99??R? sss '99??R?  )$wi?T U r#c$V^8dQhRRRRRR/#)r6r7SpecifierSet | Nonecurrentr9r>r?r)r@s"r$rArAs&  "   ! r#cV'd \V4MRpW8XdR#\R\V4 R\V4 2R7#)Nzthe lockfile requires-python z does not match this run's r^)r r*_render_specifier)r7rb current_sets&& r$rCrCsM,3,w'K +,=i,H+IJ)):;)G(H J r#c(V^8dQhRRRRRRRR/#) r6rKr+r7rRrbz Sequence[str]r>r?r)r@s"r$rArAs0 #! r#c T;'gRUu0uFp\V4kK ppVUu0uFp\V4kK ppWE8XdR#\RV R\V4 R\V4 2R7#uupiuupi)Nzthe lockfile was built with  z but this run selects r^r)r r*_render_name_set)rKr7rbrH committed_setres&&& r$rFrFs :CbI&t,MI7>?wt$T*wK?# *4&2B=2Q1RS$$4[$A#B D  J?s A.A3resolve_targetc ,V^8dQhRRRRRRRRR R /#) r6r7r requirementszIterable[RootRequirement] marker_envMapping[str, str]rkResolveTarget | Noner>r?r)r@s"r$rArAs:000+0" 0 ) 0 ! 0r#c VPUu0uFqDPkK pp\V4pVEFpVPp\ VP W#4'dK.\ VP4p W9d6\VP RVP RVP R2R7u#VP'dKVPV 4p V fKVPPV RR7'dK\VP RVP VP RVP R V 2R7u# R#uupi) aCheck every active direct requirement against the committed lock. A requirement is active when its marker holds for ``marker_env``. Each active requirement must be pinned somewhere in ``committed.packages``, and when the matching pin records a concrete version the specifier must contain it. Anything that cannot be reduced to a name and specifier against a concrete version is skipped: an inactive or indeterminate marker, a URL requirement, a version-less or direct (URL, VCS, directory) pin, and a name carrying more than one versioned pin. Returns the first violation, or ``None``. ``resolve_target`` is the target ``marker_env`` came from: a marker its micro slices answer differently is indeterminate rather than read off the environment. z requires z2 and its marker applies here, but the lock has no z pinr^NT prereleasesz but the lock pins rh) packagesrH_versioned_pinsr1 _marker_skipsmarkerr r*r2urlget specifiercontains) r7rmrnrkpackage package_names versionedrootreqrHversions &&$$ r$check_direct_requirementsrs*,2;1C1CD1Cg\\1CMD *I Z @ @  *  $'{{m:chhZ8114 $@  777 --% ? }}%%g4%@@'{{m:chhZ G!!$ !G96 %0 5EsEc ,V^8dQhRRRRRRRRR R /#) r6r7r constraintszIterable[Requirement]rnrorkrpr>r?r)r@s"r$rArAs:!!!&!" ! ) ! ! !r#c r\V4pVFp\VPW#4'dK!VP\ VP 44pVfKKVP PVRR7'dKp\RVP VP RVP RV 2R7u# R#)a+Check every active constraint against the committed lock. A constraint is active when its marker holds for ``marker_env``. When it names a single versioned pin, that version must satisfy the constraint. An inactive or indeterminate marker, and a name with no single versioned pin (absent, version-less, or multiple under a conflict fork), are skipped. Returns the first violation, or ``None``. ``resolve_target`` is the target ``marker_env`` came from: a marker its micro slices answer differently is indeterminate rather than read off the environment. NTrrzthe constraint z is violated by the pinned rhr^) rurvrwryr rHrzr{r*)r7rrnrkr~ constraintrs&&$$ r$check_constraintsrs& *I! **J G G -- 1*// BC ? ##,,W$,GG'%joo%6z7K7K6LM..8oo->ayJ " r#c V^8dQhRRRR/#)r6r7rr>zdict[str, Version]r)r@s"r$rArA$sv*<r#c$/p\4pVPFhpVPe\V4'dK$VPV9dVP VP4VPWP&Kj VFpWK V#)a`Map canonical name to version for names with a single concrete pin. URL, VCS and directory pins are excluded: they have no index version to test a specifier against. A name carrying more than one versioned pin is excluded too: a conflict fork records the same package once per member under a disjoint marker, so no single version stands for the name. )setrtr_is_direct_pinrHadd)r7versions duplicatedr|rHs& r$ruru$sy$&H5J%% ?? "nW&=&=  <<8 # NN7<< (!( &  N Or#c V^8dQhRRRR/#)r6r|rr>boolr)r@s"r$rArA9sGr#cvVPRJ;'g%VPRJ;'gVPRJ#rY)vcs directoryarchive)r|s&r$rr9sA 4 ' '   D ( ' ' ??$ &r#c(V^8dQhRRRRRRRR/#) r6rwz Marker | Nonernrotargetrpr>rr)r@s"r$rArAAs0 ! ! r#cVfR#Ve\W4'dR#\W4pV'*# \\3dR#i;i)aReturn whether an item is inactive or indeterminate for ``marker_env``. A missing marker is active. A false marker is inactive. A marker that cannot be evaluated, or that ``target``'s micro slices answer differently, is indeterminate. Both inactive and indeterminate skip. FT)_splits_micro_linerrr)rwrnractives&&& r$rvrvAsS~ 0@@(<: #$< =s 1AAc$V^8dQhRRRRRR/#)r6rwrrrr>rr)r@s"r$rArAWs!  v }  r#cR\\W.44# \dR#i;i)adWhether ``marker`` reads differently across ``target``'s micro slices. A minor target's ``marker_env`` answers the micro axis at the synthesized ``{minor}.0`` floor, so a marker cutting a boundary inside the minor is decided per slice by the resolve rather than here. A marker the split cannot tile is undecided here too, and the full resolve reports it. T)rrr)rwrs&&r$rrWs,)&(;<< !s  &&c V^8dQhRRRR/#)r6specrar>r+r)r@s"r$rArAes33/3C3r#c$VfR#\V4#)Nz(none))r+)rs&r$rdrdes|82T2r#c V^8dQhRRRR/#)r6rQ Iterable[str]r>r+r)r@s"r$rArAis00M0c0r#cRRRP\V44,R,#){z, })joinsorted)rQs&r$ririis 6%=) )C //r#c V^8dQhRRRR/#)r6pathrr>rr)r@s"r$rArAmsr#c\P!VPRR74p\P!T4pTPe\TP4T#T# \\P3dp\ \ T44ThRp?ii;i \dp\\ T44ThRp?ii;i \dpT R2p\T4ThRp?ii;i)zParse the committed lockfile at ``path``. Raises :class:`OSError` when the file cannot be read, :class:`LockfileSyntaxError` when it is not TOML, and :class:`InvalidLockfileError` when it is TOML but not a usable PEP 751 lock. zutf-8)encodingNz in 'requires-python')tomliloads read_textUnicodeDecodeErrorTOMLDecodeErrorrr+r from_dictr r&r8r ValueError)rdataepylockmsgs& r$read_committed_pylockrms1{{4>>7>;<2!!$') 3 '(>(> ? M6M  5 5 61!#a&)q01 !2"3q6*12  3C,-C&s+ 2 3sF&A'BC'BBB C*B??C C(C##C(rootsrexcludecHV^8dQhRRRRRRRRRRR RR RR R R RRRRRRR/ #)r6lockfilerr8r9r:r;r<r=r3r4rz Iterable[RootRequirement] | Nonerrrkrprzfrozenset[str]r>r?r)r@s"r$rArAs888 8  8 ' 8 $ 888 ,88)88!8r#c ~\V4p \V VVVVVVR7p V f VeV fV #VU u.uF+p \V PP4V 9gK)V NK- pp \ V VV P V R7pVeV#VUu.uFp\V4NK pp\V VV P V R7#uup iuupi)a0Disqualify the committed lock at ``lockfile``, or return ``None``. Runs the envelope checks, then the validity checks over the active direct requirements and constraints, reading ``resolve_target``'s marker environment. ``roots`` or ``resolve_target`` of ``None`` runs the envelope checks alone. ``exclude`` holds canonical names to skip, for the workspace members ``--no-emit-workspace`` drops from both sides. Constraints arrive as text; the config loader has already rejected any that do not parse. Raises the errors :func:`read_committed_pylock` raises. )r8r:r<r=r3r4)rnrk) rrOr r1rHrrnr r)rr8r:r<r=r3r4rrrkrr7disqualificationrrdirecttextparseds&$$$$$$$$$$ r$ check_lockedrs2&h/I%'+%#u}8ND T--22 37 B   '!,,% F  ,7 8KDk$KF 8 !,,%  9s&B5B5B:r);r! __future__r dataclassesrtypingrr_conflict_kindrr_vendor.packaging.markersr_vendor.packaging.pylockrr _vendor.packaging.requirementsr _vendor.packaging.specifiersr _vendor.packaging.utilsr metadatarrrrcollections.abcrrrpathlibrrr_vendor.packaging.versionrr Exceptionrr&r*r0rOrErDrCrFrrrurrvrrdrir frozensetrrr#r$rs\>#! L@D8772B;;223&=)=G9G $d#$ $d#$5"5#5pQ . "0 ,0 0f! ,0 !H*, 3048"8#8/38"$8,08(k88r#