@guidanti/duet 1.6.0 → 1.8.0

package/NOTICE.md

@@ -18,7 +18,7 @@ duet runs external programs. It installs none of them, bundles none of them, red
 | Git | duet asks it where the project is, creates the implementation worktree with it and integrates through it | the Git project's |
 | Codex CLI (`codex`) | launched as a subprocess, per turn | OpenAI's |
 | Claude Code (`claude`) | launched as a subprocess, per turn | Anthropic's |
-| Node and npm | install and update duet, and nothing afterwards; no duet command invokes either | the Node.js project's and npm's |
+| Node and npm | install and update duet, and nothing afterwards; the only duet command that invokes npm is `duet upgrade`, which is that install command run on request | the Node.js project's and npm's |
 
 Your use of those programs, and what your provider accounts permit, is between you and them. duet starts no sign-in, opens no credential file and makes no claim about which account a CLI would run as.
 

package/README.md

@@ -2,23 +2,49 @@
 
 An automated Codex <-> Claude research, planning and implementation loop.
 
-npm installs and updates duet. It does not run it: the `duet` on your PATH is a shell script that execs the managed dispatcher, and every invocation after that is Python. Nothing duet runs invokes Node, npm or a source checkout.
+npm installs and updates duet. It does not run it: the `duet` on your PATH is a shell script that execs the managed dispatcher, and every invocation after that is Python. Nothing duet does with a project, a run or a version reads Node, npm or a source checkout; the one command that invokes npm is `duet upgrade`, which runs the install below for you and then reports what it left.
 
 ## Prerequisite: a Python you already have
 
 duet needs CPython >=3.9 on macOS (arm64) and does not install one. Installation finds an interpreter already on the machine, checks its version, architecture and ability to create a virtual environment, and fails with instructions when nothing usable is there. The official installers are at https://www.python.org/downloads/macos/.
 
+## Prerequisite: an npm that can allow this package's install script
+
+The install command below carries `--allow-scripts=@guidanti/duet`, and that allowance is not optional: the one install script it allows is the whole of duet's setup, and an install that runs none of it installs no runtime and selects nothing. `allow-scripts` is npm's own config and arrived in **npm 11.16.0**, documented for exactly the contexts that have no project to write a policy into -- `npm exec`, `npx` and `npm install -g` -- so for a global install it is npm's own route rather than a preference. In npm 11.x the policy is advisory and install scripts still run; npm 12.0.0 blocks unreviewed dependency install scripts, which is what makes the allowance load-bearing rather than defensive. Any npm that installs a global package installs this one; npm 11.16.0 or newer is what the allowance itself needs. `duet upgrade` reads one bounded `npm --version` before it installs anything: an npm established to be older refuses with the version it read, the boundary and npm's own sources, and duet neither drops the allowance nor writes npm's configuration to work around it. An npm whose version it could not read is reported as *unverified* rather than unsupported, and the install runs with the allowance in it.
+
 ## Install, update, retry
 
 ```sh
-npm install --global @guidanti/duet
+npm install --global @guidanti/duet --allow-scripts=@guidanti/duet
+```
+
+Once duet is installed, `duet upgrade` runs exactly that command for you -- npm's own global install with this package's install-script allowance -- shows npm's output and its failures unchanged, and then reads the installation root to say which release is installed, whether it is still the build it says it is, and whether it is the default. It reports an activation only where `default.json` says so and that release is intact: a zero npm status is not one. It takes no version or tag, so installing a named release stays the npm command above with `@<version>` in it.
+
+**What it can and cannot tell you about setup.** It reads this record before the install and again afterwards, and reports the comparison as what it is. The read afterwards is one read, and both questions about the record -- which artifact it names and whether its bytes are the ones from before -- are answered from those same bytes, so they are answered about one record rather than about two a setup of another release could have published between. A record that names the installed release's artifact and whose bytes changed while the command ran is evidence that a setup completed during it -- not proof of which process ran that setup, since nothing duet can read records that, and a concurrent setup or `duet select` is an ordinary thing. A record that is unchanged, that names another artifact, or that is absent is the absence of that evidence and not proof that no setup ran: npm runs no install script for a package it decides is already up to date, each record names the single artifact its own setup installed, and the record is written last. A read that could not open the record is not a reading of it either: the read before the install keeps its own state, so a record that was there and would not open is held as unreadable rather than as the absent record it is not, and where either read failed to open the file the comparison is reported as not established -- neither a setup during the command nor an unchanged record -- because a historical record of this release that was unreadable before the install and readable afterwards would otherwise read as one written during it. This record and `default.json` are two files, read one after the other and not under one lock, so the pair is reported as two observations rather than as a history: a record that changed under a default naming another release is not reported as a selection that replaced this release after it was activated, because that is an order of writes duet did not observe. A failing or interrupted install is read the same way -- npm's non-zero status is not evidence that nothing was installed or activated, because the install script is where setup happens and it can have got anywhere before the failure. An interruption signals the process group npm led, by the group id duet read while npm was running and for as long as anything is still in that group -- so npm's own exit, which is usually an interrupt's first effect, neither ends the cleanup nor takes the group's name away with it -- and then says which signals were delivered, how npm ended, whether anything outlived a signal and whether anything is left in that group, never reporting a cleanup it did not establish. `duet --version` and `duet select --json` are the read-only answers afterwards.
+
+**An interrupted or unfinished install is finished by either route below, and the second is the reason there are two:** another install, or `duet upgrade`, may run no install script at all once npm has unpacked a package it decides is already up to date, and so may finish nothing. This package's own setup script always runs setup, for the release this package carries:
+
+```sh
+/bin/sh "$(npm root -g)/@guidanti/duet/lib/setup.sh"
 ```
 
-Setup runs in this package's install script: it verifies the bundled artifact, installs it as an immutable managed runtime under `~/.duet/installations/`, self-checks that runtime, writes the dispatcher and selects the new build when the default is this distribution's own or there is none. Running the same command again is the retry and the upgrade; it installs beside what is there and removes nothing.
+Setup runs in this package's install script: it verifies the bundled artifact, installs it as an immutable managed runtime under `~/.duet/installations/<version>/`, self-checks that runtime, writes the dispatcher, and then makes that release the default for new runs -- on a first install, on an upgrade, on an explicit downgrade to an older version, and whatever was selected before. A run that already exists keeps the build it was started on, and `duet select <version>` changes the default again at any time -- as does `duet select` with no version on a terminal, which lists the installed releases, marks the default and selects the one you move to with the arrow keys and confirm with Enter. Escape, Ctrl-C and an end of input leave the default exactly as it was. A new version installs beside what is there and removes nothing.
+
+Running the same command again is the retry and the upgrade -- but a reinstall is npm's decision, not duet's: npm runs no install script for a package it decides is already up to date, and nothing then installs or selects anything. The two routes that always do are `duet select <version>`, which moves the default by hand, and `/bin/sh <package>/lib/setup.sh`, which runs this package's own setup for the release it carries. Installing another version or tag (`@guidanti/duet@<version>`) is a change npm does perform, and it activates that release.
+
+**npm does not show what the install script printed.** `foreground-scripts` defaults to false for an install, and setting it runs install scripts in npm's own process with its standard output and error -- so what setup prints, the release it activated as much as a reason it failed, is visible only under `--foreground-scripts`. Afterwards, `duet --version` and `duet select --json` say which release is installed and which one is the default, and neither installs or selects anything.
 
 Setup also creates six starter instruction files under `~/.duet/instructions/`, one for each research, plan and execute manager/implementer role. Existing files are never overwritten, including on upgrades. Edit these files to customize your guidance across projects; keep a file empty to opt out of its starter text. Setup does not create or change `~/.duet/config.json`.
 
-`DUET_SETUP_PYTHON=/path/to/python3` names the interpreter yourself. `--foreground-scripts` shows the setup output. If npm is configured with `ignore-scripts`, no setup runs and the launcher says so.
+`DUET_SETUP_PYTHON=/path/to/python3` names the interpreter yourself. `--foreground-scripts` shows the setup output. If npm is configured with `ignore-scripts`, or holds this package's install script back until it is allowed, no setup runs -- nothing is installed and nothing is selected -- and the launcher says so with the retry above.
+
+## What your runtimes are called
+
+A managed runtime is named by the version it publishes: `~/.duet/installations/1.8.0/`. That name is what `duet select`, `duet remove` and every report use, and `duet --version` prints the version alone. The build identity -- a digest of the exact bytes installed -- is kept where it is load-bearing instead of in the name: the runtime's own manifest, every run's pin, and the reports whose job is to say which build this is (`duet self-check`, `duet status --installations`, and `duet select` listing what is there, interactively on a terminal and read-only under `--json`).
+
+Runtimes installed before this release are named `<version>+<build id>`, and they keep that name: they stay listed, stay selectable and stay runnable, nothing is renamed, and no run is repinned. Select one by its full name. A bare version that *is* the name of a runtime selects that runtime; a bare version that is not a name, and that two older runtimes share, is ambiguous and refuses with both names printed for you to choose from. `duet remove` takes an exact name only.
+
+One version-only name holds one build, so installing a **different** build of a version you already have is refused rather than resolved for you: both identities and the runtime that is there are named. Nothing is overwritten and no other build is substituted, because a managed runtime is immutable and a run pinned to the build under that name has to go on reaching exactly it. Remove the one you have with `duet remove <name> --yes`, or install into a root of its own with `DUET_INSTALL_ROOT=/path/to/root`. Ordinary upgrades are unaffected: a new release has a new version and therefore a new name.
 
 ## Uninstalling is not removing your runtimes
 
@@ -30,9 +56,9 @@ That removes this package and the `duet` npm linked onto your PATH. It removes n
 
 ## This build
 
-- version `1.6.0`, build `3223e2d99afa5a8f`
-- artifact `duet-1.6.0-py3-none-any.whl`
-- `sha256=12dc1234c7223113b3448976d9b6c3efd962a033fa8692262ab39cd48535f458`
+- version `1.8.0`, build `646869928c864ea4`
+- artifact `duet-1.8.0-py3-none-any.whl`
+- `sha256=41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96`
 
 ## Permission to use duet
 

package/artifact/duet-1.8.0.artifact.json

@@ -0,0 +1,15 @@
+{
+  "build_id": "646869928c864ea4",
+  "name": "duet",
+  "schema": 1,
+  "source": {
+    "clean": true,
+    "commit": "5d13ae499990e613e949e7501c13d3aad8808426"
+  },
+  "verification": {
+    "contract": 2
+  },
+  "version": "1.8.0",
+  "wheel": "duet-1.8.0-py3-none-any.whl",
+  "wheel_sha256": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96"
+}

package/bin/duet

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Generated by duet.npm for @guidanti/duet 1.6.0.
+# Generated by duet.npm for @guidanti/duet 1.8.0.
 #
 # This is the whole of what npm puts on your PATH. It invokes no
 # Node, no npm and no source checkout: it finds the managed
@@ -22,43 +22,71 @@ root=${DUET_INSTALL_ROOT:-$HOME/.duet/installations}
 dispatcher=$root/.dispatch/duet
 if [ ! -x "$dispatcher" ]; then
   cat >&2 <<SETUP
-duet: this installation of @guidanti/duet has no managed runtime yet.
-  There is no dispatcher at $dispatcher.
-  Setup runs in this package's install script, so if npm was run
-  with --ignore-scripts, or that script failed, nothing was
-  installed and nothing was selected.
-  Install or retry:      npm install --global @guidanti/duet
-  See why it failed:     npm install --global @guidanti/duet --foreground-scripts
-  Run setup by hand:     /bin/sh $here/lib/setup.sh
-  duet installs no software by itself: nothing has been downloaded,
-  installed or selected here.
+duet: there is no executable duet dispatcher at $dispatcher.
+  That is the program this command runs, and it runs nothing else:
+  this launcher execs the dispatcher and performs no setup of its
+  own. All this message knows is that the file is not there, or is
+  not executable.
+  Setup writes it, and setup runs in this package's install script.
+  npm run with --ignore-scripts runs no install script; an npm that
+  holds this package's script back until it is allowed runs none
+  either; and a script that ran and failed can stop before this
+  file is written. This message cannot tell you which of those
+  happened, and it says nothing about what is installed under
+  $root or which release is selected there.
+  Install or retry:      npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
+  See why it failed:     npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet --foreground-scripts
+  If scripts are off:    npm config get ignore-scripts
+  Run setup by hand:     /bin/sh "$here/lib/setup.sh"
+  A successful setup installs this package's release and makes it
+  the default for new runs. duet installs no software by itself:
+  this message has downloaded, installed and selected nothing.
 SETUP
   exit 1
 fi
-# Whether a finished setup under this root installed the artifact
-# *this* package carries. One digest, matched in the record setup
-# writes last, with shell builtins and no interpreter: the launcher
-# is on the path of every duet invocation.
+# Whether the setup record under this root names the artifact *this*
+# package carries. One digest, matched in the record setup writes
+# last, with shell builtins and no interpreter: the launcher is on
+# the path of every duet invocation. A record names one artifact --
+# the one its own setup installed -- so a failure here is a record
+# that is absent, or one some other setup wrote, and the message
+# below claims nothing beyond that.
 set_up_here() {
   [ -f "$1" ] || return 1
   while IFS= read -r line; do
     case "$line" in
-      *'"wheel_sha256": "12dc1234c7223113b3448976d9b6c3efd962a033fa8692262ab39cd48535f458"'*) return 0 ;;
+      *'"wheel_sha256": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96"'*) return 0 ;;
     esac
   done < "$1"
   return 1
 }
 if ! set_up_here "$root/npm.json"; then
   cat >&2 <<INCOMPLETE
-duet: @guidanti/duet 1.6.0 is installed and its setup did not finish.
-  The runtime this package carries is not under $root, so this
-  command runs the managed runtime that is already there. Every run
-  still reaches the build it was started on, and nothing has been
-  downloaded, installed or selected -- including by this message.
-  Retry the setup:       npm install --global @guidanti/duet
-  See why it failed:     npm install --global @guidanti/duet --foreground-scripts
+duet: @guidanti/duet 1.8.0 is installed and no setup record under
+  $root names the artifact it carries.
+  That record names the one artifact its own setup installed, so
+  this reads the same whether none has been written here, a setup
+  stopped before writing one, or another setup wrote one for a
+  different release over it. It is not a statement that this
+  package's install script never ran or never finished, that its
+  runtime is not installed, or that nothing was activated.
+  Nor does it say which runtimes are installed, which one is
+  selected, or which one this command is about to run -- the
+  dispatcher decides that from the pin of the run you named and the
+  selected default, and every run still reaches the build it was
+  started on.
+  Retry the setup:       npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
+  See why it failed:     npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet --foreground-scripts
   If scripts are off:    npm config get ignore-scripts
-  Run setup by hand:     /bin/sh $here/lib/setup.sh
+  Run setup by hand:     /bin/sh "$here/lib/setup.sh"
+  npm runs no install script for a package it decides is already up
+  to date, so an install of this same version may do nothing at all.
+  The line above always runs setup for the release this package
+  carries: it installs nothing twice, removes nothing, and ends with
+  that release as the default for new runs.
+  This message has downloaded, installed and selected nothing.
+  \`duet select --json\` prints which runtime is the default; it
+  changes nothing either.
 INCOMPLETE
 fi
 exec "$dispatcher" "$@"

package/duet-npm.json

@@ -1,23 +1,23 @@
 {
   "artifact": {
-    "build_id": "3223e2d99afa5a8f",
-    "sidecar": "duet-1.6.0.artifact.json",
+    "build_id": "646869928c864ea4",
+    "sidecar": "duet-1.8.0.artifact.json",
     "verification": {
-      "contract": 1
+      "contract": 2
     },
-    "wheel": "duet-1.6.0-py3-none-any.whl",
-    "wheel_sha256": "12dc1234c7223113b3448976d9b6c3efd962a033fa8692262ab39cd48535f458"
+    "wheel": "duet-1.8.0-py3-none-any.whl",
+    "wheel_sha256": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96"
   },
   "contents": {
     "LICENSE.md": "cbc7853b308655c45a049a2c8c53c0a5e556cee29229d80209cbe82a896b1d0e",
-    "NOTICE.md": "95e6b3212b7a907e59befdca37999fd683cf02c94cc2d487df62b77c7c3ef2ba",
-    "README.md": "de73c22b8dbf9eec85608a839255a2949b0683868ac1060711163384c95eae1a",
-    "artifact/duet-1.6.0-py3-none-any.whl": "12dc1234c7223113b3448976d9b6c3efd962a033fa8692262ab39cd48535f458",
-    "artifact/duet-1.6.0.artifact.json": "8e5aa680c0b82fa568e6e682618260ebc8e47fd5ab4184378860c47ac3eefaa4",
-    "bin/duet": "be950b7cddd09ce4d657d89660c69f7bf4f68a57ad9c064966feb3dadbd0f3ab",
-    "lib/setup.py": "712a06709cff24615bb3fa6de7b296d38e53ec9caceeb569b9fa7adb1ee15a07",
-    "lib/setup.sh": "86df8dc71fb6ef276c7c986ee307b5208a4455a0905f8e0782cbccbe2e84242a",
-    "package.json": "4c3e8068b7adb44276f7cd6ab4f02e28e194a3410d1712205fd817766efbcc0a"
+    "NOTICE.md": "8cf095fd1e5abc0c29634b010890189a9a8a340f96358db93635650dbdf5ed89",
+    "README.md": "d6dfb6578fcc618c5e0f16287cffcf59c395b7092b3065ea755be912da641a40",
+    "artifact/duet-1.8.0-py3-none-any.whl": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96",
+    "artifact/duet-1.8.0.artifact.json": "a9ab64af12e028b13f910bc6d3be7a15d78faa1390252a89b4145b9482d9642c",
+    "bin/duet": "95a9762078fd565fa00d42a0cb5d2b4ca07e2fcd591facdb6e7b575517e79d8a",
+    "lib/setup.py": "d5a541812753e0d4fd395a8d3cbe6a7ecebeefb2b0b8cac92745a60070935e49",
+    "lib/setup.sh": "36d67424731e66c34333f0873dd3851563a2dc2c2890696f55ee9a4f4781f7de",
+    "package.json": "d80756c675be0a36ac2ad4759c86261eb404b70c1d461e7631a93657791554d9"
   },
   "notices": [
     "LICENSE.md",
@@ -27,7 +27,7 @@
   "schema": 1,
   "source": {
     "clean": true,
-    "commit": "3763f555bc641d2669ddb9301aee1b456f27cd9a"
+    "commit": "5d13ae499990e613e949e7501c13d3aad8808426"
   },
-  "version": "1.6.0"
+  "version": "1.8.0"
 }

package/lib/setup.py

@@ -1,4 +1,4 @@
-"""Generated by duet.npm for @guidanti/duet 1.6.0.
+"""Generated by duet.npm for @guidanti/duet 1.8.0.
 
 The install script's Python half: check the bundled artifact against
 the digest this file was generated with, import the installer out of
@@ -10,11 +10,12 @@ import os
 import sys
 
 PACKAGE = '@guidanti/duet'
-PACKAGE_VERSION = '1.6.0'
+PACKAGE_VERSION = '1.8.0'
 HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-WHEEL = os.path.join(HERE, 'artifact', 'duet-1.6.0-py3-none-any.whl')
-SIDECAR = os.path.join(HERE, 'artifact', 'duet-1.6.0.artifact.json')
-WHEEL_SHA256 = '12dc1234c7223113b3448976d9b6c3efd962a033fa8692262ab39cd48535f458'
+WHEEL = os.path.join(HERE, 'artifact', 'duet-1.8.0-py3-none-any.whl')
+SIDECAR = os.path.join(HERE, 'artifact', 'duet-1.8.0.artifact.json')
+WHEEL_SHA256 = '41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96'
+REINSTALL = ('The files in this installed package are not the ones it was published with, and npm runs nothing for a package it decides is already up to date. Remove it and install it again:', '  npm uninstall --global @guidanti/duet', '  npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet', "That install names this package's own version, so a release you installed deliberately is the release you get back.", 'That uninstall takes this package and the duet npm linked onto your PATH. It takes nothing under ~/.duet: every managed runtime, every run and every piece of evidence stays where it is.')
 
 
 def refuse(message, *lines):
@@ -33,7 +34,7 @@ def main():
             'the artifact this package carries could not be read ('
             + str(exc) + ')',
             'Nothing was installed and nothing was selected.',
-            'Install the package again:  npm install --global @guidanti/duet')
+            *REINSTALL)
     found = hashlib.sha256(data).hexdigest()
     if found != WHEEL_SHA256:
         return refuse(
@@ -45,7 +46,7 @@ def main():
             'duet will not install bytes that are not the bytes this'
             ' package records.',
             'Nothing was installed and nothing was selected.',
-            'Install the package again:  npm install --global @guidanti/duet')
+            *REINSTALL)
     # Those bytes, and nothing else, are what the installer is read
     # out of. A wheel is a zip and an interpreter imports from one
     # directly, so there is no temporary environment to clean up.
@@ -58,7 +59,7 @@ def main():
             ' a duet (' + type(exc).__name__ + ': ' + str(exc)
             + ')',
             'Nothing was installed and nothing was selected.',
-            'Install the package again:  npm install --global @guidanti/duet')
+            *REINSTALL)
     return npm.setup_main(wheel=WHEEL, sidecar=SIDECAR, here=HERE,
                           package=PACKAGE,
                           package_version=PACKAGE_VERSION,

package/lib/setup.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Generated by duet.npm for @guidanti/duet 1.6.0.
+# Generated by duet.npm for @guidanti/duet 1.8.0.
 #
 # npm runs this once, after it has unpacked the package. It finds an
 # interpreter that can run the installer and hands over to it; the
@@ -66,7 +66,9 @@ duet: DUET_SETUP_PYTHON names $DUET_SETUP_PYTHON, which duet will not run as an
   Install Python from https://www.python.org/downloads/macos/
   An explicit interpreter is an instruction, so duet does not look elsewhere when it is unusable.
   Nothing was installed and nothing was selected. Unset it or name another, then run:
-    npm install --global @guidanti/duet
+    npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
+  npm runs no install script for a package it decides is already up to date, so that install can do nothing at all. While this package is installed, its own setup script always runs setup, for the release it carries:
+    /bin/sh "$here/lib/setup.sh"
 OVERRIDE
     exit 1
   fi
@@ -107,8 +109,10 @@ if [ -z "$found" ]; then
 duet: no usable Python was found, and duet does not install one.
   duet needs CPython >=3.9 on macOS (arm64), able to create a virtual environment.
   Install Python from https://www.python.org/downloads/macos/
-  Then run:  npm install --global @guidanti/duet
-  Or name one yourself:  DUET_SETUP_PYTHON=/path/to/python3 npm install --global @guidanti/duet
+  Then run:  npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
+  Or name one yourself:  DUET_SETUP_PYTHON=/path/to/python3 npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
+  npm runs no install script for a package it decides is already up to date, so that install can do nothing at all. While this package is installed, its own setup script always runs setup, for the release it carries:
+    /bin/sh "$(npm root -g)/@guidanti/duet/lib/setup.sh"
   Nothing was installed, nothing was selected, and no existing duet installation was changed.
 NOPYTHON
   exit 1

package/package.json

@@ -23,5 +23,5 @@
   "scripts": {
     "postinstall": "/bin/sh lib/setup.sh"
   },
-  "version": "1.6.0"
+  "version": "1.8.0"
 }

package/artifact/duet-1.6.0.artifact.json

@@ -1,15 +0,0 @@
-{
-  "build_id": "3223e2d99afa5a8f",
-  "name": "duet",
-  "schema": 1,
-  "source": {
-    "clean": true,
-    "commit": "3763f555bc641d2669ddb9301aee1b456f27cd9a"
-  },
-  "verification": {
-    "contract": 1
-  },
-  "version": "1.6.0",
-  "wheel": "duet-1.6.0-py3-none-any.whl",
-  "wheel_sha256": "12dc1234c7223113b3448976d9b6c3efd962a033fa8692262ab39cd48535f458"
-}