@guidanti/duet 1.8.0 → 1.10.0

package/LICENSE.md

@@ -36,7 +36,7 @@ Stating a reservation of rights is not a claim to control everything adjacent to
 
 ## 5. External software
 
-duet bundles no third-party code. It needs a Python interpreter, Git and the vendor CLIs it drives, and it installs, bundles and redistributes none of them -- see [NOTICE.md](NOTICE.md) for what that means for each of them and whose terms govern them.
+duet bundles third-party code: four pure-Python wheels -- rich, markdown-it-py, mdurl and pygments, at the exact versions pinned in `src/duet/dependencies.json` -- travel inside the wheel the npm package carries, and each of them is published by its own copyright holder under its own terms, MIT or BSD-2-Clause. Those terms travel inside the bytes that carry them, and this file neither grants, restricts nor speaks for anything in them: the rights reserved above are the rights in duet's own code, and "duet" in clause 1 does not mean the distributions it bundles. duet also needs a Python interpreter, Git and the vendor CLIs it drives, and it installs, bundles and redistributes none of those. See [NOTICE.md](NOTICE.md) for the pinned set, where each distribution's notices travel, and whose terms govern each external program.
 
 ## 6. No warranty, and no liability
 
@@ -48,4 +48,4 @@ Licensing enquiries: **min@guidanti.com**. [Permission to use duet](docs/licensi
 
 ---
 
-**Review status: approved.** This wording was **revised on 2026-10-08** to carry the owner's decisions -- the repository stays private, Guidanti Inc. owns the existing code, Ontario and Canada govern the grant, contributions are internal only, and min@guidanti.com is the published contact -- and **corrected the same day**, because clause 2 described the private repository as meaning duet's source is not distributed and the public package's wheel is readable Python source. The owner was shown those corrected terms and **approved them on 2026-10-08**, naming the exact bytes: sha256 `41d8a0763b603eafe24d5d9605167299bfc03d52cd01c9add56c8b5a843ad9e7` for this file and `23f7ea74c9f7afc9c96baaf268136b73200fc9f8d0937ba92f5991cee1726d10` for [NOTICE.md](NOTICE.md). Clauses 1 to 7 above are unchanged by this note and are the approved text; what changed after the approval is this paragraph, which is why the file no longer hashes to the digest the approval names. A change to any clause would be a new approval and a different build identity. A distribution under these terms has now happened: the authorized `0.0.x` publication rehearsal put `@guidanti/duet` on npm carrying this file, and no release of duet has been published.
+**Review status: approved on 2026-10-08; clause 5 has been corrected since and is not covered by that approval.** This wording was **revised on 2026-10-08** to carry the owner's decisions -- the repository stays private, Guidanti Inc. owns the existing code, Ontario and Canada govern the grant, contributions are internal only, and min@guidanti.com is the published contact -- and **corrected the same day**, because clause 2 described the private repository as meaning duet's source is not distributed and the public package's wheel is readable Python source. The owner was shown those corrected terms and **approved them on 2026-10-08**, naming the exact bytes: sha256 `41d8a0763b603eafe24d5d9605167299bfc03d52cd01c9add56c8b5a843ad9e7` for this file and `23f7ea74c9f7afc9c96baaf268136b73200fc9f8d0937ba92f5991cee1726d10` for [NOTICE.md](NOTICE.md). Clauses 1 to 4, 6 and 7 above are unchanged since that approval and are the approved text. **Clause 5 is not**: it said duet bundles no third-party code, duet now distributes the four pinned wheels [NOTICE.md](NOTICE.md) names, and the clause was corrected to describe what is actually distributed and whose terms govern it. That correction states a fact and makes no licensing decision -- the ownership, the distribution decisions, the route to permission, the governing law, the contribution position and the warranty and liability clauses are as the owner decided and approved them -- and **it claims no approval**: a changed clause is a new approval and a different build identity, so the owner's review of this wording is a prerequisite of publishing a release that carries that payload, and the digests named above are the earlier bytes rather than these. This paragraph is the other reason the file does not hash to the digest the approval names. A distribution under these terms has now happened: the authorized `0.0.x` publication rehearsal put `@guidanti/duet` on npm carrying this file as it stood then, with clause 5 as the approval named it, and no release of duet has been published.

package/NOTICE.md

@@ -2,11 +2,24 @@
 
 Copyright © 2026 Guidanti Inc. All rights reserved. The terms are in [LICENSE.md](LICENSE.md); this file is the third-party notice that travels beside them.
 
-## duet bundles no third-party code
+## The third-party code duet bundles
 
-Every byte duet distributes is its own. The wheel holds the `duet` package and its own metadata and nothing else: `pyproject.toml` declares an empty dependency list, the test suite re-derives that list from the package's own imports so adding a dependency fails there rather than quietly becoming part of the installation, and `duet install --artifact` refuses an artifact that declares any `Requires-Dist` at all. The generated `@guidanti/duet` npm package is assembled from an explicit allowlist -- a launcher, an install script, a bootstrap, that same wheel, its record, a generated manifest and README, and these notices -- with no dependencies and nothing taken from a checkout. Nothing is downloaded by an installation of duet, at any point.
+**duet distributes four third-party wheels, and each distribution's own terms travel inside the bytes that carry it.** The set is Rich and the distributions Rich requires, each pinned to one version, length and sha256 in `src/duet/dependencies.json`. That inventory is the only list of them: `pyproject.toml` declares `dependencies` dynamic and `setup.py` renders the exact `==` pins from it, a managed build writes those same pins into the artifact's `Requires-Dist`, and `duet install --artifact` refuses an artifact whose metadata, carried wheels and own inventory are not one agreeing set.
 
-So there is no vendored library here, no statically linked component, and no accompanying licence text that a redistribution would have to carry. If that ever changes, the component and its terms belong in this file and in the packaging allowlists that carry it.
+| Distribution | Version | Whose terms govern | Where its notices travel |
+| --- | --- | --- | --- |
+| [rich](https://pypi.org/project/rich/15.0.0/) | 15.0.0 | its publishers', under MIT | `duet-<version>.dist-info/licenses/rich-15.0.0/` |
+| [markdown-it-py](https://pypi.org/project/markdown-it-py/3.0.0/) | 3.0.0 | its publishers', under MIT | `duet-<version>.dist-info/licenses/markdown-it-py-3.0.0/` |
+| [mdurl](https://pypi.org/project/mdurl/0.1.2/) | 0.1.2 | its publishers', under MIT | `duet-<version>.dist-info/licenses/mdurl-0.1.2/` |
+| [pygments](https://pypi.org/project/pygments/2.21.0/) | 2.21.0 | its publishers', under BSD-2-Clause | `duet-<version>.dist-info/licenses/pygments-2.21.0/` |
+
+Those are their own copyright holders' terms, and nothing in [LICENSE.md](LICENSE.md) adds to them, narrows them or speaks for them. Their notice files are not retyped here: a build reads each one out of the wheel whose bytes it has just held to the pinned length and digest, carries it at the path in the table, and names it in the wheel's `METADATA` as a `License-File` beside duet's own -- so what is redistributed is each publisher's own file, and an artifact that does not carry a notice its inventory records for a distribution does not verify and is not installed.
+
+**Where those bytes are, and what carries them.** The four wheels are members of duet's own wheel, at `duet/_dependencies/<wheel>`, so one artifact is the whole of what a release distributes. The generated `@guidanti/duet` npm package is assembled from an explicit allowlist -- a launcher, an install script, a bootstrap, that wheel, its record, a generated manifest and README, and these notices -- and it carries the payload and the carried distributions' notices because they are inside the wheel the allowlist already names, with nothing taken from a checkout. The package itself declares no npm dependencies, and nothing in it runs under Node. Setup unpacks the carried wheels into the managed runtime's own environment: an npm installation, `duet install --artifact`, a restoration and an ordinary command resolve no version and download no package.
+
+**One route does download them, and it is not a release's.** An ordinary `pip install .` resolves `pyproject.toml`'s dependency list -- those same exact pins -- from whatever index you point pip at, into an environment you chose, under pip's integrity checks rather than duet's. duet neither creates nor records that environment and makes no claim about the bytes pip put in it.
+
+One duet module imports one of the carried distributions -- `src/duet/live.py` imports Rich, for the live row it draws while a turn runs -- and no other module imports anything outside the standard library; nothing compares what duet imports with that inventory. So a change to the set is an edit to the inventory, a re-run of `tools/prepare_dependencies.py`, and a revision of this file -- by hand, because no check here derives one from the other.
 
 ## What duet needs, and does not distribute
 
@@ -32,4 +45,4 @@ duet drives model providers, and what a provider's model writes into a report, a
 
 ---
 
-**Review status: approved.** Revised with [LICENSE.md](LICENSE.md) on 2026-10-08 under the owner's decisions and **approved the same day**, by sha256 `23f7ea74c9f7afc9c96baaf268136b73200fc9f8d0937ba92f5991cee1726d10`, which is this file as it stood when the approval was recorded. Everything above this note is the approved text and is unchanged by it; this paragraph is what moved the digest afterwards. Nothing else in this file has ever changed: duet still bundles no third-party code, so the decisions about distribution, jurisdiction, contributions and contact touch the terms rather than the notices. The account of the approval is in [permission to use duet](docs/licensing.md#what-the-owner-decided-and-what-that-settled).
+**Review status: approved on 2026-10-08; the third-party section has been corrected since and is not covered by that approval.** This file was revised with [LICENSE.md](LICENSE.md) on 2026-10-08 under the owner's decisions and **approved the same day**, by sha256 `23f7ea74c9f7afc9c96baaf268136b73200fc9f8d0937ba92f5991cee1726d10`, which is this file as it stood when the approval was recorded; the account of that approval is in [permission to use duet](docs/licensing.md#what-the-owner-decided-and-what-that-settled). What has changed since is the section on third-party code, and it changed as a statement of fact: duet began distributing the four pinned wheels, the approved text said it distributed none, and an approval of earlier bytes is not a reason to go on publishing an inaccurate notice. **No new approval is claimed here.** The owner's decisions are untouched by that correction -- the copyright holder, what is distributed where, the governing law, the contribution position and the published address are [LICENSE.md](LICENSE.md)'s and are unchanged -- and the corrected wording is awaiting the owner's review, which [the activation checklist](docs/release-publication.md#the-activation-checklist) carries as a prerequisite of publishing a release carrying that payload. The sections on the external programs duet runs, the contributor tooling and the agents' own output are the approved text, unchanged.

package/README.md

@@ -18,6 +18,8 @@ The install command below carries `--allow-scripts=@guidanti/duet`, and that all
 npm install --global @guidanti/duet --allow-scripts=@guidanti/duet
 ```
 
+**Setup installs the whole runtime from the bundled artifact and downloads nothing for it.** The artifact declares the pinned third-party wheels it travels with and carries their exact bytes, and installing it unpacks duet and every one of those wheels into the runtime's own environment, which is created without pip and resolves nothing. A runtime missing any of them is not published: the staged tree is held to the manifest it declares before anything is renamed into place.
+
 Once duet is installed, `duet upgrade` runs exactly that command for you -- npm's own global install with this package's install-script allowance -- shows npm's output and its failures unchanged, and then reads the installation root to say which release is installed, whether it is still the build it says it is, and whether it is the default. It reports an activation only where `default.json` says so and that release is intact: a zero npm status is not one. It takes no version or tag, so installing a named release stays the npm command above with `@<version>` in it.
 
 **What it can and cannot tell you about setup.** It reads this record before the install and again afterwards, and reports the comparison as what it is. The read afterwards is one read, and both questions about the record -- which artifact it names and whether its bytes are the ones from before -- are answered from those same bytes, so they are answered about one record rather than about two a setup of another release could have published between. A record that names the installed release's artifact and whose bytes changed while the command ran is evidence that a setup completed during it -- not proof of which process ran that setup, since nothing duet can read records that, and a concurrent setup or `duet select` is an ordinary thing. A record that is unchanged, that names another artifact, or that is absent is the absence of that evidence and not proof that no setup ran: npm runs no install script for a package it decides is already up to date, each record names the single artifact its own setup installed, and the record is written last. A read that could not open the record is not a reading of it either: the read before the install keeps its own state, so a record that was there and would not open is held as unreadable rather than as the absent record it is not, and where either read failed to open the file the comparison is reported as not established -- neither a setup during the command nor an unchanged record -- because a historical record of this release that was unreadable before the install and readable afterwards would otherwise read as one written during it. This record and `default.json` are two files, read one after the other and not under one lock, so the pair is reported as two observations rather than as a history: a record that changed under a default naming another release is not reported as a selection that replaced this release after it was activated, because that is an order of writes duet did not observe. A failing or interrupted install is read the same way -- npm's non-zero status is not evidence that nothing was installed or activated, because the install script is where setup happens and it can have got anywhere before the failure. An interruption signals the process group npm led, by the group id duet read while npm was running and for as long as anything is still in that group -- so npm's own exit, which is usually an interrupt's first effect, neither ends the cleanup nor takes the group's name away with it -- and then says which signals were delivered, how npm ended, whether anything outlived a signal and whether anything is left in that group, never reporting a cleanup it did not establish. `duet --version` and `duet select --json` are the read-only answers afterwards.
@@ -40,7 +42,7 @@ Setup also creates six starter instruction files under `~/.duet/instructions/`,
 
 ## What your runtimes are called
 
-A managed runtime is named by the version it publishes: `~/.duet/installations/1.8.0/`. That name is what `duet select`, `duet remove` and every report use, and `duet --version` prints the version alone. The build identity -- a digest of the exact bytes installed -- is kept where it is load-bearing instead of in the name: the runtime's own manifest, every run's pin, and the reports whose job is to say which build this is (`duet self-check`, `duet status --installations`, and `duet select` listing what is there, interactively on a terminal and read-only under `--json`).
+A managed runtime is named by the version it publishes: `~/.duet/installations/1.10.0/`. That name is what `duet select`, `duet remove` and every report use, and `duet --version` prints the version alone. The build identity -- a digest of the exact bytes installed -- is kept where it is load-bearing instead of in the name: the runtime's own manifest, every run's pin, and the reports whose job is to say which build this is (`duet self-check`, and `duet select` listing what is there, interactively on a terminal and read-only under `--json`).
 
 Runtimes installed before this release are named `<version>+<build id>`, and they keep that name: they stay listed, stay selectable and stay runnable, nothing is renamed, and no run is repinned. Select one by its full name. A bare version that *is* the name of a runtime selects that runtime; a bare version that is not a name, and that two older runtimes share, is ambiguous and refuses with both names printed for you to choose from. `duet remove` takes an exact name only.
 
@@ -56,12 +58,15 @@ That removes this package and the `duet` npm linked onto your PATH. It removes n
 
 ## This build
 
-- version `1.8.0`, build `646869928c864ea4`
-- artifact `duet-1.8.0-py3-none-any.whl`
-- `sha256=41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96`
+- version `1.10.0`, build `2f5e084fa87940f2`
+- artifact `duet-1.10.0-py3-none-any.whl`
+- `sha256=1eb946c64874ed78190b8959a4873fca48a694670446dd6cb2b5639120c63112`
+- carries 4 pinned wheels: markdown-it-py 3.0.0, mdurl 0.1.2, pygments 2.21.0, rich 15.0.0, by digest inside that artifact; nothing is downloaded for them, and setup unpacks them into the runtime's own environment beside duet
 
 ## Permission to use duet
 
 duet is not open-source software and installing it is not permission to use it: the copyright is Guidanti Inc.'s, all rights are reserved, and permission is granted individually and in writing. `license` is `UNLICENSED`, which is npm's own spelling for "no license is granted here" and is accurate rather than provisional. The terms are `LICENSE.md` and `NOTICE.md` in this package; the source repository is private, so ask for permission at min@guidanti.com rather than looking for an issue tracker.
 
+**The distributions this release carries are published under their own terms, and those terms travel with their bytes.** Each one's notice files are inside the artifact above, at `duet-1.10.0.dist-info/licenses/<name>-<version>/`, and are named in that artifact's own `METADATA` as `License-File` beside duet's: an artifact that does not carry the notice its inventory records for a distribution does not verify and is not installed. They are their publishers' terms rather than a grant made here, and this package carries no second copy of them.
+
 `docs/packaging.md` and `docs/launching.md` are the full documentation, in that private repository; this README and the files beside it are what travels with the package.

package/artifact/duet-1.10.0.artifact.json

@@ -0,0 +1,56 @@
+{
+  "build_id": "2f5e084fa87940f2",
+  "dependencies": {
+    "carried_in": "duet/_dependencies",
+    "packages": [
+      {
+        "name": "markdown-it-py",
+        "sha256": "355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1",
+        "size": 87528,
+        "version": "3.0.0",
+        "wheel": "markdown_it_py-3.0.0-py3-none-any.whl"
+      },
+      {
+        "name": "mdurl",
+        "sha256": "84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8",
+        "size": 9979,
+        "version": "0.1.2",
+        "wheel": "mdurl-0.1.2-py3-none-any.whl"
+      },
+      {
+        "name": "pygments",
+        "sha256": "2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9",
+        "size": 1250147,
+        "version": "2.21.0",
+        "wheel": "pygments-2.21.0-py3-none-any.whl"
+      },
+      {
+        "name": "rich",
+        "sha256": "33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb",
+        "size": 310654,
+        "version": "15.0.0",
+        "wheel": "rich-15.0.0-py3-none-any.whl"
+      }
+    ],
+    "requires": [
+      "markdown-it-py==3.0.0",
+      "mdurl==0.1.2",
+      "pygments==2.21.0",
+      "rich==15.0.0"
+    ],
+    "schema": 1,
+    "unpacked": false
+  },
+  "name": "duet",
+  "schema": 2,
+  "source": {
+    "clean": true,
+    "commit": "57e555292a538374065a602d7186daea32e1a00f"
+  },
+  "verification": {
+    "contract": 2
+  },
+  "version": "1.10.0",
+  "wheel": "duet-1.10.0-py3-none-any.whl",
+  "wheel_sha256": "1eb946c64874ed78190b8959a4873fca48a694670446dd6cb2b5639120c63112"
+}

package/bin/duet

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Generated by duet.npm for @guidanti/duet 1.8.0.
+# Generated by duet.npm for @guidanti/duet 1.10.0.
 #
 # This is the whole of what npm puts on your PATH. It invokes no
 # Node, no npm and no source checkout: it finds the managed
@@ -34,8 +34,8 @@ duet: there is no executable duet dispatcher at $dispatcher.
   file is written. This message cannot tell you which of those
   happened, and it says nothing about what is installed under
   $root or which release is selected there.
-  Install or retry:      npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
-  See why it failed:     npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet --foreground-scripts
+  Install or retry:      npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet
+  See why it failed:     npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet --foreground-scripts
   If scripts are off:    npm config get ignore-scripts
   Run setup by hand:     /bin/sh "$here/lib/setup.sh"
   A successful setup installs this package's release and makes it
@@ -55,14 +55,14 @@ set_up_here() {
   [ -f "$1" ] || return 1
   while IFS= read -r line; do
     case "$line" in
-      *'"wheel_sha256": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96"'*) return 0 ;;
+      *'"wheel_sha256": "1eb946c64874ed78190b8959a4873fca48a694670446dd6cb2b5639120c63112"'*) return 0 ;;
     esac
   done < "$1"
   return 1
 }
 if ! set_up_here "$root/npm.json"; then
   cat >&2 <<INCOMPLETE
-duet: @guidanti/duet 1.8.0 is installed and no setup record under
+duet: @guidanti/duet 1.10.0 is installed and no setup record under
   $root names the artifact it carries.
   That record names the one artifact its own setup installed, so
   this reads the same whether none has been written here, a setup
@@ -75,8 +75,8 @@ duet: @guidanti/duet 1.8.0 is installed and no setup record under
   dispatcher decides that from the pin of the run you named and the
   selected default, and every run still reaches the build it was
   started on.
-  Retry the setup:       npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
-  See why it failed:     npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet --foreground-scripts
+  Retry the setup:       npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet
+  See why it failed:     npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet --foreground-scripts
   If scripts are off:    npm config get ignore-scripts
   Run setup by hand:     /bin/sh "$here/lib/setup.sh"
   npm runs no install script for a package it decides is already up

package/duet-npm.json

@@ -1,23 +1,64 @@
 {
   "artifact": {
-    "build_id": "646869928c864ea4",
-    "sidecar": "duet-1.8.0.artifact.json",
+    "build_id": "2f5e084fa87940f2",
+    "dependencies": {
+      "carried_in": "duet/_dependencies",
+      "packages": [
+        {
+          "name": "markdown-it-py",
+          "sha256": "355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1",
+          "size": 87528,
+          "version": "3.0.0",
+          "wheel": "markdown_it_py-3.0.0-py3-none-any.whl"
+        },
+        {
+          "name": "mdurl",
+          "sha256": "84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8",
+          "size": 9979,
+          "version": "0.1.2",
+          "wheel": "mdurl-0.1.2-py3-none-any.whl"
+        },
+        {
+          "name": "pygments",
+          "sha256": "2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9",
+          "size": 1250147,
+          "version": "2.21.0",
+          "wheel": "pygments-2.21.0-py3-none-any.whl"
+        },
+        {
+          "name": "rich",
+          "sha256": "33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb",
+          "size": 310654,
+          "version": "15.0.0",
+          "wheel": "rich-15.0.0-py3-none-any.whl"
+        }
+      ],
+      "requires": [
+        "markdown-it-py==3.0.0",
+        "mdurl==0.1.2",
+        "pygments==2.21.0",
+        "rich==15.0.0"
+      ],
+      "schema": 1,
+      "unpacked": false
+    },
+    "sidecar": "duet-1.10.0.artifact.json",
     "verification": {
       "contract": 2
     },
-    "wheel": "duet-1.8.0-py3-none-any.whl",
-    "wheel_sha256": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96"
+    "wheel": "duet-1.10.0-py3-none-any.whl",
+    "wheel_sha256": "1eb946c64874ed78190b8959a4873fca48a694670446dd6cb2b5639120c63112"
   },
   "contents": {
-    "LICENSE.md": "cbc7853b308655c45a049a2c8c53c0a5e556cee29229d80209cbe82a896b1d0e",
-    "NOTICE.md": "8cf095fd1e5abc0c29634b010890189a9a8a340f96358db93635650dbdf5ed89",
-    "README.md": "d6dfb6578fcc618c5e0f16287cffcf59c395b7092b3065ea755be912da641a40",
-    "artifact/duet-1.8.0-py3-none-any.whl": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96",
-    "artifact/duet-1.8.0.artifact.json": "a9ab64af12e028b13f910bc6d3be7a15d78faa1390252a89b4145b9482d9642c",
-    "bin/duet": "95a9762078fd565fa00d42a0cb5d2b4ca07e2fcd591facdb6e7b575517e79d8a",
-    "lib/setup.py": "d5a541812753e0d4fd395a8d3cbe6a7ecebeefb2b0b8cac92745a60070935e49",
-    "lib/setup.sh": "36d67424731e66c34333f0873dd3851563a2dc2c2890696f55ee9a4f4781f7de",
-    "package.json": "d80756c675be0a36ac2ad4759c86261eb404b70c1d461e7631a93657791554d9"
+    "LICENSE.md": "16f67dce425dbd3ff2c85bb92325d5b0a8b0e230e8813f1120ee1e1f330ddbfa",
+    "NOTICE.md": "1045e33f6939d1f23b4763f09ab8a5235df15f7be341dca673b05c45654eddeb",
+    "README.md": "3ee7232880a07fceedafb58e1d4039911f629af2dc071525e074bc4d2c54a32e",
+    "artifact/duet-1.10.0-py3-none-any.whl": "1eb946c64874ed78190b8959a4873fca48a694670446dd6cb2b5639120c63112",
+    "artifact/duet-1.10.0.artifact.json": "21d0284fc7e4ec48a66cb2f6e8c44afc68f8c18f4e79c538fdf0f7aa112a1d12",
+    "bin/duet": "542dc62ec7b04f9748785e1acb3966621f196a75f0e49878228bc7982a44be73",
+    "lib/setup.py": "cb237a13ea3ed263530a78ba3a030bc9aeff3d73ce057121d081400a9bcf8522",
+    "lib/setup.sh": "6e5617978d97e380e212d9206a03587141ba135f5d2ef3ee0dfd9c57b671d831",
+    "package.json": "5684ae9684f94b07ae90a45eedb08bea9643163e158fc5af9628508dfe67f8c8"
   },
   "notices": [
     "LICENSE.md",
@@ -27,7 +68,7 @@
   "schema": 1,
   "source": {
     "clean": true,
-    "commit": "5d13ae499990e613e949e7501c13d3aad8808426"
+    "commit": "57e555292a538374065a602d7186daea32e1a00f"
   },
-  "version": "1.8.0"
+  "version": "1.10.0"
 }

package/lib/setup.py

@@ -1,21 +1,23 @@
-"""Generated by duet.npm for @guidanti/duet 1.8.0.
+"""Generated by duet.npm for @guidanti/duet 1.10.0.
 
 The install script's Python half: check the bundled artifact against
 the digest this file was generated with, import the installer out of
-those same bytes, and run it. Nothing here verifies an artifact
-itself or creates an environment."""
+those same bytes, and run it. That digest covers the whole artifact,
+the pinned dependency wheels inside it included, so there is nothing
+beside it to check here and nothing to fetch. Nothing here verifies
+an artifact itself or creates an environment."""
 
 import hashlib
 import os
 import sys
 
 PACKAGE = '@guidanti/duet'
-PACKAGE_VERSION = '1.8.0'
+PACKAGE_VERSION = '1.10.0'
 HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-WHEEL = os.path.join(HERE, 'artifact', 'duet-1.8.0-py3-none-any.whl')
-SIDECAR = os.path.join(HERE, 'artifact', 'duet-1.8.0.artifact.json')
-WHEEL_SHA256 = '41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96'
-REINSTALL = ('The files in this installed package are not the ones it was published with, and npm runs nothing for a package it decides is already up to date. Remove it and install it again:', '  npm uninstall --global @guidanti/duet', '  npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet', "That install names this package's own version, so a release you installed deliberately is the release you get back.", 'That uninstall takes this package and the duet npm linked onto your PATH. It takes nothing under ~/.duet: every managed runtime, every run and every piece of evidence stays where it is.')
+WHEEL = os.path.join(HERE, 'artifact', 'duet-1.10.0-py3-none-any.whl')
+SIDECAR = os.path.join(HERE, 'artifact', 'duet-1.10.0.artifact.json')
+WHEEL_SHA256 = '1eb946c64874ed78190b8959a4873fca48a694670446dd6cb2b5639120c63112'
+REINSTALL = ('The files in this installed package are not the ones it was published with, and npm runs nothing for a package it decides is already up to date. Remove it and install it again:', '  npm uninstall --global @guidanti/duet', '  npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet', "That install names this package's own version, so a release you installed deliberately is the release you get back.", 'That uninstall takes this package and the duet npm linked onto your PATH. It takes nothing under ~/.duet: every managed runtime, every run and every piece of evidence stays where it is.')
 
 
 def refuse(message, *lines):

package/lib/setup.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Generated by duet.npm for @guidanti/duet 1.8.0.
+# Generated by duet.npm for @guidanti/duet 1.10.0.
 #
 # npm runs this once, after it has unpacked the package. It finds an
 # interpreter that can run the installer and hands over to it; the
@@ -66,7 +66,7 @@ duet: DUET_SETUP_PYTHON names $DUET_SETUP_PYTHON, which duet will not run as an
   Install Python from https://www.python.org/downloads/macos/
   An explicit interpreter is an instruction, so duet does not look elsewhere when it is unusable.
   Nothing was installed and nothing was selected. Unset it or name another, then run:
-    npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
+    npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet
   npm runs no install script for a package it decides is already up to date, so that install can do nothing at all. While this package is installed, its own setup script always runs setup, for the release it carries:
     /bin/sh "$here/lib/setup.sh"
 OVERRIDE
@@ -109,8 +109,8 @@ if [ -z "$found" ]; then
 duet: no usable Python was found, and duet does not install one.
   duet needs CPython >=3.9 on macOS (arm64), able to create a virtual environment.
   Install Python from https://www.python.org/downloads/macos/
-  Then run:  npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
-  Or name one yourself:  DUET_SETUP_PYTHON=/path/to/python3 npm install --global @guidanti/duet@1.8.0 --allow-scripts=@guidanti/duet
+  Then run:  npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet
+  Or name one yourself:  DUET_SETUP_PYTHON=/path/to/python3 npm install --global @guidanti/duet@1.10.0 --allow-scripts=@guidanti/duet
   npm runs no install script for a package it decides is already up to date, so that install can do nothing at all. While this package is installed, its own setup script always runs setup, for the release it carries:
     /bin/sh "$(npm root -g)/@guidanti/duet/lib/setup.sh"
   Nothing was installed, nothing was selected, and no existing duet installation was changed.

package/package.json

@@ -23,5 +23,5 @@
   "scripts": {
     "postinstall": "/bin/sh lib/setup.sh"
   },
-  "version": "1.8.0"
+  "version": "1.10.0"
 }

package/artifact/duet-1.8.0.artifact.json

@@ -1,15 +0,0 @@
-{
-  "build_id": "646869928c864ea4",
-  "name": "duet",
-  "schema": 1,
-  "source": {
-    "clean": true,
-    "commit": "5d13ae499990e613e949e7501c13d3aad8808426"
-  },
-  "verification": {
-    "contract": 2
-  },
-  "version": "1.8.0",
-  "wheel": "duet-1.8.0-py3-none-any.whl",
-  "wheel_sha256": "41b3258715af0b49865c4b4151eac320019abf3dae66815e9626ab571c9bfe96"
-}