@mannyc1/ts-release 0.0.6 → 0.2.2

package/dist/resolve/authored.js

@@ -0,0 +1,55 @@
+// The shape a HUMAN writes. It is the canonical config with the facts a
+// repository already knows made optional, plus the two directives that say how
+// to fill them. Nothing here is inferred at plan time: resolution happens at
+// the application boundary and produces a canonical value before `plan` runs.
+//
+// The field lists are REUSED from the canonical classes, never restated — a
+// hand-mirrored schema is a drift machine.
+import * as Schema from "effect/Schema";
+import { NonEmptyName, Version } from "../model/primitives.js";
+import { CandidateConfig, CandidatePublish, CandidateProject, NpmAccess, NpmAuthentication, NpmProvenancePolicy, PyPiAuthentication, PyPiRepository } from "../recipes/config.js";
+const optional = Schema.optionalKey;
+export class AuthoredProject extends Schema.Class("AuthoredProject")({
+    ...CandidateProject.fields,
+    // Filled from the package manifest's name when omitted; still required if
+    // nothing observes one.
+    name: optional(NonEmptyName),
+    // Observed or derived when omitted: version from a manifest or the tag at
+    // HEAD, and tag from the template. Source commit is always observed; a
+    // human-authored commit expectation would only validate and then disappear.
+    version: optional(Version),
+    tag: optional(NonEmptyName),
+    // `{version}` is the only token, and it is the only one this repo will ever
+    // accept: a template grammar is the rejected direction.
+    tagTemplate: optional(Schema.NonEmptyString)
+}) {
+}
+/** Human-authored npm policy. Resolution fills only documented deterministic defaults. */
+export class AuthoredNpmPublish extends Schema.Class("AuthoredNpmPublish")({
+    registry: optional(Schema.NonEmptyString),
+    distTag: optional(Schema.NonEmptyString),
+    access: optional(NpmAccess),
+    authentication: NpmAuthentication,
+    provenance: optional(NpmProvenancePolicy)
+}) {
+}
+export class AuthoredPyPiPublish extends Schema.Class("AuthoredPyPiPublish")({
+    artifacts: Schema.NonEmptyArray(Schema.NonEmptyString),
+    repository: optional(PyPiRepository),
+    authentication: PyPiAuthentication
+}) {
+}
+export class AuthoredPublish extends Schema.Class("AuthoredPublish")({
+    ...CandidatePublish.fields,
+    npm: optional(AuthoredNpmPublish),
+    pypi: optional(AuthoredPyPiPublish)
+}) {
+}
+export class AuthoredConfig extends Schema.Class("AuthoredConfig")({
+    ...CandidateConfig.fields,
+    project: AuthoredProject,
+    publish: optional(AuthoredPublish),
+    versionFrom: optional(Schema.Literals(["manifest", "git-tag"]))
+}) {
+}
+//# sourceMappingURL=authored.js.map

package/dist/resolve/authored.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authored.js","sourceRoot":"","sources":["../../src/resolve/authored.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,2CAA2C;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAE7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAA;AAEnC,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,iBAAiB,CAAC,CAAC;IACpF,GAAG,gBAAgB,CAAC,MAAM;IAC1B,0EAA0E;IAC1E,wBAAwB;IACxB,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC;IAC5B,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;IAC1B,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC;IAC3B,4EAA4E;IAC5E,wDAAwD;IACxD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;CAC7C,CAAC;CAAG;AAEL,0FAA0F;AAC1F,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,KAAK,CAAqB,oBAAoB,CAAC,CAAC;IAC7F,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IACzC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC3B,cAAc,EAAE,iBAAiB;IACjC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC;CAC1C,CAAC;CAAG;AAEL,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,KAAK,CAAsB,qBAAqB,CAAC,CAAC;IAChG,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC;IACtD,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC;IACpC,cAAc,EAAE,kBAAkB;CACnC,CAAC;CAAG;AAEL,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,iBAAiB,CAAC,CAAC;IACpF,GAAG,gBAAgB,CAAC,MAAM;IAC1B,GAAG,EAAE,QAAQ,CAAC,kBAAkB,CAAC;IACjC,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC;CACpC,CAAC;CAAG;AAEL,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,KAAK,CAAiB,gBAAgB,CAAC,CAAC;IACjF,GAAG,eAAe,CAAC,MAAM;IACzB,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC;IAClC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;CAChE,CAAC;CAAG"}

package/dist/resolve/encode.d.ts

@@ -0,0 +1,3 @@
+export declare const toPlainJson: (value: unknown) => unknown;
+export declare const encodeResolvedConfig: (config: unknown) => string;
+//# sourceMappingURL=encode.d.ts.map

package/dist/resolve/encode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encode.d.ts","sourceRoot":"","sources":["../../src/resolve/encode.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,WAAW,GAAI,OAAO,OAAO,KAAG,OAS5C,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAI,QAAQ,OAAO,KAAG,MACF,CAAA"}

package/dist/resolve/encode.js

@@ -0,0 +1,21 @@
+// The reviewable IR's byte shape: readable JSON with sorted keys, so two
+// resolutions of the same inputs produce the same file and a diff shows only
+// what actually changed.
+//
+// This is deliberately NOT the plan-bytes canonical encoder. Canonical encoding
+// is a durable-document discipline that plan identity depends on; this is a
+// convenience artifact that nothing ever reads back.
+// Also the plain-JSON conversion the resolver needs: decoding produces Schema
+// class INSTANCES, and the canonical decoder refuses non-plain objects.
+export const toPlainJson = (value) => {
+    if (Array.isArray(value))
+        return value.map(toPlainJson);
+    if (typeof value !== "object" || value === null)
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+        .map(([key, entry]) => [key, toPlainJson(entry)]));
+};
+export const encodeResolvedConfig = (config) => `${JSON.stringify(toPlainJson(config), null, 2)}\n`;
+//# sourceMappingURL=encode.js.map

package/dist/resolve/encode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encode.js","sourceRoot":"","sources":["../../src/resolve/encode.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,qDAAqD;AACrD,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAW,EAAE;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CACpD,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAe,EAAU,EAAE,CAC9D,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA"}

package/dist/resolve/errors.d.ts

@@ -0,0 +1,7 @@
+export declare class ResolveError extends Error {
+    readonly field: string;
+    readonly reason: string;
+    readonly _tag = "ResolveError";
+    constructor(field: string, reason: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/resolve/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resolve/errors.ts"],"names":[],"mappings":"AAKA,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAHzB,QAAQ,CAAC,IAAI,kBAAiB;gBAEnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM;CAK1B"}

package/dist/resolve/errors.js

@@ -0,0 +1,17 @@
+// `resolveConfig` is a PUBLIC boundary function that apps call directly, so its
+// refusals follow the boundary rule SPEC §13 states: a stable plain error
+// carrying a reason, readable as-is when a CLI prints it. (The internal
+// ConfigValueError family is a decode-time vocabulary; its `message` is empty
+// by construction, which would reach a user as a blank line.)
+export class ResolveError extends Error {
+    field;
+    reason;
+    _tag = "ResolveError";
+    constructor(field, reason) {
+        super(reason);
+        this.field = field;
+        this.reason = reason;
+        this.name = "ResolveError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/resolve/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resolve/errors.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,0EAA0E;AAC1E,wEAAwE;AACxE,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG1B;IACA;IAHF,IAAI,GAAG,cAAc,CAAA;IAC9B,YACW,KAAa,EACb,MAAc;QAEvB,KAAK,CAAC,MAAM,CAAC,CAAA;QAHJ,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC5B,CAAC;CACF"}

package/dist/resolve/facts.d.ts

@@ -0,0 +1,12 @@
+import * as Schema from "effect/Schema";
+declare const ObservedFacts_base: Schema.Class<ObservedFacts, Schema.Struct<{
+    readonly commit: Schema.optionalKey<Schema.brand<Schema.NonEmptyString, "NonEmptyName">>;
+    readonly manifestName: Schema.optionalKey<Schema.NonEmptyString>;
+    readonly manifestVersion: Schema.optionalKey<Schema.brand<Schema.NonEmptyString, "Version">>;
+    readonly repository: Schema.optionalKey<Schema.NonEmptyString>;
+    readonly headTagVersion: Schema.optionalKey<Schema.brand<Schema.NonEmptyString, "Version">>;
+}>, {}>;
+export declare class ObservedFacts extends ObservedFacts_base {
+}
+export {};
+//# sourceMappingURL=facts.d.ts.map

package/dist/resolve/facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts.d.ts","sourceRoot":"","sources":["../../src/resolve/facts.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;;;;;;;;AAKvC,qBAAa,aAAc,SAAQ,kBASjC;CAAG"}

package/dist/resolve/facts.js

@@ -0,0 +1,18 @@
+// What the world can tell us about a release, observed by an app and passed in
+// as a value. The library never looks: no git, no filesystem, no environment —
+// observation is the imperative shell's job, resolution is pure.
+import * as Schema from "effect/Schema";
+import { NonEmptyName, Version } from "../model/primitives.js";
+const optional = Schema.optionalKey;
+export class ObservedFacts extends Schema.Class("ObservedFacts")({
+    commit: optional(NonEmptyName),
+    manifestName: optional(Schema.NonEmptyString),
+    manifestVersion: optional(Version),
+    repository: optional(Schema.NonEmptyString),
+    // The version carried by the single release-shaped tag at HEAD. Ambiguity is
+    // resolved by the observer: several candidate tags means NO fact, so the
+    // resolver refuses instead of picking one.
+    headTagVersion: optional(Version)
+}) {
+}
+//# sourceMappingURL=facts.js.map

package/dist/resolve/facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts.js","sourceRoot":"","sources":["../../src/resolve/facts.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,iEAAiE;AACjE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAE9D,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAA;AAEnC,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,eAAe,CAAC,CAAC;IAC9E,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;IAC9B,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IAC7C,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC;IAClC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IAC3C,6EAA6E;IAC7E,yEAAyE;IACzE,2CAA2C;IAC3C,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC;CAClC,CAAC;CAAG"}

package/dist/resolve/resolve.d.ts

@@ -0,0 +1,10 @@
+import { MISSING_COMMIT } from "../model/errors.js";
+import { CandidateConfig } from "../recipes/config.js";
+/**
+ * Resolve an authored configuration and observed facts into the canonical
+ * configuration. Pure and total: the same inputs always produce the same value,
+ * and every unfillable or contradicted field raises `ResolveError`.
+ */
+export { MISSING_COMMIT };
+export declare const resolveConfig: (authored: unknown, facts: unknown) => CandidateConfig;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnD,OAAO,EACL,eAAe,EAQhB,MAAM,sBAAsB,CAAA;AAuQ7B;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,CAAA;AAEzB,eAAO,MAAM,aAAa,GAAI,UAAU,OAAO,EAAE,OAAO,OAAO,KAAG,eAmCjE,CAAA"}

package/dist/resolve/resolve.js

@@ -0,0 +1,242 @@
+// Authored configuration plus observed facts → the canonical config, by total
+// rules and nothing else. This is the ONLY place authored-to-canonical
+// semantics may live: no recipe and no compiler may infer anything, because
+// plan bytes are a function of the canonical value alone.
+//
+// Every rule is one of three shapes: the authored value wins, a fact fills an
+// omission, or the two disagree and the resolver REFUSES naming both values and
+// where each came from. Silence is never an option — a release that guesses its
+// own identity is the defect this module exists to prevent.
+import * as Schema from "effect/Schema";
+import * as Semver from "semver";
+import { MISSING_COMMIT } from "../model/errors.js";
+import { NonEmptyName, OutputId } from "../model/primitives.js";
+import { CandidateConfig, CanonicalNpmRegistryEndpoint, NpmDistTag, PyPiProjectName, canonicalizeNpmRegistryEndpoint, normalizePyPiProjectName } from "../recipes/config.js";
+import { AuthoredConfig } from "./authored.js";
+import { toPlainJson } from "./encode.js";
+import { ResolveError } from "./errors.js";
+import { ObservedFacts } from "./facts.js";
+const refuse = (field, reason) => {
+    throw new ResolveError(field, reason);
+};
+const disagreement = (field, authored, observed, source) => refuse(`project.${field}`, `project.${field} is ${JSON.stringify(authored)} in the config but ${JSON.stringify(observed)} ${source}. Remove the authored value or correct the source; the resolver never picks.`);
+const decodeAuthored = Schema.decodeUnknownSync(AuthoredConfig, { onExcessProperty: "error" });
+const decodeFacts = Schema.decodeUnknownSync(ObservedFacts, { onExcessProperty: "error" });
+const decodeCandidate = Schema.decodeUnknownSync(CandidateConfig, { onExcessProperty: "error" });
+const version = (authored, facts) => {
+    const directive = authored.versionFrom;
+    const observed = directive === "manifest"
+        ? facts.manifestVersion
+        : directive === "git-tag"
+            ? facts.headTagVersion
+            : undefined;
+    const source = directive === "manifest" ? "in the package manifest" : "on the tag at HEAD";
+    if (authored.project.version !== undefined) {
+        if (observed !== undefined && observed !== authored.project.version) {
+            disagreement("version", authored.project.version, observed, source);
+        }
+        return authored.project.version;
+    }
+    if (directive === undefined) {
+        return refuse("project.version", "project.version is required. State it, or set versionFrom to \"manifest\" or \"git-tag\" so it can be observed.");
+    }
+    if (observed === undefined) {
+        return refuse("project.version", `versionFrom is ${JSON.stringify(directive)} but no version was observed ${source}.`);
+    }
+    return observed;
+};
+// `{version}` is the whole grammar. An unrecognized token is a refusal, exactly
+// as the checksum name filter treats one.
+const tag = (authored, resolved) => {
+    if (authored.project.tag !== undefined)
+        return authored.project.tag;
+    const template = authored.project.tagTemplate ?? "v{version}";
+    const rendered = template.replaceAll("{version}", resolved);
+    if (rendered.includes("{") || rendered.includes("}")) {
+        return refuse("project.tagTemplate", `project.tagTemplate supports only the {version} token, got ${JSON.stringify(template)}.`);
+    }
+    return NonEmptyName.make(rendered);
+};
+const requireObservedCommit = (facts) => {
+    if (facts.commit === undefined)
+        refuse("source.commit", MISSING_COMMIT);
+};
+const names = (authored, facts) => {
+    const manifest = facts.manifestName;
+    if (manifest !== undefined && authored.project.packageName !== undefined &&
+        manifest !== authored.project.packageName) {
+        disagreement("packageName", authored.project.packageName, manifest, "in the package manifest");
+    }
+    const name = authored.project.name ?? manifest;
+    if (name === undefined) {
+        return refuse("project.name", "project.name is required when no package manifest is observed.");
+    }
+    const packageName = authored.project.packageName ?? manifest;
+    return { name, ...(packageName === undefined ? {} : { packageName }) };
+};
+const repository = (authored, facts) => {
+    if (authored.project.repository !== undefined && facts.repository !== undefined && authored.project.repository !== facts.repository) {
+        disagreement("repository", authored.project.repository, facts.repository, "in the observed repository");
+    }
+    return authored.project.repository ?? facts.repository;
+};
+const canonicalRegistry = (value) => {
+    try {
+        return CanonicalNpmRegistryEndpoint.make(canonicalizeNpmRegistryEndpoint(value ?? "https://registry.npmjs.org"));
+    }
+    catch (cause) {
+        return refuse("publish.npm.registry", cause instanceof Error ? cause.message : String(cause));
+    }
+};
+const distTag = (versionValue, authored) => {
+    const normalized = Semver.valid(versionValue.toString());
+    if (normalized === null || normalized !== versionValue.toString()) {
+        return refuse("project.version", `npm publication requires a canonical semantic version, got ${JSON.stringify(versionValue)}.`);
+    }
+    const prerelease = Semver.prerelease(normalized) !== null;
+    if (authored === undefined) {
+        if (prerelease) {
+            return refuse("publish.npm.distTag", "Prerelease npm versions require an explicit non-latest distTag.");
+        }
+        return NpmDistTag.make("latest");
+    }
+    let tag;
+    try {
+        tag = NpmDistTag.make(authored);
+    }
+    catch (cause) {
+        return refuse("publish.npm.distTag", cause instanceof Error ? cause.message : String(cause));
+    }
+    if (prerelease && tag === "latest") {
+        return refuse("publish.npm.distTag", "Prerelease npm versions cannot publish under the latest dist-tag.");
+    }
+    return tag;
+};
+const npmPublish = (authored, project) => {
+    const npm = authored.publish?.npm;
+    if (npm === undefined)
+        return undefined;
+    if (authored.npmPackage === undefined) {
+        return refuse("npmPackage", "publish.npm requires npmPackage to declare the exact package artifact prepared by npm pack.");
+    }
+    const packageName = project.packageName ?? project.name;
+    if (npm.access === "restricted" && !packageName.startsWith("@")) {
+        return refuse("publish.npm.access", "npm restricted access is valid only for scoped package names.");
+    }
+    const registry = canonicalRegistry(npm.registry);
+    const authentication = npm.authentication;
+    if (authentication.strategy === "trusted-publishing") {
+        if (registry !== "https://registry.npmjs.org/") {
+            return refuse("publish.npm.authentication", "npm trusted publishing is certified only for https://registry.npmjs.org/.");
+        }
+        if (project.repository === undefined) {
+            return refuse("project.repository", "npm trusted publishing requires the exact GitHub owner/repository coordinate.");
+        }
+        if (authentication.attestation.repository !== project.repository) {
+            return refuse("publish.npm.authentication.attestation.repository", `The attested repository ${JSON.stringify(authentication.attestation.repository)} does not match ${JSON.stringify(project.repository)} resolved for the package.`);
+        }
+    }
+    const provenance = npm.provenance ??
+        (authentication.strategy === "trusted-publishing" ? "automatic" : "disabled");
+    if (authentication.strategy === "token" && provenance === "automatic") {
+        return refuse("publish.npm.provenance", "Automatic provenance is an npm trusted-publishing behavior; token mode must choose required or disabled.");
+    }
+    return {
+        packageArtifact: OutputId.make("npm-package"),
+        packageName: NonEmptyName.make(packageName),
+        registry,
+        distTag: distTag(project.version, npm.distTag),
+        access: npm.access ?? "public",
+        authentication,
+        provenance
+    };
+};
+const pypiPublish = (authored, project) => {
+    const pypi = authored.publish?.pypi;
+    if (pypi === undefined)
+        return undefined;
+    const artifacts = pypi.artifacts.map((id) => OutputId.make(id));
+    if (new Set(artifacts).size !== artifacts.length) {
+        return refuse("publish.pypi.artifacts", "PyPI publication cannot repeat one distribution artifact.");
+    }
+    if (pypi.authentication.strategy === "trusted-publishing") {
+        if (project.repository === undefined) {
+            return refuse("project.repository", "External PyPI trusted publishing requires the exact GitHub owner/repository coordinate.");
+        }
+        if (pypi.authentication.repository !== project.repository) {
+            return refuse("publish.pypi.authentication.repository", `The external PyPI publisher repository ${JSON.stringify(pypi.authentication.repository)} does not match ${JSON.stringify(project.repository)}.`);
+        }
+        let projectName;
+        let projects;
+        try {
+            projectName = normalizePyPiProjectName(project.name);
+            projects = pypi.authentication.projects.map(normalizePyPiProjectName);
+        }
+        catch (cause) {
+            return refuse("publish.pypi", cause instanceof Error ? cause.message : String(cause));
+        }
+        if (!projects.includes(projectName)) {
+            return refuse("publish.pypi.authentication.projects", `The external PyPI publisher authority set does not include ${JSON.stringify(projectName)}.`);
+        }
+        if (new Set(projects).size !== projects.length) {
+            return refuse("publish.pypi.authentication.projects", "External PyPI publisher project coordinates must be unique after normalization.");
+        }
+    }
+    let projectName;
+    try {
+        projectName = PyPiProjectName.make(normalizePyPiProjectName(project.name));
+    }
+    catch (cause) {
+        return refuse("publish.pypi", cause instanceof Error ? cause.message : String(cause));
+    }
+    return {
+        artifacts,
+        project: projectName,
+        version: project.version,
+        repository: pypi.repository ?? "pypi",
+        authentication: pypi.authentication
+    };
+};
+/**
+ * Resolve an authored configuration and observed facts into the canonical
+ * configuration. Pure and total: the same inputs always produce the same value,
+ * and every unfillable or contradicted field raises `ResolveError`.
+ */
+export { MISSING_COMMIT };
+export const resolveConfig = (authored, facts) => {
+    const config = decodeAuthored(authored);
+    const observed = decodeFacts(facts);
+    const resolvedVersion = version(config, observed);
+    // The directives are CONSUMED here: they describe how to resolve, and the
+    // canonical world has never heard of them.
+    const { project, versionFrom: _directive, $schema: _schema, ...rest } = config;
+    const { tagTemplate: _template, ...projectRest } = project;
+    const resolvedNames = names(config, observed);
+    const resolvedRepository = repository(config, observed);
+    // Verified source identity is observation-owned. It must exist, but is not a
+    // human-authored config field and is not copied into canonical release intent.
+    requireObservedCommit(observed);
+    const resolvedProject = {
+        ...projectRest,
+        ...resolvedNames,
+        ...(resolvedRepository === undefined ? {} : { repository: resolvedRepository }),
+        version: resolvedVersion,
+        tag: tag(config, resolvedVersion)
+    };
+    const npm = npmPublish(config, resolvedProject);
+    const pypi = pypiPublish(config, resolvedProject);
+    const publish = config.publish === undefined ? undefined : {
+        ...config.publish,
+        ...(config.publish.npm === undefined ? {} : { npm }),
+        ...(config.publish.pypi === undefined ? {} : { pypi })
+    };
+    // Plain JSON, not class instances: this value goes straight to `plan`, whose
+    // decoder refuses anything with a prototype.
+    const plain = toPlainJson({
+        ...rest,
+        project: resolvedProject,
+        ...(publish === undefined ? {} : { publish })
+    });
+    return toPlainJson(decodeCandidate(plain));
+};
+//# sourceMappingURL=resolve.js.map

package/dist/resolve/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,4DAA4D;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAW,MAAM,wBAAwB,CAAA;AACxE,OAAO,EACL,eAAe,EAGf,4BAA4B,EAC5B,UAAU,EACV,eAAe,EACf,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE1C,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAc,EAAS,EAAE;IACtD,MAAM,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AACvC,CAAC,CAAA;AACD,MAAM,YAAY,GAAG,CACnB,KAAa,EAAE,QAAgB,EAAE,QAAgB,EAAE,MAAc,EAC1D,EAAE,CACT,MAAM,CACJ,WAAW,KAAK,EAAE,EAClB,WAAW,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,sBAC7C,IAAI,CAAC,SAAS,CAAC,QAAQ,CACzB,IAAI,MAAM,8EAA8E,CACzF,CAAA;AAEH,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;AAC9F,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;AAC1F,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;AAEhG,MAAM,OAAO,GAAG,CACd,QAAwB,EAAE,KAAoB,EACrC,EAAE;IACX,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAA;IACtC,MAAM,QAAQ,GAAG,SAAS,KAAK,UAAU;QACvC,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC,KAAK,CAAC,cAAc;YACtB,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,oBAAoB,CAAA;IAC1F,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACpE,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAA;IACjC,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CACX,iBAAiB,EACjB,iHAAiH,CAClH,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CACX,iBAAiB,EACjB,kBAAkB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gCAAgC,MAAM,GAAG,CACrF,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,gFAAgF;AAChF,0CAA0C;AAC1C,MAAM,GAAG,GAAG,CAAC,QAAwB,EAAE,QAAiB,EAAgB,EAAE;IACxE,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAA;IACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,YAAY,CAAA;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3D,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CACX,qBAAqB,EACrB,8DAA8D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAC1F,CAAA;IACH,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACpC,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,KAAoB,EAAQ,EAAE;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;AACzE,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CACZ,QAAwB,EAAE,KAAoB,EACY,EAAE;IAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAA;IACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;QACtE,QAAQ,KAAK,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5C,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,cAAc,EAAE,gEAAgE,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAA;AACxE,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,QAAwB,EAAE,KAAoB,EAAsB,EAAE;IACxF,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACpI,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;IACzG,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAA;AACxD,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,KAAyB,EAAgC,EAAE;IACpF,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,IAAI,CACtC,+BAA+B,CAAC,KAAK,IAAI,4BAA4B,CAAC,CACvE,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CACX,sBAAsB,EACtB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,YAAqB,EAAE,QAA4B,EAAc,EAAE;IAClF,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;IACxD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,OAAO,MAAM,CACX,iBAAiB,EACjB,8DAA8D,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAC9F,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAA;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,MAAM,CACX,qBAAqB,EACrB,iEAAiE,CAClE,CAAA;QACH,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IACD,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QAAC,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACrD,OAAO,MAAM,CACX,qBAAqB,EACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAA;IACH,CAAC;IACD,IAAI,UAAU,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,qBAAqB,EACrB,mEAAmE,CACpE,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AASD,MAAM,UAAU,GAAG,CACjB,QAAwB,EACxB,OAAwB,EACS,EAAE;IACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAA;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CACX,YAAY,EACZ,6FAA6F,CAC9F,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAA;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,MAAM,CACX,oBAAoB,EACpB,+DAA+D,CAChE,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAA;IACzC,IAAI,cAAc,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;QACrD,IAAI,QAAQ,KAAK,6BAA6B,EAAE,CAAC;YAC/C,OAAO,MAAM,CACX,4BAA4B,EAC5B,2EAA2E,CAC5E,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,CACX,oBAAoB,EACpB,+EAA+E,CAChF,CAAA;QACH,CAAC;QACD,IAAI,cAAc,CAAC,WAAW,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACjE,OAAO,MAAM,CACX,mDAAmD,EACnD,2BAA2B,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,mBAC9E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CACnC,4BAA4B,CAC7B,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU;QAC/B,CAAC,cAAc,CAAC,QAAQ,KAAK,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,cAAc,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QACtE,OAAO,MAAM,CACX,wBAAwB,EACxB,0GAA0G,CAC3G,CAAA;IACH,CAAC;IACD,OAAO;QACL,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;QAC7C,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;QAC3C,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,QAAQ;QAC9B,cAAc;QACd,UAAU;KACX,CAAA;AACH,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAClB,QAAwB,EACxB,OAAwB,EACU,EAAE;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAmC,CAAA;IACjG,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,wBAAwB,EAAE,2DAA2D,CAAC,CAAA;IACtG,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,oBAAoB,EAAE,yFAAyF,CAAC,CAAA;QAChI,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1D,OAAO,MAAM,CACX,wCAAwC,EACxC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CACjJ,CAAA;QACH,CAAC;QACD,IAAI,WAAmB,CAAA;QACvB,IAAI,QAA+B,CAAA;QACnC,IAAI,CAAC;YACH,WAAW,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACpD,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,cAAc,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM,CACX,sCAAsC,EACtC,8DAA8D,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAC7F,CAAA;QACH,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,MAAM,CAAC,sCAAsC,EAAE,iFAAiF,CAAC,CAAA;QAC1I,CAAC;IACH,CAAC;IACD,IAAI,WAA4B,CAAA;IAChC,IAAI,CAAC;QAAC,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChG,OAAO,MAAM,CAAC,cAAc,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACvF,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM;QACrC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,CAAA;AAEzB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAiB,EAAE,KAAc,EAAmB,EAAE;IAClF,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjD,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAC9E,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAA;IAC1D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC7C,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,6EAA6E;IAC7E,+EAA+E;IAC/E,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,eAAe,GAAG;QACtB,GAAG,WAAW;QACd,GAAG,aAAa;QAChB,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;QAC/E,OAAO,EAAE,eAAe;QACxB,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;KAClC,CAAA;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,GAAG,MAAM,CAAC,OAAO;QACjB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACvD,CAAA;IACD,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,GAAG,IAAI;QACP,OAAO,EAAE,eAAe;QACxB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,CAAoB,CAAA;AAC/D,CAAC,CAAA"}

package/dist/store.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Supported durable-store library boundary.
+ *
+ * The store service tag remains private. Hosts pass this structural value to
+ * one of the public layer constructors instead of assembling Effect contexts.
+ */
+export { GitHubActionsPreparedStoreProvenance, LocalPreparedStoreProvenance, PreparedCommitHandoffError, PreparedStoreError, PreparedStoreProvenanceError, verifyPreparedStoreProvenance, makeLocalPreparedReleaseStore } from "./release/prepared-store.js";
+export type { CommittedPreparedRelease, PreparedBundle, PreparedStoreProvenance, PreparedReleaseStoreShape } from "./release/prepared-store.js";
+export { PreparedManifestError, PreparedReleaseV2, decodePreparedRelease, encodePreparedRelease } from "./release/prepared.js";
+export type { CompletePreparedReleaseRef } from "./release/prepared-ref.js";
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,oCAAoC,EACpC,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,wBAAwB,EACxB,cAAc,EACd,uBAAuB,EACvB,yBAAyB,EAC1B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA"}

package/dist/store.js

@@ -0,0 +1,9 @@
+/**
+ * Supported durable-store library boundary.
+ *
+ * The store service tag remains private. Hosts pass this structural value to
+ * one of the public layer constructors instead of assembling Effect contexts.
+ */
+export { GitHubActionsPreparedStoreProvenance, LocalPreparedStoreProvenance, PreparedCommitHandoffError, PreparedStoreError, PreparedStoreProvenanceError, verifyPreparedStoreProvenance, makeLocalPreparedReleaseStore } from "./release/prepared-store.js";
+export { PreparedManifestError, PreparedReleaseV2, decodePreparedRelease, encodePreparedRelease } from "./release/prepared.js";
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,oCAAoC,EACpC,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,6BAA6B,CAAA;AAOpC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,uBAAuB,CAAA"}

package/examples/README.md

@@ -1,36 +1,26 @@
-# release examples
+# Release examples
 
-Start with the coordinated release example:
+Examples are schema-checked authored configurations. They show jobs that map
+to native ts-release primitives; they do not publish during repository checks.
+
+Start with the automatic path:
 
 ```sh
-cd examples/multi-target
-bun ../../apps/release-ts/src/cli/main.ts plan --config release.config.json --format text
+ts-release init
+ts-release release --config release.config.json
 ```
 
-That plan shows one release split across GitHub Releases, npm, and a Homebrew
-tap. Inspect the artifact inventory, target capabilities, `argv` lines,
-approval gates, and generated catalog-file operations. `plan` is safe: publish
-operations stay data until a caller passes explicit execution approval.
-
-Templates live in `../templates/` and are copyable starting points for new
-repositories. These examples are runnable fixtures for this repository's
-checks.
-
-Focused examples:
-
-- `multi-target`: one release coordinated across GitHub Releases, npm, and Homebrew.
-- `npm-only`: npm package directory with native npm dry-run validation.
-- `npm-first-publish`: token-based npm bootstrap config for the first version before switching to trusted publishing.
-- `github-release`: GitHub release asset with simulated GitHub dry-run validation.
-- `homebrew-tap`: Homebrew tap formula rendering with simulated formula validation.
-- `pypi-registry`: prebuilt Python distribution planned for TestPyPI with Twine.
-- `scoop-bucket`: Scoop bucket manifest rendering with simulated validation.
-- `non-strict-skips`: non-strict config that records skipped dry-run evidence.
+Runnable fixtures cover npm, GitHub Releases, portable binaries,
+archive/checksum preparation, and typed Homebrew/Scoop catalog Git delivery.
+Catalog fixtures prepare locally during checks and never mutate a provider.
+The PyPI directory remains a migration note until it carries an independently
+runnable prebuilt-distribution fixture.
+An example passing strict decode is necessary but not sufficient support
+evidence; the same capability must execute through the root API and default
+runtime in release-candidate certification.
 
-Trusted-publishing npm examples use `provenance` and
-`verifyPackageExists`. `npm-first-publish` demonstrates only the bootstrap shape
-for a package that does not exist on npm yet, so it stays token-based and omits
-`trustedPublishing`. Replace it with trusted publishing after the first version
-exists. TestPyPI is still a real registry publish target, not a dry-run. The
-examples only render plans; do not run publish operations without intentional
-credentials and approval flags.
+Trusted npm examples bind local host admission to the exact repository,
+workflow filename, and `workflowRef` they author. For the reviewed two-job
+workflow, start from the paired
+`templates/npm-github/reviewed-release.config.json`; the host refuses a foreign
+workflow/ref before reading OIDC request material.

package/examples/github-release/release.config.json

@@ -1,33 +1,26 @@
 {
-  "$schema": "https://mannyc2.github.io/ts-release/schema/release-config.schema.json",
-  "identity": {
+  "$schema": "https://raw.githubusercontent.com/mannyc2/ts-release/main/schema/release-config.schema.json",
+  "project": {
     "name": "release-example-github",
+    "packageName": "release-example-github",
     "version": "0.1.0",
-    "commit": "example",
-    "tag": "v0.1.0",
-    "notes": "Example GitHub release"
+    "tag": "v0.1.0"
   },
   "artifacts": [
     {
       "id": "archive",
       "path": "artifacts/release-example-github-0.1.0.tgz",
-      "format": "tarball",
-      "consumers": ["github"]
+      "format": "tarball"
     }
   ],
-  "targets": [
-    {
-      "_tag": "GitHubReleaseTarget",
-      "id": "github",
+  "publish": {
+    "github": {
       "repository": "owner/repo",
-      "tokenEnv": "GH_TOKEN",
+      "tokenEnv": "GITHUB_TOKEN",
       "draft": true,
       "prerelease": false,
-      "dryRunSupport": "simulated",
-      "mutability": "mutable-release",
-      "recovery": "delete-and-recreate"
+      "body": "Example GitHub release",
+      "ids": ["archive"]
     }
-  ],
-  "strict": true,
-  "evidenceDirectory": ".release/evidence"
+  }
 }

package/examples/homebrew-tap/README.md

@@ -0,0 +1,11 @@
+# Homebrew tap delivery
+
+This runnable example prepares a typed Homebrew formula from the exact digest
+of a GitHub release archive, then models delivery of the formula and its
+canonical managed-state record to `owner/homebrew-tap`.
+
+Catalog delivery runs only after the GitHub release subjects converge. The Git
+Data adapter preserves unrelated repository objects, creates a commit with the
+observed branch commit as its sole parent, and updates the branch without
+force. Replace every `owner/*` coordinate and the credential reference before
+using the example.