putitoutthere 0.0.1

package/README.md

@@ -0,0 +1,10 @@
+# Put It Out There
+
+Polyglot release orchestrator for single-maintainer, LLM-authored projects
+that publish to crates.io, PyPI, and npm from one monorepo.
+
+> **Status.** v0 implementation in progress. See the [v0 epic](https://github.com/thekevinscott/put-it-out-there/issues/2) for the full work breakdown.
+
+User-facing README (installation, quickstart, worked example) lands in
+[#32](https://github.com/thekevinscott/put-it-out-there/issues/32) once
+the CLI is functional.

package/action.yml

@@ -0,0 +1,24 @@
+name: 'Put It Out There'
+description: 'Polyglot release orchestrator for crates.io, PyPI, and npm.'
+author: 'Kevin Scott'
+
+inputs:
+  command:
+    description: 'Which putitoutthere command to run: plan | publish'
+    required: true
+  dry_run:
+    description: 'If true, resolve the plan but skip all destructive operations.'
+    required: false
+    default: 'false'
+  fail_on_error:
+    description: 'If true, non-zero putitoutthere exit codes fail the step.'
+    required: false
+    default: 'true'
+
+outputs:
+  matrix:
+    description: 'JSON matrix emitted by `putitoutthere plan`. Empty string for other commands.'
+
+runs:
+  using: 'node20'
+  main: 'dist-action/index.js'

package/dist/action.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GitHub Actions wrapper. Bundled to `dist-action/index.js` via ncc.
+ *
+ * Implementation lands in #24. Scaffold here exits cleanly with a
+ * not-yet-implemented marker so `action.yml` resolves during early
+ * integration work.
+ */
+export declare function main(): void;
+//# sourceMappingURL=action.d.ts.map

package/dist/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wBAAgB,IAAI,IAAI,IAAI,CAQ3B"}

package/dist/action.js

@@ -0,0 +1,19 @@
+/**
+ * GitHub Actions wrapper. Bundled to `dist-action/index.js` via ncc.
+ *
+ * Implementation lands in #24. Scaffold here exits cleanly with a
+ * not-yet-implemented marker so `action.yml` resolves during early
+ * integration work.
+ */
+export function main() {
+    const command = process.env.INPUT_COMMAND ?? '';
+    process.stderr.write(`put-it-out-there@v0 action: command='${command}' — scaffold only; see #24 for the real wrapper.\n`);
+    // GHA outputs are appended to $GITHUB_OUTPUT when the CLI supports it;
+    // scaffold emits nothing. The action is inert until #24 lands.
+    process.exit(0);
+}
+/* v8 ignore next 3 -- entry-point guard; only reachable when invoked as a binary */
+if (import.meta.url === `file://${process.argv[1]}`) {
+    main();
+}
+//# sourceMappingURL=action.js.map

package/dist/action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,IAAI;IAClB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,OAAO,oDAAoD,CACpG,CAAC;IACF,uEAAuE;IACvE,+DAA+D;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/cascade.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Cascade algorithm. Given a package list and the files changed since
+ * the last release, returns the packages that will release.
+ *
+ * Two passes (plan.md §11.1):
+ *   1. Direct match: every package whose `paths` globs intersect
+ *      changedFiles is cascaded.
+ *   2. Transitive match: repeat until stable — any package whose
+ *      `depends_on` list contains an already-cascaded package gets
+ *      added.
+ *
+ * Cycle detection per §11.3: cycles in depends_on are a config error
+ * and throw loudly before cascade runs. Dangling depends_on names also
+ * throw.
+ *
+ * Output preserves the input order so downstream matrix emission is
+ * deterministic.
+ *
+ * Issue #7.
+ */
+import type { Package } from './config.js';
+export declare function computeCascade(packages: readonly Package[], changedFiles: readonly string[]): Package[];
+/**
+ * Reject cycles and dangling depends_on refs. Runs a DFS from each
+ * node with a recursion-stack (gray) set to flag back-edges. Dangling
+ * refs are caught during traversal when the target is missing from
+ * the name map.
+ */
+export declare function assertNoCycles(packages: readonly Package[]): void;
+//# sourceMappingURL=cascade.d.ts.map

package/dist/cascade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade.d.ts","sourceRoot":"","sources":["../src/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,EAAE,CA8BX;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAoCjE"}

package/dist/cascade.js

@@ -0,0 +1,92 @@
+/**
+ * Cascade algorithm. Given a package list and the files changed since
+ * the last release, returns the packages that will release.
+ *
+ * Two passes (plan.md §11.1):
+ *   1. Direct match: every package whose `paths` globs intersect
+ *      changedFiles is cascaded.
+ *   2. Transitive match: repeat until stable — any package whose
+ *      `depends_on` list contains an already-cascaded package gets
+ *      added.
+ *
+ * Cycle detection per §11.3: cycles in depends_on are a config error
+ * and throw loudly before cascade runs. Dangling depends_on names also
+ * throw.
+ *
+ * Output preserves the input order so downstream matrix emission is
+ * deterministic.
+ *
+ * Issue #7.
+ */
+import { matchesAny } from './glob.js';
+export function computeCascade(packages, changedFiles) {
+    assertNoCycles(packages);
+    const byName = new Map();
+    for (const p of packages)
+        byName.set(p.name, p);
+    // Pass 1: direct glob matches.
+    const cascaded = new Set();
+    for (const p of packages) {
+        if (changedFiles.some((f) => matchesAny(p.paths, f))) {
+            cascaded.add(p.name);
+        }
+    }
+    // Pass 2: transitive via depends_on, iterate to stability.
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const p of packages) {
+            if (cascaded.has(p.name))
+                continue;
+            const deps = p.depends_on ?? [];
+            if (deps.some((d) => cascaded.has(d))) {
+                cascaded.add(p.name);
+                changed = true;
+            }
+        }
+    }
+    // Preserve input order.
+    return packages.filter((p) => cascaded.has(p.name));
+}
+/**
+ * Reject cycles and dangling depends_on refs. Runs a DFS from each
+ * node with a recursion-stack (gray) set to flag back-edges. Dangling
+ * refs are caught during traversal when the target is missing from
+ * the name map.
+ */
+export function assertNoCycles(packages) {
+    const byName = new Map();
+    for (const p of packages)
+        byName.set(p.name, p);
+    const color = new Map();
+    for (const p of packages)
+        color.set(p.name, 'white');
+    const visit = (name, path) => {
+        const c = color.get(name);
+        if (c === 'black')
+            return;
+        if (c === 'gray') {
+            const cycle = [...path.slice(path.indexOf(name)), name].join(' → ');
+            throw new Error(`putitoutthere.toml: depends_on cycle: ${cycle}`);
+        }
+        color.set(name, 'gray');
+        const node = byName.get(name);
+        // `byName.get` is only undefined here when `visit` was entered with
+        // a name we iterated over packages for — that list IS the keys of
+        // byName, so this branch is unreachable under normal use. Defensive.
+        /* v8 ignore next */
+        if (!node)
+            return;
+        for (const dep of node.depends_on ?? []) {
+            if (!byName.has(dep)) {
+                throw new Error(`putitoutthere.toml: package "${name}" has unknown depends_on: "${dep}"`);
+            }
+            visit(dep, [...path, name]);
+        }
+        color.set(name, 'black');
+    };
+    for (const p of packages) {
+        visit(p.name, []);
+    }
+}
+//# sourceMappingURL=cascade.js.map

package/dist/cascade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade.js","sourceRoot":"","sources":["../src/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,UAAU,cAAc,CAC5B,QAA4B,EAC5B,YAA+B;IAE/B,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhD,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAA4B;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAGhD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAc,EAAQ,EAAE;QACnD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,oBAAoB;QACpB,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,8BAA8B,GAAG,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+/**
+ * `putitoutthere` CLI entry. Thin wrapper around the SDK.
+ *
+ * Command implementations land in #20 (init), #21 (plan), #22 (publish),
+ * #23 (doctor). This scaffold just parses the command name and prints a
+ * not-yet-implemented message, so the binary is installable today.
+ */
+export declare function run(argv: readonly string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AA2BH,wBAAgB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB5D"}

package/dist/cli.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+/**
+ * `putitoutthere` CLI entry. Thin wrapper around the SDK.
+ *
+ * Command implementations land in #20 (init), #21 (plan), #22 (publish),
+ * #23 (doctor). This scaffold just parses the command name and prints a
+ * not-yet-implemented message, so the binary is installable today.
+ */
+const COMMANDS = ['init', 'plan', 'publish', 'doctor', 'version'];
+function isCommand(value) {
+    return COMMANDS.includes(value);
+}
+function printUsage() {
+    process.stderr.write([
+        'Usage: putitoutthere <command> [options]',
+        '',
+        'Commands:',
+        '  init       Scaffold putitoutthere.toml + workflows + AGENTS.md (#20)',
+        '  plan       Compute and emit the release plan (#21)',
+        '  publish    Execute the plan (#22)',
+        '  doctor     Validate config + handlers + auth (#23)',
+        '  version    Print CLI version',
+        '',
+        'See https://github.com/thekevinscott/put-it-out-there for docs.',
+        '',
+    ].join('\n'));
+}
+export function run(argv) {
+    const [, , cmd, ..._rest] = argv;
+    if (cmd === undefined || cmd === '-h' || cmd === '--help') {
+        printUsage();
+        return Promise.resolve(cmd === undefined ? 1 : 0);
+    }
+    if (cmd === 'version' || cmd === '--version' || cmd === '-v') {
+        process.stdout.write('putitoutthere 0.0.0 (pre-release scaffold)\n');
+        return Promise.resolve(0);
+    }
+    if (!isCommand(cmd)) {
+        process.stderr.write(`putitoutthere: unknown command: ${cmd}\n`);
+        printUsage();
+        return Promise.resolve(1);
+    }
+    process.stderr.write(`putitoutthere: '${cmd}' is not implemented yet in this scaffold. See the v0 epic: https://github.com/thekevinscott/put-it-out-there/issues/2\n`);
+    return Promise.resolve(2);
+}
+// Entry point when invoked as `putitoutthere` or `node dist/cli.js`.
+/* v8 ignore start -- entry-point guard; only reachable when invoked as a binary */
+if (import.meta.url === `file://${process.argv[1]}`) {
+    run(process.argv).then((code) => {
+        process.exit(code);
+    }, (err) => {
+        process.stderr.write(`putitoutthere: fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(4);
+    });
+}
+/* v8 ignore stop */
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAG3E,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAQ,QAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,0CAA0C;QAC1C,EAAE;QACF,WAAW;QACX,wEAAwE;QACxE,sDAAsD;QACtD,qCAAqC;QACrC,sDAAsD;QACtD,gCAAgC;QAChC,EAAE;QACF,iEAAiE;QACjE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB;IACzC,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1D,UAAU,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,GAAG,0HAA0H,CACjJ,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,qEAAqE;AACrE,mFAAmF;AACnF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC;AACD,oBAAoB"}

package/dist/completeness.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Artifact completeness check.
+ *
+ * Before any publish side effect, verify every matrix row's artifact
+ * is present and has the expected shape. A missing artifact aborts
+ * that package's release (per plan.md §13.2); other packages
+ * continue. No --allow-incomplete flag in v0: silent partial ships
+ * are exactly the class of bug this exists to prevent.
+ *
+ * This is putitoutthere's own guardrail -- it runs regardless of what
+ * the user's workflow YAML did with `needs:` chains or
+ * `fail-fast: false`.
+ *
+ * Issue #13. Plan: §13.2.
+ */
+import type { Kind } from './types.js';
+export interface MatrixRow {
+    name: string;
+    kind: Kind;
+    version: string;
+    target: string;
+    artifact_name: string;
+}
+export interface MissingArtifact {
+    row: MatrixRow;
+    reason: string;
+}
+export interface PackageCompleteness {
+    ok: boolean;
+    missing: MissingArtifact[];
+}
+export declare function checkCompleteness(matrix: readonly MatrixRow[], artifactsRoot: string): Map<string, PackageCompleteness>;
+export declare function requireCompleteness(matrix: readonly MatrixRow[], artifactsRoot: string): void;
+//# sourceMappingURL=completeness.d.ts.map

package/dist/completeness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completeness.d.ts","sourceRoot":"","sources":["../src/completeness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,aAAa,EAAE,MAAM,GACpB,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAclC;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,aAAa,EAAE,MAAM,GACpB,IAAI,CAeN"}

package/dist/completeness.js

@@ -0,0 +1,121 @@
+/**
+ * Artifact completeness check.
+ *
+ * Before any publish side effect, verify every matrix row's artifact
+ * is present and has the expected shape. A missing artifact aborts
+ * that package's release (per plan.md §13.2); other packages
+ * continue. No --allow-incomplete flag in v0: silent partial ships
+ * are exactly the class of bug this exists to prevent.
+ *
+ * This is putitoutthere's own guardrail -- it runs regardless of what
+ * the user's workflow YAML did with `needs:` chains or
+ * `fail-fast: false`.
+ *
+ * Issue #13. Plan: §13.2.
+ */
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+export function checkCompleteness(matrix, artifactsRoot) {
+    const byPackage = new Map();
+    for (const row of matrix) {
+        const entry = byPackage.get(row.name) ?? { ok: true, missing: [] };
+        const reason = verifyRow(row, artifactsRoot);
+        if (reason !== null) {
+            entry.ok = false;
+            entry.missing.push({ row, reason });
+        }
+        byPackage.set(row.name, entry);
+    }
+    return byPackage;
+}
+export function requireCompleteness(matrix, artifactsRoot) {
+    const results = checkCompleteness(matrix, artifactsRoot);
+    const failed = [...results.entries()].filter(([, r]) => !r.ok);
+    if (failed.length === 0)
+        return;
+    const lines = ['Artifact completeness check failed:'];
+    for (const [pkg, result] of failed) {
+        lines.push(`  ${pkg}:`);
+        for (const m of result.missing) {
+            lines.push(`    - target=${m.row.target} artifact=${m.row.artifact_name}: ${m.reason}`);
+        }
+    }
+    lines.push('');
+    lines.push('No side effects performed. Fix the build and re-run.');
+    throw new Error(lines.join('\n'));
+}
+/* ----------------------------- internals ----------------------------- */
+/**
+ * Returns null when the row's artifact is present and shaped correctly;
+ * otherwise a human-readable reason.
+ */
+function verifyRow(row, artifactsRoot) {
+    const dir = join(artifactsRoot, row.artifact_name);
+    if (!existsSync(dir)) {
+        return `missing artifact directory ${row.artifact_name}/`;
+    }
+    let files;
+    try {
+        files = listFiles(dir);
+    }
+    catch (err) {
+        return `cannot read ${row.artifact_name}/: ${err instanceof Error ? err.message : String(err)}`;
+    }
+    if (files.length === 0) {
+        return `empty artifact directory ${row.artifact_name}/`;
+    }
+    return verifyShape(row, files);
+}
+/**
+ * Recursive file listing. Wheels and sdists may sit one level deep in
+ * a `dist/` subdir depending on how the user's build writes them.
+ */
+function listFiles(dir) {
+    const out = [];
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        const st = statSync(full);
+        if (st.isDirectory()) {
+            out.push(...listFiles(full));
+        }
+        else if (st.isFile() && st.size > 0) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+function verifyShape(row, files) {
+    switch (row.kind) {
+        case 'crates':
+            return hasSuffix(files, '.crate')
+                ? null
+                : `no .crate file in ${row.artifact_name}/`;
+        case 'pypi':
+            if (row.target === 'sdist') {
+                return hasSuffix(files, '.tar.gz')
+                    ? null
+                    : `no .tar.gz (sdist) in ${row.artifact_name}/`;
+            }
+            return hasSuffix(files, '.whl')
+                ? null
+                : `no .whl file in ${row.artifact_name}/`;
+        case 'npm':
+            // vanilla (noarch) and `main` must have package.json. Per-platform
+            // rows need any binary/bundle artifact to be meaningful; since
+            // napi + bundled-cli layouts vary, a non-empty directory is
+            // enough.
+            if (row.target === 'main' || row.target === 'noarch') {
+                return hasFile(files, 'package.json')
+                    ? null
+                    : `no package.json in ${row.artifact_name}/`;
+            }
+            return null; // any non-empty file is acceptable for a platform package
+    }
+}
+function hasSuffix(files, suffix) {
+    return files.some((f) => f.endsWith(suffix));
+}
+function hasFile(files, name) {
+    return files.some((f) => f.endsWith(`/${name}`) || f.endsWith(`\\${name}`));
+}
+//# sourceMappingURL=completeness.js.map

package/dist/completeness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completeness.js","sourceRoot":"","sources":["../src/completeness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAqBjC,MAAM,UAAU,iBAAiB,CAC/B,MAA4B,EAC5B,aAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEzD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC;YACjB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAA4B,EAC5B,aAAqB;IAErB,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhC,MAAM,KAAK,GAAa,CAAC,qCAAqC,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,2EAA2E;AAE3E;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAc,EAAE,aAAqB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,8BAA8B,GAAG,CAAC,aAAa,GAAG,CAAC;IAC5D,CAAC;IACD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,GAAG,CAAC,aAAa,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,4BAA4B,GAAG,CAAC,aAAa,GAAG,CAAC;IAC1D,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAc,EAAE,KAAe;IAClD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAC/B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,qBAAqB,GAAG,CAAC,aAAa,GAAG,CAAC;QAChD,KAAK,MAAM;YACT,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC3B,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;oBAChC,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,yBAAyB,GAAG,CAAC,aAAa,GAAG,CAAC;YACpD,CAAC;YACD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC7B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,mBAAmB,GAAG,CAAC,aAAa,GAAG,CAAC;QAC9C,KAAK,KAAK;YACR,mEAAmE;YACnE,+DAA+D;YAC/D,4DAA4D;YAC5D,UAAU;YACV,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;oBACnC,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,sBAAsB,GAAG,CAAC,aAAa,GAAG,CAAC;YACjD,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,0DAA0D;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAwB,EAAE,MAAc;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB,EAAE,IAAY;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,132 @@
+/**
+ * `putitoutthere.toml` loader and validator.
+ *
+ * Shape per plan.md §6. Handler-specific fields per §6.4. `targets`
+ * cross-validation per §12.2: only meaningful for `maturin` / `napi` /
+ * `bundled-cli` builds.
+ *
+ * Two entry points:
+ *  - `parseConfig(toml)`  pure function over a TOML string; used in tests.
+ *  - `loadConfig(path)`   reads the file and calls parseConfig.
+ *
+ * Unknown fields are a hard error (no silent drops). Zod's `.strict()`
+ * enforces this at every level.
+ */
+import { z } from 'zod';
+declare const PILOT: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    cadence: z.ZodOptional<z.ZodEnum<{
+        immediate: "immediate";
+        scheduled: "scheduled";
+    }>>;
+    agents_path: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const CRATES_PKG: z.ZodObject<{
+    kind: z.ZodLiteral<"crates">;
+    crate: z.ZodOptional<z.ZodString>;
+    features: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    target: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    name: z.ZodString;
+    path: z.ZodString;
+    paths: z.ZodArray<z.ZodString>;
+    depends_on: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    first_version: z.ZodDefault<z.ZodString>;
+    smoke: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const PYPI_PKG: z.ZodObject<{
+    kind: z.ZodLiteral<"pypi">;
+    pypi: z.ZodOptional<z.ZodString>;
+    build: z.ZodOptional<z.ZodEnum<{
+        maturin: "maturin";
+        setuptools: "setuptools";
+        hatch: "hatch";
+    }>>;
+    wheels_artifact: z.ZodOptional<z.ZodString>;
+    targets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    name: z.ZodString;
+    path: z.ZodString;
+    paths: z.ZodArray<z.ZodString>;
+    depends_on: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    first_version: z.ZodDefault<z.ZodString>;
+    smoke: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const NPM_PKG: z.ZodObject<{
+    kind: z.ZodLiteral<"npm">;
+    npm: z.ZodOptional<z.ZodString>;
+    access: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        restricted: "restricted";
+    }>>;
+    tag: z.ZodOptional<z.ZodString>;
+    build: z.ZodOptional<z.ZodEnum<{
+        napi: "napi";
+        "bundled-cli": "bundled-cli";
+    }>>;
+    targets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    name: z.ZodString;
+    path: z.ZodString;
+    paths: z.ZodArray<z.ZodString>;
+    depends_on: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    first_version: z.ZodDefault<z.ZodString>;
+    smoke: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const PACKAGE: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"crates">;
+    crate: z.ZodOptional<z.ZodString>;
+    features: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    target: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    name: z.ZodString;
+    path: z.ZodString;
+    paths: z.ZodArray<z.ZodString>;
+    depends_on: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    first_version: z.ZodDefault<z.ZodString>;
+    smoke: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"pypi">;
+    pypi: z.ZodOptional<z.ZodString>;
+    build: z.ZodOptional<z.ZodEnum<{
+        maturin: "maturin";
+        setuptools: "setuptools";
+        hatch: "hatch";
+    }>>;
+    wheels_artifact: z.ZodOptional<z.ZodString>;
+    targets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    name: z.ZodString;
+    path: z.ZodString;
+    paths: z.ZodArray<z.ZodString>;
+    depends_on: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    first_version: z.ZodDefault<z.ZodString>;
+    smoke: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"npm">;
+    npm: z.ZodOptional<z.ZodString>;
+    access: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        restricted: "restricted";
+    }>>;
+    tag: z.ZodOptional<z.ZodString>;
+    build: z.ZodOptional<z.ZodEnum<{
+        napi: "napi";
+        "bundled-cli": "bundled-cli";
+    }>>;
+    targets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    name: z.ZodString;
+    path: z.ZodString;
+    paths: z.ZodArray<z.ZodString>;
+    depends_on: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    first_version: z.ZodDefault<z.ZodString>;
+    smoke: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "kind">;
+export type PilotBlock = z.infer<typeof PILOT>;
+export type CratesPackage = z.infer<typeof CRATES_PKG>;
+export type PypiPackage = z.infer<typeof PYPI_PKG>;
+export type NpmPackage = z.infer<typeof NPM_PKG>;
+export type Package = z.infer<typeof PACKAGE>;
+export interface Config {
+    putitoutthere: PilotBlock;
+    packages: Package[];
+}
+export declare function parseConfig(toml: string): Config;
+export declare function loadConfig(path: string): Config;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,CAAC,EAAiB,MAAM,KAAK,CAAC;AAIvC,QAAA,MAAM,KAAK;;;;;;;kBAMA,CAAC;AAYZ,QAAA,MAAM,UAAU;;;;;;;;;;;kBAQL,CAAC;AAIZ,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;kBAcX,CAAC;AAIJ,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;kBAeV,CAAC;AAEJ,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAAgE,CAAC;AAW9E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACvD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AACjD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,MAAM,WAAW,MAAM;IACrB,aAAa,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBhD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU/C"}