putitoutthere 0.0.1

package/dist/config.js

@@ -0,0 +1,128 @@
+/**
+ * `putitoutthere.toml` loader and validator.
+ *
+ * Shape per plan.md §6. Handler-specific fields per §6.4. `targets`
+ * cross-validation per §12.2: only meaningful for `maturin` / `napi` /
+ * `bundled-cli` builds.
+ *
+ * Two entry points:
+ *  - `parseConfig(toml)`  pure function over a TOML string; used in tests.
+ *  - `loadConfig(path)`   reads the file and calls parseConfig.
+ *
+ * Unknown fields are a hard error (no silent drops). Zod's `.strict()`
+ * enforces this at every level.
+ */
+import { readFileSync } from 'node:fs';
+import { parse as parseToml } from 'smol-toml';
+import { z } from 'zod';
+/* ------------------------------ schemas ------------------------------ */
+const PILOT = z
+    .object({
+    version: z.literal(1),
+    cadence: z.enum(['immediate', 'scheduled']).optional(),
+    agents_path: z.string().optional(),
+})
+    .strict();
+// Fields every package carries, regardless of kind.
+const PACKAGE_BASE = {
+    name: z.string().min(1),
+    path: z.string().min(1),
+    paths: z.array(z.string()).min(1),
+    depends_on: z.array(z.string()).default([]),
+    first_version: z.string().default('0.1.0'),
+    smoke: z.string().optional(),
+};
+const CRATES_PKG = z
+    .object({
+    ...PACKAGE_BASE,
+    kind: z.literal('crates'),
+    crate: z.string().optional(),
+    features: z.array(z.string()).optional(),
+    target: z.array(z.string()).optional(),
+})
+    .strict();
+const PYPI_BUILD = z.enum(['maturin', 'setuptools', 'hatch']);
+const PYPI_PKG = z
+    .object({
+    ...PACKAGE_BASE,
+    kind: z.literal('pypi'),
+    pypi: z.string().optional(),
+    build: PYPI_BUILD.optional(),
+    wheels_artifact: z.string().optional(),
+    targets: z.array(z.string()).optional(),
+})
+    .strict()
+    .refine((p) => p.targets === undefined || p.build === 'maturin', 
+// §12.2: targets only for maturin on pypi.
+{ message: 'targets is only valid when build = "maturin" on pypi packages' });
+const NPM_BUILD = z.enum(['napi', 'bundled-cli']);
+const NPM_PKG = z
+    .object({
+    ...PACKAGE_BASE,
+    kind: z.literal('npm'),
+    npm: z.string().optional(),
+    access: z.enum(['public', 'restricted']).optional(),
+    tag: z.string().optional(),
+    build: NPM_BUILD.optional(),
+    targets: z.array(z.string()).optional(),
+})
+    .strict()
+    .refine((p) => p.targets === undefined || p.build === 'napi' || p.build === 'bundled-cli', 
+// §12.2: targets only for napi or bundled-cli on npm.
+{ message: 'targets is only valid when build = "napi" or "bundled-cli" on npm packages' });
+const PACKAGE = z.discriminatedUnion('kind', [CRATES_PKG, PYPI_PKG, NPM_PKG]);
+const FILE = z
+    .object({
+    putitoutthere: PILOT,
+    package: z.array(PACKAGE).min(1),
+})
+    .strict();
+/* ----------------------------- functions ----------------------------- */
+export function parseConfig(toml) {
+    let raw;
+    try {
+        raw = parseToml(toml);
+    }
+    catch (err) {
+        throw new Error(`putitoutthere.toml: invalid TOML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const result = FILE.safeParse(raw);
+    if (!result.success) {
+        throw new Error(`putitoutthere.toml: ${formatZodError(result.error)}`);
+    }
+    const parsed = result.data;
+    assertUniqueNames(parsed.package);
+    return {
+        putitoutthere: parsed.putitoutthere,
+        packages: parsed.package,
+    };
+}
+export function loadConfig(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        throw new Error(`putitoutthere.toml: cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return parseConfig(text);
+}
+/* ----------------------------- internals ----------------------------- */
+function assertUniqueNames(packages) {
+    const seen = new Set();
+    for (const p of packages) {
+        if (seen.has(p.name)) {
+            throw new Error(`putitoutthere.toml: duplicate package name: ${p.name}`);
+        }
+        seen.add(p.name);
+    }
+}
+function formatZodError(error) {
+    return error.issues
+        .map((issue) => {
+        const path = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+        return `${path}: ${issue.message}`;
+    })
+        .join('; ');
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAiB,MAAM,KAAK,CAAC;AAEvC,2EAA2E;AAE3E,MAAM,KAAK,GAAG,CAAC;KACZ,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,oDAAoD;AACpD,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,GAAG,YAAY;IACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9D,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,GAAG,YAAY;IACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;AACvD,2CAA2C;AAC3C,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAC7E,CAAC;AAEJ,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAElD,MAAM,OAAO,GAAG,CAAC;KACd,MAAM,CAAC;IACN,GAAG,YAAY;IACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa;AACjF,sDAAsD;AACtD,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAC1F,CAAC;AAEJ,MAAM,OAAO,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9E,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,CAAC;IACN,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAeZ,2EAA2E;AAE3E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAE3E,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAe;IACrC,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrE,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/git.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Thin wrapper around the `git` CLI for the ops putitoutthere needs.
+ *
+ * Sync-only, by design — the caller is either CI (which we don't mind
+ * blocking) or a doctor run (which is interactive). Stderr is captured
+ * and surfaced in thrown errors so failures are diagnosable without
+ * re-running with --verbose.
+ *
+ * Issue #9. Plan: §13.6 (no-push tag model), §14.2 (last-tag resolver).
+ */
+export interface GitOptions {
+    cwd?: string;
+}
+interface TagOptions extends GitOptions {
+    message?: string;
+}
+export declare function headCommit(opts?: GitOptions): string;
+export declare function commitBody(sha: string, opts?: GitOptions): string;
+export declare function diffNames(from: string, to: string, opts?: GitOptions): string[];
+export declare function tagList(glob: string, opts?: GitOptions): string[];
+export declare function createTag(name: string, sha: string, opts?: TagOptions): void;
+export declare function pushTag(name: string, opts?: GitOptions): void;
+/**
+ * Find the highest-semver tag for a given package.
+ *
+ * Tag format is fixed (plan.md §14.1): `{packageName}-v{major}.{minor}.{patch}`.
+ * We glob-filter by prefix, parse each candidate, and return the highest.
+ * Malformed candidates that match the glob but not strict semver are
+ * skipped silently — they're operator noise, not tool output.
+ *
+ * Returns null when no tag for this package exists.
+ */
+export declare function lastTag(packageName: string, opts?: GitOptions): string | null;
+export {};
+//# sourceMappingURL=git.d.ts.map

package/dist/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,UAAU,UAAW,SAAQ,UAAU;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAuBD,wBAAgB,UAAU,CAAC,IAAI,GAAE,UAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAGrE;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,UAAe,GACpB,MAAM,EAAE,CAIV;AAID,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,EAAE,CAIrE;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,UAAe,GACpB,IAAI,CAGN;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,IAAI,CAEjE;AAID;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,GAAG,IAAI,CAmBjF"}

package/dist/git.js

@@ -0,0 +1,98 @@
+/**
+ * Thin wrapper around the `git` CLI for the ops putitoutthere needs.
+ *
+ * Sync-only, by design — the caller is either CI (which we don't mind
+ * blocking) or a doctor run (which is interactive). Stderr is captured
+ * and surfaced in thrown errors so failures are diagnosable without
+ * re-running with --verbose.
+ *
+ * Issue #9. Plan: §13.6 (no-push tag model), §14.2 (last-tag resolver).
+ */
+import { execFileSync } from 'node:child_process';
+import { parseSemver } from './version.js';
+/* ------------------------------ core ------------------------------ */
+function run(args, opts = {}) {
+    try {
+        return execFileSync('git', args, {
+            cwd: opts.cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trimEnd();
+    }
+    catch (err) {
+        // execFileSync throws an Error whose `stderr` field carries git's
+        // error output. Fold it into the thrown message so tests + logs
+        // see the root cause without separate plumbing.
+        const stderr = err.stderr?.toString('utf8').trim();
+        const base = err instanceof Error ? err.message : String(err);
+        throw new Error(stderr ? `${base}\n${stderr}` : base);
+    }
+}
+/* ---------------------------- observers ---------------------------- */
+export function headCommit(opts = {}) {
+    return run(['rev-parse', 'HEAD'], opts);
+}
+export function commitBody(sha, opts = {}) {
+    // %B = raw body (subject + body, no trailer folding).
+    return run(['log', '-1', '--format=%B', sha], opts);
+}
+export function diffNames(from, to, opts = {}) {
+    const out = run(['diff', '--name-only', `${from}..${to}`], opts);
+    if (out === '')
+        return [];
+    return out.split('\n').filter((l) => l.length > 0);
+}
+/* ------------------------------ tags ------------------------------ */
+export function tagList(glob, opts = {}) {
+    const out = run(['tag', '-l', glob], opts);
+    if (out === '')
+        return [];
+    return out.split('\n').filter((l) => l.length > 0);
+}
+export function createTag(name, sha, opts = {}) {
+    const message = opts.message ?? name;
+    run(['tag', '-a', '-m', message, name, sha], opts);
+}
+export function pushTag(name, opts = {}) {
+    run(['push', 'origin', name], opts);
+}
+/* -------------------------- last-tag resolver -------------------------- */
+/**
+ * Find the highest-semver tag for a given package.
+ *
+ * Tag format is fixed (plan.md §14.1): `{packageName}-v{major}.{minor}.{patch}`.
+ * We glob-filter by prefix, parse each candidate, and return the highest.
+ * Malformed candidates that match the glob but not strict semver are
+ * skipped silently — they're operator noise, not tool output.
+ *
+ * Returns null when no tag for this package exists.
+ */
+export function lastTag(packageName, opts = {}) {
+    const prefix = `${packageName}-v`;
+    const candidates = tagList(`${prefix}*.*.*`, opts);
+    let best = null;
+    for (const tag of candidates) {
+        if (!tag.startsWith(prefix))
+            continue;
+        const versionPart = tag.slice(prefix.length);
+        let parsed;
+        try {
+            parsed = parseSemver(versionPart);
+        }
+        catch {
+            continue; // skip malformed
+        }
+        if (!best || greater(parsed, best.version)) {
+            best = { tag, version: parsed };
+        }
+    }
+    return best?.tag ?? null;
+}
+function greater(a, b) {
+    if (a.major !== b.major)
+        return a.major > b.major;
+    if (a.minor !== b.minor)
+        return a.minor > b.minor;
+    return a.patch > b.patch;
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAUxD,wEAAwE;AAExE,SAAS,GAAG,CAAC,IAAc,EAAE,OAAmB,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,OAAO,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,gEAAgE;QAChE,gDAAgD;QAChD,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,MAAM,UAAU,UAAU,CAAC,OAAmB,EAAE;IAC9C,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAmB,EAAE;IAC3D,sDAAsD;IACtD,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,EAAU,EACV,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAmB,EAAE;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,GAAW,EACX,OAAmB,EAAE;IAErB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAmB,EAAE;IACzD,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,WAAmB,EAAE,OAAmB,EAAE;IAChE,MAAM,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,MAAM,OAAO,EAAE,IAAI,CAAC,CAAC;IAEnD,IAAI,IAAI,GAA4C,IAAI,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,iBAAiB;QAC7B,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;AAC3B,CAAC"}

package/dist/glob.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Glob matcher. Thin wrapper over minimatch with the flags putitoutthere
+ * needs everywhere.
+ *
+ * Flags per plan.md §11.4:
+ *   - dot: true       — real repos keep config under .github/, .config/, etc.
+ *   - matchBase: false — patterns anchor at the repo root
+ *
+ * Double-star crosses directory boundaries; brace expansion is on.
+ *
+ * Issue #10.
+ */
+export declare function matchesGlob(pattern: string, path: string): boolean;
+export declare function matchesAny(patterns: readonly string[], path: string): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAK7E"}

package/dist/glob.js

@@ -0,0 +1,29 @@
+/**
+ * Glob matcher. Thin wrapper over minimatch with the flags putitoutthere
+ * needs everywhere.
+ *
+ * Flags per plan.md §11.4:
+ *   - dot: true       — real repos keep config under .github/, .config/, etc.
+ *   - matchBase: false — patterns anchor at the repo root
+ *
+ * Double-star crosses directory boundaries; brace expansion is on.
+ *
+ * Issue #10.
+ */
+import { minimatch } from 'minimatch';
+const OPTS = {
+    dot: true,
+    matchBase: false,
+    nocomment: true, // putitoutthere.toml patterns aren't shell comments
+};
+export function matchesGlob(pattern, path) {
+    return minimatch(path, pattern, OPTS);
+}
+export function matchesAny(patterns, path) {
+    for (const p of patterns) {
+        if (matchesGlob(p, path))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=glob.js.map

package/dist/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI,EAAE,oDAAoD;CAC7D,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAA2B,EAAE,IAAY;IAClE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/handlers/crates.d.ts

@@ -0,0 +1,8 @@
+/**
+ * crates.io handler. Real implementation lands in #16.
+ * Scaffold: contract-shaped stub that throws on any method call so
+ * callers link against the expected surface.
+ */
+import type { Handler } from '../types.js';
+export declare const crates: Handler;
+//# sourceMappingURL=crates.d.ts.map

package/dist/handlers/crates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crates.d.ts","sourceRoot":"","sources":["../../src/handlers/crates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAK3C,eAAO,MAAM,MAAM,EAAE,OAWpB,CAAC"}

package/dist/handlers/crates.js

@@ -0,0 +1,19 @@
+/**
+ * crates.io handler. Real implementation lands in #16.
+ * Scaffold: contract-shaped stub that throws on any method call so
+ * callers link against the expected surface.
+ */
+const NOT_IMPLEMENTED = (method) => new Error(`crates handler '${method}' not implemented yet — see #16`);
+export const crates = {
+    kind: 'crates',
+    isPublished() {
+        throw NOT_IMPLEMENTED('isPublished');
+    },
+    writeVersion() {
+        throw NOT_IMPLEMENTED('writeVersion');
+    },
+    publish() {
+        throw NOT_IMPLEMENTED('publish');
+    },
+};
+//# sourceMappingURL=crates.js.map

package/dist/handlers/crates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crates.js","sourceRoot":"","sources":["../../src/handlers/crates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAS,EAAE,CAChD,IAAI,KAAK,CAAC,mBAAmB,MAAM,iCAAiC,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,MAAM,GAAY;IAC7B,IAAI,EAAE,QAAQ;IACd,WAAW;QACT,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IACD,YAAY;QACV,MAAM,eAAe,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IACD,OAAO;QACL,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;CACF,CAAC"}

package/dist/handlers/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Handler dispatch by `package.kind`. Real dispatcher lands in #12;
+ * per-handler impls in #16 (crates), #17 (pypi), #18–#19 (npm).
+ */
+import type { Handler, Kind } from '../types.js';
+export declare function handlerFor(kind: Kind): Handler;
+//# sourceMappingURL=index.d.ts.map

package/dist/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAKjD,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAa9C"}

package/dist/handlers/index.js

@@ -0,0 +1,22 @@
+/**
+ * Handler dispatch by `package.kind`. Real dispatcher lands in #12;
+ * per-handler impls in #16 (crates), #17 (pypi), #18–#19 (npm).
+ */
+import { crates } from './crates.js';
+import { npm } from './npm.js';
+import { pypi } from './pypi.js';
+export function handlerFor(kind) {
+    switch (kind) {
+        case 'crates':
+            return crates;
+        case 'pypi':
+            return pypi;
+        case 'npm':
+            return npm;
+        default: {
+            const exhaustive = kind;
+            throw new Error(`unknown package kind: ${String(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/handlers/npm.d.ts

@@ -0,0 +1,7 @@
+/**
+ * npm handler. Real implementation lands in #18 (vanilla) and #19
+ * (napi + bundled-cli platform orchestration).
+ */
+import type { Handler } from '../types.js';
+export declare const npm: Handler;
+//# sourceMappingURL=npm.d.ts.map

package/dist/handlers/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAK3C,eAAO,MAAM,GAAG,EAAE,OAWjB,CAAC"}

package/dist/handlers/npm.js

@@ -0,0 +1,18 @@
+/**
+ * npm handler. Real implementation lands in #18 (vanilla) and #19
+ * (napi + bundled-cli platform orchestration).
+ */
+const NOT_IMPLEMENTED = (method) => new Error(`npm handler '${method}' not implemented yet — see #18 / #19`);
+export const npm = {
+    kind: 'npm',
+    isPublished() {
+        throw NOT_IMPLEMENTED('isPublished');
+    },
+    writeVersion() {
+        throw NOT_IMPLEMENTED('writeVersion');
+    },
+    publish() {
+        throw NOT_IMPLEMENTED('publish');
+    },
+};
+//# sourceMappingURL=npm.js.map

package/dist/handlers/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAS,EAAE,CAChD,IAAI,KAAK,CAAC,gBAAgB,MAAM,uCAAuC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,GAAG,GAAY;IAC1B,IAAI,EAAE,KAAK;IACX,WAAW;QACT,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IACD,YAAY;QACV,MAAM,eAAe,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IACD,OAAO;QACL,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;CACF,CAAC"}

package/dist/handlers/pypi.d.ts

@@ -0,0 +1,6 @@
+/**
+ * PyPI handler. Real implementation lands in #17.
+ */
+import type { Handler } from '../types.js';
+export declare const pypi: Handler;
+//# sourceMappingURL=pypi.d.ts.map

package/dist/handlers/pypi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pypi.d.ts","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAK3C,eAAO,MAAM,IAAI,EAAE,OAWlB,CAAC"}

package/dist/handlers/pypi.js

@@ -0,0 +1,17 @@
+/**
+ * PyPI handler. Real implementation lands in #17.
+ */
+const NOT_IMPLEMENTED = (method) => new Error(`pypi handler '${method}' not implemented yet — see #17`);
+export const pypi = {
+    kind: 'pypi',
+    isPublished() {
+        throw NOT_IMPLEMENTED('isPublished');
+    },
+    writeVersion() {
+        throw NOT_IMPLEMENTED('writeVersion');
+    },
+    publish() {
+        throw NOT_IMPLEMENTED('publish');
+    },
+};
+//# sourceMappingURL=pypi.js.map

package/dist/handlers/pypi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAS,EAAE,CAChD,IAAI,KAAK,CAAC,iBAAiB,MAAM,iCAAiC,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,IAAI,GAAY;IAC3B,IAAI,EAAE,MAAM;IACZ,WAAW;QACT,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IACD,YAAY;QACV,MAAM,eAAe,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IACD,OAAO;QACL,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;CACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * SDK entry. This is what callers import as `putitoutthere`.
+ *
+ * Implementations land in follow-up issues; this file re-exports the
+ * public API surface so the CLI (#20–#23) and the GHA wrapper (#24)
+ * have a stable import site.
+ */
+export type { ArtifactStore, Bump, Config, Ctx, Handler, Kind, Logger, PackageConfig, PublishResult, SmokeResult, } from './types.js';
+export { AuthError, TransientError } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EACV,aAAa,EACb,IAAI,EACJ,MAAM,EACN,GAAG,EACH,OAAO,EACP,IAAI,EACJ,MAAM,EACN,aAAa,EACb,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+/**
+ * SDK entry. This is what callers import as `putitoutthere`.
+ *
+ * Implementations land in follow-up issues; this file re-exports the
+ * public API surface so the CLI (#20–#23) and the GHA wrapper (#24)
+ * have a stable import site.
+ */
+export { AuthError, TransientError } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Structured logger for putitoutthere.
+ *
+ * JSON-per-line output in CI; human-readable text in TTYs. Every emitted
+ * line is passed through a redactor that replaces any occurrence of a
+ * known-secret env value (keys matching *TOKEN* / *SECRET* / *PASSWORD*
+ * / *KEY*, case-insensitive) with `[REDACTED]`.
+ *
+ * Substring redaction (rather than Pino-style field-path redaction) is
+ * deliberate: handlers capture child-process stdout/stderr and feed it
+ * through the logger. A token leaked inside that stream must not escape
+ * to CI logs regardless of which field it ended up in.
+ *
+ * Issue #11. Plan: §22.2, §22.5.
+ */
+import type { Writable } from 'node:stream';
+import type { Logger } from './types.js';
+export type Level = 'debug' | 'info' | 'warn' | 'error';
+export interface LoggerOptions {
+    stream?: Writable;
+    pretty?: boolean;
+    level?: Level;
+}
+export declare function createLogger(opts?: LoggerOptions): Logger;
+/**
+ * Replace every occurrence of a known-secret env value with `[REDACTED]`.
+ * Empty / single-char values are skipped to avoid mangling unrelated
+ * characters. Called on every log write.
+ */
+export declare function redact(s: string): string;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AASxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,aAAkB,GAAG,MAAM,CAkB7D;AA0BD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAWxC"}

package/dist/log.js

@@ -0,0 +1,81 @@
+/**
+ * Structured logger for putitoutthere.
+ *
+ * JSON-per-line output in CI; human-readable text in TTYs. Every emitted
+ * line is passed through a redactor that replaces any occurrence of a
+ * known-secret env value (keys matching *TOKEN* / *SECRET* / *PASSWORD*
+ * / *KEY*, case-insensitive) with `[REDACTED]`.
+ *
+ * Substring redaction (rather than Pino-style field-path redaction) is
+ * deliberate: handlers capture child-process stdout/stderr and feed it
+ * through the logger. A token leaked inside that stream must not escape
+ * to CI logs regardless of which field it ended up in.
+ *
+ * Issue #11. Plan: §22.2, §22.5.
+ */
+const LEVEL_ORDER = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40,
+};
+export function createLogger(opts = {}) {
+    const stream = opts.stream ?? process.stdout;
+    const pretty = opts.pretty ?? isTty(stream);
+    const minLevel = LEVEL_ORDER[opts.level ?? 'info'];
+    const emit = (level, msg, fields) => {
+        if (LEVEL_ORDER[level] < minLevel)
+            return;
+        const record = { level, time: new Date().toISOString(), msg, ...fields };
+        const raw = pretty ? formatPretty(record) : `${JSON.stringify(record)}\n`;
+        stream.write(redact(raw));
+    };
+    return {
+        debug: (msg, fields = {}) => emit('debug', msg, fields),
+        info: (msg, fields = {}) => emit('info', msg, fields),
+        warn: (msg, fields = {}) => emit('warn', msg, fields),
+        error: (msg, fields = {}) => emit('error', msg, fields),
+    };
+}
+function isTty(stream) {
+    return Boolean(stream.isTTY);
+}
+function formatPretty(record) {
+    const { level, time: _t, msg, ...fields } = record;
+    const pairs = Object.entries(fields)
+        .map(([k, v]) => `${k}=${formatScalar(v)}`)
+        .join(' ');
+    const prefix = `[${String(level).toUpperCase()}]`;
+    return pairs.length > 0 ? `${prefix} ${String(msg)}  ${pairs}\n` : `${prefix} ${String(msg)}\n`;
+}
+function formatScalar(v) {
+    if (typeof v === 'string')
+        return v;
+    if (typeof v === 'number' || typeof v === 'boolean' || v === null)
+        return String(v);
+    return JSON.stringify(v);
+}
+/* ----------------------------- redaction ----------------------------- */
+const SECRET_KEY = /TOKEN|SECRET|PASSWORD|KEY/i;
+const REDACTED = '[REDACTED]';
+/**
+ * Replace every occurrence of a known-secret env value with `[REDACTED]`.
+ * Empty / single-char values are skipped to avoid mangling unrelated
+ * characters. Called on every log write.
+ */
+export function redact(s) {
+    let out = s;
+    for (const [k, v] of Object.entries(process.env)) {
+        if (!SECRET_KEY.test(k))
+            continue;
+        if (typeof v !== 'string' || v.length < 2)
+            continue;
+        if (!out.includes(v))
+            continue;
+        // String.replaceAll expects a literal or a RegExp; use split/join to
+        // avoid regex escaping every secret value.
+        out = out.split(v).join(REDACTED);
+    }
+    return out;
+}
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,WAAW,GAA0B;IACzC,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAQF,MAAM,UAAU,YAAY,CAAC,OAAsB,EAAE;IACnD,MAAM,MAAM,GAAa,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,GAAW,EAAE,MAA+B,EAAQ,EAAE;QAChF,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,QAAQ;YAAE,OAAO;QAC1C,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;QACvD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QACrD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QACrD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAgB;IAC7B,OAAO,OAAO,CAAE,MAA8B,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;AAClG,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAE3E,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/B,qEAAqE;QACrE,2CAA2C;QAC3C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}