putitoutthere 0.0.1

package/dist/preflight.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Pre-flight auth check. Runs before any publish side effect to verify
+ * every cascaded package has usable credentials.
+ *
+ * Per plan.md §16.3: each handler accepts OIDC (detected by
+ * `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific long-lived env var.
+ * OIDC-capable handlers fall back on the env var when OIDC is not
+ * available.
+ *
+ * This module reports; callers decide whether to throw. `requireAuth`
+ * is the common case (publish). `pilot doctor` uses `checkAuth`
+ * directly so it can show a table instead of aborting.
+ *
+ * Issue #14.
+ */
+import type { Package } from './config.js';
+import type { Kind } from './types.js';
+export interface AuthResult {
+    package: string;
+    kind: Kind;
+    via: 'oidc' | 'token' | 'missing';
+    envVar: string;
+}
+export interface AuthStatus {
+    ok: boolean;
+    results: AuthResult[];
+}
+export declare function checkAuth(packages: readonly Package[]): AuthStatus;
+export declare function requireAuth(packages: readonly Package[]): void;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAWvC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAclE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAiB9D"}

package/dist/preflight.js

@@ -0,0 +1,55 @@
+/**
+ * Pre-flight auth check. Runs before any publish side effect to verify
+ * every cascaded package has usable credentials.
+ *
+ * Per plan.md §16.3: each handler accepts OIDC (detected by
+ * `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific long-lived env var.
+ * OIDC-capable handlers fall back on the env var when OIDC is not
+ * available.
+ *
+ * This module reports; callers decide whether to throw. `requireAuth`
+ * is the common case (publish). `pilot doctor` uses `checkAuth`
+ * directly so it can show a table instead of aborting.
+ *
+ * Issue #14.
+ */
+const TOKEN_ENV = {
+    crates: 'CARGO_REGISTRY_TOKEN',
+    pypi: 'PYPI_API_TOKEN',
+    npm: 'NODE_AUTH_TOKEN',
+};
+const OIDC_ENV = 'ACTIONS_ID_TOKEN_REQUEST_TOKEN';
+const DOCS_POINTER = 'plan.md §16.4';
+export function checkAuth(packages) {
+    const hasOidc = nonEmpty(process.env[OIDC_ENV]);
+    const results = packages.map((p) => {
+        const envVar = TOKEN_ENV[p.kind];
+        if (hasOidc) {
+            return { package: p.name, kind: p.kind, via: 'oidc', envVar };
+        }
+        if (nonEmpty(process.env[envVar])) {
+            return { package: p.name, kind: p.kind, via: 'token', envVar };
+        }
+        return { package: p.name, kind: p.kind, via: 'missing', envVar };
+    });
+    const ok = results.every((r) => r.via !== 'missing');
+    return { ok, results };
+}
+export function requireAuth(packages) {
+    const status = checkAuth(packages);
+    if (status.ok)
+        return;
+    const missing = status.results.filter((r) => r.via === 'missing');
+    const lines = missing.map((r) => `  - ${r.package} (${r.kind}) needs ${r.envVar} (or OIDC via ${OIDC_ENV})`);
+    throw new Error([
+        'Pre-flight auth check failed:',
+        ...lines,
+        '',
+        `Wire the missing env vars in .github/workflows/release.yml under the publish job.`,
+        `See ${DOCS_POINTER}.`,
+    ].join('\n'));
+}
+function nonEmpty(v) {
+    return typeof v === 'string' && v.trim().length > 0;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,MAAM,SAAS,GAAyB;IACtC,MAAM,EAAE,sBAAsB;IAC9B,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,iBAAiB;CACvB,CAAC;AAEF,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,MAAM,YAAY,GAAG,eAAe,CAAC;AAcrC,MAAM,UAAU,SAAS,CAAC,QAA4B;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,iBAAiB,QAAQ,GAAG,CAC7E,CAAC;IACF,MAAM,IAAI,KAAK,CACb;QACE,+BAA+B;QAC/B,GAAG,KAAK;QACR,EAAE;QACF,mFAAmF;QACnF,OAAO,YAAY,GAAG;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC"}

package/dist/retry.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Retry with exponential backoff + jitter.
+ *
+ * Applied uniformly by the orchestrator rather than per-handler (plan.md
+ * §13.3 / §7.3):
+ *
+ *   retries:        3
+ *   initial_delay:  1s
+ *   multiplier:     2          (1s, 2s, 4s)
+ *   jitter:         ±25%
+ *   retry_on:       TransientError, fetch 5xx, ECONNRESET, ETIMEDOUT, 429
+ *   no_retry_on:    AuthError, other errors, 4xx (except 429)
+ *
+ * 429 honors the error's `retryAfter` hint (seconds) when present, so
+ * registries asking us to back off get respected.
+ *
+ * Issue #10.
+ */
+export interface RetryOptions {
+    retries?: number;
+    initialDelayMs?: number;
+    multiplier?: number;
+    jitter?: number;
+}
+export declare function withRetry<T>(fn: () => Promise<T>, opts?: RetryOptions): Promise<T>;
+//# sourceMappingURL=retry.d.ts.map

package/dist/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD,wBAAsB,SAAS,CAAC,CAAC,EAC/B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,CAAC,CAAC,CAuBZ"}

package/dist/retry.js

@@ -0,0 +1,91 @@
+/**
+ * Retry with exponential backoff + jitter.
+ *
+ * Applied uniformly by the orchestrator rather than per-handler (plan.md
+ * §13.3 / §7.3):
+ *
+ *   retries:        3
+ *   initial_delay:  1s
+ *   multiplier:     2          (1s, 2s, 4s)
+ *   jitter:         ±25%
+ *   retry_on:       TransientError, fetch 5xx, ECONNRESET, ETIMEDOUT, 429
+ *   no_retry_on:    AuthError, other errors, 4xx (except 429)
+ *
+ * 429 honors the error's `retryAfter` hint (seconds) when present, so
+ * registries asking us to back off get respected.
+ *
+ * Issue #10.
+ */
+import { AuthError, TransientError } from './types.js';
+const DEFAULTS = {
+    retries: 3,
+    initialDelayMs: 1000,
+    multiplier: 2,
+    jitter: 0.25,
+};
+export async function withRetry(fn, opts = {}) {
+    const { retries, initialDelayMs, multiplier, jitter } = { ...DEFAULTS, ...opts };
+    let attempt = 0;
+    let lastErr;
+    while (attempt < retries) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+            attempt++;
+            if (attempt >= retries || !isRetryable(err)) {
+                throw err;
+            }
+            const baseDelay = initialDelayMs * Math.pow(multiplier, attempt - 1);
+            const hinted = retryAfterMs(err);
+            const delay = Math.max(baseDelay, hinted) + jitterOffset(baseDelay, jitter);
+            await sleep(delay);
+        }
+    }
+    // Unreachable: loop either returns or throws. TypeScript can't infer that.
+    /* v8 ignore next 2 */
+    throw lastErr;
+}
+function isRetryable(err) {
+    if (err instanceof AuthError)
+        return false;
+    if (err instanceof TransientError)
+        return true;
+    // Network-ish error codes used by Node's net/http stack.
+    const code = extractProp(err, 'code');
+    if (code === 'ECONNRESET' || code === 'ETIMEDOUT')
+        return true;
+    // HTTP-status-tagged errors: retry 5xx and 429.
+    const status = extractProp(err, 'status');
+    if (typeof status === 'number') {
+        if (status === 429)
+            return true;
+        if (status >= 500 && status < 600)
+            return true;
+    }
+    return false;
+}
+function retryAfterMs(err) {
+    const ra = extractProp(err, 'retryAfter');
+    if (typeof ra === 'number' && ra > 0)
+        return ra * 1000;
+    return 0;
+}
+function extractProp(err, key) {
+    if (err && typeof err === 'object' && key in err) {
+        return err[key];
+    }
+    return undefined;
+}
+function jitterOffset(baseDelay, fraction) {
+    if (fraction <= 0)
+        return 0;
+    // ±fraction of the base delay.
+    const amp = baseDelay * fraction;
+    return (Math.random() * 2 - 1) * amp;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
+}
+//# sourceMappingURL=retry.js.map

package/dist/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASvD,MAAM,QAAQ,GAA2B;IACvC,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,IAAI;CACb,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,OAAqB,EAAE;IAEvB,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAgB,CAAC;IACrB,OAAO,OAAO,GAAG,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,OAAO,EAAE,CAAC;YACV,IAAI,OAAO,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,SAAS,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC5E,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,GAAG,YAAY,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,yDAAyD;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/D,gDAAgD;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,GAAW;IAC5C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACjD,OAAQ,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,QAAgB;IACvD,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5B,+BAA+B;IAC/B,MAAM,GAAG,GAAG,SAAS,GAAG,QAAQ,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/trailer.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Release trailer parser.
+ *
+ * Grammar (plan.md §10.3):
+ *   trailer      = "release:" WS value [ WS packages ]
+ *   value        = "patch" | "minor" | "major" | "skip"
+ *   packages     = "[" package-list "]"
+ *   package-list = package-name *( "," WS package-name )
+ *
+ * Semantics (§10.6): case-insensitive key match; only the LAST `release:`
+ * line wins.
+ *
+ * Pure TypeScript implementation. A `git interpret-trailers`-backed
+ * variant may be added later for edge cases the RFC 822 trailer spec
+ * handles (folded continuations, etc.), but the pure parser covers
+ * every message shape putitoutthere actually sees.
+ *
+ * Issue #6.
+ */
+import type { Bump } from './types.js';
+export interface Trailer {
+    bump: Bump | 'skip';
+    packages: string[];
+}
+export declare function parseTrailer(commitBody: string): Trailer | null;
+//# sourceMappingURL=trailer.d.ts.map

package/dist/trailer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trailer.d.ts","sourceRoot":"","sources":["../src/trailer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAcD,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAe/D"}

package/dist/trailer.js

@@ -0,0 +1,84 @@
+/**
+ * Release trailer parser.
+ *
+ * Grammar (plan.md §10.3):
+ *   trailer      = "release:" WS value [ WS packages ]
+ *   value        = "patch" | "minor" | "major" | "skip"
+ *   packages     = "[" package-list "]"
+ *   package-list = package-name *( "," WS package-name )
+ *
+ * Semantics (§10.6): case-insensitive key match; only the LAST `release:`
+ * line wins.
+ *
+ * Pure TypeScript implementation. A `git interpret-trailers`-backed
+ * variant may be added later for edge cases the RFC 822 trailer spec
+ * handles (folded continuations, etc.), but the pure parser covers
+ * every message shape putitoutthere actually sees.
+ *
+ * Issue #6.
+ */
+const VALID_VALUES = new Set(['patch', 'minor', 'major', 'skip']);
+// `release:` key, case-insensitive. Captures the remainder of the line.
+// Anchored with `^\s*` so indented trailers still count (§10 is silent on
+// indentation; real commit bodies rarely indent trailers, be lenient).
+const TRAILER_LINE = /^\s*release\s*:\s*(.*?)\s*$/i;
+// Package names: letters, digits, hyphen, underscore, dot. Matches what
+// npm / crates.io / PyPI themselves accept in identifiers.
+const PACKAGE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export function parseTrailer(commitBody) {
+    const lines = commitBody.split(/\r?\n/);
+    // Scan in reverse; first hit = last occurrence.
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i];
+        const match = TRAILER_LINE.exec(line);
+        if (!match)
+            continue;
+        const payload = match[1];
+        if (payload === undefined || payload === '') {
+            // `release:` with no value — malformed.
+            return null;
+        }
+        return parsePayload(payload);
+    }
+    return null;
+}
+function parsePayload(payload) {
+    // The payload is `<value>` or `<value> [pkg, pkg, ...]`.
+    const bracketIdx = payload.indexOf('[');
+    const valueText = (bracketIdx === -1 ? payload : payload.slice(0, bracketIdx)).trim();
+    if (!isValidValue(valueText)) {
+        return null;
+    }
+    if (bracketIdx === -1) {
+        return { bump: valueText, packages: [] };
+    }
+    const listText = payload.slice(bracketIdx);
+    const packages = parsePackageList(listText);
+    if (packages === null)
+        return null;
+    return { bump: valueText, packages };
+}
+function isValidValue(s) {
+    return VALID_VALUES.has(s);
+}
+function parsePackageList(s) {
+    // Must open with `[` and close with `]`; nothing after the close.
+    if (!s.startsWith('['))
+        return null;
+    const closeIdx = s.indexOf(']');
+    if (closeIdx === -1)
+        return null;
+    const tail = s.slice(closeIdx + 1).trim();
+    if (tail.length > 0)
+        return null; // stray text after list
+    const inner = s.slice(1, closeIdx).trim();
+    if (inner === '')
+        return []; // `release: minor []` → no packages
+    const parts = inner.split(',').map((p) => p.trim());
+    for (const name of parts) {
+        if (name === '' || !PACKAGE_NAME.test(name))
+            return null;
+    }
+    return parts;
+}
+//# sourceMappingURL=trailer.js.map

package/dist/trailer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trailer.js","sourceRoot":"","sources":["../src/trailer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzE,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,wEAAwE;AACxE,2DAA2D;AAC3D,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxC,gDAAgD;IAChD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YAC5C,wCAAwC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,yDAAyD;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,kEAAkE;IAClE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC,CAAC,oCAAoC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Public SDK + internal handler types.
+ *
+ * Full contract specified in plan.md §7.1. This file is the scaffolded
+ * surface; each field's implementation lands in its own issue:
+ * #5 (config), #7 (cascade), #11 (logger), #12 (handler dispatcher),
+ * #13 (completeness), #14 (pre-flight), #16–#19 (handlers).
+ */
+export type Kind = 'crates' | 'pypi' | 'npm';
+export type Bump = 'patch' | 'minor' | 'major';
+/** Shape filled in by #5. */
+export interface PackageConfig {
+    name: string;
+    kind: Kind;
+    path: string;
+    paths: string[];
+    depends_on?: string[];
+    first_version?: string;
+    smoke?: string;
+    [key: string]: unknown;
+}
+/** Shape filled in by #5. */
+export interface Config {
+    version: 1;
+    cadence?: 'immediate' | 'scheduled';
+    agents_path?: string;
+    packages: PackageConfig[];
+}
+/** Runtime context passed to every handler call. */
+export interface Ctx {
+    cwd: string;
+    dryRun: boolean;
+    log: Logger;
+    env: Record<string, string>;
+    artifacts: ArtifactStore;
+}
+export interface Logger {
+    debug(msg: string, fields?: Record<string, unknown>): void;
+    info(msg: string, fields?: Record<string, unknown>): void;
+    warn(msg: string, fields?: Record<string, unknown>): void;
+    error(msg: string, fields?: Record<string, unknown>): void;
+}
+export interface ArtifactStore {
+    /** Absolute path to the artifact tree for a given matrix artifact_name. */
+    get(artifactName: string): string;
+    /** True if the artifact_name exists and is non-empty. */
+    has(artifactName: string): boolean;
+}
+export interface PublishResult {
+    status: 'published' | 'already-published' | 'skipped';
+    url?: string;
+    bytes?: number;
+}
+export interface SmokeResult {
+    status: 'passed' | 'failed' | 'skipped';
+    output?: string;
+}
+export interface Handler {
+    kind: Kind;
+    isPublished(pkg: PackageConfig, version: string, ctx: Ctx): Promise<boolean>;
+    writeVersion(pkg: PackageConfig, version: string, ctx: Ctx): Promise<string[]>;
+    publish(pkg: PackageConfig, version: string, ctx: Ctx): Promise<PublishResult>;
+    smokeTest?(pkg: PackageConfig, version: string, ctx: Ctx): Promise<SmokeResult>;
+}
+/** Thrown on auth failure. Not retried. */
+export declare class AuthError extends Error {
+    readonly name = "AuthError";
+}
+/** Thrown on 5xx / network / timeout. Retried per §13.3. */
+export declare class TransientError extends Error {
+    readonly name = "TransientError";
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C,6BAA6B;AAC7B,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,oDAAoD;AACpD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,yDAAyD;IACzD,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E,SAAS,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjF;AAED,2CAA2C;AAC3C,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,eAAe;CACtC;AAED,4DAA4D;AAC5D,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,oBAAoB;CAC3C"}

package/dist/types.js

@@ -0,0 +1,17 @@
+/**
+ * Public SDK + internal handler types.
+ *
+ * Full contract specified in plan.md §7.1. This file is the scaffolded
+ * surface; each field's implementation lands in its own issue:
+ * #5 (config), #7 (cascade), #11 (logger), #12 (handler dispatcher),
+ * #13 (completeness), #14 (pre-flight), #16–#19 (handlers).
+ */
+/** Thrown on auth failure. Not retried. */
+export class AuthError extends Error {
+    name = 'AuthError';
+}
+/** Thrown on 5xx / network / timeout. Retried per §13.3. */
+export class TransientError extends Error {
+    name = 'TransientError';
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAqEH,2CAA2C;AAC3C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAG,WAAW,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C"}

package/dist/verbose.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Verbose-on-failure dump.
+ *
+ * When a handler throws, this writes a rich diagnostic record to
+ * `$GITHUB_STEP_SUMMARY` (as markdown) and to the structured log
+ * stream (as a single error-level record). Both are passed through
+ * the logger's redactor so env-matched secrets never leak.
+ *
+ * Per plan.md §22.4. Auto-emitted on failure; never on success.
+ *
+ * Issue #15.
+ */
+import type { Logger } from './types.js';
+/**
+ * Everything the dump needs to describe the failure. Handlers build
+ * this from their own state (the command they ran, the subprocess
+ * output they captured, handler-specific extras like parsed wheel
+ * tags). Nothing in here is putitoutthere-specific -- a fresh handler
+ * can populate all fields from scratch.
+ */
+export interface FailureContext {
+    /** Internal package name from pilot.toml. */
+    package: string;
+    /** Handler kind (crates | pypi | npm). */
+    handler: string;
+    /** The command that failed, argv-style. env values are redacted at emit. */
+    command: readonly string[];
+    /** stdout captured from the failing command. */
+    stdout: string;
+    /** stderr captured from the failing command. */
+    stderr: string;
+    /** Exit code (for child processes) or -1 when N/A. */
+    exitCode: number;
+    /** `{tool: "tool --version output"}`. Optional; handlers supply what's relevant. */
+    toolVersions?: Record<string, string>;
+    /**
+     * Handler-specific diagnostic extras. Arbitrary key/value; rendered
+     * verbatim in the summary. Examples from the plan: wheel platform
+     * tags, npm tarball contents, cargo package --list output.
+     */
+    extras?: Record<string, unknown>;
+}
+export interface DumpOptions {
+    log: Logger;
+}
+export declare function dumpFailure(err: Error, ctx: FailureContext, opts: DumpOptions): void;
+//# sourceMappingURL=verbose.d.ts.map

package/dist/verbose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verbose.d.ts","sourceRoot":"","sources":["../src/verbose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,wBAAgB,WAAW,CACzB,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,WAAW,GAChB,IAAI,CAaN"}

package/dist/verbose.js

@@ -0,0 +1,84 @@
+/**
+ * Verbose-on-failure dump.
+ *
+ * When a handler throws, this writes a rich diagnostic record to
+ * `$GITHUB_STEP_SUMMARY` (as markdown) and to the structured log
+ * stream (as a single error-level record). Both are passed through
+ * the logger's redactor so env-matched secrets never leak.
+ *
+ * Per plan.md §22.4. Auto-emitted on failure; never on success.
+ *
+ * Issue #15.
+ */
+import { appendFileSync } from 'node:fs';
+import { redact } from './log.js';
+const SUMMARY_CAP = 4 * 1024 * 1024; // GHA job-summary ceiling: 1 MiB per step, 20 MiB total. Cap at 4 MiB to stay well under on a single failure.
+const TRUNC_NOTE = '\n\n_… truncated. Run `gh run view --log` for the full log._\n';
+export function dumpFailure(err, ctx, opts) {
+    const md = redact(renderMarkdown(err, ctx));
+    writeSummary(truncate(md));
+    // A single structured record pairs the summary so downstream log
+    // pipelines (JSON sinks, GHA log grep) can find the failure by
+    // package + handler + exitCode without parsing markdown.
+    opts.log.error(`${ctx.handler}/${ctx.package} failed: ${err.message}`, {
+        package: ctx.package,
+        handler: ctx.handler,
+        exitCode: ctx.exitCode,
+        command: ctx.command.join(' '),
+    });
+}
+function renderMarkdown(err, ctx) {
+    const lines = [];
+    lines.push(`## ❌ ${ctx.handler}/${ctx.package} failed`);
+    lines.push('');
+    lines.push(`**Error.** ${err.message}`);
+    lines.push(`**Exit code.** \`${ctx.exitCode}\``);
+    lines.push('');
+    lines.push('**Command**');
+    lines.push('```');
+    lines.push(ctx.command.join(' '));
+    lines.push('```');
+    if (ctx.toolVersions && Object.keys(ctx.toolVersions).length > 0) {
+        lines.push('');
+        lines.push('**Tool versions**');
+        lines.push('```');
+        for (const [k, v] of Object.entries(ctx.toolVersions)) {
+            lines.push(`${k}: ${v}`);
+        }
+        lines.push('```');
+    }
+    lines.push('');
+    lines.push('**stdout**');
+    lines.push('```');
+    lines.push(ctx.stdout || '(empty)');
+    lines.push('```');
+    lines.push('');
+    lines.push('**stderr**');
+    lines.push('```');
+    lines.push(ctx.stderr || '(empty)');
+    lines.push('```');
+    if (ctx.extras && Object.keys(ctx.extras).length > 0) {
+        lines.push('');
+        lines.push('**Handler extras**');
+        lines.push('```json');
+        lines.push(JSON.stringify(ctx.extras, null, 2));
+        lines.push('```');
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+function truncate(md) {
+    if (md.length <= SUMMARY_CAP)
+        return md;
+    // Keep the head (error + command + versions) — the most useful
+    // bytes. Tail bytes are usually repeated noise at this size.
+    const head = md.slice(0, SUMMARY_CAP - TRUNC_NOTE.length);
+    return head + TRUNC_NOTE;
+}
+function writeSummary(md) {
+    const path = process.env.GITHUB_STEP_SUMMARY;
+    if (!path)
+        return; // local runs / non-GHA CI — summary is a no-op
+    appendFileSync(path, md, 'utf8');
+}
+//# sourceMappingURL=verbose.js.map

package/dist/verbose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verbose.js","sourceRoot":"","sources":["../src/verbose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAqClC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,8GAA8G;AACnJ,MAAM,UAAU,GAAG,gEAAgE,CAAC;AAEpF,MAAM,UAAU,WAAW,CACzB,GAAU,EACV,GAAmB,EACnB,IAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,iEAAiE;IACjE,+DAA+D;IAC/D,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,OAAO,EAAE,EAAE;QACrE,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAU,EAAE,GAAmB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,IAAI,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW;QAAE,OAAO,EAAE,CAAC;IACxC,+DAA+D;IAC/D,6DAA6D;IAC7D,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,IAAI,GAAG,UAAU,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,+CAA+C;IAClE,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Version bumper.
+ *
+ * Strict semver — no pre-release suffixes in v0 (plan.md §26.2 defers
+ * `-rc` / `-beta` / `-alpha` to v0.2). Pre-1.0 does *not* use the
+ * "breaking minor bumps" convention; 0.1.5 + minor is 0.2.0, not 1.0.0.
+ *
+ * Issue #8. Plan: §14.3 (bump semantics), §14.4 (first version).
+ */
+import type { Bump } from './types.js';
+export interface Semver {
+    major: number;
+    minor: number;
+    patch: number;
+}
+export declare function parseSemver(s: string): Semver;
+export declare function formatSemver(v: Semver): string;
+export declare function bump(lastVersion: string, bumpType: Bump): string;
+/**
+ * First-release version. Uses `package.first_version` when set, else
+ * the repo-wide default of `0.1.0`. Either way the value is validated
+ * against strict semver so typos fail loud before we tag.
+ */
+export declare function firstVersion(pkg: {
+    first_version?: string;
+}): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAKD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAU7C;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,MAAM,CAchE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIpE"}