putitoutthere 0.1.44 → 0.1.45

package/CHANGELOG.md

@@ -12,7 +12,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Added
 
-- **Reusable workflow `.github/workflows/release.yml` (`workflow_call`).** The single user-facing surface. Consumer integration is one `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v1` line in their own `release.yml`; pinned action versions, plan/build/publish orchestration, and GitHub Release creation all live inside. Three optional inputs: `environment` (default `release`), `node_version` (default `24`), `python_version` (default `3.12`). No `dry_run`, `working_directory`, or `config` inputs — the plan job is already side-effect-free, the config file is `putitoutthere.toml` at the repo root, period. The engine is invoked via `uses: thekevinscott/putitoutthere@v1` so the workflow file and the engine always agree on a single git ref.
+- **Reusable workflow `.github/workflows/release.yml` (`workflow_call`).** The single user-facing surface. Consumer integration is one `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0` line in their own `release.yml`; pinned action versions, plan/build/publish orchestration, and GitHub Release creation all live inside. Three optional inputs: `environment` (default `release`), `node_version` (default `24`), `python_version` (default `3.12`). No `dry_run`, `working_directory`, or `config` inputs — the plan job is already side-effect-free, the config file is `putitoutthere.toml` at the repo root, period. The engine is invoked via `uses: thekevinscott/putitoutthere@v0` so the workflow file and the engine always agree on a single git ref.
 
 - **`[package.bundle_cli]` recipe for maturin pypi packages** (#217). Opt-in declarative shape for libraries that ship a Rust CLI inside each wheel (the `ruff` / `uv` / `pydantic-core` pattern). Declare `bin`, `stage_to`, and optional `crate_path`; the reusable workflow cross-compiles the binary per target, stages it into the package source tree, and maturin picks it up via `[tool.maturin].include`. Requires `build = "maturin"` and non-empty `targets`. See [README → Recipes → Rust CLI inside a PyPI wheel](./README.md#rust-cli-inside-a-pypi-wheel). No behavior change for existing packages that don't declare the block.
 
@@ -21,6 +21,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 - **Public consumer surface collapsed to the README + the reusable workflow.** The CLI, the JS action (`action.yml`), and the diagnostic subcommands (`doctor`, `preflight`) are internal seams the reusable workflow invokes; consumers do not call them. The entire `docs/` directory is removed — `README.md` is the single user-facing surface. See [MIGRATIONS.md](./MIGRATIONS.md#public-surface-collapsed-to-a-reusable-workflow) for the before/after.
 - **Auth is OIDC trusted publishers only.** The reusable workflow does not pass long-lived registry tokens (`NPM_TOKEN`, `PYPI_API_TOKEN`, `CARGO_REGISTRY_TOKEN`) as secrets. The engine's env-var fallback code paths still exist (in `src/auth.ts`); they're just not reachable through the reusable workflow.
 - **Repository renamed `put-it-out-there` → `putitoutthere`.** GitHub auto-redirects the old slug, but consumers with the old URL pinned in `package.json`, `Cargo.toml`, `pyproject.toml`, or workflow files should update them. See [MIGRATIONS.md](./MIGRATIONS.md#repository-renamed-put-it-out-there--putitoutthere).
+- **BREAKING: `[[package]].paths` renamed to `[[package]].globs`.** The `path`/`paths` pair was confusing — singular and plural differed only in a trailing `s` while meaning two unrelated things (the package working directory vs. the cascade-trigger globs). Configs declaring `paths` now fail validation. See [MIGRATIONS.md](./MIGRATIONS.md#package-paths-renamed-to-globs).
 
 ### Deprecated
 
@@ -33,6 +34,14 @@ are prefixed `**BREAKING**` and link to the matching section in
 - **`build_workflow:` config field.** Removed from the schema in `src/config.ts`; configs declaring it now fail validation.
 - **`putitoutthere init` subcommand** and the templates it scaffolded. Source removed (`src/init.ts`, `src/templates.ts`, plus tests, plus `--force` and `--cadence` flag plumbing).
 - **`migrations/` directory** moved to `notes/migrations-pre-rewrite/`. Stale plans drafted against the prior hand-written-`release.yml` model.
+- **`[package.trust_policy]` config block + the OIDC trust-policy diff machinery.** Removed: `src/oidc-policy.ts`, `src/registries/crates-trust.ts`, the `trust_policy` schema field, and the matching README section. The check was opt-in defensive validation — for npm + PyPI it could only verify "the workflow file you declared exists locally" (no public read API for trust-policy config), making it a typo-catcher rather than a real drift detector. crates.io's registry cross-check was the only path with real bug-catching power and required a separate `CRATES_IO_DOCTOR_TOKEN`. Net: false security; renaming `release.yml` still produces an HTTP 400 from the registry, which is the same UX as before and what every other tool gives you.
+- **`putitoutthere doctor` subcommand + `src/doctor.ts`.** Its main job was the trust-policy validation phases above. With those gone, doctor was checking workflow structural details that are already validated by the reusable workflow's own shape. Internal seam, no consumer use case.
+- **`putitoutthere preflight` subcommand + `src/preflight-run.ts`.** Standalone diagnostic CLI surface. The internal `requireAuth` check that gates `publish` is preserved (`src/preflight.ts` stays).
+- **`putitoutthere token` subcommand + `src/token.ts`, `src/token-scope.ts`.** The `token list` / `token inspect` operator-debugging surface was built when long-lived registry tokens were the norm. Under OIDC-only there's nothing to enumerate or scope-check at the env level. ~1,100 lines removed.
+- **`putitoutthere auth login/logout/status` subcommand + `src/auth.ts`, `src/keyring.ts`.** The GitHub App device-flow login existed solely to power `token list --secrets` (which fetched secret names via the GitHub API). With `token` removed, the App + keyring + device-flow plumbing is dead weight. ~500 lines removed. The `putitoutthere-cli` GitHub App registration is no longer used.
+- **`src/release.ts` (engine-side GitHub Release creation).** Duplicated by the reusable workflow's `gh release create --generate-notes` step. The engine cuts the tag and stops; the workflow owns the Release. ~129 lines removed.
+- **Dead config fields**: `cadence`, `agents_path`, `smoke`, `wheels_artifact`. Defined in the schema; never read anywhere in the engine.
+- **`--preflight-check` flag on `publish`.** The deep token-scope check it gated was the sole consumer of `src/token-scope.ts`. Same reason as the `token` subcommand removal: under OIDC-only there's no long-lived token to scope-check.
 
 ### Fixed
 

package/MIGRATIONS.md

@@ -21,6 +21,83 @@ Each section covers five things, in order:
 
 ## Unreleased
 
+### `[[package]].paths` renamed to `globs`
+
+**Summary.** The `path` / `paths` pair in `[[package]]` was confusing —
+singular and plural differed only in a trailing `s` while meaning two
+unrelated things (the package working directory vs. the cascade-trigger
+globs). Renaming `paths` → `globs` removes the trailing-S collision.
+
+**Required changes.**
+
+| Before | After |
+|-----|-----|
+| `paths = ["src/**", "pyproject.toml"]` | `globs = ["src/**", "pyproject.toml"]` |
+
+Every `[[package]]` block in `putitoutthere.toml` needs the rename.
+Configs declaring `paths` now fail validation under `.strict()`.
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** None — the field's semantics
+are unchanged.
+
+**Verification.** `pnpm exec putitoutthere plan` (or the next reusable-
+workflow run) loads cleanly. A config still declaring `paths` fails
+load with a Zod error pointing at the unknown key.
+
+### Removed: diagnostic CLI surface, GitHub-App auth, trust-policy validation
+
+**Summary.** Eight things removed in one pass, none consumer-observable
+under the new "reusable workflow + OIDC-only" surface:
+
+- `[package.trust_policy]` config block (false security: typo-catcher
+  for npm/PyPI; the only real check was the crates.io registry
+  cross-check, which required a separate token most consumers wouldn't
+  set up).
+- `putitoutthere doctor` subcommand (its main job was the trust-policy
+  validation above).
+- `putitoutthere preflight` subcommand (the internal `requireAuth`
+  gate inside `publish` is preserved).
+- `putitoutthere token list/inspect` subcommands (operator-debugging
+  surface for long-lived registry tokens — none exist under OIDC-only).
+- `putitoutthere auth login/logout/status` subcommands + the
+  `putitoutthere-cli` GitHub App's device-flow plumbing + the keyring
+  (only purpose was powering `token list --secrets`).
+- `src/release.ts` engine-side GitHub Release creation (duplicated by
+  the reusable workflow's `gh release create --generate-notes` step).
+- `publish --preflight-check` flag (deep token-scope check for
+  long-lived tokens; OIDC-only renders it moot).
+- Dead config fields: `cadence`, `agents_path`, `smoke`,
+  `wheels_artifact` — defined in the schema, never read.
+
+Net: ~2,800 lines of source removed, ~17% of `src/`.
+
+**Required changes.**
+
+| Before | After |
+|-----|-----|
+| `[package.trust_policy] workflow = "release.yml"` | Delete the block. Workflow renames still produce HTTP 400 from registries — same UX every other tool gives you. |
+| `putitoutthere doctor` / `preflight` / `token` / `auth` invocations in any consumer script | Remove. None of these are reachable through the reusable workflow; consumer-facing surface is the workflow itself. |
+| `cadence`, `agents_path`, `smoke`, `wheels_artifact` fields in `putitoutthere.toml` | Delete. They were never consumed; configs declaring them now fail validation under `.strict()`. |
+| `--preflight-check` flag passed to `publish` | Drop. Internal `requireAuth` still gates publish. |
+
+**Deprecations removed.** Everything in the list above.
+
+**Behavior changes without code changes.** Engine behavior on the
+plan / publish path is unchanged. `requireAuth` (the gate that
+catches missing OIDC env or missing token) still runs; the deep
+scope check (which required a long-lived token to inspect) no
+longer runs because there's no long-lived token to inspect. GitHub
+Release creation moves entirely to the reusable workflow's
+`gh release create` step — engines invoked outside that workflow
+(local dry-runs, custom integrations) no longer create Releases.
+
+**Verification.** A consumer who never used any of the removed
+surfaces sees no observable change. Consumers who used `doctor` or
+`token` subcommands see exit-1 + "unknown command"; switch to the
+reusable workflow.
+
 ### Public surface collapsed to a reusable workflow
 
 **Summary.** The consumer surface is now one line in a `release.yml`:
@@ -31,7 +108,7 @@ on:
 
 jobs:
   release:
-    uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v1
+    uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0
     permissions:
       contents: write
       id-token: write
@@ -52,7 +129,7 @@ for the authoritative non-goals.
 
 | Before (hand-written `release.yml`) | After |
 |-----|-----|
-| ~100 lines of YAML: plan/build/publish jobs, twine install, git identity, GitHub Release backfill, hand-pinned action majors | `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v1` |
+| ~100 lines of YAML: plan/build/publish jobs, twine install, git identity, GitHub Release backfill, hand-pinned action majors | `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0` |
 | `putitoutthere init` to scaffold the workflow | Subcommand removed; consumers add the snippet above by hand |
 | `[[package]].build_workflow = "publish-foo.yml"` for unsupported shapes | Removed. Shapes that don't fit piot's named build modes write their own release workflow that doesn't use piot |
 | Long-lived registry tokens (`NPM_TOKEN`, `PYPI_API_TOKEN`, `CARGO_REGISTRY_TOKEN`) passed to a hand-written publish step | Not reachable through the reusable workflow. Register an OIDC trusted publisher per registry once |
@@ -85,7 +162,7 @@ known-tested versions.
 
 - `pnpm test:unit` passes in the main repo.
 - A consumer's first cutover: drop in the 12-line `release.yml`
-  shown above, push a commit that touches a `[[package]].paths`
+  shown above, push a commit that touches a `[[package]].globs`
   glob, and watch for a tag push + GitHub Release on the next
   workflow run.
 
@@ -505,7 +582,7 @@ configurations are unchanged.
  kind       = "pypi"
  build      = "maturin"
  path       = "packages/python"
- paths      = ["packages/python/**"]
+ globs      = ["packages/python/**"]
  targets    = ["x86_64-unknown-linux-gnu", "aarch64-apple-darwin"]
 +
 +[package.bundle_cli]
@@ -525,7 +602,7 @@ And in the Python package's `pyproject.toml`:
 +include = ["...", "src/my_py/_binary/**"]  # ship the staged binary
 ```
 
-See [Polyglot Rust library → Shipping a Rust CLI inside the PyPI wheel](https://github.com/thekevinscott/putitoutthere/blob/main/docs/guide/shapes/polyglot-rust.md#shipping-a-rust-cli-inside-the-pypi-wheel)
+See [README → Rust CLI inside a PyPI wheel](https://github.com/thekevinscott/putitoutthere/blob/main/README.md#rust-cli-inside-a-pypi-wheel)
 for the full worked example including the launcher stub.
 
 **Deprecations removed.** None.

package/README.md

@@ -3,7 +3,7 @@
 A reusable GitHub Actions workflow that publishes packages to crates.io, PyPI,
 and npm from one repo. OIDC-first, cascade-aware, polyglot. The consumer
 surface is one config file plus ~10 lines of YAML calling
-`uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v1`.
+`uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0`.
 
 ## Quickstart
 
@@ -18,7 +18,7 @@ on:
 
 jobs:
   release:
-    uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v1
+    uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0
     permissions:
       contents: write
       id-token: write
@@ -45,13 +45,13 @@ version = 1
 name  = "my-lib"
 kind  = "pypi"        # or "npm" | "crates"
 path  = "."
-paths = ["src/**", "pyproject.toml"]
+globs = ["src/**", "pyproject.toml"]
 build = "hatch"       # required for kind = "pypi"
 tag_format = "v{version}"   # single-package repos often want this
 ```
 
-`paths` are the globs that trigger a release. Any commit touching a matching
-file makes the package a candidate.
+`globs` are the path globs that trigger a release. Any commit touching a
+matching file makes the package a candidate.
 
 More config patterns are in [Configuration](#configuration) below.
 
@@ -63,7 +63,7 @@ registry.
 
 ### 4. Push a release
 
-Merge to `main`. Default behavior: any package whose `paths` matched changed
+Merge to `main`. Default behavior: any package whose `globs` matched changed
 files cascades and ships at `patch`. To bump `minor` or `major`:
 
 ```
@@ -92,11 +92,10 @@ version = 1   # required; only 1 is valid today
 | `name`          | string   | yes      | Unique across the config.                         |
 | `kind`          | enum     | yes      | `crates` \| `pypi` \| `npm`.                      |
 | `path`          | string   | yes      | Package working dir (`Cargo.toml` / `pyproject.toml` / `package.json` location). |
-| `paths`         | string[] | yes      | Globs that cascade this package.                  |
+| `globs`         | string[] | yes      | Path globs that cascade this package.             |
 | `depends_on`    | string[] | no       | Package names this one cascades on top of.        |
 | `first_version` | string   | no       | Default `0.1.0`.                                  |
 | `tag_format`    | string   | no       | Template for the git tag. Default `"{name}-v{version}"`. Single-package repos often want `"v{version}"`. |
-| `trust_policy`  | table    | no       | Declared OIDC trust-policy expectations. See [Trusted publishers](#trusted-publishers). |
 
 ### `kind = "crates"`
 
@@ -134,13 +133,13 @@ One Rust crate feeds three artifacts:
 name = "my-rust"
 kind = "crates"
 path = "crates/my-rust"
-paths = ["crates/my-rust/**"]
+globs = ["crates/my-rust/**"]
 
 [[package]]
 name       = "my-py"
 kind       = "pypi"
 path       = "py/my-py"
-paths      = ["py/my-py/**"]
+globs      = ["py/my-py/**"]
 build      = "maturin"
 targets    = ["x86_64-unknown-linux-gnu", "aarch64-apple-darwin"]
 depends_on = ["my-rust"]
@@ -149,7 +148,7 @@ depends_on = ["my-rust"]
 name       = "my-cli"
 kind       = "npm"
 path       = "packages/ts"
-paths      = ["packages/ts/**"]
+globs      = ["packages/ts/**"]
 build      = "bundled-cli"
 targets    = ["x86_64-unknown-linux-gnu", "aarch64-apple-darwin"]
 depends_on = ["my-rust"]
@@ -165,20 +164,20 @@ wheels and npm family ship on top, version-bumped to match.
 name  = "@my/core"
 kind  = "npm"
 path  = "packages/core"
-paths = ["packages/core/**"]
+globs = ["packages/core/**"]
 
 [[package]]
 name       = "@my/parser"
 kind       = "npm"
 path       = "packages/parser"
-paths      = ["packages/parser/**"]
+globs      = ["packages/parser/**"]
 depends_on = ["@my/core"]
 ```
 
 ## Trailer
 
 The trailer is **optional**. Default behavior is `patch` whenever a package's
-`paths` matched changed files.
+`globs` matched changed files.
 
 Grammar:
 
@@ -203,7 +202,7 @@ are present, the **last** one wins.
 ## Cascade
 
 A package cascades into the release plan when a commit changes any file
-matching one of its `paths` globs since its last tag. If another package
+matching one of its `globs` since its last tag. If another package
 declares `depends_on = ["this-package"]`, that package also cascades.
 Transitively, DFS-ordered, with cycle detection at config-load.
 
@@ -251,31 +250,6 @@ filename (`release.yml`), and optionally a GitHub environment name.
 3. Fill in: repository, workflow filename, environment (optional).
 4. Delete the bootstrap token.
 
-### Catching trust-policy drift before release
-
-Renaming `release.yml` to anything else, or renaming the environment, breaks
-publish with an opaque HTTP 400 from the registry. To catch the rename
-before it ships, declare the expected values in `putitoutthere.toml`:
-
-```toml
-[[package]]
-name = "my-crate"
-kind = "crates"
-path = "crates/my-crate"
-paths = ["crates/my-crate/**"]
-
-[package.trust_policy]
-workflow    = "release.yml"      # required; bare filename
-environment = "release"          # optional
-repository  = "my-org/my-crate"  # optional
-```
-
-The engine diffs the declaration against the local workflow file and (in CI)
-against `GITHUB_WORKFLOW_REF` before any registry call. For `kind = "crates"`,
-a registry cross-check runs when `CRATES_IO_DOCTOR_TOKEN` is set — calls the
-trusted-publishing read API and fails on mismatch. PyPI and npm don't expose
-read APIs for trust policy, so the declared diff is the full gate there.
-
 ## Recipes
 
 ### Bundled-CLI npm family
@@ -293,7 +267,7 @@ kind  = "npm"
 npm   = "my-cli"
 build = "bundled-cli"
 path  = "packages/ts-cli"
-paths = ["packages/ts-cli/**", "crates/my-cli/**"]
+globs = ["packages/ts-cli/**", "crates/my-cli/**"]
 targets = [
   "x86_64-unknown-linux-gnu",
   "aarch64-unknown-linux-gnu",
@@ -363,7 +337,7 @@ name  = "my-py"
 kind  = "pypi"
 build = "maturin"
 path  = "packages/python"
-paths = ["packages/python/**", "crates/my-rust/**"]
+globs = ["packages/python/**", "crates/my-rust/**"]
 targets = [
   "x86_64-unknown-linux-gnu",
   "aarch64-unknown-linux-gnu",

package/action.yml

@@ -1,5 +1,5 @@
 name: 'Put It Out There (internal)'
-description: 'Internal step-level wrapper around the putitoutthere CLI. Consumers compose with the reusable workflow at .github/workflows/release.yml@v1, not with this action directly. See notes/design-commitments.md non-goal #10.'
+description: 'Internal step-level wrapper around the putitoutthere CLI. Consumers compose with the reusable workflow at .github/workflows/release.yml@v0, not with this action directly. See notes/design-commitments.md non-goal #10.'
 author: 'Kevin Scott'
 
 inputs:

package/dist/cascade.d.ts

@@ -3,7 +3,7 @@
  * the last release, returns the packages that will release.
  *
  * Two passes (plan.md §11.1):
- *   1. Direct match: every package whose `paths` globs intersect the
+ *   1. Direct match: every package whose `globs` intersect the
  *      files changed since *its own* last tag is cascaded.
  *   2. Transitive match: repeat until stable — any package whose
  *      `depends_on` list contains an already-cascaded package gets

package/dist/cascade.js

@@ -3,7 +3,7 @@
  * the last release, returns the packages that will release.
  *
  * Two passes (plan.md §11.1):
- *   1. Direct match: every package whose `paths` globs intersect the
+ *   1. Direct match: every package whose `globs` intersect the
  *      files changed since *its own* last tag is cascaded.
  *   2. Transitive match: repeat until stable — any package whose
  *      `depends_on` list contains an already-cascaded package gets
@@ -35,7 +35,7 @@ export function computeCascade(packages, changedFilesByPackage) {
         if (!files)
             continue;
         for (const f of files) {
-            if (matchesAny(p.paths, f)) {
+            if (matchesAny(p.globs, f)) {
                 cascaded.add(p.name);
                 break;
             }

package/dist/cli.d.ts

@@ -4,6 +4,11 @@
  * facing surface; flags / help text are stable enough to test, but
  * not promised externally. See `notes/design-commitments.md`.
  *
+ * Commands:
+ *   plan       — compute and emit the release plan
+ *   publish    — execute the plan against the registries
+ *   version    — print CLI version
+ *
  * Global flags:
  *   --cwd <path>      working directory (default: process.cwd())
  *   --config <path>   path to putitoutthere.toml

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6GH,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyTlE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA2DH,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+FlE"}