putitoutthere 0.1.48 → 0.1.49

package/CHANGELOG.md

@@ -12,12 +12,14 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Added
 
+- **`workflow_call` output `has_pypi`.** The reusable workflow now emits a string `'true'`/`'false'` indicating whether the planned matrix contains any `kind = "pypi"` rows. Consumers gate their caller-side `pypi-publish` job on this so non-PyPI repos paste the canonical template verbatim without paying any runtime cost. Computed in the `plan` job from the matrix output.
 - **Reusable workflow `.github/workflows/release.yml` (`workflow_call`).** The single user-facing surface. Consumer integration is one `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0` line in their own `release.yml`; pinned action versions, plan/build/publish orchestration, and GitHub Release creation all live inside. Three optional inputs: `environment` (default `release`), `node_version` (default `24`), `python_version` (default `3.12`). No `dry_run`, `working_directory`, or `config` inputs — the plan job is already side-effect-free, the config file is `putitoutthere.toml` at the repo root, period. The engine is invoked via `uses: thekevinscott/putitoutthere@v0` so the workflow file and the engine always agree on a single git ref.
 
 - **`[package.bundle_cli]` recipe for maturin pypi packages** (#217). Opt-in declarative shape for libraries that ship a Rust CLI inside each wheel (the `ruff` / `uv` / `pydantic-core` pattern). Declare `bin`, `stage_to`, and optional `crate_path`; the reusable workflow cross-compiles the binary per target, stages it into the package source tree, and maturin picks it up via `[tool.maturin].include`. Requires `build = "maturin"` and non-empty `targets`. See [README → Recipes → Rust CLI inside a PyPI wheel](./README.md#rust-cli-inside-a-pypi-wheel). No behavior change for existing packages that don't declare the block.
 
 ### Changed
 
+- **BREAKING: PyPI uploads moved to a caller-side `pypi-publish` job.** PyPI's Trusted Publisher matching filters candidates by `repository_owner` + `repository_name` *before* checking `job_workflow_ref` ([Warehouse implementation](https://github.com/pypi/warehouse/blob/main/warehouse/oidc/models/github.py)); since the OIDC `repository` claim always reflects the caller's repo even inside a reusable workflow, a TP registered against `thekevinscott/putitoutthere` is filtered out before the workflow_ref is ever checked. PyPI explicitly documents this as unsupported ([troubleshooting](https://docs.pypi.org/trusted-publishers/troubleshooting/)). Tracked at [pypi/warehouse#11096](https://github.com/pypi/warehouse/issues/11096), no timeline. The engine still does plan + build + version-rewrite + git tag for PyPI; the actual upload (`pypa/gh-action-pypi-publish`) now runs in the consumer's workflow file as a second job, gated on `needs.release.outputs.has_pypi`. The canonical template grew from ~12 → ~30 lines but remains a single copy-paste — the `if:` skips the job for non-PyPI repos. See [MIGRATIONS.md](./MIGRATIONS.md#pypi-uploads-moved-to-caller-side-job) and [`notes/audits/2026-04-28-pypi-tp-reusable-workflow-constraint.md`](./notes/audits/2026-04-28-pypi-tp-reusable-workflow-constraint.md).
 - **Public consumer surface collapsed to the README + the reusable workflow.** The CLI, the JS action (`action.yml`), and the diagnostic subcommands (`doctor`, `preflight`) are internal seams the reusable workflow invokes; consumers do not call them. The entire `docs/` directory is removed — `README.md` is the single user-facing surface. See [MIGRATIONS.md](./MIGRATIONS.md#public-surface-collapsed-to-a-reusable-workflow) for the before/after.
 - **Auth is OIDC trusted publishers only.** The reusable workflow does not pass long-lived registry tokens (`NPM_TOKEN`, `PYPI_API_TOKEN`, `CARGO_REGISTRY_TOKEN`) as secrets. The engine's env-var fallback code paths still exist (in `src/auth.ts`); they're just not reachable through the reusable workflow.
 - **Repository renamed `put-it-out-there` → `putitoutthere`.** GitHub auto-redirects the old slug, but consumers with the old URL pinned in `package.json`, `Cargo.toml`, `pyproject.toml`, or workflow files should update them. See [MIGRATIONS.md](./MIGRATIONS.md#repository-renamed-put-it-out-there--putitoutthere).

package/MIGRATIONS.md

@@ -21,6 +21,108 @@ Each section covers five things, in order:
 
 ## Unreleased
 
+### PyPI uploads moved to caller-side job
+
+**Summary.** PyPI's Trusted Publisher matching filters candidates by
+`repository_owner` + `repository_name` *before* checking
+`job_workflow_ref`
+([Warehouse implementation](https://github.com/pypi/warehouse/blob/main/warehouse/oidc/models/github.py)).
+The OIDC `repository` claim always reflects the caller's repo —
+including inside a reusable workflow — so a TP registered against
+the reusable workflow's repo is filtered out before workflow_ref
+is even checked. PyPI documents this as unsupported
+([troubleshooting](https://docs.pypi.org/trusted-publishers/troubleshooting/)).
+Tracked at [pypi/warehouse#11096](https://github.com/pypi/warehouse/issues/11096),
+no timeline.
+
+To preserve OIDC trusted publishing for PyPI without setting
+`PYPI_API_TOKEN`, the upload step (`pypa/gh-action-pypi-publish`)
+now runs in the consumer's own workflow file as a second job,
+gated on the new `has_pypi` output. The engine still owns plan,
+build, version-rewrite, and git-tag creation for PyPI rows; only
+the actual upload moves. See
+[`notes/audits/2026-04-28-pypi-tp-reusable-workflow-constraint.md`](./notes/audits/2026-04-28-pypi-tp-reusable-workflow-constraint.md)
+for the full diagnosis.
+
+**Required changes.** Update `.github/workflows/release.yml`:
+
+Before (~12 lines):
+
+```yaml
+name: Release
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0
+    permissions:
+      contents: write
+      id-token: write
+```
+
+After (~30 lines, single copy-paste from README → Quickstart):
+
+```yaml
+name: Release
+on:
+  push:
+    branches: [main]
+jobs:
+  release:
+    uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0
+    permissions:
+      contents: write
+      id-token: write
+
+  pypi-publish:
+    needs: release
+    if: needs.release.outputs.has_pypi == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: '*-sdist'
+          path: dist/
+          merge-multiple: true
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: '*-wheel-*'
+          path: dist/
+          merge-multiple: true
+      - uses: pypa/gh-action-pypi-publish@release/v1
+```
+
+The `pypi-publish` job's `if:` gate skips it for non-PyPI repos —
+paste verbatim regardless of what you publish. Crates.io and npm
+are unaffected; their TP claim semantics work fine inside the
+reusable workflow.
+
+**No PyPI TP re-registration required.** Your existing TP
+registration (against your repo, your `release.yml`, optional
+environment) was already correct for this pattern. If you'd
+attempted to register a TP against `thekevinscott/putitoutthere`
+to work around the prior failure, remove that entry — it would
+have never matched anyway.
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** PyPI upload step now
+runs in the consumer's workflow context. The reusable workflow's
+publish job no longer installs `twine` or `setup-python`; engine
+log lines for PyPI rows now read "delegated to caller-side upload
+step" instead of "authenticating via OIDC".
+
+**Verification.** Push a release. The reusable workflow's
+`release` job creates and pushes the git tag for PyPI rows; the
+caller's `pypi-publish` job runs `pypa/gh-action-pypi-publish`
+and uploads to PyPI. Check `https://pypi.org/project/<name>/<version>/`
+to confirm.
+
+---
+
 ### PyPI artifact discovery matches `{name}-sdist` and `{name}-wheel-` exactly
 
 **Summary.** `src/handlers/pypi.ts:collectArtifacts` used a bare prefix

package/README.md

@@ -2,7 +2,7 @@
 
 A reusable GitHub Actions workflow that publishes packages to crates.io, PyPI,
 and npm from one repo. OIDC-first, cascade-aware, polyglot. The consumer
-surface is one config file plus ~10 lines of YAML calling
+surface is one config file plus one canonical YAML calling
 `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0`.
 
 ## Quickstart
@@ -22,10 +22,41 @@ jobs:
     permissions:
       contents: write
       id-token: write
+
+  # PyPI upload runs in the caller's workflow context. Required because
+  # PyPI Trusted Publishers can't validate OIDC tokens minted from a
+  # cross-repo reusable workflow (pypi/warehouse#11096). The `if:`
+  # gate skips this job for non-PyPI repos — paste verbatim regardless
+  # of what you publish.
+  pypi-publish:
+    needs: release
+    if: needs.release.outputs.has_pypi == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: '*-sdist'
+          path: dist/
+          merge-multiple: true
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: '*-wheel-*'
+          path: dist/
+          merge-multiple: true
+      - uses: pypa/gh-action-pypi-publish@release/v1
 ```
 
 Pinned action versions, `plan → build → publish` orchestration, and GitHub
-Release creation all live inside the reusable workflow.
+Release creation all live inside the reusable workflow. The `pypi-publish`
+job is the one piece that has to live in your workflow file: PyPI's
+Trusted Publisher feature filters OIDC tokens by `repository_owner` /
+`repository_name` claims, which always reflect the caller's repo — so a
+TP registered against `thekevinscott/putitoutthere` is filtered out
+before `job_workflow_ref` is even checked. Running `pypa/gh-action-pypi-publish`
+in your workflow context aligns the claims with your TP registration.
+The job is skipped automatically for repos that don't publish to PyPI.
 
 Optional inputs — `with:` block at the call site:
 
@@ -216,11 +247,14 @@ releases without fighting registry-immutable-publish semantics.
 
 ## Trusted publishers
 
-OIDC trusted publishers — the only auth path supported by the reusable
-workflow. Long-lived registry tokens are not reachable through the workflow.
+OIDC trusted publishers — the only auth path supported. Long-lived
+registry tokens are not reachable through the workflow.
 
-The fields each registry needs are the same: repository owner/name, workflow
-filename (`release.yml`), and optionally a GitHub environment name.
+For all three registries the fields are the same: **your** repository
+owner/name, **your** workflow filename (`release.yml`), and optionally
+a GitHub environment name. Note: you register against your *own*
+repository, not against `thekevinscott/putitoutthere` — see "How
+auth flows" below for the why.
 
 ### crates.io
 
@@ -228,15 +262,15 @@ filename (`release.yml`), and optionally a GitHub environment name.
    exists. (Trusted publishing needs a crate owner record.)
 2. Go to `https://crates.io/crates/<crate>/settings` → **Trusted Publishing**
    → **Add**.
-3. Fill in: repository owner, repository name, workflow filename
+3. Fill in: your repo owner, your repo name, workflow filename
    (`release.yml`), environment (optional).
 
 ### PyPI
 
 1. Go to `https://pypi.org/manage/project/<name>/settings/publishing/` (or
    **Publishing** on the project page).
-2. Add a **GitHub** trusted publisher: owner, repo, workflow filename,
-   environment (optional).
+2. Add a **GitHub** trusted publisher: your repo owner, your repo name,
+   workflow filename (`release.yml`), environment (optional).
 3. Brand-new project? Use a [pending publisher](https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/)
    to skip the bootstrap token.
 
@@ -247,9 +281,33 @@ filename (`release.yml`), and optionally a GitHub environment name.
    publisher requires an existing package.)
 2. Go to `https://www.npmjs.com/package/<name>/access` → **Require trusted
    publisher**.
-3. Fill in: repository, workflow filename, environment (optional).
+3. Fill in: your repository, workflow filename (`release.yml`),
+   environment (optional).
 4. Delete the bootstrap token.
 
+### How auth flows
+
+`crates.io` and `npm` validate OIDC tokens that are minted by the
+reusable workflow's `publish` job. The reusable workflow already
+sits in your release path, so the OIDC `repository` and
+`job_workflow_ref` claims line up with your TP registration.
+
+PyPI is different. Its TP matching filters candidates by
+`repository_owner` + `repository_name` *before* checking
+`job_workflow_ref` ([Warehouse implementation](https://github.com/pypi/warehouse/blob/main/warehouse/oidc/models/github.py)).
+The `repository` claim always reflects the caller's repo — even
+inside a reusable workflow — so a TP registered against the
+reusable workflow's repo would be filtered out before
+`job_workflow_ref` is even checked. PyPI documents this:
+"[Reusable workflows cannot currently be used as the workflow in
+a Trusted Publisher.](https://docs.pypi.org/trusted-publishers/troubleshooting/)"
+Tracked at [pypi/warehouse#11096](https://github.com/pypi/warehouse/issues/11096).
+
+That's why the canonical template puts the PyPI upload step
+(`pypa/gh-action-pypi-publish`) directly in *your* workflow,
+gated on `needs.release.outputs.has_pypi`. In your workflow context
+both claims resolve to your repo, so your TP registration matches.
+
 ## Recipes
 
 ### Bundled-CLI npm family

package/dist/error-codes.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Stable error-code vocabulary.
+ *
+ * User-facing errors and GitHub Actions `::error::` annotations carry
+ * one of these codes so external observers — humans grepping the run
+ * log, foreign LLM agents debugging a failed publish, the docs site
+ * deep-linking from a code to a recipe — can fingerprint the failure
+ * mode without parsing free-form prose.
+ *
+ * Codes are deliberately verbose. The string is the diagnostic; brevity
+ * here just creates ambiguity at a distance.
+ *
+ * Adding a new code: add it to BOTH `ErrorCodes` and `ALL_ERROR_CODES`;
+ * the test in `error-codes.test.ts` enforces parity. Once a code ships
+ * in a public-surfaced error message it becomes a stable identifier —
+ * rename only with a migration entry.
+ */
+export declare const ErrorCodes: {
+    /** Generic auth failure when no registry token resolved. Used by
+     *  npm/crates handlers; PyPI no longer surfaces this code (the
+     *  upload moved to a caller-side job per the reusable-workflow
+     *  TP constraint — see notes/audits/). */
+    readonly AUTH_NO_TOKEN: "PIOT_AUTH_NO_TOKEN";
+};
+export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
+/**
+ * Iterable form of the codes. Walked by tests for uniqueness/format
+ * checks and by future tooling that renders a code reference table.
+ */
+export declare const ALL_ERROR_CODES: readonly ErrorCode[];
+//# sourceMappingURL=error-codes.d.ts.map

package/dist/error-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;CAElC,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EAE/C,CAAC"}

package/dist/error-codes.js

@@ -0,0 +1,32 @@
+/**
+ * Stable error-code vocabulary.
+ *
+ * User-facing errors and GitHub Actions `::error::` annotations carry
+ * one of these codes so external observers — humans grepping the run
+ * log, foreign LLM agents debugging a failed publish, the docs site
+ * deep-linking from a code to a recipe — can fingerprint the failure
+ * mode without parsing free-form prose.
+ *
+ * Codes are deliberately verbose. The string is the diagnostic; brevity
+ * here just creates ambiguity at a distance.
+ *
+ * Adding a new code: add it to BOTH `ErrorCodes` and `ALL_ERROR_CODES`;
+ * the test in `error-codes.test.ts` enforces parity. Once a code ships
+ * in a public-surfaced error message it becomes a stable identifier —
+ * rename only with a migration entry.
+ */
+export const ErrorCodes = {
+    /** Generic auth failure when no registry token resolved. Used by
+     *  npm/crates handlers; PyPI no longer surfaces this code (the
+     *  upload moved to a caller-side job per the reusable-workflow
+     *  TP constraint — see notes/audits/). */
+    AUTH_NO_TOKEN: 'PIOT_AUTH_NO_TOKEN',
+};
+/**
+ * Iterable form of the codes. Walked by tests for uniqueness/format
+ * checks and by future tooling that renders a code reference table.
+ */
+export const ALL_ERROR_CODES = [
+    ErrorCodes.AUTH_NO_TOKEN,
+];
+//# sourceMappingURL=error-codes.js.map

package/dist/error-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;CAC3B,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,UAAU,CAAC,aAAa;CACzB,CAAC"}

package/dist/handlers/pypi.d.ts

@@ -1,19 +1,38 @@
 /**
  * PyPI handler.
  *
- * Issue #17. Plan: §6.4, §12.2, §12.3, §13.1, §14.5, §16.1.
+ * **Architectural note (2026-04-28).** PyPI's Trusted Publisher matching
+ * filters candidate publishers by `repository_owner` + `repository_name`
+ * before checking `job_workflow_ref`. When OIDC tokens are minted from
+ * inside a cross-repo reusable workflow, the `repository` claim is the
+ * *caller's* repo and `job_workflow_ref` is the reusable workflow's
+ * path — so a TP registered against the reusable workflow's repo is
+ * filtered out before workflow_ref is even checked. PyPI documents this
+ * as unsupported and tracks the fix at pypi/warehouse#11096 (no
+ * timeline). See `notes/audits/2026-04-28-pypi-tp-reusable-workflow-
+ * constraint.md`.
+ *
+ * Consequence for `putitoutthere`: the engine cannot upload to PyPI
+ * from inside the reusable workflow's publish job. The actual upload
+ * is delegated to a caller-side `pypi-publish` job that runs
+ * `pypa/gh-action-pypi-publish` from the consumer's own workflow
+ * context (where both `repository` and `job_workflow_ref` align with
+ * the consumer's repo + their TP registration). The reusable workflow
+ * still emits the matrix, builds artifacts, and creates+pushes git
+ * tags; only the upload step moves.
  *
- * Publish model: twine upload. The workflow is responsible for wiring
- * up PYPI_API_TOKEN (either from a classic secret or via a
- * trusted-publisher-backed OIDC exchange step that populates the env
- * before pilot runs). Full in-handler OIDC exchange is deferred --
- * the gh-action-pypi-publish step handles that cleanly for v0.
+ * The handler therefore:
+ *  - `isPublished`: unchanged. Public PyPI HEAD; no auth needed.
+ *  - `writeVersion`: unchanged. Rewrites `[project].version` in-place
+ *    or logs a SETUPTOOLS_SCM hint for dynamic-version projects.
+ *  - `publish`: NO upload. Returns `{ status: 'published' }` so
+ *    `publish.ts` creates+pushes the git tag. The tag is the engine's
+ *    record-of-intent; the caller's `pypi-publish` job performs the
+ *    actual upload using `pypa/gh-action-pypi-publish` (which is
+ *    idempotent, so a transient caller-side failure is recoverable
+ *    by re-triggering).
  *
- * Artifact discovery: scans `ctx.artifactsRoot` for directories named
- * `{pkg.name}-*` (the artifact naming contract from §12.4). Uploads
- * all `.whl` and `.tar.gz` files found under those directories. Fails
- * loud if nothing's found -- the completeness check (#13) should have
- * caught that earlier, but defense in depth.
+ * Issue #17. Plan: §6.4, §12.2, §12.3, §13.1, §14.5, §16.1.
  */
 import type { Handler } from '../types.js';
 /**

package/dist/handlers/pypi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pypi.d.ts","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,KAAK,EAAO,OAAO,EAAiB,MAAM,aAAa,CAAC;AAsO/D;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa/E;AAaD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAqDD,eAAO,MAAM,IAAI,EAAE,OAKlB,CAAC"}
+{"version":3,"file":"pypi.d.ts","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAOH,OAAO,KAAK,EAAO,OAAO,EAAiB,MAAM,aAAa,CAAC;AAkI/D;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa/E;AAaD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,eAAO,MAAM,IAAI,EAAE,OAKlB,CAAC"}

package/dist/handlers/pypi.js

@@ -1,27 +1,43 @@
 /**
  * PyPI handler.
  *
- * Issue #17. Plan: §6.4, §12.2, §12.3, §13.1, §14.5, §16.1.
+ * **Architectural note (2026-04-28).** PyPI's Trusted Publisher matching
+ * filters candidate publishers by `repository_owner` + `repository_name`
+ * before checking `job_workflow_ref`. When OIDC tokens are minted from
+ * inside a cross-repo reusable workflow, the `repository` claim is the
+ * *caller's* repo and `job_workflow_ref` is the reusable workflow's
+ * path — so a TP registered against the reusable workflow's repo is
+ * filtered out before workflow_ref is even checked. PyPI documents this
+ * as unsupported and tracks the fix at pypi/warehouse#11096 (no
+ * timeline). See `notes/audits/2026-04-28-pypi-tp-reusable-workflow-
+ * constraint.md`.
+ *
+ * Consequence for `putitoutthere`: the engine cannot upload to PyPI
+ * from inside the reusable workflow's publish job. The actual upload
+ * is delegated to a caller-side `pypi-publish` job that runs
+ * `pypa/gh-action-pypi-publish` from the consumer's own workflow
+ * context (where both `repository` and `job_workflow_ref` align with
+ * the consumer's repo + their TP registration). The reusable workflow
+ * still emits the matrix, builds artifacts, and creates+pushes git
+ * tags; only the upload step moves.
  *
- * Publish model: twine upload. The workflow is responsible for wiring
- * up PYPI_API_TOKEN (either from a classic secret or via a
- * trusted-publisher-backed OIDC exchange step that populates the env
- * before pilot runs). Full in-handler OIDC exchange is deferred --
- * the gh-action-pypi-publish step handles that cleanly for v0.
+ * The handler therefore:
+ *  - `isPublished`: unchanged. Public PyPI HEAD; no auth needed.
+ *  - `writeVersion`: unchanged. Rewrites `[project].version` in-place
+ *    or logs a SETUPTOOLS_SCM hint for dynamic-version projects.
+ *  - `publish`: NO upload. Returns `{ status: 'published' }` so
+ *    `publish.ts` creates+pushes the git tag. The tag is the engine's
+ *    record-of-intent; the caller's `pypi-publish` job performs the
+ *    actual upload using `pypa/gh-action-pypi-publish` (which is
+ *    idempotent, so a transient caller-side failure is recoverable
+ *    by re-triggering).
  *
- * Artifact discovery: scans `ctx.artifactsRoot` for directories named
- * `{pkg.name}-*` (the artifact naming contract from §12.4). Uploads
- * all `.whl` and `.tar.gz` files found under those directories. Fails
- * loud if nothing's found -- the completeness check (#13) should have
- * caught that earlier, but defense in depth.
+ * Issue #17. Plan: §6.4, §12.2, §12.3, §13.1, §14.5, §16.1.
  */
-import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parse as parseToml } from 'smol-toml';
-import { sanitizeArtifactName } from '../config.js';
 import { TransientError } from '../types.js';
-import { buildSubprocessEnv, nonEmpty } from '../env.js';
 import { USER_AGENT } from '../version.js';
 const REGISTRY = 'https://pypi.org';
 async function isPublishedImpl(pkg, version, _ctx) {
@@ -105,69 +121,19 @@ async function publishImpl(pkg, version, ctx) {
     if (await isPublishedImpl(pkg, version, ctx)) {
         return { status: 'already-published' };
     }
-    const files = collectArtifacts(pkg.name, ctx.artifactsRoot);
-    if (files.length === 0) {
-        throw new Error(`pypi: no artifacts found for ${pkg.name} under ${ctx.artifactsRoot ?? '(artifactsRoot unset)'}`);
-    }
-    // Prefer OIDC trusted publishing; fall back to an explicit
-    // PYPI_API_TOKEN when the GHA OIDC env is absent or the mint
-    // exchange fails. Docs (docs/guide/auth.md) promise OIDC wins over
-    // PYPI_API_TOKEN so a stale repo secret can't shadow the
-    // short-lived path.
-    const oidcToken = await mintOidcToken(ctx);
-    const explicitToken = nonEmpty(ctx.env.PYPI_API_TOKEN) ?? nonEmpty(process.env.PYPI_API_TOKEN);
-    const token = oidcToken ?? explicitToken;
-    if (!token) {
-        throw new Error([
-            'pypi: no auth available. Either:',
-            '  - set PYPI_API_TOKEN (classic API token), or',
-            '  - enable trusted publishing: add `permissions.id-token: write` to the job and register a pending publisher on pypi.org.',
-            // Points consumers at the published auth guide, not internal plan
-            // docs (#149).
-            'See https://thekevinscott.github.io/putitoutthere/guide/auth for setup.',
-        ].join('\n'));
-    }
-    ctx.log.info(oidcToken ? 'pypi: authenticating via OIDC trusted publishing' : 'pypi: authenticating via PYPI_API_TOKEN');
-    try {
-        execFileSync('twine', ['upload', '--non-interactive', '--disable-progress-bar', '--verbose', ...files], {
-            cwd: ctx.cwd,
-            // #138: minimal env. Don't forward the whole parent process.env
-            // to twine.
-            env: buildSubprocessEnv(ctx.env, {
-                TWINE_USERNAME: '__token__',
-                TWINE_PASSWORD: token,
-            }),
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-    }
-    catch (err) {
-        // ENOENT = twine not on PATH. The scaffolded publish job is supposed
-        // to install it (setup-python + pip install twine), but an adopter
-        // running an older template or a hand-rolled workflow will hit this.
-        // Give them an actionable message instead of a cryptic ENOENT. #205.
-        if (err.code === 'ENOENT') {
-            throw new Error([
-                'pypi: twine not found on PATH (ENOENT).',
-                'The publish job must install it before invoking piot. Add:',
-                '  - uses: actions/setup-python@v5',
-                "    with: { python-version: '3.12' }",
-                '  - run: pip install twine',
-                'See https://thekevinscott.github.io/putitoutthere/guide/runner-prerequisites',
-            ].join('\n'), { cause: err });
-        }
-        const stderr = err.stderr?.toString('utf8').trim();
-        const stdout = err.stdout?.toString('utf8').trim();
-        const base = err instanceof Error ? err.message : String(err);
-        // Twine sometimes writes its actual failure (4xx/5xx body, render
-        // diagnostic, etc.) to stdout rather than stderr; surface both so
-        // adopters see the registry's response, not a bare "Command failed".
-        const parts = [`twine upload failed: ${base}`];
-        if (stderr)
-            parts.push(`--- stderr ---\n${stderr}`);
-        if (stdout)
-            parts.push(`--- stdout ---\n${stdout}`);
-        throw new Error(parts.join('\n'), { cause: err });
-    }
+    // No upload from here. The engine's role for PyPI is plan + build +
+    // version-rewrite + tag — the actual `pypa/gh-action-pypi-publish`
+    // call lives in the caller's `pypi-publish` job, where the OIDC
+    // claims align with their TP registration. Returning 'published'
+    // triggers `publish.ts` to create + push the git tag, which is the
+    // engine's record-of-intent and the signal the caller's job uses to
+    // know there's work to do.
+    ctx.log.info([
+        `pypi: ${pkg.name}@${version} delegated to caller-side upload step.`,
+        '  The engine creates and pushes the git tag from this job; the actual',
+        '  upload runs in your `pypi-publish` job via `pypa/gh-action-pypi-publish`.',
+        '  See README → "Publishing to PyPI" for the recipe.',
+    ].join('\n'));
     return {
         status: 'published',
         url: `${REGISTRY}/project/${pypiNameFor(pkg)}/${version}/`,
@@ -177,45 +143,6 @@ async function publishImpl(pkg, version, ctx) {
 function pypiNameFor(pkg) {
     return pkg.pypi ?? pkg.name;
 }
-/**
- * Trusted-publishing OIDC exchange. Returns a short-lived API token
- * from PyPI when the workflow exposes ACTIONS_ID_TOKEN_REQUEST_*; null
- * when the env isn't there or the exchange fails (caller decides
- * whether to error).
- */
-async function mintOidcToken(ctx) {
-    const reqUrl = nonEmpty(ctx.env.ACTIONS_ID_TOKEN_REQUEST_URL) ??
-        nonEmpty(process.env.ACTIONS_ID_TOKEN_REQUEST_URL);
-    const reqToken = nonEmpty(ctx.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) ??
-        nonEmpty(process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
-    if (!reqUrl || !reqToken)
-        return null;
-    const idTokenRes = await fetch(`${reqUrl}&audience=pypi`, {
-        headers: { authorization: `bearer ${reqToken}` },
-    });
-    if (!idTokenRes.ok) {
-        ctx.log.warn(`pypi: OIDC id-token request failed: ${idTokenRes.status}`);
-        return null;
-    }
-    const idTokenJson = (await idTokenRes.json());
-    const idToken = idTokenJson.value;
-    if (!idToken) {
-        ctx.log.warn('pypi: OIDC id-token response missing `value`');
-        return null;
-    }
-    const mintRes = await fetch(`${REGISTRY}/_/oidc/mint-token`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ token: idToken }),
-    });
-    if (!mintRes.ok) {
-        const body = await mintRes.text();
-        ctx.log.warn(`pypi: OIDC mint-token failed (${mintRes.status}): ${body.slice(0, 200)}`);
-        return null;
-    }
-    const mintJson = (await mintRes.json());
-    return mintJson.token ?? null;
-}
 /**
  * Rewrites the first `version = "x.y.z"` inside the `[project]` table.
  *
@@ -254,59 +181,6 @@ function projectDynamicIncludesVersion(project) {
 export function scmEnvSuffix(pkgName) {
     return pkgName.replace(/[-._]+/g, '_').toUpperCase();
 }
-/**
- * Collects `.whl` and `.tar.gz` files across every artifact subdir whose
- * name starts with the package's pilot name. Matches the artifact naming
- * contract from §12.4: `{name}-wheel-{target}` and `{name}-sdist`.
- */
-function collectArtifacts(pkgName, artifactsRoot) {
-    if (!artifactsRoot || !existsSync(artifactsRoot))
-        return [];
-    // #237: encode pkg.name so slash-containing names (e.g. `py/foo` →
-    // `py__foo`) line up with the on-disk directory the planner emitted.
-    // Match exactly the two artifact-name shapes the planner emits per
-    // §12.4: `{name}-sdist` (single dir) and `{name}-wheel-{target}` (one
-    // dir per wheel target). A bare prefix match would also pick up
-    // sibling packages whose names extend the same prefix
-    // (`foo-extras-sdist` matched as if it were `foo`'s sdist) — the
-    // tighter shape mirrors the documented contract.
-    const base = sanitizeArtifactName(pkgName);
-    const sdistDir = `${base}-sdist`;
-    const wheelPrefix = `${base}-wheel-`;
-    const out = [];
-    for (const entry of readdirSync(artifactsRoot)) {
-        if (entry !== sdistDir && !entry.startsWith(wheelPrefix))
-            continue;
-        const sub = join(artifactsRoot, entry);
-        /* v8 ignore next -- fs entries shouldn't vanish between readdir and stat */
-        if (!statSync(sub).isDirectory())
-            continue;
-        // #237: walk recursively so we tolerate any layout inside the
-        // artifact directory. upload-artifact's behavior differs per
-        // path-input shape (directory vs glob), so a flat `readdir` here
-        // would miss files that landed in a workspace-relative subdir.
-        for (const file of walkFiles(sub)) {
-            if (file.endsWith('.whl') || file.endsWith('.tar.gz')) {
-                out.push(file);
-            }
-        }
-    }
-    return out;
-}
-function walkFiles(dir) {
-    const out = [];
-    for (const entry of readdirSync(dir)) {
-        const full = join(dir, entry);
-        const st = statSync(full);
-        if (st.isDirectory()) {
-            out.push(...walkFiles(full));
-        }
-        else if (st.isFile()) {
-            out.push(full);
-        }
-    }
-    return out;
-}
 export const pypi = {
     kind: 'pypi',
     isPublished: isPublishedImpl,

package/dist/handlers/pypi.js.map

@@ -1 +1 @@
-{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,KAAK,UAAU,eAAe,CAC5B,GAAoC,EACpC,OAAe,EACf,IAAS;IAET,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,QAAQ,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;KACtC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yFAAyF;IACzF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoC,EACpC,OAAe,EACf,GAAQ;IAER,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,aAAa,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,OAAO,GAAI,MAA8C,EAAE,OAAO,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,uGAAuG,CACxG,CACF,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CACV;YACE,GAAG,GAAG,8DAA8D;YACpE,sBAAsB,OAAO,4CAA4C;YACzE,4CAA4C,SAAS,IAAI,OAAO,gCAAgC;YAChG,+DAA+D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,2BAA2B;YACxI,0FAA0F;YAC1F,4EAA4E;SAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAkD,EAClD,OAAe,EACf,GAAQ;IAER,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,aAAa,IAAI,uBAAuB,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,6DAA6D;IAC7D,mEAAmE;IACnE,yDAAyD;IACzD,oBAAoB;IACpB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,SAAS,IAAI,aAAa,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb;YACE,kCAAkC;YAClC,gDAAgD;YAChD,2HAA2H;YAC3H,kEAAkE;YAClE,eAAe;YACf,yEAAyE;SAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,SAAS,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,yCAAyC,CAC3G,CAAC;IAEF,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,EAAE;YACtG,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,gEAAgE;YAChE,YAAY;YACZ,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC/B,cAAc,EAAE,WAAW;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC;YACF,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb;gBACE,yCAAyC;gBACzC,4DAA4D;gBAC5D,mCAAmC;gBACnC,sCAAsC;gBACtC,4BAA4B;gBAC5B,8EAA8E;aAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,KAAK,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,GAAG,QAAQ,YAAY,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG;KAC3D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,WAAW,CAAC,GAAoC;IACvD,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,GAAQ;IACnC,MAAM,MAAM,GACV,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACrD,MAAM,QAAQ,GACZ,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAChD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE;QACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAuB,CAAC;IACpE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,oBAAoB,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuB,CAAC;IAC9D,OAAO,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,OAAe;IACrE,MAAM,EAAE,GAAG,uDAAuD,CAAC;IACnE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAwD,CAAC;IAC9F,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,OAA8B;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,aAAiC;IAC1E,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,gEAAgE;IAChE,sDAAsD;IACtD,iEAAiE;IACjE,iDAAiD;IACjD,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,GAAG,IAAI,QAAQ,CAAC;IACjC,MAAM,WAAW,GAAG,GAAG,IAAI,SAAS,CAAC;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACvC,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC3C,8DAA8D;QAC9D,6DAA6D;QAC7D,iEAAiE;QACjE,+DAA+D;QAC/D,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAY;IAC3B,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,WAAW;CACrB,CAAC"}
+{"version":3,"file":"pypi.js","sourceRoot":"","sources":["../../src/handlers/pypi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,KAAK,UAAU,eAAe,CAC5B,GAAoC,EACpC,OAAe,EACf,IAAS;IAET,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,QAAQ,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;KACtC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yFAAyF;IACzF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAoC,EACpC,OAAe,EACf,GAAQ;IAER,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,aAAa,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,OAAO,GAAI,MAA8C,EAAE,OAAO,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,uGAAuG,CACxG,CACF,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,+DAA+D;IAC/D,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CACV;YACE,GAAG,GAAG,8DAA8D;YACpE,sBAAsB,OAAO,4CAA4C;YACzE,4CAA4C,SAAS,IAAI,OAAO,gCAAgC;YAChG,+DAA+D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,2BAA2B;YACxI,0FAA0F;YAC1F,4EAA4E;SAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAkD,EAClD,OAAe,EACf,GAAQ;IAER,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,IAAI,CACV;QACE,SAAS,GAAG,CAAC,IAAI,IAAI,OAAO,wCAAwC;QACpE,uEAAuE;QACvE,6EAA6E;QAC7E,qDAAqD;KACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,GAAG,QAAQ,YAAY,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG;KAC3D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,WAAW,CAAC,GAAoC;IACvD,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,OAAe;IACrE,MAAM,EAAE,GAAG,uDAAuD,CAAC;IACnE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAwD,CAAC;IAC9F,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,OAA8B;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAY;IAC3B,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,WAAW;CACrB,CAAC"}

package/dist/publish.d.ts

@@ -15,7 +15,7 @@
  *
  * Issue #22.
  */
-import type { Handler, PublishResult } from './types.js';
+import { type Handler, type PublishResult } from './types.js';
 export interface PublishOptions {
     cwd: string;
     configPath?: string;

package/dist/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,OAAO,KAAK,EAAO,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA+G1E"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAmH1E"}

package/dist/publish.js

@@ -25,6 +25,7 @@ import { plan } from './plan.js';
 import { formatTag } from './tag-template.js';
 import { requireAuth } from './preflight.js';
 import { withRetry } from './retry.js';
+import { readHandlerMeta } from './types.js';
 import { dumpFailure } from './verbose.js';
 export async function publish(opts) {
     const cwd = opts.cwd;
@@ -112,6 +113,9 @@ export async function publish(opts) {
         }
         catch (err) {
             const error = err instanceof Error ? err : new Error(String(err));
+            // Phase 2 / Idea 9: handler-attached metadata (tool versions, etc.)
+            // rides through to the failure renderer.
+            const meta = readHandlerMeta(error);
             dumpFailure(error, {
                 package: name,
                 handler: pkg.kind,
@@ -119,6 +123,7 @@ export async function publish(opts) {
                 stdout: '',
                 stderr: error.message,
                 exitCode: -1,
+                ...(meta?.toolVersions ? { toolVersions: meta.toolVersions } : {}),
             }, 
             // Thread ctx.env through so handler-injected credentials (OIDC-
             // minted twine/npm/crates tokens that live only on ctx.env, not

package/dist/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;SAClC,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;aACb;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;SAClC,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/types.d.ts

@@ -99,4 +99,26 @@ export declare class AuthError extends Error {
 export declare class TransientError extends Error {
     readonly name = "TransientError";
 }
+/**
+ * Diagnostic metadata a handler can attach to a thrown error so the
+ * failure renderer (`verbose.ts:dumpFailure`) can surface tool versions
+ * and other context without requiring every handler to plumb its own
+ * dump call. Phase 2 / Idea 9.
+ *
+ * Attached via `attachHandlerMeta(err, ...)` and read at the publish
+ * boundary via `readHandlerMeta(err)`.
+ */
+export interface HandlerErrorMeta {
+    /** `{tool: "tool --version output"}`. Examples: `twine`, `python`,
+     *  `npm`, `cargo`. Capture is best-effort — keys may be absent if
+     *  the tool isn't on PATH or its version probe failed. */
+    toolVersions?: Record<string, string>;
+}
+/** Attach handler-failure metadata to an Error and return the same
+ *  Error (so callers can `throw attachHandlerMeta(new Error(...), {...})`). */
+export declare function attachHandlerMeta<E extends Error>(err: E, meta: HandlerErrorMeta): E;
+/** Read handler-failure metadata from a possibly-Error value. Returns
+ *  undefined for non-Error values, plain Errors, and Errors without
+ *  attached meta. */
+export declare function readHandlerMeta(value: unknown): HandlerErrorMeta | undefined;
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAKvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,oDAAoD;AACpD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,yDAAyD;IACzD,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E,SAAS,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjF;AAED,2CAA2C;AAC3C,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,eAAe;CACtC;AAED,4DAA4D;AAC5D,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,oBAAoB;CAC3C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAKvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,oDAAoD;AACpD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,yDAAyD;IACzD,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E,SAAS,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjF;AAED,2CAA2C;AAC3C,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,eAAe;CACtC;AAED,4DAA4D;AAC5D,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,oBAAoB;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAID;+EAC+E;AAC/E,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,CAAC,CAGpF;AAED;;qBAEqB;AACrB,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAI5E"}

package/dist/types.js

@@ -27,4 +27,20 @@ export class AuthError extends Error {
 export class TransientError extends Error {
     name = 'TransientError';
 }
+const HANDLER_META_KEY = '__piotHandlerMeta';
+/** Attach handler-failure metadata to an Error and return the same
+ *  Error (so callers can `throw attachHandlerMeta(new Error(...), {...})`). */
+export function attachHandlerMeta(err, meta) {
+    err[HANDLER_META_KEY] = meta;
+    return err;
+}
+/** Read handler-failure metadata from a possibly-Error value. Returns
+ *  undefined for non-Error values, plain Errors, and Errors without
+ *  attached meta. */
+export function readHandlerMeta(value) {
+    if (!(value instanceof Error))
+        return undefined;
+    const carrier = value;
+    return carrier[HANDLER_META_KEY];
+}
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QAChD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AAuED,2CAA2C;AAC3C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAG,WAAW,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QAChD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AAuED,2CAA2C;AAC3C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAG,WAAW,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C;AAkBD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;+EAC+E;AAC/E,MAAM,UAAU,iBAAiB,CAAkB,GAAM,EAAE,IAAsB;IAC9E,GAAqD,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;qBAEqB;AACrB,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAA0D,CAAC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC"}

package/dist/verbose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verbose.d.ts","sourceRoot":"","sources":["../src/verbose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACnC;AAKD,wBAAgB,WAAW,CACzB,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,WAAW,GAChB,IAAI,CAqBN"}
+{"version":3,"file":"verbose.d.ts","sourceRoot":"","sources":["../src/verbose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACnC;AAKD,wBAAgB,WAAW,CACzB,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,WAAW,GAChB,IAAI,CA6BN"}

package/dist/verbose.js

@@ -24,6 +24,13 @@ export function dumpFailure(err, ctx, opts) {
         : undefined;
     const md = redact(renderMarkdown(err, ctx), sources);
     writeSummary(truncate(md));
+    // Phase 3 / Idea 6. The markdown summary above is auth-gated on
+    // private repos and not always reachable to a foreign agent helping
+    // debug from outside; a workflow-command annotation written to
+    // stdout renders on the public run-summary page where any observer
+    // (including WebFetch) can read it. Carry the same redaction the
+    // markdown gets.
+    emitGhaAnnotation(err, ctx, redact(err.message, sources));
     // A single structured record pairs the summary so downstream log
     // pipelines (JSON sinks, GHA log grep) can find the failure by
     // package + handler + exitCode without parsing markdown.
@@ -34,6 +41,39 @@ export function dumpFailure(err, ctx, opts) {
         command: ctx.command.join(' '),
     });
 }
+/**
+ * Emit a GitHub Actions `::error::` workflow command on stdout.
+ * Visible on the run-summary page's annotation strip — the only
+ * failure surface reachable without GitHub auth.
+ *
+ * No-op outside GHA (gated on `GITHUB_ACTIONS=true`, the canonical
+ * runner env var). Stays one line: GH annotations are line-oriented
+ * and a bare embedded newline truncates the body.
+ */
+const ANNOTATION_MAX_LEN = 500;
+function emitGhaAnnotation(err, ctx, redactedMsg) {
+    if (process.env.GITHUB_ACTIONS !== 'true')
+        return;
+    void err; // arity preserved for future callers; redactedMsg drives output
+    const codeMatch = /\[(PIOT_[A-Z0-9_]+)\]/.exec(redactedMsg);
+    const codeTag = codeMatch ? ` [${codeMatch[1]}]` : '';
+    // First non-empty line. The full diagnostic lives in the markdown
+    // summary and the structured log record; the annotation is the
+    // public one-liner.
+    const firstLine = redactedMsg
+        .split('\n')
+        .map((s) => s.trim())
+        .find((s) => s.length > 0) ?? '';
+    const head = `${ctx.handler}/${ctx.package}${codeTag}: ${firstLine}`;
+    const trimmed = head.length > ANNOTATION_MAX_LEN
+        ? head.slice(0, ANNOTATION_MAX_LEN - 1) + '…'
+        : head;
+    // Strip any embedded line breaks that survived (defensive — first-line
+    // selection should have prevented them) so the annotation stays a
+    // single workflow command.
+    const oneLine = trimmed.replace(/[\r\n]+/g, ' ');
+    process.stdout.write(`::error::${oneLine}\n`);
+}
 function renderMarkdown(err, ctx) {
     const lines = [];
     lines.push(`## ❌ ${ctx.handler}/${ctx.package} failed`);

package/dist/verbose.js.map

@@ -1 +1 @@
-{"version":3,"file":"verbose.js","sourceRoot":"","sources":["../src/verbose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,EAAkB,MAAM,UAAU,CAAC;AA+ClD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,8GAA8G;AACnJ,MAAM,UAAU,GAAG,gEAAgE,CAAC;AAEpF,MAAM,UAAU,WAAW,CACzB,GAAU,EACV,GAAmB,EACnB,IAAiB;IAEjB,kEAAkE;IAClE,mEAAmE;IACnE,oEAAoE;IACpE,0BAA0B;IAC1B,MAAM,OAAO,GACX,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACrD,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,iEAAiE;IACjE,+DAA+D;IAC/D,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,OAAO,EAAE,EAAE;QACrE,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAU,EAAE,GAAmB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,IAAI,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW;QAAE,OAAO,EAAE,CAAC;IACxC,+DAA+D;IAC/D,6DAA6D;IAC7D,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,IAAI,GAAG,UAAU,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,+CAA+C;IAClE,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"verbose.js","sourceRoot":"","sources":["../src/verbose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,EAAkB,MAAM,UAAU,CAAC;AA+ClD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,8GAA8G;AACnJ,MAAM,UAAU,GAAG,gEAAgE,CAAC;AAEpF,MAAM,UAAU,WAAW,CACzB,GAAU,EACV,GAAmB,EACnB,IAAiB;IAEjB,kEAAkE;IAClE,mEAAmE;IACnE,oEAAoE;IACpE,0BAA0B;IAC1B,MAAM,OAAO,GACX,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACrD,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,gEAAgE;IAChE,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,iEAAiE;IACjE,iBAAiB;IACjB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAE1D,iEAAiE;IACjE,+DAA+D;IAC/D,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,OAAO,EAAE,EAAE;QACrE,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,SAAS,iBAAiB,CACxB,GAAU,EACV,GAAmB,EACnB,WAAmB;IAEnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;QAAE,OAAO;IAClD,KAAK,GAAG,CAAC,CAAC,gEAAgE;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,kEAAkE;IAClE,+DAA+D;IAC/D,oBAAoB;IACpB,MAAM,SAAS,GACb,WAAW;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,GAAG,OAAO,KAAK,SAAS,EAAE,CAAC;IACrE,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,GAAG,kBAAkB;QAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,GAAG,CAAC,CAAC,GAAG,GAAG;QAC7C,CAAC,CAAC,IAAI,CAAC;IACX,uEAAuE;IACvE,kEAAkE;IAClE,2BAA2B;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,GAAU,EAAE,GAAmB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,IAAI,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElB,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW;QAAE,OAAO,EAAE,CAAC;IACxC,+DAA+D;IAC/D,6DAA6D;IAC7D,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,IAAI,GAAG,UAAU,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,+CAA+C;IAClE,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.1.48",
+  "version": "0.1.49",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {