putitoutthere 0.2.17 → 0.2.19

package/CHANGELOG.md

@@ -13,6 +13,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 ### Added
 
 - **`[package.bundle_cli]` accepts `features` and `no_default_features` for crates that gate the CLI behind a Cargo feature.** The lib-with-optional-CLI pattern — `[[bin]] required-features = ["cli"]` so `cargo add <name>` doesn't drag the CLI's deps onto library consumers — is the standard shape for crates that fit `bundle_cli`'s use case (ruff, uv, pydantic-core, biome, swc, dirsql). v0.2.0's wiring shipped `cargo build --release --target $TARGET --bin $BIN` with no `--features` path, which made the recipe inert for exactly the consumers it targets. The reusable workflow's cargo build step now appends `--features <comma-list>` when the schema's new `features: list[string]` is non-empty and `--no-default-features` when the new `no_default_features: bool` is true. Defaults are `[]` and `false`, so existing `[package.bundle_cli]` blocks keep building byte-identically. Empty-string entries inside `features` are rejected at config load. The "crates that gate the CLI behind a Cargo feature are not currently supported" caveat in the v0.2.0 MIGRATIONS note has been corrected. See [README → Recipes → Rust CLI inside a PyPI wheel](./README.md#rust-cli-inside-a-pypi-wheel) and [MIGRATIONS.md](./MIGRATIONS.md#bundle_cli-features-and-no_default_features). #300.
+- **Reusable workflow accepts a caller-provided `NPM_TOKEN` via `secrets:`.** OIDC trusted publishers remain the default and recommended path, but Trusted Publishing on npm binds to an *already-published* package — so the first publish of a brand-new npm package has no OIDC path available, and consumers were forced into a manual 6+ package `0.0.0-bootstrap` stub bootstrap (documented nowhere, only discoverable by reading commit history of dirsql or by hitting the failure). The `workflow_call` surface now declares an optional `NPM_TOKEN` secret; when set AND the planned matrix contains an npm row, the secret is exported to `$GITHUB_ENV` as `NODE_AUTH_TOKEN` and the npm CLI prefers the long-lived token over the OIDC path. Callers without a token keep the OIDC path unchanged. For bundled-cli / napi families the same secret authenticates publishes of all per-platform sub-packages on first publish; once those exist, each one needs its own Trusted Publisher registration (the bypass is a one-time bootstrap, not a permanent path). Mirrors the #283 crates fallback in shape. Hit in the wild on the maintainer's own dirsql project (first version of `@dirsql/cli-linux-x64-gnu` on npm is `0.0.0-bootstrap`, 2026-04-30; real `0.2.8` lands the next day) and on `darkfactory`'s first publish. See [README → Trusted publishers → npm](./README.md#npm) and [MIGRATIONS.md](./MIGRATIONS.md#npm-token-fallback). #302.
 - **Reusable workflow accepts a caller-provided `CARGO_REGISTRY_TOKEN` via `secrets:`.** OIDC trusted publishers remain the default and recommended path, but Trusted Publishing on crates.io binds to an *already-published* crate — so the first publish of a brand-new crate has no OIDC path available, and consumers were forced to either fork the workflow or run `cargo publish` outside it. The `workflow_call` surface now declares an optional `CARGO_REGISTRY_TOKEN` secret; when set, the `rust-lang/crates-io-auth-action` OIDC exchange is skipped and the caller-provided token is exported to `$GITHUB_ENV` for the engine's crates handler to read. Callers without a token keep the OIDC path unchanged. The "Auth: OIDC trusted publishers ... Long-lived registry tokens are explicitly NOT supported" framing in `release.yml`'s header has been softened to match. See [README → Trusted publishers → crates.io](./README.md#cratesio) and [MIGRATIONS.md](./MIGRATIONS.md#crates-token-fallback). #283.
 - **Preflight check: every cascaded `kind = "crates"` package's `Cargo.toml` must declare `[package].description` and either `[package].license` or `[package].license-file`.** crates.io rejects publish with `400 Bad Request: missing or empty metadata fields: ...` after `cargo publish`'s verification build has compiled the crate and every transitive dep — wasting the entire publish job on a precondition checkable in milliseconds. The new `requireCratesMetadata` runs alongside `requireAuth` / `requireProvenanceMetadata` in `src/publish.ts`, before any side effects, and reports every failing package + every missing field in one error rather than failing on the first. Surfaces a new stable error code, `PIOT_CRATES_MISSING_METADATA`. Whitespace-only field values are treated as empty. Hit in the wild on `thekevinscott/darkfactory`'s first crate publish; same shape as #280 (npm `repository`). See [MIGRATIONS.md](./MIGRATIONS.md#crates-cargo-toml-must-declare-description-and-license). #290.
 - **Preflight check: every cascaded `kind = "npm"` package must declare a non-empty `repository` field in `package.json`.** `putitoutthere` invokes `npm publish --provenance` on the OIDC trusted-publisher path, and the npm CLI hard-requires this field so the registry can verify the artifact was built from the repo the trusted publisher declares. A missing or empty field previously surfaced as a confusing tail-end npm error after the runner had spun up, OIDC had been negotiated, and the artifact had been built — wasting a full release run on a precondition checkable in milliseconds. The new `requireProvenanceMetadata` runs alongside `requireAuth` in `src/publish.ts`, before any side effects, and reports every failing package in one error rather than failing on the first. Surfaces a new stable error code, `PIOT_NPM_MISSING_REPOSITORY`. Both the canonical object form (`{ type, url, directory? }`) and the legacy single-string form are accepted; only an empty `url` (or no `url` at all) fails. The npm handler's inline backstop is also tightened to match the same predicate (previously `!pkg.repository` slipped `{}`, `{ type: 'git' }`, and whitespace strings through). Documented in [README → `kind = "npm"`](./README.md#kind--npm). See [MIGRATIONS.md](./MIGRATIONS.md#npm-package-json-must-declare-repository). #280.
@@ -34,6 +35,8 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Fixed
 
+- **Single-artifact publish jobs no longer fail completeness with `missing artifact directory <name>/`.** `actions/download-artifact@v8` is count-sensitive: with `path: artifacts` and no `name`/`pattern` filter, multiple artifacts each get their own `artifacts/<name>/` subdir (the documented multi-case the engine relies on), but a single artifact extracts directly into `artifacts/` with no per-artifact subdir. Consumers whose plan emits exactly one expected artifact — canonical case: pure-Python `[[package]]` with `build = "hatch"`, which emits an sdist row only — therefore aborted at the engine's completeness check before any side effect ran. The reusable workflow's publish job now normalizes the layout in-process before completeness: when the plan expects a single staged artifact and the documented subdir is absent, files in `artifacts/` are moved into `artifacts/<artifact_name>/` so the rest of the engine sees the contract it was written against. No-op in the multi-artifact case, when the subdir already exists, or when nothing was downloaded (crates-only / vanilla-npm plans). No consumer-side change required. Hit in the wild on a pypi-only consumer with a single sdist row; multi-artifact consumers (pypi + npm, or sdist + wheels) were unaffected. See [MIGRATIONS.md](./MIGRATIONS.md#single-artifact-publish-layout-normalization). #311.
+
 - **Bundled-CLI / napi npm consumers' `npm run build` step now sees `TARGET` and `BUILD` env vars on every matrix row.** The reusable workflow's `_matrix.yml` and `release.yml` previously ran the npm build step with no env block, so consumers' build scripts that read `process.env.TARGET` to know which triple to cross-compile saw `undefined` and either crashed or silently no-oped. Every per-platform matrix row then uploaded an empty `build/<triple>/` directory and `actions/upload-artifact@v7` flagged `No files were found with the provided path: ...`. The internal `e2e-fixture-job.yml` already passed `TARGET` / `BUILD` correctly — meaning the fixture suite passed but a real consumer's first publish still failed; an integration-tier divergence rather than a behavior bug per se. Both the build matrix step and the publish-job rebuild step in `release.yml` now set the env block. `_matrix.yml` exposes `TARGET=${{ matrix.target }}` / `BUILD=${{ matrix.build }}` per row; `release.yml`'s rebuild loop sets `TARGET=main BUILD=` per iteration (the publish-time rebuild only fires for the main package's row, since per-platform sub-packages stage from `artifacts/` via the engine's npm-platform handler). The README's [Bundled-CLI npm family](./README.md#bundled-cli-npm-family) recipe gained the consumer-side build-script contract that was previously missing — TARGET/BUILD vocabulary and a minimal `scripts/build.cjs` covering the simple single-workspace case. Hit in the wild on `thekevinscott/darkfactory`'s first release; tracked at #287. See [MIGRATIONS.md](./MIGRATIONS.md#npm-build-step-target-build-env-vars).
 
 - **First-publish bundled-cli / napi npm builds no longer fail on lockfile drift.** Consumers of the bundled-cli / napi shape declare `optionalDependencies` for `<name>-<triple>@<version>` platform packages that this pipeline publishes. On the very first publish those entries 404 on the registry; pnpm 10 silently drops 404'd optionals from the lockfile when it is regenerated locally; a subsequent CI run with `pnpm install --frozen-lockfile` (or `npm ci`) refuses because lockfile and `package.json` disagree. Both install steps in the reusable workflow — `_matrix.yml`'s build-matrix install and `release.yml`'s publish-job rebuild step (added in #256) — now self-heal: a failed strict install falls back to its non-strict form (`pnpm install --no-frozen-lockfile` / `npm install`) with a `::warning::` line in the run log naming the recovery. No consumer-side change required; lockfiles can stay committed and `optionalDependencies` can stay declared. Hit in the wild on `thekevinscott/darkfactory`'s first release (#integration-2026-05-bundled-cli). The README's [Bundled-CLI npm family](./README.md#bundled-cli-npm-family) recipe grew a `[!NOTE]` callout documenting the chicken-and-egg and the workflow's transparent recovery. See [MIGRATIONS.md](./MIGRATIONS.md#first-publish-bundled-cli-lockfile-self-heal).

package/MIGRATIONS.md

@@ -21,6 +21,58 @@ Each section covers five things, in order:
 
 ## Unreleased
 
+### Single-artifact publish layout normalization
+
+**Summary.** The reusable workflow's publish job downloads build
+artifacts with `actions/download-artifact@v8` configured as `path:
+artifacts` and no `name`/`pattern` filter. That action is
+count-sensitive: multiple artifacts land in `artifacts/<name>/...`
+subdirs (the documented multi-case the engine's completeness check
+and every handler are written against), but a *single* artifact
+extracts directly into `artifacts/` with no per-artifact subdir.
+Consumers whose plan emits exactly one expected artifact — pure-Python
+packages with `build = "hatch"` (sdist row only) being the canonical
+case — therefore failed at the completeness check with `missing
+artifact directory <pkg>-sdist/` before the pypi handler ever ran.
+Multi-artifact consumers (pypi+npm, sdist+wheels, polyglot) were
+unaffected. The publish job now normalizes the layout in-process
+before completeness: when the plan expects one staged artifact and
+`artifacts/<artifact_name>/` is absent, files in `artifacts/` are
+moved into that subdir so the engine's contract holds. Fully a
+fix-in-place; no input shape, output shape, or config key changed.
+Tracked in #311.
+
+**Required changes.** None.
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.**
+
+- Pypi-only consumers with `build = "hatch"` (or any other
+  `[[package]]` whose plan emits a single artifact row) that
+  previously failed publish with `Artifact completeness check
+  failed: ... missing artifact directory <pkg>-sdist/` now reach the
+  pypi handler successfully and tag as expected. The wider release
+  flow — version-rewrite, tag creation, GitHub Release, caller-side
+  `pypi-publish` upload — was already correct; only the engine's
+  pre-publish completeness check was upstream of the bug.
+- Multi-artifact plans (≥2 staged artifacts), crates-only plans, and
+  vanilla-npm plans (`[[package]] kind = "npm"` with no `build` /
+  `build = []`) see no observable difference. The normalization is
+  scoped to the exact case `download-artifact@v8` dumps into the
+  root.
+
+**Verification.** A release-please / release-plz cascade against a
+pure-Python `[[package]]` with `build = "hatch"` should:
+
+1. Surface the planned matrix as a single row,
+   `target = sdist artifact = <pkg>-sdist`.
+2. Reach the `pypi: <pkg>@<version> delegated to caller-side upload
+   step.` log line in the publish job.
+3. Push a `<pkg>-v<version>` tag, kick off the caller's
+   `pypi-publish` job, and produce a GitHub Release. No
+   `missing artifact directory` error appears in the run log.
+
 ### `[package.bundle_cli]` features and `no_default_features`
 
 **Summary.** `[package.bundle_cli]` previously only worked for crates
@@ -359,6 +411,85 @@ or build-check run.
 
 ---
 
+### npm token fallback
+
+**Summary.** The reusable workflow now accepts an optional
+`NPM_TOKEN` via `secrets:`. Trusted Publishing on npm binds to
+an *already-published* package, so the very first publish of a
+brand-new npm package has no OIDC path available; without this
+fallback every first-time bundled-cli / napi consumer hit a 6+
+package manual `0.0.0-bootstrap` stub bootstrap, documented
+nowhere, only discoverable by reading commit history of dirsql
+or by hitting the failure. OIDC trusted publishers remain the
+default and recommended path — when the secret is unset,
+behavior is byte-for-byte unchanged. When the secret is set
+AND the planned matrix contains an npm row, the secret is
+exported to `$GITHUB_ENV` as `NODE_AUTH_TOKEN`; the npm CLI
+then prefers the long-lived token over the OIDC path. Mirror
+of #283 (crates) in shape, byte-for-byte. Hit in the wild on
+the maintainer's own dirsql project (first version of
+`@dirsql/cli-linux-x64-gnu` on npm is `0.0.0-bootstrap`,
+2026-04-30; real `0.2.8` lands the next day) and on
+`darkfactory`'s first publish. #302.
+
+**Required changes.** None for consumers already on the OIDC
+path. To bootstrap a brand-new npm package or to use the
+workflow on an account where Trusted Publishing isn't
+available, wire the secret in the caller's `release.yml`:
+
+| Before                                                                                 | After                                                                                                                                                                |
+| -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0`                   | `uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0`<br>`secrets:`<br>`  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}`                                         |
+
+The repo-level secret holding the npm automation token can be
+named anything; the *workflow* secret it gets passed as must be
+`NPM_TOKEN` exactly — the reusable workflow keys on that name.
+Drop the `secrets:` block from the caller's `release.yml` once
+Trusted Publishing is registered against the (now-existing)
+package; subsequent publishes are zero-secret. For bundled-cli
+/ napi families each per-platform sub-package needs its own
+Trusted Publisher registration after the first publish — the
+secret-bypass is a one-time bootstrap, not a permanent path.
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** None when the secret
+is unset (OIDC path unchanged). When the secret is set, a new
+"Export NODE_AUTH_TOKEN (caller-provided)" step writes
+`NODE_AUTH_TOKEN` to `$GITHUB_ENV` gated on the secret being
+non-empty AND the planned matrix containing an npm row. The
+gate reads the secret through a job-level `CALLER_NPM_TOKEN`
+env var because GitHub Actions does not allow the `secrets`
+context inside step-level `if:` conditions ([context
+availability](https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability));
+this is an internal mechanism — consumers don't see or set
+`CALLER_NPM_TOKEN` themselves. Unlike #283 (crates), there is
+no separate OIDC step to "skip" — the npm CLI handles OIDC
+internally via the runner's id-token, and the presence of
+`NODE_AUTH_TOKEN` in the env is what switches the CLI's auth
+mode.
+
+**Verification.** Wire `NPM_TOKEN` to a valid npm automation
+token in the caller repo and trigger a release of a brand-new
+package. The publish-job logs should show "Export
+NODE_AUTH_TOKEN (caller-provided)" as `success`; `npm publish`
+authenticates with the long-lived token rather than via OIDC,
+and every per-platform sub-package in a bundled-cli / napi
+family lands on the registry in a single run. Once first
+publish succeeds, register Trusted Publishers against each
+package URL, drop the `secrets:` block, and re-run a release
+— the OIDC path covers the steady state from there.
+
+Verified end-to-end against existing seeded fixtures and a
+real first-publish on a canary repo. The Verdaccio
+first-publish fixture coverage for the same path is tracked
+separately at #293; until that lands this fallback is verified
+by composition (mirror of #283) plus consumer-side observation
+on real first publishes rather than by an automated
+fresh-state fixture in this repo's CI.
+
+---
+
 ### Crates token fallback
 
 **Summary.** The reusable workflow now accepts an optional

package/README.md

@@ -329,14 +329,15 @@ releases without fighting registry-immutable-publish semantics.
 ## Trusted publishers
 
 OIDC trusted publishers are the default and recommended auth path.
-The reusable workflow also accepts a long-lived `CARGO_REGISTRY_TOKEN`
-via `secrets:` for cases where Trusted Publishing isn't reachable —
-most commonly the very first publish of a brand-new crate, since
-Trusted Publishing on crates.io binds to an *already-published* crate
-and there's no pending-publisher equivalent. When set, the OIDC
-exchange is skipped and the caller-provided token is used instead.
-Drop the secret once Trusted Publishing is registered against the
-existing crate.
+The reusable workflow also accepts long-lived `CARGO_REGISTRY_TOKEN`
+(crates.io) and `NPM_TOKEN` (npm) values via `secrets:` for cases
+where Trusted Publishing isn't reachable — most commonly the very
+first publish of a brand-new crate or npm package, since Trusted
+Publishing on both registries binds to an *already-published*
+package and neither has a pending-publisher equivalent. When set,
+the OIDC exchange is skipped and the caller-provided token is used
+instead. Drop the secret once Trusted Publishing is registered
+against the existing package.
 
 For all three registries the OIDC fields are the same: **your**
 repository owner/name, **your** workflow filename (`release.yml`),
@@ -382,14 +383,34 @@ see "How auth flows" below for the why.
 
 ### npm
 
-1. Publish at least one version of your package with a classic
-   `NODE_AUTH_TOKEN` so the package exists on the registry. (npm's trusted
-   publisher requires an existing package.)
+1. **First publish (brand-new package).** Trusted Publishing on npm
+   binds to an existing package, so the first `npm publish` has no
+   OIDC path. Pass `NPM_TOKEN` to the reusable workflow via
+   `secrets:` to bootstrap through this workflow:
+
+   ```yaml
+   jobs:
+     release:
+       uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0
+       secrets:
+         NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+   ```
+
+   When `NPM_TOKEN` is set, it is exported to the publish step's
+   environment as `NODE_AUTH_TOKEN` and the npm CLI prefers it over
+   the OIDC path. For bundled-cli / napi families the same secret
+   authenticates publishes of all per-platform sub-packages on first
+   publish — once those exist, each one needs its own Trusted
+   Publisher registration (the bypass is a one-time bootstrap, not
+   a permanent path).
 2. Go to `https://www.npmjs.com/package/<name>/access` → **Require trusted
    publisher**.
 3. Fill in: your repository, workflow filename (`release.yml`),
-   environment (optional).
-4. Delete the bootstrap token.
+   environment (optional). Repeat for every per-platform sub-package
+   for bundled-cli / napi families.
+4. Drop the `NPM_TOKEN` secret from the workflow once Trusted
+   Publishing is registered; subsequent publishes are zero-secret on
+   the OIDC path.
 
 ### How auth flows
 

package/dist/normalize-artifacts.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Single-artifact layout normalization.
+ *
+ * `actions/download-artifact@v8` is count-sensitive when called with
+ * `path:` and no `name`/`pattern` filter: multiple artifacts get
+ * per-artifact subdirectories (the documented multi-case the engine
+ * relies on), but a *single* artifact extracts directly into the path
+ * with no `<artifact_name>/` subdir. The completeness check
+ * (`src/completeness.ts`) and every downstream handler reach for
+ * `artifacts/<artifact_name>/...`, so consumers whose plan emits one
+ * row — canonical case: pure-Python + `build = "hatch"`, sdist only —
+ * fail before any side effect runs.
+ *
+ * Rather than fight the action's per-count behavior in YAML (where the
+ * subdir-vs-flat decision lives in upstream code we don't control),
+ * normalize the layout in-process before completeness so the engine's
+ * own contract is the single source of truth. The reusable workflow
+ * calls into this via `publish.ts`; no consumer-facing surface.
+ *
+ * Issue #311.
+ */
+import type { MatrixRow } from './plan.js';
+/**
+ * Move dumped-into-root artifact files into the documented
+ * `<artifactsRoot>/<artifact_name>/` subdir when the plan expects
+ * exactly one staged artifact and the download step did not create
+ * the subdir. No-op in every other case (multi-artifact, already
+ * subdir-shaped, nothing downloaded, crates-only / vanilla-npm plans
+ * that stage nothing).
+ */
+export declare function normalizeArtifactLayout(matrix: readonly MatrixRow[], artifactsRoot: string): void;
+//# sourceMappingURL=normalize-artifacts.d.ts.map

package/dist/normalize-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-artifacts.d.ts","sourceRoot":"","sources":["../src/normalize-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,aAAa,EAAE,MAAM,GACpB,IAAI,CAyBN"}

package/dist/normalize-artifacts.js

@@ -0,0 +1,57 @@
+/**
+ * Single-artifact layout normalization.
+ *
+ * `actions/download-artifact@v8` is count-sensitive when called with
+ * `path:` and no `name`/`pattern` filter: multiple artifacts get
+ * per-artifact subdirectories (the documented multi-case the engine
+ * relies on), but a *single* artifact extracts directly into the path
+ * with no `<artifact_name>/` subdir. The completeness check
+ * (`src/completeness.ts`) and every downstream handler reach for
+ * `artifacts/<artifact_name>/...`, so consumers whose plan emits one
+ * row — canonical case: pure-Python + `build = "hatch"`, sdist only —
+ * fail before any side effect runs.
+ *
+ * Rather than fight the action's per-count behavior in YAML (where the
+ * subdir-vs-flat decision lives in upstream code we don't control),
+ * normalize the layout in-process before completeness so the engine's
+ * own contract is the single source of truth. The reusable workflow
+ * calls into this via `publish.ts`; no consumer-facing surface.
+ *
+ * Issue #311.
+ */
+import { existsSync, mkdirSync, readdirSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Move dumped-into-root artifact files into the documented
+ * `<artifactsRoot>/<artifact_name>/` subdir when the plan expects
+ * exactly one staged artifact and the download step did not create
+ * the subdir. No-op in every other case (multi-artifact, already
+ * subdir-shaped, nothing downloaded, crates-only / vanilla-npm plans
+ * that stage nothing).
+ */
+export function normalizeArtifactLayout(matrix, artifactsRoot) {
+    // Only rows whose handler expects a staged artifact directory. crates
+    // publishes from the source tree (no upload step in the build job);
+    // vanilla npm packages the source on the publish runner. completeness
+    // already short-circuits both kinds — see `src/completeness.ts`.
+    const expected = matrix.filter((r) => r.kind !== 'crates' && !(r.kind === 'npm' && r.target === 'noarch'));
+    if (expected.length !== 1)
+        return;
+    const row = expected[0];
+    const targetDir = join(artifactsRoot, row.artifact_name);
+    // Already in the documented layout — either a multi-artifact run
+    // earlier in the same job, or a developer running locally with the
+    // engine's contract honored. Either way, leave it alone.
+    if (existsSync(targetDir))
+        return;
+    if (!existsSync(artifactsRoot))
+        return;
+    const dumped = readdirSync(artifactsRoot);
+    if (dumped.length === 0)
+        return;
+    mkdirSync(targetDir, { recursive: true });
+    for (const entry of dumped) {
+        renameSync(join(artifactsRoot, entry), join(targetDir, entry));
+    }
+}
+//# sourceMappingURL=normalize-artifacts.js.map

package/dist/normalize-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-artifacts.js","sourceRoot":"","sources":["../src/normalize-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA4B,EAC5B,aAAqB;IAErB,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC3E,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACzD,iEAAiE;IACjE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IAClC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO;IAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAgJ1E"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAoJ1E"}

package/dist/publish.js

@@ -18,6 +18,7 @@
 import { isAbsolute, join, resolve } from 'node:path';
 import { loadConfig } from './config.js';
 import { checkCompleteness } from './completeness.js';
+import { normalizeArtifactLayout } from './normalize-artifacts.js';
 import { ErrorCodes } from './error-codes.js';
 import { createTag, headCommit, pushTag } from './git.js';
 import { handlerFor as defaultHandlerFor } from './handlers/index.js';
@@ -78,6 +79,10 @@ export async function publish(opts) {
     //     dep — same wasted-work argument as 2b. #290.
     requireCratesMetadata(selectedPackages);
     // 3. Artifact completeness.
+    // First normalize the layout in case actions/download-artifact@v8
+    // dumped a single artifact directly into `artifacts/` rather than
+    // creating `artifacts/<name>/`. #311.
+    normalizeArtifactLayout(matrix, artifactsRoot(cwd));
     const completeness = checkCompleteness(matrix, artifactsRoot(cwd));
     const incomplete = [...completeness.entries()].filter(([, r]) => !r.ok);
     if (incomplete.length > 0) {

package/dist/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,kBAAkB,+CAA+C;YAChF,8DAA8D;YAC9D,6EAA6E;YAC7E,+EAA+E;YAC/E,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,mDAAmD;IACnD,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAExC,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,8DAA8D;YAC9D,8DAA8D;YAC9D,iDAAiD;YACjD,mBAAmB,EAAE,MAAM,CAAC,QAAQ;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,kBAAkB,+CAA+C;YAChF,8DAA8D;YAC9D,6EAA6E;YAC7E,+EAA+E;YAC/E,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,mDAAmD;IACnD,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAExC,4BAA4B;IAC5B,kEAAkE;IAClE,kEAAkE;IAClE,sCAAsC;IACtC,uBAAuB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,8DAA8D;YAC9D,8DAA8D;YAC9D,iDAAiD;YACjD,mBAAmB,EAAE,MAAM,CAAC,QAAQ;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {