putitoutthere 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -13,7 +13,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 ### Added
 
 - **`PIOT_PUBLISH_EMPTY_PLAN` error code.** Surfaced when `publish` is invoked with an empty matrix. Joins `PIOT_AUTH_NO_TOKEN` in the stable error-code vocabulary; foreign agents debugging a failed publish can fingerprint on the code without parsing prose.
-- **`kind = "npm"` `build` accepts an array of entries with consumer-defined platform-package name templates** (#dirsql). For packages that ship both a napi-rs Node addon and a CLI binary from the same npm package (the `@swc/core` / dirsql shape), declare `build = [{ mode = "napi", name = "@scope/lib-{triple}" }, { mode = "bundled-cli", name = "@scope/cli-{triple}" }]`. Each entry contributes its own per-platform package family; the main package's `optionalDependencies` spans both. Entries can be bare mode strings (`"napi"`, defaults to `{name}-{triple}` template) or `{ mode, name }` objects. Variables surfaced in `name` templates: `{name}`, `{scope}`, `{base}`, `{triple}`, `{mode}`. `{version}` is intentionally not surfaced. Single-mode string form (`build = "napi"`) preserved byte-for-byte — same artifact-name layout, same platform-package names, no migration pressure on existing consumers. See [README → Recipes → Multi-mode npm family](./README.md#multi-mode-npm-family) and [MIGRATIONS.md](./MIGRATIONS.md#npm-build-accepts-array-of-entries).
+- **`kind = "npm"` `build` accepts an array of entries with consumer-defined platform-package name templates.** For packages that ship both a napi-rs Node addon and a CLI binary from the same npm package (the `@swc/core` shape), declare `build = [{ mode = "napi", name = "@scope/lib-{triple}" }, { mode = "bundled-cli", name = "@scope/cli-{triple}" }]`. Each entry contributes its own per-platform package family; the main package's `optionalDependencies` spans both. Entries can be bare mode strings (`"napi"`, defaults to `{name}-{triple}` template) or `{ mode, name }` objects. Variables surfaced in `name` templates: `{name}`, `{scope}`, `{base}`, `{triple}`, `{mode}`. `{version}` is intentionally not surfaced. Single-mode string form (`build = "napi"`) preserved byte-for-byte — same artifact-name layout, same platform-package names, no migration pressure on existing consumers. See [README → Recipes → Multi-mode npm family](./README.md#multi-mode-npm-family) and [MIGRATIONS.md](./MIGRATIONS.md#npm-build-accepts-array-of-entries).
 
 ### Changed
 
@@ -82,7 +82,7 @@ are prefixed `**BREAKING**` and link to the matching section in
   — which then ran `npm publish` from a fresh checkout and shipped
   tarballs missing the compiled output. Any consumer whose
   `package.json` declared `"files": ["dist", ...]` would publish a
-  broken artifact (caught in the wild as `cachetta@0.3.1`/`0.3.2`).
+  broken artifact (caught in the wild on a downstream consumer).
   The publish job now mirrors what a developer running `npm publish`
   locally would do: detect the lockfile, install deps, run `npm run
   build --if-present` per npm package path. napi / bundled-cli
@@ -155,19 +155,19 @@ are prefixed `**BREAKING**` and link to the matching section in
   [MIGRATIONS.md](./MIGRATIONS.md#scaffolded-releaseyml-now-forwards-github_token).
 - **`/` in `[[package]].name` is now safe — planner encodes it for
   `actions/upload-artifact@v4`** (#230). Polyglot-monorepo grouping
-  shapes (e.g. `name = "py/cachetta"`, `"js/cachetta"`) used to
+  shapes (e.g. `name = "py/foo"`, `"js/foo"`) used to
   produce `artifact_name` values containing `/`, which
   `actions/upload-artifact@v4` rejects with
   `The artifact name is not valid: ... Contains the following character: Forward slash /`,
   failing the build job before piot ever ran. The planner now encodes
-  each `/` to `__` in `artifact_name` (so `py/cachetta` →
-  `py__cachetta-sdist`) and config validation reserves `__` in
+  each `/` to `__` in `artifact_name` (so `py/foo` →
+  `py__foo-sdist`) and config validation reserves `__` in
   `pkg.name` so the round-trip stays unambiguous. Other
   upload-artifact-forbidden characters (`\`, `:`, `<`, `>`, `|`,
   `*`, `?`, `"`) are now rejected at config load. Read sites
   (`publish`, `doctor`, `preflight`, `completeness`) consume
-  `artifact_name` verbatim and need no changes; consumers running
-  the `cachetta#26` encode/decode workaround should remove it once
+  `artifact_name` verbatim and need no changes; consumers running a
+  prior `/`-encoding workaround should remove it once
   they upgrade. See [MIGRATIONS.md](./MIGRATIONS.md#package-names-with--no-longer-need-an-encode-decode-workaround) and
   [Artifact contract → notes](./notes/internals/artifact-contract.md#naming-convention-reference).
 - **Documentation accuracy pass** (#231). A docs-vs-code audit caught

package/MIGRATIONS.md

@@ -109,7 +109,7 @@ of entries to publish multiple per-platform package families from a
 single main package — for example, a napi-rs Node addon plus a CLI
 binary, both selected via `optionalDependencies` on a shared top-level
 package. Each entry has a `mode` (`napi` / `bundled-cli`) and an
-optional `name` template (e.g. `"@dirsql/lib-{triple}"`) that the
+optional `name` template (e.g. `"@scope/lib-{triple}"`) that the
 consumer fully controls. The previous single-mode string form is
 preserved.
 
@@ -143,8 +143,8 @@ families separate:
 
 ```
 artifacts/
-  dirsql-napi-linux-x64-gnu/         # napi family
-  dirsql-bundled-cli-linux-x64-gnu/  # bundled-cli family
+  my-cli-napi-linux-x64-gnu/         # napi family
+  my-cli-bundled-cli-linux-x64-gnu/  # bundled-cli family
 ```
 
 The build job for a multi-mode row writes to
@@ -184,7 +184,7 @@ emitted `artifact_path: package.json` for noarch npm rows, so the
 build job's compile output was never uploaded — and the publish job's
 fresh checkout had no compiled files. `npm publish` doesn't validate
 `files` content, so the broken artifact reached the registry. Caught
-in the wild as `cachetta@0.3.1`/`0.3.2`. The publish job now installs
+in the wild on a downstream consumer. The publish job now installs
 deps and runs `npm run build --if-present` per npm package path
 before invoking the engine — the same logic the build job already
 runs, just at the point where it actually matters.
@@ -707,7 +707,7 @@ reusable workflow internally pins:
 - `actions/download-artifact@v4`
 - `PyO3/maturin-action@v1`
 
-If a consumer was running newer majors (e.g. coaxer hit
+If a consumer was running newer majors (e.g. one consumer hit
 `download-artifact@v8` defaults that broke the artifact-naming
 contract), the reusable workflow standardises everyone on the
 known-tested versions.
@@ -806,12 +806,12 @@ putitoutthere plan --json | jq '.[] | {name, artifact_name, artifact_path}'
 Expect every `artifact_path` to be a plain directory (no `*`):
 
 ```json
-{ "name": "py/cachetta", "artifact_name": "py__cachetta-sdist", "artifact_path": "py/cachetta/dist" }
+{ "name": "py/foo", "artifact_name": "py__foo-sdist", "artifact_path": "py/foo/dist" }
 ```
 
 After the next release run, the `actions/upload-artifact@v4` step
-uploads `py/cachetta/dist/` contents flat under
-`artifacts/py__cachetta-sdist/` (no nested `packages/python/dist/`
+uploads `py/foo/dist/` contents flat under
+`artifacts/py__foo-sdist/` (no nested `packages/python/dist/`
 prefix), and the publish step finds the sdist immediately.
 
 ### Scaffolded `release.yml` now forwards `GITHUB_TOKEN`
@@ -901,8 +901,7 @@ upstream.
 
 - **None for repos with slash-free `pkg.name`** — `artifact_name`
   is byte-identical to the previous version.
-- **Repos that ran the [`cachetta#26`-style](https://github.com/thekevinscott/cachetta/pull/26)
-  encode/decode workaround should remove it.** The planner now
+- **Repos that ran a prior `/`-encoding workaround should remove it.** The planner now
   does the encoding natively; leaving the workaround in place
   produces double-encoded names like `py____foo-sdist`, which the
   publish-side reader will treat as a missing artifact.
@@ -950,15 +949,15 @@ putitoutthere plan --json | jq '.[].artifact_name'
 
 Expect every emitted `artifact_name` to contain only ASCII letters,
 digits, `-`, `_`, and `.` — no `/` and no other forbidden chars.
-For a repo with `name = "py/cachetta"`:
+For a repo with `name = "py/foo"`:
 
 ```
-"py__cachetta-sdist"
-"py__cachetta-wheel-x86_64-unknown-linux-gnu"
+"py__foo-sdist"
+"py__foo-wheel-x86_64-unknown-linux-gnu"
 ```
 
 After the next release, the build job's `actions/upload-artifact@v4`
-step uploads under `py__cachetta-sdist/` (a single flat directory
+step uploads under `py__foo-sdist/` (a single flat directory
 under `artifacts/`), and piot's publish-side reader consumes the
 same path.
 

package/README.md

@@ -389,17 +389,17 @@ registration (a policy on `my-cli` does not cover
 For a package that is both a napi-rs Node addon (a `.node` library) **and**
 a CLI binary, declare `build` as an array. Each entry contributes its own
 per-platform family; the main package's `optionalDependencies` spans both.
-The `@swc/core` / dirsql distribution shape.
+The `@swc/core` distribution shape.
 
 ```toml
 [[package]]
-name    = "dirsql"
+name    = "my-cli"
 kind    = "npm"
 path    = "packages/ts"
-globs   = ["packages/ts/**", "crates/dirsql/**"]
+globs   = ["packages/ts/**", "crates/my-cli/**"]
 build   = [
-  { mode = "napi",        name = "@dirsql/lib-{triple}" },
-  { mode = "bundled-cli", name = "@dirsql/cli-{triple}" },
+  { mode = "napi",        name = "@my-cli/lib-{triple}" },
+  { mode = "bundled-cli", name = "@my-cli/cli-{triple}" },
 ]
 targets = [
   "linux-x64-gnu",
@@ -414,8 +414,8 @@ template** for its platform packages. Variables:
 | Variable    | Resolves to                                                       |
 |-------------|-------------------------------------------------------------------|
 | `{name}`    | The main package's npm name (`pkg.npm` if set, else `pkg.name`).  |
-| `{scope}`   | Scope without `@` for scoped names (e.g. `dirsql`); `""` if unscoped. |
-| `{base}`    | Name without scope (e.g. `core` for `@dirsql/core`).              |
+| `{scope}`   | Scope without `@` for scoped names (e.g. `myorg`); `""` if unscoped. |
+| `{base}`    | Name without scope (e.g. `core` for `@myorg/core`).              |
 | `{triple}`  | Target triple as written in `targets` — required in the template. |
 | `{mode}`    | The entry's mode (`napi` / `bundled-cli`).                        |
 
@@ -437,11 +437,11 @@ only applies when `build` has more than one entry.
 - All entries must produce distinct platform-package name templates.
 
 Each platform package across **every** family needs its own npm
-trusted-publisher registration. For the dirsql config above, that's
-`@dirsql/lib-linux-x64-gnu`, `@dirsql/lib-darwin-arm64`,
-`@dirsql/lib-win32-x64-msvc`, `@dirsql/cli-linux-x64-gnu`,
-`@dirsql/cli-darwin-arm64`, `@dirsql/cli-win32-x64-msvc` — six total,
-one per platform package, plus the top-level `dirsql`.
+trusted-publisher registration. For the config above, that's
+`@my-cli/lib-linux-x64-gnu`, `@my-cli/lib-darwin-arm64`,
+`@my-cli/lib-win32-x64-msvc`, `@my-cli/cli-linux-x64-gnu`,
+`@my-cli/cli-darwin-arm64`, `@my-cli/cli-win32-x64-msvc` — six total,
+one per platform package, plus the top-level `my-cli`.
 
 ### Rust CLI inside a PyPI wheel
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {