putitoutthere 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -12,6 +12,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Added
 
+- **Preflight check: every cascaded `kind = "npm"` package must declare a non-empty `repository` field in `package.json`.** `putitoutthere` invokes `npm publish --provenance` on the OIDC trusted-publisher path, and the npm CLI hard-requires this field so the registry can verify the artifact was built from the repo the trusted publisher declares. A missing or empty field previously surfaced as a confusing tail-end npm error after the runner had spun up, OIDC had been negotiated, and the artifact had been built — wasting a full release run on a precondition checkable in milliseconds. The new `requireProvenanceMetadata` runs alongside `requireAuth` in `src/publish.ts`, before any side effects, and reports every failing package in one error rather than failing on the first. Surfaces a new stable error code, `PIOT_NPM_MISSING_REPOSITORY`. Both the canonical object form (`{ type, url, directory? }`) and the legacy single-string form are accepted; only an empty `url` (or no `url` at all) fails. The npm handler's inline backstop is also tightened to match the same predicate (previously `!pkg.repository` slipped `{}`, `{ type: 'git' }`, and whitespace strings through). Documented in [README → `kind = "npm"`](./README.md#kind--npm). See [MIGRATIONS.md](./MIGRATIONS.md#npm-package-json-must-declare-repository). #280.
 - **Reusable workflow `.github/workflows/build.yml` (`workflow_call`).** PR-time build verification: runs the same plan + build matrix that `release.yml` runs, calling a shared internal `_matrix.yml` reusable workflow so action pins, per-target build steps, and runner selection cannot drift between the two paths. `build.yml` declares only `permissions: contents: read` and contains no publish job, no `id-token: write`, no OIDC trusted-publisher exchange, and no registry auth — the bytes required to publish do not exist on this code path. Two optional inputs forwarded to `_matrix.yml`: `node_version` (default `24`), `python_version` (default `3.12`). Concurrency is keyed on `github.ref` with `cancel-in-progress: true` so PR pushes supersede stale runs (release.yml's repository-keyed group with `cancel-in-progress: false` is unchanged). An `actionlint`-job grep assertion rejects any future patch that adds `id-token: write` to `build.yml` or `_matrix.yml`. See [README → Build check](./README.md#1b-optional-drop-in-githubworkflowsbuild-checkyml) and [MIGRATIONS.md](./MIGRATIONS.md#new-buildyml-reusable-workflow-for-pr-time-build-verification).
 - **`PIOT_PUBLISH_EMPTY_PLAN` error code.** Surfaced when `publish` is invoked with an empty matrix. Joins `PIOT_AUTH_NO_TOKEN` in the stable error-code vocabulary; foreign agents debugging a failed publish can fingerprint on the code without parsing prose.
 - **`kind = "npm"` `build` accepts an array of entries with consumer-defined platform-package name templates.** For packages that ship both a napi-rs Node addon and a CLI binary from the same npm package (the `@swc/core` shape), declare `build = [{ mode = "napi", name = "@scope/lib-{triple}" }, { mode = "bundled-cli", name = "@scope/cli-{triple}" }]`. Each entry contributes its own per-platform package family; the main package's `optionalDependencies` spans both. Entries can be bare mode strings (`"napi"`, defaults to `{name}-{triple}` template) or `{ mode, name }` objects. Variables surfaced in `name` templates: `{name}`, `{scope}`, `{base}`, `{triple}`, `{mode}`. `{version}` is intentionally not surfaced. Single-mode string form (`build = "napi"`) preserved byte-for-byte — same artifact-name layout, same platform-package names, no migration pressure on existing consumers. See [README → Recipes → Multi-mode npm family](./README.md#multi-mode-npm-family) and [MIGRATIONS.md](./MIGRATIONS.md#npm-build-accepts-array-of-entries).
@@ -30,6 +31,8 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Fixed
 
+- **pypi/maturin wheels now ship at the planned version instead of the literal in `pyproject.toml`.** The reusable workflow's build matrix (`_matrix.yml`) now bumps `[project].version` in `pyproject.toml` (or `[package].version` in `Cargo.toml` when `pyproject.toml` declares `dynamic = ["version"]`) to `matrix.version` before each `PyO3/maturin-action@v1` invocation. Maturin reads its version source from disk at build time and honors no env override — `SETUPTOOLS_SCM_PRETEND_VERSION` is a setuptools-scm / hatch-vcs feature, not a maturin one. Without the bump, wheels left the build runner at whatever literal happened to be in the consumer's manifest — diverging from the planned version, tripping PyPI's "file already exists" rejection at upload, and turning otherwise-clean release runs red even when crates and npm shipped correctly. The bump is implemented as a new internal `putitoutthere write-version` CLI subcommand and exposed through the JS action's existing surface (new `version:` input on `action.yml`); the e2e fixture harness now verifies wheel `METADATA: Version:` matches `matrix.version` post-build. The CLI subcommand and action input are internal — consumers compose with the reusable workflow, not directly with the CLI. Hit in the wild on `dirsql`'s 0.2.8 release (issue #276). See [MIGRATIONS.md](./MIGRATIONS.md#pypi-maturin-version-bump-at-build).
+
 - **npm publish no longer fails red when npm CLI retries a successful PUT.** When the registry acks a publish but the response comes back flaky to the client (timeout / 502 / connection reset), the npm CLI retries with the same payload. The retry lands on a registry that already has the new version and exits `E403 "cannot publish over the previously published versions: <ver>"`. Both the platform-package handler (`src/handlers/npm-platform.ts:npmPublish`) and the main publish path (`src/handlers/npm.ts:publishImpl`) now detect that exact stderr shape and treat it as success — the package is already on the registry at the requested version. Hit in the wild on PR #257's polyglot-everything multi-mode publish (10 platform packages × ~1 in 10 chance per request meant the race was nearly guaranteed).
 
 - **Crates publish no longer refuses on workflow-managed install state in sibling packages.** Before, the engine's pre-publish dirty-workspace check (`scanDirtyOutsideManifest`) flagged anything dirty outside the package's `Cargo.toml`. For polyglot consumers (rust + js in one repo), the reusable workflow's `Build npm packages` step (#256) creates `node_modules/`, `package-lock.json`, and `dist/` inside each npm package's path before cargo publish runs — these are workflow scratch, not stray edits, and cargo can't pack them anyway (it only packs files inside the crate's own dir). The check now whitelists every other configured package's path, similar to how it already whitelists `artifacts/`. Stray edits elsewhere in the repo (a `README.md` change, etc.) still fail the check. Hit in the wild on the polyglot-everything e2e fixture; would also have hit any consumer with the same shape.

package/MIGRATIONS.md

@@ -21,6 +21,153 @@ Each section covers five things, in order:
 
 ## Unreleased
 
+### npm package.json must declare `repository`
+
+**Summary.** Every cascaded `kind = "npm"` package's `package.json`
+must now carry a non-empty `repository` field. The new preflight
+check (`requireProvenanceMetadata` in `src/preflight.ts`) runs in
+`src/publish.ts` immediately after `requireAuth` and rejects the
+run with `PIOT_NPM_MISSING_REPOSITORY` before any runner work.
+Why: `putitoutthere` invokes `npm publish --provenance` on the OIDC
+trusted-publisher path; the npm CLI hard-requires this field so the
+registry can verify the artifact was built from the repo the trusted
+publisher declares. A missing or empty field previously surfaced
+only after the runner had spun up, OIDC had been negotiated, and
+the artifact had been built — wasting a full release run on a
+precondition checkable in milliseconds. Hit in the wild on
+`coaxer@0.1.1`'s first npm release; tracked in #280.
+
+The npm handler's inline backstop (`assertRepositoryField` in
+`src/handlers/npm.ts`) is also tightened. Previously it used
+`if (!pkg.repository)` — falsy-only — which let three real shapes
+slip through: an object without `url` (`{ type: 'git' }`), an
+empty object (`{}`), and a whitespace-only string (`'   '`). All
+three are now rejected; the error message also carries the stable
+`PIOT_NPM_MISSING_REPOSITORY` code and the path of the offending
+file, matching the preflight error.
+
+**Required changes.** Add a `repository` block to every
+`package.json` declared as `kind = "npm"` in
+`putitoutthere.toml`. Canonical shape:
+
+| Before                                              | After                                                                                                                                                                                                                                  |
+| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `{ "name": "@scope/lib", "version": "0.1.0" }`      | `{ "name": "@scope/lib", "version": "0.1.0", "repository": { "type": "git", "url": "git+https://github.com/<owner>/<repo>.git", "directory": "<path/to/package>" } }` |
+
+`directory` is needed for monorepo packages so npm can locate the
+source within the repo. Both the object form and the legacy single-
+string form (`"repository": "git+https://github.com/<owner>/<repo>.git"`)
+are accepted; only a missing field, an empty string, or an object
+without a non-empty `url` fails the check.
+
+No `release.yml` or `putitoutthere.toml` changes are required.
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** `putitoutthere publish`
+now fails fast at preflight with
+`[PIOT_NPM_MISSING_REPOSITORY] npm publish requires a non-empty
+\`repository\` field in package.json` for any cascaded npm package
+whose `package.json` lacks the field. Previously the same shape
+ran through plan + build + auth-negotiation + artifact-staging
+and failed inside `npm publish` with `npm publish --provenance
+requires a \`repository\` field in package.json`. Well-formed
+packages are unaffected.
+
+The error message names every failing package and its
+`package.json` path so consumers fix all of them in one round-trip
+rather than discovering them one at a time across multiple release
+attempts.
+
+**Verification.** Drop the `repository` field from one of your
+`package.json` files locally and run `pnpm test:integration` (or
+the engine against a local fixture); the failure should arrive at
+preflight with `PIOT_NPM_MISSING_REPOSITORY` in the message, no
+platform packages should be published, and no git tag should be
+created. Restore the field; the next run completes normally.
+
+---
+
+### pypi/maturin version bump at build
+
+**Summary.** `pypi` packages built with `build = "maturin"` now ship
+wheels at the planned version, not at whatever literal happened to be
+in `pyproject.toml` on the build runner. The reusable workflow's
+build matrix (`_matrix.yml`) bumps the version source on disk to
+`matrix.version` immediately before each `PyO3/maturin-action@v1`
+step. Two version-source shapes are supported:
+
+- Static literal: `[project].version = "0.1.0"` in `pyproject.toml`
+  is rewritten in place. This is maturin's default project shape and
+  the case that was previously broken for every consumer.
+- Dynamic: `pyproject.toml` declaring `[project].dynamic = ["version"]`
+  with the version sourced from a sibling `Cargo.toml`'s
+  `[package].version` — that's where the bump lands instead.
+
+Why it matters: maturin reads its version source from disk at build
+time and honors no env override. Other build paths bumped elsewhere
+in the contract — crates and npm at publish (`writeVersion` rewrites
+the manifest before `cargo publish` / `npm publish` reads it),
+setuptools-scm / hatch-vcs through `SETUPTOOLS_SCM_PRETEND_VERSION`
+in the build step. Maturin had no equivalent, so wheels left the
+build runner pre-versioned at the consumer's stale literal. PyPI
+rejected the upload with `400 File already exists` whenever that
+literal had been previously registered, even when crates and npm
+shipped correctly. Hit in the wild on `dirsql`'s 0.2.8 release;
+issue #276.
+
+**Required changes.** None. The bump is internal to the reusable
+workflow. Consumers pinning `release.yml@v0` and `build.yml@v0`
+inherit the fix on the next workflow run with no `release.yml` edits
+and no `putitoutthere.toml` edits. The fix applies equally to the
+static-literal and dynamic-version shapes; consumers don't need to
+restructure their pyproject to opt in.
+
+The CLI gains a new internal subcommand,
+`putitoutthere write-version --path <pkg-dir> --version <v>`, that
+implements the bump dispatch. `action.yml` gains a new optional
+`version:` input that the reusable workflow forwards. Both surfaces
+are internal seams powering `_matrix.yml`; consumers compose with
+the reusable workflow, not directly with the CLI or the JS action
+(see [`notes/design-commitments.md`](./notes/design-commitments.md)
+non-goal #7 and #10).
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** A maturin build run
+through the reusable workflow now mutates the build runner's
+`pyproject.toml` (or `Cargo.toml` for dynamic-version projects) in
+place, bumping the version literal to `matrix.version`. The mutation
+lives only on the build runner — the consumer's source tree is
+untouched. Anyone fingerprinting on the on-disk manifest version
+during a build (e.g. a custom shell step running between
+`uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0`
+and a follow-up step that reads the manifest) will now see the
+planned version where they previously saw the consumer's stale
+literal. Custom build steps that grep on a specific literal version
+need to grep on `matrix.version` instead.
+
+`pyproject.toml` projects whose `[project]` table is malformed
+(neither a static `version = "..."` line nor `dynamic = ["version"]`)
+now fail the build matrix with a clear error. Previously the same
+shape produced wheels at whatever fallback the build backend chose,
+which silently disagreed with the plan.
+
+**Verification.** Cut a release on a maturin package whose
+`pyproject.toml` carries a stale literal (e.g. `version = "0.1.0"`
+when the planned version is `0.2.8`). The reusable workflow's
+build matrix logs a `write-version: ... → 0.2.8` line before each
+maturin invocation, and the produced wheel's `METADATA: Version:`
+matches the planned version:
+
+```sh
+unzip -p dist/*.whl '*.dist-info/METADATA' | grep '^Version:'
+# Version: 0.2.8
+```
+
+PyPI accepts the upload — assuming the planned version itself isn't
+a duplicate of a previously-registered file.
+
 ### New `build.yml` reusable workflow for PR-time build verification
 
 **Summary.** A second consumer-facing reusable workflow,

package/README.md

@@ -183,6 +183,32 @@ version = 1   # required; only 1 is valid today
 | `build`   | string \| array        | `"napi"` \| `"bundled-cli"` (single mode), or an array of entries (each: a bare mode string or `{ mode, name }` with a [name template](#multi-mode-npm-family)). Omitted = vanilla. See [Recipes → Bundled-CLI npm family](#bundled-cli-npm-family). |
 | `targets` | (string \| object)[]   | Required when `build` is set.                        |
 
+> [!IMPORTANT]
+> **`package.json` MUST declare a non-empty `repository` field.** `putitoutthere`
+> publishes npm packages with `npm publish --provenance` on the OIDC
+> trusted-publisher path; the npm CLI hard-requires `repository` so the
+> registry can verify the artifact was built from the repo the trusted
+> publisher declares. Preflight rejects the run with
+> `PIOT_NPM_MISSING_REPOSITORY` when the field is missing or empty.
+>
+> Canonical shape (use this in every npm `package.json` you publish through
+> `putitoutthere`):
+>
+> ```json
+> {
+>   "repository": {
+>     "type": "git",
+>     "url": "git+https://github.com/<owner>/<repo>.git",
+>     "directory": "<path/to/package>"
+>   }
+> }
+> ```
+>
+> `directory` is needed for monorepo packages so npm can locate the source
+> within the repo. The legacy single-string form
+> (`"repository": "git+https://github.com/<owner>/<repo>.git"`) is also
+> accepted.
+
 ### Example: polyglot Rust library
 
 One Rust crate feeds three artifacts:

package/action.yml

@@ -4,15 +4,25 @@ author: 'Kevin Scott'
 
 inputs:
   command:
-    description: 'Which CLI subcommand to run. Canonical values are `plan` and `publish`.'
+    description: 'Which CLI subcommand to run. Canonical values are `plan`, `publish`, and `write-version`.'
     required: false
     default: 'plan'
   working_directory:
     description: >-
-      Path the CLI runs against (forwarded as `--cwd`). Defaults to the
-      runner working directory. Internal use; the reusable workflow
-      supplies this when invoked against a non-root tree (e.g. e2e
-      fixtures materialized into a subdir).
+      Path the CLI runs against. For `plan` / `publish`, forwarded as
+      `--cwd`. For `write-version` (#276), forwarded as `--path` —
+      the package directory whose pyproject.toml / Cargo.toml gets
+      bumped. Defaults to the runner working directory. Internal use;
+      the reusable workflow supplies this when invoked against a
+      non-root tree (e.g. e2e fixtures materialized into a subdir,
+      or a per-package `matrix.path`).
+    required: false
+    default: ''
+  version:
+    description: >-
+      Planned version string. Required when `command: write-version`
+      (#276); ignored otherwise. The reusable workflow forwards the
+      build matrix's `version` row from the planner.
     required: false
     default: ''
   fail_on_error:

package/dist/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAwB1C"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmC1C"}

package/dist/action.js

@@ -7,18 +7,33 @@
  *
  * Issue #24. Plan: §5.2, §5.3.
  */
+import { pathToFileURL } from 'node:url';
 import { run } from './cli.js';
 export async function main() {
     const command = process.env.INPUT_COMMAND ?? '';
     const workingDirectory = process.env.INPUT_WORKING_DIRECTORY ?? '';
+    const versionInput = process.env.INPUT_VERSION ?? '';
     const failOnError = (process.env.INPUT_FAIL_ON_ERROR ?? 'true').toLowerCase() !== 'false';
     if (!command) {
         process.stderr.write('putitoutthere action: missing required input `command`\n');
         process.exit(1);
     }
-    const argv = ['node', 'putitoutthere', command, '--json'];
-    if (workingDirectory)
-        argv.push('--cwd', workingDirectory);
+    // #276: write-version uses a different argv shape — `--path` (the
+    // package dir, sourced from `working_directory`) and `--version`.
+    // No `--json`: the subcommand emits a single human line; there's
+    // no structured output to consume.
+    const argv = ['node', 'putitoutthere', command];
+    if (command === 'write-version') {
+        if (workingDirectory)
+            argv.push('--path', workingDirectory);
+        if (versionInput)
+            argv.push('--version', versionInput);
+    }
+    else {
+        argv.push('--json');
+        if (workingDirectory)
+            argv.push('--cwd', workingDirectory);
+    }
     const code = await run(argv);
     if (code !== 0 && !failOnError) {
         process.stderr.write(`putitoutthere action: ignoring non-zero exit (fail_on_error=false): ${code}\n`);
@@ -26,8 +41,18 @@ export async function main() {
     }
     process.exit(code);
 }
+// Entry-point guard. Compare via `pathToFileURL` so the guard fires on
+// Windows too: `import.meta.url` is a `file://` URL with forward
+// slashes (`file:///D:/.../index.js`), while `process.argv[1]` is the
+// native path (`D:\...\index.js`). Concatenating `file://` to the
+// native path produces a string that never equals the URL on Windows,
+// so the previous guard silently no-op'd the entire action when ncc-
+// bundled and invoked via `uses: ./` on a windows-latest runner —
+// `main()` was never called, the action exited 0 immediately, and
+// `_matrix.yml`'s pre-maturin write-version step bumped nothing
+// (PR #277, e2e Windows maturin failures). Issue #276.
 /* v8 ignore next 3 -- entry-point guard; only reachable when invoked as a binary */
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
     void main();
 }
 //# sourceMappingURL=action.js.map

package/dist/action.js.map

@@ -1 +1 @@
-{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACnE,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IAExE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,CAC3D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,gBAAgB;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,IAAI,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACrD,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IAExE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,CAC3D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,mCAAmC;IACnC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,IAAI,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,IAAI,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,uEAAuE;AACvE,iEAAiE;AACjE,sEAAsE;AACtE,kEAAkE;AAClE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,gEAAgE;AAChE,uDAAuD;AACvD,oFAAoF;AACpF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}

package/dist/cli.d.ts

@@ -5,15 +5,21 @@
  * not promised externally. See `notes/design-commitments.md`.
  *
  * Commands:
- *   plan       — compute and emit the release plan
- *   publish    — execute the plan against the registries
- *   version    — print CLI version
+ *   plan           — compute and emit the release plan
+ *   publish        — execute the plan against the registries
+ *   write-version  — bump a package's manifest to a planned version
+ *                    (pre-build hook for maturin; #276)
+ *   version        — print CLI version
  *
  * Global flags:
  *   --cwd <path>      working directory (default: process.cwd())
  *   --config <path>   path to putitoutthere.toml
  *   --json            machine-readable output
  *
+ * `write-version` flags:
+ *   --path <dir>      package directory (where pyproject.toml lives)
+ *   --version <v>     planned version to write
+ *
  * `--dry-run` was removed deliberately (#244). The library's job is
  * publishing; a non-publishing mode of the publish command was a
  * coverage hole pretending to be a feature. Passing `--dry-run` now
@@ -23,6 +29,8 @@ interface ParsedFlags {
     cwd: string;
     config?: string | undefined;
     json: boolean;
+    path?: string | undefined;
+    version?: string | undefined;
 }
 export declare function parseFlags(argv: readonly string[]): ParsedFlags;
 export declare function run(argv: readonly string[]): Promise<number>;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoCH,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CA4B/D;AAED,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8FlE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAwCH,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IAId,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CA8B/D;AAED,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6GlE"}

package/dist/cli.js

@@ -5,15 +5,21 @@
  * not promised externally. See `notes/design-commitments.md`.
  *
  * Commands:
- *   plan       — compute and emit the release plan
- *   publish    — execute the plan against the registries
- *   version    — print CLI version
+ *   plan           — compute and emit the release plan
+ *   publish        — execute the plan against the registries
+ *   write-version  — bump a package's manifest to a planned version
+ *                    (pre-build hook for maturin; #276)
+ *   version        — print CLI version
  *
  * Global flags:
  *   --cwd <path>      working directory (default: process.cwd())
  *   --config <path>   path to putitoutthere.toml
  *   --json            machine-readable output
  *
+ * `write-version` flags:
+ *   --path <dir>      package directory (where pyproject.toml lives)
+ *   --version <v>     planned version to write
+ *
  * `--dry-run` was removed deliberately (#244). The library's job is
  * publishing; a non-publishing mode of the publish command was a
  * coverage hole pretending to be a feature. Passing `--dry-run` now
@@ -22,8 +28,9 @@
 import { isAbsolute, resolve } from 'node:path';
 import { plan } from './plan.js';
 import { publish } from './publish.js';
+import { writeVersionForBuild } from './write-version.js';
 import { VERSION } from './version.js';
-const COMMANDS = ['plan', 'publish', 'version'];
+const COMMANDS = ['plan', 'publish', 'write-version', 'version'];
 function isCommand(value) {
     return COMMANDS.includes(value);
 }
@@ -32,13 +39,16 @@ function printUsage() {
         'Usage: putitoutthere <command> [options]',
         '',
         'Commands:',
-        '  plan       Compute and emit the release plan',
-        '  publish    Execute the plan',
-        '  version    Print CLI version',
+        '  plan           Compute and emit the release plan',
+        '  publish        Execute the plan',
+        '  write-version  Bump a package manifest to the planned version (pre-build; #276)',
+        '  version        Print CLI version',
         '',
         'Options:',
         '  --cwd <path>      working directory',
         '  --config <path>   path to putitoutthere.toml',
+        '  --path <dir>      package directory (write-version)',
+        '  --version <v>     planned version (write-version)',
         '  --json            emit machine-readable output',
         '',
         'See https://github.com/thekevinscott/putitoutthere for docs.',
@@ -59,6 +69,10 @@ export function parseFlags(argv) {
             out.config = argv[++i];
         else if (a === '--json')
             out.json = true;
+        else if (a === '--path')
+            out.path = argv[++i];
+        else if (a === '--version')
+            out.version = argv[++i];
         else if (a === '--dry-run') {
             // Removed in #244. Publishing is the library's only job; a
             // non-publishing flavor of `publish` is a coverage hole, not
@@ -130,6 +144,21 @@ export async function run(argv) {
                 }
                 return 0;
             }
+            case 'write-version': {
+                // #276: pre-build hook used by `_matrix.yml`'s maturin steps.
+                // Maturin reads the version from disk at build time with no
+                // env override, so the manifest must match the planned
+                // version before maturin runs. crates / npm bump at publish;
+                // setuptools-scm / hatch-vcs use SETUPTOOLS_SCM_PRETEND_VERSION.
+                if (!flags.path)
+                    throw new Error('write-version: --path <pkg-dir> is required');
+                if (!flags.version)
+                    throw new Error('write-version: --version <v> is required');
+                const target = isAbsolute(flags.path) ? flags.path : resolve(flags.cwd, flags.path);
+                const written = writeVersionForBuild(target, flags.version);
+                process.stdout.write(`write-version: ${target} → ${flags.version}; wrote ${written.join(', ')}\n`);
+                return 0;
+            }
             case 'publish': {
                 const result = await publish({
                     cwd: flags.cwd,

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAGzD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAQ,QAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,0CAA0C;QAC1C,EAAE;QACF,WAAW;QACX,gDAAgD;QAChD,+BAA+B;QAC/B,gCAAgC;QAChC,EAAE;QACF,UAAU;QACV,uCAAuC;QACvC,gDAAgD;QAChD,kDAAkD;QAClD,EAAE;QACF,8DAA8D;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAgB;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,sFAAsF;QACtF,IAAI,CAAC,KAAK,OAAO;YAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;aAC7C,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC7C,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACpC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,8CAA8C;IAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE,CAC1E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrC,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;oBACxB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBACnD,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;wBAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;4BACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,CAC/F,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,gEAAgE;gBAChE,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC/C,IAAI,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EACpC,MAAM,CACP,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;oBAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,2FAA2F;oBAC3F,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBAC/C,6FAA6F;gBAC/F,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;wBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,oBAAoB;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,6DAA6D;YAC7D,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,yBAAyB"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,CAAU,CAAC;AAG1E,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAQ,QAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,0CAA0C;QAC1C,EAAE;QACF,WAAW;QACX,oDAAoD;QACpD,mCAAmC;QACnC,mFAAmF;QACnF,oCAAoC;QACpC,EAAE;QACF,UAAU;QACV,uCAAuC;QACvC,gDAAgD;QAChD,uDAAuD;QACvD,qDAAqD;QACrD,kDAAkD;QAClD,EAAE;QACF,8DAA8D;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAgB;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,sFAAsF;QACtF,IAAI,CAAC,KAAK,OAAO;YAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;aAC7C,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC7C,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACpC,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACzC,IAAI,CAAC,KAAK,WAAW;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC/C,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,8CAA8C;IAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE,CAC1E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrC,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;oBACxB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBACnD,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;wBAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;4BACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,CAC/F,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,gEAAgE;gBAChE,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC/C,IAAI,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EACpC,MAAM,CACP,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,8DAA8D;gBAC9D,4DAA4D;gBAC5D,uDAAuD;gBACvD,6DAA6D;gBAC7D,iEAAiE;gBACjE,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAChF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAChF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpF,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,MAAM,MAAM,KAAK,CAAC,OAAO,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC7E,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;oBAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,2FAA2F;oBAC3F,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBAC/C,6FAA6F;gBAC/F,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;wBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,oBAAoB;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,6DAA6D;YAC7D,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,yBAAyB"}

package/dist/error-codes.d.ts

@@ -29,6 +29,13 @@ export declare const ErrorCodes: {
      *  prevent this from being reached; if it fires, the gate was
      *  bypassed or the engine is inconsistent. */
     readonly PUBLISH_EMPTY_PLAN: "PIOT_PUBLISH_EMPTY_PLAN";
+    /** An npm package's `package.json` is missing a non-empty
+     *  `repository` field. `npm publish --provenance` (the OIDC
+     *  trusted-publisher path) requires it so the registry can verify
+     *  the artifact was built from the repo the trusted publisher
+     *  declares. Failing at preflight prevents wasting a build run on
+     *  a precondition checkable in milliseconds. #280. */
+    readonly NPM_MISSING_REPOSITORY: "PIOT_NPM_MISSING_REPOSITORY";
 };
 export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 /**

package/dist/error-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;CAEtC,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EAG/C,CAAC"}
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;IAE9C;;;;;0DAKsD;;CAE9C,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EAI/C,CAAC"}

package/dist/error-codes.js

@@ -29,6 +29,13 @@ export const ErrorCodes = {
      *  prevent this from being reached; if it fires, the gate was
      *  bypassed or the engine is inconsistent. */
     PUBLISH_EMPTY_PLAN: 'PIOT_PUBLISH_EMPTY_PLAN',
+    /** An npm package's `package.json` is missing a non-empty
+     *  `repository` field. `npm publish --provenance` (the OIDC
+     *  trusted-publisher path) requires it so the registry can verify
+     *  the artifact was built from the repo the trusted publisher
+     *  declares. Failing at preflight prevents wasting a build run on
+     *  a precondition checkable in milliseconds. #280. */
+    NPM_MISSING_REPOSITORY: 'PIOT_NPM_MISSING_REPOSITORY',
 };
 /**
  * Iterable form of the codes. Walked by tests for uniqueness/format
@@ -37,5 +44,6 @@ export const ErrorCodes = {
 export const ALL_ERROR_CODES = [
     ErrorCodes.AUTH_NO_TOKEN,
     ErrorCodes.PUBLISH_EMPTY_PLAN,
+    ErrorCodes.NPM_MISSING_REPOSITORY,
 ];
 //# sourceMappingURL=error-codes.js.map

package/dist/error-codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;CACrC,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,UAAU,CAAC,aAAa;IACxB,UAAU,CAAC,kBAAkB;CAC9B,CAAC"}
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;IAC7C;;;;;0DAKsD;IACtD,sBAAsB,EAAE,6BAA6B;CAC7C,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,UAAU,CAAC,aAAa;IACxB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,sBAAsB;CAClC,CAAC"}

package/dist/handlers/npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAA6B,KAAK,OAAO,EAAwC,MAAM,aAAa,CAAC;AA8L5G;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBvE;AAYD,eAAO,MAAM,GAAG,EAAE,OAKjB,CAAC"}
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAA6B,KAAK,OAAO,EAAwC,MAAM,aAAa,CAAC;AAgN5G;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBvE;AAYD,eAAO,MAAM,GAAG,EAAE,OAKjB,CAAC"}

package/dist/handlers/npm.js

@@ -13,6 +13,7 @@ import { join } from 'node:path';
 import { normalizeTarget } from '../types.js';
 import { looksLikePublishOverRace, normalizeBuild, publishPlatforms, } from './npm-platform.js';
 import { buildSubprocessEnv, nonEmpty } from '../env.js';
+import { ErrorCodes } from '../error-codes.js';
 import { USER_AGENT } from '../version.js';
 function npmNameFor(pkg) {
     return pkg.npm ?? pkg.name;
@@ -88,9 +89,12 @@ async function publishImpl(pkg, version, ctx) {
     }
     const hasOidc = Boolean(nonEmpty(ctx.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) ??
         nonEmpty(process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN));
-    // npm provenance requires a `repository` field in package.json
-    // that matches the git remote. Failing loud here is strictly better
-    // than letting npm publish fail at the end with a confusing error.
+    // npm provenance requires a non-empty `repository` field in
+    // package.json that matches the git remote. The primary check is
+    // `requireProvenanceMetadata` in src/preflight.ts (#280), which
+    // runs before any runner work. This inline assertion is a
+    // defensive backstop for direct handler calls that bypass the
+    // publish pipeline.
     if (hasOidc) {
         assertRepositoryField(pkg.path);
     }
@@ -150,8 +154,23 @@ function assertRepositoryField(path) {
     const pkgJsonPath = join(path, 'package.json');
     const raw = readFileSync(pkgJsonPath, 'utf8');
     const pkg = JSON.parse(raw);
-    if (!pkg.repository) {
-        throw new Error('npm publish --provenance requires a `repository` field in package.json');
+    const repository = pkg.repository;
+    // Accept either the canonical object form (`{ type, url, … }`) or
+    // the legacy single-string form. Both shapes must carry a non-empty
+    // URL after trimming. `!pkg.repository` would pass `{}` and
+    // `{ type: 'git' }` since both are truthy — that's the bug #280
+    // is closing.
+    let ok = false;
+    if (typeof repository === 'string') {
+        ok = repository.trim().length > 0;
+    }
+    else if (repository !== null && typeof repository === 'object') {
+        const url = repository.url;
+        ok = typeof url === 'string' && url.trim().length > 0;
+    }
+    if (!ok) {
+        throw new Error(`[${ErrorCodes.NPM_MISSING_REPOSITORY}] npm publish --provenance requires a non-empty \`repository\` field in ${pkgJsonPath}. ` +
+            'See https://github.com/thekevinscott/putitoutthere#kind--npm.');
     }
 }
 /** Heuristic match on npm's auth-related stderr shapes. */

package/dist/handlers/npm.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAgE,MAAM,aAAa,CAAC;AAC5G,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAmB3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAS;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC/D,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,YAAY;YACnB,iEAAiE;YACjE,kEAAkE;YAClE,6DAA6D;YAC7D,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAC3D,CAAC;QACF,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CACvD,CAAC;IAEF,+DAA+D;IAC/D,oEAAoE;IACpE,mEAAmE;IACnE,IAAI,OAAO,EAAE,CAAC;QACZ,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;IACtC,MAAM,IAAI,GAAa,CAAC,SAAS,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,gEAAgE;YAChE,2CAA2C;YAC3C,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,GAAG,EAAE,iCAAiC,IAAI,MAAM,OAAO,EAAE;aAC1D,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,kCAAkC;QAClC,IAAI,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb;oBACE,yBAAyB,IAAI,6CAA6C;oBAC1E,6DAA6D;oBAC7D,+GAA+G;iBAChH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,iCAAiC,UAAU,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,qFAAqF,CAAC,IAAI,CAC/F,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,IAAI,CAAC;QACH,mEAAmE;QACnE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAC/E;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CACF,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,gEAAgE;QAChE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,0GAA0G;IAC1G,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAY;IAC1B,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,WAAW;CACrB,CAAC"}
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAgE,MAAM,aAAa,CAAC;AAC5G,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAmB3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAS;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC/D,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,YAAY;YACnB,iEAAiE;YACjE,kEAAkE;YAClE,6DAA6D;YAC7D,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAC3D,CAAC;QACF,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CACvD,CAAC;IAEF,4DAA4D;IAC5D,iEAAiE;IACjE,gEAAgE;IAChE,0DAA0D;IAC1D,8DAA8D;IAC9D,oBAAoB;IACpB,IAAI,OAAO,EAAE,CAAC;QACZ,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;IACtC,MAAM,IAAI,GAAa,CAAC,SAAS,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,gEAAgE;YAChE,2CAA2C;YAC3C,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,GAAG,EAAE,iCAAiC,IAAI,MAAM,OAAO,EAAE;aAC1D,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,kCAAkC;QAClC,IAAI,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb;oBACE,yBAAyB,IAAI,6CAA6C;oBAC1E,6DAA6D;oBAC7D,+GAA+G;iBAChH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,iCAAiC,UAAU,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,kEAAkE;IAClE,oEAAoE;IACpE,4DAA4D;IAC5D,gEAAgE;IAChE,cAAc;IACd,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,GAAG,GAAI,UAAgC,CAAC,GAAG,CAAC;QAClD,EAAE,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,sBAAsB,2EAA2E,WAAW,IAAI;YAC7H,+DAA+D,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,qFAAqF,CAAC,IAAI,CAC/F,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,IAAI,CAAC;QACH,mEAAmE;QACnE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAC/E;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CACF,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,gEAAgE;QAChE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,0GAA0G;IAC1G,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAY;IAC1B,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,WAAW;CACrB,CAAC"}

package/dist/preflight.d.ts

@@ -1,17 +1,24 @@
 /**
- * Pre-flight auth check. Runs before any publish side effect to verify
- * every cascaded package has usable credentials.
+ * Pre-flight checks. Run before any publish side effect.
  *
- * Per plan.md §16.3: each handler accepts OIDC (detected by
- * `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific long-lived env var.
- * OIDC-capable handlers fall back on the env var when OIDC is not
- * available.
+ * Auth (`requireAuth` / `checkAuth`) — every cascaded package has a
+ * viable credentials path. Per plan.md §16.3: each handler accepts
+ * OIDC (detected by `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific
+ * long-lived env var.
  *
- * This module reports; callers decide whether to throw. `requireAuth`
- * is the common case (publish). `pilot doctor` uses `checkAuth`
- * directly so it can show a table instead of aborting.
+ * npm provenance metadata (`requireProvenanceMetadata` /
+ * `checkProvenanceMetadata`) — every npm package's `package.json`
+ * carries a non-empty `repository` field. `npm publish --provenance`
+ * (the OIDC trusted-publisher path) hard-requires this; failing
+ * here, before runner work, beats failing deep inside the npm CLI
+ * after artifact upload + OIDC negotiation. #280.
  *
- * Issue #14.
+ * Each function reports; callers decide whether to throw. The
+ * `require*` variants are the publish path; the `check*` variants
+ * exist so future diagnostic surfaces can render tables instead of
+ * aborting.
+ *
+ * Issue #14, #280.
  */
 import type { Package } from './config.js';
 import type { Kind } from './types.js';
@@ -30,4 +37,38 @@ export interface AuthStatus {
 }
 export declare function checkAuth(packages: readonly Package[]): AuthStatus;
 export declare function requireAuth(packages: readonly Package[]): void;
+export interface ProvenanceFinding {
+    package: string;
+    /** Pkg-relative `package.json` path examined. */
+    packageJsonPath: string;
+    /** Why the field is unusable: missing entirely, or empty/no-url. */
+    reason: 'missing' | 'empty';
+}
+/**
+ * Scan every npm package's `package.json` for a non-empty `repository`
+ * field. Returns the list of findings; an empty list means every npm
+ * package is well-formed.
+ *
+ * `repository` is accepted in either the canonical object form
+ * (`{ type, url, directory? }`) or the legacy single-string form
+ * (`"git+https://…"`). The string form must be non-empty after
+ * trimming; the object form must carry a non-empty `url`.
+ *
+ * Non-npm packages and a malformed `package.json` (parse error) are
+ * skipped — other parts of the pipeline already cover those failure
+ * modes; this check is scoped to the `repository` field alone.
+ */
+export declare function checkProvenanceMetadata(packages: readonly Package[]): ProvenanceFinding[];
+/**
+ * Throw with an actionable error when any npm package's `package.json`
+ * lacks a non-empty `repository` field. Reports every failing package
+ * in one error rather than failing on the first, so consumers fix
+ * them all in one round-trip.
+ *
+ * Always runs (not OIDC-gated): the README demands the field for
+ * every npm publish, and `npm publish --provenance` is putitoutthere's
+ * blessed publish mode. Even on the token path, missing `repository`
+ * is a misconfiguration — fail fast.
+ */
+export declare function requireProvenanceMetadata(packages: readonly Package[]): void;
 //# sourceMappingURL=preflight.d.ts.map

package/dist/preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAqBvC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAClC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAgBlE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAiB9D"}
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAqBvC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAClC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAgBlE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAiB9D;AAcD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAC3B,iBAAiB,EAAE,CA0BrB;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CA8B5E"}

package/dist/preflight.js

@@ -1,18 +1,28 @@
 /**
- * Pre-flight auth check. Runs before any publish side effect to verify
- * every cascaded package has usable credentials.
+ * Pre-flight checks. Run before any publish side effect.
  *
- * Per plan.md §16.3: each handler accepts OIDC (detected by
- * `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific long-lived env var.
- * OIDC-capable handlers fall back on the env var when OIDC is not
- * available.
+ * Auth (`requireAuth` / `checkAuth`) — every cascaded package has a
+ * viable credentials path. Per plan.md §16.3: each handler accepts
+ * OIDC (detected by `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific
+ * long-lived env var.
  *
- * This module reports; callers decide whether to throw. `requireAuth`
- * is the common case (publish). `pilot doctor` uses `checkAuth`
- * directly so it can show a table instead of aborting.
+ * npm provenance metadata (`requireProvenanceMetadata` /
+ * `checkProvenanceMetadata`) — every npm package's `package.json`
+ * carries a non-empty `repository` field. `npm publish --provenance`
+ * (the OIDC trusted-publisher path) hard-requires this; failing
+ * here, before runner work, beats failing deep inside the npm CLI
+ * after artifact upload + OIDC negotiation. #280.
  *
- * Issue #14.
+ * Each function reports; callers decide whether to throw. The
+ * `require*` variants are the publish path; the `check*` variants
+ * exist so future diagnostic surfaces can render tables instead of
+ * aborting.
+ *
+ * Issue #14, #280.
  */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCodes } from './error-codes.js';
 // Per-kind accepted env var names, primary first. `checkAuth` scans left
 // to right and reports the first that has a non-empty value. npm takes
 // two names because ecosystems have split on the convention:
@@ -67,4 +77,88 @@ export function requireAuth(packages) {
 function nonEmpty(v) {
     return typeof v === 'string' && v.trim().length > 0;
 }
+/* ----------------------- npm provenance metadata ----------------------- */
+// Anchor for the README section that documents the field requirement.
+// Surfaced verbatim in the thrown error so users have something
+// actionable to follow rather than a code-search target.
+const REPOSITORY_DOC_POINTER = 'https://github.com/thekevinscott/putitoutthere#kind--npm';
+/**
+ * Scan every npm package's `package.json` for a non-empty `repository`
+ * field. Returns the list of findings; an empty list means every npm
+ * package is well-formed.
+ *
+ * `repository` is accepted in either the canonical object form
+ * (`{ type, url, directory? }`) or the legacy single-string form
+ * (`"git+https://…"`). The string form must be non-empty after
+ * trimming; the object form must carry a non-empty `url`.
+ *
+ * Non-npm packages and a malformed `package.json` (parse error) are
+ * skipped — other parts of the pipeline already cover those failure
+ * modes; this check is scoped to the `repository` field alone.
+ */
+export function checkProvenanceMetadata(packages) {
+    const findings = [];
+    for (const p of packages) {
+        if (p.kind !== 'npm')
+            continue;
+        const pkgJsonPath = join(p.path, 'package.json');
+        let raw;
+        try {
+            raw = readFileSync(pkgJsonPath, 'utf8');
+        }
+        catch {
+            findings.push({ package: p.name, packageJsonPath: pkgJsonPath, reason: 'missing' });
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            // A malformed package.json is a different failure surface;
+            // leave it to the publish step to bubble up. This check only
+            // owns the `repository` field.
+            continue;
+        }
+        if (!hasNonEmptyRepository(parsed.repository)) {
+            findings.push({ package: p.name, packageJsonPath: pkgJsonPath, reason: 'empty' });
+        }
+    }
+    return findings;
+}
+function hasNonEmptyRepository(value) {
+    if (typeof value === 'string')
+        return value.trim().length > 0;
+    if (value !== null && typeof value === 'object') {
+        const url = value.url;
+        return typeof url === 'string' && url.trim().length > 0;
+    }
+    return false;
+}
+/**
+ * Throw with an actionable error when any npm package's `package.json`
+ * lacks a non-empty `repository` field. Reports every failing package
+ * in one error rather than failing on the first, so consumers fix
+ * them all in one round-trip.
+ *
+ * Always runs (not OIDC-gated): the README demands the field for
+ * every npm publish, and `npm publish --provenance` is putitoutthere's
+ * blessed publish mode. Even on the token path, missing `repository`
+ * is a misconfiguration — fail fast.
+ */
+export function requireProvenanceMetadata(packages) {
+    const findings = checkProvenanceMetadata(packages);
+    if (findings.length === 0)
+        return;
+    const lines = [
+        `[${ErrorCodes.NPM_MISSING_REPOSITORY}] npm publish requires a non-empty \`repository\` field in package.json.`,
+        '',
+        'Failing packages:',
+    ];
+    for (const f of findings) {
+        lines.push(`  - ${f.package}: ${f.packageJsonPath} (${f.reason})`);
+    }
+    lines.push('', 'Why: `npm publish --provenance` (used by putitoutthere on the OIDC trusted-publisher', 'path) hard-requires this field so npm can verify the package was built from the repo', 'the trusted publisher declares.', '', 'Fix: add a `repository` block to each failing package.json. Canonical shape:', '', '  {', '    "repository": {', '      "type": "git",', '      "url": "git+https://github.com/<owner>/<repo>.git",', '      "directory": "<path/to/package>"', '    }', '  }', '', `See ${REPOSITORY_DOC_POINTER}.`);
+    throw new Error(lines.join('\n'));
+}
 //# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,kEAAkE;AAClE,yDAAyD;AACzD,uEAAuE;AACvE,uCAAuC;AACvC,MAAM,SAAS,GAAoC;IACjD,MAAM,EAAE,CAAC,sBAAsB,CAAC;IAChC,IAAI,EAAE,CAAC,gBAAgB,CAAC;IACxB,GAAG,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;CACtC,CAAC;AAEF,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,uEAAuE;AACvE,UAAU;AACV,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAiBhF,MAAM,UAAU,SAAS,CAAC,QAA4B;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAW,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,IAAI,iBAAiB,QAAQ,GAAG,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb;QACE,+BAA+B;QAC/B,GAAG,KAAK;QACR,EAAE;QACF,mFAAmF;QACnF,OAAO,YAAY,GAAG;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,kEAAkE;AAClE,yDAAyD;AACzD,uEAAuE;AACvE,uCAAuC;AACvC,MAAM,SAAS,GAAoC;IACjD,MAAM,EAAE,CAAC,sBAAsB,CAAC;IAChC,IAAI,EAAE,CAAC,gBAAgB,CAAC;IACxB,GAAG,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;CACtC,CAAC;AAEF,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,uEAAuE;AACvE,UAAU;AACV,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAiBhF,MAAM,UAAU,SAAS,CAAC,QAA4B;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAW,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,IAAI,iBAAiB,QAAQ,GAAG,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb;QACE,+BAA+B;QAC/B,GAAG,KAAK;QACR,EAAE;QACF,mFAAmF;QACnF,OAAO,YAAY,GAAG;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,6EAA6E;AAE7E,sEAAsE;AACtE,gEAAgE;AAChE,yDAAyD;AACzD,MAAM,sBAAsB,GAC1B,0DAA0D,CAAC;AAU7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA4B;IAE5B,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,6DAA6D;YAC7D,+BAA+B;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA4B;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,KAAK,GAAa;QACtB,IAAI,UAAU,CAAC,sBAAsB,0EAA0E;QAC/G,EAAE;QACF,mBAAmB;KACpB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,sFAAsF,EACtF,sFAAsF,EACtF,iCAAiC,EACjC,EAAE,EACF,8EAA8E,EAC9E,EAAE,EACF,KAAK,EACL,qBAAqB,EACrB,sBAAsB,EACtB,2DAA2D,EAC3D,wCAAwC,EACxC,OAAO,EACP,KAAK,EACL,EAAE,EACF,OAAO,sBAAsB,GAAG,CACjC,CAAC;IACF,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAmI1E"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAyI1E"}

package/dist/publish.js

@@ -24,7 +24,7 @@ import { handlerFor as defaultHandlerFor } from './handlers/index.js';
 import { createLogger } from './log.js';
 import { plan } from './plan.js';
 import { formatTag } from './tag-template.js';
-import { requireAuth } from './preflight.js';
+import { requireAuth, requireProvenanceMetadata } from './preflight.js';
 import { withRetry } from './retry.js';
 import { readHandlerMeta } from './types.js';
 import { dumpFailure } from './verbose.js';
@@ -66,6 +66,11 @@ export async function publish(opts) {
     //    auth path (OIDC env or env-var token) before any side effects.
     const selectedPackages = [...perPackage.keys()].map((name) => mustGet(config.packages, name));
     requireAuth(selectedPackages);
+    // 2b. Pre-flight npm provenance metadata: every selected npm package's
+    //     package.json must carry a non-empty `repository` field. Without
+    //     it, `npm publish --provenance` fails deep inside the npm CLI
+    //     after the runner has spun up — checkable in milliseconds. #280.
+    requireProvenanceMetadata(selectedPackages);
     // 3. Artifact completeness.
     const completeness = checkCompleteness(matrix, artifactsRoot(cwd));
     const incomplete = [...completeness.entries()].filter(([, r]) => !r.ok);

package/dist/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,kBAAkB,+CAA+C;YAChF,8DAA8D;YAC9D,6EAA6E;YAC7E,+EAA+E;YAC/E,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,8DAA8D;YAC9D,8DAA8D;YAC9D,iDAAiD;YACjD,mBAAmB,EAAE,MAAM,CAAC,QAAQ;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,kBAAkB,+CAA+C;YAChF,8DAA8D;YAC9D,6EAA6E;YAC7E,+EAA+E;YAC/E,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,8DAA8D;YAC9D,8DAA8D;YAC9D,iDAAiD;YACjD,mBAAmB,EAAE,MAAM,CAAC,QAAQ;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/write-version.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Pre-build version bump used by `_matrix.yml`'s maturin steps. #276.
+ *
+ * Maturin reads `[project].version` from `pyproject.toml` (or
+ * `[package].version` from a sibling `Cargo.toml` when pyproject
+ * declares `dynamic = ["version"]`) at build time. There is no env
+ * override the build job can inject — `SETUPTOOLS_SCM_PRETEND_VERSION`
+ * is honored by hatch-vcs / setuptools-scm but not by maturin. So
+ * the on-disk manifest has to be rewritten before `maturin build`
+ * runs. crates and npm bump at publish (cargo / npm read the
+ * manifest at upload time, not before); maturin is the one path
+ * where the artifact (the wheel) leaves the build runner already
+ * versioned.
+ *
+ * This module is the build-time complement to `pypi.writeVersion`.
+ * The publish-time handler logs guidance for dynamic-version
+ * projects rather than rewriting Cargo.toml; here we actually do
+ * the rewrite, because the build step has no fallback.
+ */
+/**
+ * Rewrite the version source(s) for a maturin package and return the
+ * list of absolute paths that were modified.
+ *
+ * Dispatch:
+ *  - `[project].version = "..."` is a static literal → rewrite
+ *    pyproject.toml in place. If a sibling `Cargo.toml` with a
+ *    `[package].version` line is present, rewrite it too. This is
+ *    not redundant: a python-rust-maturin shape with both a static
+ *    pyproject literal AND a Cargo `[package].version` literal will
+ *    have the two manifests disagree post-bump if only pyproject is
+ *    rewritten, and maturin's mismatch-resolution behavior varies
+ *    by platform / version (PR #277 hit this on Windows: wheels
+ *    shipped at the stale Cargo literal even though pyproject was
+ *    bumped). Bumping both keeps the contract straightforward.
+ *  - `[project].dynamic = ["version", ...]` → rewrite the sibling
+ *    `Cargo.toml`'s `[package].version`. Errors if Cargo.toml is
+ *    missing.
+ *
+ * Throws on missing pyproject.toml, malformed TOML, or a `[project]`
+ * table that declares neither a literal nor `dynamic = ["version"]`.
+ *
+ * I/O uses `readFileSync` with `try` / `catch (ENOENT)` instead of an
+ * `existsSync` precheck — the precheck is a TOCTOU race CodeQL flags
+ * (`pull/277` advisories #13, #14), and `pypi.writeVersion` already
+ * uses the same try/catch shape we mirror here.
+ */
+export declare function writeVersionForBuild(pkgDir: string, version: string): string[];
+//# sourceMappingURL=write-version.d.ts.map

package/dist/write-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-version.d.ts","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA6E9E"}

package/dist/write-version.js

@@ -0,0 +1,134 @@
+/**
+ * Pre-build version bump used by `_matrix.yml`'s maturin steps. #276.
+ *
+ * Maturin reads `[project].version` from `pyproject.toml` (or
+ * `[package].version` from a sibling `Cargo.toml` when pyproject
+ * declares `dynamic = ["version"]`) at build time. There is no env
+ * override the build job can inject — `SETUPTOOLS_SCM_PRETEND_VERSION`
+ * is honored by hatch-vcs / setuptools-scm but not by maturin. So
+ * the on-disk manifest has to be rewritten before `maturin build`
+ * runs. crates and npm bump at publish (cargo / npm read the
+ * manifest at upload time, not before); maturin is the one path
+ * where the artifact (the wheel) leaves the build runner already
+ * versioned.
+ *
+ * This module is the build-time complement to `pypi.writeVersion`.
+ * The publish-time handler logs guidance for dynamic-version
+ * projects rather than rewriting Cargo.toml; here we actually do
+ * the rewrite, because the build step has no fallback.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { replaceCargoVersion } from './handlers/crates.js';
+import { replacePyProjectVersion } from './handlers/pypi.js';
+/**
+ * Rewrite the version source(s) for a maturin package and return the
+ * list of absolute paths that were modified.
+ *
+ * Dispatch:
+ *  - `[project].version = "..."` is a static literal → rewrite
+ *    pyproject.toml in place. If a sibling `Cargo.toml` with a
+ *    `[package].version` line is present, rewrite it too. This is
+ *    not redundant: a python-rust-maturin shape with both a static
+ *    pyproject literal AND a Cargo `[package].version` literal will
+ *    have the two manifests disagree post-bump if only pyproject is
+ *    rewritten, and maturin's mismatch-resolution behavior varies
+ *    by platform / version (PR #277 hit this on Windows: wheels
+ *    shipped at the stale Cargo literal even though pyproject was
+ *    bumped). Bumping both keeps the contract straightforward.
+ *  - `[project].dynamic = ["version", ...]` → rewrite the sibling
+ *    `Cargo.toml`'s `[package].version`. Errors if Cargo.toml is
+ *    missing.
+ *
+ * Throws on missing pyproject.toml, malformed TOML, or a `[project]`
+ * table that declares neither a literal nor `dynamic = ["version"]`.
+ *
+ * I/O uses `readFileSync` with `try` / `catch (ENOENT)` instead of an
+ * `existsSync` precheck — the precheck is a TOCTOU race CodeQL flags
+ * (`pull/277` advisories #13, #14), and `pypi.writeVersion` already
+ * uses the same try/catch shape we mirror here.
+ */
+export function writeVersionForBuild(pkgDir, version) {
+    const pyProjectPath = join(pkgDir, 'pyproject.toml');
+    let pyOriginal;
+    try {
+        pyOriginal = readFileSync(pyProjectPath, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            throw new Error(`write-version: pyproject.toml not found at ${pyProjectPath}`, {
+                cause: err,
+            });
+        }
+        /* v8 ignore next -- non-ENOENT read errors surface as-is */
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = parseToml(pyOriginal);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`write-version: failed to parse ${pyProjectPath}: ${msg}`, { cause: err });
+    }
+    const project = parsed?.project;
+    if (!project) {
+        throw new Error(`write-version: ${pyProjectPath} has no [project] table -- declare [project].version or [project].dynamic = ["version"]`);
+    }
+    const cargoPath = join(pkgDir, 'Cargo.toml');
+    if (isDynamicVersion(project)) {
+        let cargoOriginal;
+        try {
+            cargoOriginal = readFileSync(cargoPath, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                throw new Error(`write-version: pyproject.toml declares dynamic = ["version"] but Cargo.toml is missing at ${cargoPath}. Maturin's dynamic-version mode reads [package].version from Cargo.toml; without it there's nothing to bump.`, { cause: err });
+            }
+            /* v8 ignore next -- non-ENOENT read errors surface as-is */
+            throw err;
+        }
+        const cargoUpdated = replaceCargoVersion(cargoOriginal, version);
+        if (cargoUpdated !== cargoOriginal)
+            writeFileSync(cargoPath, cargoUpdated, 'utf8');
+        return [cargoPath];
+    }
+    const written = [];
+    const pyUpdated = replacePyProjectVersion(pyOriginal, version);
+    if (pyUpdated !== pyOriginal)
+        writeFileSync(pyProjectPath, pyUpdated, 'utf8');
+    written.push(pyProjectPath);
+    // Bump a sibling Cargo.toml's [package].version too, when present.
+    // Pure-python pyproject (no Rust crate) → no Cargo.toml → skip.
+    // Cargo.toml without [package].version (workspace root) → skip
+    // (replaceCargoVersion throws on missing field; catch and continue).
+    let cargoOriginal;
+    try {
+        cargoOriginal = readFileSync(cargoPath, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return written;
+        /* v8 ignore next -- non-ENOENT read errors surface as-is */
+        throw err;
+    }
+    let cargoUpdated;
+    try {
+        cargoUpdated = replaceCargoVersion(cargoOriginal, version);
+    }
+    catch {
+        // No [package].version in Cargo.toml — nothing to bump on the
+        // Cargo side. The pyproject bump above is the source of truth.
+        return written;
+    }
+    if (cargoUpdated !== cargoOriginal)
+        writeFileSync(cargoPath, cargoUpdated, 'utf8');
+    written.push(cargoPath);
+    return written;
+}
+function isDynamicVersion(project) {
+    const { dynamic } = project;
+    return Array.isArray(dynamic) && dynamic.includes('version');
+}
+//# sourceMappingURL=write-version.js.map

package/dist/write-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-version.js","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,aAAa,EAAE,EAAE;gBAC7E,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAI,MAA8C,EAAE,OAAO,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,yFAAyF,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE7C,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,6FAA6F,SAAS,+GAA+G,EACrN,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,4DAA4D;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,aAAa;YAAE,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACnF,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,UAAU;QAAE,aAAa,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE5B,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,qEAAqE;IACrE,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACrE,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,+DAA+D;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,YAAY,KAAK,aAAa;QAAE,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA8B;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {