putitoutthere 0.3.26 → 0.3.28

package/dist/verify/npm-tarball/triple.d.ts

@@ -1,30 +1,8 @@
 /**
- * Verify each published per-triple npm tarball ships a synthesized binary,
- * not just metadata (#443).
- *
- * `npm-platform`'s `synthesizePlatformPackage` emits `files: <readdir of
- * the artifact dir>`, so an empty artifact dir yields a tarball with only
- * `package.json` and `npm publish` still returns 0. This step downloads the
- * published platform tarball back and asserts at least one non-`package.json`
- * file is present — shipping that binary is the whole point of the
- * synthesis. Extracted verbatim from the "Verify published per-triple npm
- * tarballs honor expected files" bash block.
- *
- * The count is RECURSIVE (#633). A consumer whose build stages the binary
- * nested — `artifacts/<name>-<triple>/bin/<binary>` rather than flat —
- * publishes a tarball whose top level is `package.json` plus the `bin/`
- * directory, and a top-level file count discards that directory along with
- * the payload inside it. The nested layout is legal all the way to publish
- * (`checkCompleteness` lists recursively, so it accepts either shape), so
- * this check has to see it too. Paths are reported relative to `package/`,
- * which is what makes a nested payload legible in the log. One walk decides
- * the verdict, so the failure message can no longer name a file the verdict
- * called absent.
- *
- * The platform package name is reconstructed as `{name}-{triple}` — the
- * default template every fixture uses — because the matrix row carries the
- * main package name (synthesis is a publish-time concern). Returns the
- * process exit code (0 ok, 1 on any metadata-only tarball).
+ * Verify each published per-triple npm tarball ships a synthesized binary, not
+ * just metadata (#443): an empty artifact dir yields a `package.json`-only
+ * tarball and `npm publish` still returns 0. The count is RECURSIVE (#633) — a
+ * nested `bin/<binary>` layout is legal to publish, and a flat count misses it.
  */
 import type { TarballRow, VerifyNpmTarballOptions } from './types.js';
 export declare function verifyNpmTarballTriple(rows: TarballRow[], opts: VerifyNpmTarballOptions): Promise<number>;

package/dist/verify/npm-tarball/triple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"triple.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AASH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,UAAU,EAAE,EAClB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+CjB"}
+{"version":3,"file":"triple.d.ts","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEtE,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,UAAU,EAAE,EAClB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/verify/npm-tarball/triple.js

@@ -1,30 +1,8 @@
 /**
- * Verify each published per-triple npm tarball ships a synthesized binary,
- * not just metadata (#443).
- *
- * `npm-platform`'s `synthesizePlatformPackage` emits `files: <readdir of
- * the artifact dir>`, so an empty artifact dir yields a tarball with only
- * `package.json` and `npm publish` still returns 0. This step downloads the
- * published platform tarball back and asserts at least one non-`package.json`
- * file is present — shipping that binary is the whole point of the
- * synthesis. Extracted verbatim from the "Verify published per-triple npm
- * tarballs honor expected files" bash block.
- *
- * The count is RECURSIVE (#633). A consumer whose build stages the binary
- * nested — `artifacts/<name>-<triple>/bin/<binary>` rather than flat —
- * publishes a tarball whose top level is `package.json` plus the `bin/`
- * directory, and a top-level file count discards that directory along with
- * the payload inside it. The nested layout is legal all the way to publish
- * (`checkCompleteness` lists recursively, so it accepts either shape), so
- * this check has to see it too. Paths are reported relative to `package/`,
- * which is what makes a nested payload legible in the log. One walk decides
- * the verdict, so the failure message can no longer name a file the verdict
- * called absent.
- *
- * The platform package name is reconstructed as `{name}-{triple}` — the
- * default template every fixture uses — because the matrix row carries the
- * main package name (synthesis is a publish-time concern). Returns the
- * process exit code (0 ok, 1 on any metadata-only tarball).
+ * Verify each published per-triple npm tarball ships a synthesized binary, not
+ * just metadata (#443): an empty artifact dir yields a `package.json`-only
+ * tarball and `npm publish` still returns 0. The count is RECURSIVE (#633) — a
+ * nested `bin/<binary>` layout is legal to publish, and a flat count misses it.
  */
 import { rm } from 'node:fs/promises';
 import { relative } from 'node:path';

package/dist/verify/npm-tarball/triple.js.map

@@ -1 +1 @@
-{"version":3,"file":"triple.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAkB,EAClB,IAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACrG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,IAAI,OAAO,0BAA0B,QAAQ,IAAI,CAAC,CAAC;QAExF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,iBAAiB,QAAQ,mKAAmK,CACjO,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9D,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,8EAA8E,CACnH,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"triple.js","sourceRoot":"","sources":["../../../src/verify/npm-tarball/triple.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAkB,EAClB,IAA6B;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACrG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,IAAI,OAAO,0BAA0B,QAAQ,IAAI,CAAC,CAAC;QAExF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,iBAAiB,QAAQ,mKAAmK,CACjO,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9D,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,YAAY,IAAI,OAAO,8EAA8E,CACnH,CAAC;YACF,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/posture.d.ts

@@ -1,17 +1,8 @@
 /**
- * `putitoutthere verify` — per-package publish/trust posture (#414).
- *
- * Answers "do I still need the registry token, or is OIDC trusted
- * publishing active?" For each package it reads the latest published
- * version (the same `latestVersion` `status` uses) and then that release's
- * trust attribution via the handler's `trustPosture` primitive — from
- * PUBLIC registry data, no secrets. Classifies `oidc` (trusted publisher /
- * provenance) / `token` / `unpublished` (no release) / `unreachable`.
- *
- * Shared engine, no parallel logic (design-commitments #7): a thin reader
- * over the per-kind handlers, reusing the exact registry-name resolution
- * the publish path runs. The read degrades — an unreachable registry
- * yields `unreachable`, never an abort — matching `status`.
+ * `putitoutthere verify` — per-package publish/trust posture (#414): "do I still
+ * need the registry token, or is OIDC trusted publishing active?", answered from
+ * PUBLIC registry data via the handler's `trustPosture`. Classifies `oidc` /
+ * `token` / `unpublished` / `unreachable`; unreachable degrades, never aborts.
  */
 import type { VerifyOptions, VerifyRow } from './posture-types.js';
 export declare function computeVerify(opts: VerifyOptions): Promise<VerifyRow[]>;

package/dist/verify/posture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/verify/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,KAAK,EAAW,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA6B7E"}
+{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/verify/posture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAW,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE5E,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA6B7E"}

package/dist/verify/posture.js

@@ -1,17 +1,8 @@
 /**
- * `putitoutthere verify` — per-package publish/trust posture (#414).
- *
- * Answers "do I still need the registry token, or is OIDC trusted
- * publishing active?" For each package it reads the latest published
- * version (the same `latestVersion` `status` uses) and then that release's
- * trust attribution via the handler's `trustPosture` primitive — from
- * PUBLIC registry data, no secrets. Classifies `oidc` (trusted publisher /
- * provenance) / `token` / `unpublished` (no release) / `unreachable`.
- *
- * Shared engine, no parallel logic (design-commitments #7): a thin reader
- * over the per-kind handlers, reusing the exact registry-name resolution
- * the publish path runs. The read degrades — an unreachable registry
- * yields `unreachable`, never an abort — matching `status`.
+ * `putitoutthere verify` — per-package publish/trust posture (#414): "do I still
+ * need the registry token, or is OIDC trusted publishing active?", answered from
+ * PUBLIC registry data via the handler's `trustPosture`. Classifies `oidc` /
+ * `token` / `unpublished` / `unreachable`; unreachable degrades, never aborts.
  */
 import { join } from 'node:path';
 import { loadConfig } from '../config.js';

package/dist/verify/posture.js.map

@@ -1 +1 @@
-{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/verify/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIzC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAQ;QACf,GAAG;QACH,GAAG,EAAE,YAAY,EAAE;QACnB,GAAG,EAAE,OAAO,CAAC,GAA6B;QAC1C,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;KAC/C,CAAC;IAEF,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,mEAAmE;YACnE,4BAA4B;YAC5B,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,wBAAwB;YACxB,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/verify/posture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIzC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAQ;QACf,GAAG;QACH,GAAG,EAAE,YAAY,EAAE;QACnB,GAAG,EAAE,OAAO,CAAC,GAA6B;QAC1C,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;KAC/C,CAAC;IAEF,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,mEAAmE;YACnE,4BAA4B;YAC5B,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,wBAAwB;YACxB,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/wheel/index.d.ts

@@ -1,21 +1,8 @@
 /**
- * `putitoutthere verify wheel` — assert the built wheel/sdist carries the
- * planned version (#450, epic #442).
- *
- * Extraction of the inline "Verify wheel/sdist version matches
- * matrix.version" bash block (#276) in `.github/workflows/e2e-fixture-job.yml`.
- * The contract, per that step: "the build artifact carries matrix.version",
- * verified directly against the produced files — independent of which
- * mechanism (write-version, SETUPTOOLS_SCM_PRETEND_VERSION, …) set the
- * manifest, so it catches a divergence regardless of which build path
- * silently regressed.
- *
- * For an sdist row (`--target sdist`) the sdist filename must end
- * `-<version>.tar.gz`; for a wheel row the first `*.whl`'s
- * `*.dist-info/METADATA` `Version:` must equal `--version`. The wheel is
- * read with a pure-Node zip reader (no `unzip`), so this runs on every
- * platform the maturin matrix builds on. Async throughout. Returns the
- * process exit code (0 ok, 1 on any miss).
+ * `putitoutthere verify wheel` — assert the built wheel/sdist carries the planned
+ * version (#450, #276), whatever set the manifest. An sdist filename must end
+ * `-<version>.tar.gz`; a wheel's `*.dist-info/METADATA` `Version:` must equal
+ * `--version`, read with a pure-Node zip reader so Windows rows work too.
  */
 import type { VerifyWheelOptions } from './types.js';
 export declare function verifyWheel(opts: VerifyWheelOptions): Promise<number>;

package/dist/verify/wheel/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkD3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkD3E"}

package/dist/verify/wheel/index.js

@@ -1,21 +1,8 @@
 /**
- * `putitoutthere verify wheel` — assert the built wheel/sdist carries the
- * planned version (#450, epic #442).
- *
- * Extraction of the inline "Verify wheel/sdist version matches
- * matrix.version" bash block (#276) in `.github/workflows/e2e-fixture-job.yml`.
- * The contract, per that step: "the build artifact carries matrix.version",
- * verified directly against the produced files — independent of which
- * mechanism (write-version, SETUPTOOLS_SCM_PRETEND_VERSION, …) set the
- * manifest, so it catches a divergence regardless of which build path
- * silently regressed.
- *
- * For an sdist row (`--target sdist`) the sdist filename must end
- * `-<version>.tar.gz`; for a wheel row the first `*.whl`'s
- * `*.dist-info/METADATA` `Version:` must equal `--version`. The wheel is
- * read with a pure-Node zip reader (no `unzip`), so this runs on every
- * platform the maturin matrix builds on. Async throughout. Returns the
- * process exit code (0 ok, 1 on any miss).
+ * `putitoutthere verify wheel` — assert the built wheel/sdist carries the planned
+ * version (#450, #276), whatever set the manifest. An sdist filename must end
+ * `-<version>.tar.gz`; a wheel's `*.dist-info/METADATA` `Version:` must equal
+ * `--version`, read with a pure-Node zip reader so Windows rows work too.
  */
 import { stat } from 'node:fs/promises';
 import { basename, isAbsolute, join, resolve } from 'node:path';

package/dist/verify/wheel/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/verify/wheel/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAGxD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,OAAO,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,IAAI,uCAAuC,IAAI,CAAC,OAAO,KAAK,CACzF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,IAAI,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,MAAM,IAAI,EAAE,eAAe,IAAI,CAAC,OAAO,aAAa,QAAQ,CAAC,KAAK,CAAC,KAAK,CAC7G,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,gEAAgE;IAChE,kEAAkE;IAClE,+DAA+D;IAC/D,oEAAoE;IACpE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,QAAQ,CAAC,KAAK,CAAC,sDAAsD,IAAI,CAAC,SAAS,IAAI,EAAE,yCAAyC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACrM,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,KAAK,CAAC,qBAAqB,MAAM,IAAI,CAAC,CAAC;IAClF,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/verify/wheel/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAGxD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,OAAO,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,IAAI,uCAAuC,IAAI,CAAC,OAAO,KAAK,CACzF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,IAAI,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,MAAM,IAAI,EAAE,eAAe,IAAI,CAAC,OAAO,aAAa,QAAQ,CAAC,KAAK,CAAC,KAAK,CAC7G,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,gEAAgE;IAChE,kEAAkE;IAClE,+DAA+D;IAC/D,oEAAoE;IACpE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,QAAQ,CAAC,KAAK,CAAC,sDAAsD,IAAI,CAAC,SAAS,IAAI,EAAE,yCAAyC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACrM,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,KAAK,CAAC,qBAAqB,MAAM,IAAI,CAAC,CAAC;IAClF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/verify/wheel/manylinux-tag-patterns.d.ts

@@ -1,10 +1,8 @@
 /**
- * #610: map a config `manylinux` baseline to the platform-tag substrings
- * a compliant wheel filename may carry. maturin emits PEP 600 tags
- * (`manylinux_2_28`) and, for the legacy aliases, sometimes both the
- * alias and its PEP 600 equivalent — accept either. `auto` (or no
- * baseline) returns no patterns: the tag is whatever the build
- * environment produced, so there is nothing to assert.
+ * #610: map a config `manylinux` baseline to the platform-tag substrings a
+ * compliant wheel filename may carry. maturin emits PEP 600 tags
+ * (`manylinux_2_28`) and sometimes both a legacy alias and its PEP 600
+ * equivalent — accept either. `auto` (or unset) asserts nothing.
  */
 export declare function manylinuxTagPatterns(manylinux: string | undefined): string[];
 //# sourceMappingURL=manylinux-tag-patterns.d.ts.map

package/dist/verify/wheel/manylinux-tag-patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manylinux-tag-patterns.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/manylinux-tag-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAgB5E"}
+{"version":3,"file":"manylinux-tag-patterns.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/manylinux-tag-patterns.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAgB5E"}

package/dist/verify/wheel/manylinux-tag-patterns.js

@@ -1,10 +1,8 @@
 /**
- * #610: map a config `manylinux` baseline to the platform-tag substrings
- * a compliant wheel filename may carry. maturin emits PEP 600 tags
- * (`manylinux_2_28`) and, for the legacy aliases, sometimes both the
- * alias and its PEP 600 equivalent — accept either. `auto` (or no
- * baseline) returns no patterns: the tag is whatever the build
- * environment produced, so there is nothing to assert.
+ * #610: map a config `manylinux` baseline to the platform-tag substrings a
+ * compliant wheel filename may carry. maturin emits PEP 600 tags
+ * (`manylinux_2_28`) and sometimes both a legacy alias and its PEP 600
+ * equivalent — accept either. `auto` (or unset) asserts nothing.
  */
 export function manylinuxTagPatterns(manylinux) {
     if (manylinux === undefined || manylinux === '' || manylinux === 'auto') {

package/dist/verify/wheel/manylinux-tag-patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"manylinux-tag-patterns.js","sourceRoot":"","sources":["../../../src/verify/wheel/manylinux-tag-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA6B;IAChE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,GAAG;YACN,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAC3C,KAAK,MAAM;YACT,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC/C,KAAK,MAAM;YACT,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC/C;YACE,iEAAiE;YACjE,0BAA0B;YAC1B,OAAO,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC;IAChG,CAAC;AACH,CAAC"}
+{"version":3,"file":"manylinux-tag-patterns.js","sourceRoot":"","sources":["../../../src/verify/wheel/manylinux-tag-patterns.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA6B;IAChE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,GAAG;YACN,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAC3C,KAAK,MAAM;YACT,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC/C,KAAK,MAAM;YACT,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC/C;YACE,iEAAiE;YACjE,0BAA0B;YAC1B,OAAO,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC;IAChG,CAAC;AACH,CAAC"}

package/dist/verify/wheel/read-wheel-version.d.ts

@@ -1,12 +1,8 @@
 /**
- * Read the `Version:` field from a wheel's `*.dist-info/METADATA` (#450).
- *
- * The engine analogue of the bash
- * `unzip -p "$wheel" '*.dist-info/METADATA' | awk '/^Version:/ { print $2 }'`,
- * but via the pure-Node zip reader so it needs no `unzip`. Returns the
- * version string, or null when the wheel carries no METADATA or no
- * `Version:` line. `Metadata-Version:` is deliberately not matched — only a
- * line that begins exactly `Version:`, mirroring the bash `^Version:`.
+ * Read the `Version:` field from a wheel's `*.dist-info/METADATA` (#450), via
+ * the pure-Node zip reader so it needs no `unzip`. Returns null when the wheel
+ * carries no METADATA or no `Version:` line. `Metadata-Version:` is
+ * deliberately not matched — only a line beginning exactly `Version:`.
  */
 export declare function readWheelVersion(wheelPath: string): Promise<string | null>;
 //# sourceMappingURL=read-wheel-version.d.ts.map

package/dist/verify/wheel/read-wheel-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-wheel-version.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/read-wheel-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhF"}
+{"version":3,"file":"read-wheel-version.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/read-wheel-version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYhF"}

package/dist/verify/wheel/read-wheel-version.js

@@ -1,12 +1,8 @@
 /**
- * Read the `Version:` field from a wheel's `*.dist-info/METADATA` (#450).
- *
- * The engine analogue of the bash
- * `unzip -p "$wheel" '*.dist-info/METADATA' | awk '/^Version:/ { print $2 }'`,
- * but via the pure-Node zip reader so it needs no `unzip`. Returns the
- * version string, or null when the wheel carries no METADATA or no
- * `Version:` line. `Metadata-Version:` is deliberately not matched — only a
- * line that begins exactly `Version:`, mirroring the bash `^Version:`.
+ * Read the `Version:` field from a wheel's `*.dist-info/METADATA` (#450), via
+ * the pure-Node zip reader so it needs no `unzip`. Returns null when the wheel
+ * carries no METADATA or no `Version:` line. `Metadata-Version:` is
+ * deliberately not matched — only a line beginning exactly `Version:`.
  */
 import { readFile } from 'node:fs/promises';
 import { readZipEntry } from './read-zip-entry.js';

package/dist/verify/wheel/read-wheel-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-wheel-version.js","sourceRoot":"","sources":["../../../src/verify/wheel/read-wheel-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC;YACN,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"read-wheel-version.js","sourceRoot":"","sources":["../../../src/verify/wheel/read-wheel-version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC;YACN,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/wheel/read-zip-entry.d.ts

@@ -1,13 +1,8 @@
 /**
  * Extract the first zip entry whose name satisfies `matches`, returning its
- * decompressed bytes (or null if none matches) (#450).
- *
- * A minimal pure-Node zip reader for the stored (method 0) and deflate
- * (method 8) entries a wheel uses — enough to read `dist-info/METADATA`
- * without an `unzip` / `tar` subprocess, so `verify wheel` runs on every
- * platform the maturin matrix builds on (Windows included). Wheels are not
- * ZIP64 and carry no archive comment, so the common-case layout is all that
- * is handled.
+ * decompressed bytes (or null) (#450). A minimal pure-Node reader for the
+ * stored (method 0) and deflate (method 8) entries a wheel uses, so no
+ * `unzip`/`tar` subprocess. Wheels are never ZIP64 and carry no comment.
  */
 export declare function readZipEntry(buf: Buffer, matches: (name: string) => boolean): Buffer | null;
 //# sourceMappingURL=read-zip-entry.d.ts.map

package/dist/verify/wheel/read-zip-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-zip-entry.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/read-zip-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,GAAG,IAAI,CAqC3F"}
+{"version":3,"file":"read-zip-entry.d.ts","sourceRoot":"","sources":["../../../src/verify/wheel/read-zip-entry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,GAAG,IAAI,CAqC3F"}

package/dist/verify/wheel/read-zip-entry.js

@@ -1,13 +1,8 @@
 /**
  * Extract the first zip entry whose name satisfies `matches`, returning its
- * decompressed bytes (or null if none matches) (#450).
- *
- * A minimal pure-Node zip reader for the stored (method 0) and deflate
- * (method 8) entries a wheel uses — enough to read `dist-info/METADATA`
- * without an `unzip` / `tar` subprocess, so `verify wheel` runs on every
- * platform the maturin matrix builds on (Windows included). Wheels are not
- * ZIP64 and carry no archive comment, so the common-case layout is all that
- * is handled.
+ * decompressed bytes (or null) (#450). A minimal pure-Node reader for the
+ * stored (method 0) and deflate (method 8) entries a wheel uses, so no
+ * `unzip`/`tar` subprocess. Wheels are never ZIP64 and carry no comment.
  */
 import { inflateRawSync } from 'node:zlib';
 export function readZipEntry(buf, matches) {

package/dist/verify/wheel/read-zip-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-zip-entry.js","sourceRoot":"","sources":["../../../src/verify/wheel/read-zip-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAkC;IAC1E,gEAAgE;IAChE,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,CAAC;YACT,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,2BAA2B;IAChE,0EAA0E;IAC1E,+CAA+C;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,+DAA+D;YAC/D,8DAA8D;YAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,WAAW,GAAG,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAC,CAAC;YAC1D,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"read-zip-entry.js","sourceRoot":"","sources":["../../../src/verify/wheel/read-zip-entry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAkC;IAC1E,gEAAgE;IAChE,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,CAAC;YACT,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,2BAA2B;IAChE,0EAA0E;IAC1E,+CAA+C;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,+DAA+D;YAC/D,8DAA8D;YAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,WAAW,GAAG,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAC,CAAC;YAC1D,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/version.d.ts

@@ -1,16 +1,8 @@
 /**
- * Version bumper.
- *
- * Strict semver — no pre-release suffixes in v0 (plan.md §26.2 defers
- * `-rc` / `-beta` / `-alpha` to v0.2). Pre-1.0 does *not* use the
- * "breaking minor bumps" convention; 0.1.5 + minor is 0.2.0, not 1.0.0.
- *
- * Issue #8. Plan: §14.3 (bump semantics), §14.4 (first version).
- *
- * Also exports the canonical `USER_AGENT` string used for all outbound
- * HTTP requests to registries (crates.io / npm / PyPI / GitHub).
- * Sourced from `package.json` at build time so new releases don't ship
- * a stale `putitoutthere/0.0.1` UA (#147).
+ * Version bumper (#8; plan.md §14.3 bump semantics, §14.4 first version).
+ * Strict semver, no pre-release suffixes in v0 (§26.2). Pre-1.0 does *not* use
+ * the "breaking minor bumps" convention: 0.1.5 + minor is 0.2.0, not 1.0.0.
+ * Also exports `USER_AGENT`, sourced from `package.json` at build time (#147).
  */
 import type { Bump } from './types.js';
 /** CLI version, read from package.json at build time. */

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,yDAAyD;AACzD,eAAO,MAAM,OAAO,EAAE,MAAoB,CAAC;AAE3C,wDAAwD;AACxD,eAAO,MAAM,UAAU,EAAE,MAAmC,CAAC;AAE7D,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAKD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAU7C;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,MAAM,CAchE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIpE"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,yDAAyD;AACzD,eAAO,MAAM,OAAO,EAAE,MAAoB,CAAC;AAE3C,wDAAwD;AACxD,eAAO,MAAM,UAAU,EAAE,MAAmC,CAAC;AAE7D,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAKD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAU7C;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,MAAM,CAchE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIpE"}

package/dist/version.js

@@ -1,16 +1,8 @@
 /**
- * Version bumper.
- *
- * Strict semver — no pre-release suffixes in v0 (plan.md §26.2 defers
- * `-rc` / `-beta` / `-alpha` to v0.2). Pre-1.0 does *not* use the
- * "breaking minor bumps" convention; 0.1.5 + minor is 0.2.0, not 1.0.0.
- *
- * Issue #8. Plan: §14.3 (bump semantics), §14.4 (first version).
- *
- * Also exports the canonical `USER_AGENT` string used for all outbound
- * HTTP requests to registries (crates.io / npm / PyPI / GitHub).
- * Sourced from `package.json` at build time so new releases don't ship
- * a stale `putitoutthere/0.0.1` UA (#147).
+ * Version bumper (#8; plan.md §14.3 bump semantics, §14.4 first version).
+ * Strict semver, no pre-release suffixes in v0 (§26.2). Pre-1.0 does *not* use
+ * the "breaking minor bumps" convention: 0.1.5 + minor is 0.2.0, not 1.0.0.
+ * Also exports `USER_AGENT`, sourced from `package.json` at build time (#147).
  */
 import pkg from '../package.json' with { type: 'json' };
 /** CLI version, read from package.json at build time. */

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAGxD,yDAAyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,CAAC;AAE3C,wDAAwD;AACxD,MAAM,CAAC,MAAM,UAAU,GAAW,iBAAiB,OAAO,EAAE,CAAC;AAQ7D,6EAA6E;AAC7E,MAAM,MAAM,GAAG,4CAA4C,CAAC;AAE5D,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,WAAmB,EAAE,QAAc;IACtD,MAAM,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACpD,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,CAAC;YACR,yDAAyD;YACzD,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAA+B;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;IAC/C,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAGxD,yDAAyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,CAAC;AAE3C,wDAAwD;AACxD,MAAM,CAAC,MAAM,UAAU,GAAW,iBAAiB,OAAO,EAAE,CAAC;AAQ7D,6EAA6E;AAC7E,MAAM,MAAM,GAAG,4CAA4C,CAAC;AAE5D,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,WAAmB,EAAE,QAAc;IACtD,MAAM,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACpD,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,CAAC;YACR,yDAAyD;YACzD,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAA+B;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;IAC/C,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/wheel-abi.d.ts

@@ -1,32 +1,9 @@
 /**
- * Detects Python-version-independent maturin wheels so the planner can
- * collapse the per-CPython-version build fan to a single wheel. #401.
- *
- * `kind = "pypi"` `build = "maturin"` normally fans the wheel build
- * across every CPython version `requires-python` allows (see
- * `python-versions.ts`). But two maturin shapes produce ONE wheel per
- * platform that is byte-identical regardless of the interpreter that
- * built it:
- *
- *  - `[tool.maturin].bindings = "bin"` in `pyproject.toml` — the wheel
- *    wraps a Rust *binary*, tagged `py3-none-<platform>`; it carries no
- *    Python ABI at all.
- *  - a pyo3 (or pyo3-ffi) `abi3` / `abi3-pyXY` feature — a single
- *    stable-ABI extension tagged `cp3x-abi3-<platform>` that loads on
- *    every CPython >= X.Y.
- *
- * Fanning either shape across N versions yields N identical wheels:
- * wasted build time, and — because each fanned row uploads under its own
- * artifact — N copies of the same wheel filename that race-corrupt at the
- * consumer's `merge-multiple: true` download (`twine` → `BadZipFile`).
- *
- * Detection is best-effort and conservative. A missing or unparseable
- * manifest, or an abi3 setup we don't recognize (a workspace-inherited
- * `pyo3` dependency, a target-specific `[target.'cfg(...)'.dependencies]`
- * table), falls through to `false` and the planner keeps fanning — the
- * pre-#401 behavior, never worse.
- *
- * Engine convention: async `readFile` throughout (AGENTS.md, #469).
+ * Detect Python-version-independent maturin wheels so the planner collapses the
+ * per-CPython build fan to one wheel (#401): `[tool.maturin].bindings = "bin"` or
+ * a pyo3 `abi3` feature. Fanning either yields N identical wheel filenames that
+ * race-corrupt under `merge-multiple: true` (`twine` → `BadZipFile`); anything
+ * unrecognised falls through to `false` and keeps fanning.
  */
 /**
  * True when the maturin wheel for the package at `cwd/pkgPath` is

package/dist/wheel-abi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wheel-abi.d.ts","sourceRoot":"","sources":["../src/wheel-abi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAYH;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK9F"}
+{"version":3,"file":"wheel-abi.d.ts","sourceRoot":"","sources":["../src/wheel-abi.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK9F"}

package/dist/wheel-abi.js

@@ -1,32 +1,9 @@
 /**
- * Detects Python-version-independent maturin wheels so the planner can
- * collapse the per-CPython-version build fan to a single wheel. #401.
- *
- * `kind = "pypi"` `build = "maturin"` normally fans the wheel build
- * across every CPython version `requires-python` allows (see
- * `python-versions.ts`). But two maturin shapes produce ONE wheel per
- * platform that is byte-identical regardless of the interpreter that
- * built it:
- *
- *  - `[tool.maturin].bindings = "bin"` in `pyproject.toml` — the wheel
- *    wraps a Rust *binary*, tagged `py3-none-<platform>`; it carries no
- *    Python ABI at all.
- *  - a pyo3 (or pyo3-ffi) `abi3` / `abi3-pyXY` feature — a single
- *    stable-ABI extension tagged `cp3x-abi3-<platform>` that loads on
- *    every CPython >= X.Y.
- *
- * Fanning either shape across N versions yields N identical wheels:
- * wasted build time, and — because each fanned row uploads under its own
- * artifact — N copies of the same wheel filename that race-corrupt at the
- * consumer's `merge-multiple: true` download (`twine` → `BadZipFile`).
- *
- * Detection is best-effort and conservative. A missing or unparseable
- * manifest, or an abi3 setup we don't recognize (a workspace-inherited
- * `pyo3` dependency, a target-specific `[target.'cfg(...)'.dependencies]`
- * table), falls through to `false` and the planner keeps fanning — the
- * pre-#401 behavior, never worse.
- *
- * Engine convention: async `readFile` throughout (AGENTS.md, #469).
+ * Detect Python-version-independent maturin wheels so the planner collapses the
+ * per-CPython build fan to one wheel (#401): `[tool.maturin].bindings = "bin"` or
+ * a pyo3 `abi3` feature. Fanning either yields N identical wheel filenames that
+ * race-corrupt under `merge-multiple: true` (`twine` → `BadZipFile`); anything
+ * unrecognised falls through to `false` and keeps fanning.
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';

package/dist/wheel-abi.js.map

@@ -1 +1 @@
-{"version":3,"file":"wheel-abi.js","sourceRoot":"","sources":["../src/wheel-abi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,yEAAyE;AACzE,uDAAuD;AACvD,6BAA6B;AAC7B,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,GAAW;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACvE,IAAI,gCAAgC,CAAC,SAAS,CAAC,EAAE,CAAC;QAAA,OAAO,IAAI,CAAC;IAAA,CAAC;IAC/D,OAAO,gBAAgB,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,6EAA6E;AAE7E,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,iHAAiH;QACjH,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,oBAAoB;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gCAAgC,CAAC,SAAyC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAAA,OAAO,IAAI,CAAC;IAAA,CAAC;IAC9C,OAAO,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAqC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiB;IAC3C,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,OAAO,CACd,IAAoC,EACpC,IAAc;IAEd,IAAI,GAAG,GAAY,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;QACjC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"wheel-abi.js","sourceRoot":"","sources":["../src/wheel-abi.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,yEAAyE;AACzE,uDAAuD;AACvD,6BAA6B;AAC7B,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,GAAW;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACvE,IAAI,gCAAgC,CAAC,SAAS,CAAC,EAAE,CAAC;QAAA,OAAO,IAAI,CAAC;IAAA,CAAC;IAC/D,OAAO,gBAAgB,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,6EAA6E;AAE7E,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,iHAAiH;QACjH,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,oBAAoB;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gCAAgC,CAAC,SAAyC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAAA,OAAO,IAAI,CAAC;IAAA,CAAC;IAC9C,OAAO,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAqC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiB;IAC3C,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,OAAO,CACd,IAAoC,EACpC,IAAc;IAEd,IAAI,GAAG,GAAY,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;QACjC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/write-crate-version.d.ts

@@ -1,21 +1,8 @@
 /**
- * Pre-build version bump for the npm `bundled-cli` path. #366.
- *
- * `cargo build` bakes `CARGO_PKG_VERSION` into the compiled binary at
- * build time, sourced from `[package].version` in the crate's
- * `Cargo.toml`. There is no env override. The npm `bundled-cli` path in
- * `_matrix.yml` cross-compiles a Rust CLI and ships it inside the
- * per-platform package; without rewriting the crate manifest first, the
- * binary reports whatever literal sits on disk — diverging from the
- * planned release version (a `@scope/cli-<triple>@0.3.5` package whose
- * `--version` says `0.2.7`).
- *
- * The maturin/pypi path already solves the equivalent problem with
- * `write-version` (#276), but that command is tied to maturin's
- * dynamic-version contract — it requires a `pyproject.toml` declaring
- * `dynamic = ["version"]`. The npm bundled-cli crate has only a
- * `Cargo.toml`, so it needs a manifest-direct bump with no pyproject
- * gate. This is that command.
+ * Pre-build version bump for the npm `bundled-cli` path (#366). `cargo build`
+ * bakes `CARGO_PKG_VERSION` into the binary from `[package].version` with no
+ * env override, so without rewriting the manifest a `@scope/cli-<triple>@0.3.5`
+ * ships a `--version` of `0.2.7`. `write-version` (#276) gates on pyproject.
  */
 /**
  * Rewrite `[package].version` in the crate at `crateDir` to `version`

package/dist/write-crate-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-crate-version.d.ts","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBpG"}
+{"version":3,"file":"write-crate-version.d.ts","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBpG"}

package/dist/write-crate-version.js

@@ -1,21 +1,8 @@
 /**
- * Pre-build version bump for the npm `bundled-cli` path. #366.
- *
- * `cargo build` bakes `CARGO_PKG_VERSION` into the compiled binary at
- * build time, sourced from `[package].version` in the crate's
- * `Cargo.toml`. There is no env override. The npm `bundled-cli` path in
- * `_matrix.yml` cross-compiles a Rust CLI and ships it inside the
- * per-platform package; without rewriting the crate manifest first, the
- * binary reports whatever literal sits on disk — diverging from the
- * planned release version (a `@scope/cli-<triple>@0.3.5` package whose
- * `--version` says `0.2.7`).
- *
- * The maturin/pypi path already solves the equivalent problem with
- * `write-version` (#276), but that command is tied to maturin's
- * dynamic-version contract — it requires a `pyproject.toml` declaring
- * `dynamic = ["version"]`. The npm bundled-cli crate has only a
- * `Cargo.toml`, so it needs a manifest-direct bump with no pyproject
- * gate. This is that command.
+ * Pre-build version bump for the npm `bundled-cli` path (#366). `cargo build`
+ * bakes `CARGO_PKG_VERSION` into the binary from `[package].version` with no
+ * env override, so without rewriting the manifest a `@scope/cli-<triple>@0.3.5`
+ * ships a `--version` of `0.2.7`. `write-version` (#276) gates on pyproject.
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';