toolfactory 0.1.2 → 0.2.0

package/README.md

@@ -22,7 +22,7 @@ generated and every surface still installs, builds and publishes.
 - **Gemini CLI extension** — `gemini extensions install https://github.com/GoatInAHat/toolfactory`
 - **OpenClaw plugin** — `openclaw plugins install --link hosts/openclaw` from a checkout
 - **Hermes plugin** — `hermes plugins install https://github.com/GoatInAHat/toolfactory#hosts/hermes/toolfactory_hermes`
-- **DSH plugin** (experimental) — `dsh plugin --profile <profile> add ./hosts/dsh` from a checkout, or the release tarball `toolfactory-dsh-0.1.2.tgz`
+- **DSH plugin** (experimental) — `dsh plugin --profile <profile> add ./hosts/dsh` from a checkout, or the release tarball `toolfactory-dsh-0.2.0.tgz`
 - **Web app** — `npx -y toolfactory mcp --http --open` serves the operations page beside the
   MCP endpoint on one port and opens it; over MCP or a skill, the `web` operation does the same and
   returns the URL.
@@ -120,16 +120,39 @@ and an MCP server cannot give it (a gateway tab, browser capability, a store lis
 | `gemini` | root `gemini-extension.json` — a Gemini CLI extension installable straight from the repo, reading your `AGENTS.md` and `skills/` | `gemini extensions validate` |
 | `mcp`, `cli` | the kernel MCP server (stdio, or `--http`) and a CLI over your operations; each lists only the operations it can run | MCP Inspector, `--help` |
 | `npm`, `pypi` | package metadata merged into `package.json` / `pyproject.toml` | `npm pack`, `uv build` |
+| `cargo`, `nuget`, `maven-central`, `rubygems`, `packagist`, `go-module` | releases for author-owned native packages alongside the tool; metadata stays in its native format | Cargo, .NET, Maven, RubyGems, Composer, Go |
+| `homebrew`, `winget`, `scoop`, `chocolatey`, `apt`, `rpm` | native packaging and catalog/repository distribution on the appropriate OS | the manager's own tooling |
 | `mcp-registry` | `server.json` | `mcp-publisher` |
 | `mcpb` | `hosts/mcpb/manifest.json` and a `.mcpb` release asset packed from the npm tarball — the one-click install Claude Desktop takes | `mcpb validate` |
 | `openclaw-native` | `hosts/openclaw/`, mirroring `openclaw plugins init --type tool` | `openclaw plugins build --check`, `validate`, plugin-inspector |
 | `hermes-native` | `hosts/hermes/`, a manifest v2 plugin | `hermes plugins doctor --ci` |
 | `web` | `web/`, a shadcn/ui (Vite, React, Tailwind) app with a form per operation; your own pages sit beside it in `App.tsx` | `vite build`, Playwright |
 | `browser-extension` | `hosts/browser/`, one WXT extension built for Chromium, Firefox and Safari: the worker calls your kernel over loopback MCP, the popup is the `web` app, and the operations that need a page are yours to write in `entrypoints/` | `wxt build`, `web-ext lint`, Playwright against a real Chromium |
+| `vscode-extension` | `hosts/vscode/`, a native TypeScript extension with MCP discovery, command palette operations, settings and SecretStorage; activation and native contributions are yours | Microsoft `generator-code` scaffold comparison, `vsce package`, real Extension Development Host |
 | `dsh` (experimental) | `hosts/dsh/`, a zero-code DSH (DeepSeek Harness) bundle: one Cordis patch row attaching your MCP server through `@deepseek-ai/dsh-mcp-client` | a keyless `dsh --profile headless` boot |
 | workflows (always) | `ci.yml`, `release.yml` (gate → package → publish legs → GitHub Release, plus Pages), `compose.toolfactory.yaml`, `.env.example`, `renovate.json`; every step is one `toolfactory gate` / `toolfactory package` runs without GitHub | the workflow itself |
 | readme (always) | the Install section of `README.md` (a marked region): one install line per selected surface, plus a static Agent Skill badge | — |
 
+Select `vscode-extension` together with `mcp`, `cli`, and the runtime registry (`npm` for
+TypeScript, `pypi` for Python). Set `vscode.publisher` in `dev.toolfactory/tool.json`, then build.
+Open `hosts/vscode` and press F5 to use the checkout's runtime, or run `npm run vsix` in that
+directory to package it. Native commands, views, webviews, language services, chat participants,
+and language-model tools use the full VS Code API in your own `src/extension.ts`. Add contribution
+points directly to its `package.json`; rebuilds preserve author entries and additional fields
+on generated entries. Marketplace and Open VSX release jobs use `VSCE_PAT` and `OVSX_PAT` after
+you register the publisher. Both can be disabled individually in `tool.json`.
+
+The same native customization rule applies to the other surfaces: JSON, TOML and YAML manifests
+merge only projected fields, and host entry points retain your code outside the marked regions.
+OpenClaw, Hermes, DSH and browser shims can use their host's complete native API. `adopt` and
+`eject` remain available when replacing a generated integration entirely.
+
+Package distribution is opt-in. PyPI supports both `pip install` and `uv add`; pip uses the same
+published wheel/sdist. Other ecosystems consume real native packages and metadata supplied by the
+author. See [native package releases](docs/native-package-releases.md) and
+[system package releases](docs/system-package-releases.md) for configuration and registry setup.
+Toolfactory itself continues to use npm as its package registry.
+
 ## Driving toolfactory from an agent
 
 Every command is an MCP tool, so a host can drive the whole loop without a shell — and nothing is

package/dist/commands.d.ts

@@ -185,4 +185,4 @@ export declare function bootstrapRepo(args: {
     dryRun?: boolean;
 }): BootstrapResult;
 export declare function doctor(): DoctorReport;
-export declare const SURFACES: readonly ["skill", "agent-plugins", "claude", "codex", "cursor", "mcp", "mcp-registry", "cli", "npm", "pypi", "openclaw-native", "hermes-native", "clawhub", "web", "dsh", "workflows", "agents", "readme", "gemini", "mcpb", "browser-extension"];
+export declare const SURFACES: readonly ["skill", "agent-plugins", "claude", "codex", "cursor", "mcp", "mcp-registry", "cli", "npm", "pypi", "openclaw-native", "hermes-native", "clawhub", "web", "dsh", "workflows", "agents", "readme", "gemini", "mcpb", "browser-extension", "vscode-extension", "cargo", "nuget", "maven-central", "rubygems", "packagist", "go-module", "homebrew", "winget", "scoop", "chocolatey", "apt", "rpm"];

package/dist/distribution/native.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Native package registries are deliberately an escape hatch, not bindings.  A project may
+ * carry a real Cargo/.NET/JVM/Ruby/PHP/Go package beside a Toolfactory TypeScript or Python
+ * kernel, but Toolfactory never translates that kernel into another language or invents a
+ * launcher to enter a registry.
+ */
+import { z } from "zod";
+import type { Project, Surface } from "../model.js";
+import type { GateStep, Registry } from "../project/gate.js";
+export declare const NATIVE_PACKAGE_IDS: readonly ["cargo", "nuget", "maven-central", "rubygems", "packagist", "go-module"];
+export type NativePackageId = (typeof NATIVE_PACKAGE_IDS)[number];
+/**
+ * `name` is intentionally not derived from the Toolfactory identity: package namespaces have
+ * their own ownership rules. A standard per-ecosystem version read is used unless the author
+ * needs a `versionCommand` escape hatch.
+ */
+export declare const nativePackageConfigSchema: z.ZodObject<{
+    id: z.ZodEnum<{
+        cargo: "cargo";
+        nuget: "nuget";
+        "maven-central": "maven-central";
+        rubygems: "rubygems";
+        packagist: "packagist";
+        "go-module": "go-module";
+    }>;
+    path: z.ZodString;
+    identity: z.ZodString;
+    name: z.ZodString;
+    versionCommand: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type NativePackageConfig = z.infer<typeof nativePackageConfigSchema>;
+/** External registries do not generate files: their package metadata remains author-owned. */
+export declare const nativePackageSurfaces: Surface[];
+/**
+ * Release packaging happens after the main package build. VCS registries deliberately have no
+ * artifact: their published object is the signed Git tag and repository contents.
+ */
+export declare function nativePackageSteps(project: Project): GateStep[];
+/**
+ * Kept with the release contract so local `gate` and the package job fail before a package
+ * command with a clear missing-tool message. GitHub's hosted Linux image supplies these upstream
+ * clients; callers that use another runner can install its normal distro packages first.
+ */
+export declare function nativeToolchainSteps(project: Project): GateStep[];
+export declare function nativeRegistryRows(project: Project): Registry[];
+type Job = Record<string, unknown>;
+/** GitHub Actions jobs use the upstream language tool and package client directly. */
+export declare function nativePublishJobs(project: Project, artifactDir: string, releaseSha: string): Record<string, Job>;
+export declare function nativeInstallLines(project: Project): string[];
+export {};

package/dist/distribution/native.js

@@ -0,0 +1,414 @@
+/**
+ * Native package registries are deliberately an escape hatch, not bindings.  A project may
+ * carry a real Cargo/.NET/JVM/Ruby/PHP/Go package beside a Toolfactory TypeScript or Python
+ * kernel, but Toolfactory never translates that kernel into another language or invents a
+ * launcher to enter a registry.
+ */
+import { z } from "zod";
+export const NATIVE_PACKAGE_IDS = [
+    "cargo",
+    "nuget",
+    "maven-central",
+    "rubygems",
+    "packagist",
+    "go-module",
+];
+/**
+ * `name` is intentionally not derived from the Toolfactory identity: package namespaces have
+ * their own ownership rules. A standard per-ecosystem version read is used unless the author
+ * needs a `versionCommand` escape hatch.
+ */
+export const nativePackageConfigSchema = z
+    .object({
+    id: z.enum(NATIVE_PACKAGE_IDS),
+    path: z
+        .string()
+        .min(1)
+        .refine((path) => !/^(?:[A-Za-z]:|[\\/])/.test(path) && !path.split(/[\\/]/).includes(".."), "path must stay inside the repository."),
+    identity: z
+        .string()
+        .min(1)
+        .refine((path) => !/^(?:[A-Za-z]:|[\\/])/.test(path) && !path.split(/[\\/]/).includes(".."), "identity must be relative to path."),
+    name: z
+        .string()
+        .min(1)
+        .describe("Registry package identity, including its required namespace."),
+    versionCommand: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Command run in path that prints exactly the authored native package version."),
+})
+    .superRefine((entry, context) => {
+    if (entry.id === "maven-central" && entry.name.split(":").length !== 2)
+        context.addIssue({
+            code: "custom",
+            path: ["name"],
+            message: "Maven Central name must be groupId:artifactId.",
+        });
+    if ((entry.id === "packagist" || entry.id === "go-module") && entry.path !== ".")
+        context.addIssue({
+            code: "custom",
+            path: ["path"],
+            message: `${entry.id} is VCS/tag-discovered and currently requires package path ".".`,
+        });
+})
+    .strict();
+function configs(project) {
+    const raw = project.tool.nativePackages ?? [];
+    const parsed = raw.map((entry) => nativePackageConfigSchema.parse(entry));
+    const duplicates = parsed.filter((entry, index) => parsed.findIndex((other) => other.id === entry.id) !== index);
+    if (duplicates.length)
+        throw new Error(`Native package configuration repeats: ${[...new Set(duplicates.map((entry) => entry.id))].join(", ")}.`);
+    return parsed;
+}
+function selected(project, id) {
+    return project.tool.surfaces.includes(id);
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function defaultVersionCommand(entry) {
+    const identity = shellQuote(entry.identity);
+    switch (entry.id) {
+        case "cargo":
+            return `cargo metadata --no-deps --format-version 1 --manifest-path ${identity} | node -e ${shellQuote(`let s='';process.stdin.on('data',d=>s+=d).on('end',()=>console.log(JSON.parse(s).packages.find(p=>p.name===${JSON.stringify(entry.name)}).version))`)}`;
+        case "nuget":
+            return `dotnet msbuild ${identity} -nologo -getProperty:Version`;
+        case "maven-central":
+            return `mvn --quiet --file ${identity} -DforceStdout help:evaluate -Dexpression=project.version`;
+        case "rubygems":
+            return `ruby -e 'puts Gem::Specification.load(ARGV[0]).version' ${identity}`;
+        case "packagist":
+        case "go-module":
+            throw new Error(`${entry.id} is discovered from the release tag and has no pre-release version command.`);
+    }
+}
+function versionAssert(entry, version) {
+    if (!version)
+        throw new Error(`Native package "${entry.name}" requires the shared identity to declare version.`);
+    return `test "$(${entry.versionCommand ?? defaultVersionCommand(entry)})" = ${shellQuote(version)}`;
+}
+function configFor(project, id) {
+    const matches = configs(project).filter((entry) => entry.id === id);
+    if (matches.length !== 1)
+        throw new Error(`Surface "${id}" requires exactly one tool.nativePackages entry with id "${id}".`);
+    const entry = matches[0];
+    if ((id === "packagist" || id === "go-module") && !project.identity.repository)
+        throw new Error(`Surface "${id}" requires identity.repository because it is discovered from the final Git tag.`);
+    return entry;
+}
+function activeConfigs(project) {
+    return NATIVE_PACKAGE_IDS.filter((id) => selected(project, id)).map((id) => configFor(project, id));
+}
+function entryVersion(project, entry) {
+    if (!project.identity.version)
+        throw new Error(`Native package "${entry.name}" requires the shared identity to declare version.`);
+    return project.identity.version;
+}
+const commands = {
+    cargo: (entry) => [
+        {
+            label: "Cargo package",
+            command: "cargo",
+            args: ["package", "--manifest-path", entry.identity],
+            cwd: entry.path,
+        },
+    ],
+    nuget: (entry) => [
+        {
+            label: "NuGet pack",
+            command: "dotnet",
+            args: ["pack", entry.identity, "--configuration", "Release"],
+            cwd: entry.path,
+        },
+    ],
+    "maven-central": (entry) => [
+        {
+            label: "Maven verify",
+            command: "mvn",
+            args: ["--batch-mode", "--file", entry.identity, "verify"],
+            cwd: entry.path,
+        },
+    ],
+    rubygems: (entry) => [
+        {
+            label: "RubyGems build",
+            command: "gem",
+            args: ["build", "--strict", entry.identity],
+            cwd: entry.path,
+        },
+    ],
+    packagist: (entry) => [
+        {
+            label: "Composer validate",
+            command: "composer",
+            args: ["validate", "--strict", entry.identity],
+            cwd: entry.path,
+        },
+    ],
+    "go-module": (entry) => [
+        { label: "Go module tidy", command: "go", args: ["mod", "tidy", "-diff"], cwd: entry.path },
+        { label: "Go module tests", command: "go", args: ["test", "./..."], cwd: entry.path },
+    ],
+};
+/** External registries do not generate files: their package metadata remains author-owned. */
+export const nativePackageSurfaces = NATIVE_PACKAGE_IDS.map((id) => ({
+    id,
+    plan(project) {
+        configFor(project, id);
+        return [];
+    },
+    validate(project) {
+        const entry = configFor(project, id);
+        return commands[id](entry).map((command) => ({ ...command, cwd: entry.path }));
+    },
+}));
+/**
+ * Release packaging happens after the main package build. VCS registries deliberately have no
+ * artifact: their published object is the signed Git tag and repository contents.
+ */
+export function nativePackageSteps(project) {
+    return activeConfigs(project).flatMap((entry) => {
+        // Packagist and Go proxy discovery happens from the tag created by the final release job.
+        // Before then, `git describe` can only see the prior version, so asserting it here is wrong.
+        if (entry.id === "packagist" || entry.id === "go-module")
+            return [];
+        const directory = shellQuote(entry.path);
+        const out = `dist/release/native/${entry.id}`;
+        const check = versionAssert(entry, project.identity.version);
+        const steps = [
+            { name: `${entry.id} version matches release`, run: `cd ${directory} && ${check}` },
+        ];
+        switch (entry.id) {
+            case "cargo":
+                steps.push({
+                    name: "Cargo crate",
+                    run: `mkdir -p ${shellQuote(out)} && cargo package --manifest-path ${shellQuote(`${entry.path}/${entry.identity}`)} --target-dir ${shellQuote(`dist/native-build/${entry.id}`)} && cp ${shellQuote(`dist/native-build/${entry.id}/package`)}/*.crate ${shellQuote(out)}/`,
+                });
+                break;
+            case "nuget":
+                steps.push({
+                    name: "NuGet package",
+                    run: `mkdir -p ${shellQuote(out)} && dotnet pack ${shellQuote(`${entry.path}/${entry.identity}`)} --configuration Release --output ${shellQuote(out)}`,
+                });
+                break;
+            case "maven-central":
+                steps.push({
+                    name: "Maven package",
+                    run: `mkdir -p ${shellQuote(out)} && mvn --batch-mode --file ${shellQuote(`${entry.path}/${entry.identity}`)} package && cp ${shellQuote(`${entry.path}/${entry.identity}`)} ${shellQuote(`${out}/${entry.name.split(":")[1]}-${project.identity.version}.pom`)} && find ${shellQuote(`${entry.path}/target`)} -maxdepth 1 -type f \\( -name '*.jar' -o -name '*.war' -o -name '*.pom' \\) -exec cp {} ${shellQuote(out)} \\;`,
+                });
+                break;
+            case "rubygems":
+                steps.push({
+                    name: "Ruby gem",
+                    run: `mkdir -p ${shellQuote(out)} && (cd ${directory} && gem build --strict ${shellQuote(entry.identity)}) && mv ${shellQuote(`${entry.path}/${entry.name}-${project.identity.version}.gem`)} ${shellQuote(out)}/`,
+                });
+                break;
+        }
+        return steps;
+    });
+}
+/**
+ * Kept with the release contract so local `gate` and the package job fail before a package
+ * command with a clear missing-tool message. GitHub's hosted Linux image supplies these upstream
+ * clients; callers that use another runner can install its normal distro packages first.
+ */
+export function nativeToolchainSteps(project) {
+    const tools = {
+        cargo: "cargo",
+        nuget: "dotnet",
+        "maven-central": "mvn",
+        rubygems: "gem",
+        packagist: "composer",
+        "go-module": "go",
+    };
+    return activeConfigs(project).map((entry) => ({
+        name: `${entry.id} upstream toolchain`,
+        run: `command -v ${tools[entry.id]} >/dev/null || { echo "${entry.id}: install its upstream ${tools[entry.id]} CLI before packaging" >&2; exit 1; }`,
+    }));
+}
+function row(project, entry) {
+    const version = entryVersion(project, entry);
+    const [groupId = "", artifactId = ""] = entry.name.split(":");
+    const mavenSearch = `https://search.maven.org/solrsearch/select?q=${encodeURIComponent(`g:"${groupId}" AND a:"${artifactId}" AND v:"${version}"`)}&rows=1&wt=json`;
+    const shared = {
+        id: entry.id,
+        surfaces: [entry.id],
+        url: {
+            cargo: "https://crates.io/settings/tokens",
+            nuget: "https://www.nuget.org/account/apikeys",
+            "maven-central": "https://central.sonatype.com/account",
+            rubygems: "https://rubygems.org/profile/edit",
+            packagist: "https://packagist.org/about",
+            "go-module": "https://go.dev/doc/modules/publishing",
+        }[entry.id],
+    };
+    switch (entry.id) {
+        case "cargo":
+            return {
+                ...shared,
+                secrets: ["CARGO_REGISTRY_TOKEN"],
+                exists: `curl -fsS -o /dev/null ${shellQuote(`https://crates.io/api/v1/crates/${encodeURIComponent(entry.name)}/${encodeURIComponent(version)}`)}`,
+                gate: '[ -n "$CARGO_REGISTRY_TOKEN" ]',
+                retract: `cargo yank ${shellQuote(entry.name)} --vers ${shellQuote(version)} --token "$CARGO_REGISTRY_TOKEN"`,
+            };
+        case "nuget":
+            return {
+                ...shared,
+                secrets: ["NUGET_API_KEY"],
+                exists: `curl -fsS -o /dev/null ${shellQuote(`https://api.nuget.org/v3-flatcontainer/${entry.name.toLowerCase()}/${version.toLowerCase()}/${entry.name.toLowerCase()}.${version.toLowerCase()}.nupkg`)}`,
+                gate: '[ -n "$NUGET_API_KEY" ]',
+                retract: `dotnet nuget delete ${shellQuote(entry.name)} ${shellQuote(version)} --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --non-interactive`,
+            };
+        case "maven-central":
+            return {
+                ...shared,
+                secrets: [
+                    "MAVEN_CENTRAL_USERNAME",
+                    "MAVEN_CENTRAL_PASSWORD",
+                    "MAVEN_GPG_PRIVATE_KEY",
+                    "MAVEN_GPG_PASSPHRASE",
+                ],
+                exists: `curl -fsS ${shellQuote(mavenSearch)} | node -e ${shellQuote("let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.exit(JSON.parse(s).response.numFound>0?0:1))")}`,
+                gate: '[ -n "$MAVEN_CENTRAL_USERNAME" ] && [ -n "$MAVEN_CENTRAL_PASSWORD" ] && [ -n "$MAVEN_GPG_PRIVATE_KEY" ] && [ -n "$MAVEN_GPG_PASSPHRASE" ]',
+                retractUrl: "https://central.sonatype.com/publishing/deployments",
+            };
+        case "rubygems":
+            return {
+                ...shared,
+                secrets: ["RUBYGEMS_API_KEY"],
+                exists: `curl -fsS ${shellQuote(`https://rubygems.org/api/v1/versions/${encodeURIComponent(entry.name)}.json`)} | node -e ${shellQuote(`let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.exit(JSON.parse(s).some(v=>v.number===${JSON.stringify(version)})?0:1))`)}`,
+                gate: '[ -n "$RUBYGEMS_API_KEY" ]',
+                retract: `GEM_HOST_API_KEY="$RUBYGEMS_API_KEY" gem yank ${shellQuote(entry.name)} -v ${shellQuote(version)}`,
+            };
+        case "packagist":
+            return {
+                ...shared,
+                secrets: [],
+                gate: "true",
+                retractUrl: "https://packagist.org/packages",
+            };
+        case "go-module":
+            return {
+                ...shared,
+                secrets: [],
+                gate: "true",
+                retractUrl: "https://go.dev/ref/mod#go-mod-file-retract-directive",
+            };
+    }
+}
+export function nativeRegistryRows(project) {
+    return activeConfigs(project).map((entry) => row(project, entry));
+}
+const checkout = (releaseSha) => ({
+    uses: "actions/checkout@v7",
+    with: { ref: releaseSha },
+});
+const download = (artifactDir) => ({
+    uses: "actions/download-artifact@v8",
+    with: { name: "release-assets", path: artifactDir },
+});
+/** GitHub Actions jobs use the upstream language tool and package client directly. */
+export function nativePublishJobs(project, artifactDir, releaseSha) {
+    return Object.fromEntries(activeConfigs(project).flatMap((entry) => {
+        if (entry.id === "packagist" || entry.id === "go-module")
+            return [];
+        const path = entry.path;
+        const base = {
+            needs: ["gate", "package"],
+            if: `needs.gate.outputs.${entry.id.replace(/-/g, "_")} == 'true'`,
+            "runs-on": "ubuntu-latest",
+            permissions: { contents: "read", "id-token": "write" },
+        };
+        let job;
+        switch (entry.id) {
+            case "cargo":
+                job = {
+                    ...base,
+                    env: { CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}" },
+                    steps: [
+                        checkout(releaseSha),
+                        { run: "cargo --version" },
+                        {
+                            run: `cd ${shellQuote(path)} && ${versionAssert(entry, project.identity.version)} && cargo publish --manifest-path ${shellQuote(entry.identity)} --token "$CARGO_REGISTRY_TOKEN"`,
+                        },
+                    ],
+                };
+                break;
+            case "nuget":
+                job = {
+                    ...base,
+                    env: { NUGET_API_KEY: "${{ secrets.NUGET_API_KEY }}" },
+                    steps: [
+                        { uses: "actions/setup-dotnet@v5", with: { "dotnet-version": "8.0.x" } },
+                        { run: "dotnet --info" },
+                        download(artifactDir),
+                        {
+                            run: `find ${shellQuote(`${artifactDir}/native/nuget`)} -maxdepth 1 -name '*.nupkg' -print0 | xargs -0 -r -n1 sh -c 'dotnet nuget push "$0" --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate'`,
+                        },
+                    ],
+                };
+                break;
+            case "maven-central":
+                job = {
+                    ...base,
+                    env: {
+                        MAVEN_CENTRAL_USERNAME: "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
+                        MAVEN_CENTRAL_PASSWORD: "${{ secrets.MAVEN_CENTRAL_PASSWORD }}",
+                        MAVEN_GPG_PRIVATE_KEY: "${{ secrets.MAVEN_GPG_PRIVATE_KEY }}",
+                        MAVEN_GPG_PASSPHRASE: "${{ secrets.MAVEN_GPG_PASSPHRASE }}",
+                    },
+                    steps: [
+                        checkout(releaseSha),
+                        {
+                            uses: "actions/setup-java@v5",
+                            with: {
+                                distribution: "temurin",
+                                "java-version": "21",
+                                cache: "maven",
+                                "server-id": "central",
+                                "server-username": "MAVEN_CENTRAL_USERNAME",
+                                "server-password": "MAVEN_CENTRAL_PASSWORD",
+                            },
+                        },
+                        { run: 'echo "$MAVEN_GPG_PRIVATE_KEY" | base64 --decode | gpg --batch --import' },
+                        {
+                            run: `cd ${shellQuote(path)} && ${versionAssert(entry, project.identity.version)} && mvn --batch-mode --file ${shellQuote(entry.identity)} -DskipTests -Dgpg.passphrase="$MAVEN_GPG_PASSPHRASE" deploy`,
+                        },
+                    ],
+                };
+                break;
+            case "rubygems":
+                job = {
+                    ...base,
+                    env: { GEM_HOST_API_KEY: "${{ secrets.RUBYGEMS_API_KEY }}" },
+                    steps: [
+                        { run: "gem --version" },
+                        download(artifactDir),
+                        {
+                            run: `gem push ${shellQuote(`${artifactDir}/native/rubygems/${entry.name}-${project.identity.version}.gem`)}`,
+                        },
+                    ],
+                };
+                break;
+        }
+        const steps = job.steps;
+        steps.unshift({ uses: "actions/setup-node@v7", with: { "node-version": "24" } });
+        const publish = steps.at(-1);
+        const exists = row(project, entry).exists;
+        if (publish && exists)
+            publish.run = `if ${exists}; then echo "${entry.id}: version already published"; else ${publish.run}; fi`;
+        return [[`publish-${entry.id}`, job]];
+    }));
+}
+export function nativeInstallLines(project) {
+    return activeConfigs(project).map((entry) => ({
+        cargo: `\`cargo install ${entry.name}\``,
+        nuget: `\`dotnet add package ${entry.name}\``,
+        "maven-central": `add \`${entry.name}\` as a Maven dependency`,
+        rubygems: `\`gem install ${entry.name}\``,
+        packagist: `\`composer require ${entry.name}\``,
+        "go-module": `\`go get ${entry.name}@${project.identity.version ? `v${project.identity.version}` : "latest"}\``,
+    })[entry.id]);
+}

package/dist/distribution/native.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/distribution/native.test.js

@@ -0,0 +1,127 @@
+import { describe, expect, it } from "vitest";
+import { nativeInstallLines, nativePackageConfigSchema, nativePackageSteps, nativePublishJobs, nativeRegistryRows, } from "./native.js";
+function project(entries, surfaces = entries.map((entry) => entry.id)) {
+    return {
+        root: "/repo",
+        tool: {
+            schemaVersion: 1,
+            identity: "package.json",
+            binding: "typescript",
+            surfaces: surfaces,
+            bundle: { runtime: "package" },
+            tests: { examples: {} },
+            nativePackages: entries,
+        },
+        identity: { name: "tool", version: "1.2.3", repository: "https://github.com/acme/tool" },
+        identityExtra: {},
+        operations: [],
+        toolfactoryVersion: "0.1.0",
+    };
+}
+const cargo = {
+    id: "cargo",
+    path: "native/cli",
+    identity: "Cargo.toml",
+    name: "acme-cli",
+    versionCommand: "cargo pkgid | sed 's/.*@//'",
+};
+describe("native package configuration", () => {
+    it("requires the package path, authored identity, and registry identity", () => {
+        expect(() => nativePackageConfigSchema.parse({ id: "cargo", path: "native" })).toThrow();
+        expect(nativePackageConfigSchema.parse(cargo)).toEqual(cargo);
+    });
+    it("rejects a selected registry with no config or duplicate configuration", () => {
+        expect(() => nativePackageSteps(project([], ["cargo"]))).toThrow(/requires exactly one/);
+        expect(() => nativePackageSteps(project([cargo, cargo]))).toThrow(/repeats/);
+    });
+    it("packages authored crates and checks their version against the release", () => {
+        const steps = nativePackageSteps(project([cargo]));
+        expect(steps.map((step) => step.name)).toEqual([
+            "cargo version matches release",
+            "Cargo crate",
+        ]);
+        expect(steps[0]?.run).toContain("= '1.2.3'");
+        expect(steps[1]?.run).toContain("cargo package --manifest-path 'native/cli/Cargo.toml'");
+        expect(steps[1]?.run).toContain("--target-dir 'dist/native-build/cargo'");
+        expect(steps[1]?.run).not.toContain("/repo");
+    });
+    it("reads structured Cargo metadata and the raw MSBuild version", () => {
+        const cargoDefault = {
+            id: "cargo",
+            path: "native/cli",
+            identity: "Cargo.toml",
+            name: "acme-cli",
+        };
+        const nuget = {
+            id: "nuget",
+            path: "dotnet",
+            identity: "Tool.csproj",
+            name: "Acme.Tool",
+        };
+        const steps = nativePackageSteps(project([cargoDefault, nuget]));
+        expect(steps[0]?.run).toContain("cargo metadata --no-deps --format-version 1 --manifest-path 'Cargo.toml'");
+        expect(steps[0]?.run).toContain("JSON.parse(s).packages.find");
+        expect(steps[2]?.run).toContain("dotnet msbuild 'Tool.csproj' -nologo -getProperty:Version");
+        expect(steps[2]?.run).not.toContain("sed -n");
+    });
+    it("leaves VCS-discovered Packagist and Go modules for the final release tag", () => {
+        const entries = [
+            {
+                id: "packagist",
+                path: ".",
+                identity: "composer.json",
+                name: "acme/tool",
+            },
+            {
+                id: "go-module",
+                path: ".",
+                identity: "go.mod",
+                name: "github.com/acme/tool",
+            },
+        ];
+        expect(nativePackageSteps(project(entries))).toEqual([]);
+        expect(nativeInstallLines(project(entries))).toEqual([
+            "`composer require acme/tool`",
+            "`go get github.com/acme/tool@v1.2.3`",
+        ]);
+    });
+    it("uses direct upstream publishing commands and exposes only their actual credentials", () => {
+        const entries = [
+            cargo,
+            {
+                id: "nuget",
+                path: "dotnet",
+                identity: "Tool.csproj",
+                name: "Acme.Tool",
+                versionCommand: "dotnet msbuild -getProperty:Version Tool.csproj",
+            },
+        ];
+        const jobs = nativePublishJobs(project(entries), "release-assets", "${{ needs.gate.outputs.sha }}");
+        expect(jobs["publish-cargo"]?.steps).toContainEqual(expect.objectContaining({ run: expect.stringContaining("cargo publish") }));
+        expect(jobs["publish-nuget"]?.steps).toContainEqual(expect.objectContaining({ run: expect.stringContaining("dotnet nuget push") }));
+        expect(jobs["publish-nuget"]?.steps).toContainEqual(expect.objectContaining({
+            uses: "actions/setup-dotnet@v5",
+            with: { "dotnet-version": "8.0.x" },
+        }));
+        expect(nativeRegistryRows(project(entries)).map((row) => row.secrets)).toEqual([
+            ["CARGO_REGISTRY_TOKEN"],
+            ["NUGET_API_KEY"],
+        ]);
+        expect(jobs["publish-cargo"]?.needs).toEqual(["gate", "package"]);
+        expect(jobs["publish-cargo"]?.if).toBe("needs.gate.outputs.cargo == 'true'");
+        expect(jobs["publish-cargo"]?.steps).not.toContainEqual(expect.objectContaining({ uses: "dtolnay/rust-toolchain@stable" }));
+    });
+    it("builds a gem from its package directory before moving the resulting asset", () => {
+        const steps = nativePackageSteps(project([
+            {
+                id: "rubygems",
+                path: "native/ruby",
+                identity: "acme.gemspec",
+                name: "acme",
+                versionCommand: "ruby -e 'puts 1.2.3'",
+            },
+        ]));
+        expect(steps[1]?.run).toContain("(cd 'native/ruby' && gem build --strict 'acme.gemspec')");
+        expect(steps[1]?.run).toContain("mv 'native/ruby/acme-1.2.3.gem'");
+    });
+});