django-admin-agent 0.1.0__tar.gz

django_admin_agent-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,81 @@
+name: release
+
+# Main-triggered: every merge to `main` runs `release-publish-prepare`, which
+# short-circuits to a no-op unless the version in source has been bumped past
+# the most recent `vX.Y.Z` tag.
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release-main
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: release
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/django-admin-agent
+    permissions:
+      id-token: write   # PyPI OIDC trusted publishing
+      contents: write   # tag push + gh release create
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install
+        run: uv sync --all-groups
+
+      - name: Prepare release (version check, test, build dist)
+        id: prepare
+        run: make release-publish-prepare
+
+      - name: Publish to PyPI
+        if: steps.prepare.outputs.released == 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Tag + GitHub Release
+        if: steps.prepare.outputs.released == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: make release-publish-finalize
+
+      # Embed a coverage-badge JSON into the docs build so `mkdocs gh-deploy`
+      # carries it to the gh-pages root, where the README's shields.io endpoint
+      # badge reads it. `release-publish-prepare`'s pytest run wrote .coverage
+      # to the workspace root.
+      - name: Render coverage badge for the docs site
+        if: steps.prepare.outputs.released == 'true' && hashFiles('mkdocs.yml') != ''
+        run: |
+          set -euo pipefail
+          uv run coverage xml -o coverage.xml
+          python - <<'PY'
+          import json
+          import xml.etree.ElementTree as ET
+
+          pct = round(float(ET.parse("coverage.xml").getroot().attrib["line-rate"]) * 100, 1)
+          color = (
+              "brightgreen" if pct >= 95
+              else "green" if pct >= 85
+              else "yellow" if pct >= 70
+              else "red"
+          )
+          payload = {"schemaVersion": 1, "label": "coverage", "message": f"{pct}%", "color": color}
+          with open("docs/coverage.json", "w") as fh:
+              json.dump(payload, fh)
+              fh.write("\n")
+          print(json.dumps(payload))
+          PY
+
+      - name: Deploy docs + coverage badge to gh-pages
+        if: steps.prepare.outputs.released == 'true' && hashFiles('mkdocs.yml') != ''
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          DJANGO_SETTINGS_MODULE=tests.conftest_settings \
+            uv run mkdocs gh-deploy --force --clean --config-file mkdocs.yml

django_admin_agent-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,95 @@
+name: tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install
+        run: uv sync --all-groups
+      - name: ruff check
+        run: uv run ruff check .
+      - name: ruff format check
+        run: uv run ruff format --check --diff .
+      - name: ty
+        run: uv run ty check django_admin_agent
+
+  docs:
+    name: docs build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install with docs group
+        run: uv sync --all-groups
+      - name: mkdocs build --strict
+        run: DJANGO_SETTINGS_MODULE=tests.conftest_settings uv run mkdocs build --strict
+
+  test:
+    name: ${{ matrix.python-version }} / Django ${{ matrix.django-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        django-version: ["4.2", "5.0", "5.1", "5.2", "6.0"]
+        exclude:
+          # Django 4.2 supports Python 3.8–3.12
+          - python-version: "3.13"
+            django-version: "4.2"
+          - python-version: "3.14"
+            django-version: "4.2"
+          # Django 5.0 supports Python 3.10–3.12
+          - python-version: "3.13"
+            django-version: "5.0"
+          - python-version: "3.14"
+            django-version: "5.0"
+          # Django 5.1 supports Python 3.10–3.13
+          - python-version: "3.14"
+            django-version: "5.1"
+          # Django 6.0 requires Python 3.12+
+          - python-version: "3.10"
+            django-version: "6.0"
+          - python-version: "3.11"
+            django-version: "6.0"
+
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+      - name: Sync dev deps
+        run: uv sync --all-groups --python ${{ matrix.python-version }}
+      - name: Pin Django ${{ matrix.django-version }}
+        run: uv pip install --reinstall-package django "django~=${{ matrix.django-version }}.0"
+      - name: pytest
+        run: |
+          uv run --no-sync pytest \
+            --cov-report=xml:coverage.xml \
+            --cov-report=html:htmlcov
+      - name: Upload coverage artifact
+        if: always()
+        uses: actions/upload-artifact@v5
+        with:
+          name: coverage-py${{ matrix.python-version }}-django${{ matrix.django-version }}
+          path: |
+            coverage.xml
+            htmlcov/
+          if-no-files-found: ignore

django_admin_agent-0.1.0/.gitignore

@@ -0,0 +1,122 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+coverage*.json
+coverage*.xml
+
+# release.yml renders this at workflow-time and drops it under docs/ so
+# mkdocs gh-deploy carries it to the gh-pages root.
+docs/coverage.json
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Sphinx documentation
+docs/_build/
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Virtualenv-style scripts dirs (we re-include the repo-root scripts/ directory).
+[Ss]cripts
+!/scripts/
+pyvenv.cfg
+.Python
+[Bb]in
+[Ii]nclude
+[Ll]ib
+[Ll]ib64
+[Ll]ocal
+
+# uv
+.uv-cache/
+
+# mkdocs
+/site
+
+# Type checkers
+.mypy_cache/
+.dmypy.json
+dmypy.json
+.pyre/
+.pytype/
+.ruff_cache/
+.ty_cache/
+
+# IDE
+.vscode/
+.idea/
+*.iml
+*.code-workspace
+.history/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Release metadata (rendered by scripts/release-publish.sh during CI)
+.release-metadata/
+
+# AI-specific items
+.ai/
+.claude/

django_admin_agent-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,32 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+        args: ["--maxkb=2000"]
+
+  - repo: local
+    hooks:
+      - id: ruff-check
+        name: "ruff check --fix"
+        entry: make lint-fix
+        pass_filenames: false
+        language: system
+        stages: [pre-commit]
+
+      - id: ruff-format
+        name: "ruff format"
+        entry: make format
+        pass_filenames: false
+        language: system
+        stages: [pre-commit]
+
+      - id: backend-type-check
+        name: "type check (ty)"
+        entry: make type-check
+        pass_filenames: false
+        language: system
+        stages: [pre-commit]

django_admin_agent-0.1.0/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] — 2026-06-01
+
+### Added
+- Chat-agent sidebar for the Django admin, built on `django-ag-ui` and the
+  vendored `@artooi/ag-ui-web-component` `<ag-ui-chat>` bundle.
+- Default server-side tool registry (`build_default_registry`) of read-only
+  `shell.*` (query / count / fetch / inspect-schema) and `introspect.*`
+  (model + admin registration) tools, plus `register_*_tools` builders and
+  `get_urls()` to mount the agent endpoint.
+- Frontend admin tool layer: `nav.*` navigation and DOM-driving handlers
+  (fill field, click, apply changelist filter) with visible animations, and a
+  confirmation modal gating `x-destructive` tools.
+- Sidebar wiring: the `{% django_admin_agent_sidebar %}` template tag and a
+  `SidebarAdminSite` (`each_context`) path, with an admin route + page map.
+- Django Unfold compatibility shim (runtime JS; lazy, guarded Python).
+- Optional `[mcp]` extra exposing the admin tools as an HTTP MCP server via
+  `djangorestframework-mcp-server`.
+
+[Unreleased]: https://github.com/Artui/django-admin-agent/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/Artui/django-admin-agent/releases/tag/v0.1.0

django_admin_agent-0.1.0/CLAUDE.md

@@ -0,0 +1,146 @@
+# Repo conventions for `django-admin-agent`
+
+Single source of truth for how to write code here. Rules are non-negotiable
+unless flagged as a heuristic.
+
+## What this package is
+
+An always-present chat-agent sidebar embedded in the Django admin. It depends
+on two sibling packages:
+- **`django-ag-ui`** — the Django ↔ Pydantic-AI ↔ AG-UI bridge. Provides
+  `ToolRegistry`, the `@tool` decorator, `DjangoAGUIView`, `get_urls`, the
+  audit logger. This package *builds on* those; it does not reimplement them.
+- **`@artooi/ag-ui-web-component`** — the `<ag-ui-chat>` Web Component. We
+  vendor its built bundle into `django_admin_agent/static/django_admin_agent/`
+  and load it from the admin templates.
+
+This package adds: server-side admin tools (`shell.*` / `introspect.*` /
+`nav.*`), the admin-specific frontend tool handlers (DOM driving), the
+`SidebarAdminSite` / `each_context` / template-tag plumbing, and an Unfold
+compatibility shim.
+
+The design is at `/Users/arturveres/code/opensource/docs/plans/django-ag-ui-plan.md`.
+
+## Local development
+
+`django-ag-ui` is resolved from PyPI via the plain `django-ag-ui>=0.1` pin in
+`pyproject.toml` (so CI, which has no sibling checkout, syncs cleanly). To
+develop both packages together against a local checkout, add a `[tool.uv.sources]`
+override *locally* (do not commit it) and `uv sync`:
+
+```toml
+[tool.uv.sources]
+django-ag-ui = { path = "../django-ag-ui", editable = true }
+```
+
+### The vendored web-component bundle
+
+`django_admin_agent/static/django_admin_agent/ag-ui-web-component.bundle.js` is
+a **build artefact**, not hand-written — it is esbuild's minified output from
+`@artooi/ag-ui-web-component` (TypeScript source), with `@ag-ui/*` inlined.
+
+The bundle is **version-pinned** in the `Makefile` (`WEB_COMPONENT_VERSION`).
+That pin is the source of truth:
+
+- **Release** re-vendors the pinned published version. `make
+  release-publish-prepare` runs `make vendor-bundle-release` (which `npm pack`s
+  `@artooi/ag-ui-web-component@$(WEB_COMPONENT_VERSION)` and copies its built
+  bundle) *before* building the wheel. So a released wheel always ships exactly
+  the pinned bundle — ongoing web-component changes can never retroactively
+  break a released `django-admin-agent`, and bumping the bundle is a deliberate
+  `WEB_COMPONENT_VERSION` change + release.
+- **Dev** uses `make vendor-bundle` to copy from the sibling
+  `../ag-ui-web-component/dist/` checkout. The committed copy is a convenience
+  (so `git clone` + `runserver` works) and may drift; the release re-vendor is
+  the authoritative refresh.
+
+To adopt a new web-component version: bump `WEB_COMPONENT_VERSION`, run `make
+vendor-bundle-release` (or `vendor-bundle` in dev), commit, release.
+
+## Commands
+
+| Target | What it does |
+| --- | --- |
+| `make init` | `uv sync --all-groups` + install pre-commit hooks |
+| `make test` | pytest with 100% line+branch coverage gate |
+| `make lint` | `ruff check .` + `ty check django_admin_agent` |
+| `make format` | `ruff format .` |
+| `make docs-build` | `mkdocs build --strict` |
+| `make release-bump VERSION=X.Y.Z` | rewrite `version.py` + promote CHANGELOG |
+
+## Structural rules
+
+1. **One exported class or function per file.** File name = `snake_case` of the
+   symbol. `constants.py` is the only multi-export file (enums + constants).
+2. **Private one-file helpers** stay local with a leading `_`.
+3. **Cross-file non-exported helpers** go in a sibling `utils.py`.
+4. **Top-level imports only.** Optional deps (`unfold`, `rest_framework_mcp`)
+   import lazily inside function bodies with a clear `ImportError` message.
+5. **Full type annotations** on every signature. `Any` only at Django ORM /
+   admin boundaries where the type genuinely is `Any`.
+6. **`__init__.py` is the only re-export point.** Internal modules import from
+   leaf paths, never from the package `__init__`.
+7. **Always `from __future__ import annotations`.** Python 3.10+, no PEP 695
+   `type` statements, no `match`.
+8. **Absolute imports only**, ordered stdlib → third-party → first-party
+   (`django_admin_agent`). Never relative.
+9. **Types and functionality in separate sub-packages** (`types/` siblings).
+
+## Reuse, don't reimplement
+
+The agent loop, tool registry, AG-UI transport, and audit logger live in
+`django-ag-ui`. Import them:
+- `django_ag_ui.ToolRegistry`, `django_ag_ui.tool` (the `@tool` decorator),
+  `django_ag_ui.ToolCategory`
+- `django_ag_ui.DjangoAGUIView`, `django_ag_ui.get_urls`
+- `django_ag_ui.AuditLogger` and friends
+
+This package contributes *tools* and *admin wiring*, not transport.
+
+## No module-level or class-level mutable state
+
+State lives on instances. No module-level mutable singletons or class-body
+mutables; initialise in `__init__`. A project may mount more than one sidebar.
+
+## Tests
+
+- `make test` runs pytest with `--cov=django_admin_agent --cov-fail-under=100`
+  (line + branch). Restructure rather than `# pragma: no cover`.
+- Layout mirrors the source tree under `tests/`.
+- `tests/conftest_settings.py` is the Django settings module (admin + auth +
+  sessions installed). Fixture admin apps live under `tests/`.
+- Async tests: `async def test_...` (pytest-asyncio auto mode). DB tests:
+  `@pytest.mark.django_db`.
+
+## Lint and types
+
+- `make lint` runs `ruff check .` + `ty check django_admin_agent`. CI fails on
+  either. `ruff format` is the layout source of truth.
+- Pre-commit runs `make lint-fix`, `make format`, `make type-check`. Never
+  `--no-verify`.
+
+## Boundaries
+
+- Core imports `django.contrib.admin`; that is expected here (unlike
+  `django-ag-ui`, which must stay admin-free).
+- `unfold` is never imported at module load — the shim is JS, runtime-detected
+  in the browser; any Python Unfold introspection is lazy + guarded.
+- The `[mcp]` extra plugs into `djangorestframework-mcp-server`; import it
+  lazily.
+
+## Compatibility floor
+
+| Component | Floor | Tested |
+| --- | --- | --- |
+| Python | 3.10 | 3.10–3.14 |
+| Django | 4.2 LTS | 4.2, 5.0, 5.1, 5.2, 6.0 |
+| django-ag-ui | 0.1 | from PyPI (`>=0.1`) |
+| Django Unfold (supported, optional) | 0.40 | latest in matrix |
+
+## Branching & releases
+
+Branch-first for every feature/bump; never commit to `main` locally. Releases
+are merge-to-main triggered via `.github/workflows/release.yml` →
+`scripts/release-publish.sh` (version source: `django_admin_agent/version.py`).
+OIDC trusted publishing to PyPI; `mkdocs gh-deploy` to gh-pages. Cut a release
+with `make release-bump VERSION=X.Y.Z`, edit CHANGELOG, PR, merge.

django_admin_agent-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artur Veres
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_admin_agent-0.1.0/Makefile

@@ -0,0 +1,116 @@
+.PHONY: help init test lint lint-fix format format-check type-check deps-bump docs-serve docs-build vendor-bundle vendor-bundle-release release-bump release-publish release-publish-prepare release-publish-finalize
+
+help:
+	@echo "Available targets:"
+	@echo "  init             Sync deps (all groups) and install pre-commit hooks"
+	@echo "  test             Run pytest with coverage (100% required)"
+	@echo "  lint             Run ruff check + ty check"
+	@echo "  lint-fix         Auto-fix lint issues with ruff"
+	@echo "  format           Format with ruff"
+	@echo "  format-check     Verify formatting"
+	@echo "  type-check       Run ty over the package"
+	@echo "  deps-bump        Upgrade pinned dependencies"
+	@echo "  docs-serve       Live-reload docs at http://localhost:8000 (needs mkdocs.yml)"
+	@echo "  docs-build       Build docs into ./site (strict — fails on broken links)"
+	@echo "  vendor-bundle    Copy the web-component bundle from the sibling checkout (dev)"
+	@echo "  vendor-bundle-release  Vendor the PINNED published web-component bundle (release)"
+	@echo "  release-bump     Bump version files + CHANGELOG. Usage: make release-bump VERSION=X.Y.Z"
+	@echo "  release-publish  prepare → uv publish → finalize (workstation release)"
+	@echo "  release-publish-prepare   Run by release.yml on push to main (no-op unless bumped)"
+	@echo "  release-publish-finalize  Tag vX.Y.Z + create GitHub Release after PyPI publish"
+
+init:
+	uv sync --all-groups
+	uv run pre-commit install
+
+test:
+	uv run pytest
+
+# Browser end-to-end suite: Playwright drives a live admin through the sidebar.
+# Separate settings + no coverage gate (it exercises JS + the server over HTTP).
+test-e2e:
+	DJANGO_ALLOW_ASYNC_UNSAFE=1 uv run pytest tests/e2e --ds=tests.e2e.settings -o addopts="" -p no:cacheprovider
+
+lint:
+	uv run ruff check .
+	uv run ty check django_admin_agent
+
+lint-fix:
+	uv run ruff check --fix .
+
+format:
+	uv run ruff format .
+
+format-check:
+	uv run ruff format --check --diff .
+
+type-check:
+	uv run ty check django_admin_agent
+
+deps-bump:
+	uvx uv-upx upgrade run --profile with_pinned
+
+docs-serve:
+	uv run --group docs mkdocs serve
+
+docs-build:
+	uv run --group docs mkdocs build --strict
+
+# The web-component bundle is a vendored build artefact. The PINNED version
+# below is the single source of truth: a release re-vendors exactly this
+# version (see release-publish-prepare), so a published wheel never depends on
+# the live web-component source and ongoing component changes cannot
+# retroactively affect a released django-admin-agent.
+WEB_COMPONENT_PKG := @artooi/ag-ui-web-component
+WEB_COMPONENT_VERSION := 0.1.1
+BUNDLE_DEST := django_admin_agent/static/django_admin_agent/ag-ui-web-component.bundle.js
+
+# Dev: copy the locally-built bundle from the sibling checkout (run
+# `make build` in ../ag-ui-web-component first). Convenient, may drift — the
+# release re-vendor is the authoritative refresh.
+vendor-bundle:
+	cp ../ag-ui-web-component/dist/ag-ui-web-component.bundle.js $(BUNDLE_DEST)
+	@echo "Vendored ag-ui-web-component.bundle.js from the sibling checkout (dev)."
+
+# Release: fetch the PINNED published version and vendor its built bundle. Run
+# automatically by release-publish-prepare so every wheel ships exactly
+# $(WEB_COMPONENT_PKG)@$(WEB_COMPONENT_VERSION). Fails loudly if the pinned
+# version cannot be fetched — better than shipping a stale bundle.
+vendor-bundle-release:
+	@set -e; tmp="$$(mktemp -d)"; \
+	( cd "$$tmp" && npm pack "$(WEB_COMPONENT_PKG)@$(WEB_COMPONENT_VERSION)" >/dev/null ); \
+	tar -xzf "$$tmp"/*.tgz -C "$$tmp"; \
+	cp "$$tmp/package/dist/ag-ui-web-component.bundle.js" "$(BUNDLE_DEST)"; \
+	rm -rf "$$tmp"; \
+	echo "Vendored $(WEB_COMPONENT_PKG)@$(WEB_COMPONENT_VERSION) bundle (release)."
+
+release-bump:
+	@if [ -z "$(VERSION)" ]; then \
+		echo "Usage: make release-bump VERSION=X.Y.Z"; exit 1; \
+	fi
+	uvx bump-my-version bump --new-version "$(VERSION)" patch
+	@echo ""
+	@echo "Bumped to $(VERSION). Edit CHANGELOG.md to fill the new section,"
+	@echo "review with 'git diff', then run 'make release-publish'."
+
+# Release pipeline. Version lives in django_admin_agent/version.py
+# (pyproject pulls it in via [tool.hatch.version] dynamic).
+RELEASE_PACKAGE_NAME := django-admin-agent
+RELEASE_VERSION_FILES := django_admin_agent/version.py|^__version__[^=]*= *
+
+release-publish: vendor-bundle-release
+	@PACKAGE_NAME='$(RELEASE_PACKAGE_NAME)' \
+	VERSION_FILES="$$(printf '$(RELEASE_VERSION_FILES)')" \
+		bash scripts/release-publish.sh all
+
+# Re-vendor the pinned bundle BEFORE the script builds the wheel, so the
+# published artefact always carries a fresh, version-pinned bundle.
+release-publish-prepare: vendor-bundle-release
+	@PACKAGE_NAME='$(RELEASE_PACKAGE_NAME)' \
+	VERSION_FILES="$$(printf '$(RELEASE_VERSION_FILES)')" \
+		bash scripts/release-publish.sh prepare
+
+release-publish-finalize:
+	@PACKAGE_NAME='$(RELEASE_PACKAGE_NAME)' \
+	VERSION_FILES="$$(printf '$(RELEASE_VERSION_FILES)')" \
+		bash scripts/release-publish.sh finalize