protowire-python 0.70.0__tar.gz

protowire_python-0.70.0/.editorconfig

@@ -0,0 +1,27 @@
+# EditorConfig — https://editorconfig.org
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{md,markdown}]
+trim_trailing_whitespace = false  # markdown uses trailing spaces for line breaks
+indent_size = 2
+
+[*.{yml,yaml,json,toml}]
+indent_size = 2
+
+[*.{cc,h,hpp,proto,cmake}]
+indent_size = 2
+
+[CMakeLists.txt]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

protowire_python-0.70.0/.github/CODEOWNERS

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 TrendVidia, LLC.
+#
+# Code ownership for protowire-python.
+
+*                              @trendvidia/maintainers
+
+# --- FFI boundary (cross-language safety scrutiny applies) --------------
+/src/_protowire/                @trendvidia/maintainers
+
+# --- Public Python API --------------------------------------------------
+/src/protowire/                 @trendvidia/maintainers
+
+# --- Tests + cross-port harnesses (open to broader reviewer pool) -------
+/tests/                         @trendvidia/contributors @trendvidia/maintainers
+/scripts/                       @trendvidia/contributors @trendvidia/maintainers
+/testdata/                      @trendvidia/contributors @trendvidia/maintainers
+
+# --- Build, packaging, CI -----------------------------------------------
+/.github/                       @trendvidia/maintainers
+/CMakeLists.txt                 @trendvidia/maintainers
+/pyproject.toml                 @trendvidia/maintainers

protowire_python-0.70.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,49 @@
+---
+name: Bug report
+about: Report a defect — wrong output, crash, parse error on valid input, etc.
+title: "bug: "
+labels: bug
+---
+
+<!--
+Cross-port issues (the same input behaves differently on multiple ports)
+belong upstream at trendvidia/protowire, not here. See CONTRIBUTING.md.
+
+Codec-level bugs that also reproduce in protowire-cpp directly belong
+in trendvidia/protowire-cpp.
+
+Security issues (decoder crash/hang/OOM on adversarial input, FFI
+refcount errors, GIL violations) go to security@trendvidia.com
+instead. See SECURITY.md.
+-->
+
+## What happened
+
+A clear description of the bug.
+
+## How to reproduce
+
+Smallest possible PXF / PB / SBE / envelope input + Python snippet that
+triggers it.
+
+```python
+from protowire import pxf
+# ...
+```
+
+## What you expected
+
+What you thought should happen.
+
+## Versions
+
+- `protowire` version (`pip show protowire`):
+- Python version (`python --version`):
+- OS / arch:
+- Installed via wheel or source build (`pip install -v` last lines):
+- If source build: protobuf + CMake + compiler versions
+
+## Reproduces in protowire-cpp directly?
+
+If yes, please file at https://github.com/trendvidia/protowire-cpp/issues
+instead — the codec lives there. (Skip if unknown.)

protowire_python-0.70.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 TrendVidia, LLC.
+
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/trendvidia/protowire-python/blob/main/SECURITY.md
+    about: >-
+      Decoder crashes, hangs, OOMs, FFI refcount errors, GIL violations
+      — email security@trendvidia.com per SECURITY.md, do not file a
+      public issue.
+  - name: Codec bug (also reproduces in C++)
+    url: https://github.com/trendvidia/protowire-cpp/issues/new?template=bug_report.md
+    about: >-
+      The wire codec is in protowire-cpp and reaches Python through
+      nanobind. Codec bugs that also reproduce in C++ directly belong
+      there.
+  - name: Cross-port wire-equivalence regression
+    url: https://github.com/trendvidia/protowire/issues/new?template=bug_report.md
+    about: >-
+      Same input produces different output on different ports. File
+      these upstream against trendvidia/protowire so all 9 port repos
+      can coordinate the fix.
+  - name: Spec / grammar / annotation discussion
+    url: https://github.com/trendvidia/protowire/discussions
+    about: >-
+      Wire format, PXF grammar, proto annotation design — the spec
+      project owns these decisions.

protowire_python-0.70.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,36 @@
+---
+name: Feature request
+about: Propose a Python-port-only API addition or ergonomics improvement
+title: "feat: "
+labels: enhancement
+---
+
+<!--
+Wire-format / spec / annotation proposals belong upstream at
+trendvidia/protowire — they affect every port.
+
+Codec-level changes belong in trendvidia/protowire-cpp — this port is a
+nanobind wrapper.
+
+This template is for PYTHON-PORT-ONLY changes: better Pythonic
+ergonomics, new convenience overloads, packaging improvements, support
+for a new Python version or platform.
+-->
+
+## Problem
+
+What's awkward to express today, or what's missing?
+
+## Proposal
+
+What you'd like to add. If it's a new public API, sketch the signature
+and the typical call-site. If it's a perf change, ideally include a
+microbench number from `scripts/bench_pxf.py` or `scripts/bench_sbe.py`.
+
+## Alternatives considered
+
+What else you tried, and why it isn't enough.
+
+## Out of scope (optional)
+
+Things this proposal is **not** trying to do, to keep review focused.

protowire_python-0.70.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,36 @@
+<!--
+For changes that touch wire-format behaviour: please open the upstream
+PR in trendvidia/protowire and trendvidia/protowire-cpp FIRST. This port
+implements the spec via the C++ codec; it shouldn't lead spec or codec
+changes. See CONTRIBUTING.md.
+
+For FFI-boundary changes (src/_protowire/module.cc, anything crossing
+the nanobind shim): include a manual round-trip check against the
+protowire-cpp reference fixtures.
+-->
+
+## Summary
+
+What this PR changes, in 1–3 sentences.
+
+## Why
+
+Link to the issue or upstream spec/codec change that motivated this.
+
+## Scope
+
+- [ ] FFI boundary (`src/_protowire/`)
+- [ ] Public Python API (`src/protowire/`)
+- [ ] Tests / fixtures / harnesses (`tests/`, `testdata/`, `scripts/`)
+- [ ] Build / packaging / CI (`pyproject.toml`, `CMakeLists.txt`, `.github/`)
+- [ ] Documentation only
+
+## Test plan
+
+- [ ] Local build clean: `pip install -e '.[test]' && pytest`
+- [ ] If FFI-boundary change: round-tripped at least one PXF + SBE fixture
+      against the sibling `protowire-cpp` checkout
+- [ ] If wire-impacting: matching upstream PRs linked above
+- [ ] If new public symbol: exported from `protowire/__init__.py` and
+      covered by a test under `tests/`
+- [ ] If packaging change: cibuildwheel matrix smoke build still passes

protowire_python-0.70.0/.github/dependabot.yml

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 TrendVidia, LLC.
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "deps(actions)"
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-and-patch:
+        update-types: ["minor", "patch"]
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "deps(pip)"
+    open-pull-requests-limit: 5
+    groups:
+      pip-minor-and-patch:
+        update-types: ["minor", "patch"]

protowire_python-0.70.0/.github/workflows/ci.yml

@@ -0,0 +1,179 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 TrendVidia, LLC.
+
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  # Pin the sibling C++ checkout to a specific commit. cpp@v0.70.0
+  # predates the __int128 → checked_arith refactor (MSVC), the
+  # protobuf-API-skew shim, and the MSVC source-charset fix; 9af2ec0
+  # is the first commit with all of those. Bump to a v0.70.x tag
+  # once cpp cuts one that includes them.
+  PROTOWIRE_CPP_REF: 9af2ec04918a417933848de1577cd61f83a710b0
+
+jobs:
+  # ---------------------------------------------------------------------
+  # Build + pytest matrix across {Linux, macOS, Windows} ×
+  # CPython 3.10–3.13. The native extension is rebuilt on every job
+  # because the C++ codec is a build-time dependency, not a wheel.
+  # ---------------------------------------------------------------------
+  test:
+    name: ${{ matrix.os }} / py${{ matrix.python }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v6
+
+      # Sibling protowire-cpp checkout. CMakeLists.txt looks here by
+      # default (../protowire-cpp). The ref is pinned via env var above
+      # so a codec change requires explicitly bumping both repos.
+      - name: Checkout protowire-cpp
+        uses: actions/checkout@v6
+        with:
+          repository: trendvidia/protowire-cpp
+          ref: ${{ env.PROTOWIRE_CPP_REF }}
+          path: protowire-cpp-checkout
+
+      - name: Set up Python ${{ matrix.python }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install protobuf (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            protobuf-compiler libprotobuf-dev libprotoc-dev
+
+      - name: Install protobuf (macOS)
+        if: runner.os == 'macOS'
+        run: brew install protobuf
+
+      - name: Install protobuf (Windows / vcpkg)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        # Default dynamic triplet — wheel repair handles DLL bundling
+        # at publish time (see publish.yml). The pytest job below
+        # imports the in-place build, where the DLLs in vcpkg's bin
+        # are reachable via PATH set up by the toolchain file.
+        run: vcpkg install protobuf:x64-windows
+
+      - name: Install package + test deps (Linux / macOS)
+        if: runner.os != 'Windows'
+        env:
+          PROTOWIRE_CPP_DIR: ${{ github.workspace }}/protowire-cpp-checkout
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[test]' -v
+
+      - name: Install package + test deps (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          PROTOWIRE_CPP_DIR: ${{ github.workspace }}\protowire-cpp-checkout
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[test]' -v `
+            --config-settings=cmake.define.CMAKE_TOOLCHAIN_FILE="$env:VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            --config-settings=cmake.define.VCPKG_TARGET_TRIPLET=x64-windows
+
+      - name: pytest (Linux / macOS)
+        if: runner.os != 'Windows'
+        env:
+          PROTOWIRE_CPP_DIR: ${{ github.workspace }}/protowire-cpp-checkout
+        run: pytest -v
+
+      - name: pytest (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          PROTOWIRE_CPP_DIR: ${{ github.workspace }}\protowire-cpp-checkout
+        # editable installs don't bundle DLLs — _protowire.pyd resolves
+        # libprotobuf.dll / libabsl_*.dll out of vcpkg's bin dir at
+        # import time. Put it on PATH for the pytest run.
+        run: |
+          $env:PATH = "$env:VCPKG_INSTALLATION_ROOT\installed\x64-windows\bin;$env:PATH"
+          pytest -v
+
+  # ---------------------------------------------------------------------
+  # cibuildwheel smoke build — exercises the wheel-publishing path on
+  # every PR so packaging regressions surface before release time.
+  # Builds one Python version per OS to keep CI fast; the full matrix
+  # runs in publish.yml on tag push.
+  # ---------------------------------------------------------------------
+  cibuildwheel-smoke:
+    name: cibuildwheel smoke / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Checkout protowire-cpp
+        uses: actions/checkout@v6
+        with:
+          repository: trendvidia/protowire-cpp
+          ref: ${{ env.PROTOWIRE_CPP_REF }}
+          path: protowire-cpp-checkout
+
+      - name: Build one wheel
+        uses: pypa/cibuildwheel@v3.4.1
+        env:
+          # Build only one CPython version per OS for the smoke job —
+          # the full matrix is reserved for the release workflow.
+          CIBW_BUILD: cp312-*
+          CIBW_SKIP: "*-musllinux_* *-manylinux_i686 pp*"
+          CIBW_ARCHS_LINUX: x86_64
+          CIBW_ARCHS_MACOS: arm64
+          CIBW_ARCHS_WINDOWS: AMD64
+          # Linux: source is mounted at /project inside the manylinux
+          # container; host paths don't resolve. Override there.
+          CIBW_ENVIRONMENT_LINUX: PROTOWIRE_CPP_DIR=/project/protowire-cpp-checkout
+          PROTOWIRE_CPP_DIR: ${{ github.workspace }}/protowire-cpp-checkout
+          # Linux uses manylinux containers — base image protobuf is
+          # too old (3.5 / 3.14) for our annotations, so build 25.3
+          # from source. See scripts/cibw_install_protobuf_linux.sh
+          # for the why.
+          CIBW_BEFORE_ALL_LINUX: bash {project}/scripts/cibw_install_protobuf_linux.sh
+          CIBW_BEFORE_ALL_MACOS: brew install protobuf
+          CIBW_BEFORE_ALL_WINDOWS: vcpkg install protobuf:x64-windows
+          # delvewheel is only auto-installed when cibuildwheel uses
+          # its default Windows repair command — once we override
+          # CIBW_REPAIR_WHEEL_COMMAND_WINDOWS we have to install it.
+          CIBW_BEFORE_BUILD_WINDOWS: pip install delvewheel
+          # macOS: Homebrew's bottled dylibs are built for the runner's
+          # OS (macos-latest = 15). Set the wheel's deployment target
+          # to match so delocate accepts them.
+          MACOSX_DEPLOYMENT_TARGET: "15.0"
+          CIBW_ENVIRONMENT_WINDOWS: >-
+            CMAKE_TOOLCHAIN_FILE="$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake"
+            VCPKG_TARGET_TRIPLET=x64-windows
+          # Drop delocate's per-dylib INFO chatter from the macOS
+          # repair step (cibuildwheel default includes -v).
+          CIBW_REPAIR_WHEEL_COMMAND_MACOS: delocate-wheel --require-archs {delocate_archs} -w {dest_dir} {wheel}
+          # cibuildwheel has no Windows wheel-repair by default —
+          # delvewheel bundles the DLL deps the wheel links against.
+          # See publish.yml for the full rationale.
+          CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: >-
+            delvewheel repair
+            --add-path "%VCPKG_INSTALLATION_ROOT%\installed\x64-windows\bin"
+            -w {dest_dir} {wheel}

protowire_python-0.70.0/.github/workflows/codeql.yml

@@ -0,0 +1,73 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 TrendVidia, LLC.
+
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "37 6 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+env:
+  # See ci.yml for why this is a SHA, not v0.70.0.
+  PROTOWIRE_CPP_REF: 9af2ec04918a417933848de1577cd61f83a710b0
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # python: pure-Python wrapper code. cpp: src/_protowire/module.cc
+        # (the FFI shim) plus the linked protowire-cpp sources.
+        language: [python, cpp]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Checkout protowire-cpp
+        if: matrix.language == 'cpp'
+        uses: actions/checkout@v6
+        with:
+          repository: trendvidia/protowire-cpp
+          ref: ${{ env.PROTOWIRE_CPP_REF }}
+          path: protowire-cpp-checkout
+
+      - name: Install build deps (cpp)
+        if: matrix.language == 'cpp'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            gcc-13 g++-13 protobuf-compiler libprotobuf-dev libprotoc-dev
+
+      - name: Set up Python (cpp build needs nanobind in PATH)
+        if: matrix.language == 'cpp'
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-and-quality
+
+      - name: Configure + build the FFI extension (drives cpp extraction)
+        if: matrix.language == 'cpp'
+        env:
+          CC:  gcc-13
+          CXX: g++-13
+          PROTOWIRE_CPP_DIR: ${{ github.workspace }}/protowire-cpp-checkout
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e . -v
+
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

protowire_python-0.70.0/.github/workflows/publish.yml

@@ -0,0 +1,203 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 TrendVidia, LLC.
+#
+# Wheel + sdist publishing pipeline.
+#
+# Triggered manually or on a `v*` tag push. The trusted-publishing OIDC
+# step requires the GitHub repo to be configured as a "trusted publisher"
+# for the `protowire` PyPI project (see
+# https://docs.pypi.org/trusted-publishers/). No long-lived API tokens
+# are stored anywhere.
+
+name: Publish to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  # Pin the sibling C++ checkout to a specific commit. This is a
+  # frozen FFI surface, so it must be an immutable ref — never a
+  # branch.
+  #
+  # Using a SHA (not the v0.70.0 tag) because cpp@v0.70.0 predates
+  # the f1d3eb0 __int128 → checked_arith refactor needed for MSVC,
+  # plus the protobuf-API-skew shim and MSVC source-charset fixes.
+  # 9af2ec0 (cpp main, ci: MSVC source-charset + skip pxf_escapes)
+  # is the first commit with all of those. Bump to v0.70.x once cpp
+  # cuts a tag that includes them.
+  PROTOWIRE_CPP_REF: 9af2ec04918a417933848de1577cd61f83a710b0
+
+jobs:
+  # ---------------------------------------------------------------------
+  # Full wheel matrix: CPython 3.10–3.13 × {linux x86_64, linux aarch64,
+  # macos x86_64, macos arm64, windows x86_64}. cibuildwheel handles
+  # the manylinux/musllinux/macos universal2 toolchain plumbing.
+  # ---------------------------------------------------------------------
+  wheels:
+    name: ${{ matrix.os }} (${{ matrix.archs }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            archs: "x86_64"
+          - os: ubuntu-latest
+            archs: "aarch64"
+          # macOS Apple Silicon only. The macos-13 (Intel) runner pool
+          # is being deprecated by GitHub Actions — runner availability
+          # is sporadic with no SLA, and we waited 9+ hours for the
+          # x86_64 leg to even start during the v0.70.0 release. Intel
+          # macOS users fall back to a source build via the published
+          # sdist for now; we'll add the x86_64 wheel back via
+          # universal2 (or a self-hosted runner) in a follow-up.
+          # Deployment target must match the runner: Homebrew's bottled
+          # protobuf/abseil dylibs are built for the runner's macOS
+          # version (macos-latest = 15), and delocate refuses to bundle
+          # dylibs whose min target is newer than the wheel's.
+          - os: macos-latest
+            archs: "arm64"
+            macosx_deployment_target: "15.0"
+          - os: windows-latest
+            archs: "AMD64"
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Checkout protowire-cpp
+        uses: actions/checkout@v6
+        with:
+          repository: trendvidia/protowire-cpp
+          ref: ${{ env.PROTOWIRE_CPP_REF }}
+          path: protowire-cpp-checkout
+
+      # Linux aarch64 runs through QEMU emulation inside the manylinux
+      # container — register binfmt handlers first.
+      - name: Set up QEMU
+        if: matrix.os == 'ubuntu-latest' && matrix.archs == 'aarch64'
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: arm64
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v3.4.1
+        env:
+          CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-*"
+          CIBW_SKIP: "*-musllinux_* *-manylinux_i686 pp*"
+          CIBW_ARCHS: ${{ matrix.archs }}
+          # Linux: cibuildwheel runs the build inside a manylinux
+          # container that mounts the project source at /project, so
+          # the host PROTOWIRE_CPP_DIR path doesn't resolve. Point at
+          # the in-container path instead.
+          CIBW_ENVIRONMENT_LINUX: PROTOWIRE_CPP_DIR=/project/protowire-cpp-checkout
+          # macOS + Windows: cibuildwheel runs natively, so the host
+          # path passed via the action-level env block works directly.
+          PROTOWIRE_CPP_DIR: ${{ github.workspace }}/protowire-cpp-checkout
+          # The manylinux base image's protobuf-devel rpm is too old
+          # (3.5 / 3.14) and generates broken C++ for fields named
+          # `default`. Build 25.3 from source instead.
+          CIBW_BEFORE_ALL_LINUX: bash {project}/scripts/cibw_install_protobuf_linux.sh
+          CIBW_BEFORE_ALL_MACOS: brew install protobuf
+          # Use the default dynamic triplet — vcpkg integrates with
+          # CMake's find_package via the toolchain file, and delvewheel
+          # bundles the resulting libprotobuf.dll / libabsl_*.dll into
+          # the wheel (see CIBW_REPAIR_WHEEL_COMMAND_WINDOWS below).
+          # The static-md triplet would also work but scikit-build-core
+          # didn't reliably pick up the toolchain switch through
+          # CIBW_ENVIRONMENT_WINDOWS in earlier attempts.
+          CIBW_BEFORE_ALL_WINDOWS: vcpkg install protobuf:x64-windows
+          # delvewheel is only auto-installed when cibuildwheel uses its
+          # default Windows repair command; once we override
+          # CIBW_REPAIR_WHEEL_COMMAND_WINDOWS we have to install it
+          # ourselves.
+          CIBW_BEFORE_BUILD_WINDOWS: pip install delvewheel
+          # See matrix comment: align wheel target with runner OS so
+          # delocate accepts brew's dylibs.
+          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.macosx_deployment_target }}
+          CIBW_ENVIRONMENT_WINDOWS: >-
+            CMAKE_TOOLCHAIN_FILE="$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake"
+            VCPKG_TARGET_TRIPLET=x64-windows
+          # Override cibuildwheel's default macOS repair command to
+          # drop the -v flag — the per-dylib INFO chatter from delocate
+          # is noise.
+          CIBW_REPAIR_WHEEL_COMMAND_MACOS: delocate-wheel --require-archs {delocate_archs} -w {dest_dir} {wheel}
+          # cibuildwheel ships with no Windows wheel-repair by default,
+          # so libprotobuf.dll and libabsl_*.dll never get bundled into
+          # the wheel — `import protowire` fails with "DLL load failed"
+          # at user install time. Use delvewheel and point it at
+          # vcpkg's bin dir so it can find the runtime DLLs to bundle.
+          # The repair command runs in cmd.exe on Windows, so use
+          # %VAR% syntax (not bash $VAR) for env-var expansion.
+          CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: >-
+            delvewheel repair
+            --add-path "%VCPKG_INSTALLATION_ROOT%\installed\x64-windows\bin"
+            -w {dest_dir} {wheel}
+          # Smoke-import the wheel after build to catch link errors and
+          # missing symbols before they hit users.
+          CIBW_TEST_COMMAND: python -c "import protowire; from protowire import pxf, sbe, envelope"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: wheels-${{ matrix.os }}-${{ matrix.archs }}
+          path: ./wheelhouse/*.whl
+
+  # ---------------------------------------------------------------------
+  # Source distribution. Built once on Linux; PyPI requires the sdist
+  # alongside the wheels for from-source installs on platforms we don't
+  # cover.
+  # ---------------------------------------------------------------------
+  sdist:
+    name: sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Build sdist
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+          python -m build --sdist
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  # ---------------------------------------------------------------------
+  # Aggregate all artifacts and publish to PyPI via OIDC trusted
+  # publishing. The `pypi` environment is configured in repo settings
+  # to require approval before publishing — a final human gate.
+  # ---------------------------------------------------------------------
+  publish:
+    name: Publish to PyPI
+    needs: [wheels, sdist]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/protowire-python
+    permissions:
+      id-token: write  # required for OIDC trusted publishing
+      attestations: write  # required for Sigstore provenance attestations
+      contents: read
+    steps:
+      - name: Download all wheels + sdist
+        uses: actions/download-artifact@v8
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist
+          attestations: true
+          print-hash: true