salak 0.1.0__tar.gz

salak-0.1.0/.cursorrules

@@ -0,0 +1,69 @@
+Salak — deterministic code knowledge graph generator. Python 3.11+, PyPI `salak`.
+Parses a repo, emits one provenance-tagged JSON file (`repo-graph.json`).
+It is a BUILD ARTIFACT, not a database. Built to unblock Jeruk AI/MANGGA, not to
+become a product.
+
+READ THESE TWO FILES BEFORE DOING ANYTHING:
+  1. CLAUDE.md                      — working rules, the binding documents by name,
+                                      and what to do next
+  2. project-memory/03-progress.md  — authoritative state, newest snapshot at the top
+
+THIS FILE DELIBERATELY CARRIES NO PROJECT STATE.
+No task numbers, no phase status, no document version numbers, no "next task".
+It used to carry all four, and it went roughly thirty tasks stale without anyone
+noticing — it still named a superseded spec and a task finished weeks earlier.
+Five documents claimed the same facts and one of them was being maintained. So
+the duplication is gone rather than merely corrected, and a test enforces it
+(tests/test_context_pack.py). If you are tempted to paste status here, put it in
+03-progress.md and let this file keep pointing at it.
+
+DURABLE RULES — these do not change from task to task:
+
+- Precision over recall. A wrong edge is worse than a missing edge.
+- Provenance downgrades, never upgrades. `extracted` means the relation is
+  literally in source AND the target was confirmed — guess any part of the target
+  and it is not `extracted`.
+- Determinism is a test, not an aspiration. Two runs over an unchanged tree are
+  byte-identical except `generated_at`. Never let `set` or `dict` iteration order
+  reach the output.
+- Core must never import an adapter. Registration goes through the
+  `salak.adapters` entry-point group, and a test enforces the direction.
+- Every path in the artifact is repo-relative with POSIX separators. This repo is
+  developed on Windows; assume nothing.
+- Degraded is not failed. No language server means structure plus import edges,
+  not an error. `health_check()` never raises; `resolve()` may return empty.
+- Diagnostics never abort a run. A broken file yields a diagnostic and the scan
+  completes.
+- Exit codes are a public contract: 0 clean · 1 fatal · 2 completed with
+  diagnostics · 3 overwrite guard refused.
+- The bundled JSON Schema beats the prose. If the two disagree, the schema is
+  right and the prose gets fixed.
+- No placeholders. No "implement later", no stub returning a fake value. If a task
+  is too large to finish, say so and split it before starting.
+- Any binding decision the spec does not already make: STOP and ask the owner,
+  then record the approved answer in project-memory/01-decision-register.md.
+- One task at a time, in the plan's order — not numeric order; the two disagree,
+  and following the numbers has already caused a task to be skipped. Check
+  dependencies before starting.
+- Gates are hard. A `rework` verdict invalidates the downstream task list rather
+  than delaying it. Never pull later-phase work forward.
+- Run the real tools. Never describe output you did not see.
+- Update project-memory/03-progress.md in the same turn as the work it records.
+
+HARD BOUNDARIES — decisions, not preferences. Do not build, scaffold, or
+"prepare for": a UI or graph viewer · document/PDF/image ingestion · any LLM
+call · clustering or community detection · cross-repo graphs · any language
+beyond TypeScript and Python · dev-kickoff integration · `salak query` · watch
+mode · metrics or complexity scoring. Touching one of these is an anti-pattern,
+not initiative. Name it out loud instead.
+
+VERIFY THE REPO:
+  uv sync && uv run ruff check . && uv run mypy src tests && uv run pytest
+
+CONVENTIONS: `src/salak/` layout · ruff + mypy strict · CI on 3.11 and 3.12 ·
+snake_case functions, PascalCase classes, SCREAMING_SNAKE_CASE diagnostic codes ·
+full type hints · `LanguageAdapter` is a `typing.Protocol` · Conventional Commits
+with the phase as scope, e.g. `feat(v0.1): emit files section`.
+
+Talk to the owner in Bahasa Indonesia. Write every file, comment, commit message
+and document in English.

salak-0.1.0/.gitattributes

@@ -0,0 +1,16 @@
+# LF everywhere, on every platform.
+#
+# This repository is developed on Windows but its output is a build artifact whose
+# whole point is byte-identical, file-scoped diffs (SDD §3.6, acceptance criterion 6).
+# Mixed line endings make every diff noisy and would eventually be mistaken for a
+# determinism defect. Normalised repo-wide at TASK-016 after 12 tracked files had
+# drifted to CRLF.
+* text=auto eol=lf
+
+# Keep the artifact's own rules explicit — it is JSON, emitted one record per line.
+*.json text eol=lf
+repo-graph.json text eol=lf
+
+*.png binary
+*.jpg binary
+*.ico binary

salak-0.1.0/.github/copilot-instructions.md

@@ -0,0 +1,84 @@
+# Copilot instructions — Salak
+
+Salak — deterministic code knowledge graph generator. Python 3.11+, published on
+PyPI as `salak`. It parses a repository and emits one provenance-tagged JSON file
+(`repo-graph.json`) so an assistant can answer *"what depends on this module?"*
+from a recorded fact instead of a guess. The graph is a **build artifact, not a
+database**. It exists to unblock Jeruk AI and MANGGA; it is not meant to become a
+product.
+
+## Read these two files before doing anything
+
+| File | What it holds |
+|---|---|
+| `CLAUDE.md` | The working rules, the binding documents **by name**, and what to do next |
+| `project-memory/03-progress.md` | Authoritative state — newest snapshot at the top |
+
+## This file deliberately carries no project state
+
+No task numbers, no phase status, no document version numbers, no "next task".
+
+It used to carry all four, and it went roughly thirty tasks stale without anyone
+noticing — still naming a superseded spec and a task finished weeks earlier. The
+cause was structural rather than careless: five documents claimed the same facts
+and only one of them was being maintained. So the duplication is gone rather than
+merely corrected, and a test enforces it (`tests/test_context_pack.py`).
+
+If you are tempted to paste status here, put it in `03-progress.md` and let this
+file keep pointing at it.
+
+## Durable rules — these do not change from task to task
+
+- **Precision over recall.** A wrong edge is worse than a missing edge.
+- **Provenance downgrades, never upgrades.** `extracted` means the relation is
+  literally in source **and** the target was confirmed. Guess any part of the
+  target and it is not `extracted`.
+- **Determinism is a test.** Two runs over an unchanged tree are byte-identical
+  except `generated_at`. Never let a `set` or `dict` iteration order reach the
+  output.
+- **Core must never import an adapter.** Registration goes through the
+  `salak.adapters` entry-point group, and a test enforces the direction.
+- **Every path in the artifact is repo-relative with POSIX separators.** This
+  repository is developed on Windows; assume nothing.
+- **Degraded is not failed.** No language server means structure plus import
+  edges, not an error. `health_check()` never raises.
+- **Diagnostics never abort a run.** A broken file yields a diagnostic and the
+  scan completes.
+- **Exit codes are a public contract:** `0` clean · `1` fatal · `2` completed with
+  diagnostics · `3` overwrite guard refused.
+- **The bundled JSON Schema beats the prose.** If they disagree, the schema is
+  right and the prose gets fixed.
+- **No placeholders.** No "implement later", no stub returning a fake value. If a
+  task is too large to finish, say so and split it before starting.
+- **Any binding decision the spec does not make: STOP and ask the owner**, then
+  record the approved answer in `project-memory/01-decision-register.md`.
+- **One task at a time, in the plan's order** — not numeric order; the two
+  disagree, and following the numbers has already caused a task to be skipped.
+- **Gates are hard.** A `rework` verdict invalidates the downstream task list
+  rather than delaying it. Never pull later-phase work forward.
+- **Run the real tools.** Never describe output you did not see.
+
+## Hard boundaries — decisions, not preferences
+
+Do not build, scaffold, or "prepare for": a UI or graph viewer · document, PDF or
+image ingestion · **any LLM call** · clustering or community detection ·
+cross-repo graphs · any language beyond TypeScript and Python · dev-kickoff
+integration · **`salak query`** · watch mode · metrics or complexity scoring.
+
+Touching one of these is an anti-pattern, not initiative. Name it out loud instead.
+
+## Verify the repo
+
+```bash
+uv sync && uv run ruff check . && uv run mypy src tests && uv run pytest
+```
+
+## Conventions
+
+`src/salak/` layout · ruff + mypy strict · CI on 3.11 and 3.12 · `snake_case`
+functions · `PascalCase` classes · `SCREAMING_SNAKE_CASE` diagnostic codes · full
+type hints · `LanguageAdapter` is a `typing.Protocol` · Conventional Commits with
+the phase as scope, e.g. `feat(v0.1): emit files section`.
+
+Talk to the owner in **Bahasa Indonesia**. Write every file, comment, commit
+message and document in **English**.

salak-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,96 @@
+# TASK-009 — lint, type-check and tests on Python 3.11 and 3.12.
+#
+# Three things here are deliberate rather than boilerplate:
+#
+# * **The steps are ordered and none carries `continue-on-error`.** A failing `ruff`
+#   or `mypy` fails the job and stops it before the tests run, which is DoD item 3.
+#   Nothing here may be softened into a warning.
+# * **mypy is given the matrix version explicitly.** `pyproject.toml` pins
+#   `python_version = "3.11"`, so without `--python-version` the 3.12 leg would run the
+#   *same* type-check as the 3.11 leg and the matrix would only be varying the pytest
+#   runtime. The CLI flag overrides the config, so both legs genuinely differ.
+# * **`pytest` exit code 5 is accepted, loudly.** See the test step.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Read-only by default. The security track (P5, TASK-099…102) treats an
+# over-permissioned workflow token as a finding, and this is the cheap moment to
+# get it right.
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: py${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      # Both legs always report. Cancelling 3.12 because 3.11 failed hides
+      # version-specific breakage, which is the only thing a matrix exists to find.
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Sync dependencies
+        # `--frozen` refuses to update uv.lock. A pyproject.toml edited without
+        # re-locking then fails here rather than silently resolving to something no
+        # developer has ever run.
+        run: uv sync --frozen --python ${{ matrix.python-version }}
+
+      - name: Install Node
+        # Phase 2 is entirely about language servers, so a CI that cannot run them cannot
+        # verify the phase at all. `npm ci` installs the exact pins in package.json —
+        # pyright, typescript-language-server, and typescript 5.9.3 as a CEILING (D15).
+        # The postinstall hook fails the job if `typescript/lib/tsserver.js` is missing,
+        # which is the whole of that ceiling's compatibility test.
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Install language servers (npm ci)
+        run: npm ci --no-audit --no-fund
+
+      - name: Lint (ruff)
+        run: uv run ruff check .
+
+      - name: Type-check (mypy, strict, src + tests)
+        run: uv run mypy --python-version ${{ matrix.python-version }}
+
+      - name: Test (pytest)
+        shell: bash
+        # `pytest` exits **5** when it collects no tests, and an exit-5 CI step is red.
+        # TASK-009's Definition of Done is literally "CI green on an empty test suite",
+        # so the condition is handled explicitly instead of being left to depend on the
+        # suite happening to be non-empty (gap analysis G1).
+        #
+        # Exit 5 means specifically "no tests collected" — a collection *error* exits 2
+        # or 3 and still fails the job — so this cannot mask a broken test module. It
+        # can mask a mis-set `testpaths`, which is why it annotates the run instead of
+        # passing in silence.
+        run: |
+          set +e
+          uv run pytest
+          code=$?
+          set -e
+          if [ "$code" -eq 5 ]; then
+            echo "::warning title=Empty test suite::pytest collected no tests (exit 5). Treated as a pass per TASK-009 DoD, but a non-empty suite is expected from TASK-010 onward."
+            exit 0
+          fi
+          exit "$code"

salak-0.1.0/.github/workflows/clean-machine.yml

@@ -0,0 +1,138 @@
+# TASK-095 — clean-machine installation acceptance test. SDD §6 v1.0 done criterion.
+#
+# §2.1 requires two Node-based language servers that PyPI cannot install, so
+# "installable on a clean machine" is satisfiable in a state where those servers are
+# absent entirely — this task exists to force that gap into the open rather than let
+# "clean machine" mean whatever the person running the check happens to have installed.
+#
+# **D54 (project-memory/01-decision-register.md): "clean machine" is defined as three
+# states, all three required to pass, none more authoritative than another:**
+#   1. No Node.js at all
+#   2. Node.js present, no language server installed
+#   3. Node.js present, both pinned language servers installed (`npm ci`, same shape
+#      `ci.yml` already uses)
+#
+# **What "capability difference" means today, proven rather than asserted**: after
+# K15/D43, no module under `salak.resolution` imports `salak.lsp`, so a language
+# server's presence changes nothing about what a scan emits. The final step proves
+# this concretely — all three states scan the identical fixture and their graphs must
+# be byte-identical except `generated_at`, checked with `salak diff` itself.
+#
+# **One job, not three-plus-a-comparison.** The first version of this workflow used
+# four jobs (one per state, one to compare) and passed graphs between them via
+# `actions/upload-artifact`/`download-artifact`. Real run, 2026-08-26: every state's
+# own `doctor`/`scan` step passed, but every `upload-artifact` step failed —
+# "Artifact storage quota has been hit" — an account-level GitHub Actions storage
+# limit, not a bug in the check itself. Node's presence and installed servers are
+# runtime, not install-time, facts, so all three states can be exercised sequentially
+# against **one** build and **one** install in **one** container's filesystem, with the
+# three graphs compared as local files — no artifact transfer needed at all.
+
+name: Clean-machine matrix
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: clean-machine-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  clean-machine:
+    name: Three states, one container, no artifacts
+    runs-on: ubuntu-latest
+    # Debian-based, so Node can be installed with apt partway through — and, until
+    # that step runs, genuinely has no Node anywhere on the image (checked, not
+    # trusted, in "State 1" below).
+    container: python:3.11-slim
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        run: pip install --no-cache-dir uv
+
+      - name: Sync and build once — every state below installs the same wheel
+        run: |
+          uv sync --frozen --python 3.11
+          uv build
+
+      - name: Install salak from the built wheel into a fresh venv
+        run: |
+          uv venv /tmp/clean-venv --python 3.11
+          uv pip install --python /tmp/clean-venv/bin/python dist/*.whl
+
+      - name: Make a tiny fixture, scanned identically in every state below
+        run: |
+          mkdir -p /tmp/fixture
+          printf 'export const x = 1;\n' > /tmp/fixture/a.ts
+
+      # ----------------------------------------------------------------- State 1
+
+      - name: "State 1: confirm no Node, then doctor + scan"
+        run: |
+          if command -v node >/dev/null 2>&1; then
+            echo "::error::this image already has Node on PATH; State 1 is not testing what it claims to"
+            exit 1
+          fi
+          /tmp/clean-venv/bin/salak doctor | tee doctor-1.txt
+          grep -q "Node.js: NOT FOUND" doctor-1.txt
+          grep -q "python: ok" doctor-1.txt
+          grep -q "typescript: ok" doctor-1.txt
+          /tmp/clean-venv/bin/salak scan /tmp/fixture --out "$PWD/graph-1-no-node.json" --no-lsp
+
+      # ----------------------------------------------------------------- State 2
+
+      - name: Install Node (no language servers yet)
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends nodejs npm >/dev/null
+
+      - name: "State 2: Node present, no servers — doctor + scan"
+        run: |
+          command -v node >/dev/null 2>&1 || { echo "::error::Node install did not put node on PATH"; exit 1; }
+          /tmp/clean-venv/bin/salak doctor | tee doctor-2.txt
+          grep -q "Node.js: found" doctor-2.txt
+          grep -q "pyright: not detected" doctor-2.txt
+          grep -q "typescript-language-server: not detected" doctor-2.txt
+          grep -q "python: ok" doctor-2.txt
+          grep -q "typescript: ok" doctor-2.txt
+          /tmp/clean-venv/bin/salak scan /tmp/fixture --out "$PWD/graph-2-node-no-servers.json" --no-lsp
+
+      # ----------------------------------------------------------------- State 3
+
+      - name: Install language servers (npm ci)
+        run: npm ci --no-audit --no-fund
+
+      - name: "State 3: Node present, both servers — doctor + scan"
+        run: |
+          /tmp/clean-venv/bin/salak doctor | tee doctor-3.txt
+          grep -q "Node.js: found" doctor-3.txt
+          grep -q "pyright " doctor-3.txt
+          grep -q "typescript-language-server:" doctor-3.txt
+          grep -q "python: ok" doctor-3.txt
+          grep -q "typescript: ok" doctor-3.txt
+          /tmp/clean-venv/bin/salak scan /tmp/fixture --out "$PWD/graph-3-node-with-servers.json" --no-lsp
+
+      # -------------------------------------------------------- Prove parity
+
+      - name: All three states must produce an identical graph
+        # The tool verifying its own DoD claim: `salak diff` already ignores
+        # `generated_at` (its whole reason to exist), so "empty" here means
+        # genuinely identical, not merely eyeballed-similar.
+        run: |
+          set -e
+          for pair in \
+            "graph-1-no-node.json graph-2-node-no-servers.json" \
+            "graph-1-no-node.json graph-3-node-with-servers.json" \
+            "graph-2-node-no-servers.json graph-3-node-with-servers.json"; do
+            echo "::group::diff $pair"
+            /tmp/clean-venv/bin/salak diff $pair
+            echo "::endgroup::"
+          done
+          echo "All three clean-machine states produced an identical graph."

salak-0.1.0/.github/workflows/publish-testpypi.yml

@@ -0,0 +1,71 @@
+# TASK-086 — TestPyPI publish rehearsal. SDD §5, WBS §4.1.
+#
+# Manually triggered (`workflow_dispatch`), not tag-triggered — a TestPyPI rehearsal is
+# something the owner runs deliberately before cutting a real release, as many times as
+# needed, without it consuming a real version tag. Give it whatever version string you
+# want to test with; TestPyPI's index is separate from PyPI's, so nothing here can
+# collide with a real published version.
+#
+# Requires the same one-time PyPI Trusted Publishing setup as `release.yml`, done on
+# **test.pypi.org** specifically (a separate account/project registration from the real
+# pypi.org one) — see `docs/RELEASING.md`.
+
+name: Publish to TestPyPI
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version string to build and publish (e.g. 0.1.0.dev1) — TestPyPI only, does not need to match any git tag"
+        required: true
+        type: string
+
+jobs:
+  publish-testpypi:
+    name: Build and publish to TestPyPI
+    runs-on: ubuntu-latest
+    environment: testpypi
+    # Job-level `permissions:` REPLACES the workflow-level block for this job, it does
+    # not merge with it — a real bug found running this workflow for the first time
+    # (2026-08-26): `contents: read` lived only at the workflow level, so the job's
+    # own `permissions: {id-token: write}` silently dropped it, and actions/checkout
+    # got a token with no read access to the repo at all ("repository ... not found").
+    # Both permissions this job actually needs are listed here, explicitly, together.
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Rewrite version for this rehearsal
+        # Not committed back, same as release.yml — this build never needs to match
+        # anything the repository's own history records.
+        run: |
+          version="${{ inputs.version }}"
+          sed -i "s/^version = \".*\"/version = \"${version}\"/" pyproject.toml
+          sed -i "s/^__version__ = \".*\"/__version__ = \"${version}\"/" src/salak/__init__.py
+          grep -q "version = \"${version}\"" pyproject.toml
+          grep -q "__version__ = \"${version}\"" src/salak/__init__.py
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Sync dependencies
+        run: uv sync --python "3.11"
+
+      - name: Verify (lint, type-check, packaging + wheel-install tests)
+        run: |
+          uv run ruff check .
+          uv run mypy src tests
+          uv run pytest tests/test_cli_version.py tests/test_packaging_metadata.py tests/test_wheel_installation.py -q
+
+      - name: Build
+        run: uv build
+
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/

salak-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,96 @@
+# TASK-087 — release automation from a git tag. SDD §5, WBS Sec4.1.
+#
+# Triggered by pushing a tag matching `v*` (e.g. `v1.0.0`). Three things here are
+# deliberate rather than boilerplate:
+#
+# * **The version is derived from the tag, not typed twice.** `pyproject.toml` and
+#   `src/salak/__init__.py` both carry a version string
+#   (`tests/test_cli_version.py::test_package_version_matches_pyprojects_declared_version`
+#   already guards the two staying equal to *each other*); this job additionally makes
+#   *the tag itself* the source of truth by rewriting both to match it before building,
+#   so "version string matches the release tag" (TASK-087 DoD item 3) holds by
+#   construction rather than by someone remembering to bump two files before tagging.
+#   D53 records why this is a workflow-time rewrite rather than adopting a VCS-derived
+#   dynamic-versioning build backend (`hatch-vcs`) — see `project-memory/01-decision-register.md`.
+# * **Full verification runs against the *retagged* tree**, not the tree as committed —
+#   a version string is part of what ships, and a bug the bump script itself introduces
+#   (a malformed version, a partial rewrite) must fail the job before anything is
+#   published, the same way a broken feature would.
+# * **Publishing uses PyPI Trusted Publishing (OIDC)**, not a stored API token. No
+#   long-lived secret to leak or rotate; scoped by PyPI to exactly this repository and
+#   workflow file. Requires a one-time setup on pypi.org (see `docs/RELEASING.md`)
+#   before the first real run — until that's done, this job's publish step fails with a
+#   clear PyPI-side error, not a silent no-op.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    name: Build, verify and publish
+    runs-on: ubuntu-latest
+    environment: pypi
+    # Job-level `permissions:` REPLACES the workflow-level block for this job, it does
+    # not merge with it — a real bug found running publish-testpypi.yml's identical
+    # shape for the first time (2026-08-26): `contents: read` lived only at the
+    # workflow level, so the job's own `permissions: {id-token: write}` (needed for
+    # Trusted Publishing's OIDC exchange) silently dropped it, and actions/checkout
+    # got a token with no read access to the repo at all ("repository ... not found").
+    # Both permissions this job actually needs are listed here, explicitly, together.
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Derive version from the tag
+        id: version
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          version="${tag#v}"
+          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc|\.dev)[0-9]+)?$ ]]; then
+            echo "::error::tag '$tag' does not look like vMAJOR.MINOR.PATCH, optionally suffixed a[N]/b[N]/rc[N]/.dev[N] (PEP 440)"
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Rewrite version to match the tag
+        # Not committed back — this mutates the ephemeral checkout only, so the
+        # build artifact carries the tag's version without the repository ever
+        # holding a second, potentially-stale copy of it outside a release.
+        # Plain `sed`, deliberately — a shell one-liner is easier to verify at a
+        # glance than a heredoc'd Python string embedded inside a shell step.
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          sed -i "s/^version = \".*\"/version = \"${version}\"/" pyproject.toml
+          sed -i "s/^__version__ = \".*\"/__version__ = \"${version}\"/" src/salak/__init__.py
+          grep -q "version = \"${version}\"" pyproject.toml
+          grep -q "__version__ = \"${version}\"" src/salak/__init__.py
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Sync dependencies
+        run: uv sync --python "3.11"
+
+      - name: Verify the retagged tree (lint, type-check, package-metadata + version tests)
+        # Full pytest is CI's job (already green on the commit this tag points at);
+        # here it's the version-sync and packaging tests specifically that matter,
+        # since those are what the rewrite step above could break.
+        run: |
+          uv run ruff check .
+          uv run mypy src tests
+          uv run pytest tests/test_cli_version.py tests/test_packaging_metadata.py tests/test_wheel_installation.py -q
+
+      - name: Build
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

salak-0.1.0/.gitignore

@@ -0,0 +1,36 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+dist/
+build/
+
+# Tooling caches
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+
+# Editors / OS
+.idea/
+.vscode/
+.DS_Store
+
+# Spike 0 raw evidence — local only. Finding G3.
+# The 40 log files enumerate the internal structure of jeruk-ai and mangga-pa: route
+# names, admin pages, auth flows, module layout, and the absolute paths of the machine
+# they were measured on. No secret *values* (verified), but this package is destined
+# for PyPI with a public GitHub homepage, and publishing another project's file
+# inventory is cheap to prevent and impossible to undo. The findings that cite them
+# stay tracked; the logs stay on disk, uncommitted, and `README.md` in that directory
+# says so.
+project-memory/spike-0/logs/
+
+# NOTE: project-memory/repo-graph.json is NOT ignored.
+# It is the artifact this tool exists to produce, and SDD §9 Q2 decided it is
+# committed to git for v0.1 (1.08 MB measured, five times under the threshold).
+
+# Language servers for the Phase 2 tests. Pinned in package.json, never committed:
+# they are ~100 MB of platform-specific JavaScript, and `npm ci` reproduces them exactly.
+node_modules/