[icanhasmath]

state publish --build (encrypted private ingredients) had no practical way to set dependencies: --meta was read only after the wheel was built, and --edit overwrote whatever the meta file supplied. This adds dependency support from pyproject.toml, fixes --meta/--edit, and adds a command to export an ingredient's meta file for editing.

Changes

Dependencies from pyproject.toml (pyproject.go)

• [project].dependencies become runtime dependencies on language/python packages. Names are normalized in one inventory API call (new model.FetchNormalizedNames).
• Version ranges carry over; ~=1.16 → >=1.16,<2, ==4.2.* → >=4.2,<4.3.
• OS and Python version markers become conditions, matching how the platform encodes PyPI ingredients: sys_platform/platform_system/os_name == "nt" → kernel/Windows|Linux|Darwin; python_version/python_full_version → language/python. python_version is major.minor only, so > "3.9" becomes >=3.10 rather than >3.9 (which would match 3.9.18).
• Unsupported entries (or, !=, extra, platform_machine, URL references) are skipped with a notice pointing to --depend.
• The wheel's METADATA records them as Requires-Dist.
• Precedence: --depend* flags > meta file > pyproject.toml.

--meta with --build: the meta file is now read before the wheel is built, so its name/version/description are used (flags > meta file > pyproject.toml). Previously a meta file without a matching pyproject.toml failed with "missing metadata".

--edit fixes (publish.go)

• Dependencies and authors from the meta file are kept instead of being overwritten by the previous revision's.
• Inherited dependencies keep their type and conditions (both were dropped, so python's build/runtime/test entries collapsed into duplicates and Windows-only dependencies became unconditional).
• builder/private-builder is added only if not already inherited.
• Author/description changes on an existing version are rejected up front; the API error ("Cannot change authors or description without a new version") previously surfaced as Error received: <no value>.

New command: state export ingredient-meta <namespace>/<name>[@version] writes an existing ingredient's meta file (name, namespace, version, full dependency list with conditions) in the format --meta reads, to edit and pass back with state publish --edit --meta. Authors and description are omitted since they can't change on an existing version.

Crash fix: model.InventoryRequirementsToString dereferenced requirements without a version (present on some public ingredients' conditions, e.g. click). It now skips them.

Docs: internal/runners/publish/readme.md walks through publishing an encrypted ingredient with dependencies and editing them.

Testing

• Unit tests for requirement/marker translation, edit inheritance (dependencies, types, conditions), private-builder dedupe, and pyproject.toml parsing.
• TestPublishBuildEncrypted now includes a pyproject.toml dependency (six) that the package imports, so the test fails unless the dependency is published and installed. Not yet run under the integration-test account.
• Manually against the platform (private/ActiveStateBE/python/test-00N-greeting, with an org-key contract via env):
  • publish with pyproject.toml dependencies, then install and import: dependency installed, sentinel printed;
  • conditional dependencies on Linux / Python 3.11: Linux-only and python_version > "3.9" dependencies installed, Windows-only and < "3.11" not;
  • --edit with a meta file, --edit inheriting dependencies, and the export → edit → --edit --meta → export round trip;
  • a new version without --edit publishes; the same version without --edit is refused.

Not addressed

• On --edit, a meta file or pyproject.toml replaces the whole dependency list; there is no merge.
• Other publish API errors still render as Error received: <no value>; the real message is only in the log.

🤖 Generated with Claude Code

[MDrakos]

Requesting changes because --edit can now silently rewrite the wrong dependency list: one path drops the inherited deps, and the export round trip can land on a different version than the one exported.

Another note on tests: the new state export ingredient-meta command (FetchMeta), the up-front author/description rejection, and the nil-version crash fix in InventoryRequirementsToString have no tests, and the only pyproject-deps coverage is TestPublishBuildEncrypted, which per the description hasn't run yet. I think a unit test for the nil-requirement case and one for prepareEditRequest with a condition that carries requirements would be cheap and pin the crash fix.

2 inline comments below.

[MDrakos]

If every pyproject.toml entry gets skipped (say the only dep has a platform_machine marker), pyprojectDependencies returns nil, and on --edit this line wipes the deps prepareEditRequest just inherited. The publish then goes out with only builder/private-builder. That contradicts the readme ("If neither the meta file nor pyproject.toml lists any, the previous revision's dependencies are kept") and it's a regression from master, where --edit --build kept them.

Suggested change

	reqVars.Dependencies = deps
	if len(deps) > 0 {
	reqVars.Dependencies = deps
	}

[icanhasmath]

Good catch, fixed in 5dfae2a as suggested. The step now lives in applyPyprojectDependencies, which only replaces the dependencies when at least one survives translation. TestApplyPyprojectDependencies covers both no entries and all entries skipped, and fails with the guard removed.

Checked against the platform too: --edit --build on a version whose pyproject.toml only had a platform_machine dependency kept all of the previous revision's dependencies.

[MDrakos]

This points users at state publish --edit --meta without --build, but on that path the meta file's version is never used: Run only looks up params.Version, so it falls through to the latest version and prepareEditRequest overwrites reqVars.Version with it. So exporting mypkg@1.0.0 while 1.1.0 is latest and publishing it back rewrites 1.1.0's dependencies with 1.0.0's list, no error. imo the fix is in Run: look up cmp.Or(params.Version, reqVars.Version) instead of params.Version, so the exported version is what gets edited (the --build path already does this through generateEncryptedArtifact).

[icanhasmath]

Agreed, fixed in 5dfae2a. Right after the meta file is read, params.Version = cmp.Or(params.Version, reqVars.Version), so the meta file's version drives the lookup, the edit and the published version, with --version still taking precedence. Doing it on params rather than only in the lookup keeps everything downstream in agreement, the same way --build already worked. As a side effect, publishing a new version from a meta file without --build no longer fails with "already exists".

Checked your scenario on the platform: with 0.0.1 and 0.0.2 published, exporting @0.0.1, changing a dependency and running state publish --edit --meta (no --build) created revision 2 of 0.0.1. 0.0.2 was unchanged.

[icanhasmath]

@MDrakos thanks, both inline issues are fixed in 5dfae2a (details in the threads).

On tests:

• InventoryRequirementsToString nil case: TestInventoryRequirementsToString covers requirements missing a version or a comparator. It panics against master's implementation, as exporting click did.
• prepareEditRequest with a condition carrying requirements: TestPrepareEditRequestDependencies now inherits a language/python <3.11 condition and checks the requirement string survives.
• Author/description rejection: moved into checkEditKeepsIdentity, with TestCheckEditKeepsIdentity covering revisions, a new version via --edit, and a new ingredient.
• Inherited deps when all pyproject entries are skipped: TestApplyPyprojectDependencies (your first comment).

Still not covered by unit tests:

• FetchMeta / state export ingredient-meta only wraps platform calls. It's exercised by the platform runs above and in the description, but there's no mocked test.
• TestPublishBuildEncrypted still hasn't run under the integration-test account, so CI with the publish tag will be its first run.