Add publish command

core/Cargo.toml

@@ -45,7 +45,7 @@ log = { version = "0.4.29", default-features = false }
 pubgrub = { version = "0.3.0", default-features = false }
 # partialzip = { version = "5.0.0", default-features = false, optional = true }
 pyo3 = { version = "0.28.2", default-features = false, features = ["macros", "chrono", "indexmap"], optional = true }
-reqwest-middleware = { version = "0.5.1" }
+reqwest-middleware = { version = "0.5.1", features = ["multipart"] }
 semver = { version = "1.0.27", features = ["serde"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.149", default-features = false, features = ["preserve_order"] }
@@ -67,7 +67,7 @@ tokio = { version = "1.50.0", default-features = false, features = ["rt", "io-ut
 bytes = { version = "1.11.1", default-features = false }
 toml_edit = { version = "0.25.4", features = ["serde"] }
 globset = { version = "0.4.18", default-features = false }
-reqwest = { version = "0.13.2", optional = true, features = ["rustls", "stream"] }
+reqwest = { version = "0.13.2", optional = true, features = ["rustls", "stream", "multipart"] }
 dunce = "1.0.5"
 
 [dev-dependencies]

core/src/auth.rs

@@ -416,6 +416,32 @@ pub type StandardHTTPAuthentication = RestrictAuthentication<
     Unauthenticated,
 >;
 
+impl StandardHTTPAuthentication {
+    /// Extracts the bearer tokens from the configured credential set into a URL-glob map
+    /// suitable for driving publish-time credential selection. Basic-auth entries are
+    /// dropped, since publish only supports bearer authentication.
+    pub fn try_into_publish_bearer_auth_map(
+        self,
+    ) -> Result<GlobMap<ForceBearerAuth>, globset::Error> {
+        let mut partial = GlobMapBuilder::new();
+
+        // `GlobMap` stores keys and values in parallel vectors; consume `self` so we
+        // can move bearer tokens into a publish-only map without cloning secrets.
+        for (key, sequence_auth) in self
+            .restricted
+            .keys
+            .into_iter()
+            .zip(self.restricted.values.into_iter())
+        {
+            if let StandardInnerAuthentication::BearerAuth(inner) = sequence_auth.lower {
+                partial.add(key, inner);
+            }
+        }
+
+        partial.build()
+    }
+}
+
 /// Utility to simplify construction of `StandardHTTPAuthentication`
 #[derive(Debug, Default, Clone)]
 pub struct StandardHTTPAuthenticationBuilder {

core/src/commands/build.rs

@@ -1,4 +1,4 @@
-use camino::Utf8Path;
+use camino::{Utf8Path, Utf8PathBuf};
 use thiserror::Error;
 
 use crate::{
@@ -209,6 +209,19 @@ impl<ProjectReadError: ErrorBound> From<IntoKparError<LocalSrcError>>
     }
 }
 
+pub fn default_kpar_path<Pr: ProjectRead>(
+    project: &Pr,
+    workspace: Option<&Workspace>,
+    project_path: &Utf8Path,
+) -> Result<Utf8PathBuf, KParBuildError<Pr::Error>> {
+    let mut path = workspace
+        .map(Workspace::root_path)
+        .unwrap_or(project_path)
+        .join("output");
+    path.push(default_kpar_file_name(project)?);
+    Ok(path)
+}
+
 pub fn default_kpar_file_name<Pr: ProjectRead>(
     project: &Pr,
 ) -> Result<String, KParBuildError<Pr::Error>> {

core/src/commands/mod.rs

@@ -10,6 +10,8 @@ pub mod include;
 pub mod info;
 pub mod init;
 pub mod lock;
+#[cfg(all(feature = "filesystem", feature = "networking"))]
+pub mod publish;
 pub mod remove;
 #[cfg(feature = "filesystem")]
 pub mod root;