pray-cli 1.12.1 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58da4ada7990f04bc2acf64b33bca633828a586f0918e1e3ff00cc50ddaeb7c5
-  data.tar.gz: ffc0855f9f9dc6466fe1260905b23d9ab74a5d96905562f8307f472dde851849
+  metadata.gz: cc753f65405f7052d882da07b3293b66c69e60cb26b8fe865919000323f2da1a
+  data.tar.gz: 91586f374cc5a677b0f5d2b722a4ba5da5912d8bd3664eac0ccd48b864889c65
 SHA512:
-  metadata.gz: 20cab97de54d753c4f7191f6a68469bbc7f4801e16999e7ca8ee13c0e1c5c27e53b8e0c436695a6f457cb169e7f4389d41407f9e56752cf7fed33c329b5fa94b
-  data.tar.gz: 109496e4410f4bc43f63af51a73ec3439f87348a5c1e94dbed712799416d8e47286360f97bb50e37aaad096f8c0957fc3e2a9a26840167fefe7ea1d6dbb66abd
+  metadata.gz: a84c2945dba3386f31dfdfc08d603ecee88d2be1e9898c20a993cd9dba9149ae4966b9cf9e02ba8c28905b7a1c81e2f5158bdf2eff8b36fe7f470e0bbd82ab6a
+  data.tar.gz: 48f107b5721d69c62b83db0f99247f9c4821eea42f85d3459cac09b7441badc3fa092965f877b1d3ae3fb0d38f391e8f65ae76cc21a6fd1595799dd2de0c6324

data/CHANGELOG.md

@@ -1,6 +1,15 @@
 # CHANGELOG
 
-## Unreleased
+## 1.14.0 (2026-09-14)
+
+- Keep an unchanged package version's artifact, first-publish time, and yank when `pray publish` runs again (RFC 0061).
+- Write `published_at` as UTC Unix seconds in registry and federation JSON.
+- Collapse trailing blank lines when composing so a composed file ends with a single newline, matching the other CLIs.
+- Order `symbols` before `render` in the canonical manifest JSON so `manifest_hash` matches the other CLIs.
+
+## 1.13.0 (2026-09-08)
+
+- Record and verify package upstream pins in `.prayspec` and `Prayfile.lock`. Refuse path-fork updates until this CLI can refresh the path tree safely (RFC 0114).
 
 ## 1.12.1 (2026-09-08)
 

data/lib/pray/cli/commands/workflow.rb

@@ -100,6 +100,8 @@ module Pray
           raise Error.manifest("package #{package} not found")
         end
       end
+      current = resolve_current_project(ResolveOptions.new(offline: offline))
+      Upstream.ensure_update_supported!(current.packages, package)
       install_command({locked: false, frozen: false, offline: offline, refresh: true})
     end
 

data/lib/pray/lockfile.rb

@@ -8,14 +8,15 @@ module Pray
   LockSource = Struct.new(:name, :kind, :url, :revision, :host_key_fingerprint)
   LockedPackage = Struct.new(
     :name, :version, :source, :path, :tree_hash, :artifact_hash, :artifact,
-    :exports, :dependencies, :signer_fingerprint
+    :exports, :dependencies, :signer_fingerprint, :upstream
   ) do
-    def initialize(exports: [], dependencies: [], signer_fingerprint: nil, source: nil, **kwargs)
-      super(**kwargs, exports: exports, dependencies: dependencies, signer_fingerprint: signer_fingerprint, source: source)
+    def initialize(exports: [], dependencies: [], signer_fingerprint: nil, source: nil, upstream: nil, **kwargs)
+      super(**kwargs, exports: exports, dependencies: dependencies, signer_fingerprint: signer_fingerprint, source: source, upstream: upstream)
     end
   end
 
   LockedTarget = Struct.new(:name, :outputs)
+  LockedUpstream = Struct.new(:name, :version, :source, :tree_hash, :artifact_hash, keyword_init: true)
   ManagedSpanRecord = Struct.new(
     :id, :target, :open_line, :close_line, :ideal_checksum, :package, :export,
     :source_checksum, :silenced
@@ -98,6 +99,7 @@ module Pray
       }
       hash["source"] = entry.source unless entry.source.nil?
       hash["signer_fingerprint"] = entry.signer_fingerprint if entry.signer_fingerprint
+      hash["upstream"] = Upstream.to_lock_hash(entry.upstream) if entry.upstream
       hash
     end
 
@@ -185,7 +187,8 @@ module Pray
             artifact: normalize_lockfile_artifact(project_root, package.artifact, package.root),
             exports: package.selected_exports,
             dependencies: package.spec.dependencies.map(&:name),
-            signer_fingerprint: package.signer_fingerprint
+            signer_fingerprint: package.signer_fingerprint,
+            upstream: package.upstream
           )
         end,
         target: manifest_targets.map { |target| LockedTarget.new(name: target.name, outputs: target.outputs) },
@@ -224,7 +227,8 @@ module Pray
             artifact: entry["artifact"],
             exports: entry["exports"] || [],
             dependencies: entry["dependencies"] || [],
-            signer_fingerprint: entry["signer_fingerprint"]
+            signer_fingerprint: entry["signer_fingerprint"],
+            upstream: Upstream.from_lock_hash(entry["upstream"])
           )
         end,
         target: Array(data["target"]).map { |entry| LockedTarget.new(name: entry["name"], outputs: entry["outputs"] || []) },

data/lib/pray/lockfile_serialize.rb

@@ -66,6 +66,25 @@ module Pray
       lines << "exports = #{format_string_array(entry.exports)}"
       lines << "dependencies = #{format_string_array(entry.dependencies)}"
       lines << "signer_fingerprint = #{format_string(entry.signer_fingerprint)}" if entry.signer_fingerprint
+      if entry.upstream
+        lines << ""
+        lines << "[package.upstream]"
+        append_scalars(
+          lines,
+          [
+            ["name", entry.upstream.name],
+            ["version", entry.upstream.version]
+          ].tap do |scalars|
+            scalars << ["source", entry.upstream.source] unless entry.upstream.source.nil?
+            scalars.concat(
+              [
+                ["tree_hash", entry.upstream.tree_hash],
+                ["artifact_hash", entry.upstream.artifact_hash]
+              ]
+            )
+          end
+        )
+      end
       lines
     end
 

data/lib/pray/manifest_json.rb

@@ -14,10 +14,10 @@ module Pray
         "sources" => manifest.sources.map { |source| source_fields(source) },
         "targets" => manifest.targets.map { |target| target_fields(target) },
         "packages" => manifest.packages.map { |package| package_fields(package) },
-        "local" => manifest.local.map { |entry| local_fields(entry) },
-        "render" => render_fields(manifest.render)
+        "local" => manifest.local.map { |entry| local_fields(entry) }
       }
       fields["symbols"] = manifest.symbols.sort.to_h unless manifest.symbols.empty?
+      fields["render"] = render_fields(manifest.render)
       fields
     end
 

data/lib/pray/package_spec.rb

@@ -9,17 +9,18 @@ module Pray
   PackageSkill = Struct.new(:path, :summary)
   PackageTemplate = Struct.new(:path, :summary)
   PackageDependency = Struct.new(:name, :constraint, :optional)
+  PackageUpstream = Struct.new(:name, :constraint, keyword_init: true)
 
   PackageSpec = Struct.new(
     :name, :version, :summary, :description, :authors, :license, :homepage,
     :source_code_uri, :changelog_uri, :prayfile_version, :files, :exports,
-    :skills, :templates, :adapters, :targets, :dependencies, :metadata
+    :skills, :templates, :adapters, :targets, :dependencies, :metadata, :upstream
   ) do
     def initialize(
       name: "", version: "", summary: nil, description: nil, authors: [], license: nil,
       homepage: nil, source_code_uri: nil, changelog_uri: nil, prayfile_version: nil,
       files: [], exports: {}, skills: {}, templates: {}, adapters: {}, targets: [],
-      dependencies: [], metadata: {}
+      dependencies: [], metadata: {}, upstream: nil
     )
       super
     end
@@ -90,6 +91,13 @@ module Pray
         )
       end
 
+      def parse_upstream(rest)
+        values, _keywords = parse_call(rest)
+        name = string_from_value(values.first)
+        constraint = values[1] ? string_from_value(values[1]) : "*"
+        PackageUpstream.new(name: name, constraint: constraint)
+      end
+
       def parse_exports(value)
         map = Literal.parse_literal_map(value)
         exports = {}
@@ -208,6 +216,10 @@ module Pray
           spec.dependencies << parse_dependency(Regexp.last_match(1), false)
         when /\Aspec\.add_optional_dependency (.+)\z/
           spec.dependencies << parse_dependency(Regexp.last_match(1), true)
+        when /\Aspec\.upstream (.+)\z/
+          raise Error.parse("prayspec", "upstream may only be declared once") if spec.upstream
+
+          spec.upstream = parse_upstream(Regexp.last_match(1))
         when /\Aspec\.(.+) = (.+)\z/
           apply_assignment(spec, Regexp.last_match(1).strip, Regexp.last_match(2).strip)
         else

data/lib/pray/publish.rb

@@ -20,13 +20,21 @@ module Pray
       package_names = index.packages.to_set
 
       project.packages.each do |package|
-        archive_bytes = Archive.build_package_archive_bytes(package)
         artifact_path = registry_artifact_path(package.declaration.name, package.spec.version)
-        artifact_output_path = File.join(root, artifact_path)
-        write_output_bytes(artifact_output_path, archive_bytes)
-
         metadata_path = registry_metadata_path(root, package.declaration.name)
         metadata = load_registry_package_metadata(metadata_path, package.declaration.name)
+        existing = metadata.versions.find { |entry| entry.version == package.spec.version }
+        stored_artifact = stored_package_artifact(root, artifact_path, package, existing)
+        if stored_artifact && stored_publish_matches?(
+          stored_artifact, package, signer, signer_fingerprint, existing
+        )
+          package_names << package.declaration.name
+          write_registry_package_metadata(metadata_path, metadata)
+          next
+        end
+
+        archive_bytes = Archive.build_package_archive_bytes(package)
+        write_output_bytes(File.join(root, artifact_path), archive_bytes)
         version_entry = published_registry_package_version(
           package,
           signer,
@@ -34,6 +42,7 @@ module Pray
           archive_bytes,
           artifact_path
         )
+        preserve_existing_publish_metadata(metadata, version_entry, stored_artifact)
         metadata.versions.reject! { |entry| entry.version == version_entry.version }
         metadata.versions << version_entry
         write_registry_package_metadata(metadata_path, metadata)
@@ -81,11 +90,50 @@ module Pray
         exports: package.spec.exports.keys,
         signer: signer,
         signer_fingerprint: signer_fingerprint,
-        published_at: Time.now.utc.iso8601,
+        published_at: Time.now.to_i,
         signature: Registry.registry_artifact_signature(archive_bytes, package.tree_hash, signer)
       )
     end
 
+    def stored_package_artifact(root, artifact_path, package, existing)
+      return unless existing&.artifact == artifact_path && existing.tree_hash == package.tree_hash
+
+      stored_path = File.join(root, artifact_path)
+      return unless File.file?(stored_path)
+
+      artifact_bytes = File.binread(stored_path)
+      return unless existing.artifact_hash == Hashing.sha256_prefixed(artifact_bytes)
+      return unless stored_prayspec_matches?(artifact_bytes, package.root)
+
+      artifact_bytes
+    end
+
+    def stored_publish_matches?(artifact_bytes, package, signer, signer_fingerprint, existing)
+      existing.signer == signer &&
+        existing.signer_fingerprint == signer_fingerprint &&
+        existing.signature == Registry.registry_artifact_signature(artifact_bytes, package.tree_hash, signer)
+    end
+
+    def stored_prayspec_matches?(artifact_bytes, package_root)
+      Dir.mktmpdir("pray-publish-check-") do |directory|
+        Archive.unpack_praypkg(artifact_bytes, directory)
+        stored_path = Resolve.find_prayspec_file(directory)
+        current_path = Resolve.find_prayspec_file(package_root)
+        File.basename(stored_path) == File.basename(current_path) &&
+          File.binread(stored_path) == File.binread(current_path)
+      end
+    rescue Error, SystemCallError
+      false
+    end
+
+    def preserve_existing_publish_metadata(metadata, version_entry, stored_artifact)
+      existing = metadata.versions.find { |entry| entry.version == version_entry.version }
+      return unless existing
+
+      version_entry.yanked = existing.yanked
+      version_entry.published_at = existing.published_at if stored_artifact
+    end
+
     def load_registry_index(root)
       path = File.join(root, "v1", "index.json")
       return RegistryIndex.new unless File.exist?(path)

data/lib/pray/registry.rb

@@ -5,6 +5,7 @@ require "net/http"
 require "uri"
 require "fileutils"
 require "pathname"
+require "time"
 require_relative "path_safety"
 require_relative "http_body"
 
@@ -145,11 +146,26 @@ module Pray
         exports: entry["exports"] || [],
         signer: entry["signer"],
         signer_fingerprint: entry["signer_fingerprint"],
-        published_at: entry["published_at"],
+        published_at: entry.key?("published_at") ? publish_timestamp_from_value(entry["published_at"]) : nil,
         signature: entry["signature"]
       )
     end
 
+    def publish_timestamp_from_value(value)
+      timestamp = case value
+      when Integer then value
+      when String
+        value.match?(/\A\d+\z/) ? value.to_i : Time.iso8601(value).to_i
+      end
+      unless timestamp&.between?(0, 253_402_300_799)
+        raise Error.integrity("registry published_at must be whole UTC Unix seconds")
+      end
+
+      timestamp
+    rescue ArgumentError
+      raise Error.integrity("registry published_at must be whole UTC Unix seconds")
+    end
+
     def select_package_version(metadata, constraint, preferred_version)
       if preferred_version
         version = metadata.versions.find { |entry| entry.version == preferred_version && !entry.yanked }

data/lib/pray/render_content.rb

@@ -27,7 +27,7 @@ module Pray
       end
 
       def finish
-        @content.sub(/\n\n+\z/, "\n")
+        @content.sub!(/\n\n+\z/, "\n")
         @content << "\n" unless @content.end_with?("\n")
         @content
       end

data/lib/pray/resolve.rb

@@ -13,7 +13,7 @@ module Pray
   ResolvedPackage = Struct.new(
     :declaration, :root, :spec, :tree_hash, :artifact_hash, :artifact,
     :selected_exports, :source_checksum, :export_bodies, :skill_files,
-    :signer_fingerprint, :registry_latest_version
+    :signer_fingerprint, :registry_latest_version, :upstream
   )
 
   ResolvedLocalFile = Struct.new(
@@ -75,7 +75,7 @@ module Pray
           user_config,
           declaration,
           lockfile_hints,
-          offline: options.offline
+          options: options
         )
         if seen[package.declaration.name]
           raise Error.resolution("duplicate package declaration: #{package.declaration.name}")
@@ -149,9 +149,10 @@ module Pray
         "Create the file or remove the entry from Prayfile, then run `pray install`."
     end
 
-    def resolve_package(project_root, sources, git_sources, user_config, declaration, lockfile, offline: false)
+    def resolve_package(project_root, sources, git_sources, user_config, declaration, lockfile, offline: false, options: nil)
+      options ||= ResolveOptions.new(offline: offline)
       root, registry_latest_version = resolve_package_root_with_metadata(
-        project_root, sources, git_sources, user_config, declaration, lockfile, offline: offline
+        project_root, sources, git_sources, user_config, declaration, lockfile, offline: options.offline
       )
       spec_path = find_prayspec_file(root)
       spec_text = File.read(spec_path)
@@ -185,7 +186,10 @@ module Pray
         export_bodies: export_bodies,
         skill_files: skill_files,
         signer_fingerprint: nil,
-        registry_latest_version: registry_latest_version
+        registry_latest_version: registry_latest_version,
+        upstream: Upstream.lock_path(
+          project_root, sources, git_sources, user_config, declaration, spec, lockfile, options
+        )
       )
     end
 

data/lib/pray/serve_federation.rb

@@ -34,7 +34,7 @@ module Pray
         )
         next if metadata.versions.empty?
 
-        updated_at = metadata.versions.map { |version| version.published_at.to_s }.max || "0"
+        updated_at = (metadata.versions.filter_map(&:published_at).max || 0).to_s
         {
           "name" => name,
           "updated_at" => updated_at,
@@ -57,7 +57,7 @@ module Pray
       metadata = Publish.load_registry_package_metadata(metadata_path, name)
       body = {
         "name" => metadata.name,
-        "updated_at" => metadata.versions.map { |version| version.published_at.to_s }.max || "0",
+        "updated_at" => (metadata.versions.filter_map(&:published_at).max || 0).to_s,
         "versions" => metadata.versions.map { |version| transport_version(version) }
       }
       Serve.ok_response("application/json", JSON.pretty_generate(body))
@@ -78,9 +78,9 @@ module Pray
         "tree_hash" => version.tree_hash.to_s,
         "yanked" => version.yanked,
         "targets" => version.targets,
-        "exports" => version.exports,
-        "published_at" => version.published_at.to_s
+        "exports" => version.exports
       }
+      hash["published_at"] = version.published_at if version.published_at
       if version.signer || version.signer_fingerprint
         hash["publisher"] = {
           "id" => version.signer.to_s,

data/lib/pray/upstream.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module Pray
+  module Upstream
+    module_function
+
+    def ensure_update_supported!(packages, selected = nil)
+      unsupported = packages.find do |package|
+        package.declaration.path && package.spec.upstream &&
+          (selected.nil? || package.declaration.name == selected)
+      end
+      return unless unsupported
+
+      raise Error.unsupported(
+        "this installation cannot refresh upstream package #{unsupported.declaration.name}; " \
+        "install pray with Cargo and retry"
+      )
+    end
+
+    def to_lock_hash(entry)
+      hash = {
+        "name" => entry.name,
+        "version" => entry.version,
+        "tree_hash" => entry.tree_hash,
+        "artifact_hash" => entry.artifact_hash
+      }
+      hash["source"] = entry.source unless entry.source.nil?
+      hash
+    end
+
+    def from_lock_hash(entry)
+      return nil if entry.nil?
+
+      LockedUpstream.new(
+        name: entry["name"],
+        version: entry["version"],
+        source: entry["source"],
+        tree_hash: entry["tree_hash"],
+        artifact_hash: entry["artifact_hash"]
+      )
+    end
+
+    def lock_path(project_root, sources, git_sources, user_config, declaration, spec, lockfile, options)
+      return nil unless spec.upstream
+      if spec.name == spec.upstream.name
+        raise Error.resolution("package #{spec.name} cannot use itself as upstream")
+      end
+      return nil unless declaration.path
+
+      refresh = options.ignore_locked_versions || options.unlocked_packages.include?(declaration.name)
+      locked = lockfile&.package&.find { |entry| entry.name == declaration.name }&.upstream
+      name, constraint, source = resolution_input(declaration, spec, sources, locked, refresh)
+      resolved = Resolve.resolve_package(
+        project_root,
+        sources,
+        git_sources,
+        user_config,
+        ManifestPackage.new(
+          name: name,
+          constraint: constraint,
+          source: source
+        ),
+        lockfile,
+        options: options
+      )
+      resolved_upstream = LockedUpstream.new(
+        name: name,
+        version: resolved.spec.version,
+        source: source,
+        tree_hash: resolved.tree_hash,
+        artifact_hash: resolved.artifact_hash
+      )
+      ensure_locked_match!(locked, resolved_upstream) if !refresh && locked
+      resolved_upstream
+    end
+
+    def resolution_input(declaration, spec, sources, locked, refresh)
+      if locked && !refresh
+        if locked.name != spec.upstream.name
+          raise Error.integrity(
+            "locked upstream name mismatch for #{declaration.name}: " \
+            "expected #{locked.name}, found #{spec.upstream.name}"
+          )
+        end
+        return [locked.name, "= #{locked.version}", locked.source]
+      end
+
+      name = spec.upstream.name
+      source = ResolveSource.implied_source_name(ManifestPackage.new(name: name), sources)
+      [name, spec.upstream.constraint, source]
+    end
+
+    def ensure_locked_match!(locked, resolved)
+      if locked.name != resolved.name || locked.version != resolved.version
+        raise Error.integrity("locked upstream identity mismatch")
+      end
+      raise Error.integrity("locked upstream source mismatch") if locked.source != resolved.source
+      raise Error.integrity("locked upstream tree hash mismatch") if locked.tree_hash != resolved.tree_hash
+      if locked.artifact_hash != resolved.artifact_hash
+        raise Error.integrity("locked upstream artifact hash mismatch")
+      end
+    end
+  end
+end

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.12.1"
-  GENERATED_BY = "pray 1.12.1"
+  VERSION = "1.14.0"
+  GENERATED_BY = "pray 1.14.0"
 end

data/lib/pray.rb

@@ -24,6 +24,7 @@ require_relative "pray/resolve_exports"
 require_relative "pray/invocation"
 require_relative "pray/git_refresh"
 require_relative "pray/resolve"
+require_relative "pray/upstream"
 require_relative "pray/compose_dest"
 require_relative "pray/render_patch"
 require_relative "pray/render"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.12.1
+  version: 1.14.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -180,6 +180,7 @@ files:
 - lib/pray/trust.rb
 - lib/pray/trust_feed.rb
 - lib/pray/trust_ops.rb
+- lib/pray/upstream.rb
 - lib/pray/verify.rb
 - lib/pray/verify_position.rb
 - lib/pray/verify_provisioned.rb