pray-cli 1.15.0 → 1.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4754a8028d48136e6617f016890123bddb43a4fe27e87a05cc0da63ee5a22106
-  data.tar.gz: 5293f312b5cf2b5adb17d2955b21c447aa7ec1e91b374636b475eef30ad68770
+  metadata.gz: 5950b63f50e919bd5864874919afde95413ed095954046604d570d4c3daf090a
+  data.tar.gz: 82056f753f0d244afd54de70b7528d1e5d98b0c67f0da18538eb5d906986f12b
 SHA512:
-  metadata.gz: 4905aa110a4304e404dfe10e763ec4dee9c30e158659a2390e1af4e9be6aaf07e4cfb909c56023c7c622fdfb4689c250cdb40a632596f4033492bb1cbc7ecdb6
-  data.tar.gz: 59a29e48784dd55363e8c2f63683fccc388029f4dbd18599a44f8efedb6b939e123e7203f96b1bc751edf2dbed8f49f30ca40842b3d13bdb3304a4d2a6e6e129
+  metadata.gz: e3289cc2a08751a1358c37ddfb692d042c2d522374b02ed370dd25e703f5c5fe3be66996bbd008a7e6dfbe26a9ea6b278b87f640035a55a235ef7e1ed1d00967
+  data.tar.gz: a54b4dbed546b3f301d42692033552c3878b2281f25fee70e647e02634c19541a7440542bddbade45619a2e6dd4cac8bcefc05ff89b035645195ce90a3bffad6

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # CHANGELOG
 
+## 1.16.0 (2026-09-15)
+
+- Rewrite a two-component pessimistic Prayfile pin on `pray update --latest` (`~> 2.2` to `~> 2.4` when registry latest is 2.4.0), matching the Rust and TypeScript CLIs. Install a newer version that the current constraint already allows.
+- Resolve a local `.praypkg` from `tarball:`, including offline when the archive is on disk.
+- Refuse two-package dependency cycles during resolve, matching the Rust CLI.
+- Check dest files against `Prayfile.lock` managed spans without resolving packages (`inspect_locked_destinations`, RFC 0106).
+
 ## 1.15.0 (2026-09-15)
 
 - Refresh path-fork trees with `pray update` (RFC 0114). Rewrite `spec.upstream` pins with `pray update --latest` when the pin does not admit the latest upstream version. Rewrite Prayfile constraints with `pray update --latest` when they do not admit the registry latest version. `pray update --latest --dry-run` prints the planned rewrite and does not write.

data/lib/pray/constraint.rb

@@ -17,15 +17,28 @@ module Pray
     end
 
     def version_satisfies(version, constraint)
-      normalized = normalize_version_constraint(constraint)
-      return true if normalized.empty? || normalized == "*"
+      parts = constraint.to_s.split(",").map(&:strip).reject(&:empty?)
+      return true if parts.empty?
 
-      requirement = Gem::Requirement.new(normalized.strip)
-      requirement.satisfied_by?(Gem::Version.new(version))
+      parsed = Gem::Version.new(version)
+      parts.all? { |part| version_satisfies_one(parsed, part) }
     rescue ArgumentError => error
       raise Error.resolution(error.message)
     end
 
+    def version_satisfies_one(version, constraint)
+      normalized = normalize_version_constraint(constraint)
+      return true if normalized.empty? || normalized == "*"
+
+      requirement_text = if normalized.lstrip.start_with?("~>")
+        ruby_pessimistic_to_semver(normalized)
+      else
+        normalized.strip
+      end
+      clauses = requirement_text.split(",").map(&:strip).reject(&:empty?)
+      Gem::Requirement.new(*clauses).satisfied_by?(version)
+    end
+
     def pessimistic_constraint_for_version(version)
       parsed = Gem::Version.new(version)
       if parsed.segments[1].to_i.zero? && parsed.segments[2].to_i.zero?

data/lib/pray/dependency_graph.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Pray
+  module DependencyGraph
+    module_function
+
+    def find_dependency_cycle(edges)
+      visiting = {}
+      visited = {}
+      stack = []
+      edges.keys.sort.each do |name|
+        next if visited[name]
+
+        cycle = depth_first_search(name, edges, visiting, visited, stack)
+        return cycle if cycle
+      end
+      nil
+    end
+
+    def depth_first_search(name, edges, visiting, visited, stack)
+      return nil if visited[name]
+      if visiting[name]
+        start = stack.index(name)
+        return nil unless start
+
+        return stack[start..] + [name]
+      end
+
+      visiting[name] = true
+      stack << name
+      Array(edges[name]).each do |dependency|
+        next unless edges.key?(dependency)
+
+        cycle = depth_first_search(dependency, edges, visiting, visited, stack)
+        return cycle if cycle
+      end
+      stack.pop
+      visiting.delete(name)
+      visited[name] = true
+      nil
+    end
+  end
+end

data/lib/pray/git_sources.rb

@@ -16,8 +16,8 @@ module Pray
         next unless source.kind == "git"
 
         clone_url = source.url.delete_prefix("git+")
-        if local_filesystem_source?(clone_url) && !local_git_repo_path(clone_url)
-          source_root = local_git_source_root(clone_url)
+        if local_filesystem_source?(clone_url) && !local_git_repo_path(project_root, clone_url)
+          source_root = local_git_source_root(project_root, clone_url)
           if source_root
             checkouts[source.name] = GitSourceCheckout.new(
               cache_directory: source_root,
@@ -76,12 +76,8 @@ module Pray
       File.directory?(File.join(path, "v1", "packages"))
     end
 
-    def local_git_source_root(clone_url)
-      path = if clone_url.start_with?("file://")
-        clone_url.delete_prefix("file://")
-      else
-        clone_url
-      end
+    def local_git_source_root(project_root, clone_url)
+      path = clone_url_filesystem_path(project_root, clone_url)
       return nil unless File.exist?(path)
 
       discover_distribution_root(path)
@@ -136,12 +132,17 @@ module Pray
       clone_url.start_with?("file://") || Pathname.new(clone_url).absolute?
     end
 
-    def local_git_repo_path(clone_url)
-      path = clone_url.delete_prefix("file://")
+    def local_git_repo_path(project_root, clone_url)
+      path = clone_url_filesystem_path(project_root, clone_url)
       git_directory = File.join(path, ".git")
       File.directory?(git_directory) ? path : nil
     end
 
+    def clone_url_filesystem_path(project_root, clone_url)
+      path = clone_url.delete_prefix("file://")
+      Pathname.new(path).absolute? ? path : File.expand_path(path, project_root)
+    end
+
     def global_cache_root
       return ENV["PRAY_CACHE"] if ENV["PRAY_CACHE"]
       return File.join(ENV["PRAY_HOME"], "cache") if ENV["PRAY_HOME"]

data/lib/pray/materialize.rb

@@ -133,6 +133,7 @@ module Pray
   def resolve_project(...) = Resolve.resolve_project(...)
   def render_project(...) = Render.render_project(...)
   def inspect_project(...) = Verify.inspect_project(...)
+  def inspect_locked_destinations(...) = Verify.inspect_locked_destinations(...)
   def verify_project(...) = Verify.verify_project(...)
   def drift_project(...) = Verify.drift_project(...)
 end

data/lib/pray/registry.rb

@@ -8,6 +8,7 @@ require "pathname"
 require "time"
 require_relative "path_safety"
 require_relative "http_body"
+require_relative "registry_paths"
 
 module Pray
   RegistryPackageVersion = Struct.new(
@@ -40,6 +41,17 @@ module Pray
     module_function
 
     def resolve_registry_package_root(project_root, source_url, declaration, preferred_version: nil, offline: false)
+      if local_source?(source_url)
+        return resolve_local_registry_package_root(
+          project_root,
+          source_url,
+          RegistryPaths.local_registry_root(project_root, source_url),
+          declaration,
+          preferred_version: preferred_version,
+          offline: offline
+        )
+      end
+
       metadata = fetch_package_metadata(source_url, declaration.name)
       registry_latest_version = registry_latest_version_label(metadata)
       selected = select_package_version(metadata, declaration.constraint, preferred_version)

data/lib/pray/registry_paths.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require "pathname"
+
+module Pray
+  module RegistryPaths
+    module_function
+
+    def local_registry_root(project_root, source_url)
+      path = source_url.delete_prefix("file://")
+      Pathname.new(path).absolute? ? path : File.expand_path(path, project_root)
+    end
+  end
+end

data/lib/pray/resolve.rb

@@ -98,6 +98,8 @@ module Pray
       end
       raise Error.resolution(local_errors.join("\n")) unless local_errors.empty?
 
+      ResolveDeps.reject_dependency_cycles(packages)
+
       ResolvedProject.new(
         manifest_path: manifest_path,
         project_root: project_root,
@@ -152,7 +154,7 @@ module Pray
     def resolve_package(project_root, sources, git_sources, user_config, declaration, lockfile, offline: false, options: nil)
       options ||= ResolveOptions.new(offline: offline)
       root, registry_latest_version = resolve_package_root_with_metadata(
-        project_root, sources, git_sources, user_config, declaration, lockfile, offline: options.offline
+        project_root, sources, git_sources, user_config, declaration, lockfile, options
       )
       spec_path = find_prayspec_file(root)
       spec_text = File.read(spec_path)
@@ -194,12 +196,16 @@ module Pray
     end
 
     def resolve_package_root_with_metadata(
-      project_root, sources, git_sources, user_config, declaration, lockfile, offline: false
+      project_root, sources, git_sources, user_config, declaration, lockfile, options = nil
     )
+      options ||= ResolveOptions.new
+      offline = options.offline
+      preferred_version = options.preferred_lock_version(lockfile, declaration.name)
       if (local_path = user_config.local.package[declaration.name])
         return [File.expand_path(local_path, project_root), nil]
       end
       return [File.expand_path(declaration.path, project_root), nil] if declaration.path
+      return [ResolveTarball.package_root(project_root, declaration.tarball, offline: offline), nil] if declaration.tarball
       source_name = ResolveSource.implied_source_name(declaration, sources)
       if source_name
         source = sources[source_name]
@@ -212,7 +218,7 @@ module Pray
             "local:#{source_name}",
             source_root,
             declaration,
-            preferred_version: lockfile_preferred_version(lockfile, declaration.name),
+            preferred_version: preferred_version,
             offline: offline
           )
           return [resolved.root, resolved.registry_latest_version]
@@ -226,7 +232,7 @@ module Pray
             project_root,
             source.url,
             declaration,
-            preferred_version: lockfile_preferred_version(lockfile, declaration.name),
+            preferred_version: preferred_version,
             offline: offline
           )
           return [resolved.root, resolved.registry_latest_version]
@@ -245,7 +251,7 @@ module Pray
               source_key,
               distribution_root,
               declaration,
-              preferred_version: lockfile_preferred_version(lockfile, declaration.name),
+              preferred_version: preferred_version,
               offline: offline
             )
           rescue Error => error
@@ -262,9 +268,7 @@ module Pray
         end
       end
 
-      if declaration.git || declaration.tarball || declaration.oci
-        raise Error.unsupported("remote sources are not implemented yet")
-      end
+      raise Error.unsupported("remote sources are not implemented yet") if declaration.git || declaration.oci
 
       [File.join(project_root, declaration.name.tr("/", "-")), nil]
     end
@@ -273,12 +277,6 @@ module Pray
       resolve_package_root_with_metadata(project_root, sources, git_sources, user_config, declaration, lockfile).first
     end
 
-    def lockfile_preferred_version(lockfile, package_name)
-      return nil unless lockfile
-
-      lockfile.package.find { |entry| entry.name == package_name }&.version
-    end
-
     def resolve_local_file(project_root, declaration)
       path = File.join(project_root, declaration.path)
       unless File.exist?(path)

data/lib/pray/resolve_context.rb

@@ -15,5 +15,12 @@ module Pray
     )
       super
     end
+
+    def preferred_lock_version(lockfile, package_name)
+      return nil unless lockfile
+      return nil if ignore_locked_versions || unlocked_packages.include?(package_name)
+
+      lockfile.package.find { |entry| entry.name == package_name }&.version
+    end
   end
 end

data/lib/pray/resolve_deps.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Pray
+  module ResolveDeps
+    module_function
+
+    def reject_dependency_cycles(packages)
+      edges = {}
+      packages.each do |package|
+        edges[package.declaration.name] = package.spec.dependencies.map(&:name)
+      end
+      cycle = DependencyGraph.find_dependency_cycle(edges)
+      return unless cycle
+
+      raise Error.resolution("dependency cycle detected: #{cycle.join(" -> ")}")
+    end
+  end
+end

data/lib/pray/resolve_tarball.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "pathname"
+require_relative "archive_unpack"
+require_relative "hashing"
+require_relative "resource_limits"
+
+module Pray
+  module ResolveTarball
+    module_function
+
+    def package_root(project_root, tarball, offline:)
+      artifact_bytes = read_tarball_bytes(project_root, tarball, offline: offline)
+      if artifact_bytes.bytesize > ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES
+        raise Error.integrity(
+          "package archive exceeds #{ResourceLimits::MAX_ARCHIVE_TOTAL_BYTES} bytes"
+        )
+      end
+
+      cache_key = Hashing.sha256_prefixed(artifact_bytes).delete_prefix("sha256:")[0, 16]
+      cache_directory = File.join(project_root, ".pray", "cache", "tarball", cache_key)
+      if File.directory?(cache_directory)
+        begin
+          Resolve.find_prayspec_file(cache_directory)
+          return cache_directory
+        rescue Error
+          nil
+        end
+      end
+
+      staging_directory = "#{cache_directory}.staging"
+      FileUtils.rm_rf(staging_directory)
+      FileUtils.mkdir_p(staging_directory)
+      ArchiveUnpack.unpack_praypkg(artifact_bytes, staging_directory)
+      Resolve.find_prayspec_file(staging_directory)
+      FileUtils.mkdir_p(File.dirname(cache_directory))
+      FileUtils.rm_rf(cache_directory)
+      FileUtils.mv(staging_directory, cache_directory)
+      cache_directory
+    end
+
+    def read_tarball_bytes(project_root, tarball, offline:)
+      if tarball.start_with?("http://", "https://")
+        if offline
+          raise Error.resolution(
+            "tarball #{tarball} is not cached locally and offline mode is enabled"
+          )
+        end
+        return Registry.http_get(tarball)
+      end
+
+      path = local_tarball_path(project_root, tarball)
+      unless File.file?(path)
+        raise Error.resolution("tarball missing at #{path}")
+      end
+
+      File.binread(path)
+    end
+
+    def local_tarball_path(project_root, tarball)
+      path = tarball.delete_prefix("file://")
+      Pathname.new(path).absolute? ? path : File.expand_path(path, project_root)
+    end
+  end
+end

data/lib/pray/verify_locked_dest.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Pray
+  module Verify
+    module_function
+
+    def inspect_locked_destinations(project_root, lockfile)
+      report = VerificationReport.new
+      lockfile.managed_span.group_by(&:target).each do |target_path, spans|
+        absolute_path = File.join(project_root, target_path)
+        unless File.exist?(absolute_path)
+          report.findings << VerificationFinding.new(
+            kind: "verify_error",
+            message: "Rendered file `#{target_path}` is missing. Run `pray install` to generate it."
+          )
+          next
+        end
+
+        text = RenderDest.decode_utf8(
+          RenderDest.read_regular_bytes(absolute_path, target_path),
+          target_path
+        )
+        markers = marker_positions(text.lines(chomp: true))
+        spans.each do |span|
+          marker = markers[span.id]
+          unless marker
+            report.findings << VerificationFinding.new(
+              kind: "removed_prayer",
+              message: "`#{target_path}` is missing managed marker `#{span.id}` for `#{span.package}::#{span.export}`. Run `pray install` to restore the managed span."
+            )
+            next
+          end
+          next if marker[2] == span.ideal_checksum
+
+          report.findings << VerificationFinding.new(
+            kind: "custom_implementation",
+            message: "`#{target_path}` marker `#{span.id}` (`#{span.package}::#{span.export}`) was edited. Restore the managed block or run `pray install` to regenerate it."
+          )
+        end
+        find_orphan_marker_findings(spans, markers, target_path).each do |finding|
+          report.findings << finding
+        end
+      end
+      report
+    end
+  end
+end

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.15.0"
-  GENERATED_BY = "pray 1.15.0"
+  VERSION = "1.16.0"
+  GENERATED_BY = "pray 1.16.0"
 end

data/lib/pray.rb

@@ -21,6 +21,9 @@ require_relative "pray/environment"
 require_relative "pray/resolve_context"
 require_relative "pray/resolve_source"
 require_relative "pray/resolve_exports"
+require_relative "pray/dependency_graph"
+require_relative "pray/resolve_deps"
+require_relative "pray/resolve_tarball"
 require_relative "pray/invocation"
 require_relative "pray/git_refresh"
 require_relative "pray/resolve"
@@ -38,6 +41,7 @@ require_relative "pray/render_layout"
 require_relative "pray/verify_position"
 require_relative "pray/verify_provisioned"
 require_relative "pray/verify"
+require_relative "pray/verify_locked_dest"
 require_relative "pray/resource_limits"
 require_relative "pray/http_body"
 require_relative "pray/registry_install"
@@ -61,6 +65,6 @@ class << Pray
     :parse_package_spec, :parse_lockfile, :read_lockfile, :serialize_lockfile, :lockfile_hash,
     :write_lockfile, :write_lockfile_if_changed, :lockfiles_equivalent?, :build_lockfile,
     :resolve_project, :render_project, :materialize_project,
-    :inspect_project, :verify_project, :drift_project,
+    :inspect_project, :inspect_locked_destinations, :verify_project, :drift_project,
     :default_manifest_path, :default_lockfile_path, :project_root_from_manifest
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.15.0
+  version: 1.16.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -125,6 +125,7 @@ files:
 - lib/pray/confess.rb
 - lib/pray/config.rb
 - lib/pray/constraint.rb
+- lib/pray/dependency_graph.rb
 - lib/pray/destination.rb
 - lib/pray/dotenv.rb
 - lib/pray/environment.rb
@@ -156,6 +157,7 @@ files:
 - lib/pray/registry.rb
 - lib/pray/registry_install.rb
 - lib/pray/registry_integrity.rb
+- lib/pray/registry_paths.rb
 - lib/pray/render.rb
 - lib/pray/render_content.rb
 - lib/pray/render_dest.rb
@@ -163,8 +165,10 @@ files:
 - lib/pray/render_patch.rb
 - lib/pray/resolve.rb
 - lib/pray/resolve_context.rb
+- lib/pray/resolve_deps.rb
 - lib/pray/resolve_exports.rb
 - lib/pray/resolve_source.rb
+- lib/pray/resolve_tarball.rb
 - lib/pray/resource_limits.rb
 - lib/pray/serve.rb
 - lib/pray/serve_federation.rb
@@ -187,6 +191,7 @@ files:
 - lib/pray/upstream_merge.rb
 - lib/pray/upstream_refresh.rb
 - lib/pray/verify.rb
+- lib/pray/verify_locked_dest.rb
 - lib/pray/verify_position.rb
 - lib/pray/verify_provisioned.rb
 - lib/pray/version.rb