pray-cli 1.13.0 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55a5d9fd2741f9ecd2d6d41c18acf6c7358b8bedb15e874d3686ce4ac88c7898
-  data.tar.gz: 489b7b073d8194c8f90fbbbab0b757804cc05a9ee309d7e596ce8a894ead1666
+  metadata.gz: cc753f65405f7052d882da07b3293b66c69e60cb26b8fe865919000323f2da1a
+  data.tar.gz: 91586f374cc5a677b0f5d2b722a4ba5da5912d8bd3664eac0ccd48b864889c65
 SHA512:
-  metadata.gz: 005a627e411946e40ae7b782feb62737b8d49a3eef411fda42ecd90c705c252414e504f231f94f24f5e687b035562233ba68f424abe49d2d541700b281493406
-  data.tar.gz: 80f998bf51a0fa32bf40d36b38f9a1101affdd988a0cb938e34b637a8225d3903d5c98bb217a88dab2ceb99849cd11957748d22d612e4f593f082f0d40122132
+  metadata.gz: a84c2945dba3386f31dfdfc08d603ecee88d2be1e9898c20a993cd9dba9149ae4966b9cf9e02ba8c28905b7a1c81e2f5158bdf2eff8b36fe7f470e0bbd82ab6a
+  data.tar.gz: 48f107b5721d69c62b83db0f99247f9c4821eea42f85d3459cac09b7441badc3fa092965f877b1d3ae3fb0d38f391e8f65ae76cc21a6fd1595799dd2de0c6324

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 # CHANGELOG
 
-## Unreleased
+## 1.14.0 (2026-09-14)
+
+- Keep an unchanged package version's artifact, first-publish time, and yank when `pray publish` runs again (RFC 0061).
+- Write `published_at` as UTC Unix seconds in registry and federation JSON.
+- Collapse trailing blank lines when composing so a composed file ends with a single newline, matching the other CLIs.
+- Order `symbols` before `render` in the canonical manifest JSON so `manifest_hash` matches the other CLIs.
 
 ## 1.13.0 (2026-09-08)
 

data/lib/pray/manifest_json.rb

@@ -14,10 +14,10 @@ module Pray
         "sources" => manifest.sources.map { |source| source_fields(source) },
         "targets" => manifest.targets.map { |target| target_fields(target) },
         "packages" => manifest.packages.map { |package| package_fields(package) },
-        "local" => manifest.local.map { |entry| local_fields(entry) },
-        "render" => render_fields(manifest.render)
+        "local" => manifest.local.map { |entry| local_fields(entry) }
       }
       fields["symbols"] = manifest.symbols.sort.to_h unless manifest.symbols.empty?
+      fields["render"] = render_fields(manifest.render)
       fields
     end
 

data/lib/pray/publish.rb

@@ -20,13 +20,21 @@ module Pray
       package_names = index.packages.to_set
 
       project.packages.each do |package|
-        archive_bytes = Archive.build_package_archive_bytes(package)
         artifact_path = registry_artifact_path(package.declaration.name, package.spec.version)
-        artifact_output_path = File.join(root, artifact_path)
-        write_output_bytes(artifact_output_path, archive_bytes)
-
         metadata_path = registry_metadata_path(root, package.declaration.name)
         metadata = load_registry_package_metadata(metadata_path, package.declaration.name)
+        existing = metadata.versions.find { |entry| entry.version == package.spec.version }
+        stored_artifact = stored_package_artifact(root, artifact_path, package, existing)
+        if stored_artifact && stored_publish_matches?(
+          stored_artifact, package, signer, signer_fingerprint, existing
+        )
+          package_names << package.declaration.name
+          write_registry_package_metadata(metadata_path, metadata)
+          next
+        end
+
+        archive_bytes = Archive.build_package_archive_bytes(package)
+        write_output_bytes(File.join(root, artifact_path), archive_bytes)
         version_entry = published_registry_package_version(
           package,
           signer,
@@ -34,6 +42,7 @@ module Pray
           archive_bytes,
           artifact_path
         )
+        preserve_existing_publish_metadata(metadata, version_entry, stored_artifact)
         metadata.versions.reject! { |entry| entry.version == version_entry.version }
         metadata.versions << version_entry
         write_registry_package_metadata(metadata_path, metadata)
@@ -81,11 +90,50 @@ module Pray
         exports: package.spec.exports.keys,
         signer: signer,
         signer_fingerprint: signer_fingerprint,
-        published_at: Time.now.utc.iso8601,
+        published_at: Time.now.to_i,
         signature: Registry.registry_artifact_signature(archive_bytes, package.tree_hash, signer)
       )
     end
 
+    def stored_package_artifact(root, artifact_path, package, existing)
+      return unless existing&.artifact == artifact_path && existing.tree_hash == package.tree_hash
+
+      stored_path = File.join(root, artifact_path)
+      return unless File.file?(stored_path)
+
+      artifact_bytes = File.binread(stored_path)
+      return unless existing.artifact_hash == Hashing.sha256_prefixed(artifact_bytes)
+      return unless stored_prayspec_matches?(artifact_bytes, package.root)
+
+      artifact_bytes
+    end
+
+    def stored_publish_matches?(artifact_bytes, package, signer, signer_fingerprint, existing)
+      existing.signer == signer &&
+        existing.signer_fingerprint == signer_fingerprint &&
+        existing.signature == Registry.registry_artifact_signature(artifact_bytes, package.tree_hash, signer)
+    end
+
+    def stored_prayspec_matches?(artifact_bytes, package_root)
+      Dir.mktmpdir("pray-publish-check-") do |directory|
+        Archive.unpack_praypkg(artifact_bytes, directory)
+        stored_path = Resolve.find_prayspec_file(directory)
+        current_path = Resolve.find_prayspec_file(package_root)
+        File.basename(stored_path) == File.basename(current_path) &&
+          File.binread(stored_path) == File.binread(current_path)
+      end
+    rescue Error, SystemCallError
+      false
+    end
+
+    def preserve_existing_publish_metadata(metadata, version_entry, stored_artifact)
+      existing = metadata.versions.find { |entry| entry.version == version_entry.version }
+      return unless existing
+
+      version_entry.yanked = existing.yanked
+      version_entry.published_at = existing.published_at if stored_artifact
+    end
+
     def load_registry_index(root)
       path = File.join(root, "v1", "index.json")
       return RegistryIndex.new unless File.exist?(path)

data/lib/pray/registry.rb

@@ -5,6 +5,7 @@ require "net/http"
 require "uri"
 require "fileutils"
 require "pathname"
+require "time"
 require_relative "path_safety"
 require_relative "http_body"
 
@@ -145,11 +146,26 @@ module Pray
         exports: entry["exports"] || [],
         signer: entry["signer"],
         signer_fingerprint: entry["signer_fingerprint"],
-        published_at: entry["published_at"],
+        published_at: entry.key?("published_at") ? publish_timestamp_from_value(entry["published_at"]) : nil,
         signature: entry["signature"]
       )
     end
 
+    def publish_timestamp_from_value(value)
+      timestamp = case value
+      when Integer then value
+      when String
+        value.match?(/\A\d+\z/) ? value.to_i : Time.iso8601(value).to_i
+      end
+      unless timestamp&.between?(0, 253_402_300_799)
+        raise Error.integrity("registry published_at must be whole UTC Unix seconds")
+      end
+
+      timestamp
+    rescue ArgumentError
+      raise Error.integrity("registry published_at must be whole UTC Unix seconds")
+    end
+
     def select_package_version(metadata, constraint, preferred_version)
       if preferred_version
         version = metadata.versions.find { |entry| entry.version == preferred_version && !entry.yanked }

data/lib/pray/render_content.rb

@@ -27,7 +27,7 @@ module Pray
       end
 
       def finish
-        @content.sub(/\n\n+\z/, "\n")
+        @content.sub!(/\n\n+\z/, "\n")
         @content << "\n" unless @content.end_with?("\n")
         @content
       end

data/lib/pray/serve_federation.rb

@@ -34,7 +34,7 @@ module Pray
         )
         next if metadata.versions.empty?
 
-        updated_at = metadata.versions.map { |version| version.published_at.to_s }.max || "0"
+        updated_at = (metadata.versions.filter_map(&:published_at).max || 0).to_s
         {
           "name" => name,
           "updated_at" => updated_at,
@@ -57,7 +57,7 @@ module Pray
       metadata = Publish.load_registry_package_metadata(metadata_path, name)
       body = {
         "name" => metadata.name,
-        "updated_at" => metadata.versions.map { |version| version.published_at.to_s }.max || "0",
+        "updated_at" => (metadata.versions.filter_map(&:published_at).max || 0).to_s,
         "versions" => metadata.versions.map { |version| transport_version(version) }
       }
       Serve.ok_response("application/json", JSON.pretty_generate(body))
@@ -78,9 +78,9 @@ module Pray
         "tree_hash" => version.tree_hash.to_s,
         "yanked" => version.yanked,
         "targets" => version.targets,
-        "exports" => version.exports,
-        "published_at" => version.published_at.to_s
+        "exports" => version.exports
       }
+      hash["published_at"] = version.published_at if version.published_at
       if version.signer || version.signer_fingerprint
         hash["publisher"] = {
           "id" => version.signer.to_s,

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.13.0"
-  GENERATED_BY = "pray 1.13.0"
+  VERSION = "1.14.0"
+  GENERATED_BY = "pray 1.14.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.13.0
+  version: 1.14.0
 platform: ruby
 authors:
 - Andrei Makarov