@konvert7/klint 0.33.1 → 0.35.0

package/README.md

@@ -15,6 +15,12 @@ brew tap konvert7/tap
 brew install klint
 ```
 
+With Cargo (installs the `klint-rs` binary):
+
+```sh
+cargo install klint-rs
+```
+
 For TypeScript projects using Bun:
 
 ```sh
@@ -107,7 +113,8 @@ Rules give agents room to move quickly because the unsafe moves are blocked stru
 ## CLI
 
 ```sh
-klint [--config <dir>] [--rules <file>] [--engine ts|rust|compare|auto] [--fix] [--json]
+klint [--config <dir>] [--rules <file>] [--engine ts|rust|compare|auto] [--fix] [--json] [--hook]
+klint stats [--config <dir>]
 klint install-skill [--agents <list>] [--symlink | --copy] [--force]
 ```
 
@@ -118,6 +125,7 @@ klint install-skill [--agents <list>] [--symlink | --copy] [--force]
 | `--engine <name>` | Engine mode: `ts` (default), `rust`, `compare`, or `auto` |
 | `--fix` | Apply auto-fixes for fixable violations in-place |
 | `--json` | Emit structured JSON to stdout for agents and CI |
+| `--hook` | Count this run as an agent hook run in `klint stats` |
 
 `klint install-skill` installs the bundled rule-authoring skill for agent environments:
 
@@ -127,6 +135,8 @@ klint install-skill
 
 The skill is embedded in the native engine, so this works from every distribution — the npm package, the PyPI wheel, the NuGet tool, and the standalone binary — not just Node projects.
 
+Run on a terminal without `--agents`, `--symlink`, or `--copy`, it asks which agents to install for and how to store the skill. That is true of every distribution: the npm CLI prompts through `@clack/prompts`, and the native engine — which the wheel, the NuGet tool, and the standalone binary all wrap — prompts through `inquire`. Passing any of those flags, or piping stdin (CI, scripts, hooks), skips the questions and uses the defaults.
+
 ### Shared layout (default)
 
 By default the skill lives in exactly one place and every other agent directory points at it:
@@ -137,7 +147,7 @@ By default the skill lives in exactly one place and every other agent directory
 .cursor/skills/klint-rules  ->      ../../.agents/skills/klint-rules
 ```
 
-`.agents/skills` is where opencode and Codex already read from, so it doubles as the hub. One source of truth means one file to diff, one receipt, and one warning when it drifts. The links are relative and stay inside the repo — nothing points into `node_modules`, so reinstalling dependencies can never break them.
+`.agents/skills` is where opencode, Codex, and GitHub Copilot already read from, so it doubles as the hub. One source of truth means one file to diff, one receipt, and one warning when it drifts. The links are relative and stay inside the repo — nothing points into `node_modules`, so reinstalling dependencies can never break them.
 
 Pass `--copy` instead to give every agent directory its own independent copy and receipt.
 
@@ -161,6 +171,26 @@ Earlier versions symlinked into `node_modules/@konvert7/klint`, which breaks the
 
 Running `klint install-skill` replaces those links with the shared layout, including links whose target is already gone. No `--force` needed — a symlink holds no content to lose.
 
+### Stats
+
+Every lint run is recorded in `.klint/stats.json` next to your config. `klint stats` prints the totals:
+
+```
+klint stats (.klint/stats.json)
+
+  runs              42  (hook 30, direct 12)
+  errors prevented  17  (caught by hook 11, direct 6)
+
+  prevented by rule
+    no-floating-promise  9
+    arch/imports         5
+    no-string-match      3
+```
+
+An error counts as prevented once: when a run reports it and a later run no longer does. Errors match by rule, file, and message, so moving code to another line doesn't count as a fix, and running klint again on an unfixed error doesn't count twice. Warnings aren't tracked. A prevented error is credited to the run that first caught it: pass `--hook` from agent hooks, and every other run (an agent's own shell, a person, CI) counts as direct.
+
+`.klint/` contains a `.gitignore` with `*`, so git ignores the whole folder and nothing needs adding to your own `.gitignore`. Set `KLINT_NO_STATS=1` to stop recording. Stats are best effort: a read-only checkout never fails a lint run.
+
 ## Engines
 
 klint currently ships a TypeScript engine and an experimental Rust engine. The Rust path is built for portable architecture checks and syntax-local rules; type-aware checks stay in TypeScript for now.
@@ -743,13 +773,13 @@ Enable plugin rules with `plugins: [sonar]`, then override individual severities
 
 ## Agent and CI Integration
 
-Agent hooks should run klint with `--json` so violations are machine-readable.
+Agent hooks should run klint with `--json` so violations are machine-readable, and with `--hook` so [`klint stats`](#stats) can tell hook runs apart from direct ones.
 
 ```ts
 // .agents/hooks/klint.ts
 import { runHook } from "./run-hook";
 
-const exitCode = runHook(["bun", "run", "klint", "--", "--json"]);
+const exitCode = runHook(["bun", "run", "klint", "--", "--json", "--hook"]);
 process.exit(exitCode);
 ```
 

package/cli/help.ts

@@ -12,7 +12,8 @@ export function printHelp(): void {
     [
       "klint — agent harness for TypeScript architecture rules",
       "",
-      "Usage: klint [--config <dir>] [--rules <file>] [--engine ts|rust|compare|auto] [--fix] [--json]",
+      "Usage: klint [--config <dir>] [--rules <file>] [--engine ts|rust|compare|auto] [--fix] [--json] [--hook]",
+      "       klint stats [--config <dir>]",
       "       klint install-skill [--agents <list>] [--symlink | --copy] [--force]",
       "",
       "  --config <dir>   directory containing klint.yaml or klint.config.json (default: cwd)",
@@ -21,9 +22,13 @@ export function printHelp(): void {
       "  --fix            apply auto-fixes for fixable violations in-place",
       "  --json           emit structured JSON to stdout (for agent/CI consumption)",
       "  --debug          print file resolution and rule progress to stderr",
+      "  --hook           count this run as an agent hook run in klint stats",
+      "",
+      "  stats            print runs and errors prevented, in total and per rule, from",
+      "                   .klint/stats.json (set KLINT_NO_STATS=1 to stop recording)",
       "",
       "  install-skill    install the rule-authoring skill into agent config directories",
-      "                   --agents <list>  comma-separated: claude,opencode,cursor,codex (default: all)",
+      "                   --agents <list>  comma-separated: claude,opencode,cursor,codex,copilot (default: all)",
       "                   --symlink        keep one skill in .agents/skills and symlink the",
       "                                    other agents to it (default)",
       "                   --copy           give every agent directory its own copy",

package/cli/install-skill.ts

@@ -20,6 +20,7 @@ const AGENT_TARGETS = [
   { value: "opencode", label: "opencode" },
   { value: "cursor", label: "Cursor" },
   { value: "codex", label: "Codex" },
+  { value: "copilot", label: "GitHub Copilot" },
 ] as const satisfies ReadonlyArray<{ value: AgentKey; label: string }>;
 
 interface InstallPlan {

package/cli/rust-engine.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { runKlint } from "../core/runner";
+import type { RunRecorder } from "../core/stats";
 import type { KlintRule, RuleConfigValue, Violation } from "../core/types";
 import {
   emptyJsonPayload,
@@ -25,11 +26,14 @@ import {
   splitRulesForAuto,
 } from "./rust-config";
 
+const RUST_CHILD_ENV = { ...process.env, KLINT_NO_STATS: "1" };
+
 export function runRustEngine({
   advisories,
   fix,
   json,
   raw,
+  record,
   root,
   rulesFile,
   startedAt,
@@ -42,6 +46,7 @@ export function runRustEngine({
     rules?: Record<string, RuleConfigValue>;
     arch?: unknown;
   };
+  record: RunRecorder;
   root: string;
   rulesFile?: string;
   startedAt: number;
@@ -69,18 +74,20 @@ export function runRustEngine({
     result = spawnSync(command.bin, command.args, {
       cwd: PACKAGE_ROOT,
       encoding: "utf-8",
+      env: RUST_CHILD_ENV,
     });
   } finally {
     cleanup();
   }
 
   if (result.stderr) process.stderr.write(result.stderr);
+  const payload = parseJsonPayload(result.stdout);
+  if (isJsonPayload(payload)) record(payload.violations);
   if (json) {
     if (result.stdout) process.stdout.write(withAdvisories(result.stdout, advisories));
     process.exit(result.status ?? 1);
   }
 
-  const payload = parseJsonPayload(result.stdout);
   if (!isJsonPayload(payload)) {
     process.stderr.write("klint: --engine rust failed to parse Rust JSON output\n");
     process.exit(1);
@@ -93,6 +100,7 @@ export function runCompareEngine({
   fix,
   json,
   raw,
+  record,
   root,
   rulesFile,
   tsViolations,
@@ -105,6 +113,7 @@ export function runCompareEngine({
     rules?: Record<string, RuleConfigValue>;
     arch?: unknown;
   };
+  record: RunRecorder;
   root: string;
   rulesFile?: string;
   tsViolations: ReturnType<typeof runKlint>;
@@ -133,6 +142,7 @@ export function runCompareEngine({
     rustResult = spawnSync(rustCommand.bin, rustCommand.args, {
       cwd: PACKAGE_ROOT,
       encoding: "utf-8",
+      env: RUST_CHILD_ENV,
     });
   } finally {
     cleanup();
@@ -159,6 +169,7 @@ export function runCompareEngine({
     process.exit(1);
   }
 
+  record(tsViolations);
   process.stdout.write(withAdvisories(tsResult.stdout, advisories));
   process.exit(tsResult.status);
 }
@@ -197,6 +208,7 @@ export function runAutoEngine({
   fix,
   json,
   raw,
+  record,
   root,
   rulesFile,
   startedAt,
@@ -213,6 +225,7 @@ export function runAutoEngine({
     rules?: Record<string, RuleConfigValue>;
     arch?: unknown;
   };
+  record: RunRecorder;
   root: string;
   rulesFile?: string;
   startedAt: number;
@@ -247,6 +260,7 @@ export function runAutoEngine({
   });
   const tsOutput = toJsonPayload(tsViolations);
   const merged = mergeJsonOutputs(rustOutput, tsOutput);
+  record(merged.violations);
   if (json) {
     process.stdout.write(withAdvisories(JSON.stringify(merged), advisories));
     process.exit(merged.summary.errors > 0 ? 2 : 0);
@@ -289,6 +303,7 @@ function runAutoRustSubset({
     const result = spawnSync(command.bin, command.args, {
       cwd: PACKAGE_ROOT,
       encoding: "utf-8",
+      env: RUST_CHILD_ENV,
     });
     if (result.stderr) process.stderr.write(result.stderr);
     if ((result.status ?? 1) !== 0 && (result.status ?? 1) !== 2) {

package/cli/stats.ts

@@ -0,0 +1,34 @@
+import { resolve } from "node:path";
+import { type KlintStats, readStats, STATS_DIR, STATS_FILE } from "../core/stats";
+
+function rulesByCount(byRule: Record<string, number>): Array<[string, number]> {
+  const byCodePoint = (a: string, b: string) => Number(a > b) - Number(a < b);
+  return Object.entries(byRule).sort(([a, x], [b, y]) => y - x || byCodePoint(a, b));
+}
+
+export function formatStats(stats: KlintStats): string {
+  const runs = stats.runs.hook + stats.runs.direct;
+  const prevented = stats.prevented.bySource.hook + stats.prevented.bySource.direct;
+  const rules = rulesByCount(stats.prevented.byRule);
+  const width = Math.max(0, ...rules.map(([rule]) => rule.length));
+  const lines = [
+    `klint stats (${STATS_DIR}/${STATS_FILE})`,
+    "",
+    `  runs              ${runs}  (hook ${stats.runs.hook}, direct ${stats.runs.direct})`,
+    `  errors prevented  ${prevented}  (caught by hook ${stats.prevented.bySource.hook}, direct ${stats.prevented.bySource.direct})`,
+  ];
+  if (rules.length > 0) {
+    lines.push("", "  prevented by rule");
+    for (const [rule, count] of rules) lines.push(`    ${rule.padEnd(width)}  ${count}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+export function printStats(args: string[]): void {
+  const configFlag = args.indexOf("--config");
+  const configDir =
+    configFlag !== -1 && args[configFlag + 1]
+      ? resolve(args[configFlag + 1])
+      : process.cwd();
+  process.stdout.write(formatStats(readStats(configDir)));
+}

package/cli.ts

@@ -14,10 +14,12 @@ import {
 } from "./cli/output";
 import { installedVersion, SHIPPED_SKILL_PATH } from "./cli/paths";
 import { runAutoEngine, runCompareEngine, runRustEngine } from "./cli/rust-engine";
+import { printStats } from "./cli/stats";
 import { applyFixes } from "./core/fixer";
 import { runKlint } from "./core/runner";
 import { schemaVersionAdvisory } from "./core/schema-version";
 import { skillAdvisories } from "./core/skill";
+import { runRecorder } from "./core/stats";
 import type { ArchConfig, KlintConfig, KlintRule, RuleConfigValue } from "./core/types";
 
 interface CliOptions {
@@ -34,6 +36,11 @@ export async function main(opts: CliOptions = {}): Promise<void> {
     process.exit(0);
   }
 
+  if (args[0] === "stats") {
+    printStats(args.slice(1));
+    return;
+  }
+
   const subcommand = args.indexOf("install-skill");
   if (subcommand !== -1) {
     await installSkill(args.slice(subcommand + 1));
@@ -45,6 +52,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
   let fix = false;
   let json = false;
   let debug = false;
+  let hook = false;
   let engine = process.env.KLINT_ENGINE;
 
   for (let i = 0; i < args.length; i++) {
@@ -53,6 +61,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
     else if (args[i] === "--engine" && args[i + 1]) engine = args[++i];
     else if (args[i] === "--fix") fix = true;
     else if (args[i] === "--json") json = true;
+    else if (args[i] === "--hook") hook = true;
     else if (args[i] === "--debug" || args[i] === "-debug") debug = true;
     else if (args[i] === "--help" || args[i] === "-h") {
       printHelp();
@@ -67,6 +76,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
   }
 
   configDir ??= process.cwd();
+  const record = runRecorder(configDir, hook ? "hook" : "direct");
 
   const yamlPath = resolve(configDir, "klint.yaml");
   const jsonPath = resolve(configDir, "klint.config.json");
@@ -115,7 +125,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
   ];
 
   if (engine === "rust") {
-    runRustEngine({ advisories, fix, json, raw, root, rulesFile, startedAt });
+    runRustEngine({ advisories, fix, json, raw, record, root, rulesFile, startedAt });
     return;
   }
   if (
@@ -151,6 +161,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
       fix,
       json,
       raw,
+      record,
       root,
       rulesFile,
       startedAt,
@@ -178,6 +189,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
       fix,
       json,
       raw,
+      record,
       root,
       rulesFile,
       tsViolations: violations,
@@ -186,6 +198,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
   }
 
   if (json) {
+    record(violations);
     const tsResult = toJsonCliResult(violations);
     process.stdout.write(withAdvisories(tsResult.stdout, advisories));
     process.exit(tsResult.status);
@@ -211,6 +224,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
       );
       if (current.every((v) => !v.fix)) break;
     }
+    record(current);
     const unfixed = current.filter((v) => !v.fix).length;
     const msg =
       unfixed > 0
@@ -219,6 +233,7 @@ export async function main(opts: CliOptions = {}): Promise<void> {
     process.stdout.write(`${msg} Finished in ${formatDuration(startedAt)}.\n`);
     process.exit(0);
   }
+  record(violations);
   writeTextOutput([...violations, ...advisories], startedAt);
 }
 

package/core/skill.ts

@@ -6,6 +6,7 @@ import type { Violation } from "./types";
 export const AGENT_SKILL_DIRS = {
   claude: ".claude/skills",
   codex: ".agents/skills",
+  copilot: ".agents/skills",
   cursor: ".cursor/skills",
   opencode: ".agents/skills",
 } as const;

package/core/stats.ts

@@ -0,0 +1,128 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import type { Violation } from "./types";
+
+export const STATS_DIR = ".klint";
+export const STATS_FILE = "stats.json";
+const SELF_IGNORE = "# Created by klint automatically.\n*\n";
+const STATS_VERSION = 1;
+
+export type RunSource = "hook" | "direct";
+
+type CountedViolation = Pick<Violation, "file" | "rule" | "message" | "severity">;
+
+export type RunRecorder = (violations: readonly CountedViolation[]) => void;
+
+interface OpenError {
+  rule: string;
+  file: string;
+  message: string;
+  caughtBy: RunSource;
+}
+
+export interface KlintStats {
+  version: typeof STATS_VERSION;
+  runs: Record<RunSource, number>;
+  prevented: {
+    byRule: Record<string, number>;
+    bySource: Record<RunSource, number>;
+  };
+  open: OpenError[];
+}
+
+export function emptyStats(): KlintStats {
+  return {
+    version: STATS_VERSION,
+    runs: { hook: 0, direct: 0 },
+    prevented: { byRule: {}, bySource: { hook: 0, direct: 0 } },
+    open: [],
+  };
+}
+
+function sameError(a: Omit<OpenError, "caughtBy">, b: Omit<OpenError, "caughtBy">) {
+  return a.rule === b.rule && a.file === b.file && a.message === b.message;
+}
+
+function errorsOf(
+  violations: readonly CountedViolation[]
+): Omit<OpenError, "caughtBy">[] {
+  return violations
+    .filter((v) => v.severity === "error")
+    .map(({ rule, file, message }) => ({ rule, file, message }));
+}
+
+export function nextStats(
+  previous: KlintStats,
+  violations: readonly CountedViolation[],
+  source: RunSource
+): KlintStats {
+  const stats = structuredClone(previous);
+  stats.runs[source] += 1;
+
+  const unmatched = errorsOf(violations);
+  const stillOpen: OpenError[] = [];
+  for (const error of previous.open) {
+    const match = unmatched.findIndex((current) => sameError(current, error));
+    if (match === -1) {
+      stats.prevented.byRule[error.rule] = (stats.prevented.byRule[error.rule] ?? 0) + 1;
+      stats.prevented.bySource[error.caughtBy] += 1;
+      continue;
+    }
+    unmatched.splice(match, 1);
+    stillOpen.push(error);
+  }
+  stats.open = [
+    ...stillOpen,
+    ...unmatched.map((error) => ({ ...error, caughtBy: source })),
+  ];
+  return stats;
+}
+
+function isStats(value: unknown): value is KlintStats {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value as Partial<KlintStats>;
+  return (
+    candidate.version === STATS_VERSION &&
+    typeof candidate.runs?.hook === "number" &&
+    typeof candidate.runs.direct === "number" &&
+    typeof candidate.prevented?.byRule === "object" &&
+    typeof candidate.prevented.bySource?.hook === "number" &&
+    typeof candidate.prevented.bySource.direct === "number" &&
+    Array.isArray(candidate.open)
+  );
+}
+
+export function readStats(configDir: string): KlintStats {
+  try {
+    const parsed: unknown = JSON.parse(
+      readFileSync(join(configDir, STATS_DIR, STATS_FILE), "utf-8")
+    );
+    return isStats(parsed) ? parsed : emptyStats();
+  } catch {
+    return emptyStats();
+  }
+}
+
+function writeStats(configDir: string, stats: KlintStats): void {
+  const dir = join(configDir, STATS_DIR);
+  mkdirSync(dir, { recursive: true });
+  const ignoreFile = join(dir, ".gitignore");
+  if (!existsSync(ignoreFile)) writeFileSync(ignoreFile, SELF_IGNORE);
+  const target = join(dir, STATS_FILE);
+  const staging = `${target}.${process.pid}.tmp`;
+  writeFileSync(staging, `${JSON.stringify(stats, null, 2)}\n`);
+  renameSync(staging, target);
+}
+
+function statsDisabled(): boolean {
+  return Boolean(process.env.KLINT_NO_STATS);
+}
+
+export function runRecorder(configDir: string, source: RunSource): RunRecorder {
+  return (violations) => {
+    if (statsDisabled()) return;
+    try {
+      writeStats(configDir, nextStats(readStats(configDir), violations, source));
+    } catch {}
+  };
+}

package/klint.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://raw.githubusercontent.com/konvert7/klint/refs/tags/v0.33.1/klint.schema.json",
+  "$id": "https://raw.githubusercontent.com/konvert7/klint/refs/tags/v0.35.0/klint.schema.json",
   "type": "object",
   "properties": {
     "$schema": {

package/klint.schema.yaml

@@ -1,5 +1,5 @@
 $schema: http://json-schema.org/draft-07/schema#
-$id: https://raw.githubusercontent.com/konvert7/klint/refs/tags/v0.33.1/klint.schema.json
+$id: https://raw.githubusercontent.com/konvert7/klint/refs/tags/v0.35.0/klint.schema.json
 type: object
 properties:
   $schema:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@konvert7/klint",
-  "version": "0.33.1",
+  "version": "0.35.0",
   "description": "Architecture-as-Code linter for TypeScript. Enforce layer boundaries, import rules, and singleton patterns in YAML.",
   "type": "module",
   "bin": {
@@ -70,10 +70,10 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@konvert7/klint-darwin-arm64": "0.33.1",
-    "@konvert7/klint-darwin-x64": "0.33.1",
-    "@konvert7/klint-linux-x64": "0.33.1",
-    "@konvert7/klint-win32-x64": "0.33.1"
+    "@konvert7/klint-darwin-arm64": "0.35.0",
+    "@konvert7/klint-darwin-x64": "0.35.0",
+    "@konvert7/klint-linux-x64": "0.35.0",
+    "@konvert7/klint-win32-x64": "0.35.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.7",

package/tools/generate-homebrew-formula.ts

@@ -20,10 +20,10 @@ class Klint < Formula
   license "MIT"
 
   if Hardware::CPU.arm?
-    url "https://github.com/konvert7/klint/releases/download/native-v${version}/klint-${version}-darwin-arm64.tar.gz"
+    url "https://github.com/konvert7/klint/releases/download/v${version}/klint-${version}-darwin-arm64.tar.gz"
     sha256 "${options.darwinArm64Sha}"
   else
-    url "https://github.com/konvert7/klint/releases/download/native-v${version}/klint-${version}-darwin-x64.tar.gz"
+    url "https://github.com/konvert7/klint/releases/download/v${version}/klint-${version}-darwin-x64.tar.gz"
     sha256 "${options.darwinX64Sha}"
   end
 

package/tools/semantic-release-crates.js

@@ -0,0 +1,96 @@
+import { spawnSync } from "node:child_process";
+import { copyFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+const CRATE_NAME = "klint-rs";
+const MANIFEST = "crates/klint-rs/Cargo.toml";
+const WORKSPACE_SKILL = "skill/klint-rules/SKILL.md";
+const PACKAGED_SKILL = "crates/klint-rs/skill/SKILL.md";
+
+export async function verifyConditions(_, context) {
+  const manifest = readManifest(cwdOf(context));
+  if (crateNameOf(manifest) !== CRATE_NAME) {
+    throw new Error(`${MANIFEST} declares ${crateNameOf(manifest)}, expected ${CRATE_NAME}`);
+  }
+  if (context.options?.dryRun) return;
+  if (!process.env.CARGO_REGISTRY_TOKEN) {
+    throw new Error(
+      "CARGO_REGISTRY_TOKEN is unset; crates.io trusted publishing issued no token"
+    );
+  }
+}
+
+export async function prepare(pluginConfig = {}, context) {
+  const cwd = cwdOf(context);
+  const version = versionOf(context);
+
+  writeManifest(cwd, stampVersion(readManifest(cwd), version));
+  refreshLockfile(cwd, pluginConfig.spawnSync ?? spawnSync);
+  bundleSkill(cwd);
+
+  context.logger?.log(`Stamped ${CRATE_NAME} at ${version} and bundled its skill`);
+}
+
+export async function publish(pluginConfig = {}, context) {
+  if (context.options?.dryRun) {
+    context.logger?.log("Dry run: skipping the crates.io publish");
+    return;
+  }
+
+  const spawn = pluginConfig.spawnSync ?? spawnSync;
+  const result = spawn(
+    "cargo",
+    ["publish", "-p", CRATE_NAME, "--locked", "--allow-dirty"],
+    { cwd: cwdOf(context), encoding: "utf-8", stdio: "inherit" }
+  );
+  if ((result.status ?? -1) !== 0) {
+    throw new Error(`cargo publish failed with exit code ${result.status ?? -1}`);
+  }
+
+  context.logger?.log(`Published ${CRATE_NAME} ${versionOf(context)} to crates.io`);
+}
+
+function stampVersion(manifest, version) {
+  return manifest.replace(/^version = ".*"$/m, `version = "${version}"`);
+}
+
+function refreshLockfile(cwd, spawn) {
+  const result = spawn("cargo", ["update", "--workspace"], {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["ignore", "ignore", "pipe"],
+  });
+  if ((result.status ?? -1) !== 0) {
+    throw new Error(
+      `cargo update failed with exit code ${result.status ?? -1}\n${result.stderr ?? ""}`
+    );
+  }
+}
+
+function bundleSkill(cwd) {
+  const target = join(cwd, PACKAGED_SKILL);
+  mkdirSync(dirname(target), { recursive: true });
+  copyFileSync(join(cwd, WORKSPACE_SKILL), target);
+}
+
+function crateNameOf(manifest) {
+  return manifest.match(/^name = "(.*)"$/m)?.[1];
+}
+
+function readManifest(cwd) {
+  return readFileSync(join(cwd, MANIFEST), "utf-8");
+}
+
+function writeManifest(cwd, manifest) {
+  writeFileSync(join(cwd, MANIFEST), manifest);
+}
+
+function cwdOf(context) {
+  return context.cwd ?? process.cwd();
+}
+
+function versionOf(context) {
+  const version = context.nextRelease?.version;
+  if (!version) throw new Error("semantic-release did not provide nextRelease.version");
+  return version;
+}