putitoutthere 0.2.26 → 0.2.28

package/CHANGELOG.md

@@ -12,6 +12,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Added
 
+- **`kind = "npm"` `build = "bundled-cli"` now supports `[package.bundle_cli]` so the reusable workflow runs the Rust cross-compile itself.** Mirror of the pypi `[package.bundle_cli]` recipe shipped in #282 — the reusable workflow now, for every per-target row with `matrix.kind == 'npm' && matrix.build == 'bundled-cli' && matrix.bundle_cli && matrix.target != 'main'`: (1) `rustup target add ${{ matrix.target }}`, (2) `cargo build --release --target ${{ matrix.target }} --bin ${{ matrix.bundle_cli.bin }}` against `crate_path` (with optional `--features` / `--no-default-features` for crates that gate the CLI behind a Cargo feature), (3) copies the resulting binary (`.exe` on Windows) into the per-target staging directory the engine's npm-platform handler reads (`${{ matrix.artifact_path }}`, which is `<pkg.path>/build/<triple>` for single-mode rows and `<pkg.path>/build/<mode>-<triple>` for multi-mode rows), and (4) runs a permanent defense-in-depth build-content guard that asserts the staged binary exists before `actions/upload-artifact` runs. Schema: `bin` (required), `crate_path` (default `"."`), `features` (default `[]`), `no_default_features` (default `false`). The block is only valid when at least one bundled-cli entry exists in `build` and `targets` is non-empty. Existing consumers who authored a `scripts/build.cjs` keep working — the workflow runs first, then `npm run build --if-present` runs the consumer's script (which sees `build/<triple>/` already populated and probably no-ops); migrating to the declarative block is opt-in. Every bundled-cli npm consumer to date has written essentially the same cross-compile script and hit bugs at the seam between that script and the engine (#287 was the most recent). Absorbing the script closes the largest remaining piece of the consumer integration surface that exists for no architectural reason. See [README → Recipes → Bundled-CLI npm family](./README.md#bundled-cli-npm-family) and [MIGRATIONS.md](./MIGRATIONS.md#npm-bundle_cli-absorbed-into-the-reusable-workflow). #298.
 - **Reusable workflow `.github/workflows/check.yml` (`workflow_call`).** PR-time config-sanity gate. Wires into a consumer's `pull_request:` CI in one line: `uses: thekevinscott/putitoutthere/.github/workflows/check.yml@v0`. Drives the same `putitoutthere check` engine entry the publish path already uses (no parallel diagnostic code path — the operative rule from the [refreshed non-goal #8](./notes/design-commitments.md#non-goals)), so the consumer-observable check list is whatever `check` reports: `putitoutthere.toml` parse + schema + common-mistakes detector, unique package names, `depends_on` cycle / dangling-ref detection, `[[package]].path` directory exists, `globs` match a tracked file, `tag_format` collisions, npm `repository` field, crates `description` / `license`, pypi `pyproject.toml` + `bundle_cli` binary declaration, npm target triple mapping. Findings are aggregated into one round-trip rather than failing on the first. A few seconds per PR, no per-target build, no `setup-python` / `setup-rust`. Permissions: `contents: read` only — the workflow holds no publishable artifact and cannot mint a registry token. Complementary to `build.yml`: `check.yml` is the cheap config-sanity gate, `build.yml` is the heavier per-target build gate; wire both. See [README → check](./README.md#1b-recommended-drop-in-githubworkflowscheckyml) and [MIGRATIONS.md](./MIGRATIONS.md#new-checkyml-reusable-workflow-for-pr-time-config-sanity). #317 (workflow shell) + #319 (check list, shipped via #321).
 - **Internal-only: `cargo-http-registry` alt-registry for e2e crates.io 429 fallback and first-publish coverage.** `e2e (polyglot-everything) / publish` reliably 429s on `cargo publish` for the polyglot rust fixture once a few PRs have burned crates.io's 24h-per-crate quota (the fixture publishes a fresh `0.0.<timestamp>` version on every run; the per-crate quota gets exhausted faster than it resets). `e2e-fixture-job.yml`'s publish job now installs and runs [`cargo-http-registry`](https://github.com/d-e-s-o/cargo-http-registry) (an off-the-shelf, auth-free cargo alt-registry — the "Verdaccio for cargo" the workflow has needed) as a background process on every crates-bearing matrix row. Two engine seams in `src/handlers/crates.ts` consume it: `PIOT_CRATES_REGISTRY_FALLBACK` retries `cargo publish --index <url>` against the alt-registry on a 429-rate-limit-shaped failure from real crates.io and emits a `::warning::` workflow command naming the URL so reviewers see the path was taken; `PIOT_CRATES_REGISTRY_PRIMARY` routes the publish *only* at the alt-registry (no real-crates.io attempt, no fallback) — reserved for any future `*-first-publish` crates fixture, symmetric with #304's npm/Verdaccio shape. Non-429 failures (auth, network, validation) surface verbatim — the fallback predicate is scoped narrowly to rate-limit prose. The handler now passes `--token <placeholder>` alongside `--index <url>` because cargo's CLI parser refuses to invoke publish with `--index` unless a token is explicitly named (a wart of the cargo CLI surface; cargo-http-registry accepts any token value). **Why `cargo-http-registry` and not a hand-rolled mock or another off-the-shelf registry**: an earlier iteration on this PR wired Kellnr; three CI rounds all 403'd because Kellnr (and alexandrie, ktra, cratery) are multi-tenant-shaped and reject fixture-style unrecognized identities. `cargo-http-registry`'s README explicitly disclaims auth ("if being asked to cargo login to the registry, any string may be used") and has a lightweight dep tree (tokio rt-only + warp + git2, no openssl-sys / sqlite-sys / aws-lc-sys), making `cargo install --locked` a ~70s cold cost — well inside the e2e job's existing budget. **No consumer surface changes**: both env vars are read only by the engine; the dogfood `release-rust.yml` continues to publish to real crates.io, and consumer `release.yml` flows that don't set either env var keep the publish path they have today byte-identical. See [MIGRATIONS.md](./MIGRATIONS.md#internal-cargo-http-registry-alt-registry-for-crates-e2e). #331.
 - **Internal-only: first-publish e2e coverage via Verdaccio.** A new `js-vanilla-first-publish` fixture and matrix row in `.github/workflows/e2e-fixture.yml` exercises the empty-packument path (`npm view <name>` returns 404 before publish) that consumer-reported bugs cluster around. `e2e-fixture-job.yml`'s publish job now runs an in-job Verdaccio service container (`verdaccio/verdaccio:5`); per-fixture job isolation gives per-scenario wipe implicitly. The new fixture carries a `-placeholder` suffix on its package name that the workflow rewrites to `-${run_id}-${run_attempt}` at materialize time, so each scenario publishes against a packument that's truly empty. The post-publish tarball-verification step is now registry-agnostic — `REGISTRY_URL` env steers `npm view` at either real npm or Verdaccio with adapted retry/backoff. **No consumer surface changes**: `PIOT_NPM_REGISTRY` is an internal e2e seam read by `src/handlers/npm.ts` and `src/handlers/npm-platform.ts`; setting it bypasses provenance and the bootstrap-hint path. Steady-state e2e fixtures and consumer `release.yml` flows are untouched. See [MIGRATIONS.md](./MIGRATIONS.md#internal-verdaccio-e2e-coverage). #304 (parent #293).
@@ -26,6 +27,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Changed
 
+- **BREAKING: `kind = "pypi"` packages must declare `[project].dynamic = ["version"]` in `pyproject.toml`.** Static `[project].version = "..."` literals are now rejected at PR time by `putitoutthere check` and again at publish-time preflight, both surfacing the new stable error code `PIOT_PYPI_STATIC_VERSION`. The most common Python-publishing footgun: putitoutthere does not edit `pyproject.toml` at release time (per the [no version computation](./notes/design-commitments.md#non-goals) design commitment), so a literal silently shipped the previous release's wheel/sdist because the build backend read whatever was on disk. The fix is the same across the three supported backends: `hatch-vcs` (recommended), `setuptools-scm`, and maturin's Cargo.toml-driven path — all accept `dynamic = ["version"]`. `pypi.writeVersion` and the `putitoutthere write-version` CLI subcommand also reject the literal shape (previously they rewrote it in place). The `replacePyProjectVersion` helper, the "preserves comments around the literal" carve-out, and the sibling-pyproject-and-Cargo.toml double-rewrite path are removed; under the dynamic contract `Cargo.toml` alone is the bump target for maturin and `SETUPTOOLS_SCM_PRETEND_VERSION` is the handoff for hatch-vcs / setuptools-scm. See [README → Python version source](./README.md#python-version-source--required-shape) and [MIGRATIONS.md](./MIGRATIONS.md#pypi-pyproject-toml-must-declare-dynamic--version). #333.
 - **BREAKING: `publish` throws on an empty matrix instead of exiting clean.** The reusable workflow's `publish` step now fails red when the plan is empty, with `PIOT_PUBLISH_EMPTY_PLAN` in the message. Previously, an empty plan logged `info: publish: plan is empty; nothing to release` and returned `ok: true` — leaving consumers with green release runs that hadn't published anything. Skips belong at the workflow gate (the `if:` on the publish job that reads the plan job's matrix output), not in the publish step. See [MIGRATIONS.md](./MIGRATIONS.md#publish-throws-on-empty-matrix).
 
 ### Deprecated

package/MIGRATIONS.md

@@ -152,6 +152,250 @@ curl -s https://pypi.org/pypi/<name>/json | jq '.urls[].packagetype'
 `pip install <name>` (or `uvx <name>`) should download `*.whl` and
 skip the local build step entirely.
 
+---
+
+### pypi `pyproject.toml` must declare `dynamic = ["version"]`
+
+**Summary.** Every `kind = "pypi"` package's `pyproject.toml` must
+now declare `[project].dynamic = ["version"]`. Static
+`[project].version = "x.y.z"` literals are rejected at PR time by
+`putitoutthere check` and again at publish-time preflight, both
+under the stable error code `PIOT_PYPI_STATIC_VERSION`. This is
+the most common Python-publishing footgun: putitoutthere does not
+edit `pyproject.toml` at release time (per the [no version
+computation](./notes/design-commitments.md#non-goals) design
+commitment), so a literal silently shipped the previous release's
+wheel/sdist because the build backend read whatever was on disk.
+Making the dynamic shape mandatory closes the failure mode at the
+earliest knowable boundary — the consumer's own repo state, before
+a release run is ever invoked.
+
+**Required changes.**
+
+Before — a static literal, accepted in v0.2.x:
+
+```toml
+[project]
+name = "your-package"
+version = "0.1.0"
+```
+
+After — `hatch-vcs` (recommended for new packages):
+
+```toml
+[build-system]
+requires = ["hatchling", "hatch-vcs"]
+build-backend = "hatchling.build"
+
+[project]
+name = "your-package"
+dynamic = ["version"]
+
+[tool.hatch.version]
+source = "vcs"
+```
+
+After — `setuptools-scm` (for setuptools-backed projects):
+
+```toml
+[build-system]
+requires = ["setuptools>=64", "setuptools-scm>=8"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "your-package"
+dynamic = ["version"]
+
+[tool.setuptools_scm]
+```
+
+After — `maturin` (Python packages built from a Rust crate): the
+version source moves to the sibling `Cargo.toml`'s
+`[package].version`. `pyproject.toml` declares only that the version
+is dynamic:
+
+```toml
+[build-system]
+requires = ["maturin>=1"]
+build-backend = "maturin"
+
+[project]
+name = "your-package"
+dynamic = ["version"]
+```
+
+No reusable-workflow input changes; the existing
+`SETUPTOOLS_SCM_PRETEND_VERSION` injection in the build step already
+hands the planned version to `hatch-vcs` / `setuptools-scm`, and the
+existing `putitoutthere write-version` step already bumps
+`Cargo.toml` for the maturin path.
+
+**Deprecations removed.**
+
+- `pypi.writeVersion` and the `putitoutthere write-version` CLI
+  subcommand no longer rewrite static literals in place — both now
+  surface `PIOT_PYPI_STATIC_VERSION`. Previously they would
+  silently overwrite the literal.
+- The `replacePyProjectVersion` helper export and the
+  "bumps BOTH pyproject and sibling Cargo.toml on the static-literal
+  path" #276 carve-out are gone. Under the dynamic contract, `Cargo.toml`
+  alone is the bump target on the maturin path and the pyproject literal
+  has no role.
+
+**Behavior changes without code changes.**
+
+- `putitoutthere check` reports `PIOT_PYPI_STATIC_VERSION` against
+  every pypi package whose `pyproject.toml` has a literal
+  `[project].version`. Aggregated with the other preflight
+  findings — one round-trip, not one error at a time.
+- The publish path runs `requirePypiVersionSource` between the
+  existing `requireCratesMetadata` and the artifact-completeness
+  check; a misconfigured pypi tree fails fast there even if the
+  PR-time `check.yml` gate was skipped.
+
+**Verification.**
+
+```bash
+# In a repo that still declares a static version:
+$ putitoutthere check
+[PIOT_PYPI_STATIC_VERSION] packages/python/pyproject.toml declares a
+static `[project].version` literal. Use `[project].dynamic =
+["version"]` ...
+
+# After the migration above:
+$ putitoutthere check
+# (no findings, exits 0)
+```
+
+Tracked at #333.
+
+---
+
+### `npm` `bundle_cli` absorbed into the reusable workflow
+
+**Summary.** `kind = "npm"` packages with `build = "bundled-cli"`
+no longer need to author a `scripts/build.cjs` that performs the
+Rust cross-compile by hand. Declare `[package.bundle_cli]` in
+`putitoutthere.toml` — same schema as the pypi/maturin block from
+#282, minus `stage_to` (npm staging is determined entirely by the
+matrix row's `artifact_path`) — and the reusable workflow runs
+`rustup target add`, `cargo build --release --target <triple>
+--bin <bin>` against `crate_path`, and the copy-into-staging step
+itself. A defense-in-depth build-content guard asserts the staged
+binary exists before `actions/upload-artifact` runs, so a broken
+row never leaves the build runner. Mirror of the pypi wiring landed
+in #282; closes the seam that #287 patched (env-var contract
+between the consumer's build script and the engine).
+
+**Required changes.** None for additive adoption. To migrate an
+existing consumer with a hand-written `scripts/build.cjs`:
+
+Before (`putitoutthere.toml`):
+
+```toml
+[[package]]
+name    = "my-cli"
+kind    = "npm"
+build   = "bundled-cli"
+path    = "packages/ts-cli"
+globs   = ["packages/ts-cli/**", "crates/my-cli/**"]
+targets = [
+  "x86_64-unknown-linux-gnu",
+  "x86_64-apple-darwin",
+  # ...
+]
+```
+
+`scripts/build.cjs` (consumer-owned):
+
+```js
+const { execFileSync } = require('node:child_process');
+const { mkdirSync, copyFileSync } = require('node:fs');
+const target = process.env.TARGET;
+if (!target || target === 'main' || target === 'noarch') process.exit(0);
+const binName = 'my-cli';
+const ext = target.includes('windows') ? '.exe' : '';
+execFileSync('rustup', ['target', 'add', target], { stdio: 'inherit' });
+execFileSync('cargo', ['build', '--release', '--target', target, '--bin', binName],
+  { cwd: '../../crates/my-cli', stdio: 'inherit' });
+mkdirSync(`build/${target}`, { recursive: true });
+copyFileSync(`../../crates/my-cli/target/${target}/release/${binName}${ext}`,
+  `build/${target}/${binName}${ext}`);
+```
+
+`package.json` (consumer-owned):
+
+```json
+{ "scripts": { "build": "tsc && node scripts/build.cjs" } }
+```
+
+After (`putitoutthere.toml`):
+
+```toml
+[[package]]
+name    = "my-cli"
+kind    = "npm"
+build   = "bundled-cli"
+path    = "packages/ts-cli"
+globs   = ["packages/ts-cli/**", "crates/my-cli/**"]
+targets = [
+  "x86_64-unknown-linux-gnu",
+  "x86_64-apple-darwin",
+  # ...
+]
+
+[package.bundle_cli]
+bin        = "my-cli"
+crate_path = "crates/my-cli"
+# features            = ["cli"]     # if the binary is feature-gated
+# no_default_features = false
+```
+
+`scripts/build.cjs`: **deleted.** The `build` script in
+`package.json` typically becomes `"tsc"` (or whatever your
+TypeScript launcher build was minus the `node scripts/build.cjs`
+half).
+
+**During migration both shapes coexist.** A consumer that still
+ships `scripts/build.cjs` keeps working — the workflow's cargo
+build runs first, then `npm run build --if-present` runs the
+consumer's script (which sees `build/<triple>/` already populated
+and probably no-ops). There's no transitional broken state and
+no flag to set.
+
+**Constraint.** The binary must build with a vanilla
+`cargo build --release --target <triple> --bin <bin>` from
+`crate_path`. Optional `features` / `no_default_features` cover
+the `[[bin]] required-features = ["cli"]` shape. Crates that need
+arbitrary env vars, alternate manifests, Zig-cc cross
+toolchains, or other cargo flags don't fit the recipe and
+should keep their own release workflow.
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** Existing consumers
+without `[package.bundle_cli]` declared are unaffected — the
+workflow's cargo build / stage / guard steps are gated on
+`matrix.bundle_cli` being set, so consumers who still rely on
+their hand-written `scripts/build.cjs` see the byte-identical
+build matrix they saw before. The schema rejects `bundle_cli`
+declared on a non-bundled-cli npm package (or with empty
+`targets`), so a typo can't make the block silently inert.
+
+**Verification.** After upgrading, switch one consumer's
+`putitoutthere.toml` to declare `[package.bundle_cli]` and
+remove the `node scripts/build.cjs` half of their `build` script.
+The next release run's build job will, for each per-target row,
+include three new step lines: `bundle_cli — add Rust target`,
+`bundle_cli — cargo build for <triple> (<bin>)`, and
+`bundle_cli — stage binary into <artifact_path>`, followed by
+the `bundle_cli — verify <artifact_path>/<bin>` guard before
+`Upload artifact`. The published per-platform tarball, when
+downloaded and unpacked, contains the cross-compiled binary at
+the same path the launcher resolves it from.
+
+---
+
 ### New `check.yml` reusable workflow for PR-time config sanity
 
 **Summary.** `putitoutthere` now ships a third reusable workflow,

package/README.md

@@ -242,6 +242,7 @@ version = 1   # required; only 1 is valid today
 | `tag`     | string                 | dist-tag. Default `latest`.                          |
 | `build`   | string \| array        | `"napi"` \| `"bundled-cli"` (single mode), or an array of entries (each: a bare mode string or `{ mode, name }` with a [name template](#multi-mode-npm-family)). Omitted = vanilla. See [Recipes → Bundled-CLI npm family](#bundled-cli-npm-family). |
 | `targets` | (string \| object)[]   | Required when `build` is set.                        |
+| `[package.bundle_cli]` | sub-table | Declarative cross-compile for `build = "bundled-cli"` rows. Fields: `bin` (required), `crate_path` (default `"."`), `features` (default `[]`), `no_default_features` (default `false`). See [Recipes → Bundled-CLI npm family](#bundled-cli-npm-family). |
 
 > [!IMPORTANT]
 > **`package.json` MUST declare a non-empty `repository` field.** `putitoutthere`
@@ -537,64 +538,35 @@ const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' });
 process.exit(result.status ?? 1);
 ```
 
-You also author a `build` script in `package.json` that does the
-cross-compile. The reusable workflow runs the build matrix once
-per `(target × main)` row, sets `TARGET=<triple>` /
-`BUILD=bundled-cli` on the build step, and expects the script to
-stage the compiled binary under `build/<triple>/<bin-name>` (with
-`.exe` suffix on Windows). For every per-target row the engine
-then packages `build/<triple>/` as the platform sub-package's
-artifact; the `main` row is a no-op for the build script (the
-launcher above is committed source). A minimal `package.json`:
+Declare `[package.bundle_cli]` so the reusable workflow runs the
+cross-compile for you:
 
-```json
-{
-  "name": "my-cli",
-  "scripts": {
-    "build": "node scripts/build.cjs"
-  },
-  "bin": { "my-cli": "bin/my-cli.js" }
-}
+```toml
+[package.bundle_cli]
+bin        = "my-cli"            # `cargo build --bin <this>`
+crate_path = "crates/my-cli"     # `cargo build` runs from here; defaults to `.`
+# Optional, for crates that gate the CLI behind a Cargo feature
+# (the `[[bin]] required-features = ["cli"]` shape):
+# features            = ["cli"]
+# no_default_features = false
 ```
 
-`scripts/build.cjs`:
+For every per-target row the workflow runs `rustup target add
+<triple>`, then `cargo build --release --target <triple> --bin
+<bin>` from `crate_path`, and copies the resulting binary
+(with `.exe` suffix on Windows) into the per-target staging
+directory. The engine then packages that directory as the
+platform sub-package's artifact. The `main` row carries no
+per-target binary (the launcher above is committed source).
 
-```js
-const { execFileSync, spawnSync } = require('node:child_process');
-const { mkdirSync, copyFileSync } = require('node:fs');
-const { join } = require('node:path');
-const pkg = require('../package.json');
-
-const target = process.env.TARGET;
-// `target === 'main'` is the top-level row: nothing to compile,
-// the launcher is committed source.
-if (!target || target === 'main' || target === 'noarch') process.exit(0);
-
-const binName = Object.keys(pkg.bin || {})[0] || pkg.name;
-const ext = target.includes('windows') ? '.exe' : '';
-
-execFileSync('rustup', ['target', 'add', target], { stdio: 'inherit' });
-execFileSync(
-  'cargo',
-  ['build', '--release', '--target', target, '--bin', binName],
-  { cwd: '../../crates/my-cli', stdio: 'inherit' },
-);
-
-const dir = join('build', target);
-mkdirSync(dir, { recursive: true });
-copyFileSync(
-  join('../../crates/my-cli/target', target, 'release', binName + ext),
-  join(dir, binName + ext),
-);
-```
-
-The build is consumer-owned because `cargo build` flags
-(`--features`, env vars, alternate manifests, Zig-cc cross
-toolchains) vary too much across crates to bake into the
-workflow. For the simple "single workspace member, default
-features" case the script above is the entire integration; tweak
-it as your crate demands. `TARGET` and `BUILD` are the only env
-vars the workflow guarantees.
+> [!NOTE]
+> **Constraint.** The binary must build with a vanilla
+> `cargo build --release --target <triple> --bin <bin>` from
+> `crate_path`, optionally with `--features` /
+> `--no-default-features`. Crates that need env vars, alternate
+> manifests, Zig-cc cross toolchains, or other cargo flags
+> don't fit the recipe — write your own release workflow
+> instead.
 
 Each per-platform sub-package needs its own npm trusted-publisher
 registration (a policy on `my-cli` does not cover
@@ -741,18 +713,57 @@ def entrypoint():
     os.execv(binary, [str(binary), *sys.argv[1:]])
 ```
 
-## Dynamic-version PyPI gotcha
+## Python version source — required shape
+
+Every `kind = "pypi"` package **must** declare `[project].dynamic = ["version"]`
+in its `pyproject.toml`. Static `[project].version = "..."` literals are
+rejected at PR time by `putitoutthere check` (error code
+`PIOT_PYPI_STATIC_VERSION`) and again at publish time before any side effect.
+
+Why the requirement exists: putitoutthere does not edit `pyproject.toml`
+at release time (per the "no version computation" design commitment) — a
+static literal silently ships the previous release's wheel/sdist because
+the build backend reads whatever is on disk. The fix is the same across
+all supported Python build backends: declare the version as dynamic and
+let the backend derive it.
+
+### Recommended: `hatch-vcs`
+
+The blessed path for new Python packages. The version comes from the
+latest git tag at build time, so no manual `pyproject.toml` edit is ever
+needed.
+
+```toml
+[build-system]
+requires = ["hatchling", "hatch-vcs"]
+build-backend = "hatchling.build"
+
+[project]
+name = "your-package"
+dynamic = ["version"]
+
+[tool.hatch.version]
+source = "vcs"
+```
+
+The reusable workflow sets `SETUPTOOLS_SCM_PRETEND_VERSION` on the build
+step to the planned version, which `hatch-vcs` honors. Per-package
+variants like `SETUPTOOLS_SCM_PRETEND_VERSION_FOR_<PKG>` are silently
+ignored by `hatch-vcs`; only the global form works.
+
+### Also accepted
 
-If your `pyproject.toml` uses `[project].dynamic = ["version"]` with
-`hatch-vcs` or `setuptools-scm`, the build backend derives the version from
-the latest git tag at build time — which is still the **previous** release
-when the build runs. Without a handoff, the sdist ships as
-`<pkg>-X.Y.Z.devN.tar.gz` instead of `<pkg>-X.Y.Z.tar.gz`.
+- **`setuptools-scm`** (for setuptools-backed projects): same idea, same
+  env-var handoff. Add `setuptools-scm` to `[build-system].requires`,
+  declare `dynamic = ["version"]`, and the workflow's
+  `SETUPTOOLS_SCM_PRETEND_VERSION` injection covers the build step.
+- **Maturin** (for Python packages built from a Rust crate): pyproject
+  declares `dynamic = ["version"]`; the version source is the sibling
+  `Cargo.toml`'s `[package].version`. putitoutthere bumps `Cargo.toml`
+  before `maturin build` runs.
 
-The reusable workflow sets `SETUPTOOLS_SCM_PRETEND_VERSION` to the planned
-version on the build step, which both `setuptools-scm` and `hatch-vcs`
-honor. Per-package variants like `SETUPTOOLS_SCM_PRETEND_VERSION_FOR_<PKG>`
-are silently ignored by `hatch-vcs`; only the global form works.
+If a Python package can't fit any of these three shapes, it's outside
+putitoutthere's scope — write your own release workflow.
 
 ## Project layout
 

package/dist/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAiBH,MAAM,WAAW,YAAY;IAC3B;yEACqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;iDAC6C;IAC7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,GAAG,YAAY,EAAE,CAqC5D"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAqBH,MAAM,WAAW,YAAY;IAC3B;yEACqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;iDAC6C;IAC7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,GAAG,YAAY,EAAE,CAsC5D"}

package/dist/check.js

@@ -31,7 +31,7 @@ import { loadConfig } from './config.js';
 import { ErrorCodes } from './error-codes.js';
 import { matchesAny } from './glob.js';
 import { assertTripleSupported } from './handlers/npm-platform.js';
-import { checkCratesMetadata, checkProvenanceMetadata } from './preflight.js';
+import { checkCratesMetadata, checkProvenanceMetadata, checkPypiVersionSource, } from './preflight.js';
 import { formatTag } from './tag-template.js';
 import { normalizeTarget } from './types.js';
 /**
@@ -76,6 +76,7 @@ export function runChecks(opts) {
     checkNpmRepository(packages, findings);
     checkCratesPackageMetadata(packages, findings);
     checkPyprojectAndBundleCli(packages, cwd, findings);
+    checkPypiVersion(packages, findings);
     checkNpmTargetTriples(packages, findings);
     return findings;
 }
@@ -198,6 +199,14 @@ function checkPyprojectAndBundleCli(packages, cwd, findings) {
         }
     }
 }
+function checkPypiVersion(packages, findings) {
+    for (const f of checkPypiVersionSource(packages)) {
+        findings.push({
+            package: f.package,
+            message: `[${ErrorCodes.PYPI_STATIC_VERSION}] ${f.pyprojectPath} declares a static \`[project].version\` literal. Use \`[project].dynamic = ["version"]\` with hatch-vcs (recommended), setuptools-scm, or the maturin Cargo.toml-driven path — putitoutthere does not edit pyproject.toml at release time, so a literal silently ships the previous release.`,
+        });
+    }
+}
 function checkNpmTargetTriples(packages, findings) {
     for (const p of packages) {
         if (p.kind !== 'npm')

package/dist/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAoB,MAAM,YAAY,CAAC;AAiB/D;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,IAAkB;IAC1C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEnE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,mCAAmC,OAAO,8GAA8G;SAClK,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,mEAAmE;QACnE,8DAA8D;QAC9D,gDAAgD;QAChD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,GAAG,CAAC;YACJ,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;SACzD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,2BAA2B,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrD,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvC,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpD,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE1C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAE3E,SAAS,UAAU,CAAC,QAA4B,EAAE,QAAwB;IACxE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,wDAAwD;aACjF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA4B,EAC5B,GAAW,EACX,QAAwB;IAExB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC;6BACyB;IACzB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,8FAA8F;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAA4B,EAAE,QAAwB;IAC5E,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA4B,EAC5B,QAAwB;IAExB,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,UAAU,KAAK,0BAA0B,QAAQ,sEAAsE;aACjK,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA4B,EAAE,QAAwB;IAChF,KAAK,MAAM,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GACV,CAAC,CAAC,MAAM,KAAK,SAAS;YACpB,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,YAAY;YAClC,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,sCAAsC,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI,UAAU,CAAC,sBAAsB,KAAK,MAAM,0EAA0E;SACpI,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA4B,EAC5B,QAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI,UAAU,CAAC,uBAAuB,KAAK,CAAC,CAAC,aAAa,oDAAoD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE;SAC/M,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA4B,EAC5B,GAAW,EACX,QAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChC,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,+BAA+B,aAAa,EAAE;aACxD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QAClE,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC;QAC/B,gEAAgE;QAChE,8DAA8D;QAC9D,wBAAwB;QACxB,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC;YACnD,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,0BAA0B,SAAS,CAAC,UAAU,wCAAwC;aAChG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,0BAA0B,SAAS,CAAC,UAAU,qBAAqB;aAC7E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,mBAAmB,SAAS,CAAC,GAAG,qCAAqC,aAAa,oBAAoB,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACjL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA4B,EAC5B,QAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC/B,MAAM,OAAO,GAAI,CAAiC,CAAC,OAAO,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;YAC5C,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnD,qEAAqE;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oBAAoB;AACtB,CAAC;AAED,SAAS,gBAAgB,CAAC,aAAqB;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1C,yDAAyD;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;gBAChD,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,qEAAqE;IACrE,yDAAyD;IACzD,gEAAgE;IAChE,oEAAoE;IACpE,sCAAsC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAyC,CAAC;QAC7D,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAoB,MAAM,YAAY,CAAC;AAiB/D;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,IAAkB;IAC1C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEnE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,mCAAmC,OAAO,8GAA8G;SAClK,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,mEAAmE;QACnE,8DAA8D;QAC9D,gDAAgD;QAChD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,GAAG,CAAC;YACJ,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;SACzD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,2BAA2B,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrD,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvC,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpD,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE1C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAE3E,SAAS,UAAU,CAAC,QAA4B,EAAE,QAAwB;IACxE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,wDAAwD;aACjF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA4B,EAC5B,GAAW,EACX,QAAwB;IAExB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC;6BACyB;IACzB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,8FAA8F;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAA4B,EAAE,QAAwB;IAC5E,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA4B,EAC5B,QAAwB;IAExB,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,UAAU,KAAK,0BAA0B,QAAQ,sEAAsE;aACjK,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA4B,EAAE,QAAwB;IAChF,KAAK,MAAM,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GACV,CAAC,CAAC,MAAM,KAAK,SAAS;YACpB,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,YAAY;YAClC,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,sCAAsC,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI,UAAU,CAAC,sBAAsB,KAAK,MAAM,0EAA0E;SACpI,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA4B,EAC5B,QAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI,UAAU,CAAC,uBAAuB,KAAK,CAAC,CAAC,aAAa,oDAAoD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE;SAC/M,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA4B,EAC5B,GAAW,EACX,QAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChC,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,+BAA+B,aAAa,EAAE;aACxD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QAClE,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC;QAC/B,gEAAgE;QAChE,8DAA8D;QAC9D,wBAAwB;QACxB,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC;YACnD,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,0BAA0B,SAAS,CAAC,UAAU,wCAAwC;aAChG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,0BAA0B,SAAS,CAAC,UAAU,qBAAqB;aAC7E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,mBAAmB,SAAS,CAAC,GAAG,qCAAqC,aAAa,oBAAoB,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACjL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,QAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI,UAAU,CAAC,mBAAmB,KAAK,CAAC,CAAC,aAAa,+RAA+R;SAC/V,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA4B,EAC5B,QAAwB;IAExB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC/B,MAAM,OAAO,GAAI,CAAiC,CAAC,OAAO,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,CAAC,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;YAC5C,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnD,qEAAqE;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,oBAAoB;AACtB,CAAC;AAED,SAAS,gBAAgB,CAAC,aAAqB;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1C,yDAAyD;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;gBAChD,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,qEAAqE;IACrE,yDAAyD;IACzD,gEAAgE;IAChE,oEAAoE;IACpE,sCAAsC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAyC,CAAC;QAC7D,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/config.d.ts

@@ -86,6 +86,12 @@ declare const NPM_PKG: z.ZodObject<{
         triple: z.ZodString;
         runner: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>]>>>;
+    bundle_cli: z.ZodOptional<z.ZodObject<{
+        bin: z.ZodString;
+        crate_path: z.ZodDefault<z.ZodString>;
+        features: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        no_default_features: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
     name: z.ZodString;
     path: z.ZodString;
     globs: z.ZodArray<z.ZodString>;
@@ -154,6 +160,12 @@ declare const PACKAGE: z.ZodDiscriminatedUnion<[z.ZodObject<{
         triple: z.ZodString;
         runner: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>]>>>;
+    bundle_cli: z.ZodOptional<z.ZodObject<{
+        bin: z.ZodString;
+        crate_path: z.ZodDefault<z.ZodString>;
+        features: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        no_default_features: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
     name: z.ZodString;
     path: z.ZodString;
     globs: z.ZodArray<z.ZodString>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,CAAC,EAAiB,MAAM,KAAK,CAAC;AAgBvC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAID,QAAA,MAAM,KAAK;;kBAIA,CAAC;AAsFZ,QAAA,MAAM,UAAU;;;;;;;;;;;kBAQL,CAAC;AAIZ,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;kBA+BX,CAAC;AAkDJ,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+DT,CAAC;AAEL,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAAgE,CAAC;AAW9E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACvD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AACjD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,MAAM,WAAW,MAAM;IACrB,aAAa,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2BhD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAa/C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,CAAC,EAAiB,MAAM,KAAK,CAAC;AAgBvC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAID,QAAA,MAAM,KAAK;;kBAIA,CAAC;AAsFZ,QAAA,MAAM,UAAU;;;;;;;;;;;kBAQL,CAAC;AAIZ,QAAA,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;kBA+BX,CAAC;AAgFJ,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+FT,CAAC;AAEL,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAAgE,CAAC;AAW9E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACvD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AACjD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,MAAM,WAAW,MAAM;IACrB,aAAa,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2BhD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAa/C"}

package/dist/config.js

@@ -155,6 +155,35 @@ const PYPI_PKG = z
 // without `targets` would produce only an sdist, and the staged
 // binary wouldn't end up in any wheel.
 { message: 'bundle_cli requires at least one entry in `targets`' });
+// #298: opt-in "cross-compile a Rust CLI into every per-platform tarball"
+// recipe for `kind = "npm" && build = "bundled-cli"`. Mirror of the pypi
+// `[package.bundle_cli]` block — same shape minus `stage_to`. The npm
+// staging directory is fully determined by plan.ts via the matrix row's
+// `artifact_path` (`<pkg.path>/build/<triple>` for single-mode rows or
+// `<pkg.path>/build/<mode>-<triple>` for multi-mode rows), so there's
+// no consumer-visible knob analogous to maturin's `[tool.maturin].include`
+// path that `stage_to` aligns against.
+const NPM_BUNDLE_CLI = z
+    .object({
+    // `cargo build --bin <this>`. Required — the binary name is the
+    // one thing piot can't infer.
+    bin: z.string().min(1),
+    // Directory to run `cargo build` from. Defaults to repo root ("."),
+    // which works for most workspace Cargo.toml layouts. Override when
+    // the crate lives outside a workspace (e.g. `crates/my-cli`).
+    crate_path: z.string().min(1).default('.'),
+    // Forwarded to `cargo build --features <list>` (mirror of the pypi
+    // shape added in #300). Required for crates that gate the CLI
+    // behind a Cargo feature (`[[bin]] required-features = ["cli"]`).
+    // Empty list = no `--features` flag.
+    features: z.array(z.string().min(1)).default([]),
+    // Forwarded to `cargo build --no-default-features` (mirror of the
+    // pypi shape added in #300). Pairs with `features` for crates that
+    // want a minimal CLI binary built from a disjoint feature set than
+    // the library's defaults.
+    no_default_features: z.boolean().default(false),
+})
+    .strict();
 const NPM_BUILD_MODE = z.enum(['napi', 'bundled-cli']);
 // #dirsql: must mirror ALLOWED_NAME_VARIABLES in src/handlers/npm-platform.ts.
 // `{version}` is intentionally excluded — see resolvePlatformName.
@@ -208,6 +237,7 @@ const NPM_PKG = z
     tag: z.string().optional(),
     build: NPM_BUILD.optional(),
     targets: z.array(TARGET_ENTRY).optional(),
+    bundle_cli: NPM_BUNDLE_CLI.optional(),
 })
     .strict()
     .superRefine((p, ctx) => {
@@ -264,6 +294,35 @@ const NPM_PKG = z
             });
         }
     }
+    // #298: bundle_cli only applies to bundled-cli rows. Allowed shapes:
+    //   build = "bundled-cli"
+    //   build = ["bundled-cli", ...] / [{ mode = "bundled-cli", ... }, ...]
+    // Disallowed: bundle_cli with build = "napi" / undefined / array
+    // without a bundled-cli entry. The reusable workflow's cross-compile
+    // step gates on `matrix.build == 'bundled-cli'`, so a block declared
+    // on a non-bundled-cli package would be silently inert.
+    if (p.bundle_cli !== undefined) {
+        const hasBundledCli = p.build === 'bundled-cli' ||
+            (Array.isArray(p.build) &&
+                p.build.some((e) => (typeof e === 'string' ? e : e.mode) === 'bundled-cli'));
+        if (!hasBundledCli) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'bundle_cli is only valid when build = "bundled-cli" (or a build array containing a bundled-cli entry) on npm packages',
+                path: ['bundle_cli'],
+            });
+        }
+        // #298: bundle_cli implies per-target compilation. An npm package
+        // without `targets` would produce only the main (noarch) row, and
+        // the staged binary would have nowhere to land.
+        if (p.targets === undefined || p.targets.length === 0) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'bundle_cli requires at least one entry in `targets`',
+                path: ['bundle_cli'],
+            });
+        }
+    }
 });
 const PACKAGE = z.discriminatedUnion('kind', [CRATES_PKG, PYPI_PKG, NPM_PKG]);
 const FILE = z