putitoutthere 0.2.28 → 0.2.30

package/README.md

@@ -79,7 +79,7 @@ Optional inputs — `with:` block at the call site:
 |------------------|--------------|--------------------------------------------------------------------------|
 | `environment`    | `release`    | Your GitHub deployment environment is named differently.                 |
 | `node_version`   | `24`         | You need a specific Node version for `kind = "npm"` build steps.         |
-| `python_version` | `3.12`       | You need a specific Python version for `kind = "pypi"` build steps.      |
+| `python_version` | `3.12`       | Deprecated — no longer affects `kind = "pypi"` builds. Wheel coverage is inferred from `requires-python` or pinned via [`python_versions`](#kind--pypi). |
 
 ### 1b. Recommended: drop in `.github/workflows/check.yml`
 
@@ -89,7 +89,11 @@ duplicate package name, a `depends_on` cycle, a missing
 `[[package]].path` directory, globs that match no tracked files,
 a `tag_format` collision, a missing `repository` field on an
 `npm` package, missing `description` / `license` on a `crates`
-package, or a `bundle_cli` binary the crate doesn't declare — a
+package, a `bundle_cli` binary the crate doesn't declare, a
+`pyproject.toml` whose `[project].name` or `[build-system].build-backend`
+disagrees with the configured `name` / `build`, a `Cargo.toml` whose
+`[package].name` disagrees with the configured `name` / `crate`, or a
+`features` list referencing a feature the crate doesn't declare — a
 couple of seconds per PR, no per-target build, no `setup-python`
 / `setup-rust`. Findings are aggregated into one report so you
 fix everything in one push instead of chasing errors across re-
@@ -112,6 +116,11 @@ does not run `setup-node` against your sources, and never holds a
 publishable artifact in memory; its `permissions:` block is
 `contents: read` only.
 
+`check.yml` takes no inputs. The Node version is pinned internally
+because no consumer build steps run on this code path — the
+`node_version` knob on `build.yml` / `release.yml` does not exist
+here. Wire `check.yml` exactly as shown above.
+
 ### 1c. Recommended: drop in `.github/workflows/build-check.yml`
 
 Run the same plan + build matrix on every PR, with the publish step
@@ -224,14 +233,68 @@ version = 1   # required; only 1 is valid today
 | `features`            | string[] | Pass through to `cargo publish --features`.                |
 | `no_default_features` | bool     | Pass `--no-default-features` to `cargo publish` when true. |
 
+> [!IMPORTANT]
+> **`Cargo.toml` MUST match the configured shape.** Preflight verifies
+> these at PR time (via `check.yml`) and again before any publish side
+> effect:
+>
+> - `[package].name` matches `[[package]].name` (or the `crate` override) —
+>   `PIOT_CRATES_NAME_MISMATCH`.
+> - `[package].description` and `[package].license` (or `license-file`) are
+>   set — `PIOT_CRATES_MISSING_METADATA`.
+> - Every entry in `features` (and in `bundle_cli.features`, when set) is
+>   declared in `[features]` — `PIOT_CRATES_FEATURE_NOT_DECLARED`.
+> - When `bundle_cli.bin` is set, the target `Cargo.toml` declares a
+>   `[[bin]]` with that name (or the implicit binary derived from
+>   `[package].name`) — `PIOT_CRATES_MISSING_BIN`.
+> - When `[package].version.workspace = true`, an ancestor `Cargo.toml`
+>   declares `[workspace.package].version` —
+>   `PIOT_CRATES_WORKSPACE_VERSION_MISMATCH`.
+
 ### `kind = "pypi"`
 
 | Field        | Type                   | Notes                                              |
 |--------------|------------------------|----------------------------------------------------|
 | `pypi`       | string                 | Override `name` → PyPI registered name.            |
-| `build`      | enum                   | `maturin` \| `setuptools` \| `hatch`. Required.    |
+| `build`      | enum                   | `maturin` \| `setuptools` \| `hatch`. Optional. Default `setuptools`. |
 | `targets`    | (string \| object)[]   | Required when `build = "maturin"`. Triples or `{ triple, runner }` objects. |
 | `bundle_cli` | table                  | Opt-in: cross-compile a Rust CLI per target and stage it into each wheel. Only valid with `build = "maturin"`. See [Recipes → Rust CLI inside a PyPI wheel](#rust-cli-inside-a-pypi-wheel). |
+| `python_versions` | string[]          | Optional override for the CPython versions wheels are built for, e.g. `["3.12", "3.13"]`. When omitted, the set is inferred from `[project].requires-python` and putitoutthere's checked-in released-CPython list (see below). |
+
+> [!NOTE]
+> **`kind = "pypi"` builds a wheel for every supported Python version.**
+> By default the version set is inferred from `[project].requires-python`
+> in your `pyproject.toml` — `requires-python = ">=3.10"` builds wheels
+> for every released CPython minor version in putitoutthere's checked-in
+> list that it allows. No configuration is needed for the common case;
+> update putitoutthere when a new CPython minor should be included.
+> To pin an explicit subset, set `python_versions` on the package. The
+> build matrix fans across the resolved set (per `maturin` target); the
+> sdist and a pure-Python `hatch` wheel are version-agnostic and built
+> once. A `maturin` wheel that is itself Python-version-independent —
+> `[tool.maturin].bindings = "bin"` (a `py3-none` Rust-binary wheel) or a
+> pyo3 `abi3` extension (a `cp3x-abi3` wheel) — is likewise built once, on
+> the newest resolved interpreter, instead of duplicated across the set
+> (the duplicates otherwise collide at the `pypi-publish` download). When
+> neither `python_versions` nor a parseable `requires-python` is present, a
+> single wheel is built for `3.12`.
+
+> [!IMPORTANT]
+> **`pyproject.toml` MUST match the configured shape.** Preflight verifies
+> these at PR time (via `check.yml`) and again before any publish side
+> effect:
+>
+> - `[project].name` matches `[[package]].name` (or the `pypi` override) —
+>   `PIOT_PYPI_NAME_MISMATCH`.
+> - `[build-system].build-backend`, when set, matches the configured
+>   `build` mode (`maturin` → `maturin`, `setuptools` →
+>   `setuptools.build_meta`, `hatch` → `hatchling.build`) —
+>   `PIOT_PYPI_BUILD_BACKEND_MISMATCH`.
+> - When `[project].dynamic` contains `"version"`, either
+>   `[tool.hatch.version]` or `[tool.setuptools_scm]` declares the version
+>   source — `PIOT_PYPI_DYNAMIC_VERSION_NO_BACKEND`.
+> - When `bundle_cli` is set, `[tool.maturin].include` covers
+>   `bundle_cli.stage_to` — `PIOT_PYPI_MATURIN_INCLUDE_MISSING`.
 
 ### `kind = "npm"`
 
@@ -270,6 +333,19 @@ version = 1   # required; only 1 is valid today
 > (`"repository": "git+https://github.com/<owner>/<repo>.git"`) is also
 > accepted.
 
+> [!IMPORTANT]
+> **`package.json`'s `name` MUST match the configured shape.** Preflight
+> verifies this at PR time (via `check.yml`) and again before any publish
+> side effect:
+>
+> - `name` matches `[[package]].name` (or the `npm` override) —
+>   `PIOT_NPM_NAME_MISMATCH`. `npm publish` packs the manifest `name`, but
+>   `putitoutthere`'s idempotency check (`npm view <name>`) and the tag /
+>   release-URL bookkeeping use the configured name; a divergence breaks
+>   idempotency and can publish under an unexpected name. Use the `npm`
+>   override when the registered name differs from `[[package]].name`
+>   (e.g. a scoped `@scope/foo`).
+
 ### Example: polyglot Rust library
 
 One Rust crate feeds three artifacts:
@@ -345,6 +421,13 @@ scopes a non-default bump to specific packages.
 The trailer matches anywhere in the commit body. If multiple `release:` lines
 are present, the **last** one wins.
 
+The parser is intentionally lenient on three points: the key is
+case-insensitive (`Release:` and `RELEASE:` both match), leading
+whitespace before `release:` is allowed, and an empty package list
+(`release: minor []`) is equivalent to no list (`release: minor`).
+The documented forms above are the canonical shape; the leniency
+exists so commits authored under varied review styles still parse.
+
 ## Cascade
 
 A package cascades into the release plan when a commit changes any file
@@ -360,6 +443,61 @@ Each handler's first move on publish is `isPublished` — check the registry
 for the target version. Already there → skip cleanly. Lets you re-run failed
 releases without fighting registry-immutable-publish semantics.
 
+## Manual release
+
+Releases are normally change-driven: a package ships when a commit touches
+its `globs`. Sometimes you need to release a package that has **no new
+commits** — most often a re-release after a release-pipeline bug is fixed.
+The `release_packages` input on `release.yml` does exactly that.
+
+Wire it to a `workflow_dispatch` trigger in your caller workflow:
+
+```yaml
+on:
+  push: { branches: [main] }
+  workflow_dispatch:
+    inputs:
+      release_packages:
+        description: 'Comma-separated name[@bump|version] list'
+        required: true
+
+jobs:
+  release:
+    uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0
+    permissions:
+      contents: write
+      id-token: write
+    with:
+      release_packages: ${{ inputs.release_packages }}
+```
+
+Push-triggered runs leave `release_packages` empty (the `inputs` context is
+empty outside `workflow_dispatch`), so the normal change-detected path is
+unaffected. Triggering the workflow manually from the Actions tab with
+`release_packages` set takes over.
+
+Grammar — a comma-separated list of entries:
+
+```
+release_packages: lib-core@minor, lib-py@1.4.0, lib-js
+```
+
+Each entry is a package name optionally suffixed with a version spec:
+
+| Entry            | Effect                                                            |
+|------------------|-------------------------------------------------------------------|
+| `lib-js`         | Release `lib-js`, bumping its last tag by `patch`.                |
+| `lib-core@minor` | Release `lib-core`, bumping its last tag by `minor` (or `major`). |
+| `lib-py@1.4.0`   | Release `lib-py` at exactly `1.4.0`.                              |
+
+When `release_packages` is set, change detection and `depends_on` cascade
+are bypassed entirely: **exactly** the named packages are released, and
+nothing else — even a package with real pending changes is left out unless
+you name it. An explicit version is used verbatim and is not checked
+against the last tag; if that version is already on the registry the
+publish-phase `isPublished` check skips it cleanly. Naming a package that
+is not declared in `putitoutthere.toml` is an error.
+
 ## Trusted publishers
 
 OIDC trusted publishers are the default and recommended auth path.
@@ -501,42 +639,13 @@ The engine publishes a per-platform sub-package per target
 at the published version. npm's resolver installs exactly one sub-package
 at consumer install time.
 
-You author the launcher script that picks the right per-platform binary
-once. `package.json`:
-
-```json
-{
-  "name": "my-cli",
-  "bin": { "my-cli": "bin/my-cli.js" }
-}
-```
-
-`bin/my-cli.js`:
-
-```js
-#!/usr/bin/env node
-const { spawnSync } = require('node:child_process');
-const { platform, arch } = process;
-
-const triples = {
-  'linux-x64':    'x86_64-unknown-linux-gnu',
-  'linux-arm64':  'aarch64-unknown-linux-gnu',
-  'darwin-x64':   'x86_64-apple-darwin',
-  'darwin-arm64': 'aarch64-apple-darwin',
-  'win32-x64':    'x86_64-pc-windows-msvc',
-};
-
-const triple = triples[`${platform}-${arch}`];
-if (!triple) {
-  console.error(`my-cli: unsupported platform ${platform}-${arch}`);
-  process.exit(1);
-}
-
-const pkg = `my-cli-${triple}`;
-const binary = require.resolve(`${pkg}/bin/my-cli${platform === 'win32' ? '.exe' : ''}`);
-const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' });
-process.exit(result.status ?? 1);
-```
+With `[package.bundle_cli]` declared (below), the reusable workflow
+generates the per-platform launcher and the matching `package.json#bin`
+entry for you at build time — both writes are skipped when the consumer
+already has either piece committed, so overrides remain trivial. To
+override, commit your own `bin/<bundle_cli.bin>.js` at the package root
+(or set `package.json#bin` explicitly); the workflow leaves both alone
+when present.
 
 Declare `[package.bundle_cli]` so the reusable workflow runs the
 cross-compile for you:
@@ -568,6 +677,46 @@ per-target binary (the launcher above is committed source).
 > don't fit the recipe — write your own release workflow
 > instead.
 
+> [!NOTE]
+> **Linux binaries are statically linked against musl.** A
+> binary compiled directly against the GitHub-hosted runner's
+> glibc carries that glibc's version as a hard runtime
+> requirement, so the package would break on any older Linux.
+> The reusable workflow sidesteps that by swapping the Linux
+> compile triple from `*-linux-gnu*` to `*-linux-musl*` before
+> `cargo build` runs (the package's declared triple, the npm
+> platform-package name, and everything else consumer-visible
+> stay on the original `*-linux-gnu*`; only the binary inside
+> switches). Your CLI crate must be musl-compatible:
+>
+> - If it makes HTTPS calls, prefer `reqwest` with `rustls-tls`
+>   features (the default since reqwest v0.13).
+> - If it links openssl directly, enable the `vendored` feature
+>   on the `openssl` crate.
+> - If it uses `git2`, enable `vendored-openssl` /
+>   `vendored-libgit2`.
+> - If it uses `rusqlite` / `libsqlite3-sys`, enable the
+>   `bundled` feature.
+> - If it uses `libpq-sys` / `mysqlclient-sys` (Postgres /
+>   MySQL clients), prefer a pure-Rust alternative
+>   (`sqlx` with `rustls`, `postgres-native-tls` swapped for
+>   `postgres-rustls`) — these crates have no clean static path.
+>
+> The musl build fails loudly at release time with a linker
+> error if any of the above is missed, so a forgotten feature
+> never produces a broken release — only a blocked one.
+
+> [!WARNING]
+> **Do not run `cargo build` in `npm run build` when `[package.bundle_cli]` is configured.**
+> The reusable workflow compiles the Rust binary and stages it **after**
+> your `npm run build` step, so the engine's musl binary always overwrites
+> whatever `npm run build` staged. A build script that also runs cargo with
+> the raw `-linux-gnu` triple and copies to `build/<triple>/` does wasted
+> work silently. If you migrated from a hand-authored `scripts/build.cjs`
+> to `[package.bundle_cli]`, remove the cargo invocation; keep only steps
+> that compile or generate genuinely separate artifacts (TypeScript, assets,
+> etc.).
+
 Each per-platform sub-package needs its own npm trusted-publisher
 registration (a policy on `my-cli` does not cover
 `my-cli-x86_64-unknown-linux-gnu`).
@@ -687,8 +836,14 @@ no_default_features = false
 ```
 
 The reusable workflow cross-compiles the binary per target and stages it
-into the package source tree before maturin runs. Your `pyproject.toml`
-ties the staged binary into a `console_scripts` entry:
+into the package source tree before maturin runs. The same musl
+compatibility requirement that applies to bundled-cli npm packages
+applies here — see [Linux binaries are statically linked against
+musl](#bundled-cli-npm-family) above for the list of Cargo features to
+flip when the build fails on a system-library dependency.
+
+Your `pyproject.toml` ties the staged binary into a `console_scripts`
+entry:
 
 ```toml
 [project.scripts]
@@ -765,6 +920,153 @@ ignored by `hatch-vcs`; only the global form works.
 If a Python package can't fit any of these three shapes, it's outside
 putitoutthere's scope — write your own release workflow.
 
+## Error codes
+
+Every consumer-visible failure carries a stable `PIOT_*` code in the
+GitHub Actions `::error::` annotation and in the corresponding log
+line. Grep the run log for the code, then look it up here.
+
+| Code | What trips it | Where it fires |
+|------|---------------|----------------|
+| `PIOT_NPM_MISSING_REPOSITORY` | An npm package's `package.json` is missing a non-empty `repository` field. Required by `npm publish --provenance`. | PR-time (`check.yml`) and publish-time preflight. See [`kind = "npm"`](#kind--npm). |
+| `PIOT_NPM_NAME_MISMATCH` | `package.json`'s `name` disagrees with the configured `[[package]].name` (or `npm` override). `npm publish` packs the manifest name while piot's idempotency/tag bookkeeping uses the configured name. | PR-time and publish-time. See [`kind = "npm"`](#kind--npm). |
+| `PIOT_CRATES_NAME_MISMATCH` | `Cargo.toml`'s `[package].name` disagrees with the configured `[[package]].name` (or `crate` override). | PR-time and publish-time. See [`kind = "crates"`](#kind--crates). |
+| `PIOT_CRATES_MISSING_METADATA` | `Cargo.toml` lacks `[package].description` and/or `license` (or `license-file`). crates.io 400s without it. | PR-time and publish-time. |
+| `PIOT_CRATES_FEATURE_NOT_DECLARED` | A `features` entry (on the package or in `bundle_cli.features`) is not declared in the crate's `[features]` table. | PR-time and publish-time. |
+| `PIOT_CRATES_MISSING_BIN` | `bundle_cli.bin` is set but the target crate has no `[[bin]]` (or implicit-binary) of that name. | PR-time and publish-time. |
+| `PIOT_CRATES_WORKSPACE_VERSION_MISMATCH` | `Cargo.toml` declares `version.workspace = true` but no ancestor declares `[workspace.package].version`. | PR-time and publish-time. |
+| `PIOT_CRATES_FIRST_PUBLISH_TP_REJECTED` | crates.io returned 404 because the crate has never been published. Trusted Publishing binds to an already-published crate. Bootstrap with `CARGO_REGISTRY_TOKEN` (see [crates.io](#cratesio) above). | Publish-time only — the registry's response is the signal. |
+| `PIOT_PYPI_STATIC_VERSION` | `pyproject.toml` declares a static `[project].version = "..."` literal. Use `[project].dynamic = ["version"]` instead (see [Python version source](#python-version-source--required-shape)). | PR-time and publish-time. |
+| `PIOT_PYPI_NAME_MISMATCH` | `pyproject.toml`'s `[project].name` disagrees with the configured `[[package]].name` (or `pypi` override). | PR-time and publish-time. |
+| `PIOT_PYPI_BUILD_BACKEND_MISMATCH` | `[build-system].build-backend` is set but doesn't match the configured `build` mode (`maturin` → `maturin`, `setuptools` → `setuptools.build_meta`, `hatch` → `hatchling.build`). | PR-time and publish-time. |
+| `PIOT_PYPI_DYNAMIC_VERSION_NO_BACKEND` | `[project].dynamic` contains `"version"` but no `[tool.hatch.version]` or `[tool.setuptools_scm]` block declares the source. | PR-time and publish-time. |
+| `PIOT_PYPI_MATURIN_INCLUDE_MISSING` | `bundle_cli` is set on a maturin package but `[tool.maturin].include` doesn't cover `bundle_cli.stage_to`. The cross-compiled binary wouldn't land in any wheel. | PR-time and publish-time. |
+| `PIOT_AUTH_NO_TOKEN` | The publish job reached the registry-auth step with no token resolved (neither an OIDC-minted token nor a caller-provided long-lived token). Almost always means the reusable workflow's trusted-publisher exchange failed silently or the caller-provided secret was empty. | Publish-time only. |
+| `PIOT_PUBLISH_EMPTY_PLAN` | `publish` was invoked but `plan` returned zero rows for a reason other than `release: skip`. The reusable workflow's gate normally prevents this; if it fires, the gate was bypassed or the engine is inconsistent. | Publish-time only. |
+
+## Release health
+
+The registry is the source of truth; git tags are putitoutthere's record
+of what's been released (it derives "last released version" from them).
+A few features keep the two in sync — `status` reports drift, while
+`reconcile` and the publish-path auto-heal fix it.
+
+### `status` — registry-vs-tag drift report
+
+`status` reconciles, per package, the latest git tag against the
+registry's latest published version — over the public registry APIs
+(crates.io / npm / PyPI), no auth required — and flags any drift:
+
+```
+package     tag      registry  state
+mypkg-rust  —        0.0.1     ⚠ published, untagged
+mypkg-npm   0.0.1    0.0.1     ✓ in sync
+mypkg-py    0.0.1    0.0.1     ✓ in sync
+```
+
+| State | Meaning |
+|-------|---------|
+| `in sync` | the latest tag matches the registry's latest version |
+| `unreleased` | no tag, and nothing published |
+| `published, untagged` | live on the registry but no tag — the drift that strands a package |
+| `tagged, unpublished` | tagged, but the registry doesn't have that version |
+| `version mismatch` | the tag and the registry disagree on the latest version |
+| `registry unreachable` | the registry couldn't be reached (reported, never gated) |
+
+Why it matters: a half-failed run that publishes a version but never
+tags it leaves the package `published, untagged`. Because the planner
+reads "last released" from tags, that package then looks unreleased,
+skips its already-live version forever, and can never bump — while its
+dependents keep bumping past it. `status` surfaces that in one line.
+
+- `--check` exits non-zero on any drift state — run it as a CI gate so
+  drift can't merge unnoticed.
+- `--json` emits the rows as machine-readable JSON.
+
+`putitoutthere` is published to npm, so run it with `npx` (it reads your
+git tags, so make sure they're fetched):
+
+```bash
+# Report drift across every package in putitoutthere.toml:
+npx putitoutthere status
+
+# Exit non-zero if anything has drifted:
+npx putitoutthere status --check
+echo $?            # 1 when drifted, 0 when in sync
+
+# Machine-readable rows:
+npx putitoutthere status --json
+# [{"package":"mypkg-rust","kind":"crates","tag":null,"tagVersion":null,
+#   "registry":"0.0.1","registryUnreachable":false,
+#   "state":"published, untagged","drift":true}, …]
+```
+
+To gate every PR on release-state drift, add a step to any workflow —
+checking out tags so `status` can compare them against the registry:
+
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0          # status compares local tags vs the registry
+- run: npx putitoutthere status --check
+```
+
+### `reconcile` — backfill missing tags on demand
+
+`reconcile` fixes the `published, untagged` drift `status` reports: for
+every package that is live on its registry but has no tag, it creates the
+missing tag (and pushes it). It's the on-demand companion to auto-heal —
+where auto-heal only fires for a package caught in a release run,
+`reconcile` heals an **already-stuck** package without a release, so you
+can run it the moment `status` flags drift.
+
+The tag is pointed at a sibling package already tagged at that version —
+the real release commit, e.g. a crate left untagged while its npm/PyPI
+siblings tagged the same merge — and at `HEAD` when no sibling tag exists.
+It reuses the exact drift detection `status` reports and the exact tagging
+`publish` heals with, so it can never create a tag a release wouldn't.
+
+- Idempotent: a re-run is a no-op (already-correct tags are untouched).
+- `--dry-run` reports what it would create without writing anything.
+- `--json` emits the actions.
+
+```bash
+# Backfill any missing tags across putitoutthere.toml:
+npx putitoutthere reconcile
+
+# Preview without writing:
+npx putitoutthere reconcile --dry-run
+# mypkg-rust: 0.0.1 live, no tag → would create mypkg-rust-v0.0.1 at a1b2c3d (sibling)
+
+# Machine-readable actions:
+npx putitoutthere reconcile --json
+```
+
+Run it in CI with the release job's permissions (it pushes the tag),
+checking out tags first:
+
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0          # reconcile compares local tags vs the registry
+- run: npx putitoutthere reconcile
+```
+
+### Auto-heal
+
+The most common drift — a version live on the registry but missing its
+tag — heals itself. **There's nothing to run**: when a release runs and
+`publish` finds a version already published, it writes the missing tag
+(at the release commit) instead of skipping silently. A package stranded
+by an earlier half-failed run recovers on its **next release run** — it
+has no tag, so it's force-selected into the plan, found already-published,
+and tagged. No manual tag surgery. Idempotent: already-tagged packages
+are untouched.
+
+If the repo has nothing else to release, don't wait for the next run —
+heal the stuck package now with the `reconcile` command above, or trigger
+a [manual release](#manual-release) for it (`release_packages`).
+
 ## Project layout
 
 - [`CHANGELOG.md`](./CHANGELOG.md) — per-release changes.

package/action.yml

@@ -25,6 +25,15 @@ inputs:
       build matrix's `version` row from the planner.
     required: false
     default: ''
+  release_packages:
+    description: >-
+      Manual-release spec, forwarded to `plan` / `publish` as
+      `--release-packages`. Comma-separated `name[@<bump|version>]`
+      entries; when set, change detection is bypassed and exactly the
+      named packages are released. Empty => normal change-detected
+      planning. Ignored for other commands.
+    required: false
+    default: ''
   fail_on_error:
     description: 'If true, non-zero CLI exit codes fail the step.'
     required: false

package/dist/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmC1C"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAiD1C"}

package/dist/action.js

@@ -13,6 +13,7 @@ export async function main() {
     const command = process.env.INPUT_COMMAND ?? '';
     const workingDirectory = process.env.INPUT_WORKING_DIRECTORY ?? '';
     const versionInput = process.env.INPUT_VERSION ?? '';
+    const releasePackages = process.env.INPUT_RELEASE_PACKAGES ?? '';
     const failOnError = (process.env.INPUT_FAIL_ON_ERROR ?? 'true').toLowerCase() !== 'false';
     if (!command) {
         process.stderr.write('putitoutthere action: missing required input `command`\n');
@@ -20,19 +21,40 @@ export async function main() {
     }
     // #276: write-version uses a different argv shape — `--path` (the
     // package dir, sourced from `working_directory`) and `--version`.
-    // No `--json`: the subcommand emits a single human line; there's
-    // no structured output to consume.
+    // #366: write-crate-version shares that shape — `--path` (the
+    // bundled-cli crate dir, sourced from `working_directory`) and
+    // `--version`.
+    // #299: write-launcher takes `--path` (the matrix row's package dir,
+    // sourced from `working_directory`) and reads `--cwd` from
+    // process.cwd() — the runner working dir is the repo root, where
+    // `putitoutthere.toml` lives.
+    // No `--json` on any of them: these subcommands emit a single human
+    // line; there's no structured output to consume.
     const argv = ['node', 'putitoutthere', command];
-    if (command === 'write-version') {
-        if (workingDirectory)
+    if (command === 'write-version' || command === 'write-crate-version') {
+        if (workingDirectory) {
             argv.push('--path', workingDirectory);
-        if (versionInput)
+        }
+        if (versionInput) {
             argv.push('--version', versionInput);
+        }
+    }
+    else if (command === 'write-launcher') {
+        if (workingDirectory) {
+            argv.push('--path', workingDirectory);
+        }
     }
     else {
         argv.push('--json');
-        if (workingDirectory)
+        if (workingDirectory) {
             argv.push('--cwd', workingDirectory);
+        }
+        // Manual release: forward `release_packages` to the CLI. Only
+        // `plan` / `publish` act on it; the flag parses harmlessly for the
+        // other commands that land in this branch.
+        if (releasePackages) {
+            argv.push('--release-packages', releasePackages);
+        }
     }
     const code = await run(argv);
     if (code !== 0 && !failOnError) {

package/dist/action.js.map

@@ -1 +1 @@
-{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACrD,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IAExE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,CAC3D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,mCAAmC;IACnC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,IAAI,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,IAAI,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,uEAAuE;AACvE,iEAAiE;AACjE,sEAAsE;AACtE,kEAAkE;AAClE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,gEAAgE;AAChE,uDAAuD;AACvD,oFAAoF;AACpF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACrD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;IACjE,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IAExE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,CAC3D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,8DAA8D;IAC9D,+DAA+D;IAC/D,eAAe;IACf,qEAAqE;IACrE,2DAA2D;IAC3D,iEAAiE;IACjE,8BAA8B;IAC9B,oEAAoE;IACpE,iDAAiD;IACjD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;QACrE,IAAI,gBAAgB,EAAE,CAAC;YAAA,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAAA,CAAC;QAC9D,IAAI,YAAY,EAAE,CAAC;YAAA,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAAA,CAAC;IAC3D,CAAC;SAAM,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACxC,IAAI,gBAAgB,EAAE,CAAC;YAAA,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAAA,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,IAAI,gBAAgB,EAAE,CAAC;YAAA,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAAA,CAAC;QAC7D,8DAA8D;QAC9D,mEAAmE;QACnE,2CAA2C;QAC3C,IAAI,eAAe,EAAE,CAAC;YAAA,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;QAAA,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,IAAI,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,uEAAuE;AACvE,iEAAiE;AACjE,sEAAsE;AACtE,kEAAkE;AAClE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,gEAAgE;AAChE,uDAAuD;AACvD,oFAAoF;AACpF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}

package/dist/cascade.js

@@ -26,14 +26,16 @@ import { matchesAny } from './glob.js';
 export function computeCascade(packages, changedFilesByPackage) {
     assertNoCycles(packages);
     const byName = new Map();
-    for (const p of packages)
+    for (const p of packages) {
         byName.set(p.name, p);
+    }
     // Pass 1: direct glob matches against this package's own diff.
     const cascaded = new Set();
     for (const p of packages) {
         const files = changedFilesByPackage.get(p.name);
-        if (!files)
+        if (!files) {
             continue;
+        }
         for (const f of files) {
             if (matchesAny(p.globs, f)) {
                 cascaded.add(p.name);
@@ -46,8 +48,9 @@ export function computeCascade(packages, changedFilesByPackage) {
     while (changed) {
         changed = false;
         for (const p of packages) {
-            if (cascaded.has(p.name))
+            if (cascaded.has(p.name)) {
                 continue;
+            }
             /* v8 ignore next -- depends_on default is always [] from the Zod schema */
             const deps = p.depends_on ?? [];
             if (deps.some((d) => cascaded.has(d))) {
@@ -67,15 +70,18 @@ export function computeCascade(packages, changedFilesByPackage) {
  */
 export function assertNoCycles(packages) {
     const byName = new Map();
-    for (const p of packages)
+    for (const p of packages) {
         byName.set(p.name, p);
+    }
     const color = new Map();
-    for (const p of packages)
+    for (const p of packages) {
         color.set(p.name, 'white');
+    }
     const visit = (name, path) => {
         const c = color.get(name);
-        if (c === 'black')
+        if (c === 'black') {
             return;
+        }
         if (c === 'gray') {
             const cycle = [...path.slice(path.indexOf(name)), name].join(' → ');
             throw new Error(`putitoutthere.toml: depends_on cycle: ${cycle}`);
@@ -86,8 +92,9 @@ export function assertNoCycles(packages) {
         // a name we iterated over packages for — that list IS the keys of
         // byName, so this branch is unreachable under normal use. Defensive.
         /* v8 ignore next */
-        if (!node)
+        if (!node) {
             return;
+        }
         /* v8 ignore next -- depends_on default is always [] from the Zod schema */
         for (const dep of node.depends_on ?? []) {
             if (!byName.has(dep)) {

package/dist/cascade.js.map

@@ -1 +1 @@
-{"version":3,"file":"cascade.js","sourceRoot":"","sources":["../src/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAWvC,MAAM,UAAU,cAAc,CAC5B,QAA4B,EAC5B,qBAA4C;IAE5C,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,2EAA2E;YAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAA4B;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAGhD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAc,EAAQ,EAAE;QACnD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,oBAAoB;QACpB,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,2EAA2E;QAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,8BAA8B,GAAG,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"cascade.js","sourceRoot":"","sources":["../src/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAWvC,MAAM,UAAU,cAAc,CAC5B,QAA4B,EAC5B,qBAA4C;IAE5C,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAAA,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAAA,CAAC;IAElD,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YACrC,2EAA2E;YAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAA4B;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAAA,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAAA,CAAC;IAGlD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAAA,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAAA,CAAC;IAEvD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAc,EAAQ,EAAE;QACnD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAAA,OAAO;QAAA,CAAC;QAC5B,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,oBAAoB;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YAAA,OAAO;QAAA,CAAC;QACpB,2EAA2E;QAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,8BAA8B,GAAG,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/check-crate-size.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Crate-size pre-merge check (#362).
+ *
+ * crates.io rejects any `.crate` upload over 10 MiB with `413 Payload
+ * Too Large`, but `cargo publish` surfaces that only mid-release, after
+ * the verification build has compiled the crate and every transitive
+ * dep — the release surprise the no-surprises design commitment exists
+ * to eliminate. `checkCratesPackageSize` reproduces the tarball with
+ * `cargo package` at PR time, so a tracked symlink dragging a build
+ * tree into the crate, or a missing `[package].exclude`, is caught on
+ * the PR that introduces it.
+ *
+ * Wired into `runChecks` (`check.ts`). The end-to-end path through the
+ * config loader is covered by
+ * `test/integration/check-crate-size.integration.test.ts`.
+ */
+import type { CheckFinding } from './check.js';
+import type { Package } from './config.js';
+/**
+ * One finding per `kind = "crates"` package whose `cargo package`
+ * `.crate` is over crates.io's upload limit. Empty when every crate is
+ * within the limit — or when a crate's size can't be determined, in
+ * which case the check skips it rather than inventing a finding.
+ */
+export declare function checkCratesPackageSize(packages: readonly Package[]): CheckFinding[];
+//# sourceMappingURL=check-crate-size.d.ts.map