putitoutthere 0.2.28 → 0.2.30

package/dist/error-codes.d.ts

@@ -36,6 +36,15 @@ export declare const ErrorCodes: {
      *  declares. Failing at preflight prevents wasting a build run on
      *  a precondition checkable in milliseconds. #280. */
     readonly NPM_MISSING_REPOSITORY: "PIOT_NPM_MISSING_REPOSITORY";
+    /** An npm package's `package.json` declares a `name` that differs from
+     *  the `[[package]].name` configured in `putitoutthere.toml` (or the
+     *  `npm` override when set). `npm publish` packs the manifest `name`,
+     *  but the engine's idempotency probe (`npm view <name>`) and the
+     *  tag/URL bookkeeping use the configured name — so a divergence
+     *  silently breaks idempotency and can publish under an unexpected
+     *  name. The npm analogue of PIOT_PYPI_NAME_MISMATCH /
+     *  PIOT_CRATES_NAME_MISMATCH. #301. */
+    readonly NPM_NAME_MISMATCH: "PIOT_NPM_NAME_MISMATCH";
     /** A crates package's `Cargo.toml` is missing one or more
      *  required `[package]` metadata fields (`description` and
      *  `license`/`license-file`). crates.io rejects the publish with
@@ -54,6 +63,86 @@ export declare const ErrorCodes: {
      *  (the recommended path; setuptools-scm and the maturin
      *  Cargo.toml-driven path are equally valid). */
     readonly PYPI_STATIC_VERSION: "PIOT_PYPI_STATIC_VERSION";
+    /** A pypi package's `pyproject.toml` declares a `[project].name` that
+     *  differs from the `[[package]].name` configured in
+     *  `putitoutthere.toml` (or the `pypi` override when set). The build
+     *  tool will pack the wrong name and the upload either lands on the
+     *  wrong registered project or 403s with a confusing "no such project"
+     *  message. #301. */
+    readonly PYPI_NAME_MISMATCH: "PIOT_PYPI_NAME_MISMATCH";
+    /** A pypi package's `[build-system].build-backend` is set but does
+     *  not match the configured `build` mode (e.g. `build = "maturin"`
+     *  but the pyproject declares `hatchling.build`). The build tool
+     *  surfaces a confusing tail-end error long after maturin has run.
+     *  #301. */
+    readonly PYPI_BUILD_BACKEND_MISMATCH: "PIOT_PYPI_BUILD_BACKEND_MISMATCH";
+    /** A pypi package declares `dynamic = ["version"]` but no
+     *  version-source backend block (`[tool.hatch.version]` /
+     *  `[tool.setuptools_scm]`) is present, so the build backend has no
+     *  way to compute a version at pack time. #301. */
+    readonly PYPI_DYNAMIC_VERSION_NO_BACKEND: "PIOT_PYPI_DYNAMIC_VERSION_NO_BACKEND";
+    /** A maturin pypi package declares `[package.bundle_cli]` but
+     *  `[tool.maturin].include` does not cover the configured
+     *  `bundle_cli.stage_to` path, so the cross-compiled binary will
+     *  never make it inside the wheel. The post-build wheel-content
+     *  guard catches it, but only after maturin has run. #301. */
+    readonly PYPI_MATURIN_INCLUDE_MISSING: "PIOT_PYPI_MATURIN_INCLUDE_MISSING";
+    /** A crates package's `Cargo.toml` declares a `[package].name` that
+     *  differs from the `[[package]].name` configured in
+     *  `putitoutthere.toml` (or the `crate` override when set). cargo
+     *  publish will pack the wrong crate, often 404'ing on the registry
+     *  side after a verification build that took 10+ minutes. #301. */
+    readonly CRATES_NAME_MISMATCH: "PIOT_CRATES_NAME_MISMATCH";
+    /** A `bundle_cli.bin` is configured but the target `Cargo.toml` has
+     *  no `[[bin]]` table with that name (and the implicit-bin name
+     *  derived from `[package].name` does not match either). `cargo
+     *  build --bin <bin>` fails with `no bin target named ...` mid-
+     *  build. #301. */
+    readonly CRATES_MISSING_BIN: "PIOT_CRATES_MISSING_BIN";
+    /** A `features` list (either on a `kind = "crates"` package or on
+     *  a `bundle_cli` block) references a feature that the target
+     *  `Cargo.toml` does not declare in `[features]`. `cargo build
+     *  --features <list>` fails with `Package ... does not have these
+     *  features`. #301. */
+    readonly CRATES_FEATURE_NOT_DECLARED: "PIOT_CRATES_FEATURE_NOT_DECLARED";
+    /** A crates package's `Cargo.toml` declares `version.workspace =
+     *  true`, but no ancestor `Cargo.toml` with a `[workspace]` table
+     *  declares `[workspace.package].version`. cargo fails with
+     *  `error: failed to inherit "version" from workspace`. #301. */
+    readonly CRATES_WORKSPACE_VERSION_MISMATCH: "PIOT_CRATES_WORKSPACE_VERSION_MISMATCH";
+    /** crates.io rejected `cargo publish` because the crate has never been
+     *  published. Trusted Publishing on crates.io binds to an
+     *  already-published crate — the OIDC mint succeeds, the exchanged
+     *  token reaches cargo, but the registry returns 404 ("crate `<name>`
+     *  does not exist or you do not have permission to publish to it").
+     *  The fix is one bootstrap publish with a classic `CARGO_REGISTRY_TOKEN`;
+     *  trusted publishing works for every release after. #284. */
+    readonly CRATES_FIRST_PUBLISH_TP_REJECTED: "PIOT_CRATES_FIRST_PUBLISH_TP_REJECTED";
+    /** A crates package's `.crate`, as produced by `cargo package`, is
+     *  larger than crates.io's 10 MiB (`10485760`-byte) upload limit.
+     *  `cargo publish` would fail with `413 Payload Too Large` only
+     *  mid-release, after the verification build; `runChecks` reproduces
+     *  the tarball at PR time so the regression is caught before merge.
+     *  A tracked symlink pointing into a build directory, or a missing
+     *  `[package].exclude`, is the usual cause of build output landing
+     *  in the crate. #362. */
+    readonly CRATES_PACKAGE_TOO_LARGE: "PIOT_CRATES_PACKAGE_TOO_LARGE";
+    /** A manifest's declared repository URL resolves to a different
+     *  `owner/repo` than the GitHub repository the workflow is running
+     *  from (`GITHUB_REPOSITORY`). npm's provenance verification compares
+     *  `package.json#repository.url` against the OIDC source claim and
+     *  returns a 422 after artifact upload — Cargo.toml `[package].repository`
+     *  and pyproject.toml `[project.urls]` carry the same risk on
+     *  crates.io / PyPI trusted-publisher paths. Failing at preflight
+     *  catches the mismatch in milliseconds. */
+    readonly REPO_URL_MISMATCH: "PIOT_REPO_URL_MISMATCH";
+    /** The GitHub repository the workflow is running from is private.
+     *  putitoutthere refuses to publish from a private repository:
+     *  npm provenance attestations embed a source-ref pointer that
+     *  consumers cannot dereference when the repo is private, and the
+     *  same source-visibility expectation underpins the trusted-publisher
+     *  story on the other registries. */
+    readonly REPO_PRIVATE: "PIOT_REPO_PRIVATE";
 };
 export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 /**

package/dist/error-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;IAE9C;;;;;0DAKsD;;IAEtD;;;;;;iCAM6B;;IAE7B;;;;;;;;qDAQiD;;CAEzC,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EAM/C,CAAC"}
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;IAE9C;;;;;0DAKsD;;IAEtD;;;;;;;2CAOuC;;IAEvC;;;;;;iCAM6B;;IAE7B;;;;;;;;qDAQiD;;IAEjD;;;;;yBAKqB;;IAErB;;;;gBAIY;;IAEZ;;;uDAGmD;;IAEnD;;;;kEAI8D;;IAE9D;;;;uEAImE;;IAEnE;;;;uBAImB;;IAEnB;;;;2BAIuB;;IAEvB;;;qEAGiE;;IAEjE;;;;;;kEAM8D;;IAE9D;;;;;;;8BAO0B;;IAE1B;;;;;;;gDAO4C;;IAE5C;;;;;yCAKqC;;CAE7B,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EAmB/C,CAAC"}

package/dist/error-codes.js

@@ -36,6 +36,15 @@ export const ErrorCodes = {
      *  declares. Failing at preflight prevents wasting a build run on
      *  a precondition checkable in milliseconds. #280. */
     NPM_MISSING_REPOSITORY: 'PIOT_NPM_MISSING_REPOSITORY',
+    /** An npm package's `package.json` declares a `name` that differs from
+     *  the `[[package]].name` configured in `putitoutthere.toml` (or the
+     *  `npm` override when set). `npm publish` packs the manifest `name`,
+     *  but the engine's idempotency probe (`npm view <name>`) and the
+     *  tag/URL bookkeeping use the configured name — so a divergence
+     *  silently breaks idempotency and can publish under an unexpected
+     *  name. The npm analogue of PIOT_PYPI_NAME_MISMATCH /
+     *  PIOT_CRATES_NAME_MISMATCH. #301. */
+    NPM_NAME_MISMATCH: 'PIOT_NPM_NAME_MISMATCH',
     /** A crates package's `Cargo.toml` is missing one or more
      *  required `[package]` metadata fields (`description` and
      *  `license`/`license-file`). crates.io rejects the publish with
@@ -54,6 +63,86 @@ export const ErrorCodes = {
      *  (the recommended path; setuptools-scm and the maturin
      *  Cargo.toml-driven path are equally valid). */
     PYPI_STATIC_VERSION: 'PIOT_PYPI_STATIC_VERSION',
+    /** A pypi package's `pyproject.toml` declares a `[project].name` that
+     *  differs from the `[[package]].name` configured in
+     *  `putitoutthere.toml` (or the `pypi` override when set). The build
+     *  tool will pack the wrong name and the upload either lands on the
+     *  wrong registered project or 403s with a confusing "no such project"
+     *  message. #301. */
+    PYPI_NAME_MISMATCH: 'PIOT_PYPI_NAME_MISMATCH',
+    /** A pypi package's `[build-system].build-backend` is set but does
+     *  not match the configured `build` mode (e.g. `build = "maturin"`
+     *  but the pyproject declares `hatchling.build`). The build tool
+     *  surfaces a confusing tail-end error long after maturin has run.
+     *  #301. */
+    PYPI_BUILD_BACKEND_MISMATCH: 'PIOT_PYPI_BUILD_BACKEND_MISMATCH',
+    /** A pypi package declares `dynamic = ["version"]` but no
+     *  version-source backend block (`[tool.hatch.version]` /
+     *  `[tool.setuptools_scm]`) is present, so the build backend has no
+     *  way to compute a version at pack time. #301. */
+    PYPI_DYNAMIC_VERSION_NO_BACKEND: 'PIOT_PYPI_DYNAMIC_VERSION_NO_BACKEND',
+    /** A maturin pypi package declares `[package.bundle_cli]` but
+     *  `[tool.maturin].include` does not cover the configured
+     *  `bundle_cli.stage_to` path, so the cross-compiled binary will
+     *  never make it inside the wheel. The post-build wheel-content
+     *  guard catches it, but only after maturin has run. #301. */
+    PYPI_MATURIN_INCLUDE_MISSING: 'PIOT_PYPI_MATURIN_INCLUDE_MISSING',
+    /** A crates package's `Cargo.toml` declares a `[package].name` that
+     *  differs from the `[[package]].name` configured in
+     *  `putitoutthere.toml` (or the `crate` override when set). cargo
+     *  publish will pack the wrong crate, often 404'ing on the registry
+     *  side after a verification build that took 10+ minutes. #301. */
+    CRATES_NAME_MISMATCH: 'PIOT_CRATES_NAME_MISMATCH',
+    /** A `bundle_cli.bin` is configured but the target `Cargo.toml` has
+     *  no `[[bin]]` table with that name (and the implicit-bin name
+     *  derived from `[package].name` does not match either). `cargo
+     *  build --bin <bin>` fails with `no bin target named ...` mid-
+     *  build. #301. */
+    CRATES_MISSING_BIN: 'PIOT_CRATES_MISSING_BIN',
+    /** A `features` list (either on a `kind = "crates"` package or on
+     *  a `bundle_cli` block) references a feature that the target
+     *  `Cargo.toml` does not declare in `[features]`. `cargo build
+     *  --features <list>` fails with `Package ... does not have these
+     *  features`. #301. */
+    CRATES_FEATURE_NOT_DECLARED: 'PIOT_CRATES_FEATURE_NOT_DECLARED',
+    /** A crates package's `Cargo.toml` declares `version.workspace =
+     *  true`, but no ancestor `Cargo.toml` with a `[workspace]` table
+     *  declares `[workspace.package].version`. cargo fails with
+     *  `error: failed to inherit "version" from workspace`. #301. */
+    CRATES_WORKSPACE_VERSION_MISMATCH: 'PIOT_CRATES_WORKSPACE_VERSION_MISMATCH',
+    /** crates.io rejected `cargo publish` because the crate has never been
+     *  published. Trusted Publishing on crates.io binds to an
+     *  already-published crate — the OIDC mint succeeds, the exchanged
+     *  token reaches cargo, but the registry returns 404 ("crate `<name>`
+     *  does not exist or you do not have permission to publish to it").
+     *  The fix is one bootstrap publish with a classic `CARGO_REGISTRY_TOKEN`;
+     *  trusted publishing works for every release after. #284. */
+    CRATES_FIRST_PUBLISH_TP_REJECTED: 'PIOT_CRATES_FIRST_PUBLISH_TP_REJECTED',
+    /** A crates package's `.crate`, as produced by `cargo package`, is
+     *  larger than crates.io's 10 MiB (`10485760`-byte) upload limit.
+     *  `cargo publish` would fail with `413 Payload Too Large` only
+     *  mid-release, after the verification build; `runChecks` reproduces
+     *  the tarball at PR time so the regression is caught before merge.
+     *  A tracked symlink pointing into a build directory, or a missing
+     *  `[package].exclude`, is the usual cause of build output landing
+     *  in the crate. #362. */
+    CRATES_PACKAGE_TOO_LARGE: 'PIOT_CRATES_PACKAGE_TOO_LARGE',
+    /** A manifest's declared repository URL resolves to a different
+     *  `owner/repo` than the GitHub repository the workflow is running
+     *  from (`GITHUB_REPOSITORY`). npm's provenance verification compares
+     *  `package.json#repository.url` against the OIDC source claim and
+     *  returns a 422 after artifact upload — Cargo.toml `[package].repository`
+     *  and pyproject.toml `[project.urls]` carry the same risk on
+     *  crates.io / PyPI trusted-publisher paths. Failing at preflight
+     *  catches the mismatch in milliseconds. */
+    REPO_URL_MISMATCH: 'PIOT_REPO_URL_MISMATCH',
+    /** The GitHub repository the workflow is running from is private.
+     *  putitoutthere refuses to publish from a private repository:
+     *  npm provenance attestations embed a source-ref pointer that
+     *  consumers cannot dereference when the repo is private, and the
+     *  same source-visibility expectation underpins the trusted-publisher
+     *  story on the other registries. */
+    REPO_PRIVATE: 'PIOT_REPO_PRIVATE',
 };
 /**
  * Iterable form of the codes. Walked by tests for uniqueness/format
@@ -63,7 +152,20 @@ export const ALL_ERROR_CODES = [
     ErrorCodes.AUTH_NO_TOKEN,
     ErrorCodes.PUBLISH_EMPTY_PLAN,
     ErrorCodes.NPM_MISSING_REPOSITORY,
+    ErrorCodes.NPM_NAME_MISMATCH,
     ErrorCodes.CRATES_MISSING_METADATA,
     ErrorCodes.PYPI_STATIC_VERSION,
+    ErrorCodes.PYPI_NAME_MISMATCH,
+    ErrorCodes.PYPI_BUILD_BACKEND_MISMATCH,
+    ErrorCodes.PYPI_DYNAMIC_VERSION_NO_BACKEND,
+    ErrorCodes.PYPI_MATURIN_INCLUDE_MISSING,
+    ErrorCodes.CRATES_NAME_MISMATCH,
+    ErrorCodes.CRATES_MISSING_BIN,
+    ErrorCodes.CRATES_FEATURE_NOT_DECLARED,
+    ErrorCodes.CRATES_WORKSPACE_VERSION_MISMATCH,
+    ErrorCodes.CRATES_FIRST_PUBLISH_TP_REJECTED,
+    ErrorCodes.CRATES_PACKAGE_TOO_LARGE,
+    ErrorCodes.REPO_URL_MISMATCH,
+    ErrorCodes.REPO_PRIVATE,
 ];
 //# sourceMappingURL=error-codes.js.map

package/dist/error-codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;IAC7C;;;;;0DAKsD;IACtD,sBAAsB,EAAE,6BAA6B;IACrD;;;;;;iCAM6B;IAC7B,uBAAuB,EAAE,8BAA8B;IACvD;;;;;;;;qDAQiD;IACjD,mBAAmB,EAAE,0BAA0B;CACvC,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,UAAU,CAAC,aAAa;IACxB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,sBAAsB;IACjC,UAAU,CAAC,uBAAuB;IAClC,UAAU,CAAC,mBAAmB;CAC/B,CAAC"}
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;IAC7C;;;;;0DAKsD;IACtD,sBAAsB,EAAE,6BAA6B;IACrD;;;;;;;2CAOuC;IACvC,iBAAiB,EAAE,wBAAwB;IAC3C;;;;;;iCAM6B;IAC7B,uBAAuB,EAAE,8BAA8B;IACvD;;;;;;;;qDAQiD;IACjD,mBAAmB,EAAE,0BAA0B;IAC/C;;;;;yBAKqB;IACrB,kBAAkB,EAAE,yBAAyB;IAC7C;;;;gBAIY;IACZ,2BAA2B,EAAE,kCAAkC;IAC/D;;;uDAGmD;IACnD,+BAA+B,EAAE,sCAAsC;IACvE;;;;kEAI8D;IAC9D,4BAA4B,EAAE,mCAAmC;IACjE;;;;uEAImE;IACnE,oBAAoB,EAAE,2BAA2B;IACjD;;;;uBAImB;IACnB,kBAAkB,EAAE,yBAAyB;IAC7C;;;;2BAIuB;IACvB,2BAA2B,EAAE,kCAAkC;IAC/D;;;qEAGiE;IACjE,iCAAiC,EAAE,wCAAwC;IAC3E;;;;;;kEAM8D;IAC9D,gCAAgC,EAAE,uCAAuC;IACzE;;;;;;;8BAO0B;IAC1B,wBAAwB,EAAE,+BAA+B;IACzD;;;;;;;gDAO4C;IAC5C,iBAAiB,EAAE,wBAAwB;IAC3C;;;;;yCAKqC;IACrC,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,UAAU,CAAC,aAAa;IACxB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,sBAAsB;IACjC,UAAU,CAAC,iBAAiB;IAC5B,UAAU,CAAC,uBAAuB;IAClC,UAAU,CAAC,mBAAmB;IAC9B,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,2BAA2B;IACtC,UAAU,CAAC,+BAA+B;IAC1C,UAAU,CAAC,4BAA4B;IACvC,UAAU,CAAC,oBAAoB;IAC/B,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,2BAA2B;IACtC,UAAU,CAAC,iCAAiC;IAC5C,UAAU,CAAC,gCAAgC;IAC3C,UAAU,CAAC,wBAAwB;IACnC,UAAU,CAAC,iBAAiB;IAC5B,UAAU,CAAC,YAAY;CACxB,CAAC"}

package/dist/git.d.ts

@@ -21,6 +21,11 @@ export declare function diffNames(from: string, to: string, opts?: GitOptions):
 export declare function tagList(glob: string, opts?: GitOptions): string[];
 export declare function createTag(name: string, sha: string, opts?: TagOptions): void;
 export declare function pushTag(name: string, opts?: GitOptions): void;
+/**
+ * The commit a tag points at. `rev-list -n 1` dereferences an annotated
+ * tag down to the commit it ultimately references.
+ */
+export declare function tagCommit(name: string, opts?: GitOptions): string;
 /**
  * Find the highest-semver tag for a given package.
  *

package/dist/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,UAAU,UAAW,SAAQ,UAAU;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAgDD,wBAAgB,UAAU,CAAC,IAAI,GAAE,UAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAGrE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,EAAE,CAM1E;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,UAAe,GACpB,MAAM,EAAE,CAIV;AAID,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,EAAE,CAIrE;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,UAAe,GACpB,IAAI,CAGN;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,IAAI,CAEjE;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CACrB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,UAAe,GACpB,MAAM,GAAG,IAAI,CAmBf"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,UAAU,UAAW,SAAQ,UAAU;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAgDD,wBAAgB,UAAU,CAAC,IAAI,GAAE,UAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAGrE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,EAAE,CAM1E;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,UAAe,GACpB,MAAM,EAAE,CAIV;AAID,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,EAAE,CAIrE;AAED,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,UAAe,GACpB,IAAI,CAGN;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,IAAI,CAEjE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CAErE;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CACrB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,UAAe,GACpB,MAAM,GAAG,IAAI,CAmBf"}

package/dist/git.js

@@ -62,21 +62,24 @@ export function commitParents(sha, opts = {}) {
     // %P = parent SHAs, space-separated. Merge commits have ≥2;
     // plain commits have 1; root commits have 0.
     const out = run(['log', '-1', '--format=%P', sha], opts);
-    if (out === '')
+    if (out === '') {
         return [];
+    }
     return out.split(' ').filter((s) => s.length > 0);
 }
 export function diffNames(from, to, opts = {}) {
     const out = run(['diff', '--name-only', `${from}..${to}`], opts);
-    if (out === '')
+    if (out === '') {
         return [];
+    }
     return out.split('\n').filter((l) => l.length > 0);
 }
 /* ------------------------------ tags ------------------------------ */
 export function tagList(glob, opts = {}) {
     const out = run(['tag', '-l', glob], opts);
-    if (out === '')
+    if (out === '') {
         return [];
+    }
     return out.split('\n').filter((l) => l.length > 0);
 }
 export function createTag(name, sha, opts = {}) {
@@ -86,6 +89,13 @@ export function createTag(name, sha, opts = {}) {
 export function pushTag(name, opts = {}) {
     run(['push', 'origin', name], opts);
 }
+/**
+ * The commit a tag points at. `rev-list -n 1` dereferences an annotated
+ * tag down to the commit it ultimately references.
+ */
+export function tagCommit(name, opts = {}) {
+    return run(['rev-list', '-n', '1', name], opts);
+}
 /* -------------------------- last-tag resolver -------------------------- */
 /**
  * Find the highest-semver tag for a given package.
@@ -103,8 +113,9 @@ export function lastTag(packageName, tagFormat, opts = {}) {
     let best = null;
     for (const tag of candidates) {
         const versionPart = parseTagVersion(tagFormat, packageName, tag);
-        if (versionPart === null)
+        if (versionPart === null) {
             continue;
+        }
         let parsed;
         try {
             parsed = parseSemver(versionPart);
@@ -121,10 +132,12 @@ export function lastTag(packageName, tagFormat, opts = {}) {
 }
 function greater(a, b) {
     /* v8 ignore next 2 -- comparison branches not all reachable from current test data */
-    if (a.major !== b.major)
+    if (a.major !== b.major) {
         return a.major > b.major;
-    if (a.minor !== b.minor)
+    }
+    if (a.minor !== b.minor) {
         return a.minor > b.minor;
+    }
     return a.patch > b.patch;
 }
 //# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAUxD,wEAAwE;AAExE,SAAS,GAAG,CAAC,IAAc,EAAE,OAAmB,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,OAAO,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,gEAAgE;QAChE,gDAAgD;QAChD,iFAAiF;QACjF,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,yBAAyB;QACzB,MAAM,aAAa,GACjB,MAAM,KAAK,SAAS;YACpB,gEAAgE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb;gBACE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,qCAAqC;gBACzD,oEAAoE;gBACpE,yDAAyD;gBACzD,YAAY;gBACZ,2DAA2D;gBAC3D,8FAA8F;gBAC9F,8EAA8E;gBAC9E,EAAE;gBACF,2BAA2B,MAAM,EAAE;aACpC,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,MAAM,UAAU,UAAU,CAAC,OAAmB,EAAE;IAC9C,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAmB,EAAE;IAC3D,sDAAsD;IACtD,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAAmB,EAAE;IAC9D,4DAA4D;IAC5D,6CAA6C;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,EAAU,EACV,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAmB,EAAE;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,GAAW,EACX,OAAmB,EAAE;IAErB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAmB,EAAE;IACzD,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,OAAO,CACrB,WAAmB,EACnB,SAAiB,EACjB,OAAmB,EAAE;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAElE,IAAI,IAAI,GAA4C,IAAI,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,WAAW,KAAK,IAAI;YAAE,SAAS;QACnC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAClC,6EAA6E;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,sFAAsF;IACtF,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAUxD,wEAAwE;AAExE,SAAS,GAAG,CAAC,IAAc,EAAE,OAAmB,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,OAAO,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,gEAAgE;QAChE,gDAAgD;QAChD,iFAAiF;QACjF,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,yBAAyB;QACzB,MAAM,aAAa,GACjB,MAAM,KAAK,SAAS;YACpB,gEAAgE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb;gBACE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,qCAAqC;gBACzD,oEAAoE;gBACpE,yDAAyD;gBACzD,YAAY;gBACZ,2DAA2D;gBAC3D,8FAA8F;gBAC9F,8EAA8E;gBAC9E,EAAE;gBACF,2BAA2B,MAAM,EAAE;aACpC,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,MAAM,UAAU,UAAU,CAAC,OAAmB,EAAE;IAC9C,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAmB,EAAE;IAC3D,sDAAsD;IACtD,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAAmB,EAAE;IAC9D,4DAA4D;IAC5D,6CAA6C;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAAA,OAAO,EAAE,CAAC;IAAA,CAAC;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,EAAU,EACV,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAAA,OAAO,EAAE,CAAC;IAAA,CAAC;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAmB,EAAE;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAAA,OAAO,EAAE,CAAC;IAAA,CAAC;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,GAAW,EACX,OAAmB,EAAE;IAErB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAmB,EAAE;IACzD,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAmB,EAAE;IAC3D,OAAO,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,OAAO,CACrB,WAAmB,EACnB,SAAiB,EACjB,OAAmB,EAAE;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAElE,IAAI,IAAI,GAA4C,IAAI,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QACrC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YAClC,6EAA6E;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,sFAAsF;IACtF,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAAA,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAAA,CAAC;IACpD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAAA,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAAA,CAAC;IACpD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;AAC3B,CAAC"}

package/dist/glob.d.ts

@@ -12,4 +12,13 @@
  */
 export declare function matchesGlob(pattern: string, path: string): boolean;
 export declare function matchesAny(patterns: readonly string[], path: string): boolean;
+/**
+ * Expand a relative path glob against the filesystem, returning the
+ * directories it matches. Mirrors how cargo resolves `[workspace].members`
+ * entries: a literal entry (no glob metacharacter) resolves to a single
+ * path returned whether or not it exists — callers handle a missing
+ * directory — while a glob entry is matched one path segment at a time
+ * against the real directory tree, so only existing directories come back.
+ */
+export declare function expandDirGlob(baseDir: string, pattern: string): string[];
 //# sourceMappingURL=glob.d.ts.map

package/dist/glob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAK7E"}
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAK7E;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxE"}

package/dist/glob.js

@@ -10,6 +10,8 @@
  *
  * Issue #10.
  */
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
 import { minimatch } from 'minimatch';
 const OPTS = {
     dot: true,
@@ -21,9 +23,35 @@ export function matchesGlob(pattern, path) {
 }
 export function matchesAny(patterns, path) {
     for (const p of patterns) {
-        if (matchesGlob(p, path))
+        if (matchesGlob(p, path)) {
             return true;
+        }
     }
     return false;
 }
+const GLOB_META = /[*?[\]{}]/;
+/**
+ * Expand a relative path glob against the filesystem, returning the
+ * directories it matches. Mirrors how cargo resolves `[workspace].members`
+ * entries: a literal entry (no glob metacharacter) resolves to a single
+ * path returned whether or not it exists — callers handle a missing
+ * directory — while a glob entry is matched one path segment at a time
+ * against the real directory tree, so only existing directories come back.
+ */
+export function expandDirGlob(baseDir, pattern) {
+    const segments = pattern.split('/').filter((s) => s.length > 0);
+    let dirs = [baseDir];
+    for (const segment of segments) {
+        if (!GLOB_META.test(segment)) {
+            dirs = dirs.map((d) => join(d, segment));
+            continue;
+        }
+        dirs = dirs
+            .filter((d) => existsSync(d))
+            .flatMap((d) => readdirSync(d, { withFileTypes: true })
+            .filter((e) => e.isDirectory() && matchesGlob(segment, e.name))
+            .map((e) => join(d, e.name)));
+    }
+    return dirs;
+}
 //# sourceMappingURL=glob.js.map

package/dist/glob.js.map

@@ -1 +1 @@
-{"version":3,"file":"glob.js","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI,EAAE,oDAAoD;CAC7D,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAA2B,EAAE,IAAY;IAClE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI,EAAE,oDAAoD;CAC7D,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAA2B,EAAE,IAAY;IAClE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAe;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,IAAI;aACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;aAC5B,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACb,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;aAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAC/B,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/handlers/crates.d.ts

@@ -27,6 +27,21 @@
  * up (same for classic token fallback).
  */
 import type { Handler } from '../types.js';
+/**
+ * Match cargo's stderr shape when crates.io rejects the TP exchange
+ * because the crate has never been published. The fixture at
+ * `test/integration/fixtures/registry-responses/crates-io/publish-first-publish-tp-rejected.txt`
+ * captures the canonical shape; the catalog at
+ * `notes/upstream-behaviors.md` is the source of truth for the contract.
+ *
+ * Two anchors keep false positives out: a 404-status line and either
+ * the registry's "crate `<name>` does not exist" prose or the
+ * "trusted publish" mention. An unrelated 404 in some other cargo
+ * subcommand (e.g. a missing index file) won't carry the prose; an
+ * unrelated `does not exist` (e.g. a missing dependency) won't carry
+ * the 404 status.
+ */
+export declare function looksLikeFirstPublishTpRejection(stderr: string | undefined): boolean;
 /**
  * Rewrites the first `version = "..."` assignment inside `[package]`.
  * Preserves everything else in the file byte-for-byte. Throws if the

package/dist/handlers/crates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crates.d.ts","sourceRoot":"","sources":["../../src/handlers/crates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,KAAK,EAAO,OAAO,EAAiB,MAAM,aAAa,CAAC;AAiN/D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa3E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,GACtC,MAAM,EAAE,GAAG,IAAI,CA6FjB;AAQD,eAAO,MAAM,MAAM,EAAE,OAKpB,CAAC"}
+{"version":3,"file":"crates.d.ts","sourceRoot":"","sources":["../../src/handlers/crates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,KAAK,EAAO,OAAO,EAAiB,MAAM,aAAa,CAAC;AAmO/D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOpF;AAUD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa3E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,GACtC,MAAM,EAAE,GAAG,IAAI,CA6FjB;AA8BD,eAAO,MAAM,MAAM,EAAE,OAMpB,CAAC"}

package/dist/handlers/crates.js

@@ -30,6 +30,7 @@ import { execFileSync } from 'node:child_process';
 import { readFileSync, writeFileSync } from 'node:fs';
 import { join, relative } from 'node:path';
 import { TransientError } from '../types.js';
+import { ErrorCodes } from '../error-codes.js';
 import { buildSubprocessEnv, nonEmpty } from '../env.js';
 import { USER_AGENT } from '../version.js';
 const REGISTRY = 'https://crates.io';
@@ -40,10 +41,12 @@ async function isPublishedImpl(pkg, version, _ctx) {
         method: 'GET',
         headers: { 'user-agent': USER_AGENT },
     });
-    if (res.status === 200)
+    if (res.status === 200) {
         return true;
-    if (res.status === 404)
+    }
+    if (res.status === 404) {
         return false;
+    }
     if (res.status >= 500) {
         throw new TransientError(`crates.io GET ${url} returned ${res.status}`);
     }
@@ -70,8 +73,9 @@ function writeVersionImpl(pkg, version, _ctx) {
     catch (err) {
         return Promise.reject(err instanceof Error ? err : new Error(String(err)));
     }
-    if (updated === original)
+    if (updated === original) {
         return Promise.resolve([]);
+    }
     writeFileSync(cargoPath, updated, 'utf8');
     return Promise.resolve([cargoPath]);
 }
@@ -175,6 +179,26 @@ async function publishImpl(pkg, version, ctx) {
                 url: `${fallbackUrl.replace(/\/$/, '')}/api/v1/crates/${crateNameFor(pkg)}/${version}`,
             };
         }
+        // crates.io's Trusted Publishing binds to an already-published
+        // crate: the OIDC mint succeeds and the exchanged token reaches
+        // cargo, but the registry returns a 404 ("crate `<name>` does not
+        // exist or you do not have permission to publish to it") on the
+        // very first publish. The naive "auth failed?" interpretation
+        // sends consumers down a credentials rabbit-hole when the real
+        // fix is one bootstrap publish with a classic CARGO_REGISTRY_TOKEN.
+        // Detect this exact shape and surface the bootstrap hint inline.
+        // Suppressed under the e2e seam (primary override in effect) — the
+        // alt-registry is configured `--no-auth` and doesn't model TP, so
+        // a 404 there is a different bug. #284.
+        if (primaryOverride === undefined &&
+            looksLikeFirstPublishTpRejection(stderr)) {
+            throw new Error([
+                `[${ErrorCodes.CRATES_FIRST_PUBLISH_TP_REJECTED}] cargo publish: crates.io rejected publishing "${crateNameFor(pkg)}" because the crate has never been published.`,
+                'crates.io Trusted Publishing binds to an already-published crate, so the very first release of a new crate name cannot use the TP path.',
+                'Bootstrap by setting CARGO_REGISTRY_TOKEN (a classic crates.io API token) for the first publish; every release after that can use trusted publishing.',
+                stderr ? `\n--- cargo stderr ---\n${stderr}` : '',
+            ].filter((s) => s.length > 0).join('\n'), { cause: err });
+        }
         const base = err instanceof Error ? err.message : String(err);
         throw new Error(`cargo publish failed${stderr ? `:\n${stderr}` : `: ${base}`}`, { cause: err });
     }
@@ -195,10 +219,35 @@ async function publishImpl(pkg, version, ctx) {
  * wouldn't trigger the fallback.
  */
 function isRateLimited(stderr) {
-    if (!stderr)
+    if (!stderr) {
         return false;
+    }
     return /status\s+429\b/i.test(stderr) || /429\s+Too\s+Many\s+Requests/i.test(stderr);
 }
+/**
+ * Match cargo's stderr shape when crates.io rejects the TP exchange
+ * because the crate has never been published. The fixture at
+ * `test/integration/fixtures/registry-responses/crates-io/publish-first-publish-tp-rejected.txt`
+ * captures the canonical shape; the catalog at
+ * `notes/upstream-behaviors.md` is the source of truth for the contract.
+ *
+ * Two anchors keep false positives out: a 404-status line and either
+ * the registry's "crate `<name>` does not exist" prose or the
+ * "trusted publish" mention. An unrelated 404 in some other cargo
+ * subcommand (e.g. a missing index file) won't carry the prose; an
+ * unrelated `does not exist` (e.g. a missing dependency) won't carry
+ * the 404 status.
+ */
+export function looksLikeFirstPublishTpRejection(stderr) {
+    if (!stderr) {
+        return false;
+    }
+    if (!/status\s+404\b/i.test(stderr)) {
+        return false;
+    }
+    return (/crate\s+`[^`]+`\s+does\s+not\s+exist/i.test(stderr) ||
+        /trusted\s+publish/i.test(stderr));
+}
 /* ------------------------------ internals ------------------------------ */
 /** The published name. Falls back to the pilot package name if no
  * explicit `crate` field is set. */
@@ -220,8 +269,9 @@ export function replaceCargoVersion(source, version) {
         throw new Error('Cargo.toml: no [package].version field found');
     }
     const [, pre, prefix, old, suffix] = m;
-    if (old === version)
+    if (old === version) {
         return source;
+    }
     const start = m.index + pre.length;
     const end = start + prefix.length + old.length + suffix.length;
     return source.slice(0, start) + prefix + version + suffix + source.slice(end);
@@ -241,8 +291,9 @@ export function scanDirtyOutsideManifest(cwd, pkgPath, artifactsRoot, siblingPac
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'pipe'],
         });
-        if (!topOut.trim())
+        if (!topOut.trim()) {
             return null;
+        }
     }
     catch {
         return null;
@@ -294,14 +345,16 @@ export function scanDirtyOutsideManifest(cwd, pkgPath, artifactsRoot, siblingPac
     const siblingRels = [];
     for (const p of siblingPackagePaths ?? []) {
         const r = relative(cwd, p);
-        if (r === '' || r.startsWith('..'))
+        if (r === '' || r.startsWith('..')) {
             continue;
+        }
         siblingRels.push(r.replace(/\\/g, '/'));
     }
     const unexpected = [];
     for (const raw of porcelain.split('\n')) {
-        if (raw.length < 4)
+        if (raw.length < 4) {
             continue;
+        }
         // Porcelain v1: "XY path" or "XY old -> new" for renames. Index 3+
         // is the path; strip quoting if git applied any.
         const rest = raw.slice(3);
@@ -309,8 +362,9 @@ export function scanDirtyOutsideManifest(cwd, pkgPath, artifactsRoot, siblingPac
         const path = rest.includes(' -> ') ? rest.split(' -> ').pop() : rest;
         /* v8 ignore next -- quoted-path rendering not exercised by current tests */
         const normalized = path.startsWith('"') && path.endsWith('"') ? path.slice(1, -1) : path;
-        if (normalized === managedRel)
+        if (normalized === managedRel) {
             continue;
+        }
         if (artifactsRel !== '' &&
             (normalized === artifactsRel ||
                 normalized === `${artifactsRel}/` ||
@@ -331,9 +385,30 @@ function relativeOrSelf(base, target) {
     /* v8 ignore next -- relative() only returns '' when base === target */
     return r === '' ? target : r;
 }
+/**
+ * Latest published version of the crate, or null when it has never been
+ * published (404). GET /api/v1/crates/{name} → `crate.newest_version`.
+ * Reuses `crateNameFor` so this read resolves the crates.io name exactly
+ * as `isPublished` / `publish` do. Any non-200/404 is surfaced as a
+ * TransientError; the read-only caller renders that as "unreachable".
+ */
+async function latestVersionImpl(pkg, _ctx) {
+    const crateName = crateNameFor(pkg);
+    const url = `${REGISTRY}/api/v1/crates/${encodeURIComponent(crateName)}`;
+    const res = await fetch(url, { method: 'GET', headers: { 'user-agent': USER_AGENT } });
+    if (res.status === 200) {
+        const body = (await res.json());
+        return body.crate?.newest_version ?? null;
+    }
+    if (res.status === 404) {
+        return null;
+    }
+    throw new TransientError(`crates.io GET ${url} returned ${res.status}`);
+}
 export const crates = {
     kind: 'crates',
     isPublished: isPublishedImpl,
+    latestVersion: latestVersionImpl,
     writeVersion: writeVersionImpl,
     publish: publishImpl,
 };