putitoutthere 0.2.34 → 0.2.36

package/CHANGELOG.md

@@ -16,6 +16,7 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Fixed
 
+- Fixed: `putitoutthere`'s pre-build version rewrite now follows Cargo **workspace version inheritance** — a crate that sources its version from `[workspace.package].version` via `version.workspace = true` (the idiomatic polyglot layout: one Rust core wrapped by a PyO3 wheel and a napi addon) is now bumped correctly instead of failing the release. The maturin `write-version` (#276) and npm/pypi bundled-cli `write-crate-version` (#366) steps both rewrote only a literal `[package].version` and threw `Cargo.toml: no [package].version field found` on an inheriting member, because the inherited version lives in a different file — the workspace root — that neither step read. So a release for that layout was blocked, not merely mis-versioned. The rewrite path now resolves the manifest first: a literal `[package].version` is bumped in place byte-for-byte as before, while an inheriting member walks up to the nearest ancestor `[workspace]` `Cargo.toml` and rewrites its `[workspace.package].version`. Unparseable or version-less manifests fall through to the prior literal-only path (`replaceCargoVersion`'s existing error), so single-crate layouts are byte-for-byte unchanged. New `src/find-workspace-root.ts`, `src/replace-workspace-package-version.ts`, and `src/write-resolved-cargo-version.ts`; `write-version.ts` / `write-crate-version.ts` now delegate to the resolver. See [MIGRATIONS.md](./MIGRATIONS.md#version-bump-follows-cargo-workspace-inheritance). #428. (verified by: unit/ubuntu-latest)
 - Fixed: `putitoutthere publish` now writes a package's git tag when that version is already live on the registry but untagged, instead of skipping it silently. The publish loop's already-published branch (`isPublished` → true) returned *before* the tag-creation step, so a version that reached the registry on a half-failed run (the run died after publishing but before tagging — e.g. a cancelled downstream job) was left published-but-untagged and never self-healed: piot derives "last released version" from git tags, so on every later run the package looked unreleased, fell back to `first_version` (already live), skipped again, and stayed stuck forever — while its dependents kept bumping and publishing, opening unflagged version skew. The skip branch now calls a shared, idempotent `ensureTag` (new `src/ensure-tag.ts`; a no-op when the tag already exists, and reused by the normal post-publish tag step), so a stuck package self-heals on its next release run. See [MIGRATIONS.md](./MIGRATIONS.md#publish-path-auto-heal-missing-tags). #407. (verified by: integration, unit/ubuntu-latest)
 - Fixed: a `kind = "pypi"` `build = "maturin"` package whose wheel is **Python-version-independent** — `[tool.maturin].bindings = "bin"` (a Rust-binary wheel tagged `py3-none`) or a pyo3 `abi3` / `abi3-pyXY` extension (a stable-ABI wheel tagged `cp3x-abi3`) — no longer fans its wheel build across every CPython version `requires-python` / `python_versions` resolves to. Such a wheel is byte-identical regardless of the interpreter that built it, so the fan produced N duplicate wheels: each fanned row uploaded under its own `-py<ver>` artifact, and the documented consumer `pypi-publish` recipe's `actions/download-artifact … merge-multiple: true` then extracted N copies of the same wheel filename onto one path concurrently — a torn write that failed `twine check` with `zipfile.BadZipFile` (observed on a `bindings = "bin"`, `requires-python = ">=3.9"` package: six identical wheels per platform, the x86_64-linux copy losing its extraction race while macOS/aarch64 won theirs). The planner (`src/plan.ts`) now collapses the fan to a single wheel row per target for these packages — built once on the newest resolved interpreter, keeping the historical unsuffixed `<pkg>-wheel-<triple>` artifact name — and the new `src/wheel-abi.ts` detects version independence from the package's real `pyproject.toml` (`[tool.maturin].bindings`, `[tool.maturin].features`) and `Cargo.toml` (an `abi3` / `abi3-pyXY` feature on the `pyo3` / `pyo3-ffi` dependency). Ordinary per-version extension modules (no abi3, no `bindings = "bin"`) still fan and keep their `-py<ver>` suffixes; the sdist row is unchanged. Also saves the redundant N−1 wheel builds. Detection is conservative — an unrecognized abi3 setup (workspace-inherited `pyo3`, a target-specific dependency table) falls back to fanning, never worse than before. See [README → `kind = "pypi"`](./README.md#kind--pypi) and [MIGRATIONS.md](./MIGRATIONS.md#pypi-version-independent-wheels-build-once). #401. (verified by: integration, unit/ubuntu-latest)
 - Fixed: `kind = "npm"` releases no longer abort mid-matrix on npm's Sigstore/Rekor transparency-log dedupe (`TLOG_CREATE_ENTRY_ERROR`, HTTP 409, "an equivalent entry already exists in the transparency log"). npm's retry-on-transient-network-error re-submits a byte-identical `--provenance` attestation after a flaky response, and Rekor rejects the duplicate with a 409. Previously only the registry-PUT edition of that race (`E403` "cannot publish over the previously published versions", matched by `looksLikePublishOverRace`) was tolerated, so the attestation edition fell through to the generic `throw` and killed the publish job — for a multi-platform (`napi` / `bundled-cli`) package that meant the first sub-package published, the next 409'd, and the remaining sub-packages **and the main package** were left unpublished (a partial release; observed on a 3-language repo's first `0.0.1`). Unlike the E403 shape, a 409 from Rekor does **not** by itself prove the artifact landed (the first submit may have written the transparency-log entry but still failed the registry upload), so both the main-package (`src/handlers/npm.ts`) and per-platform (`src/handlers/npm-platform.ts`) publish catches now re-probe `npm view` to disambiguate: present on the registry ⇒ treated as a benign duplicate (`already-published` / counted as published, and the cascade's `optionalDependencies` rewrite still runs); absent ⇒ a genuine partial publish, surfaced as an actionable error telling the operator to re-run the release so a fresh attestation (new `runID`/attempt ⇒ new Rekor entry) gets past the dedupe. The engine cannot retry the attestation in-process. See [MIGRATIONS.md](./MIGRATIONS.md#npm-tlog_create_entry_error-409-provenance-retry-race). #399. (verified by: unit/ubuntu-latest)

package/MIGRATIONS.md

@@ -21,6 +21,39 @@ Each section covers five things, in order:
 
 ## Unreleased
 
+### Version bump follows Cargo workspace inheritance
+
+**Summary.** piot's pre-build version rewrite — the maturin `write-version`
+step (#276) and the npm / pypi bundled-cli `write-crate-version` step
+(#366) — now understands Cargo **workspace version inheritance**. A crate
+whose `[package]` declares `version.workspace = true` and inherits its
+version from `[workspace.package].version` at the workspace root (the
+standard shape for a single Rust core re-exposed as a PyO3 wheel and a napi
+addon) previously failed these steps with `Cargo.toml: no [package].version
+field found`. The rewrite now resolves the inheritance: a literal
+`[package].version` is bumped in place, while an inheriting member's version
+is bumped at the workspace root's `[workspace.package].version`.
+
+**Required changes.** None. Additive — a repo layout that previously errored
+at release now works. If you kept a duplicated literal `[package].version`
+in each crate to work around this, you may switch the members to
+`version.workspace = true` and let piot bump the workspace root.
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** A `kind = "pypi"`
+`build = "maturin"` or `kind = "npm"` `build = "bundled-cli"` package whose
+crate inherits its version from the workspace no longer fails the build
+step; the produced wheel / cross-compiled binary now carries the planned
+release version. Single-crate layouts with a literal `[package].version` are
+byte-for-byte unchanged.
+
+**Verification.** In a cargo workspace whose root declares
+`[workspace.package]` `version = "X"` and whose maturin/napi crate sets
+`version.workspace = true`, run a release: the published wheel / `.node`
+carries the planned release version (not the stale on-disk `X`), and the
+workspace-root `Cargo.toml` is the manifest rewritten during the build.
+
 ### verify: publish trust posture
 
 **Summary.** New command `putitoutthere verify` reports, per package, how

package/dist/find-workspace-root.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Walk up from `startDir` for the Cargo.toml that declares a `[workspace]`
+ * table — the root that a `version.workspace = true` member inherits its
+ * version from. Returns that directory, or `null` if none exists between
+ * `startDir` and the filesystem root. #428.
+ *
+ * Sync `readFileSync` with an ENOENT skip (not an `existsSync` precheck)
+ * to avoid the TOCTOU shape CodeQL flags, matching the rest of the
+ * version-write path. A malformed ancestor Cargo.toml is not treated as
+ * the workspace root; the walk continues past it.
+ */
+export declare function findWorkspaceRoot(startDir: string): string | null;
+//# sourceMappingURL=find-workspace-root.d.ts.map

package/dist/find-workspace-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-workspace-root.d.ts","sourceRoot":"","sources":["../src/find-workspace-root.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BjE"}

package/dist/find-workspace-root.js

@@ -0,0 +1,46 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+/**
+ * Walk up from `startDir` for the Cargo.toml that declares a `[workspace]`
+ * table — the root that a `version.workspace = true` member inherits its
+ * version from. Returns that directory, or `null` if none exists between
+ * `startDir` and the filesystem root. #428.
+ *
+ * Sync `readFileSync` with an ENOENT skip (not an `existsSync` precheck)
+ * to avoid the TOCTOU shape CodeQL flags, matching the rest of the
+ * version-write path. A malformed ancestor Cargo.toml is not treated as
+ * the workspace root; the walk continues past it.
+ */
+export function findWorkspaceRoot(startDir) {
+    let dir = startDir;
+    for (;;) {
+        let source = '';
+        try {
+            source = readFileSync(join(dir, 'Cargo.toml'), 'utf8');
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT') {
+                throw err;
+            }
+        }
+        if (source) {
+            let parsed;
+            try {
+                parsed = parseToml(source);
+            }
+            catch {
+                parsed = undefined;
+            }
+            if (parsed && typeof parsed === 'object' && 'workspace' in parsed) {
+                return dir;
+            }
+        }
+        const parent = dirname(dir);
+        if (parent === dir) {
+            return null;
+        }
+        dir = parent;
+    }
+}
+//# sourceMappingURL=find-workspace-root.js.map

package/dist/find-workspace-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-workspace-root.js","sourceRoot":"","sources":["../src/find-workspace-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;gBAClE,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/replace-workspace-package-version.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Rewrites the first `version = "..."` under the `[workspace.package]`
+ * table, preserving the rest of the file byte-for-byte. Throws if the
+ * field is absent. The `[workspace.package]` mirror of
+ * `replaceCargoVersion` (`src/handlers/crates.ts`), for crates that
+ * inherit their version via `version.workspace = true`. #428.
+ */
+export declare function replaceWorkspacePackageVersion(source: string, version: string): string;
+//# sourceMappingURL=replace-workspace-package-version.d.ts.map

package/dist/replace-workspace-package-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-workspace-package-version.d.ts","sourceRoot":"","sources":["../src/replace-workspace-package-version.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CActF"}

package/dist/replace-workspace-package-version.js

@@ -0,0 +1,23 @@
+/**
+ * Rewrites the first `version = "..."` under the `[workspace.package]`
+ * table, preserving the rest of the file byte-for-byte. Throws if the
+ * field is absent. The `[workspace.package]` mirror of
+ * `replaceCargoVersion` (`src/handlers/crates.ts`), for crates that
+ * inherit their version via `version.workspace = true`. #428.
+ */
+export function replaceWorkspacePackageVersion(source, version) {
+    // [workspace.package] header, then the first `version = "x.y.z"` line.
+    const re = /(\[workspace\.package\][\s\S]*?)(^\s*version\s*=\s*")([^"]*)(")/m;
+    const m = re.exec(source);
+    if (!m) {
+        throw new Error('Cargo.toml: no [workspace.package].version field found');
+    }
+    const [, pre, prefix, old, suffix] = m;
+    if (old === version) {
+        return source;
+    }
+    const start = m.index + pre.length;
+    const end = start + prefix.length + old.length + suffix.length;
+    return source.slice(0, start) + prefix + version + suffix + source.slice(end);
+}
+//# sourceMappingURL=replace-workspace-package-version.js.map

package/dist/replace-workspace-package-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-workspace-package-version.js","sourceRoot":"","sources":["../src/replace-workspace-package-version.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,OAAe;IAC5E,uEAAuE;IACvE,MAAM,EAAE,GAAG,kEAAkE,CAAC;IAC9E,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAwD,CAAC;IAC9F,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC"}

package/dist/write-crate-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-crate-version.d.ts","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBrF"}
+{"version":3,"file":"write-crate-version.d.ts","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAerF"}

package/dist/write-crate-version.js

@@ -17,9 +17,9 @@
  * `Cargo.toml`, so it needs a manifest-direct bump with no pyproject
  * gate. This is that command.
  */
-import { readFileSync, writeFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { replaceCargoVersion } from './handlers/crates.js';
+import { writeResolvedCargoVersion } from './write-resolved-cargo-version.js';
 /**
  * Rewrite `[package].version` in the crate at `crateDir` to `version`
  * and return the list of absolute paths that were modified.
@@ -43,10 +43,6 @@ export function writeCrateVersionForBuild(crateDir, version) {
         }
         throw err;
     }
-    const updated = replaceCargoVersion(original, version);
-    if (updated !== original) {
-        writeFileSync(cargoPath, updated, 'utf8');
-    }
-    return [cargoPath];
+    return writeResolvedCargoVersion(crateDir, original, version);
 }
 //# sourceMappingURL=write-crate-version.js.map

package/dist/write-crate-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-crate-version.js","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,gDAAgD,SAAS,wGAAwG,EACjK,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAAA,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAAA,CAAC;IACtE,OAAO,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"write-crate-version.js","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,gDAAgD,SAAS,wGAAwG,EACjK,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC"}

package/dist/write-resolved-cargo-version.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Rewrite a crate's version to `version`, following Cargo workspace
+ * inheritance (#428):
+ *
+ *  - a literal `[package].version = "x.y.z"` is rewritten in place;
+ *  - a member that inherits via `version.workspace = true` has the
+ *    workspace root's `[workspace.package].version` rewritten instead.
+ *
+ * `crateDir` is the crate's directory and `cargoSource` its already-read
+ * `Cargo.toml` (callers own the file-missing error message and hand the
+ * bytes here). Returns the absolute path(s) actually modified. Throws when
+ * the crate declares no resolvable version source (via `replaceCargoVersion`),
+ * or when it inherits but no ancestor `[workspace]` exists.
+ */
+export declare function writeResolvedCargoVersion(crateDir: string, cargoSource: string, version: string): string[];
+//# sourceMappingURL=write-resolved-cargo-version.d.ts.map

package/dist/write-resolved-cargo-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-resolved-cargo-version.d.ts","sourceRoot":"","sources":["../src/write-resolved-cargo-version.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAmCV"}

package/dist/write-resolved-cargo-version.js

@@ -0,0 +1,57 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { findWorkspaceRoot } from './find-workspace-root.js';
+import { replaceCargoVersion } from './handlers/crates.js';
+import { replaceWorkspacePackageVersion } from './replace-workspace-package-version.js';
+/**
+ * Rewrite a crate's version to `version`, following Cargo workspace
+ * inheritance (#428):
+ *
+ *  - a literal `[package].version = "x.y.z"` is rewritten in place;
+ *  - a member that inherits via `version.workspace = true` has the
+ *    workspace root's `[workspace.package].version` rewritten instead.
+ *
+ * `crateDir` is the crate's directory and `cargoSource` its already-read
+ * `Cargo.toml` (callers own the file-missing error message and hand the
+ * bytes here). Returns the absolute path(s) actually modified. Throws when
+ * the crate declares no resolvable version source (via `replaceCargoVersion`),
+ * or when it inherits but no ancestor `[workspace]` exists.
+ */
+export function writeResolvedCargoVersion(crateDir, cargoSource, version) {
+    // Detect inheritance from the parsed manifest. An unparseable manifest
+    // falls through to the literal path, preserving the pre-#428 regex
+    // behavior for odd-but-writable manifests.
+    let pkgVersion;
+    try {
+        pkgVersion = parseToml(cargoSource).package?.version;
+    }
+    catch {
+        pkgVersion = undefined;
+    }
+    const inherits = !!pkgVersion &&
+        typeof pkgVersion === 'object' &&
+        pkgVersion.workspace === true;
+    if (!inherits) {
+        // Literal `[package].version` (or genuinely absent — replaceCargoVersion
+        // throws the same "no [package].version" error the callers relied on).
+        const cargoPath = join(crateDir, 'Cargo.toml');
+        const updated = replaceCargoVersion(cargoSource, version);
+        if (updated !== cargoSource) {
+            writeFileSync(cargoPath, updated, 'utf8');
+        }
+        return [cargoPath];
+    }
+    const root = findWorkspaceRoot(crateDir);
+    if (root === null) {
+        throw new Error(`Cargo.toml: ${join(crateDir, 'Cargo.toml')} sets \`version.workspace = true\` but no ancestor [workspace] Cargo.toml was found. Declare [workspace.package].version at the workspace root.`);
+    }
+    const rootPath = join(root, 'Cargo.toml');
+    const rootSource = readFileSync(rootPath, 'utf8');
+    const updated = replaceWorkspacePackageVersion(rootSource, version);
+    if (updated !== rootSource) {
+        writeFileSync(rootPath, updated, 'utf8');
+    }
+    return [rootPath];
+}
+//# sourceMappingURL=write-resolved-cargo-version.js.map

package/dist/write-resolved-cargo-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-resolved-cargo-version.js","sourceRoot":"","sources":["../src/write-resolved-cargo-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,WAAmB,EACnB,OAAe;IAEf,uEAAuE;IACvE,mEAAmE;IACnE,2CAA2C;IAC3C,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAI,SAAS,CAAC,WAAW,CAAyC,CAAC,OAAO,EAAE,OAAO,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GACZ,CAAC,CAAC,UAAU;QACZ,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAsC,CAAC,SAAS,KAAK,IAAI,CAAC;IAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAAA,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAAA,CAAC;QACzE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,iJAAiJ,CAC7L,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAAA,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAAA,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC"}

package/dist/write-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-version.d.ts","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAuD9E"}
+{"version":3,"file":"write-version.d.ts","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAaH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAqD9E"}

package/dist/write-version.js

@@ -16,11 +16,11 @@
  * for the same reason, so a CLI-direct invocation surfaces the same
  * actionable error rather than building an under-versioned artifact.
  */
-import { readFileSync, writeFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parse as parseToml } from 'smol-toml';
 import { ErrorCodes } from './error-codes.js';
-import { replaceCargoVersion } from './handlers/crates.js';
+import { writeResolvedCargoVersion } from './write-resolved-cargo-version.js';
 const DYNAMIC_VERSION_DOC_POINTER = 'https://thekevinscott.github.io/putitoutthere/guide/dynamic-versions';
 /**
  * Rewrite the version source for a maturin package and return the list
@@ -82,11 +82,7 @@ export function writeVersionForBuild(pkgDir, version) {
         /* v8 ignore next -- non-ENOENT read errors surface as-is */
         throw err;
     }
-    const cargoUpdated = replaceCargoVersion(cargoOriginal, version);
-    if (cargoUpdated !== cargoOriginal) {
-        writeFileSync(cargoPath, cargoUpdated, 'utf8');
-    }
-    return [cargoPath];
+    return writeResolvedCargoVersion(pkgDir, cargoOriginal, version);
 }
 function isDynamicVersion(project) {
     const { dynamic } = project;

package/dist/write-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-version.js","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,2BAA2B,GAC/B,sEAAsE,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,aAAa,EAAE,EAAE;gBAC7E,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAI,MAAiE,EAAE,OAAO,CAAC;IAC5F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,2EAA2E,2BAA2B,GAAG,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,mBAAmB,oBAAoB,aAAa,mPAAmP,2BAA2B,GAAG,CACrV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,sFAAsF,2BAA2B,GAAG,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,6FAA6F,SAAS,+GAA+G,EACrN,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QAAA,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAAA,CAAC;IACrF,OAAO,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA8B;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"write-version.js","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,2BAA2B,GAC/B,sEAAsE,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,aAAa,EAAE,EAAE;gBAC7E,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAI,MAAiE,EAAE,OAAO,CAAC;IAC5F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,2EAA2E,2BAA2B,GAAG,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,mBAAmB,oBAAoB,aAAa,mPAAmP,2BAA2B,GAAG,CACrV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,sFAAsF,2BAA2B,GAAG,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,6FAA6F,SAAS,+GAA+G,EACrN,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,yBAAyB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA8B;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.2.34",
+  "version": "0.2.36",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {
@@ -45,7 +45,7 @@
     "@eslint/js": "^10.0.1",
     "@stylistic/eslint-plugin": "^5.10.0",
     "@types/node": "^25.6.0",
-    "@vercel/ncc": "^0.38.0",
+    "@vercel/ncc": "^0.44.0",
     "@vitest/coverage-v8": "^2.1.0",
     "eslint": "^10.2.1",
     "msw": "^2.13.4",