putitoutthere 0.2.7 → 0.2.9

package/CHANGELOG.md

@@ -30,6 +30,8 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Fixed
 
+- **pypi/maturin wheels now ship at the planned version instead of the literal in `pyproject.toml`.** The reusable workflow's build matrix (`_matrix.yml`) now bumps `[project].version` in `pyproject.toml` (or `[package].version` in `Cargo.toml` when `pyproject.toml` declares `dynamic = ["version"]`) to `matrix.version` before each `PyO3/maturin-action@v1` invocation. Maturin reads its version source from disk at build time and honors no env override — `SETUPTOOLS_SCM_PRETEND_VERSION` is a setuptools-scm / hatch-vcs feature, not a maturin one. Without the bump, wheels left the build runner at whatever literal happened to be in the consumer's manifest — diverging from the planned version, tripping PyPI's "file already exists" rejection at upload, and turning otherwise-clean release runs red even when crates and npm shipped correctly. The bump is implemented as a new internal `putitoutthere write-version` CLI subcommand and exposed through the JS action's existing surface (new `version:` input on `action.yml`); the e2e fixture harness now verifies wheel `METADATA: Version:` matches `matrix.version` post-build. The CLI subcommand and action input are internal — consumers compose with the reusable workflow, not directly with the CLI. Hit in the wild on `dirsql`'s 0.2.8 release (issue #276). See [MIGRATIONS.md](./MIGRATIONS.md#pypi-maturin-version-bump-at-build).
+
 - **npm publish no longer fails red when npm CLI retries a successful PUT.** When the registry acks a publish but the response comes back flaky to the client (timeout / 502 / connection reset), the npm CLI retries with the same payload. The retry lands on a registry that already has the new version and exits `E403 "cannot publish over the previously published versions: <ver>"`. Both the platform-package handler (`src/handlers/npm-platform.ts:npmPublish`) and the main publish path (`src/handlers/npm.ts:publishImpl`) now detect that exact stderr shape and treat it as success — the package is already on the registry at the requested version. Hit in the wild on PR #257's polyglot-everything multi-mode publish (10 platform packages × ~1 in 10 chance per request meant the race was nearly guaranteed).
 
 - **Crates publish no longer refuses on workflow-managed install state in sibling packages.** Before, the engine's pre-publish dirty-workspace check (`scanDirtyOutsideManifest`) flagged anything dirty outside the package's `Cargo.toml`. For polyglot consumers (rust + js in one repo), the reusable workflow's `Build npm packages` step (#256) creates `node_modules/`, `package-lock.json`, and `dist/` inside each npm package's path before cargo publish runs — these are workflow scratch, not stray edits, and cargo can't pack them anyway (it only packs files inside the crate's own dir). The check now whitelists every other configured package's path, similar to how it already whitelists `artifacts/`. Stray edits elsewhere in the repo (a `README.md` change, etc.) still fail the check. Hit in the wild on the polyglot-everything e2e fixture; would also have hit any consumer with the same shape.

package/MIGRATIONS.md

@@ -21,6 +21,86 @@ Each section covers five things, in order:
 
 ## Unreleased
 
+### pypi/maturin version bump at build
+
+**Summary.** `pypi` packages built with `build = "maturin"` now ship
+wheels at the planned version, not at whatever literal happened to be
+in `pyproject.toml` on the build runner. The reusable workflow's
+build matrix (`_matrix.yml`) bumps the version source on disk to
+`matrix.version` immediately before each `PyO3/maturin-action@v1`
+step. Two version-source shapes are supported:
+
+- Static literal: `[project].version = "0.1.0"` in `pyproject.toml`
+  is rewritten in place. This is maturin's default project shape and
+  the case that was previously broken for every consumer.
+- Dynamic: `pyproject.toml` declaring `[project].dynamic = ["version"]`
+  with the version sourced from a sibling `Cargo.toml`'s
+  `[package].version` — that's where the bump lands instead.
+
+Why it matters: maturin reads its version source from disk at build
+time and honors no env override. Other build paths bumped elsewhere
+in the contract — crates and npm at publish (`writeVersion` rewrites
+the manifest before `cargo publish` / `npm publish` reads it),
+setuptools-scm / hatch-vcs through `SETUPTOOLS_SCM_PRETEND_VERSION`
+in the build step. Maturin had no equivalent, so wheels left the
+build runner pre-versioned at the consumer's stale literal. PyPI
+rejected the upload with `400 File already exists` whenever that
+literal had been previously registered, even when crates and npm
+shipped correctly. Hit in the wild on `dirsql`'s 0.2.8 release;
+issue #276.
+
+**Required changes.** None. The bump is internal to the reusable
+workflow. Consumers pinning `release.yml@v0` and `build.yml@v0`
+inherit the fix on the next workflow run with no `release.yml` edits
+and no `putitoutthere.toml` edits. The fix applies equally to the
+static-literal and dynamic-version shapes; consumers don't need to
+restructure their pyproject to opt in.
+
+The CLI gains a new internal subcommand,
+`putitoutthere write-version --path <pkg-dir> --version <v>`, that
+implements the bump dispatch. `action.yml` gains a new optional
+`version:` input that the reusable workflow forwards. Both surfaces
+are internal seams powering `_matrix.yml`; consumers compose with
+the reusable workflow, not directly with the CLI or the JS action
+(see [`notes/design-commitments.md`](./notes/design-commitments.md)
+non-goal #7 and #10).
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** A maturin build run
+through the reusable workflow now mutates the build runner's
+`pyproject.toml` (or `Cargo.toml` for dynamic-version projects) in
+place, bumping the version literal to `matrix.version`. The mutation
+lives only on the build runner — the consumer's source tree is
+untouched. Anyone fingerprinting on the on-disk manifest version
+during a build (e.g. a custom shell step running between
+`uses: thekevinscott/putitoutthere/.github/workflows/release.yml@v0`
+and a follow-up step that reads the manifest) will now see the
+planned version where they previously saw the consumer's stale
+literal. Custom build steps that grep on a specific literal version
+need to grep on `matrix.version` instead.
+
+`pyproject.toml` projects whose `[project]` table is malformed
+(neither a static `version = "..."` line nor `dynamic = ["version"]`)
+now fail the build matrix with a clear error. Previously the same
+shape produced wheels at whatever fallback the build backend chose,
+which silently disagreed with the plan.
+
+**Verification.** Cut a release on a maturin package whose
+`pyproject.toml` carries a stale literal (e.g. `version = "0.1.0"`
+when the planned version is `0.2.8`). The reusable workflow's
+build matrix logs a `write-version: ... → 0.2.8` line before each
+maturin invocation, and the produced wheel's `METADATA: Version:`
+matches the planned version:
+
+```sh
+unzip -p dist/*.whl '*.dist-info/METADATA' | grep '^Version:'
+# Version: 0.2.8
+```
+
+PyPI accepts the upload — assuming the planned version itself isn't
+a duplicate of a previously-registered file.
+
 ### New `build.yml` reusable workflow for PR-time build verification
 
 **Summary.** A second consumer-facing reusable workflow,

package/action.yml

@@ -4,15 +4,25 @@ author: 'Kevin Scott'
 
 inputs:
   command:
-    description: 'Which CLI subcommand to run. Canonical values are `plan` and `publish`.'
+    description: 'Which CLI subcommand to run. Canonical values are `plan`, `publish`, and `write-version`.'
     required: false
     default: 'plan'
   working_directory:
     description: >-
-      Path the CLI runs against (forwarded as `--cwd`). Defaults to the
-      runner working directory. Internal use; the reusable workflow
-      supplies this when invoked against a non-root tree (e.g. e2e
-      fixtures materialized into a subdir).
+      Path the CLI runs against. For `plan` / `publish`, forwarded as
+      `--cwd`. For `write-version` (#276), forwarded as `--path` —
+      the package directory whose pyproject.toml / Cargo.toml gets
+      bumped. Defaults to the runner working directory. Internal use;
+      the reusable workflow supplies this when invoked against a
+      non-root tree (e.g. e2e fixtures materialized into a subdir,
+      or a per-package `matrix.path`).
+    required: false
+    default: ''
+  version:
+    description: >-
+      Planned version string. Required when `command: write-version`
+      (#276); ignored otherwise. The reusable workflow forwards the
+      build matrix's `version` row from the planner.
     required: false
     default: ''
   fail_on_error:

package/dist/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAwB1C"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmC1C"}

package/dist/action.js

@@ -7,18 +7,33 @@
  *
  * Issue #24. Plan: §5.2, §5.3.
  */
+import { pathToFileURL } from 'node:url';
 import { run } from './cli.js';
 export async function main() {
     const command = process.env.INPUT_COMMAND ?? '';
     const workingDirectory = process.env.INPUT_WORKING_DIRECTORY ?? '';
+    const versionInput = process.env.INPUT_VERSION ?? '';
     const failOnError = (process.env.INPUT_FAIL_ON_ERROR ?? 'true').toLowerCase() !== 'false';
     if (!command) {
         process.stderr.write('putitoutthere action: missing required input `command`\n');
         process.exit(1);
     }
-    const argv = ['node', 'putitoutthere', command, '--json'];
-    if (workingDirectory)
-        argv.push('--cwd', workingDirectory);
+    // #276: write-version uses a different argv shape — `--path` (the
+    // package dir, sourced from `working_directory`) and `--version`.
+    // No `--json`: the subcommand emits a single human line; there's
+    // no structured output to consume.
+    const argv = ['node', 'putitoutthere', command];
+    if (command === 'write-version') {
+        if (workingDirectory)
+            argv.push('--path', workingDirectory);
+        if (versionInput)
+            argv.push('--version', versionInput);
+    }
+    else {
+        argv.push('--json');
+        if (workingDirectory)
+            argv.push('--cwd', workingDirectory);
+    }
     const code = await run(argv);
     if (code !== 0 && !failOnError) {
         process.stderr.write(`putitoutthere action: ignoring non-zero exit (fail_on_error=false): ${code}\n`);
@@ -26,8 +41,18 @@ export async function main() {
     }
     process.exit(code);
 }
+// Entry-point guard. Compare via `pathToFileURL` so the guard fires on
+// Windows too: `import.meta.url` is a `file://` URL with forward
+// slashes (`file:///D:/.../index.js`), while `process.argv[1]` is the
+// native path (`D:\...\index.js`). Concatenating `file://` to the
+// native path produces a string that never equals the URL on Windows,
+// so the previous guard silently no-op'd the entire action when ncc-
+// bundled and invoked via `uses: ./` on a windows-latest runner —
+// `main()` was never called, the action exited 0 immediately, and
+// `_matrix.yml`'s pre-maturin write-version step bumped nothing
+// (PR #277, e2e Windows maturin failures). Issue #276.
 /* v8 ignore next 3 -- entry-point guard; only reachable when invoked as a binary */
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
     void main();
 }
 //# sourceMappingURL=action.js.map

package/dist/action.js.map

@@ -1 +1 @@
-{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACnE,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IAExE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,CAC3D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,gBAAgB;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,IAAI,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACrD,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IAExE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,CAC3D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,mCAAmC;IACnC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,IAAI,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,IAAI,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,uEAAuE;AACvE,iEAAiE;AACjE,sEAAsE;AACtE,kEAAkE;AAClE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,gEAAgE;AAChE,uDAAuD;AACvD,oFAAoF;AACpF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}

package/dist/cli.d.ts

@@ -5,15 +5,21 @@
  * not promised externally. See `notes/design-commitments.md`.
  *
  * Commands:
- *   plan       — compute and emit the release plan
- *   publish    — execute the plan against the registries
- *   version    — print CLI version
+ *   plan           — compute and emit the release plan
+ *   publish        — execute the plan against the registries
+ *   write-version  — bump a package's manifest to a planned version
+ *                    (pre-build hook for maturin; #276)
+ *   version        — print CLI version
  *
  * Global flags:
  *   --cwd <path>      working directory (default: process.cwd())
  *   --config <path>   path to putitoutthere.toml
  *   --json            machine-readable output
  *
+ * `write-version` flags:
+ *   --path <dir>      package directory (where pyproject.toml lives)
+ *   --version <v>     planned version to write
+ *
  * `--dry-run` was removed deliberately (#244). The library's job is
  * publishing; a non-publishing mode of the publish command was a
  * coverage hole pretending to be a feature. Passing `--dry-run` now
@@ -23,6 +29,8 @@ interface ParsedFlags {
     cwd: string;
     config?: string | undefined;
     json: boolean;
+    path?: string | undefined;
+    version?: string | undefined;
 }
 export declare function parseFlags(argv: readonly string[]): ParsedFlags;
 export declare function run(argv: readonly string[]): Promise<number>;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoCH,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CA4B/D;AAED,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8FlE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAwCH,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IAId,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CA8B/D;AAED,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6GlE"}

package/dist/cli.js

@@ -5,15 +5,21 @@
  * not promised externally. See `notes/design-commitments.md`.
  *
  * Commands:
- *   plan       — compute and emit the release plan
- *   publish    — execute the plan against the registries
- *   version    — print CLI version
+ *   plan           — compute and emit the release plan
+ *   publish        — execute the plan against the registries
+ *   write-version  — bump a package's manifest to a planned version
+ *                    (pre-build hook for maturin; #276)
+ *   version        — print CLI version
  *
  * Global flags:
  *   --cwd <path>      working directory (default: process.cwd())
  *   --config <path>   path to putitoutthere.toml
  *   --json            machine-readable output
  *
+ * `write-version` flags:
+ *   --path <dir>      package directory (where pyproject.toml lives)
+ *   --version <v>     planned version to write
+ *
  * `--dry-run` was removed deliberately (#244). The library's job is
  * publishing; a non-publishing mode of the publish command was a
  * coverage hole pretending to be a feature. Passing `--dry-run` now
@@ -22,8 +28,9 @@
 import { isAbsolute, resolve } from 'node:path';
 import { plan } from './plan.js';
 import { publish } from './publish.js';
+import { writeVersionForBuild } from './write-version.js';
 import { VERSION } from './version.js';
-const COMMANDS = ['plan', 'publish', 'version'];
+const COMMANDS = ['plan', 'publish', 'write-version', 'version'];
 function isCommand(value) {
     return COMMANDS.includes(value);
 }
@@ -32,13 +39,16 @@ function printUsage() {
         'Usage: putitoutthere <command> [options]',
         '',
         'Commands:',
-        '  plan       Compute and emit the release plan',
-        '  publish    Execute the plan',
-        '  version    Print CLI version',
+        '  plan           Compute and emit the release plan',
+        '  publish        Execute the plan',
+        '  write-version  Bump a package manifest to the planned version (pre-build; #276)',
+        '  version        Print CLI version',
         '',
         'Options:',
         '  --cwd <path>      working directory',
         '  --config <path>   path to putitoutthere.toml',
+        '  --path <dir>      package directory (write-version)',
+        '  --version <v>     planned version (write-version)',
         '  --json            emit machine-readable output',
         '',
         'See https://github.com/thekevinscott/putitoutthere for docs.',
@@ -59,6 +69,10 @@ export function parseFlags(argv) {
             out.config = argv[++i];
         else if (a === '--json')
             out.json = true;
+        else if (a === '--path')
+            out.path = argv[++i];
+        else if (a === '--version')
+            out.version = argv[++i];
         else if (a === '--dry-run') {
             // Removed in #244. Publishing is the library's only job; a
             // non-publishing flavor of `publish` is a coverage hole, not
@@ -130,6 +144,21 @@ export async function run(argv) {
                 }
                 return 0;
             }
+            case 'write-version': {
+                // #276: pre-build hook used by `_matrix.yml`'s maturin steps.
+                // Maturin reads the version from disk at build time with no
+                // env override, so the manifest must match the planned
+                // version before maturin runs. crates / npm bump at publish;
+                // setuptools-scm / hatch-vcs use SETUPTOOLS_SCM_PRETEND_VERSION.
+                if (!flags.path)
+                    throw new Error('write-version: --path <pkg-dir> is required');
+                if (!flags.version)
+                    throw new Error('write-version: --version <v> is required');
+                const target = isAbsolute(flags.path) ? flags.path : resolve(flags.cwd, flags.path);
+                const written = writeVersionForBuild(target, flags.version);
+                process.stdout.write(`write-version: ${target} → ${flags.version}; wrote ${written.join(', ')}\n`);
+                return 0;
+            }
             case 'publish': {
                 const result = await publish({
                     cwd: flags.cwd,

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAGzD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAQ,QAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,0CAA0C;QAC1C,EAAE;QACF,WAAW;QACX,gDAAgD;QAChD,+BAA+B;QAC/B,gCAAgC;QAChC,EAAE;QACF,UAAU;QACV,uCAAuC;QACvC,gDAAgD;QAChD,kDAAkD;QAClD,EAAE;QACF,8DAA8D;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAgB;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,sFAAsF;QACtF,IAAI,CAAC,KAAK,OAAO;YAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;aAC7C,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC7C,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACpC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,8CAA8C;IAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE,CAC1E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrC,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;oBACxB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBACnD,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;wBAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;4BACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,CAC/F,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,gEAAgE;gBAChE,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC/C,IAAI,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EACpC,MAAM,CACP,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;oBAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,2FAA2F;oBAC3F,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBAC/C,6FAA6F;gBAC/F,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;wBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,oBAAoB;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,6DAA6D;YAC7D,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,yBAAyB"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,CAAU,CAAC;AAG1E,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAQ,QAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,0CAA0C;QAC1C,EAAE;QACF,WAAW;QACX,oDAAoD;QACpD,mCAAmC;QACnC,mFAAmF;QACnF,oCAAoC;QACpC,EAAE;QACF,UAAU;QACV,uCAAuC;QACvC,gDAAgD;QAChD,uDAAuD;QACvD,qDAAqD;QACrD,kDAAkD;QAClD,EAAE;QACF,8DAA8D;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAgB;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,sFAAsF;QACtF,IAAI,CAAC,KAAK,OAAO;YAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;aAC7C,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC7C,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACpC,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACzC,IAAI,CAAC,KAAK,WAAW;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC/C,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,8CAA8C;IAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE,CAC1E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrC,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;oBACxB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBACnD,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;wBAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;4BACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,CAC/F,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,gEAAgE;gBAChE,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,kEAAkE;gBAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC/C,IAAI,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,cAAc,CACf,YAAY,EACZ,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EACpC,MAAM,CACP,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,8DAA8D;gBAC9D,4DAA4D;gBAC5D,uDAAuD;gBACvD,6DAA6D;gBAC7D,iEAAiE;gBACjE,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAChF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAChF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpF,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,MAAM,MAAM,KAAK,CAAC,OAAO,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC7E,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;oBAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,2FAA2F;oBAC3F,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBAC/C,6FAA6F;gBAC/F,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;wBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,oBAAoB;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,6DAA6D;YAC7D,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,yBAAyB"}

package/dist/write-version.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Pre-build version bump used by `_matrix.yml`'s maturin steps. #276.
+ *
+ * Maturin reads `[project].version` from `pyproject.toml` (or
+ * `[package].version` from a sibling `Cargo.toml` when pyproject
+ * declares `dynamic = ["version"]`) at build time. There is no env
+ * override the build job can inject — `SETUPTOOLS_SCM_PRETEND_VERSION`
+ * is honored by hatch-vcs / setuptools-scm but not by maturin. So
+ * the on-disk manifest has to be rewritten before `maturin build`
+ * runs. crates and npm bump at publish (cargo / npm read the
+ * manifest at upload time, not before); maturin is the one path
+ * where the artifact (the wheel) leaves the build runner already
+ * versioned.
+ *
+ * This module is the build-time complement to `pypi.writeVersion`.
+ * The publish-time handler logs guidance for dynamic-version
+ * projects rather than rewriting Cargo.toml; here we actually do
+ * the rewrite, because the build step has no fallback.
+ */
+/**
+ * Rewrite the version source(s) for a maturin package and return the
+ * list of absolute paths that were modified.
+ *
+ * Dispatch:
+ *  - `[project].version = "..."` is a static literal → rewrite
+ *    pyproject.toml in place. If a sibling `Cargo.toml` with a
+ *    `[package].version` line is present, rewrite it too. This is
+ *    not redundant: a python-rust-maturin shape with both a static
+ *    pyproject literal AND a Cargo `[package].version` literal will
+ *    have the two manifests disagree post-bump if only pyproject is
+ *    rewritten, and maturin's mismatch-resolution behavior varies
+ *    by platform / version (PR #277 hit this on Windows: wheels
+ *    shipped at the stale Cargo literal even though pyproject was
+ *    bumped). Bumping both keeps the contract straightforward.
+ *  - `[project].dynamic = ["version", ...]` → rewrite the sibling
+ *    `Cargo.toml`'s `[package].version`. Errors if Cargo.toml is
+ *    missing.
+ *
+ * Throws on missing pyproject.toml, malformed TOML, or a `[project]`
+ * table that declares neither a literal nor `dynamic = ["version"]`.
+ *
+ * I/O uses `readFileSync` with `try` / `catch (ENOENT)` instead of an
+ * `existsSync` precheck — the precheck is a TOCTOU race CodeQL flags
+ * (`pull/277` advisories #13, #14), and `pypi.writeVersion` already
+ * uses the same try/catch shape we mirror here.
+ */
+export declare function writeVersionForBuild(pkgDir: string, version: string): string[];
+//# sourceMappingURL=write-version.d.ts.map

package/dist/write-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-version.d.ts","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA6E9E"}

package/dist/write-version.js

@@ -0,0 +1,134 @@
+/**
+ * Pre-build version bump used by `_matrix.yml`'s maturin steps. #276.
+ *
+ * Maturin reads `[project].version` from `pyproject.toml` (or
+ * `[package].version` from a sibling `Cargo.toml` when pyproject
+ * declares `dynamic = ["version"]`) at build time. There is no env
+ * override the build job can inject — `SETUPTOOLS_SCM_PRETEND_VERSION`
+ * is honored by hatch-vcs / setuptools-scm but not by maturin. So
+ * the on-disk manifest has to be rewritten before `maturin build`
+ * runs. crates and npm bump at publish (cargo / npm read the
+ * manifest at upload time, not before); maturin is the one path
+ * where the artifact (the wheel) leaves the build runner already
+ * versioned.
+ *
+ * This module is the build-time complement to `pypi.writeVersion`.
+ * The publish-time handler logs guidance for dynamic-version
+ * projects rather than rewriting Cargo.toml; here we actually do
+ * the rewrite, because the build step has no fallback.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { replaceCargoVersion } from './handlers/crates.js';
+import { replacePyProjectVersion } from './handlers/pypi.js';
+/**
+ * Rewrite the version source(s) for a maturin package and return the
+ * list of absolute paths that were modified.
+ *
+ * Dispatch:
+ *  - `[project].version = "..."` is a static literal → rewrite
+ *    pyproject.toml in place. If a sibling `Cargo.toml` with a
+ *    `[package].version` line is present, rewrite it too. This is
+ *    not redundant: a python-rust-maturin shape with both a static
+ *    pyproject literal AND a Cargo `[package].version` literal will
+ *    have the two manifests disagree post-bump if only pyproject is
+ *    rewritten, and maturin's mismatch-resolution behavior varies
+ *    by platform / version (PR #277 hit this on Windows: wheels
+ *    shipped at the stale Cargo literal even though pyproject was
+ *    bumped). Bumping both keeps the contract straightforward.
+ *  - `[project].dynamic = ["version", ...]` → rewrite the sibling
+ *    `Cargo.toml`'s `[package].version`. Errors if Cargo.toml is
+ *    missing.
+ *
+ * Throws on missing pyproject.toml, malformed TOML, or a `[project]`
+ * table that declares neither a literal nor `dynamic = ["version"]`.
+ *
+ * I/O uses `readFileSync` with `try` / `catch (ENOENT)` instead of an
+ * `existsSync` precheck — the precheck is a TOCTOU race CodeQL flags
+ * (`pull/277` advisories #13, #14), and `pypi.writeVersion` already
+ * uses the same try/catch shape we mirror here.
+ */
+export function writeVersionForBuild(pkgDir, version) {
+    const pyProjectPath = join(pkgDir, 'pyproject.toml');
+    let pyOriginal;
+    try {
+        pyOriginal = readFileSync(pyProjectPath, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            throw new Error(`write-version: pyproject.toml not found at ${pyProjectPath}`, {
+                cause: err,
+            });
+        }
+        /* v8 ignore next -- non-ENOENT read errors surface as-is */
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = parseToml(pyOriginal);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`write-version: failed to parse ${pyProjectPath}: ${msg}`, { cause: err });
+    }
+    const project = parsed?.project;
+    if (!project) {
+        throw new Error(`write-version: ${pyProjectPath} has no [project] table -- declare [project].version or [project].dynamic = ["version"]`);
+    }
+    const cargoPath = join(pkgDir, 'Cargo.toml');
+    if (isDynamicVersion(project)) {
+        let cargoOriginal;
+        try {
+            cargoOriginal = readFileSync(cargoPath, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                throw new Error(`write-version: pyproject.toml declares dynamic = ["version"] but Cargo.toml is missing at ${cargoPath}. Maturin's dynamic-version mode reads [package].version from Cargo.toml; without it there's nothing to bump.`, { cause: err });
+            }
+            /* v8 ignore next -- non-ENOENT read errors surface as-is */
+            throw err;
+        }
+        const cargoUpdated = replaceCargoVersion(cargoOriginal, version);
+        if (cargoUpdated !== cargoOriginal)
+            writeFileSync(cargoPath, cargoUpdated, 'utf8');
+        return [cargoPath];
+    }
+    const written = [];
+    const pyUpdated = replacePyProjectVersion(pyOriginal, version);
+    if (pyUpdated !== pyOriginal)
+        writeFileSync(pyProjectPath, pyUpdated, 'utf8');
+    written.push(pyProjectPath);
+    // Bump a sibling Cargo.toml's [package].version too, when present.
+    // Pure-python pyproject (no Rust crate) → no Cargo.toml → skip.
+    // Cargo.toml without [package].version (workspace root) → skip
+    // (replaceCargoVersion throws on missing field; catch and continue).
+    let cargoOriginal;
+    try {
+        cargoOriginal = readFileSync(cargoPath, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return written;
+        /* v8 ignore next -- non-ENOENT read errors surface as-is */
+        throw err;
+    }
+    let cargoUpdated;
+    try {
+        cargoUpdated = replaceCargoVersion(cargoOriginal, version);
+    }
+    catch {
+        // No [package].version in Cargo.toml — nothing to bump on the
+        // Cargo side. The pyproject bump above is the source of truth.
+        return written;
+    }
+    if (cargoUpdated !== cargoOriginal)
+        writeFileSync(cargoPath, cargoUpdated, 'utf8');
+    written.push(cargoPath);
+    return written;
+}
+function isDynamicVersion(project) {
+    const { dynamic } = project;
+    return Array.isArray(dynamic) && dynamic.includes('version');
+}
+//# sourceMappingURL=write-version.js.map

package/dist/write-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-version.js","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,aAAa,EAAE,EAAE;gBAC7E,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAI,MAA8C,EAAE,OAAO,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,yFAAyF,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE7C,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CACb,6FAA6F,SAAS,+GAA+G,EACrN,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,4DAA4D;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,aAAa;YAAE,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACnF,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,UAAU;QAAE,aAAa,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE5B,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,qEAAqE;IACrE,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACrE,4DAA4D;QAC5D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,+DAA+D;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,YAAY,KAAK,aAAa;QAAE,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA8B;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {