putitoutthere 0.3.12 → 0.3.14

package/dist/replace-cargo-version.js

@@ -0,0 +1,71 @@
+/**
+ * Rewrite the `version = "..."` assignment inside a manifest's `[package]`
+ * table, preserving everything else byte-for-byte.
+ *
+ * String surgery rather than a TOML round-trip, matching
+ * `replaceWorkspacePackageVersion` and `replaceDepVersionReq`: re-emitting
+ * parsed TOML discards the comments and formatting of a file the consumer
+ * owns.
+ *
+ * Lives in its own module rather than inside `handlers/crates.ts` so both
+ * the crates publish path and `writeResolvedCargoVersion` can reach it
+ * without an import cycle between the handler and the resolver it now
+ * delegates to. #639.
+ *
+ * **The match is bounded to the `[package]` table.** The original expression
+ *
+ *     /(\[package\][\s\S]*?)(^\s*version\s*=\s*")([^"]*)(")/m
+ *
+ * was lazy and anchored only on the `[package]` *header*, so on a manifest
+ * with no literal `[package].version` — one that inherits via
+ * `version.workspace = true` — it walked past the table boundary and matched
+ * the next `version = "..."` in the file, typically a dependency's
+ * requirement in a section table. It then rewrote that requirement to the
+ * release version, naming a release of someone else's crate that does not
+ * exist, and reported success.
+ *
+ * Callers that need to handle inheritance go through
+ * `writeResolvedCargoVersion`, which detects it first and rewrites
+ * `[workspace.package].version` at the workspace root instead. This function
+ * stays literal-only on purpose; bounding the table means it now fails loud
+ * on a manifest it cannot legitimately rewrite instead of corrupting a
+ * neighbouring field.
+ */
+/**
+ * The `[package]` table's body: its header line, then every following line
+ * up to the next table header. Refusing any line that opens a table is what
+ * keeps the match inside the table — the same technique
+ * `replaceDepVersionReq` uses for `[dependencies.<key>]`.
+ *
+ * The `^` anchor matters: without it a `[package]` mentioned in a comment
+ * would start the match, and the body would then run from the comment to the
+ * real table header and stop there — empty.
+ */
+const PACKAGE_TABLE = /^\[package\][^\n]*\n((?:(?!\[)[^\n]*(?:\n|$))*)/m;
+/**
+ * A literal `version = "..."` assignment on its own line. Anchored so a
+ * `version = "…"` inside a comment cannot be mistaken for the assignment,
+ * and tolerant of indentation and of spacing around the `=`.
+ */
+const VERSION_LINE = /^[ \t]*version[ \t]*=[ \t]*"([^"]*)"/m;
+const NO_VERSION = 'Cargo.toml: no [package].version field found';
+export function replaceCargoVersion(source, version) {
+    const table = PACKAGE_TABLE.exec(source);
+    if (table === null) {
+        throw new Error(NO_VERSION);
+    }
+    const body = table[1];
+    const line = VERSION_LINE.exec(body);
+    if (line === null) {
+        throw new Error(NO_VERSION);
+    }
+    const old = line[1];
+    // Offsets resolve against the original source: the table body starts after
+    // its header, and the value starts after this line's `version = "` prefix.
+    // Rewriting by offset rather than by `String.replace` keeps every other
+    // byte — comments, spacing, a same-valued `version` elsewhere — untouched.
+    const bodyStart = table.index + table[0].length - body.length;
+    const valueStart = bodyStart + line.index + line[0].length - old.length - 1;
+    return source.slice(0, valueStart) + version + source.slice(valueStart + old.length);
+}
+//# sourceMappingURL=replace-cargo-version.js.map

package/dist/replace-cargo-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-cargo-version.js","sourceRoot":"","sources":["../src/replace-cargo-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,kDAAkD,CAAC;AAEzE;;;;GAIG;AACH,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D,MAAM,UAAU,GAAG,8CAA8C,CAAC;AAElE,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,OAAe;IACjE,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAAA,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAAA,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IAEhC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAAA,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAAA,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;IAE9B,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AACvF,CAAC"}

package/dist/repo-relative-paths.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Absolute paths rendered the way `git status --porcelain` renders them:
+ * relative to the repository root, forward-slashed. #639.
+ *
+ * The crates pre-publish dirty-tree check compares engine-managed paths
+ * against porcelain output, and porcelain names every file relative to the
+ * repo root with forward slashes on every platform. Comparing an absolute,
+ * platform-separated path against that never matches, so the conversion has
+ * to happen first — and it happens for three different sets of paths (the
+ * manifests `writeVersion` wrote, the sibling package directories, the
+ * artifacts root), which is why it lives here rather than inline three times.
+ *
+ * Paths that do not sit under `cwd` are dropped rather than returned in
+ * `../…` form: porcelain can never name a file outside the repository, so
+ * such an entry could only ever fail to match, and keeping it would suggest
+ * to a reader that it might match something.
+ */
+/** Windows separators to the forward slashes git and this repo speak in. */
+export declare function toPosixPath(p: string): string;
+/**
+ * `paths` as repo-relative, forward-slashed strings, dropping any that
+ * resolve to `cwd` itself or to somewhere outside it. `undefined` means "no
+ * paths" and yields an empty list, so callers holding an optional field can
+ * pass it straight through.
+ */
+export declare function repoRelativePaths(cwd: string, paths: readonly string[] | undefined): string[];
+//# sourceMappingURL=repo-relative-paths.d.ts.map

package/dist/repo-relative-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-relative-paths.d.ts","sourceRoot":"","sources":["../src/repo-relative-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,EAAE,CAQV"}

package/dist/repo-relative-paths.js

@@ -0,0 +1,40 @@
+/**
+ * Absolute paths rendered the way `git status --porcelain` renders them:
+ * relative to the repository root, forward-slashed. #639.
+ *
+ * The crates pre-publish dirty-tree check compares engine-managed paths
+ * against porcelain output, and porcelain names every file relative to the
+ * repo root with forward slashes on every platform. Comparing an absolute,
+ * platform-separated path against that never matches, so the conversion has
+ * to happen first — and it happens for three different sets of paths (the
+ * manifests `writeVersion` wrote, the sibling package directories, the
+ * artifacts root), which is why it lives here rather than inline three times.
+ *
+ * Paths that do not sit under `cwd` are dropped rather than returned in
+ * `../…` form: porcelain can never name a file outside the repository, so
+ * such an entry could only ever fail to match, and keeping it would suggest
+ * to a reader that it might match something.
+ */
+import { relative } from 'node:path';
+/** Windows separators to the forward slashes git and this repo speak in. */
+export function toPosixPath(p) {
+    return p.replaceAll('\\', '/');
+}
+/**
+ * `paths` as repo-relative, forward-slashed strings, dropping any that
+ * resolve to `cwd` itself or to somewhere outside it. `undefined` means "no
+ * paths" and yields an empty list, so callers holding an optional field can
+ * pass it straight through.
+ */
+export function repoRelativePaths(cwd, paths) {
+    const out = [];
+    for (const p of paths ?? []) {
+        const rel = relative(cwd, p);
+        if (rel === '' || rel.startsWith('..')) {
+            continue;
+        }
+        out.push(toPosixPath(rel));
+    }
+    return out;
+}
+//# sourceMappingURL=repo-relative-paths.js.map

package/dist/repo-relative-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-relative-paths.js","sourceRoot":"","sources":["../src/repo-relative-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,KAAoC;IAEpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/types.d.ts

@@ -73,6 +73,22 @@ export interface Ctx {
      * can omit; absent => empty list.
      */
     siblingPackagePaths?: readonly string[];
+    /**
+     * Absolute paths of the manifests this package's `writeVersion` just
+     * wrote, threaded from its return value so `publish` can tell a managed
+     * bump apart from a stray edit.
+     *
+     * The crates handler's pre-publish dirty-tree check (#135) used to assume
+     * the only file it could have touched was the package's own `Cargo.toml`.
+     * That stopped being true once `writeVersion` learned to follow workspace
+     * inheritance (#639): a crate declaring `version.workspace = true` has its
+     * version bumped at the workspace root, a file outside the package
+     * directory that the guard would otherwise refuse on.
+     *
+     * Optional so local/test flows can omit; absent => the guard falls back to
+     * allowing only the package's own manifest.
+     */
+    managedManifestPaths?: readonly string[];
 }
 export interface Logger {
     debug(msg: string, fields?: Record<string, unknown>): void;
@@ -108,7 +124,16 @@ export interface PlatformPublishSummary {
     skipped: readonly string[];
 }
 export interface PublishResult {
-    status: 'published' | 'already-published' | 'skipped';
+    /**
+     * `delegated` (#623) means the handler did NOT upload: the artifact's
+     * upload runs somewhere the engine isn't. Only pypi uses it — PyPI
+     * Trusted Publishers cannot validate an OIDC token minted inside a
+     * cross-repo reusable workflow (warehouse#11096), so the upload happens
+     * in a caller-side job. It is deliberately distinct from `published`:
+     * nothing is on the registry yet, so the publish path must not cut the
+     * package's git tag, which is the record of what shipped.
+     */
+    status: 'published' | 'already-published' | 'skipped' | 'delegated';
     url?: string;
     bytes?: number;
     /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAKvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,oDAAoD;AACpD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,yDAAyD;IACzD,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC;AAE5C,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E;;;;;;;;;OASG;IACH,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnF,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E,SAAS,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjF;AAED,2CAA2C;AAC3C,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,eAAe;CACtC;AAED,4DAA4D;AAC5D,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,oBAAoB;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAID;+EAC+E;AAC/E,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,CAAC,CAGpF;AAED;;qBAEqB;AACrB,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAI5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAKvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,oDAAoD;AACpD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,yDAAyD;IACzD,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,MAAM,EAAE,WAAW,GAAG,mBAAmB,GAAG,SAAS,GAAG,WAAW,CAAC;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC;AAE5C,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E;;;;;;;;;OASG;IACH,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnF,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E,SAAS,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjF;AAED,2CAA2C;AAC3C,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,eAAe;CACtC;AAED,4DAA4D;AAC5D,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,oBAAoB;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAID;+EAC+E;AAC/E,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,CAAC,CAGpF;AAED;;qBAEqB;AACrB,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAI5E"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAA,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QAChD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AA2ID,2CAA2C;AAC3C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAG,WAAW,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C;AAkBD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;+EAC+E;AAC/E,MAAM,UAAU,iBAAiB,CAAkB,GAAM,EAAE,IAAsB;IAC9E,GAAqD,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;qBAEqB;AACrB,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAAA,OAAO,SAAS,CAAC;IAAA,CAAC;IAClD,MAAM,OAAO,GAAG,KAA0D,CAAC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAA,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QAChD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AAoKD,2CAA2C;AAC3C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAG,WAAW,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,gBAAgB,CAAC;CAC3C;AAkBD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;+EAC+E;AAC/E,MAAM,UAAU,iBAAiB,CAAkB,GAAM,EAAE,IAAsB;IAC9E,GAAqD,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;qBAEqB;AACrB,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAAA,OAAO,SAAS,CAAC;IAAA,CAAC;IAClD,MAAM,OAAO,GAAG,KAA0D,CAAC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACnC,CAAC"}

package/dist/unpublished-kinds.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The registry kinds a planned release still has work for (#622).
+ *
+ * Distinct `kind`s carrying at least one package whose planned version is
+ * NOT already on its registry, in first-seen order. The reusable workflow
+ * gates registry authentication on this: `release.yml` used to ask the build
+ * matrix "does this repo have a crates package?", which is true whenever a
+ * crate exists — published or not — so the crates.io OIDC exchange fired on
+ * re-runs with nothing left to ship, and a failing exchange killed the
+ * publish job before npm and PyPI got their turn.
+ *
+ * `unknown` (the registry could not be reached, so `plan` degraded rather
+ * than aborting) counts as unpublished. Reading "we could not tell" as
+ * "nothing to do" would drop the credential a publish may well still need,
+ * turning a registry blip at plan time into an auth failure at publish time;
+ * listing the kind preserves the pre-#622 behaviour in exactly that case.
+ */
+import type { PlanVerdict } from './plan-status-types.js';
+import type { Kind } from './types.js';
+export declare function unpublishedKinds(verdicts: readonly PlanVerdict[]): Kind[];
+//# sourceMappingURL=unpublished-kinds.d.ts.map

package/dist/unpublished-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublished-kinds.d.ts","sourceRoot":"","sources":["../src/unpublished-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,GAAG,IAAI,EAAE,CAOzE"}

package/dist/unpublished-kinds.js

@@ -0,0 +1,30 @@
+/**
+ * The registry kinds a planned release still has work for (#622).
+ *
+ * Distinct `kind`s carrying at least one package whose planned version is
+ * NOT already on its registry, in first-seen order. The reusable workflow
+ * gates registry authentication on this: `release.yml` used to ask the build
+ * matrix "does this repo have a crates package?", which is true whenever a
+ * crate exists — published or not — so the crates.io OIDC exchange fired on
+ * re-runs with nothing left to ship, and a failing exchange killed the
+ * publish job before npm and PyPI got their turn.
+ *
+ * `unknown` (the registry could not be reached, so `plan` degraded rather
+ * than aborting) counts as unpublished. Reading "we could not tell" as
+ * "nothing to do" would drop the credential a publish may well still need,
+ * turning a registry blip at plan time into an auth failure at publish time;
+ * listing the kind preserves the pre-#622 behaviour in exactly that case.
+ */
+export function unpublishedKinds(verdicts) {
+    const kinds = [];
+    for (const verdict of verdicts) {
+        if (verdict.verdict === 'skip') {
+            continue;
+        }
+        if (!kinds.includes(verdict.kind)) {
+            kinds.push(verdict.kind);
+        }
+    }
+    return kinds;
+}
+//# sourceMappingURL=unpublished-kinds.js.map

package/dist/unpublished-kinds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublished-kinds.js","sourceRoot":"","sources":["../src/unpublished-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,MAAM,UAAU,gBAAgB,CAAC,QAAgC;IAC/D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAA,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAA,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/write-resolved-cargo-version.js

@@ -2,7 +2,7 @@ import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { parse as parseToml } from 'smol-toml';
 import { findWorkspaceRoot } from './find-workspace-root.js';
-import { replaceCargoVersion } from './handlers/crates.js';
+import { replaceCargoVersion } from './replace-cargo-version.js';
 import { replaceWorkspacePackageVersion } from './replace-workspace-package-version.js';
 /**
  * Rewrite a crate's version to `version`, following Cargo workspace

package/dist/write-resolved-cargo-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-resolved-cargo-version.js","sourceRoot":"","sources":["../src/write-resolved-cargo-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB,EAChB,WAAmB,EACnB,OAAe;IAEf,uEAAuE;IACvE,mEAAmE;IACnE,2CAA2C;IAC3C,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAI,SAAS,CAAC,WAAW,CAAyC,CAAC,OAAO,EAAE,OAAO,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GACZ,CAAC,CAAC,UAAU;QACZ,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAsC,CAAC,SAAS,KAAK,IAAI,CAAC;IAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAAA,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAAA,CAAC;QAC3E,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,iJAAiJ,CAC7L,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAAA,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAAA,CAAC;IACzE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"write-resolved-cargo-version.js","sourceRoot":"","sources":["../src/write-resolved-cargo-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB,EAChB,WAAmB,EACnB,OAAe;IAEf,uEAAuE;IACvE,mEAAmE;IACnE,2CAA2C;IAC3C,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAI,SAAS,CAAC,WAAW,CAAyC,CAAC,OAAO,EAAE,OAAO,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GACZ,CAAC,CAAC,UAAU;QACZ,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAsC,CAAC,SAAS,KAAK,IAAI,CAAC;IAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAAA,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAAA,CAAC;QAC3E,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,iJAAiJ,CAC7L,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAAA,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAAA,CAAC;IACzE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {