putitoutthere 0.3.8 → 0.3.9

package/dist/cargo-dep-entries.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Every dependency entry declared by a parsed `Cargo.toml`, flattened
+ * across the tables cargo resolves. #621.
+ *
+ * Cargo accepts a dependency in more places than `[dependencies]`, and a
+ * stale version requirement in **any** of them fails resolution
+ * identically — verified against cargo 1.94.1 for `[dev-dependencies]`,
+ * `[build-dependencies]`, `[target.'cfg(…)'.dependencies]` and
+ * `[workspace.dependencies]`. A version rewrite that walks only
+ * `[dependencies]` therefore still leaves an unbuildable tree, so the
+ * flattening happens here, once, rather than at each call site.
+ *
+ * Pure: takes an already-parsed manifest, touches no I/O.
+ */
+/** One dependency declaration, normalized to its object form. */
+export interface CargoDepEntry {
+    /** The key as written — a rename, not necessarily the crate name. */
+    key: string;
+    /** `path = "…"` as written (relative to the manifest's directory). */
+    path?: string | undefined;
+    /** True when the entry carries a `version = "…"` requirement. */
+    hasVersionReq: boolean;
+    /** True when the entry defers to `[workspace.dependencies]`. */
+    inheritsFromWorkspace: boolean;
+}
+/**
+ * Flatten every dependency entry in `parsed`, including target-specific
+ * tables and `[workspace.dependencies]`.
+ *
+ * The shorthand form (`serde = "1"`) can never be a path dependency, so
+ * it is reported with no `path` rather than skipped — callers filter on
+ * `path` and would otherwise have to re-derive that fact.
+ */
+export declare function cargoDepEntries(parsed: unknown): CargoDepEntry[];
+//# sourceMappingURL=cargo-dep-entries.d.ts.map

package/dist/cargo-dep-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo-dep-entries.d.ts","sourceRoot":"","sources":["../src/cargo-dep-entries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAMD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,EAAE,CAahE"}

package/dist/cargo-dep-entries.js

@@ -0,0 +1,81 @@
+/**
+ * Every dependency entry declared by a parsed `Cargo.toml`, flattened
+ * across the tables cargo resolves. #621.
+ *
+ * Cargo accepts a dependency in more places than `[dependencies]`, and a
+ * stale version requirement in **any** of them fails resolution
+ * identically — verified against cargo 1.94.1 for `[dev-dependencies]`,
+ * `[build-dependencies]`, `[target.'cfg(…)'.dependencies]` and
+ * `[workspace.dependencies]`. A version rewrite that walks only
+ * `[dependencies]` therefore still leaves an unbuildable tree, so the
+ * flattening happens here, once, rather than at each call site.
+ *
+ * Pure: takes an already-parsed manifest, touches no I/O.
+ */
+/**
+ * Flatten every dependency entry in `parsed`, including target-specific
+ * tables and `[workspace.dependencies]`.
+ *
+ * The shorthand form (`serde = "1"`) can never be a path dependency, so
+ * it is reported with no `path` rather than skipped — callers filter on
+ * `path` and would otherwise have to re-derive that fact.
+ */
+export function cargoDepEntries(parsed) {
+    // `?? {}` rather than a type guard: a primitive yields `undefined` for
+    // every lookup below, so only null/undefined need substituting, and the
+    // extra `typeof` arm a guard would carry could never change an outcome.
+    const root = (parsed ?? {});
+    const out = [];
+    for (const table of collectTables(root)) {
+        for (const [key, value] of Object.entries(table)) {
+            out.push(toEntry(key, value));
+        }
+    }
+    return out;
+}
+const DEP_TABLE_NAMES = ['dependencies', 'dev-dependencies', 'build-dependencies'];
+/** Every dependency-bearing table: top level, per-target, and workspace. */
+function collectTables(root) {
+    const tables = [];
+    const push = (v) => {
+        if (v !== null && typeof v === 'object') {
+            tables.push(v);
+        }
+    };
+    for (const name of DEP_TABLE_NAMES) {
+        push(root[name]);
+    }
+    // `[target.'cfg(unix)'.dependencies]` and friends. The cfg expression is
+    // an arbitrary string key, so every value under `target` is inspected.
+    const target = root['target'];
+    if (target !== null && typeof target === 'object') {
+        for (const perTarget of Object.values(target)) {
+            const tables_ = (perTarget ?? {});
+            for (const name of DEP_TABLE_NAMES) {
+                push(tables_[name]);
+            }
+        }
+    }
+    // `[workspace.dependencies]` — where an inheriting member's requirement
+    // actually lives, so the rewrite has to reach it.
+    const workspace = root['workspace'];
+    if (workspace !== null && typeof workspace === 'object') {
+        push(workspace['dependencies']);
+    }
+    return tables;
+}
+function toEntry(key, value) {
+    // `serde = "1"` — a bare version requirement; never a path dependency.
+    if (typeof value === 'string') {
+        return { key, hasVersionReq: true, inheritsFromWorkspace: false };
+    }
+    const obj = (value ?? {});
+    const path = typeof obj['path'] === 'string' ? obj['path'] : undefined;
+    return {
+        key,
+        path,
+        hasVersionReq: typeof obj['version'] === 'string',
+        inheritsFromWorkspace: obj['workspace'] === true,
+    };
+}
+//# sourceMappingURL=cargo-dep-entries.js.map

package/dist/cargo-dep-entries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo-dep-entries.js","sourceRoot":"","sources":["../src/cargo-dep-entries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkBH;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACvD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,CAAU,CAAC;AAE5F,4EAA4E;AAC5E,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;QAChC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAA,MAAM,CAAC,IAAI,CAAC,CAAa,CAAC,CAAC;QAAA,CAAC;IACxE,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QAAA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAAA,CAAC;IAEvD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAiC,CAAC,EAAE,CAAC;YACzE,MAAM,OAAO,GAAG,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;YAC7D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxD,IAAI,CAAE,SAAqC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,KAAc;IAC1C,uEAAuE;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,OAAO;QACL,GAAG;QACH,IAAI;QACJ,aAAa,EAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ;QACjD,qBAAqB,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;KACjD,CAAC;AACJ,CAAC"}

package/dist/replace-dep-version-req.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Rewrite the `version = "…"` requirement on a **path** dependency,
+ * preserving the rest of the manifest byte-for-byte. #621.
+ *
+ * Bumping an embedded crate without moving the requirements that point at
+ * it is worse than leaving it stale: cargo stops resolving entirely.
+ *
+ *     error: failed to select a version for the requirement `demo-core = "^0.2"`
+ *     candidate versions found which didn't match: 0.4.2
+ *
+ * That is a hard failure (exit 101) before anything compiles, and a
+ * `version` key alongside `path` is *mandatory* for any crate that also
+ * publishes to crates.io — so the shape that needs this is exactly the
+ * shape polyglot repos have.
+ *
+ * String surgery rather than a TOML round-trip, matching
+ * `replaceCargoVersion` and `replaceWorkspacePackageVersion`: re-emitting
+ * parsed TOML discards comments and formatting from a file the consumer
+ * owns.
+ *
+ * Only entries that also carry a `path` key are touched. A registry
+ * dependency that happens to share the key name keeps its requirement —
+ * rewriting pyo3's `0.22` to the release version would pin a version that
+ * does not exist.
+ */
+/**
+ * Rewrite every `version` requirement declared for `depKey` **that also
+ * declares a `path`**, in either dependency-entry syntax:
+ *
+ *   - inline table — `demo-core = { path = "../core", version = "0.2" }`
+ *   - section table — `[dependencies.demo-core]` / `path` / `version`
+ *
+ * Both forms are scanned across the whole manifest, so a dependency
+ * declared in several tables (normal plus dev, plus a `cfg`-gated one)
+ * has every occurrence rewritten. Returns the source unchanged when the
+ * key declares no path-plus-version entry.
+ */
+export declare function replaceDepVersionReq(source: string, depKey: string, version: string): string;
+//# sourceMappingURL=replace-dep-version-req.d.ts.map

package/dist/replace-dep-version-req.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-dep-version-req.d.ts","sourceRoot":"","sources":["../src/replace-dep-version-req.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAG5F"}

package/dist/replace-dep-version-req.js

@@ -0,0 +1,75 @@
+/**
+ * Rewrite the `version = "…"` requirement on a **path** dependency,
+ * preserving the rest of the manifest byte-for-byte. #621.
+ *
+ * Bumping an embedded crate without moving the requirements that point at
+ * it is worse than leaving it stale: cargo stops resolving entirely.
+ *
+ *     error: failed to select a version for the requirement `demo-core = "^0.2"`
+ *     candidate versions found which didn't match: 0.4.2
+ *
+ * That is a hard failure (exit 101) before anything compiles, and a
+ * `version` key alongside `path` is *mandatory* for any crate that also
+ * publishes to crates.io — so the shape that needs this is exactly the
+ * shape polyglot repos have.
+ *
+ * String surgery rather than a TOML round-trip, matching
+ * `replaceCargoVersion` and `replaceWorkspacePackageVersion`: re-emitting
+ * parsed TOML discards comments and formatting from a file the consumer
+ * owns.
+ *
+ * Only entries that also carry a `path` key are touched. A registry
+ * dependency that happens to share the key name keeps its requirement —
+ * rewriting pyo3's `0.22` to the release version would pin a version that
+ * does not exist.
+ */
+/** Escape a dependency key for literal use inside a RegExp. */
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Rewrite every `version` requirement declared for `depKey` **that also
+ * declares a `path`**, in either dependency-entry syntax:
+ *
+ *   - inline table — `demo-core = { path = "../core", version = "0.2" }`
+ *   - section table — `[dependencies.demo-core]` / `path` / `version`
+ *
+ * Both forms are scanned across the whole manifest, so a dependency
+ * declared in several tables (normal plus dev, plus a `cfg`-gated one)
+ * has every occurrence rewritten. Returns the source unchanged when the
+ * key declares no path-plus-version entry.
+ */
+export function replaceDepVersionReq(source, depKey, version) {
+    const key = escapeRe(depKey);
+    return replaceInlineTableForm(replaceSectionTableForm(source, key, version), key, version);
+}
+/**
+ * `[dependencies.demo-core]` … through to the next table header. Matches
+ * any dependency table — `[dev-dependencies.x]`,
+ * `[target.'cfg(unix)'.dependencies.x]` — via the `dependencies.` suffix
+ * on the header path. The body is consumed line by line, refusing any
+ * line that opens a new table, so a `[` inside a value (`features =
+ * ["cli"]`) cannot end the section early.
+ */
+function replaceSectionTableForm(source, key, version) {
+    const section = new RegExp(`(^\\[[^\\]\\n]*dependencies\\.${key}\\][^\\n]*\\n)((?:(?!\\[)[^\\n]*(?:\\n|$))*)`, 'gm');
+    return source.replace(section, (whole, header, body) => body.includes('path') ? header + setVersionIn(body, version) : whole);
+}
+/**
+ * `demo-core = { path = "../core", version = "0.2" }`, including the
+ * multi-line brace form. Cargo dependency entries never nest a further
+ * `{ … }`, so the body is everything up to the first `}`.
+ */
+function replaceInlineTableForm(source, key, version) {
+    const entry = new RegExp(`^[ \\t]*"?${key}"?[ \\t]*=[ \\t]*\\{[^}]*\\}`, 'gm');
+    return source.replace(entry, (whole) => whole.includes('path') ? setVersionIn(whole, version) : whole);
+}
+/**
+ * Replace the first `version = "…"` value in `segment`. Un-anchored so it
+ * covers both the one-line inline table and the multi-line/section forms
+ * where the key sits on its own line.
+ */
+function setVersionIn(segment, version) {
+    return segment.replace(/(\bversion[ \t]*=[ \t]*")([^"]*)(")/, `$1${version}$3`);
+}
+//# sourceMappingURL=replace-dep-version-req.js.map

package/dist/replace-dep-version-req.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-dep-version-req.js","sourceRoot":"","sources":["../src/replace-dep-version-req.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,+DAA+D;AAC/D,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,sBAAsB,CAAC,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,MAAc,EAAE,GAAW,EAAE,OAAe;IAC3E,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,iCAAiC,GAAG,8CAA8C,EAClF,IAAI,CACL,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE,CACrE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CACrE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc,EAAE,GAAW,EAAE,OAAe;IAC1E,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,aAAa,GAAG,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAC7C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,OAAe;IACpD,OAAO,OAAO,CAAC,OAAO,CAAC,qCAAqC,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC;AAClF,CAAC"}

package/dist/resolve-dep-dirs.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Resolve a manifest's dependency entries to the on-disk directories they
+ * point at. #621.
+ *
+ * Two indirections have to be followed before a `path` is in hand, and
+ * missing either one silently drops a crate from the version rewrite:
+ *
+ *  - a member may defer to the workspace (`demo-core.workspace = true`),
+ *    which puts both the `path` and the version requirement in the
+ *    workspace root's `[workspace.dependencies]`, a different file;
+ *  - `path` is relative to the *declaring manifest's* directory, and for
+ *    an inherited entry that is the workspace root, not the member.
+ *
+ * Shared by the discovery walk and the requirement rewrite so the two can
+ * never disagree about which crates are in scope.
+ */
+/** A dependency entry that resolves to a directory on disk. */
+export interface ResolvedDepDir {
+    /** The dependency key as written in the manifest being rewritten. */
+    key: string;
+    /** Absolute directory of the dependency crate. */
+    dir: string;
+    /** True when the entry carries a `version = "…"` requirement. */
+    hasVersionReq: boolean;
+    /**
+     * True when the requirement lives in the workspace root rather than in
+     * this manifest — the rewrite has to target the root's file instead.
+     */
+    inheritsFromWorkspace: boolean;
+}
+/**
+ * Every path dependency declared by `parsed`, resolved to an absolute
+ * directory. Registry dependencies are omitted — they have no directory
+ * and must never be rewritten.
+ *
+ * `workspaceParsed` is the parsed workspace-root manifest (or `null` when
+ * there is no workspace); it supplies `[workspace.dependencies]` for
+ * inheriting entries.
+ */
+export declare function resolveDepDirs(parsed: unknown, manifestDir: string, workspaceParsed: unknown, workspaceRoot: string | null): ResolvedDepDir[];
+//# sourceMappingURL=resolve-dep-dirs.d.ts.map

package/dist/resolve-dep-dirs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-dep-dirs.d.ts","sourceRoot":"","sources":["../src/resolve-dep-dirs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,OAAO,EACxB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,cAAc,EAAE,CA+BlB"}

package/dist/resolve-dep-dirs.js

@@ -0,0 +1,89 @@
+/**
+ * Resolve a manifest's dependency entries to the on-disk directories they
+ * point at. #621.
+ *
+ * Two indirections have to be followed before a `path` is in hand, and
+ * missing either one silently drops a crate from the version rewrite:
+ *
+ *  - a member may defer to the workspace (`demo-core.workspace = true`),
+ *    which puts both the `path` and the version requirement in the
+ *    workspace root's `[workspace.dependencies]`, a different file;
+ *  - `path` is relative to the *declaring manifest's* directory, and for
+ *    an inherited entry that is the workspace root, not the member.
+ *
+ * Shared by the discovery walk and the requirement rewrite so the two can
+ * never disagree about which crates are in scope.
+ */
+import { isAbsolute, resolve } from 'node:path';
+import { cargoDepEntries } from './cargo-dep-entries.js';
+/**
+ * Every path dependency declared by `parsed`, resolved to an absolute
+ * directory. Registry dependencies are omitted — they have no directory
+ * and must never be rewritten.
+ *
+ * `workspaceParsed` is the parsed workspace-root manifest (or `null` when
+ * there is no workspace); it supplies `[workspace.dependencies]` for
+ * inheriting entries.
+ */
+export function resolveDepDirs(parsed, manifestDir, workspaceParsed, workspaceRoot) {
+    // Only consult the workspace table when there is a root to resolve its
+    // relative paths against; an empty map then makes every inherited lookup
+    // miss, so no separate null check is needed per entry.
+    const inherited = workspaceRoot === null
+        ? new Map()
+        : workspaceDepDirs(workspaceParsed, workspaceRoot);
+    const out = [];
+    for (const entry of cargoDepEntries(parsed)) {
+        if (entry.path !== undefined) {
+            out.push({
+                key: entry.key,
+                dir: absolute(entry.path, manifestDir),
+                hasVersionReq: entry.hasVersionReq,
+                inheritsFromWorkspace: false,
+            });
+            continue;
+        }
+        if (!entry.inheritsFromWorkspace) {
+            continue;
+        }
+        const ws = inherited.get(entry.key);
+        if (ws === undefined) {
+            continue;
+        }
+        out.push({
+            key: entry.key,
+            dir: ws.dir,
+            hasVersionReq: ws.hasVersionReq,
+            inheritsFromWorkspace: true,
+        });
+    }
+    return out;
+}
+/**
+ * `[workspace.dependencies]` entries that carry a `path`, keyed by name and
+ * already resolved against `workspaceRoot` — the manifest that declared
+ * them, and therefore the base those relative paths are written against.
+ */
+function workspaceDepDirs(workspaceParsed, workspaceRoot) {
+    const map = new Map();
+    // Optional chaining rather than a guard per level: a primitive yields
+    // `undefined` for the next lookup anyway, so only null/undefined need
+    // handling and each `typeof` arm would be unobservable.
+    const workspace = workspaceParsed?.workspace;
+    const deps = workspace?.dependencies;
+    for (const [key, value] of Object.entries((deps ?? {}))) {
+        const obj = (value ?? {});
+        if (typeof obj['path'] !== 'string') {
+            continue;
+        }
+        map.set(key, {
+            dir: absolute(obj['path'], workspaceRoot),
+            hasVersionReq: typeof obj['version'] === 'string',
+        });
+    }
+    return map;
+}
+function absolute(p, base) {
+    return isAbsolute(p) ? p : resolve(base, p);
+}
+//# sourceMappingURL=resolve-dep-dirs.js.map

package/dist/resolve-dep-dirs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-dep-dirs.js","sourceRoot":"","sources":["../src/resolve-dep-dirs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAiBzD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAe,EACf,WAAmB,EACnB,eAAwB,EACxB,aAA4B;IAE5B,uEAAuE;IACvE,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,SAAS,GACb,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,IAAI,GAAG,EAAmD;QAC5D,CAAC,CAAC,gBAAgB,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;gBACtC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,qBAAqB,EAAE,KAAK;aAC7B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QAC7C,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,qBAAqB,EAAE,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,eAAwB,EACxB,aAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmD,CAAC;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,SAAS,GAAI,eAAkD,EAAE,SAAS,CAAC;IACjF,MAAM,IAAI,GAAI,SAA+C,EAAE,YAAY,CAAC;IAE5E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;QACnF,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;QACrD,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;YACX,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;YACzC,aAAa,EAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ;SAClD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,IAAY;IACvC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/write-crate-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-crate-version.d.ts","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAepG"}
+{"version":3,"file":"write-crate-version.d.ts","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBpG"}

package/dist/write-crate-version.js

@@ -19,6 +19,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { writeEmbeddedCrateVersions } from './write-embedded-crate-versions.js';
 import { writeResolvedCargoVersion } from './write-resolved-cargo-version.js';
 /**
  * Rewrite `[package].version` in the crate at `crateDir` to `version`
@@ -43,6 +44,11 @@ export async function writeCrateVersionForBuild(crateDir, version) {
         }
         throw err;
     }
-    return await writeResolvedCargoVersion(crateDir, original, version);
+    const written = await writeResolvedCargoVersion(crateDir, original, version);
+    // #621: the compiled binary also embeds every in-repo crate this one
+    // pulls in by path, and it is often the *dependency* that owns the
+    // version-bearing symbol. Bumping only this crate ships a stale literal.
+    const embedded = await writeEmbeddedCrateVersions(crateDir, version);
+    return [...new Set([...written, ...embedded])];
 }
 //# sourceMappingURL=write-crate-version.js.map

package/dist/write-crate-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-crate-version.js","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,gDAAgD,SAAS,wGAAwG,EACjK,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"write-crate-version.js","sourceRoot":"","sources":["../src/write-crate-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,gDAAgD,SAAS,wGAAwG,EACjK,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7E,qEAAqE;IACrE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/write-embedded-crate-versions.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Bump every in-repo crate an artifact compiles, plus the version
+ * requirements that point at them. #621.
+ *
+ * The three pre-build writers each bump the crate the build tool reads as
+ * its version source — maturin's `matrix.path`, `bundle_cli.crate_path`,
+ * the napi crate. That answers "what version is this artifact?" but not
+ * "whose `CARGO_PKG_VERSION` is observable *from* this artifact?" Those
+ * sets coincide only when the artifact is one crate deep. Embed a sibling
+ * by path, let the sibling own the version-bearing symbol (clap's
+ * `#[command(version)]` expands `env!("CARGO_PKG_VERSION")` inside the
+ * crate where the attribute is written), and nothing bumps the sibling.
+ *
+ * `CARGO_PKG_VERSION` is a compile-time constant scoped per crate and has
+ * no env override — not `CARGO_PKG_VERSION=… cargo build`, not
+ * `.cargo/config.toml [env]` with `force = true`. Rewriting the manifest
+ * before the build is the only lever there is.
+ *
+ * **Semantics: the artifact's version wins.** Every in-repo crate the
+ * artifact compiles is stamped with the artifact's release version, so a
+ * user who installs `dirsql 0.4.2` sees `0.4.2` from every surface the
+ * artifact exposes. The alternative — giving each declared `[[package]]`
+ * its own planned version — is indistinguishable for a repo whose crates
+ * cascade together at one version, and differs only where a repo keeps
+ * crates on deliberately separate version lines. It can be layered on
+ * later using this same requirement-rewrite machinery.
+ *
+ * The rewrites are ephemeral: the build job's checkout is thrown away and
+ * `publish` runs in a separate job off a fresh checkout, so nothing here
+ * reaches the crates handler's dirty-tree check or a published manifest.
+ */
+/**
+ * Walk the path-dependency graph out of `startDir`, bump every crate
+ * reached to `version`, and rewrite every in-repo version requirement
+ * that points at one of them. Returns the absolute paths modified.
+ *
+ * `startDir` itself is assumed already bumped by the caller (that is the
+ * pre-existing writer's job); it is still included when rewriting
+ * requirements, since a sibling may depend on it.
+ *
+ * Reachability from the built crate is the criterion, not workspace
+ * membership: a sibling member nobody depends on is not in the artifact
+ * and is left alone.
+ */
+export declare function writeEmbeddedCrateVersions(startDir: string, version: string): Promise<string[]>;
+//# sourceMappingURL=write-embedded-crate-versions.d.ts.map

package/dist/write-embedded-crate-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-embedded-crate-versions.d.ts","sourceRoot":"","sources":["../src/write-embedded-crate-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAkBH;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CA0DnB"}

package/dist/write-embedded-crate-versions.js

@@ -0,0 +1,172 @@
+/**
+ * Bump every in-repo crate an artifact compiles, plus the version
+ * requirements that point at them. #621.
+ *
+ * The three pre-build writers each bump the crate the build tool reads as
+ * its version source — maturin's `matrix.path`, `bundle_cli.crate_path`,
+ * the napi crate. That answers "what version is this artifact?" but not
+ * "whose `CARGO_PKG_VERSION` is observable *from* this artifact?" Those
+ * sets coincide only when the artifact is one crate deep. Embed a sibling
+ * by path, let the sibling own the version-bearing symbol (clap's
+ * `#[command(version)]` expands `env!("CARGO_PKG_VERSION")` inside the
+ * crate where the attribute is written), and nothing bumps the sibling.
+ *
+ * `CARGO_PKG_VERSION` is a compile-time constant scoped per crate and has
+ * no env override — not `CARGO_PKG_VERSION=… cargo build`, not
+ * `.cargo/config.toml [env]` with `force = true`. Rewriting the manifest
+ * before the build is the only lever there is.
+ *
+ * **Semantics: the artifact's version wins.** Every in-repo crate the
+ * artifact compiles is stamped with the artifact's release version, so a
+ * user who installs `dirsql 0.4.2` sees `0.4.2` from every surface the
+ * artifact exposes. The alternative — giving each declared `[[package]]`
+ * its own planned version — is indistinguishable for a repo whose crates
+ * cascade together at one version, and differs only where a repo keeps
+ * crates on deliberately separate version lines. It can be layered on
+ * later using this same requirement-rewrite machinery.
+ *
+ * The rewrites are ephemeral: the build job's checkout is thrown away and
+ * `publish` runs in a separate job off a fresh checkout, so nothing here
+ * reaches the crates handler's dirty-tree check or a published manifest.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { findWorkspaceRoot } from './find-workspace-root.js';
+import { replaceDepVersionReq } from './replace-dep-version-req.js';
+import { resolveDepDirs } from './resolve-dep-dirs.js';
+import { writeResolvedCargoVersion } from './write-resolved-cargo-version.js';
+/**
+ * Walk the path-dependency graph out of `startDir`, bump every crate
+ * reached to `version`, and rewrite every in-repo version requirement
+ * that points at one of them. Returns the absolute paths modified.
+ *
+ * `startDir` itself is assumed already bumped by the caller (that is the
+ * pre-existing writer's job); it is still included when rewriting
+ * requirements, since a sibling may depend on it.
+ *
+ * Reachability from the built crate is the criterion, not workspace
+ * membership: a sibling member nobody depends on is not in the artifact
+ * and is left alone.
+ */
+export async function writeEmbeddedCrateVersions(startDir, version) {
+    // Canonicalize before anything is compared. Every directory discovered
+    // below arrives via `resolve`, so a caller-supplied `startDir` that is
+    // relative, trailing-separated, or (on Windows) drive-letter-less would
+    // never equal its own resolved form — and the identity checks that keep
+    // the walk finite and stop the starting crate being re-bumped are all
+    // string equality on these paths.
+    const start = resolve(startDir);
+    // Any non-string stands for "no workspace above this crate" — the walk
+    // legitimately returns null at the filesystem root.
+    const found = await findWorkspaceRoot(start);
+    const workspaceRoot = typeof found === 'string' ? found : null;
+    const workspaceParsed = workspaceRoot === null ? null : (await readManifest(workspaceRoot))?.parsed;
+    const embedded = await collectEmbedded(start, workspaceParsed, workspaceRoot);
+    const written = new Set();
+    // 1. Bump each embedded crate. `writeResolvedCargoVersion` follows
+    //    `version.workspace = true` up to the workspace root (#428).
+    for (const dir of embedded) {
+        const manifest = await readManifest(dir);
+        // A virtual manifest declares `[workspace]` but no crate to version.
+        if (manifest === null || !hasPackageTable(manifest.parsed)) {
+            continue;
+        }
+        for (const p of await writeResolvedCargoVersion(dir, manifest.source, version)) {
+            written.add(p);
+        }
+    }
+    // 2. Rewrite requirements pointing at anything bumped. The workspace
+    //    root is included because an inheriting member's requirement lives
+    //    there, in a file no member's own rewrite would touch.
+    const bumped = new Set([...embedded, start]);
+    const manifestDirs = new Set([...embedded, start]);
+    if (workspaceRoot !== null) {
+        manifestDirs.add(workspaceRoot);
+    }
+    for (const dir of manifestDirs) {
+        const manifest = await readManifest(dir);
+        if (manifest === null) {
+            continue;
+        }
+        let updated = manifest.source;
+        for (const dep of resolveDepDirs(manifest.parsed, dir, workspaceParsed, workspaceRoot)) {
+            // A requirement is rewritten only when it points at a crate this run
+            // actually bumped. The workspace root routinely declares members the
+            // artifact never compiles; pinning those to the release version would
+            // name a version nothing produced.
+            if (!dep.hasVersionReq || !bumped.has(dep.dir)) {
+                continue;
+            }
+            updated = replaceDepVersionReq(updated, dep.key, version);
+        }
+        if (updated !== manifest.source) {
+            const cargoPath = join(dir, 'Cargo.toml');
+            await writeFile(cargoPath, updated, 'utf8');
+            written.add(cargoPath);
+        }
+    }
+    return [...written];
+}
+/**
+ * Breadth-first walk of path dependencies out of `startDir`. Returns the
+ * crates reached, excluding `startDir` — seeding `seen` with it also keeps
+ * a dependency cycle back to the start from re-queueing forever.
+ */
+async function collectEmbedded(startDir, workspaceParsed, workspaceRoot) {
+    const seen = new Set([startDir]);
+    const found = new Set();
+    const queue = [startDir];
+    while (queue.length > 0) {
+        const dir = queue.shift();
+        const manifest = await readManifest(dir);
+        if (manifest === null) {
+            continue;
+        }
+        for (const dep of resolveDepDirs(manifest.parsed, dir, workspaceParsed, workspaceRoot)) {
+            if (seen.has(dep.dir)) {
+                continue;
+            }
+            seen.add(dep.dir);
+            found.add(dep.dir);
+            queue.push(dep.dir);
+        }
+    }
+    return found;
+}
+/**
+ * Read and parse `<dir>/Cargo.toml`. Returns null when the file is absent
+ * or unparseable — a path dependency can point at a directory that is not
+ * a crate, and an odd-but-writable manifest should not abort the release.
+ *
+ * ENOENT is caught rather than pre-checked with `existsSync` to avoid the
+ * TOCTOU shape CodeQL flags, matching the rest of the version-write path.
+ * Any other read failure surfaces unmodified.
+ */
+async function readManifest(dir) {
+    let source;
+    try {
+        source = await readFile(join(dir, 'Cargo.toml'), 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            return null;
+        }
+        throw err;
+    }
+    try {
+        return { source, parsed: parseToml(source) };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A virtual manifest declares `[workspace]` but no crate to version.
+ * `parsed` always comes from `readManifest`, which yields a parsed TOML
+ * document or null, so the null case never reaches here.
+ */
+function hasPackageTable(parsed) {
+    return typeof parsed.package === 'object';
+}
+//# sourceMappingURL=write-embedded-crate-versions.js.map

package/dist/write-embedded-crate-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-embedded-crate-versions.js","sourceRoot":"","sources":["../src/write-embedded-crate-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAQ9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,OAAe;IAEf,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhC,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,eAAe,GACnB,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC;IAE9E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,mEAAmE;IACnE,iEAAiE;IACjE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,qEAAqE;QACrE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAAA,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAAA,CAAC;IAE9D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QAElC,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,CAAC;YACvF,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,mCAAmC;YACnC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YAC3D,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC1C,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,eAAwB,EACxB,aAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAa,CAAC,QAAQ,CAAC,CAAC;IAEnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QAElC,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;QACpE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,OAAO,OAAQ,MAAgC,CAAC,OAAO,KAAK,QAAQ,CAAC;AACvE,CAAC"}

package/dist/write-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-version.d.ts","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmD7F"}
+{"version":3,"file":"write-version.d.ts","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAeH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAwD7F"}

package/dist/write-version.js

@@ -21,6 +21,7 @@ import { join } from 'node:path';
 import { parse as parseToml } from 'smol-toml';
 import { ErrorCodes } from './error-codes.js';
 import { toError } from './to-error.js';
+import { writeEmbeddedCrateVersions } from './write-embedded-crate-versions.js';
 import { writeResolvedCargoVersion } from './write-resolved-cargo-version.js';
 const DYNAMIC_VERSION_DOC_POINTER = 'https://thekevinscott.github.io/putitoutthere/guide/dynamic-versions';
 /**
@@ -81,7 +82,12 @@ export async function writeVersionForBuild(pkgDir, version) {
         }
         throw toError(err);
     }
-    return await writeResolvedCargoVersion(pkgDir, cargoOriginal, version);
+    const written = await writeResolvedCargoVersion(pkgDir, cargoOriginal, version);
+    // #621: the wheel embeds every in-repo crate the extension module pulls
+    // in by path. When the CLI lives in one of those (a Rust core wrapped by
+    // this pyo3 crate), its `CARGO_PKG_VERSION` is what `--version` prints.
+    const embedded = await writeEmbeddedCrateVersions(pkgDir, version);
+    return [...new Set([...written, ...embedded])];
 }
 function isDynamicVersion(project) {
     const { dynamic } = project;

package/dist/write-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-version.js","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,2BAA2B,GAC/B,sEAAsE,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,OAAe;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,aAAa,EAAE,EAAE;gBAC7E,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAI,MAAiE,EAAE,OAAO,CAAC;IAC5F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,2EAA2E,2BAA2B,GAAG,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,mBAAmB,oBAAoB,aAAa,mPAAmP,2BAA2B,GAAG,CACrV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,sFAAsF,2BAA2B,GAAG,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,6FAA6F,SAAS,+GAA+G,EACrN,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,yBAAyB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA8B;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"write-version.js","sourceRoot":"","sources":["../src/write-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,2BAA2B,GAC/B,sEAAsE,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,OAAe;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,aAAa,EAAE,EAAE;gBAC7E,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAI,MAAiE,EAAE,OAAO,CAAC;IAC5F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,2EAA2E,2BAA2B,GAAG,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,mBAAmB,oBAAoB,aAAa,mPAAmP,2BAA2B,GAAG,CACrV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,sFAAsF,2BAA2B,GAAG,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,6FAA6F,SAAS,+GAA+G,EACrN,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAChF,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA8B;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {