v1.25.0

1.25.0 (2026-10-26)

• Publish jsr.io @kiskolabs/pray-cli alongside @kiskolabs/pray-core at the same version (CLI package; library stays on pray-core).
• Restore the Prayfile positioning line in pray-core registry descriptions and README openers (npm, jsr.io module docs, crates.io) so search matches the pre-split pray-cli storefront copy.
• Support Deno and Bun for TypeScript pray-core and pray-cli. Support Cloudflare Workers and browsers through the pray-core/parse and pray-cli/parse parse surface only.
• Stop piping npm publish under make release-all (that broke browser/device 2FA). After a failed publish, wait for the npm version so E409 staged conflicts can skip and the run can continue. JSR publish allows a dirty tree on resume.
• Run gem push on the terminal under make release-all so the RubyGems MFA prompt is visible. After a failed push, skip when that version is already on RubyGems.

v1.21.0

1.21.0 (2026-10-21)

• Prevent the Rust, Ruby, and TypeScript CLIs from changing the calling repository or index when a Git hook passes repository variables such as GIT_DIR or GIT_INDEX_FILE. Explicit Git configuration, including CI credentials and URL rewrites, still applies.
• Refuse a damaged Git cache that resolves to a parent repository before changing its remote.
• Read package catalogs whose published_at is an RFC 3339 string or JSON null.
• Keep prayer sources under prayers/<name>/, beside prayers/v1/ when this project publishes. prayers/v1/packages/ is catalog metadata. A root packages/ folder is not a pray source convention.
• Recalculate committed Prayfile.lock hashes after path sources moved under prayers/.
• Require Rust 1.91 to build the pray crates. cargo install pray-cli with an older compiler now stops with a message naming that minimum, instead of a compile error. Development and CI build with exactly 1.91.0 from rust-toolchain.toml.
• Make pray render --check use the same layout as pray plan and pray install, so preserved unmarked text or earlier managed-span ordering no longer causes a false stale result.

v1.20.0

1.20.0 (2026-09-18)

• Fetch a locked git catalog revision during pray install when the local cache does not have that commit yet. pray install --offline still refuses a missing commit.
• Refuse pray install --offline when a git catalog is not already in the local cache, instead of cloning it. A global cache seed still works.
• Honour a locked git revision for a local file catalog. Install does not read the origin worktree after that checkout fails.
• Keep git catalog objects in the shared cache. The project catalog is a file tree without a git directory.
• When a locked git revision is missing from a shallow cache, fetch the missing history instead of only that one commit.
• Skip a crate on make release-all when that version already exists on crates.io.
• Add pray publish --resign for local distribution roots to sign existing package versions with a new key while keeping their yank state and first-publish time.
• Keep an unchanged published version when a later pray publish uses a different publisher label.
• Label publisher names as claims and distinguish package signatures from content digests on distribution package pages.
• Keep pray drift clean after pray install when a compose block adds a local file after a package dest already had.

v1.19.0

1.19.0 (2026-09-18)

• Declare named publish remotes in Prayfile (RFC 0118). pray publish uses them when dest flags are omitted, and publishes only path-owned packages.

v1.18.0

1.18.0 (2026-09-17)

• Clone a git catalog without unused package blobs, and fetch a used package file when install needs it.
• Skip cloning a git catalog when no package uses that source.
• Fetch a used git catalog once on pray update instead of fetching it twice.
• Keep packages from two git sources that share a clone URL when each source names a different subdir.
• Share one git object store for those subdirectory checkouts.
• Import signing keys with pray trust import-repo after a catalog was cloned only through subdir sources.
• Reuse registry package metadata during one command so pray update --latest does not download the same package JSON twice.
• Skip a second resolve when pray update --latest does not rewrite constraints or upstream pins, and still refresh path-fork files when needed.
• Fetch torrent piece lists only when a registry lists torrent.

v1.17.0

1.17.0 (2026-09-16)

• Locate local prayers through a path source of any directory name (RFC 0117). pray prayer init adds source "local" when needed and declares pray "local/project" once. Version is optional until pray package or pray publish. .agents/project.md remains a compose shortcut for one local file.
• Copy upstream files into an empty path-fork tree on pray install and pray update (RFC 0116). Extra listed overlay files stay. pray outdated lists fork files that differ from the locked upstream. An identity-only fork uses empty spec.files; refresh lists content paths, not the prayspec file.
• Refuse a local path with file: and a local path inside tree. Compose still embeds local fragments. Package file: and package tree stay. RFC 0115 proposed those dest copies and is not adopted.
• Name dest versus lock on pray verify, dest versus a fresh render on pray drift, and dest write on pray render. Dry-run of a write is pray plan. pray update has a Packages-list description. Listed local compose files stay on pray install.
• Write .praytorrent.json when v1/distribution.json lists protocols: ["torrent"] (RFC 0062). pray repo init writes empty protocols. pray serve returns 404 for a missing file and 206 for a satisfiable Range.
• Parse spec.maintainers as a string array, and accept spec.pray_version as an alias for spec.prayfile_version (RFC 0011).
• Re-embed a changed local compose source on pray install, pray update, and pray plan, and print its sha256 as checked or was.
• List local checksum drift under pray outdated. The Rust CLI install footer counts local files separately from packages.

v1.16.0

1.16.0 (2026-09-15)

• Document pray_core::embed as the Rust library surface for parse, resolve, lock, render, and verify (RFC 0109).
• Run RFC 0100 parser, prayspec, lockfile, path-package, git, registry, and tarball resolver, cycle-reject, and compose render fixtures in the Rust, Ruby, and TypeScript suites.
• Resolve a local .praypkg from tarball: in the Rust, Ruby, and TypeScript libraries, including offline when the archive is on disk.
• Refuse two-package dependency cycles in the Ruby and TypeScript libraries during resolve, matching the Rust CLI.
• Check dest files against Prayfile.lock managed spans without resolving packages (inspect_locked_destinations, RFC 0106) in the Rust, Ruby, and TypeScript libraries.
• Rewrite a two-component pessimistic Prayfile pin on Ruby pray update --latest (~> 2.2 to ~> 2.4 when registry latest is 2.4.0), and install a newer version that the current constraint already allows.

v1.15.0

1.15.0 (2026-09-15)

• Refresh path-fork trees with pray update in the Rust, Ruby, and TypeScript CLIs (RFC 0114).
• Rewrite a path package spec.upstream pin with pray update --latest when the pin does not admit the latest upstream version, then refresh that tree. pray update --latest --dry-run prints the planned pin and does not write. The Ruby CLI still rejects --json and --major on update.
• Rewrite Prayfile constraints with pray update --latest in the Ruby CLI when the current constraint does not admit the registry latest version, matching the Rust and TypeScript CLIs.
• Keep spec.upstream in the packaged prayspec. Published registry metadata does not copy that pin (RFC 0114).
• Name the fork, both upstream versions, and every conflicting path when an upstream refresh merge fails.
• Keep a listed package spec in spec.files when packing; refuse a repeated or aliased content path in the package archive.
• Use the current project for a later Ruby or TypeScript install after an earlier in-process command in another directory.

v1.14.0

1.14.0 (2026-09-14)

• Keep an unchanged package version's artifact, first-publish time, and yank when pray publish runs again (RFC 0061).
• Write published_at as UTC Unix seconds in registry and federation JSON.
• Collapse trailing blank lines when composing so a composed file ends with a single newline, matching the other CLIs.
• Order symbols before render in the canonical manifest JSON so manifest_hash matches the other CLIs.
• Emit absent package locators and an absent target max_bytes as null in the canonical manifest JSON so manifest_hash matches the other CLIs.

v1.13.0

1.13.0 (2026-09-08)

• Record and verify package upstream pins in .prayspec and Prayfile.lock. Refresh path forks with the Rust CLI; refuse that update in the npm and RubyGems CLIs until they can refresh the path tree safely (RFC 0114).