Take every dependency by version, leaving no git sources

Cargo.toml

@@ -105,17 +105,11 @@ incremental = true
 # `blitz-inspector` stays in release builds regardless. It costs size, and it is
 # what made every diagnosis in this codebase's recent history possible.
 
-# `Tree::intrinsic_dimensions` lives on no released usvg and `blitz-dom` calls
-# it. Cargo honours `[patch]` only from the root workspace, so depending on the
-# renderer from here needs the same redirection it applies to itself.
-#
-# The patch is version 0.48.1, so it only covers a dependent asking for ^0.48.
-# One still on ^0.46 silently gets a *second* usvg rather than an error, which
-# surfaces much later as a type error naming two identically-spelled types.
-#
-# Here rather than in `.cargo/config.toml`, which is where it used to sit: it
-# shared a `[patch.crates-io]` table there with paths that existed on one
-# machine, and that coupling is why a file nobody could delete was also a file
-# nobody could safely commit. ps-blitz keeps the same patch in its own manifest.
-[patch.crates-io]
-usvg = { git = "https://github.com/DioxusLabs/resvg", branch = "devin/1785858271-intrinsic-dimensions" }
+# The `[patch.crates-io]` for `usvg` is gone. It redirected at a DioxusLabs
+# branch for `Tree::intrinsic_dimensions`, which lived on no released usvg at
+# the time. The published `ps-anyrender-svg` now depends on `ps-usvg` directly,
+# so nothing in the graph asks for plain `usvg` any more and cargo reported the
+# patch as "not used in the crate graph". A patch that matches nothing is not
+# inert: it is a git source in the manifest, which is what stops this workspace
+# from being publishable and what put a second usvg in the graph when a
+# dependent asked for a range it did not cover.

apps/blitz-preview/Cargo.toml

@@ -16,7 +16,7 @@ blitz-traits = { path = "../../../blitz-rust/packages/blitz-traits" }
 brotli = { version = "=8.0.4", default-features = false, features = ["std"] }
 png = { version = "=0.18.1", optional = true }
 tauri = { version = "=2.11.5", default-features = false, features = ["compression"] }
-tauri-runtime-blitz = { git = "https://github.com/pathscale/tauri-runtime-blitz.git", branch = "master" }
+tauri-runtime-blitz = "^0.1.0"
 url = "=2.5.8"
 
 [build-dependencies]

apps/gui/Cargo.toml

@@ -66,14 +66,17 @@ wt-migrate = { path = "../../crates/wt-migrate" }
 agent-abstraction = "0.4.15"
 agency-proxy-client.workspace = true
 agency-proxy-protocol.workspace = true
-agent-experimental = { git = "https://gitlab.com/anonymous-28282828282/agent-experimental.git", branch = "master", default-features = false, optional = true }
+agent-experimental = { version = "^0.1.3", default-features = false, optional = true }
 promptsyntax = "0.1.0"
 shlex = "1.3"
 az-core.workspace = true
-# Pinned rather than tracking master, unlike the engine deps above. Master has
-# moved on to an `arctic-wt` that cargo cannot select alongside this workspace,
-# so `branch = "master"` fails to resolve rather than building something newer.
-worktable = { git = "https://github.com/pathscale/WorkTable.git", rev = "7ab68d17c31e7dd3e56a364ffbb559dd0819b317" }
+# Exact rather than a caret, unlike the engine deps above, and from the
+# registry rather than a git rev. Master has moved on to an `arctic-wt` that
+# cargo cannot select alongside this workspace, so tracking it fails to resolve
+# rather than building something newer. beta.11 is published; moving to it is a
+# storage-engine change and belongs in its own commit with its own testing, not
+# in a dependency-source cleanup.
+worktable = "=1.0.0-beta.10"
 # The `worktable!` macro emits code that names these by bare path rather than
 # through a re-export, so a consumer of the macro has to declare them too.
 # Versions match worktable 1.0 beta's own, since a mismatch produces errors that name
@@ -93,8 +96,11 @@ tauri = { version = "2", default-features = false, features = ["macos-private-ap
 # `macos-private-api` must match the `tauri` dependency above. Tauri's
 # `WindowBuilder` trait declares `transparent` behind that feature, and the
 # runtime gates its implementation behind the same one, so enabling it on only
-# one side makes the trait demand a method the other side compiled out.
-tauri-runtime-blitz = { git = "https://github.com/pathscale/tauri-runtime-blitz.git", branch = "master", optional = true, features = ["macos-private-api"] }
+# one side makes the trait demand a method the other side compiled out. As of
+# 0.1.0 the runtime's own feature forwards to `tauri` and `tauri-runtime`, so
+# naming it here agrees with that rather than being the only thing holding the
+# two sides together.
+tauri-runtime-blitz = { version = "^0.1.0", optional = true, features = ["macos-private-api"] }
 #
 # The engine by version, not by branch. Same move `chuzz` made, for the same
 # reasons its manifest records.

crates/agency-tools/Cargo.toml

@@ -10,7 +10,7 @@ publish.workspace = true
 # git rev of that version are one number over two code bases, and reading a
 # store with the wrong one reports "torn or corrupt persisted table" for a
 # table the app reads without complaint.
-worktable = { git = "https://github.com/pathscale/WorkTable.git", rev = "7ab68d17c31e7dd3e56a364ffbb559dd0819b317" }
+worktable = "=1.0.0-beta.10"
 # The `worktable!` macro emits code that names these by bare path rather than
 # through a re-export, so a consumer of the macro has to declare them too.
 # Versions match worktable 1.0 beta's own, since a mismatch produces errors that name

crates/blitz-bench/Cargo.toml

@@ -11,7 +11,7 @@ publish.workspace = true
 # `tauri-runtime-blitz` for the same types would build a browser engine to send
 # a wheel event. `cargo tree -p blitz-bench` is the check.
 [dependencies]
-blitz-control-protocol = { git = "https://github.com/pathscale/tauri-runtime-blitz.git", branch = "master" }
+blitz-control-protocol = "^0.1.0"
 # The same framing the server uses, from the same crate, for the same reason as
 # the protocol types: a hand-rolled length-prefix reader is how the Python
 # client hung on its first malformed frame.

crates/wt-migrate/Cargo.toml

@@ -13,7 +13,7 @@ libc = "0.2"
 # one number, two code bases. Rows written by this crate then carried an index
 # the app could not read, which presents as "torn or corrupt persisted table"
 # on a table this tool has just written from scratch.
-worktable = { git = "https://github.com/pathscale/WorkTable.git", rev = "7ab68d17c31e7dd3e56a364ffbb559dd0819b317" }
+worktable = "=1.0.0-beta.10"
 # The `worktable!` and `worktable_version!` macros emit code that names these by
 # bare path rather than through a re-export, so a consumer of the macros has to
 # declare them too. Kept identical to the block in agency-tools and apps/gui: the

scripts/check-one-rev-per-git-source.sh

@@ -22,8 +22,15 @@ set -euo pipefail
 lock="${1:-Cargo.lock}"
 
 # `source = "git+URL?rev=SHA#SHORTSHA"` — strip the fragment, split on `?rev=`.
+#
+# `|| true` on the grep because a lockfile with no git sources at all is the
+# goal, not a failure, and grep exits 1 when it matches nothing. Under
+# `pipefail` that fails the check on precisely the lockfile it most wants to
+# see. That is this workspace today: every dependency comes from the registry,
+# so the empty case is the normal one and the duplicate-rev check below is
+# guarding against a regression rather than describing the status quo.
 duplicates=$(
-    grep -o 'source = "git+[^"]*"' "$lock" |
+    { grep -o 'source = "git+[^"]*"' "$lock" || true; } |
         sed 's/source = "git+//; s/"$//; s/#.*//' |
         sort -u |
         awk -F'\\?rev=' 'NF == 2 { count[$1]++; revs[$1] = revs[$1] "\n    " $2 }
@@ -39,4 +46,8 @@ if [[ -n $duplicates ]]; then
     exit 1
 fi
 
-echo "one rev per git source"
+if grep -q 'source = "git+' "$lock"; then
+    echo "one rev per git source"
+else
+    echo "no git sources"
+fi