[M8] cargoxx publish: open a recipe PR via tea / Gitea API

.gitignore

@@ -3,6 +3,13 @@
 !/build/CMakeLists.txt
 /result
 /result-*
+/cargoxx.AppImage
+/cargoxx-arx
+
+# e2e fixtures regenerate these on every run.sh invocation.
+tests/e2e/*/build/
+tests/e2e/**/flake.lock
+tests/e2e/**/Cargoxx.lock
 
 # CMake
 CMakeCache.txt

CHANGELOG.md

@@ -435,3 +435,131 @@ All notable changes to cargoxx will be documented in this file.
   Added `inputs.bundlers.url = "github:NixOS/bundlers"` (with
   `inputs.nixpkgs.follows = "nixpkgs"`) to keep the closure aligned
   with the project's pinned nixpkgs.
+- M8 multiple binary build artifacts (Cargo `src/bin/` parity).
+  Codegen now routes every executable (`add_executable`) to
+  `${CMAKE_BINARY_DIR}/bin` via `set_target_properties(... RUNTIME_OUTPUT_DIRECTORY ...)`.
+  `buildCppPackage` and `cargoxx run --bin <name>` follow suit, and
+  layout discovery picks up Cargo's `src/bin/<sub>/main.cpp` form
+  (subdir name becomes the binary name). End-to-end fixture
+  `tests/e2e/buildCppPackage/src/bin/extra.cpp` proves a second
+  binary lands in `$out/bin/` alongside the primary.
+- M8 reusable library install layout. `cargoxx`-built libraries now
+  ship a CMake-idiomatic `$out` tree: `lib/lib<name>.a`,
+  `lib/cmake/<name>/{<name>Config.cmake,<name>ConfigVersion.cmake,
+  <name>Targets.cmake}`, `lib/pkgconfig/<name>.pc`, and modules
+  under `include/<name>/` (via `install(TARGETS ... FILE_SET CXX_MODULES ...)`).
+  Codegen emits the install rules + a `Config.cmake.in` template
+  (inline `file(WRITE …)`) consumed by
+  `configure_package_config_file` and `write_basic_package_version_file`,
+  plus a basic `.pc.in` template. The exported library target
+  carries `target_compile_features(... PUBLIC cxx_std_<NN>)` so
+  consumers `find_package`-ing it get the right standard for
+  module BMI regeneration.
+  `buildCppPackage.installPhase` switched from `cp -a build/release/bin/.`
+  to `cmake --install build/release --prefix $out` — bins, libs,
+  headers, config, and pc files all land via one invocation.
+  `project(... VERSION <pkg.version> ...)` is now part of the
+  generated header so `<name>ConfigVersion.cmake` reflects the
+  manifest's version.
+- M8 cargoxx-path dependencies (Cargo's `{ path = "..." }`). The
+  manifest gains a discriminated dep table form:
+  ```toml
+  [dependencies]
+  greeter = { path = "./greeter" }
+  ```
+  `manifest::Dependency` carries `DepSource source` +
+  `optional<string> path`. The parser branches on `path`; unknown
+  dep-table keys still rejected for tables that have neither
+  `version` nor `path`. Round-tripped by the writer.
+  Lockfile schema adds per-package `source_kind` + `source_path`
+  so the consumer's `Cargoxx.lock` records "this dep is built from
+  a cargoxx source tree at `./greeter`" (not nixpkgs).
+  `cmd_build::resolve_path_dep` reads `<path>/Cargoxx.toml` to
+  verify the dep's name matches, then synthesizes a Recipe
+  (`find_package = "<name> CONFIG REQUIRED"`,
+  `targets = ["<name>::<name>"]`, `source = "cargoxx-path"`).
+  Codegen needs no special case — the synthesized recipe flows
+  through the existing `find_package` emission path.
+  `buildCppPackage`'s recursion: `evalDep` branches on
+  `source_kind == "cargoxx-path"` and recurses with
+  `src = src + "/" + source_path`. The resulting derivation joins
+  `buildInputs`; CMake's `CMAKE_PREFIX_PATH` picks it up so the
+  consumer's `find_package(<dep> CONFIG REQUIRED)` resolves
+  against the producer's installed Config.cmake. Path deps must be
+  subdirectories of the consumer's source tree (no sibling form in
+  v1 — sibling deps will land with git/registry sources in 1c/1d).
+  New e2e fixture `tests/e2e/pathDep/`: a `consumer` project with
+  `[dependencies] greeter = { path = "./greeter" }`. `run.sh`
+  generates locks in both, then `nix build .#default` produces a
+  binary that prints "Hello from greeter, world!".
+- M8 design doc at `docs/library-reuse-and-publish.md` covers the
+  full two-part roadmap: library reuse (path → git → registry deps)
+  and Gitea-hosted public registry with `cargoxx publish` + bot
+  validation + binary-cache substitution. Phase 1a (install rules)
+  and Phase 1b (path deps) shipped in this commit; phases 1c, 1d,
+  and 2 remain to be built.
+- M8 cargoxx-git dependencies (`{ git = "<url>", rev = "<40-char>" }`).
+  The manifest accepts a third dep-table form:
+  ```toml
+  [dependencies]
+  mylib = { git = "https://gitea/me/mylib", rev = "abc…" }
+  ```
+  Branch/tag refs are not yet supported — the rev must be a literal
+  40-char commit. `manifest::Dependency` carries `git_url` + `git_rev`;
+  parser branches on `git`, rejects git deps that omit `rev`.
+  Lockfile schema adds `source_git_url` + `source_git_commit` +
+  `source_git_sha256` (SRI form, e.g. `sha256-<base64>`). The sha256
+  pins the fetched source as a fixed-output derivation: `pkgs.fetchgit`
+  in the consumer's `buildCppPackage` substitutes from cache when the
+  same `(url, rev, sha256)` triple appears elsewhere.
+  `cmd_build::resolve_git_dep` reuses the lockfile's prior sha256 on
+  re-builds; on a fresh dep it calls
+  `resolver::prefetch_flake_source(git+<url>?rev=<rev>)` which now
+  returns `{store_path, hash}` (extended via a new
+  `PrefetchedSource` struct, with `realize_flake_source` kept as a
+  thin compat wrapper). Verifies the dep's name by reading the
+  fetched tree's `Cargoxx.toml`. In `--offline` mode, a git dep
+  without a cached hash errors with a clear "run online first"
+  message.
+  `flake.nix`'s `evalDep` branches on `source_kind == "cargoxx-git"`
+  and feeds `pkgs.fetchgit { url, rev, hash }` into a recursive
+  `buildCppPackage` call. The fetched source is content-addressed,
+  so the entire `(fetch → install)` closure is cacheable end-to-end.
+  Codegen unchanged — the synthesized recipe (find_package +
+  `<name>::<name>` target) is identical to the path-dep case, just
+  with a different `linkdb_source` discriminator.
+- M8 `cargoxx publish` (Phase 2c). Publishes the project's HEAD as a
+  new version recipe in a Gitea-hosted cargoxx registry. Steps:
+  1. Validate `Cargoxx.toml` has `name`, `version`, `license`.
+  2. Verify the working tree is clean and `Cargoxx.lock` exists.
+  3. Reject path-dep deps (registry can't reference local trees).
+  4. Read `git remote get-url origin` + `git rev-parse HEAD`,
+     normalize SSH URLs to https.
+  5. Compute the source SRI hash via `nix flake prefetch
+     git+<url>?rev=<commit> --json`.
+  6. Build the recipe TOML (mirrors `Cargoxx.toml`'s deps + `[meta]`).
+  7. POST `/repos/<registry>/contents` with `{branch: "master",
+     new_branch: "publish/<name>-<version>", files: [...]}` — a
+     single atomic commit creating both `recipes/<name>/versions/
+     <v>.toml` and (for new packages) `recipes/<name>/maintainers.txt`
+     pre-populated with the publisher's Gitea username (`tea api
+     /user`).
+  8. POST `/repos/<registry>/pulls` to open the PR.
+
+  `--dry-run` prints the recipe TOML and exits without any network
+  ops. `--registry <owner>/<repo>` overrides the default
+  (`$CARGOXX_REGISTRY`, falling back to `mozart/cargoxx-pkgs`).
+  Authentication comes from `tea login` — no separate token plumbing.
+
+  Manifest schema gains three optional `[package]` fields used in the
+  recipe's `[meta]` block: `description`, `repository`, `homepage`.
+
+  The cargoxx wrapper (`flake.nix`'s `cargoxxRuntimePath`) now bundles
+  `pkgs.tea` so the binary can shell out to it on non-Nix hosts.
+
+  Verified end-to-end against
+  `https://git.amadey.xyz/mozart/cargoxx-pkgs`: from a
+  `mozart/greeter` checkout, `cargoxx publish` opens PR #3 with
+  branch `publish/greeter-0.1.0` containing a fresh
+  `recipes/greeter/versions/0.1.0.toml` and a new
+  `recipes/greeter/maintainers.txt`.

build/CMakeLists.txt

@@ -4,7 +4,10 @@ set(CMAKE_EXPERIMENTAL_CXX_MODULE_DYNDEP 1)
 set(CMAKE_EXPERIMENTAL_CXX_IMPORT_STD "d0edc3af-4c50-42ea-a356-e2862fe7a444")
 set(CMAKE_CXX_MODULE_STD ON)
 
-project(cargoxx LANGUAGES CXX)
+project(cargoxx VERSION 0.1.0 LANGUAGES CXX)
+
+include(GNUInstallDirs)
+include(CMakePackageConfigHelpers)
 
 # Generated by cargoxx — do not edit.
 # Source of truth: ../Cargoxx.toml
@@ -43,6 +46,7 @@ target_sources(cargoxx
         ../src/cli/cmd_clean.cpp
         ../src/cli/cmd_linkdb_add.cpp
         ../src/cli/cmd_new.cpp
+        ../src/cli/cmd_publish.cpp
         ../src/cli/cmd_remove.cpp
         ../src/cli/cmd_run.cpp
         ../src/cli/cmd_test.cpp
@@ -75,20 +79,70 @@ target_sources(cargoxx
         ../src/util/levenshtein.cpp
         ../src/util/semver.cpp
 )
+target_compile_features(cargoxx PUBLIC cxx_std_23)
 target_include_directories(cargoxx SYSTEM PRIVATE ../third_party)
 target_link_libraries(cargoxx PUBLIC
     reproc
     SQLite::SQLite3
 )
 
+# ----- install + package-config + pkg-config -----
+install(TARGETS cargoxx
+        EXPORT cargoxxTargets
+        FILE_SET CXX_MODULES DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/cargoxx
+        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
+install(EXPORT cargoxxTargets
+        FILE cargoxxTargets.cmake
+        NAMESPACE cargoxx::
+        DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/cargoxx)
+
+file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/cargoxxConfig.cmake.in [[
+@PACKAGE_INIT@
+include(CMakeFindDependencyMacro)
+include("${CMAKE_CURRENT_LIST_DIR}/cargoxxTargets.cmake")
+check_required_components(cargoxx)
+]])
+configure_package_config_file(
+    ${CMAKE_CURRENT_BINARY_DIR}/cargoxxConfig.cmake.in
+    ${CMAKE_CURRENT_BINARY_DIR}/cargoxxConfig.cmake
+    INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/cargoxx)
+write_basic_package_version_file(
+    ${CMAKE_CURRENT_BINARY_DIR}/cargoxxConfigVersion.cmake
+    VERSION ${PROJECT_VERSION}
+    COMPATIBILITY SameMajorVersion)
+install(FILES
+    ${CMAKE_CURRENT_BINARY_DIR}/cargoxxConfig.cmake
+    ${CMAKE_CURRENT_BINARY_DIR}/cargoxxConfigVersion.cmake
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/cargoxx)
+
+file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/cargoxx.pc.in [[
+prefix=@CMAKE_INSTALL_PREFIX@
+exec_prefix=${prefix}
+libdir=${prefix}/${CMAKE_INSTALL_LIBDIR}
+includedir=${prefix}/${CMAKE_INSTALL_INCLUDEDIR}
+
+Name: @PROJECT_NAME@
+Version: @PROJECT_VERSION@
+Description: @PROJECT_NAME@
+Cflags: -I${includedir}
+Libs: -L${libdir} -l@PROJECT_NAME@
+]])
+configure_file(${CMAKE_CURRENT_BINARY_DIR}/cargoxx.pc.in
+               ${CMAKE_CURRENT_BINARY_DIR}/cargoxx.pc @ONLY)
+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/cargoxx.pc
+        DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig)
+
 # ----- binary target -----
 add_executable(cargoxx_bin ../src/main.cpp)
-set_target_properties(cargoxx_bin PROPERTIES OUTPUT_NAME cargoxx)
+set_target_properties(cargoxx_bin PROPERTIES
+    OUTPUT_NAME cargoxx
+    RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
 target_link_libraries(cargoxx_bin PRIVATE
     cargoxx
     reproc
     SQLite::SQLite3
 )
+install(TARGETS cargoxx_bin RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 
 # ----- tests -----
 enable_testing()

docs/library-reuse-and-publish.md

@@ -0,0 +1,448 @@
+# Library reuse + public registry
+
+Design plan for two interlocking features:
+
+1. **Library reuse** — cargoxx-built libraries are consumable by other
+   cargoxx projects, by plain CMake projects (`find_package`), and by
+   plain clang invocations (`pkg-config`).
+2. **Public registry + publish** — a Gitea-hosted package registry
+   (`cargoxx-pkgs`), a `cargoxx publish` CLI, and self-hosted CI that
+   validates PRs, builds, pushes derivations to a binary cache, and
+   auto-merges.
+
+Phase 1 covers library reuse end-to-end with local path and git deps.
+Phase 2 layers the registry on top, with cache-backed substitution so
+consumers don't recompile.
+
+---
+
+## Part 1 — reusable libraries
+
+### 1.1 Producer install layout
+
+```
+$out/
+├── bin/                                    # binaries (existing path)
+├── lib/
+│   ├── libmylib.a                          # archive of impl bits
+│   ├── pkgconfig/mylib.pc                  # pkg-config descriptor
+│   └── cmake/mylib/
+│       ├── mylibConfig.cmake               # entry point for find_package
+│       ├── mylibConfigVersion.cmake        # semver gate
+│       └── mylibTargets.cmake              # IMPORTED tgt + CXX_MODULES FILE_SET
+└── include/mylib/                          # public headers + source-form modules
+```
+
+Covers three consumption paths:
+
+- **cargoxx → cargoxx**: consumer's CMakeLists emits
+  `find_package(mylib CONFIG REQUIRED)` + link against `mylib::mylib`.
+  `$out` is on `CMAKE_PREFIX_PATH` via `buildInputs`.
+- **plain CMake**: same `find_package` call, manual `HINTS` if not on
+  the default prefix path.
+- **plain clang + pkg-config**: works for non-module libraries
+  (header-only or `.a` with extern API). Module libraries require a
+  CMake-aware consumer — industry-wide pkg-config has no story for
+  module BMIs.
+
+### 1.2 Codegen changes (`src/codegen/cmake.cpp`)
+
+When `layout.library` is set, append:
+
+```cmake
+include(GNUInstallDirs)
+include(CMakePackageConfigHelpers)
+
+install(TARGETS mylib
+        EXPORT mylibTargets
+        FILE_SET CXX_MODULES DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mylib
+        ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
+install(EXPORT mylibTargets
+        FILE mylibTargets.cmake
+        NAMESPACE mylib::
+        DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/mylib)
+
+# Config.cmake.in written inline so we don't need an off-tree template file.
+file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/mylibConfig.cmake.in [[
+@PACKAGE_INIT@
+include(CMakeFindDependencyMacro)
+@FIND_DEPENDENCY_BLOCK@
+include("${CMAKE_CURRENT_LIST_DIR}/mylibTargets.cmake")
+check_required_components(mylib)
+]])
+configure_package_config_file(
+    ${CMAKE_CURRENT_BINARY_DIR}/mylibConfig.cmake.in
+    ${CMAKE_CURRENT_BINARY_DIR}/mylibConfig.cmake
+    INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/mylib)
+write_basic_package_version_file(
+    ${CMAKE_CURRENT_BINARY_DIR}/mylibConfigVersion.cmake
+    VERSION ${PROJECT_VERSION} COMPATIBILITY SameMajorVersion)
+install(FILES
+    ${CMAKE_CURRENT_BINARY_DIR}/mylibConfig.cmake
+    ${CMAKE_CURRENT_BINARY_DIR}/mylibConfigVersion.cmake
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/mylib)
+
+# pkg-config descriptor — also inline.
+file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/mylib.pc.in [[
+prefix=@CMAKE_INSTALL_PREFIX@
+exec_prefix=${prefix}
+libdir=${prefix}/lib
+includedir=${prefix}/include
+
+Name: @PROJECT_NAME@
+Version: @PROJECT_VERSION@
+Description: @PROJECT_DESCRIPTION@
+Cflags: -I${includedir}
+Libs: -L${libdir} -lmylib
+]])
+configure_file(${CMAKE_CURRENT_BINARY_DIR}/mylib.pc.in
+               ${CMAKE_CURRENT_BINARY_DIR}/mylib.pc @ONLY)
+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/mylib.pc
+        DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig)
+```
+
+`@FIND_DEPENDENCY_BLOCK@` is computed by codegen — one `find_dependency(X)`
+line per cargoxx-source dep, so the transitive graph reconstitutes when
+a consumer does `find_package(mylib …)`.
+
+Binaries also get an install rule so `cmake --install` handles
+everything in one shot:
+
+```cmake
+install(TARGETS mylib_bin RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+install(TARGETS tool      RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+```
+
+### 1.3 `buildCppPackage.installPhase` switches to `cmake --install`
+
+```nix
+installPhase = ''
+  cmake --install build/release --prefix $out
+'';
+```
+
+Replaces the `cp -a build/release/bin/. $out/bin/` hack — now bins,
+library archive, headers, cmake config, pc file all land in the right
+place from one install command.
+
+### 1.4 Manifest schema — discriminated dep source
+
+Backward-compat (string form unchanged):
+
+```toml
+[dependencies]
+sqlite = "*"                                            # nixpkgs / linkdb (today)
+fmt = { version = ">=10" }                              # nixpkgs explicit (today)
+mylib = { path = "../mylib" }                           # cargoxx local path  ← NEW
+remote = { git = "https://gitea/me/remote", rev = "abc123" }  # cargoxx git    ← NEW
+shared = { version = "1.0", registry = "cargoxx" }      # cargoxx registry   ← NEW
+```
+
+`manifest::Dependency` grows discriminated source fields. Parser rejects
+unknown keys in dep tables (today silently ignored).
+
+### 1.5 Lockfile schema additions
+
+For cargoxx-source deps the lockfile carries source provenance and the
+recipe shape (`find_package`, `targets`) — codegen consumes the latter
+unchanged, so cargoxx deps look like any other linkdb recipe to the
+emitted CMakeLists.
+
+Path deps: record relative path.
+Git deps: record `(url, commit, sha256)`.
+Registry deps: record only `(registry_rev, registry_attr)`; the source
+URL + sha256 live in the registry repo, not the consumer's lockfile.
+
+### 1.6 `buildCppPackage` recursion
+
+```nix
+buildCargoxxDep = p:
+  if p.source_kind == "path" then
+    buildCppPackage { src = src + ("/" + p.path); }
+
+  else if p.source_kind == "git" then
+    let depSrc = pkgs.fetchgit {
+          inherit (p) url;
+          rev = p.commit;
+          hash = p.sha256;
+        };
+    in buildCppPackage { src = depSrc; }
+
+  else if p.source_kind == "registry" then
+    # Pull the prebuilt $out from the registry flake — no source fetch,
+    # no recompile. The registry's `packages.<system>.<attr>` derivation
+    # is content-addressed and substituted from the binary cache.
+    let registry = builtins.getFlake
+          "git+https://gitea/.../cargoxx-pkgs?rev=${lock.registry_rev}";
+    in registry.packages.${system}.${p.registry_attr}
+
+  else throw "unknown source_kind: ${p.source_kind}";
+
+cargoxxDepDrvs = map buildCargoxxDep
+                     (builtins.filter (p: p ? source_kind) lock.package);
+```
+
+`cargoxxDepDrvs` join `buildInputs`. nixpkgs's `cmakeConfigurePhase`
+automatically prepends every `buildInputs` `$out` to `CMAKE_PREFIX_PATH`,
+so consumer `find_package(<dep> CONFIG REQUIRED)` resolves without
+extra plumbing.
+
+### 1.7 Resolver flow for cargoxx-source deps
+
+```
+manifest dep → cmd_build::resolve_dep()
+  ├─ source kind == Nixpkgs/Auto: existing resolver chain
+  ├─ source kind == CargoxxPath:
+  │    read ${path}/Cargoxx.toml, take [package].name/version,
+  │    synthesize Recipe { find_package = "<name> CONFIG REQUIRED",
+  │                        targets      = ["<name>::<name>"] }
+  ├─ source kind == CargoxxGit:
+  │    fetch the repo at rev (resolver cache),
+  │    same as CargoxxPath against the checkout
+  └─ source kind == CargoxxRegistry:
+       fetch the registry's recipe TOML, take name + version,
+       synthesize the same Recipe shape.
+```
+
+The recipe shape — `find_package(<name> CONFIG REQUIRED)` plus
+`<name>::<name>` target — matches what the producer's installed
+`<name>Config.cmake` defines. Codegen needs no cargoxx-dep special case.
+
+### 1.8 Phasing
+
+| Phase | Deliverable |
+|---|---|
+| 1a | install rules + Config.cmake + .pc; `cmake --install` in buildCppPackage |
+| 1b | `{ path = "..." }` deps end-to-end (manifest parse + lock + recursive buildCppPackage); e2e fixture |
+| 1c | `{ git = "...", rev = "..." }` deps via `pkgs.fetchgit` |
+| 1d | `{ version = "1.0", registry = "cargoxx" }` deps (gated on Phase 2 being live) |
+
+---
+
+## Part 2 — Gitea-hosted registry
+
+### 2.1 `cargoxx-pkgs` repo layout
+
+```
+cargoxx-pkgs/
+├── flake.nix
+├── recipes/
+│   └── <name>/
+│       ├── maintainers.txt          # gitea usernames, one per line
+│       ├── meta.toml                # description, homepage, license, repo
+│       └── versions/
+│           ├── 1.0.0.toml
+│           └── 1.0.1.toml
+└── .gitea/workflows/
+    ├── validate-pr.yml
+    └── auto-merge.yml
+```
+
+### 2.2 Recipe `versions/<v>.toml`
+
+```toml
+schema = 1
+name = "mylib"
+version = "1.0.0"
+
+[source]
+type   = "git"
+url    = "https://gitea/me/mylib"
+commit = "abc123…"                   # 40-char
+sha256 = "sha256-…"                  # FOD pin
+
+[dependencies]
+fmt      = "10.2"
+otherlib = { version = "0.3", registry = "cargoxx" }
+
+[lock]
+nixpkgs_rev     = "…"
+flake_utils_rev = "…"
+cargoxx_rev     = "…"
+
+[meta]
+description = "…"
+homepage    = "https://…"
+license     = "MIT"
+```
+
+### 2.3 `cargoxx-pkgs` flake (the substitution surface)
+
+```nix
+{
+  description = "cargoxx package registry";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/<rev>";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+  inputs.cargoxx.url = "git+https://gitea/.../cargoxx?rev=<rev>";
+
+  outputs = { self, nixpkgs, flake-utils, cargoxx }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+
+        mkPackage = recipeFile:
+          let r = builtins.fromTOML (builtins.readFile recipeFile);
+          in cargoxx.lib.${system}.buildCppPackage {
+               src = pkgs.fetchgit {
+                 inherit (r.source) url;
+                 rev    = r.source.commit;
+                 hash   = r.source.sha256;
+               };
+             };
+
+        # Enumerate recipes/<name>/versions/<v>.toml, build packagesAttrs.
+        packagesAttrs = …;
+      in {
+        packages = packagesAttrs;
+      });
+}
+```
+
+CI evaluates this flake, builds the new attr, pushes `$out` to the
+binary cache. Consumers later get a cache hit for the SAME
+derivation hash via `builtins.getFlake` at the same `registry_rev`.
+
+### 2.4 Publishing flow (`cargoxx publish`)
+
+```
+cargoxx publish [--dry-run]
+1. Validate Cargoxx.toml has name, version, description, license, repository.
+2. Validate working tree clean; current commit on a remote branch.
+3. Validate Cargoxx.lock pins every cargoxx-source dep to a registry version
+   (path = "..." deps disallowed in publish).
+4. Compute recipe TOML:
+     [source].url    = git remote URL
+     [source].commit = HEAD commit
+     [source].sha256 = sha256 of `git archive HEAD`
+     [dependencies]  = mirror Cargoxx.toml
+     [lock]          = mirror Cargoxx.lock pins
+5. Clone cargoxx-pkgs (cached under ~/.cache/cargoxx/registry-clone).
+6. Create branch publish/<name>-<version>; new package → also create
+   recipes/<name>/{maintainers.txt,meta.toml}.
+7. Write recipes/<name>/versions/<version>.toml; commit.
+8. Push branch; `tea pr create` (tea login is already set up).
+```
+
+### 2.5 Validation bot (`.gitea/workflows/validate-pr.yml`)
+
+Runs on every PR via self-hosted runners:
+
+1. **Schema check**: PR touches only `recipes/<name>/**`; recipe TOML
+   validates.
+2. **Source fixity**: re-fetch `[source].url` at `[source].commit`,
+   recompute sha256, compare.
+3. **Build**: `nix build .#packages.x86_64-linux.<name>`.
+4. **Cache push**:
+   ```
+   nix copy --to "file:///srv/cargoxx-cache?secret-key=$KEY" \
+     .#packages.x86_64-linux.<name>
+   ```
+   `/srv/cargoxx-cache` served by nginx as the binary cache.
+5. **Dependency closure**: every `[dependencies]` entry exists at the
+   same PR HEAD.
+6. **Maintainer match**:
+   - New package: PR author becomes maintainer (write
+     `maintainers.txt`).
+   - Existing package: PR author appears in `maintainers.txt`. Else
+     label `needs-human-review`.
+7. On all-green + maintainer-match: label `auto-merge`.
+
+`auto-merge.yml` triggers on the `auto-merge` label and merges via
+the Gitea API.
+
+Maintainer transfer is a separate PR editing `maintainers.txt`. Same
+validation: PR author must already be on the list.
+
+### 2.6 Resolving registry deps (`cargoxx add foo`)
+
+```
+cargoxx add foo[@<version>]
+  1. Fetch https://gitea/.../cargoxx-pkgs/raw/branch/master/index.json
+     (the index, emitted by CI, maps name → list of versions).
+  2. Pick the highest matching version (or @<version>).
+  3. Fetch recipes/foo/versions/<v>.toml.
+  4. Write Cargoxx.toml:  foo = { version = "<v>", registry = "cargoxx" }.
+  5. Write Cargoxx.lock:  source_kind = "registry",
+                           registry_attr = "foo_<safe_ver>".
+  6. Also persist lock.registry_rev = <current master commit>.
+```
+
+The bundled cargoxx wrapper has `git`, `curl` on PATH, so this works
+on non-Nix hosts too.
+
+### 2.7 Binary cache config
+
+Once the cache URL + signing key are decided, the cargoxx wrapper's
+`NIX_CONFIG` (in `flake.nix`'s `cargoxxNixConfig`) gains:
+
+```
+substituters         = https://cache.cargoxx.<gitea-domain>/... https://cache.nixos.org
+trusted-public-keys  = cache.cargoxx.<gitea-domain>:<base64>= cache.nixos.org:6NCH…=
+```
+
+Set via `--set-default`, so a user with a different setup can
+override by exporting `NIX_CONFIG`.
+
+### 2.8 Hosting
+
+| Concern | Choice |
+|---|---|
+| Repo host | Self-hosted Gitea (your instance). |
+| CI | Gitea Actions on self-hosted runners (your existing pool). |
+| Binary cache | Static-HTTPS to start (`nix copy --to file:///srv/cargoxx-cache`); migrate to `attic` (https://github.com/zhaofengli/attic) if scale demands. |
+| Publishing auth | `tea login` (already configured). |
+| Architectures | `x86_64-linux` only for v1. aarch64/darwin are follow-ups. |
+
+### 2.9 Phasing
+
+| Phase | Deliverable |
+|---|---|
+| 2a | `cargoxx-pkgs` repo skeleton + `flake.nix` (zero recipes). |
+| 2b | `.gitea/workflows/validate-pr.yml`; manual recipe PRs. |
+| 2c | `cargoxx publish` CLI; `auto-merge.yml`. |
+| 2d | `cargoxx add` ↔ registry index; CI cache push; wrapper substituters config. |
+
+---
+
+## Module BMI strategy
+
+Following the libstdc++/libc++ model in nixpkgs: ship **source `.cppm`**
+via `install(TARGETS … FILE_SET CXX_MODULES …)`, ship the **compiled
+archive** (`libfoo.a`) of impl bits. Consumers regenerate the BMI in
+their own build (cmake's `FILE_SET CXX_MODULES` handles it when
+`find_package(foo)` is called). The compiled archive is what's
+cached — the BMI is cheap to regenerate against an already-cached
+archive.
+
+cargoxx already enables `CMAKE_CXX_MODULE_STD ON`, which CMake uses to
+rebuild the `std` BMI in each consumer project. The same machinery
+covers cargoxx libraries.
+
+---
+
+## Why `buildCppPackage` doesn't fetch source for registry deps
+
+The registry flake (`cargoxx-pkgs`) owns the
+`source-fetch → cargoxx-build → cmake-install` pipeline. Its
+`packages.<system>.<name>` is an input-addressed derivation: same
+sources + same toolchain pins → same hash → cache hit.
+
+Consumers reference that derivation via `builtins.getFlake` at the
+locked `registry_rev`. Nix's binary cache substitutes the `$out`
+directly — no source clone, no compile. Source fetch + build live
+inside the registry's eval, run once per recipe at CI time. This is
+the same model as nixpkgs/`cache.nixos.org`: you don't fetch fmt's
+source to use it from nixpkgs.
+
+---
+
+## Open follow-ups
+
+1. Gitea domain + cache URL (for wrapper config in Phase 2d).
+2. Signing key generation
+   (`nix-store --generate-binary-cache-key cache.cargoxx.<domain>
+    <secret> <public>`); private into runner secrets, public into
+   wrapper config.
+3. Multi-arch (`aarch64-linux`, `*-darwin`) — Phase 3+.
+4. Conan-style wrap recipes for non-cargoxx libraries — design now,
+   defer implementation.

flake.nix

@@ -21,6 +21,7 @@
           pkgs.ninja
           pkgs.curl
           pkgs.git
+          pkgs.tea     # used by `cargoxx publish` for Gitea API + auth
         ];
 
         # Defaults applied to the bundled `nix` so it works on hosts
@@ -60,6 +61,7 @@
             lock = builtins.fromTOML (builtins.readFile (src + "/Cargoxx.lock"));
             isDep = p: p ? linkdb_source;
             isRoot = p: !(isDep p);
+            isCargoxxSource = p: (p.source_kind or "") != "";
             root = builtins.head (builtins.filter isRoot lock.package);
             depPkgs = builtins.filter isDep lock.package;
             pname = if name != null then name else root.name;
@@ -68,7 +70,20 @@
               (builtins.getFlake "github:NixOS/nixpkgs/${rev}")
                 .legacyPackages.${system};
 
+            # cargoxx-source deps recurse into buildCppPackage; the result
+            # joins buildInputs so the consumer's find_package(<dep> CONFIG
+            # REQUIRED) resolves via CMAKE_PREFIX_PATH.
             evalDep = p:
+              if (p.source_kind or "") == "cargoxx-path" then
+                buildCppPackage { src = src + ("/" + p.source_path); }
+              else if (p.source_kind or "") == "cargoxx-git" then
+                let depSrc = pkgs.fetchgit {
+                      url    = p.source_git_url;
+                      rev    = p.source_git_commit;
+                      hash   = p.source_git_sha256;
+                    };
+                in buildCppPackage { src = depSrc; }
+              else
                 let rev = if (p ? nixpkgs_rev) && (p.nixpkgs_rev != "")
                           then p.nixpkgs_rev
                           else lock.nixpkgs_rev;
@@ -87,12 +102,18 @@
             mkDepTomlEntry = p:
               let
                 derivation = evalDep p;
-                rev = if (p ? nixpkgs_rev) && (p.nixpkgs_rev != "")
+                # For cargoxx-source deps we don't have a nixpkgs rev/attr — the
+                # vendor.toml entry just needs a name + store_path so cargoxx's
+                # offline pathway can find the dep's installed prefix.
+                isCargoxx = (p.source_kind or "") != "";
+                attr = if isCargoxx then "" else p.nixpkgs_attr;
+                rev = if isCargoxx then ""
+                      else if (p ? nixpkgs_rev) && (p.nixpkgs_rev != "")
                       then p.nixpkgs_rev else lock.nixpkgs_rev;
               in ''
                 [[dep]]
                 name = "${p.name}"
-                nixpkgs_attr = "${p.nixpkgs_attr}"
+                nixpkgs_attr = "${attr}"
                 nixpkgs_rev = "${rev}"
                 store_path = "${derivation}"
               '';
@@ -121,9 +142,7 @@
               cargoxx build --release --offline --vendor ${vendorToml}
             '';
             installPhase = ''
-              mkdir -p $out/bin
-              cp build/release/${pname}     $out/bin/ 2>/dev/null || \
-              cp build/release/${pname}_bin $out/bin/${pname}
+              cmake --install build/release --prefix $out
             '';
             hardeningDisable = [ "all" ];
           };

src/cli/cli.cppm

@@ -29,6 +29,20 @@ auto cmd_vendor(const std::filesystem::path& project_root,
                 const std::filesystem::path& output)
     -> util::Result<void>;
 
+// Publish the project's current HEAD as a new version recipe in the
+// cargoxx-pkgs registry. Validates manifest + lockfile, computes the
+// source sha256 via `nix flake prefetch`, writes
+// `recipes/<name>/versions/<version>.toml` (and `maintainers.txt` for
+// new packages) into a `publish/<name>-<version>` branch via the
+// Gitea contents API, opens a PR via `tea api`. With `dry_run=true`,
+// prints the recipe TOML and skips all network operations.
+//
+// `registry_slug` is "<owner>/<repo>" (default: $CARGOXX_REGISTRY or
+// "mozart/cargoxx-pkgs"). Authentication comes from `tea login`.
+auto cmd_publish(const std::filesystem::path& project_root, bool dry_run,
+                 std::optional<std::string> registry_slug = std::nullopt)
+    -> util::Result<void>;
+
 // Builds the project, picks a binary target, and execs it with `args`.
 // `bin_name` is required when the project declares more than one binary.
 // Returns the binary's exit code, or an Error if selection or build fails.

src/cli/cmd_build.cpp

@@ -74,7 +74,9 @@ auto query_flake_rev(std::string_view flake_ref) -> std::optional<std::string> {
 auto merge_lockfile(const manifest::Manifest& m,
                     const std::vector<linkdb::Recipe>& recipes,
                     const std::vector<linkdb::Recipe>& dev_recipes,
-                    const lockfile::Lockfile& prior) -> lockfile::Lockfile {
+                    const lockfile::Lockfile& prior,
+                    const std::map<std::string, std::string>& git_sha256s)
+    -> lockfile::Lockfile {
     auto find_prior = [&](const std::string& name, const std::string& version)
         -> std::optional<lockfile::LockfilePackage> {
         for (const auto& p : prior.packages) {
@@ -120,6 +122,22 @@ auto merge_lockfile(const manifest::Manifest& m,
                 attr = *p->nixpkgs_attr;
             }
         }
+        std::optional<std::string> source_kind;
+        std::optional<std::string> source_path;
+        std::optional<std::string> source_git_url;
+        std::optional<std::string> source_git_commit;
+        std::optional<std::string> source_git_sha256;
+        if (dep.source == manifest::DepSource::CargoxxPath) {
+            source_kind = "cargoxx-path";
+            source_path = dep.path;
+        } else if (dep.source == manifest::DepSource::CargoxxGit) {
+            source_kind = "cargoxx-git";
+            source_git_url = dep.git_url;
+            source_git_commit = dep.git_rev;
+            if (auto it = git_sha256s.find(dep.name); it != git_sha256s.end()) {
+                source_git_sha256 = it->second;
+            }
+        }
         lock.packages.push_back(lockfile::LockfilePackage{
             .name = dep.name,
             .version = dep.version_spec,
@@ -132,6 +150,11 @@ auto merge_lockfile(const manifest::Manifest& m,
             .pkg_config_module = rec.pkg_config_module,
             .brute_force_libs = rec.brute_force_libs,
             .brute_force_includes = rec.brute_force_includes,
+            .source_kind = std::move(source_kind),
+            .source_path = std::move(source_path),
+            .source_git_url = std::move(source_git_url),
+            .source_git_commit = std::move(source_git_commit),
+            .source_git_sha256 = std::move(source_git_sha256),
         });
     };
     for (std::size_t i = 0; i < m.dependencies.size(); ++i) {
@@ -249,11 +272,122 @@ auto cmd_build(const fs::path& project_root, bool no_build, bool release,
         return std::nullopt;
     };
 
+    // For { path = "../foo" } deps: skip the linkdb chain entirely. Read
+    // the dep's Cargoxx.toml to confirm the name matches, then synthesize
+    // a Recipe that maps to the producer's installed Config.cmake.
+    auto resolve_path_dep = [&](const manifest::Dependency& dep)
+        -> util::Result<linkdb::Recipe> {
+        const auto dep_root = (project_root / *dep.path).lexically_normal();
+        auto dep_manifest = manifest::parse(dep_root / "Cargoxx.toml");
+        if (!dep_manifest) {
+            return std::unexpected(dep_manifest.error());
+        }
+        if (dep_manifest->package.name != dep.name) {
+            return std::unexpected(util::Error{
+                util::ErrorCode::ManifestInvalidField,
+                std::format("path dep '{}' points to a project named '{}'",
+                             dep.name, dep_manifest->package.name),
+                std::format("rename the dep, or fix [package].name in {}",
+                             (dep_root / "Cargoxx.toml").string()),
+                dep_root / "Cargoxx.toml", std::nullopt,
+            });
+        }
+        return linkdb::Recipe{
+            .nixpkgs_attr = "",
+            .find_package = std::format("{} CONFIG REQUIRED", dep.name),
+            .targets = {std::format("{}::{}", dep.name, dep.name)},
+            .source = "cargoxx-path",
+            .pkg_config_module = std::nullopt,
+            .brute_force_libs = {},
+            .brute_force_includes = {},
+        };
+    };
+
+    // Side channel: (dep name) → SRI hash captured during git resolution,
+    // consumed by merge_lockfile to persist source_git_sha256.
+    std::map<std::string, std::string> git_sha256s;
+
+    // For { git = "...", rev = "..." } deps: if the prior lockfile already
+    // records an SRI hash for this (url, commit), reuse it. Otherwise run
+    // `nix flake prefetch` to fetch + hash the source tree (FOD-compatible),
+    // then verify the dep's Cargoxx.toml name matches.
+    auto resolve_git_dep = [&](const manifest::Dependency& dep)
+        -> util::Result<linkdb::Recipe> {
+        std::optional<std::string> cached_sha;
+        for (const auto& p : prior.packages) {
+            if (p.name == dep.name && p.source_kind == "cargoxx-git" &&
+                p.source_git_url == dep.git_url &&
+                p.source_git_commit == dep.git_rev && p.source_git_sha256) {
+                cached_sha = p.source_git_sha256;
+                break;
+            }
+        }
+
+        if (!cached_sha) {
+            if (offline) {
+                return std::unexpected(util::Error{
+                    util::ErrorCode::BuildCmakeFailed,
+                    std::format("git dep '{}' has no cached hash and --offline "
+                                "forbids network fetch", dep.name),
+                    "run `cargoxx build` once online to populate Cargoxx.lock",
+                    std::nullopt, std::nullopt,
+                });
+            }
+            auto flake_ref = std::format("git+{}?rev={}", *dep.git_url, *dep.git_rev);
+            auto prefetched = resolver::prefetch_flake_source(flake_ref);
+            if (!prefetched) {
+                return std::unexpected(prefetched.error());
+            }
+            // Verify name matches by reading the fetched tree's Cargoxx.toml.
+            auto dep_manifest = manifest::parse(
+                std::filesystem::path{prefetched->store_path} / "Cargoxx.toml");
+            if (!dep_manifest) {
+                return std::unexpected(dep_manifest.error());
+            }
+            if (dep_manifest->package.name != dep.name) {
+                return std::unexpected(util::Error{
+                    util::ErrorCode::ManifestInvalidField,
+                    std::format("git dep '{}' points to a project named '{}'",
+                                 dep.name, dep_manifest->package.name),
+                    "rename the dep or use a repo whose [package].name matches",
+                    std::nullopt, std::nullopt,
+                });
+            }
+            cached_sha = prefetched->hash;
+        }
+        git_sha256s[dep.name] = *cached_sha;
+        return linkdb::Recipe{
+            .nixpkgs_attr = "",
+            .find_package = std::format("{} CONFIG REQUIRED", dep.name),
+            .targets = {std::format("{}::{}", dep.name, dep.name)},
+            .source = "cargoxx-git",
+            .pkg_config_module = std::nullopt,
+            .brute_force_libs = {},
+            .brute_force_includes = {},
+        };
+    };
+
     auto resolve_list = [&](const std::vector<manifest::Dependency>& deps)
         -> util::Result<std::vector<linkdb::Recipe>> {
         std::vector<linkdb::Recipe> out;
         out.reserve(deps.size());
         for (const auto& dep : deps) {
+            if (dep.source == manifest::DepSource::CargoxxPath) {
+                auto r = resolve_path_dep(dep);
+                if (!r) {
+                    return std::unexpected(r.error());
+                }
+                out.push_back(std::move(*r));
+                continue;
+            }
+            if (dep.source == manifest::DepSource::CargoxxGit) {
+                auto r = resolve_git_dep(dep);
+                if (!r) {
+                    return std::unexpected(r.error());
+                }
+                out.push_back(std::move(*r));
+                continue;
+            }
             if (auto cached = recipe_from_lock(dep.name, dep.version_spec); cached) {
                 out.push_back(std::move(*cached));
                 continue;
@@ -282,7 +416,7 @@ auto cmd_build(const fs::path& project_root, bool no_build, bool release,
     if (!dev_recipes) {
         return std::unexpected(dev_recipes.error());
     }
-    auto lock = merge_lockfile(*m, *recipes, *dev_recipes, prior);
+    auto lock = merge_lockfile(*m, *recipes, *dev_recipes, prior, git_sha256s);
 
     std::optional<codegen::VendorIndex> vendor_index;
     if (offline) {

src/cli/cmd_publish.cpp

@@ -0,0 +1,461 @@
+module;
+
+#include <json.hpp>
+
+module cargoxx.cli;
+
+import std;
+import cargoxx.util;
+import cargoxx.manifest;
+import cargoxx.lockfile;
+import cargoxx.exec;
+
+namespace cargoxx::cli {
+
+namespace fs = std::filesystem;
+
+namespace {
+
+constexpr std::string_view DEFAULT_REGISTRY = "mozart/cargoxx-pkgs";
+
+auto err(util::ErrorCode code, std::string msg, std::string hint = "")
+    -> util::Error {
+    return util::Error{code, std::move(msg), std::move(hint), std::nullopt,
+                       std::nullopt};
+}
+
+auto trim(std::string s) -> std::string {
+    auto end = s.find_last_not_of(" \t\r\n");
+    if (end != std::string::npos) {
+        s.erase(end + 1);
+    }
+    auto start = s.find_first_not_of(" \t\r\n");
+    if (start == std::string::npos) {
+        return {};
+    }
+    return s.substr(start);
+}
+
+// Run a process, return trimmed stdout on success.
+auto capture(const std::string& prog, std::vector<std::string> args,
+              const fs::path& cwd) -> util::Result<std::string> {
+    auto r = exec::run(prog, args,
+                       exec::ExecOptions{
+                           .cwd = cwd,
+                           .env_overrides = {},
+                           .timeout = std::chrono::seconds{60},
+                           .inherit_stdio = false,
+                       });
+    if (!r) {
+        return std::unexpected(r.error());
+    }
+    if (r->exit_code != 0) {
+        return std::unexpected(err(
+            util::ErrorCode::ExecCommandFailed,
+            std::format("{} failed (exit {}): {}", prog, r->exit_code,
+                        r->stderr_text)));
+    }
+    return trim(r->stdout_text);
+}
+
+// Normalize a git remote URL to an https form Nix can fetch.
+// `git@host:owner/repo.git` → `https://host/owner/repo`
+// `https://host/owner/repo.git` → `https://host/owner/repo`
+// `ssh://git@host:port/owner/repo.git` → `https://host/owner/repo`
+auto normalize_remote(std::string url) -> std::string {
+    if (url.starts_with("git@")) {
+        // git@host:owner/repo[.git]
+        auto colon = url.find(':');
+        if (colon != std::string::npos) {
+            auto host = url.substr(4, colon - 4);
+            auto path = url.substr(colon + 1);
+            url = std::format("https://{}/{}", host, path);
+        }
+    } else if (url.starts_with("ssh://git@")) {
+        url.replace(0, std::string_view{"ssh://git@"}.size(), "https://");
+        // Strip :PORT from ssh form.
+        auto slash = url.find('/', 8);
+        auto colon = url.find(':', 8);
+        if (colon != std::string::npos && colon < slash) {
+            url.erase(colon, slash - colon);
+        }
+    }
+    if (url.ends_with(".git")) {
+        url.erase(url.size() - 4);
+    }
+    return url;
+}
+
+// Encode a string as base64 (RFC 4648, no line wrap). Inline impl avoids
+// dragging in another library — Gitea's contents-API requires base64
+// bodies for file content.
+auto b64encode(std::string_view bytes) -> std::string {
+    static constexpr std::string_view alphabet =
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    std::string out;
+    out.reserve((bytes.size() + 2) / 3 * 4);
+    std::size_t i = 0;
+    while (i + 3 <= bytes.size()) {
+        auto a = static_cast<unsigned char>(bytes[i]);
+        auto b = static_cast<unsigned char>(bytes[i + 1]);
+        auto c = static_cast<unsigned char>(bytes[i + 2]);
+        out += alphabet[(a >> 2) & 0x3f];
+        out += alphabet[((a << 4) | (b >> 4)) & 0x3f];
+        out += alphabet[((b << 2) | (c >> 6)) & 0x3f];
+        out += alphabet[c & 0x3f];
+        i += 3;
+    }
+    if (i < bytes.size()) {
+        auto a = static_cast<unsigned char>(bytes[i]);
+        out += alphabet[(a >> 2) & 0x3f];
+        if (i + 1 == bytes.size()) {
+            out += alphabet[(a << 4) & 0x3f];
+            out += "==";
+        } else {
+            auto b = static_cast<unsigned char>(bytes[i + 1]);
+            out += alphabet[((a << 4) | (b >> 4)) & 0x3f];
+            out += alphabet[(b << 2) & 0x3f];
+            out += '=';
+        }
+    }
+    return out;
+}
+
+auto escape_toml(std::string_view s) -> std::string {
+    std::string out;
+    out.reserve(s.size() + 2);
+    out += '"';
+    for (char c : s) {
+        if (c == '\\' || c == '"') {
+            out += '\\';
+        }
+        out += c;
+    }
+    out += '"';
+    return out;
+}
+
+auto build_recipe(const manifest::Manifest& m, const lockfile::Lockfile& lock,
+                  std::string_view source_url, std::string_view source_commit,
+                  std::string_view source_sha256) -> std::string {
+    std::string out;
+    out += "schema = 1\n";
+    out += std::format("name = {}\n", escape_toml(m.package.name));
+    out += std::format("version = {}\n\n", escape_toml(m.package.version));
+
+    out += "[source]\n";
+    out += "type = \"git\"\n";
+    out += std::format("url = {}\n", escape_toml(source_url));
+    out += std::format("commit = {}\n", escape_toml(source_commit));
+    out += std::format("sha256 = {}\n\n", escape_toml(source_sha256));
+
+    if (!m.dependencies.empty()) {
+        out += "[dependencies]\n";
+        for (const auto& d : m.dependencies) {
+            if (d.source == manifest::DepSource::CargoxxPath) {
+                // Path deps can't be published — caller already rejected.
+                continue;
+            }
+            out += std::format("{} = {}\n", d.name, escape_toml(d.version_spec));
+        }
+        out += "\n";
+    }
+
+    out += "[lock]\n";
+    if (lock.nixpkgs_rev_pin) {
+        out += std::format("nixpkgs_rev = {}\n", escape_toml(*lock.nixpkgs_rev_pin));
+    }
+    if (lock.flake_utils_rev_pin) {
+        out += std::format("flake_utils_rev = {}\n",
+                            escape_toml(*lock.flake_utils_rev_pin));
+    }
+    out += "\n";
+
+    out += "[meta]\n";
+    if (m.package.description) {
+        out += std::format("description = {}\n", escape_toml(*m.package.description));
+    } else {
+        out += std::format("description = {}\n", escape_toml(m.package.name));
+    }
+    if (m.package.homepage) {
+        out += std::format("homepage = {}\n", escape_toml(*m.package.homepage));
+    }
+    if (m.package.license) {
+        out += std::format("license = {}\n", escape_toml(*m.package.license));
+    }
+    return out;
+}
+
+auto extract_json_string(std::string_view body, std::string_view key)
+    -> std::optional<std::string> {
+    auto needle = std::format("\"{}\":\"", key);
+    auto pos = body.find(needle);
+    if (pos == std::string_view::npos) {
+        return std::nullopt;
+    }
+    pos += needle.size();
+    auto end = body.find('"', pos);
+    if (end == std::string_view::npos) {
+        return std::nullopt;
+    }
+    return std::string{body.substr(pos, end - pos)};
+}
+
+auto tea_whoami() -> util::Result<std::string> {
+    auto r = capture("tea", {"api", "/user"}, fs::current_path());
+    if (!r) {
+        return std::unexpected(r.error());
+    }
+    auto login = extract_json_string(*r, "login");
+    if (!login) {
+        return std::unexpected(err(util::ErrorCode::Internal,
+                                    "tea api /user returned no 'login' field"));
+    }
+    return *login;
+}
+
+auto path_exists_remote(const std::string& registry, const std::string& path)
+    -> bool {
+    auto r = exec::run("tea",
+                       {"api", std::format("/repos/{}/contents/{}", registry, path)},
+                       exec::ExecOptions{
+                           .cwd = fs::current_path(),
+                           .env_overrides = {},
+                           .timeout = std::chrono::seconds{30},
+                           .inherit_stdio = false,
+                       });
+    if (!r) {
+        return false;
+    }
+    return r->exit_code == 0 && r->stdout_text.find("\"name\":") != std::string::npos;
+}
+
+} // namespace
+
+auto cmd_publish(const fs::path& project_root, bool dry_run,
+                 std::optional<std::string> registry_slug_arg) -> util::Result<void> {
+    // 1. Read manifest + lockfile
+    auto m = manifest::parse(project_root / "Cargoxx.toml");
+    if (!m) {
+        return std::unexpected(m.error());
+    }
+    if (m->package.name.empty() || m->package.version.empty()) {
+        return std::unexpected(err(util::ErrorCode::ManifestInvalidField,
+                                    "publish requires [package].name and .version"));
+    }
+    if (!m->package.license) {
+        return std::unexpected(err(util::ErrorCode::ManifestInvalidField,
+                                    "publish requires [package].license"));
+    }
+
+    auto lock_path = project_root / "Cargoxx.lock";
+    if (std::error_code ec; !fs::exists(lock_path, ec)) {
+        return std::unexpected(err(util::ErrorCode::ManifestNotFound,
+                                    "Cargoxx.lock is missing — run `cargoxx build` first"));
+    }
+    auto lock = lockfile::parse(lock_path);
+    if (!lock) {
+        return std::unexpected(lock.error());
+    }
+
+    // 2. Path deps are disallowed when publishing (they're local-only).
+    for (const auto& d : m->dependencies) {
+        if (d.source == manifest::DepSource::CargoxxPath) {
+            return std::unexpected(err(
+                util::ErrorCode::ManifestInvalidField,
+                std::format("path dep '{}' cannot be published — convert to "
+                             "{{ git = ..., rev = ... }} or release the dep "
+                             "separately first", d.name)));
+        }
+    }
+
+    // 3. Git context.
+    auto remote_url = capture("git", {"remote", "get-url", "origin"}, project_root);
+    if (!remote_url) {
+        return std::unexpected(err(util::ErrorCode::ManifestInvalidField,
+                                    "no `origin` git remote",
+                                    "git remote add origin <url>"));
+    }
+    auto source_url = normalize_remote(*remote_url);
+
+    auto head = capture("git", {"rev-parse", "HEAD"}, project_root);
+    if (!head) {
+        return std::unexpected(head.error());
+    }
+
+    // Working tree must be clean — otherwise the published source won't
+    // match what's actually in the repo at HEAD.
+    auto status = capture("git", {"status", "--porcelain"}, project_root);
+    if (!status) {
+        return std::unexpected(status.error());
+    }
+    if (!status->empty()) {
+        return std::unexpected(err(util::ErrorCode::ManifestInvalidField,
+                                    "git working tree is not clean",
+                                    "commit or stash changes before publishing"));
+    }
+
+    // 4. Compute source sha256 via nix flake prefetch — the published
+    //    recipe pins this; the registry CI re-verifies it.
+    auto flake_ref = std::format("git+{}?rev={}", source_url, *head);
+    auto prefetch = capture("nix",
+                             {"--extra-experimental-features",
+                              "nix-command flakes", "flake", "prefetch",
+                              flake_ref, "--json"},
+                             project_root);
+    if (!prefetch) {
+        return std::unexpected(err(util::ErrorCode::ResolutionNetworkError,
+                                    std::format("nix flake prefetch failed for {}",
+                                                 flake_ref)));
+    }
+    auto source_sha256 = extract_json_string(*prefetch, "hash");
+    if (!source_sha256) {
+        return std::unexpected(err(util::ErrorCode::ResolutionNetworkError,
+                                    "nix flake prefetch returned no hash"));
+    }
+
+    // 5. Build the recipe TOML.
+    auto recipe = build_recipe(*m, *lock, source_url, *head, *source_sha256);
+
+    if (dry_run) {
+        std::cout << recipe;
+        return {};
+    }
+
+    // 6. Registry slug + auth.
+    auto registry = registry_slug_arg.value_or([]() -> std::string {
+        auto* env = std::getenv("CARGOXX_REGISTRY");
+        return env && *env ? env : std::string{DEFAULT_REGISTRY};
+    }());
+
+    auto publisher = tea_whoami();
+    if (!publisher) {
+        return std::unexpected(publisher.error());
+    }
+
+    // 7. Compose the API payload — one atomic commit creating the
+    //    version recipe, plus maintainers.txt for first-time packages.
+    auto branch = std::format("publish/{}-{}", m->package.name, m->package.version);
+    auto version_path = std::format("recipes/{}/versions/{}.toml",
+                                     m->package.name, m->package.version);
+    auto maintainers_path = std::format("recipes/{}/maintainers.txt", m->package.name);
+    bool is_new_package = !path_exists_remote(registry, maintainers_path);
+
+    nlohmann::json files = nlohmann::json::array();
+    files.push_back({
+        {"operation", "create"},
+        {"path", version_path},
+        {"content", b64encode(recipe)},
+    });
+    if (is_new_package) {
+        std::string maintainers_body = *publisher + "\n";
+        files.push_back({
+            {"operation", "create"},
+            {"path", maintainers_path},
+            {"content", b64encode(maintainers_body)},
+        });
+    }
+
+    nlohmann::json body = {
+        {"branch", "master"},
+        {"new_branch", branch},
+        {"message", std::format("publish: {} {}", m->package.name, m->package.version)},
+        {"files", files},
+    };
+
+    // tea api with `-d @<file>` reads the body from a file — write it
+    // to a temp path. exec::run doesn't pipe stdin, so a tempfile is
+    // the simplest portable plumbing.
+    auto contents_tmp = fs::temp_directory_path() /
+                        std::format("cargoxx-publish-{}.json",
+                                     std::random_device{}());
+    std::ofstream{contents_tmp} << body.dump();
+    auto contents_r = exec::run(
+        "tea",
+        {"api", "-X", "POST", "-d", std::format("@{}", contents_tmp.string()),
+         std::format("/repos/{}/contents", registry)},
+        exec::ExecOptions{
+            .cwd = project_root,
+            .env_overrides = {},
+            .timeout = std::chrono::seconds{120},
+            .inherit_stdio = false,
+        });
+    std::error_code rm_ec;
+    fs::remove(contents_tmp, rm_ec);
+    if (!contents_r) {
+        return std::unexpected(contents_r.error());
+    }
+    if (contents_r->exit_code != 0) {
+        return std::unexpected(err(
+            util::ErrorCode::ExecCommandFailed,
+            std::format("tea api contents failed (exit {}): {}",
+                         contents_r->exit_code, contents_r->stderr_text)));
+    }
+    // Gitea returns API errors with HTTP 4xx; tea writes the error JSON
+    // to stdout with exit code 0. The `"errors"` array key only appears
+    // in error responses, never in success ones — use that as signal.
+    if (contents_r->stdout_text.find("\"errors\"") != std::string::npos) {
+        return std::unexpected(err(
+            util::ErrorCode::ExecCommandFailed,
+            std::format("Gitea contents API rejected the request: {}",
+                         contents_r->stdout_text)));
+    }
+
+    // 8. Open the PR.
+    nlohmann::json pr_body = {
+        {"title", std::format("publish: {} {}", m->package.name, m->package.version)},
+        {"body",
+         std::format("Automated publish from `cargoxx publish` by @{}.\n\n"
+                      "- source: `{}@{}`\n- sha256: `{}`\n",
+                      *publisher, source_url, *head, *source_sha256)},
+        {"head", branch},
+        {"base", "master"},
+    };
+    auto pr_tmp = fs::temp_directory_path() /
+                  std::format("cargoxx-pr-{}.json", std::random_device{}());
+    std::ofstream{pr_tmp} << pr_body.dump();
+    auto pr_r = exec::run(
+        "tea",
+        {"api", "-X", "POST", "-d", std::format("@{}", pr_tmp.string()),
+         std::format("/repos/{}/pulls", registry)},
+        exec::ExecOptions{
+            .cwd = project_root,
+            .env_overrides = {},
+            .timeout = std::chrono::seconds{60},
+            .inherit_stdio = false,
+        });
+    std::error_code ec;
+    fs::remove(pr_tmp, ec);
+    if (!pr_r) {
+        return std::unexpected(pr_r.error());
+    }
+    if (pr_r->exit_code != 0) {
+        return std::unexpected(err(
+            util::ErrorCode::ExecCommandFailed,
+            std::format("tea api /pulls failed (exit {}): {}",
+                         pr_r->exit_code, pr_r->stderr_text)));
+    }
+    if (pr_r->stdout_text.find("\"errors\"") != std::string::npos) {
+        return std::unexpected(err(
+            util::ErrorCode::ExecCommandFailed,
+            std::format("Gitea /pulls API rejected the request: {}",
+                         pr_r->stdout_text)));
+    }
+
+    // Parse the response properly — substring extraction is fooled by
+    // the nested `html_url` inside the `user`/`head`/`base` sub-objects.
+    std::optional<std::string> pr_url;
+    try {
+        auto j = nlohmann::json::parse(pr_r->stdout_text);
+        if (j.contains("html_url") && j["html_url"].is_string()) {
+            pr_url = j["html_url"].get<std::string>();
+        }
+    } catch (const nlohmann::json::exception&) {
+        // Leave pr_url empty; fall through to the placeholder message.
+    }
+    std::cout << std::format("    Opened {}\n",
+                              pr_url.value_or("(PR URL not parsed)"));
+    return {};
+}
+
+} // namespace cargoxx::cli

src/cli/cmd_run.cpp

@@ -81,7 +81,7 @@ auto cmd_run(const fs::path& project_root, bool release,
     }
 
     const std::string profile = release ? "release" : "debug";
-    auto bin_path = project_root / "build" / profile / selected->name;
+    auto bin_path = project_root / "build" / profile / "bin" / selected->name;
 
     auto r = exec::run(bin_path.string(), args,
                        exec::ExecOptions{

src/cli/run.cpp

@@ -43,6 +43,16 @@ auto run(int argc, char** argv) -> int {
     vendor_cmd->add_option("--output", vendor_output,
                             "Path to write vendor.toml (default ./vendor.toml)");
 
+    auto* publish_cmd = app.add_subcommand(
+        "publish", "Publish the current HEAD as a new recipe in the cargoxx registry");
+    bool publish_dry_run = false;
+    std::string publish_registry;
+    publish_cmd->add_flag("--dry-run", publish_dry_run,
+                           "Print the recipe TOML; skip all network ops");
+    publish_cmd->add_option("--registry", publish_registry,
+                             "Registry repo slug <owner>/<repo> "
+                             "(default $CARGOXX_REGISTRY or mozart/cargoxx-pkgs)");
+
     auto* run_cmd = app.add_subcommand("run", "Build and run a binary target");
     bool run_release = false;
     std::string run_bin;
@@ -152,6 +162,19 @@ auto run(int argc, char** argv) -> int {
         return 0;
     }
 
+    if (*publish_cmd) {
+        std::optional<std::string> registry;
+        if (!publish_registry.empty()) {
+            registry = publish_registry;
+        }
+        auto r = cmd_publish(cwd, publish_dry_run, registry);
+        if (!r) {
+            std::cerr << util::format(r.error());
+            return 1;
+        }
+        return 0;
+    }
+
     if (*run_cmd) {
         std::optional<std::string> bin;
         if (!run_bin.empty()) {

src/codegen/cmake.cpp

@@ -64,7 +64,10 @@ auto emit_header(const manifest::Manifest& m) -> std::string {
         "set(CMAKE_EXPERIMENTAL_CXX_IMPORT_STD \"d0edc3af-4c50-42ea-a356-e2862fe7a444\")\n"
         "set(CMAKE_CXX_MODULE_STD ON)\n"
         "\n"
-        "project({} LANGUAGES CXX)\n"
+        "project({} VERSION {} LANGUAGES CXX)\n"
+        "\n"
+        "include(GNUInstallDirs)\n"
+        "include(CMakePackageConfigHelpers)\n"
         "\n"
         "# Generated by cargoxx — do not edit.\n"
         "# Source of truth: ../Cargoxx.toml\n"
@@ -77,7 +80,7 @@ auto emit_header(const manifest::Manifest& m) -> std::string {
         "\n"
         "add_compile_options(-Wall -Wextra -Wpedantic -Wconversion "
         "-Wno-missing-field-initializers)\n",
-        m.package.name, edition_to_int(m.package.edition));
+        m.package.name, m.package.version, edition_to_int(m.package.edition));
 }
 
 auto emit_find_packages(const std::vector<linkdb::Recipe>& recipes,
@@ -153,9 +156,65 @@ auto any_recipe_is_catch2(const std::vector<linkdb::Recipe>& dev_recipes) -> boo
     return std::ranges::any_of(dev_recipes, recipe_is_catch2);
 }
 
+auto emit_library_install_rules(const std::string& package_name) -> std::string {
+    // Installs the static archive + module FILE_SET, exports targets,
+    // generates Config.cmake + Version.cmake via configure_package_config_file,
+    // and writes a basic pkg-config descriptor. Inline file(WRITE …) keeps the
+    // .in templates self-contained in the generated CMakeLists.txt — no
+    // out-of-tree files to manage.
+    return std::format(
+        "\n# ----- install + package-config + pkg-config -----\n"
+        "install(TARGETS {0}\n"
+        "        EXPORT {0}Targets\n"
+        "        FILE_SET CXX_MODULES DESTINATION ${{CMAKE_INSTALL_INCLUDEDIR}}/{0}\n"
+        "        ARCHIVE DESTINATION ${{CMAKE_INSTALL_LIBDIR}})\n"
+        "install(EXPORT {0}Targets\n"
+        "        FILE {0}Targets.cmake\n"
+        "        NAMESPACE {0}::\n"
+        "        DESTINATION ${{CMAKE_INSTALL_LIBDIR}}/cmake/{0})\n"
+        "\n"
+        "file(WRITE ${{CMAKE_CURRENT_BINARY_DIR}}/{0}Config.cmake.in [[\n"
+        "@PACKAGE_INIT@\n"
+        "include(CMakeFindDependencyMacro)\n"
+        "include(\"${{CMAKE_CURRENT_LIST_DIR}}/{0}Targets.cmake\")\n"
+        "check_required_components({0})\n"
+        "]])\n"
+        "configure_package_config_file(\n"
+        "    ${{CMAKE_CURRENT_BINARY_DIR}}/{0}Config.cmake.in\n"
+        "    ${{CMAKE_CURRENT_BINARY_DIR}}/{0}Config.cmake\n"
+        "    INSTALL_DESTINATION ${{CMAKE_INSTALL_LIBDIR}}/cmake/{0})\n"
+        "write_basic_package_version_file(\n"
+        "    ${{CMAKE_CURRENT_BINARY_DIR}}/{0}ConfigVersion.cmake\n"
+        "    VERSION ${{PROJECT_VERSION}}\n"
+        "    COMPATIBILITY SameMajorVersion)\n"
+        "install(FILES\n"
+        "    ${{CMAKE_CURRENT_BINARY_DIR}}/{0}Config.cmake\n"
+        "    ${{CMAKE_CURRENT_BINARY_DIR}}/{0}ConfigVersion.cmake\n"
+        "    DESTINATION ${{CMAKE_INSTALL_LIBDIR}}/cmake/{0})\n"
+        "\n"
+        "file(WRITE ${{CMAKE_CURRENT_BINARY_DIR}}/{0}.pc.in [[\n"
+        "prefix=@CMAKE_INSTALL_PREFIX@\n"
+        "exec_prefix=${{prefix}}\n"
+        "libdir=${{prefix}}/${{CMAKE_INSTALL_LIBDIR}}\n"
+        "includedir=${{prefix}}/${{CMAKE_INSTALL_INCLUDEDIR}}\n"
+        "\n"
+        "Name: @PROJECT_NAME@\n"
+        "Version: @PROJECT_VERSION@\n"
+        "Description: @PROJECT_NAME@\n"
+        "Cflags: -I${{includedir}}\n"
+        "Libs: -L${{libdir}} -l@PROJECT_NAME@\n"
+        "]])\n"
+        "configure_file(${{CMAKE_CURRENT_BINARY_DIR}}/{0}.pc.in\n"
+        "               ${{CMAKE_CURRENT_BINARY_DIR}}/{0}.pc @ONLY)\n"
+        "install(FILES ${{CMAKE_CURRENT_BINARY_DIR}}/{0}.pc\n"
+        "        DESTINATION ${{CMAKE_INSTALL_LIBDIR}}/pkgconfig)\n",
+        package_name);
+}
+
 auto emit_library(const layout::Target& lib, const std::string& package_name,
                   const std::vector<linkdb::Recipe>& recipes,
                   const std::vector<std::string>& include_dirs,
+                  manifest::Edition edition,
                   const fs::path& project_root) -> std::string {
     std::string out = "\n# ----- library target -----\n";
     out += std::format("add_library({} STATIC)\n", package_name);
@@ -172,6 +231,11 @@ auto emit_library(const layout::Target& lib, const std::string& package_name,
         }
     }
     out += ")\n";
+    // PUBLIC cxx_std_NN propagates the standard requirement onto the
+    // exported IMPORTED target, so consumers `find_package`-ing this
+    // library get the right standard for module BMI regeneration.
+    out += std::format("target_compile_features({} PUBLIC cxx_std_{})\n",
+                       package_name, edition_to_int(edition));
     if (!include_dirs.empty()) {
         out += std::format("target_include_directories({} SYSTEM PRIVATE", package_name);
         for (const auto& d : include_dirs) {
@@ -181,6 +245,8 @@ auto emit_library(const layout::Target& lib, const std::string& package_name,
     }
     out += link_block(package_name, "PUBLIC", false, package_name,
                       collect_dep_targets(recipes));
+
+    out += emit_library_install_rules(package_name);
     return out;
 }
 
@@ -190,10 +256,14 @@ auto emit_primary_binary(const layout::Target& bin, const std::string& package_n
     std::string out = "\n# ----- binary target -----\n";
     out += std::format("add_executable({}_bin {})\n", package_name,
                        rel_to_build(bin.entry, project_root));
-    out += std::format("set_target_properties({}_bin PROPERTIES OUTPUT_NAME {})\n",
+    out += std::format("set_target_properties({}_bin PROPERTIES\n"
+                       "    OUTPUT_NAME {}\n"
+                       "    RUNTIME_OUTPUT_DIRECTORY \"${{CMAKE_BINARY_DIR}}/bin\")\n",
                        package_name, package_name);
     out += link_block(std::format("{}_bin", package_name), "PRIVATE", has_lib, package_name,
                       collect_dep_targets(recipes));
+    out += std::format("install(TARGETS {}_bin RUNTIME DESTINATION ${{CMAKE_INSTALL_BINDIR}})\n",
+                       package_name);
     return out;
 }
 
@@ -203,8 +273,13 @@ auto emit_extra_binary(const layout::Target& bin, const std::string& package_nam
     std::string out = std::format("\n# ----- binary target: {} -----\n", bin.name);
     out += std::format("add_executable({} {})\n", bin.name,
                        rel_to_build(bin.entry, project_root));
+    out += std::format("set_target_properties({} PROPERTIES\n"
+                       "    RUNTIME_OUTPUT_DIRECTORY \"${{CMAKE_BINARY_DIR}}/bin\")\n",
+                       bin.name);
     out += link_block(bin.name, "PRIVATE", has_lib, package_name,
                       collect_dep_targets(recipes));
+    out += std::format("install(TARGETS {} RUNTIME DESTINATION ${{CMAKE_INSTALL_BINDIR}})\n",
+                       bin.name);
     return out;
 }
 
@@ -335,7 +410,8 @@ auto cmake_lists(const GenerateInputs& in) -> std::string {
 
     if (in.layout.library) {
         out += emit_library(*in.layout.library, pkg_name, in.recipes,
-                             in.manifest.build.include_dirs, in.project_root);
+                             in.manifest.build.include_dirs,
+                             in.manifest.package.edition, in.project_root);
     }
 
     const auto* primary = find_primary_bin(in.layout);

src/layout/layout.cpp

@@ -104,6 +104,31 @@ auto discover(const fs::path& project_root, const std::string& package_name)
             .module_units = {},
         });
     }
+    // Cargo's src/bin/<name>/main.cpp form: a subdirectory of src/bin/
+    // whose entry point is its own main.cpp. v1 ships the entry only —
+    // sibling .cpp files in the subdir are not collected.
+    if (fs::exists(bin_dir, ec) && !ec) {
+        std::vector<fs::path> subdir_mains;
+        for (const auto& entry : fs::directory_iterator{bin_dir}) {
+            if (!entry.is_directory()) {
+                continue;
+            }
+            auto candidate = entry.path() / "main.cpp";
+            if (fs::exists(candidate, ec) && !ec) {
+                subdir_mains.push_back(candidate);
+            }
+        }
+        std::ranges::sort(subdir_mains);
+        for (const auto& m : subdir_mains) {
+            out.binaries.push_back(Target{
+                .kind = TargetKind::Binary,
+                .name = m.parent_path().filename().string(),
+                .entry = m,
+                .additional_sources = {},
+                .module_units = {},
+            });
+        }
+    }
     std::ranges::sort(out.binaries, by_name);
 
     for (const auto& f : top_level_cpp(tests_dir)) {

src/lockfile/lockfile.cpp

@@ -106,6 +106,21 @@ auto parse_package(const toml::table& tbl, const std::filesystem::path& path)
         }
         pkg.brute_force_includes = std::move(*r);
     }
+    if (auto v = tbl["source_kind"].value<std::string>()) {
+        pkg.source_kind = *v;
+    }
+    if (auto v = tbl["source_path"].value<std::string>()) {
+        pkg.source_path = *v;
+    }
+    if (auto v = tbl["source_git_url"].value<std::string>()) {
+        pkg.source_git_url = *v;
+    }
+    if (auto v = tbl["source_git_commit"].value<std::string>()) {
+        pkg.source_git_commit = *v;
+    }
+    if (auto v = tbl["source_git_sha256"].value<std::string>()) {
+        pkg.source_git_sha256 = *v;
+    }
 
     return pkg;
 }
@@ -215,6 +230,21 @@ auto write(const Lockfile& lock, const std::filesystem::path& path) -> util::Res
             }
             tbl.insert_or_assign("brute_force_includes", std::move(arr));
         }
+        if (p.source_kind) {
+            tbl.insert_or_assign("source_kind", *p.source_kind);
+        }
+        if (p.source_path) {
+            tbl.insert_or_assign("source_path", *p.source_path);
+        }
+        if (p.source_git_url) {
+            tbl.insert_or_assign("source_git_url", *p.source_git_url);
+        }
+        if (p.source_git_commit) {
+            tbl.insert_or_assign("source_git_commit", *p.source_git_commit);
+        }
+        if (p.source_git_sha256) {
+            tbl.insert_or_assign("source_git_sha256", *p.source_git_sha256);
+        }
         packages.push_back(std::move(tbl));
     }
     root.insert_or_assign("package", std::move(packages));

src/lockfile/lockfile.cppm

@@ -18,6 +18,15 @@ struct LockfilePackage {
     std::optional<std::string> pkg_config_module;
     std::vector<std::string> brute_force_libs;
     std::vector<std::string> brute_force_includes;
+    // For cargoxx-source deps (not nixpkgs/linkdb-resolved).
+    //   "cargoxx-path"     → source_path only
+    //   "cargoxx-git"      → source_git_url + source_git_commit + source_git_sha256
+    //   "cargoxx-registry" → (1d)
+    std::optional<std::string> source_kind;
+    std::optional<std::string> source_path;
+    std::optional<std::string> source_git_url;
+    std::optional<std::string> source_git_commit;
+    std::optional<std::string> source_git_sha256;
 
     bool operator==(const LockfilePackage&) const = default;
 };

src/manifest/manifest.cppm

@@ -5,10 +5,20 @@ import cargoxx.util;
 
 export namespace cargoxx::manifest {
 
+enum class DepSource {
+    Auto,         // string form or { version = ... } only → existing resolver chain
+    CargoxxPath,  // { path = "../foo" } → recursive cargoxx build
+    CargoxxGit,   // { git = "...", rev = "..." } → fetch + recursive cargoxx build
+};
+
 struct Dependency {
     std::string name;
     std::string version_spec;
     std::vector<std::string> components;
+    DepSource source = DepSource::Auto;
+    std::optional<std::string> path;     // when source == CargoxxPath
+    std::optional<std::string> git_url;  // when source == CargoxxGit
+    std::optional<std::string> git_rev;  // when source == CargoxxGit (40-char)
 
     bool operator==(const Dependency&) const = default;
 };
@@ -29,6 +39,9 @@ struct Package {
     Edition edition = Edition::Cpp23;
     std::vector<std::string> authors;
     std::optional<std::string> license;
+    std::optional<std::string> description;
+    std::optional<std::string> repository;
+    std::optional<std::string> homepage;
 
     bool operator==(const Package&) const = default;
 };

src/manifest/parser.cpp

@@ -138,6 +138,15 @@ auto parse_package(const toml::table& tbl, const std::filesystem::path& path)
     if (auto license = tbl["license"].value<std::string>()) {
         pkg.license = *license;
     }
+    if (auto v = tbl["description"].value<std::string>()) {
+        pkg.description = *v;
+    }
+    if (auto v = tbl["repository"].value<std::string>()) {
+        pkg.repository = *v;
+    }
+    if (auto v = tbl["homepage"].value<std::string>()) {
+        pkg.homepage = *v;
+    }
 
     return pkg;
 }
@@ -153,12 +162,49 @@ auto parse_dependency(std::string name, const toml::node& value,
     }
 
     if (const auto* tbl = value.as_table()) {
+        // Path form: { path = "../foo" } → cargoxx-source dep.
+        if (auto path_str = (*tbl)["path"].value<std::string>()) {
+            dep.source = DepSource::CargoxxPath;
+            dep.path = *path_str;
+            if (auto v = (*tbl)["version"].value<std::string>()) {
+                dep.version_spec = *v;
+            } else {
+                dep.version_spec = "*";
+            }
+            return dep;
+        }
+
+        // Git form: { git = "...", rev = "<40-char>" } → cargoxx-source dep
+        // fetched at the pinned commit. Branch/tag resolution is not yet
+        // supported; require a literal commit.
+        if (auto git_url = (*tbl)["git"].value<std::string>()) {
+            auto rev = (*tbl)["rev"].value<std::string>();
+            if (!rev) {
+                return std::unexpected(err(
+                    ErrorCode::ManifestInvalidField,
+                    std::format("git dependency '{}' must specify a 'rev' (40-char commit)",
+                                dep.name),
+                    path, source_pos(value)));
+            }
+            dep.source = DepSource::CargoxxGit;
+            dep.git_url = *git_url;
+            dep.git_rev = *rev;
+            if (auto v = (*tbl)["version"].value<std::string>()) {
+                dep.version_spec = *v;
+            } else {
+                dep.version_spec = "*";
+            }
+            return dep;
+        }
+
         if (auto v = (*tbl)["version"].value<std::string>()) {
             dep.version_spec = *v;
         } else {
             return std::unexpected(err(
                 ErrorCode::ManifestInvalidField,
-                std::format("dependency '{}' table must have a 'version' string", dep.name),
+                std::format(
+                    "dependency '{}' table must have one of: 'version', 'path', 'git'",
+                    dep.name),
                 path, source_pos(value)));
         }
         if (const auto* comps = (*tbl)["components"].as_array()) {

src/manifest/writer.cpp

@@ -44,12 +44,32 @@ auto build_table(const Manifest& m) -> toml::table {
     if (m.package.license) {
         package.insert_or_assign("license", *m.package.license);
     }
+    if (m.package.description) {
+        package.insert_or_assign("description", *m.package.description);
+    }
+    if (m.package.repository) {
+        package.insert_or_assign("repository", *m.package.repository);
+    }
+    if (m.package.homepage) {
+        package.insert_or_assign("homepage", *m.package.homepage);
+    }
     root.insert_or_assign("package", std::move(package));
 
     auto deps_to_table = [](const std::vector<Dependency>& deps) {
         toml::table out;
         for (const auto& dep : deps) {
-            if (dep.components.empty()) {
+            if (dep.source == DepSource::CargoxxPath) {
+                toml::table dep_tbl;
+                dep_tbl.insert_or_assign("path", *dep.path);
+                dep_tbl.is_inline(true);
+                out.insert_or_assign(dep.name, std::move(dep_tbl));
+            } else if (dep.source == DepSource::CargoxxGit) {
+                toml::table dep_tbl;
+                dep_tbl.insert_or_assign("git", *dep.git_url);
+                dep_tbl.insert_or_assign("rev", *dep.git_rev);
+                dep_tbl.is_inline(true);
+                out.insert_or_assign(dep.name, std::move(dep_tbl));
+            } else if (dep.components.empty()) {
                 out.insert_or_assign(dep.name, dep.version_spec);
             } else {
                 toml::table dep_tbl;

src/resolver/nixpkgs_probe.cpp

@@ -207,12 +207,31 @@ auto realize_path_at_rev(const std::string& rev, const std::string& attr)
     return path;
 }
 
-auto realize_flake_source(const std::string& flake_ref)
-    -> util::Result<std::string> {
+namespace {
+
+auto extract_json_string(std::string_view body, std::string_view key)
+    -> std::optional<std::string> {
+    auto needle = std::format("\"{}\":\"", key);
+    auto pos = body.find(needle);
+    if (pos == std::string_view::npos) {
+        return std::nullopt;
+    }
+    pos += needle.size();
+    auto end = body.find('"', pos);
+    if (end == std::string_view::npos) {
+        return std::nullopt;
+    }
+    return std::string{body.substr(pos, end - pos)};
+}
+
+} // namespace
+
+auto prefetch_flake_source(const std::string& flake_ref)
+    -> util::Result<PrefetchedSource> {
     if (flake_ref.empty()) {
         return std::unexpected(make_error(
             util::ErrorCode::ResolutionUnknownPackage,
-            "realize_flake_source: flake_ref is empty"));
+            "prefetch_flake_source: flake_ref is empty"));
     }
     std::vector<std::string> args{
         "--extra-experimental-features", "nix-command flakes",
@@ -234,23 +253,33 @@ auto realize_flake_source(const std::string& flake_ref)
             std::format("nix flake prefetch failed (exit {}): {}",
                         r->exit_code, r->stderr_text)));
     }
-    std::string_view body = r->stdout_text;
-    constexpr std::string_view key = "\"storePath\":\"";
-    auto pos = body.find(key);
-    if (pos == std::string_view::npos) {
+    auto store_path = extract_json_string(r->stdout_text, "storePath");
+    auto hash = extract_json_string(r->stdout_text, "hash");
+    if (!store_path) {
         return std::unexpected(make_error(
             util::ErrorCode::ResolutionNetworkError,
             std::format("nix flake prefetch emitted no storePath for '{}'",
                         flake_ref)));
     }
-    pos += key.size();
-    auto end = body.find('"', pos);
-    if (end == std::string_view::npos) {
+    if (!hash) {
         return std::unexpected(make_error(
             util::ErrorCode::ResolutionNetworkError,
-            "nix flake prefetch JSON malformed"));
+            std::format("nix flake prefetch emitted no hash for '{}'",
+                        flake_ref)));
     }
-    return std::string{body.substr(pos, end - pos)};
+    return PrefetchedSource{
+        .store_path = std::move(*store_path),
+        .hash = std::move(*hash),
+    };
+}
+
+auto realize_flake_source(const std::string& flake_ref)
+    -> util::Result<std::string> {
+    auto r = prefetch_flake_source(flake_ref);
+    if (!r) {
+        return std::unexpected(r.error());
+    }
+    return std::move(r->store_path);
 }
 
 } // namespace cargoxx::resolver

src/resolver/resolver.cppm

@@ -59,6 +59,17 @@ auto realize_path_at_rev(const std::string& rev, const std::string& attr)
 auto realize_flake_source(const std::string& flake_ref)
     -> util::Result<std::string>;
 
+struct PrefetchedSource {
+    std::string store_path;
+    std::string hash;        // SRI form, e.g. "sha256-<base64>"
+};
+
+// Same as realize_flake_source but also returns the SRI hash so the
+// caller can persist it in a lockfile and feed it to `pkgs.fetchgit`
+// as a fixed-output derivation pin. Used by cargoxx-git deps.
+auto prefetch_flake_source(const std::string& flake_ref)
+    -> util::Result<PrefetchedSource>;
+
 // One CMake config-file's IMPORTED targets together with the find_package
 // expression derived from its filename stem.
 struct NixCmakeCandidate {

tests/cmd_build.cpp

@@ -69,7 +69,7 @@ TEST_CASE("cmd_build generates files for a no-deps binary project",
     REQUIRE(std::filesystem::exists(root / "Cargoxx.lock"));
 
     auto cmake_text = read_file(root / "build" / "CMakeLists.txt");
-    REQUIRE(cmake_text.find("project(hello LANGUAGES CXX)") != std::string::npos);
+    REQUIRE(cmake_text.find("project(hello VERSION 0.1.0 LANGUAGES CXX)") != std::string::npos);
     REQUIRE(cmake_text.find("add_executable(hello_bin ../src/main.cpp)") !=
             std::string::npos);
 

tests/codegen_cmake.cpp

@@ -72,10 +72,15 @@ TEST_CASE("cmake_lists for a binary-only project", "[codegen][cmake]") {
     GenerateInputs in{m, layout, lock, {}, {}, ROOT};
 
     auto out = cmake_lists(in);
-    REQUIRE(out.find("project(hello LANGUAGES CXX)") != std::string::npos);
+    REQUIRE(out.find("project(hello VERSION 0.1.0 LANGUAGES CXX)") != std::string::npos);
+    REQUIRE(out.find("include(GNUInstallDirs)") != std::string::npos);
     REQUIRE(out.find("set(CMAKE_CXX_STANDARD 23)") != std::string::npos);
     REQUIRE(out.find("add_executable(hello_bin ../src/main.cpp)") != std::string::npos);
-    REQUIRE(out.find("set_target_properties(hello_bin PROPERTIES OUTPUT_NAME hello)") !=
+    REQUIRE(out.find("set_target_properties(hello_bin PROPERTIES\n"
+                     "    OUTPUT_NAME hello\n"
+                     "    RUNTIME_OUTPUT_DIRECTORY \"${CMAKE_BINARY_DIR}/bin\")") !=
+            std::string::npos);
+    REQUIRE(out.find("install(TARGETS hello_bin RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})") !=
             std::string::npos);
     REQUIRE(out.find("add_library") == std::string::npos);
     REQUIRE(out.find("enable_testing") == std::string::npos);
@@ -98,6 +103,15 @@ TEST_CASE("cmake_lists for a library-only project", "[codegen][cmake]") {
     REQUIRE(out.find("FILE_SET CXX_MODULES") != std::string::npos);
     REQUIRE(out.find("../src/lib.cppm") != std::string::npos);
     REQUIRE(out.find("add_executable") == std::string::npos);
+    // Library projects emit install rules + Config.cmake + .pc.
+    REQUIRE(out.find("install(TARGETS widget\n        EXPORT widgetTargets") !=
+            std::string::npos);
+    REQUIRE(out.find("install(EXPORT widgetTargets") != std::string::npos);
+    REQUIRE(out.find("configure_package_config_file(") != std::string::npos);
+    REQUIRE(out.find("write_basic_package_version_file(") != std::string::npos);
+    REQUIRE(out.find("widget.pc.in") != std::string::npos);
+    REQUIRE(out.find("DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig") !=
+            std::string::npos);
 }
 
 TEST_CASE("cmake_lists wires up library + primary binary", "[codegen][cmake]") {
@@ -138,6 +152,13 @@ TEST_CASE("cmake_lists emits extra binaries from src/bin/", "[codegen][cmake]")
     auto out = cmake_lists(in);
     REQUIRE(out.find("add_executable(app_bin ../src/main.cpp)") != std::string::npos);
     REQUIRE(out.find("add_executable(tool ../src/bin/tool.cpp)") != std::string::npos);
+    REQUIRE(out.find("set_target_properties(app_bin PROPERTIES\n"
+                     "    OUTPUT_NAME app\n"
+                     "    RUNTIME_OUTPUT_DIRECTORY \"${CMAKE_BINARY_DIR}/bin\")") !=
+            std::string::npos);
+    REQUIRE(out.find("set_target_properties(tool PROPERTIES\n"
+                     "    RUNTIME_OUTPUT_DIRECTORY \"${CMAKE_BINARY_DIR}/bin\")") !=
+            std::string::npos);
 }
 
 TEST_CASE("cmake_lists emits tests with add_test", "[codegen][cmake]") {

tests/e2e/buildCppPackage/src/bin/extra.cpp

@@ -0,0 +1,8 @@
+#include <nlohmann/json.hpp>
+import std;
+int main() {
+    nlohmann::json j;
+    j["from"] = "extra";
+    std::println("{}", j["from"].get<std::string>());
+    return 0;
+}

tests/e2e/pathDep/Cargoxx.toml

@@ -0,0 +1,7 @@
+[package]
+name = "consumer"
+version = "0.1.0"
+edition = "cpp23"
+
+[dependencies]
+greeter = { path = "./greeter" }

tests/e2e/pathDep/flake.nix

@@ -0,0 +1,10 @@
+{
+  description = "e2e cargoxx path-dep smoke";
+
+  inputs.cargoxx.url = "path:../../..";
+
+  outputs = { self, cargoxx }: {
+    packages.x86_64-linux.default =
+      cargoxx.lib.x86_64-linux.buildCppPackage { src = ./.; };
+  };
+}

tests/e2e/pathDep/greeter/Cargoxx.toml

@@ -0,0 +1,4 @@
+[package]
+name = "greeter"
+version = "0.1.0"
+edition = "cpp23"

tests/e2e/pathDep/greeter/src/lib.cppm

@@ -0,0 +1,8 @@
+export module greeter;
+import std;
+
+export namespace greeter {
+auto hello(std::string_view who) -> std::string {
+    return std::format("Hello from greeter, {}!", who);
+}
+} // namespace greeter

tests/e2e/pathDep/run.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo="$(cd "${here}/../../.." && pwd)"
+cargoxx_bin="${CARGOXX_BIN:-${repo}/build/debug/cargoxx}"
+
+if [[ ! -x "${cargoxx_bin}" ]]; then
+    echo "error: cargoxx binary not found at ${cargoxx_bin}" >&2
+    echo "build it first: nix develop --command cmake --build build/debug" >&2
+    exit 1
+fi
+
+work="$(mktemp -d -t cargoxx-e2e-pathdep-XXXXXX)"
+trap 'rm -rf "${work}"' EXIT
+
+cp -r "${here}/." "${work}/"
+sed -i "s|path:\\.\\./\\.\\./\\.\\.|path:${repo}|" "${work}/flake.nix"
+
+cd "${work}"
+
+echo "=== cargoxx build --no-build in greeter (path dep generates its own lock)"
+(cd greeter && "${cargoxx_bin}" build --no-build)
+
+echo "=== cargoxx build --no-build in consumer"
+"${cargoxx_bin}" build --no-build
+
+[[ -f Cargoxx.lock ]] || { echo "Cargoxx.lock missing"; exit 1; }
+grep -q "source_kind = 'cargoxx-path'" Cargoxx.lock || \
+    { echo "Cargoxx.lock missing source_kind = cargoxx-path"; exit 1; }
+
+# nix build needs the source tree to be a git tree so 'path:' input copies
+# Cargoxx.lock into the store. Init a throwaway git here.
+git init -q
+git add -A
+git -c user.email=e2e@cargoxx -c user.name=e2e commit -q -m fixture
+
+echo "=== nix build .#default"
+out="$(nix build .#default --no-link --print-out-paths \
+    --extra-experimental-features 'nix-command flakes')"
+
+[[ -n "${out}" ]] || { echo "nix build produced no output path"; exit 1; }
+[[ -x "${out}/bin/consumer" ]] || { echo "missing ${out}/bin/consumer"; exit 1; }
+
+echo "=== execute"
+"${out}/bin/consumer"
+
+echo "ok"

tests/e2e/pathDep/src/main.cpp

@@ -0,0 +1,7 @@
+import std;
+import greeter;
+
+int main() {
+    std::println("{}", greeter::hello("world"));
+    return 0;
+}

tests/layout_discovery.cpp

@@ -131,16 +131,31 @@ TEST_CASE("discover lists src/bin/*.cpp as additional binaries", "[layout]") {
     REQUIRE(r->binaries[2].name == "pkg");
 }
 
-TEST_CASE("discover does not recurse into src/bin/", "[layout]") {
+TEST_CASE("discover ignores src/bin/<sub>/ subdirs without main.cpp", "[layout]") {
     TempProject p;
     p.touch("src/main.cpp");
     p.touch("src/bin/foo.cpp");
-    p.touch("src/bin/sub/nested.cpp"); // should be ignored
+    p.touch("src/bin/sub/nested.cpp"); // no main.cpp at sub/ root, ignored
     auto r = discover(p.root(), "pkg");
     REQUIRE(r.has_value());
     REQUIRE(r->binaries.size() == 2);
 }
 
+TEST_CASE("discover lists src/bin/<sub>/main.cpp as a binary named <sub>",
+           "[layout]") {
+    TempProject p;
+    p.touch("src/main.cpp");
+    p.touch("src/bin/extra/main.cpp");
+    p.touch("src/bin/extra/helpers.cpp"); // not collected in v1
+    auto r = discover(p.root(), "pkg");
+    REQUIRE(r.has_value());
+    REQUIRE(r->binaries.size() == 2);
+    REQUIRE(r->binaries[0].name == "extra");
+    REQUIRE(r->binaries[0].entry.filename() == "main.cpp");
+    REQUIRE(r->binaries[0].entry.parent_path().filename() == "extra");
+    REQUIRE(r->binaries[1].name == "pkg");
+}
+
 TEST_CASE("discover lists tests/*.cpp", "[layout]") {
     TempProject p;
     p.touch("src/main.cpp");

tests/lockfile_round_trip.cpp

@@ -118,6 +118,57 @@ TEST_CASE("write round-trips lockfile recipe fields", "[lockfile]") {
     REQUIRE(round_trip(l) == l);
 }
 
+TEST_CASE("write round-trips cargoxx-path source fields", "[lockfile]") {
+    Lockfile l{
+        .version = 1,
+        .packages = {
+            LockfilePackage{
+                .name = "mylib",
+                .version = "*",
+                .dependencies = {},
+                .nixpkgs_attr = std::nullopt,
+                .nixpkgs_rev = std::nullopt,
+                .linkdb_source = "cargoxx-path",
+                .find_package = "mylib CONFIG REQUIRED",
+                .targets = {"mylib::mylib"},
+                .pkg_config_module = std::nullopt,
+                .brute_force_libs = {},
+                .brute_force_includes = {},
+                .source_kind = "cargoxx-path",
+                .source_path = "../mylib",
+            },
+        },
+    };
+    REQUIRE(round_trip(l) == l);
+}
+
+TEST_CASE("write round-trips cargoxx-git source fields", "[lockfile]") {
+    Lockfile l{
+        .version = 1,
+        .packages = {
+            LockfilePackage{
+                .name = "mylib",
+                .version = "*",
+                .dependencies = {},
+                .nixpkgs_attr = std::nullopt,
+                .nixpkgs_rev = std::nullopt,
+                .linkdb_source = "cargoxx-git",
+                .find_package = "mylib CONFIG REQUIRED",
+                .targets = {"mylib::mylib"},
+                .pkg_config_module = std::nullopt,
+                .brute_force_libs = {},
+                .brute_force_includes = {},
+                .source_kind = "cargoxx-git",
+                .source_path = std::nullopt,
+                .source_git_url = "https://gitea.example/me/mylib",
+                .source_git_commit = "0123456789012345678901234567890123456789",
+                .source_git_sha256 = "sha256-abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123=",
+            },
+        },
+    };
+    REQUIRE(round_trip(l) == l);
+}
+
 TEST_CASE("Lockfile::nixpkgs_rev returns the shared rev", "[lockfile]") {
     Lockfile l{
         .version = 1,

tests/manifest_parse.cpp

@@ -297,3 +297,79 @@ version = "0.1.0"
     REQUIRE_FALSE(r.has_value());
     REQUIRE(r.error().code == ErrorCode::ManifestInvalidField);
 }
+
+TEST_CASE("parse recognizes { path = \"...\" } as a cargoxx path dep",
+           "[manifest][parse]") {
+    auto p = write_manifest(R"(
+[package]
+name = "consumer"
+version = "0.1.0"
+edition = "cpp23"
+
+[dependencies]
+mylib = { path = "../mylib" }
+)");
+    auto r = parse(p);
+    REQUIRE(r.has_value());
+    REQUIRE(r->dependencies.size() == 1);
+    const auto& dep = r->dependencies[0];
+    REQUIRE(dep.name == "mylib");
+    REQUIRE(dep.source == cargoxx::manifest::DepSource::CargoxxPath);
+    REQUIRE(dep.path.has_value());
+    REQUIRE(*dep.path == "../mylib");
+    // Version defaults to "*" when only `path` is given.
+    REQUIRE(dep.version_spec == "*");
+}
+
+TEST_CASE("parse rejects dep table without version or path",
+           "[manifest][parse]") {
+    auto p = write_manifest(R"(
+[package]
+name = "consumer"
+version = "0.1.0"
+edition = "cpp23"
+
+[dependencies]
+mylib = { components = ["a"] }
+)");
+    auto r = parse(p);
+    REQUIRE_FALSE(r.has_value());
+    REQUIRE(r.error().code == ErrorCode::ManifestInvalidField);
+}
+
+TEST_CASE("parse recognizes { git = \"...\", rev = \"...\" } as a cargoxx git dep",
+           "[manifest][parse]") {
+    auto p = write_manifest(R"(
+[package]
+name = "consumer"
+version = "0.1.0"
+edition = "cpp23"
+
+[dependencies]
+mylib = { git = "https://gitea.example/me/mylib", rev = "0123456789012345678901234567890123456789" }
+)");
+    auto r = parse(p);
+    REQUIRE(r.has_value());
+    REQUIRE(r->dependencies.size() == 1);
+    const auto& dep = r->dependencies[0];
+    REQUIRE(dep.name == "mylib");
+    REQUIRE(dep.source == cargoxx::manifest::DepSource::CargoxxGit);
+    REQUIRE(dep.git_url == "https://gitea.example/me/mylib");
+    REQUIRE(dep.git_rev == "0123456789012345678901234567890123456789");
+    REQUIRE(dep.version_spec == "*");
+}
+
+TEST_CASE("parse rejects git dep without rev", "[manifest][parse]") {
+    auto p = write_manifest(R"(
+[package]
+name = "consumer"
+version = "0.1.0"
+edition = "cpp23"
+
+[dependencies]
+mylib = { git = "https://gitea.example/me/mylib" }
+)");
+    auto r = parse(p);
+    REQUIRE_FALSE(r.has_value());
+    REQUIRE(r.error().code == ErrorCode::ManifestInvalidField);
+}