@dbx-tools/projen 0.1.1 → 0.3.43

package/src/watch.ts

@@ -0,0 +1,107 @@
+/**
+ * Generic file-watch utility shared by the `sync --watch` task watchers.
+ *
+ * `watchLoop` wraps `@dbx-tools/path`'s chokidar watcher with the
+ * behavior every dbx-tools watcher wants: it debounces bursts, serializes runs (a
+ * change mid-run re-runs once afterwards), drops generated paths (barrels/manifests/
+ * decls - reacting to our own output would loop), and shuts down on SIGINT. Callers
+ * pass the paths to watch and an `onBatch` handler; the concern-specific glue - which
+ * barrels to rebuild, when to regenerate openapi, when to re-synth - lives in the task
+ * that owns it (`tasks/barrels.ts`, `tasks/openapi.ts`, `tasks/projenrc.ts`), each
+ * forwarding here rather than duplicating the watch machinery.
+ *
+ * `watchRoots()` is the one shared input - the package roots where every
+ * watchable source file lives - so the barrels and openapi watchers don't each
+ * recompute it. {@link watchFiles} owns the chokidar wiring; this is thin glue.
+ */
+import { isAbsolute, resolve } from "node:path";
+import { watch as fileScan } from "@dbx-tools/path";
+import { log } from "@dbx-tools/shared-core";
+import { isGeneratedFile, recordedRoots, repoRoot } from "./packages";
+
+const logger = log.logger("projen:watch");
+const DEBOUNCE_MS = 250;
+
+/** node-path's built-in ignore-group toggles (`{ dot, temp, test, lock, defaults }`). */
+export type IgnoreGroupOptions = NonNullable<
+  Parameters<typeof fileScan.watchFiles>[1]
+>["ignoreOptions"];
+
+/** The package roots (absolute), where every watchable source file lives. */
+export function watchRoots(): string[] {
+  return recordedRoots().map((r) => resolve(repoRoot, r));
+}
+
+/**
+ * Generated paths (barrels, manifests, tsconfigs, decls) must never drive a watch -
+ * they change *because* we generate, so reacting would loop.
+ */
+function ignoredPath(path: string): boolean {
+  const abs = isAbsolute(path) ? path : resolve(repoRoot, path);
+  return isGeneratedFile(abs);
+}
+
+/**
+ * Shared debounce/flush machinery backed by `watchFiles`. Watches `paths` and, on
+ * each debounced batch of non-generated changes, calls `onBatch` with the absolute
+ * changed paths. Runs are serialized (a change during a run re-runs once afterwards);
+ * watches until SIGINT.
+ *
+ * `ignoreOptions` toggles node-path's built-in ignore groups for this watcher only
+ * (e.g. the projenrc watcher passes `{ dot: false }` so its lone dotfile target,
+ * `.projenrc.ts`, isn't pruned by the default dotfile group and left with nothing to
+ * watch - which would let the process exit immediately).
+ */
+export function watchLoop(
+  tag: string,
+  paths: string[],
+  onBatch: (changed: string[]) => void | Promise<void>,
+  ignoreOptions?: IgnoreGroupOptions,
+): void {
+  const pending = new Set<string>();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let running = false;
+  let rerun = false;
+
+  async function flush(): Promise<void> {
+    if (running) {
+      rerun = true;
+      return;
+    }
+    running = true;
+    const relevant = [...pending]
+      .map((p) => (isAbsolute(p) ? p : resolve(repoRoot, p)))
+      .filter((p) => !ignoredPath(p));
+    pending.clear();
+    try {
+      if (relevant.length) await onBatch(relevant);
+    } catch (err) {
+      logger.error(`${tag} cycle failed:`, err instanceof Error ? err.message : err);
+    } finally {
+      running = false;
+      if (rerun) {
+        rerun = false;
+        setTimeout(() => void flush(), 0);
+      }
+    }
+  }
+
+  const watcher = fileScan.watchFiles(paths, {
+    cwd: repoRoot,
+    ignoreInitial: true,
+    ignore: (path) => ignoredPath(path),
+    ignoreOptions,
+  });
+  watcher.on("all", (_event, path) => {
+    pending.add(path);
+    clearTimeout(timer);
+    timer = setTimeout(() => void flush(), DEBOUNCE_MS);
+  });
+  watcher.on("error", (err) => logger.error(`${tag} watcher error:`, err));
+  watcher.on("ready", () => logger.info(`${tag}: watching for changes … (Ctrl-C to stop)`));
+
+  process.on("SIGINT", () => {
+    void watcher.close();
+    process.exit(0);
+  });
+}

package/tasks/barrels.ts

@@ -3,7 +3,7 @@ import { sep } from "node:path";
 import { generateBarrels } from "../src/barrels";
 import { log, string } from "@dbx-tools/shared-core";
 import { watchLoop, watchRoots } from "../src/watch";
-import { workspacePackages } from "../src/workspace";
+import { recordedPackages } from "../src/packages";
 
 const logger = log.logger("projen:barrels");
 
@@ -17,7 +17,7 @@ if (process.argv.includes("--watch")) {
   // package's `index.ts` barrel (no re-synth - the projenrc watcher owns that).
   // watchLoop already drops generated paths, so a barrel write never re-triggers us.
   watchLoop("barrels", watchRoots(), (changed) => {
-    const pkgDirs = workspacePackages().map((p) => p.dir);
+    const pkgDirs = recordedPackages().map((p) => p.dir);
     const dirs = new Set<string>();
     for (const p of changed) {
       const owner = ownerPackageDir(p, pkgDirs);

package/tasks/bump.ts

@@ -0,0 +1,340 @@
+#!/usr/bin/env -S npx tsx
+/**
+ * `projen bump` - synth, compute the next release version, then (by default)
+ * commit, tag, and push it. Pushing the tag is what triggers the release
+ * workflow.
+ *
+ * The next version is derived from the HIGHEST of:
+ *   - the latest published git tag matching `<prefix><semver>` (fetched from
+ *     the remote so a release made elsewhere is respected),
+ *   - the same for every `--sibling` prefix, and
+ *   - the local `package.json` version,
+ * then incremented by `--level` (patch | minor | major; default patch).
+ *
+ * `--sibling <dir>:<tagPrefix>` (repeatable) releases a standalone in-repo
+ * project - one that is NOT a pnpm workspace member, so `pnpm -r` cannot see it -
+ * at the SAME version as the root, in the same run: its manifest is stamped, its
+ * `<tagPrefix><version>` tag is cut and pushed (triggering its own workflow), and
+ * it is included in the local-registry publish. Taking the base version from
+ * every prefix at once is what keeps the two in lockstep: the engine sat at
+ * 0.1.24 while the packages reached 0.3.41 precisely because each namespace only
+ * ever looked at its own tags.
+ *
+ * Flags (all default ON; negate with the `--no-` form, per commander):
+ *   --synth   / --no-synth     run `projen` (synth) first so the tree is current
+ *   --version / --no-version   write the bumped version into package.json
+ *   --commit  / --no-commit    commit the release (staged with `git add -A`)
+ *   --tag     / --no-tag       create the `<prefix><version>` git tag
+ *   --push    / --no-push      push the CURRENT branch + tag to origin
+ *
+ * `--publish` / `--no-publish` is an alias for `--push` (pushing the tag is
+ * what publishes). The tag prefix comes from `--prefix` (default `v`).
+ *
+ * `--local-registry <value>` publishes the just-tagged version to a LOCAL
+ * registry (e.g. a verdaccio) right after the git tag is pushed - so a local
+ * `pnpm run bump` both fires the GitHub release (public npm) and populates your
+ * local registry. Values:
+ *   - `auto` (default): publish only when `npm config get registry` is a
+ *     loopback host (`localhost` / `127.0.0.0/8` / `::1`); otherwise skip.
+ *   - `false`: never publish locally.
+ *   - a URL: always publish to that registry.
+ */
+import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { Command, Option } from "commander";
+import { exec, project } from "@dbx-tools/core";
+import { log, net } from "@dbx-tools/shared-core";
+
+const logger = log.logger("projen:bump");
+const LEVELS = ["patch", "minor", "major"] as const;
+type Level = (typeof LEVELS)[number];
+
+/** A standalone in-repo project released alongside the root, on its own tag prefix. */
+interface Sibling {
+  /** Repo-relative directory, e.g. `projen`. */
+  readonly dir: string;
+  /** Git tag prefix, disjoint from the root's, e.g. `projen-v`. */
+  readonly prefix: string;
+}
+
+/**
+ * Commander collector for the repeatable `--sibling <dir>:<tagPrefix>`. Split on
+ * the LAST colon so a directory containing one still parses.
+ */
+function parseSibling(value: string, previous: Sibling[]): Sibling[] {
+  const at = value.lastIndexOf(":");
+  if (at <= 0 || at === value.length - 1) {
+    throw new Error(`--sibling expects <dir>:<tagPrefix>, got "${value}"`);
+  }
+  return [...previous, { dir: value.slice(0, at), prefix: value.slice(at + 1) }];
+}
+
+/** Parse `x.y.z` (ignoring any leading `v`/prefix), returning a `[maj,min,pat]` tuple. */
+function parseSemver(raw: string): [number, number, number] | undefined {
+  const m = /(\d+)\.(\d+)\.(\d+)/.exec(raw.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : undefined;
+}
+
+function compareSemver(a: [number, number, number], b: [number, number, number]): number {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+
+function increment(v: [number, number, number], level: Level): [number, number, number] {
+  if (level === "major") return [v[0] + 1, 0, 0];
+  if (level === "minor") return [v[0], v[1] + 1, 0];
+  return [v[0], v[1], v[2] + 1];
+}
+
+function git(args: string[], capture = false): string {
+  const res = exec.spawnSync("git", args, {
+    cwd: process.cwd(),
+    stdout: capture ? "capture" : "inherit",
+    stderr: capture ? "ignore" : "inherit",
+    stdin: "ignore",
+    check: !capture,
+  });
+  return res.stdout?.trim() ?? "";
+}
+
+/** Highest tag matching `<prefix><semver>`, or undefined. Call {@link fetchTags} first. */
+function latestTagVersion(prefix: string): [number, number, number] | undefined {
+  const out = git(
+    ["-c", "versionsort.suffix=-", "tag", "--sort=-version:refname", "--list", `${prefix}*`],
+    true,
+  );
+  for (const tag of out.split("\n")) {
+    const v = parseSemver(tag.replace(prefix, ""));
+    if (v) return v;
+  }
+  return undefined;
+}
+
+/** Pull remote tags once, so a release made elsewhere is respected. */
+function fetchTags(): void {
+  git(["fetch", "--tags", "--quiet"], true);
+}
+
+function readPackageVersion(pkgPath: string): [number, number, number] {
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { version?: string };
+  return parseSemver(pkg.version ?? "") ?? [0, 0, 0];
+}
+
+/**
+ * Write `version` into a manifest projen owns. Those are emitted read-only, so
+ * the write is bracketed by a chmod; the mode is restored afterwards to leave the
+ * tree exactly as synth left it.
+ */
+function writeManifestVersion(pkgPath: string, version: string): void {
+  const { mode } = statSync(pkgPath);
+  chmodSync(pkgPath, mode | 0o200);
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as Record<string, unknown>;
+    pkg.version = version;
+    writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+  } finally {
+    chmodSync(pkgPath, mode);
+  }
+}
+
+/**
+ * Resolve the `--local-registry` value to a registry URL to publish to, or
+ * `undefined` to skip. `false` skips; a URL is used as-is; `auto` uses the
+ * active npm registry only when it is a loopback host (a local verdaccio etc.).
+ */
+function resolveLocalRegistry(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.toLowerCase() === "false") return undefined;
+  if (trimmed.toLowerCase() === "auto") {
+    const registry = project.npmRegistry();
+    return registry && net.isLoopbackHost(registry) ? registry.href : undefined;
+  }
+  return trimmed;
+}
+
+const program = new Command();
+program
+  .description("Bump the release version, then commit, tag, and push it")
+  .addOption(
+    new Option("-l, --level <level>", "semver increment").choices([...LEVELS]).default("patch"),
+  )
+  .option("--prefix <prefix>", "git tag prefix", "v")
+  .option(
+    "--sibling <dir:prefix>",
+    "standalone in-repo project (not a workspace member) to release at the same version, repeatable",
+    parseSibling,
+    [] as Sibling[],
+  )
+  // Declared in the `--no-` form so commander creates a boolean that defaults to
+  // `true` and is turned off by `--no-synth` / `--no-version` / ... (the
+  // positive `--synth` etc. also work and are no-ops on the default).
+  .option("--no-synth", "do not run `projen` (synth) before bumping")
+  .option("--no-version", "do not write the bumped version into package.json")
+  .option("--no-commit", "do not commit the version change")
+  .option("--no-tag", "do not create the git tag")
+  .option("--no-push", "do not push the branch and tag to origin")
+  // `--publish` is a friendlier alias for `--push` (pushing the tag publishes).
+  .option("--no-publish", "alias for --no-push")
+  .option(
+    "--local-registry <value>",
+    "publish locally after the tag push: 'auto' (only a loopback npm registry), 'false', or a registry URL",
+    "auto",
+  )
+  .action(
+    (opts: {
+      level: Level;
+      prefix: string;
+      sibling: Sibling[];
+      synth: boolean;
+      version: boolean;
+      commit: boolean;
+      tag: boolean;
+      push: boolean;
+      publish: boolean;
+      localRegistry: string;
+    }) => {
+      const pkgPath = resolve(process.cwd(), "package.json");
+      if (!existsSync(pkgPath)) throw new Error(`no package.json in ${process.cwd()}`);
+
+      const siblings = opts.sibling.map((s) => ({ ...s, pkgPath: resolve(s.dir, "package.json") }));
+      for (const s of siblings) {
+        if (!existsSync(s.pkgPath)) throw new Error(`--sibling ${s.dir}: no package.json there`);
+      }
+
+      // Synth first so the release commit captures an up-to-date tree (generated
+      // manifests, workspace file, tasks, ...) rather than a stale one.
+      if (opts.synth) {
+        logger.info("synthesizing (projen)");
+        exec.spawnSync("pnpm", ["exec", "projen"], {
+          cwd: process.cwd(),
+          stdout: "inherit",
+          stderr: "inherit",
+          stdin: "ignore",
+          check: true,
+        });
+      }
+
+      // Base = highest of the local package version and the latest tag in EVERY
+      // namespace being released, so one shared version stays ahead of them all.
+      fetchTags();
+      const prefixes = [opts.prefix, ...siblings.map((s) => s.prefix)];
+      const tagged = prefixes
+        .map((prefix) => ({ prefix, version: latestTagVersion(prefix) }))
+        .filter((t): t is { prefix: string; version: [number, number, number] } => !!t.version);
+      const base = tagged.reduce(
+        (highest, t) => (compareSemver(t.version, highest) > 0 ? t.version : highest),
+        readPackageVersion(pkgPath),
+      );
+      const next = increment(base, opts.level);
+      const version = next.join(".");
+      const tags = prefixes.map((prefix) => `${prefix}${version}`);
+      logger.info(
+        `bump ${base.join(".")} -> ${version} (${opts.level}); tags ${tags.join(", ")}` +
+          `${tagged.length ? "" : " [no remote tag]"}`,
+      );
+      for (const t of tagged) {
+        if (compareSemver(t.version, base) < 0) {
+          logger.info(`${t.prefix}* was behind at ${t.version.join(".")}, catching it up`);
+        }
+      }
+
+      const push = opts.push && opts.publish;
+
+      if (opts.version) {
+        writeManifestVersion(pkgPath, version);
+        for (const s of siblings) writeManifestVersion(s.pkgPath, version);
+        const also = siblings.length ? ` (and ${siblings.map((s) => s.dir).join(", ")})` : "";
+        logger.info(`wrote version ${version} to package.json${also}`);
+      }
+
+      if (opts.commit) {
+        // Stage the whole tree so the release commit captures the version bump
+        // plus anything synth regenerated. Skip the commit when nothing changed.
+        git(["add", "-A"]);
+        const staged = git(["diff", "--cached", "--name-only"], true);
+        if (staged) git(["commit", "-m", `chore(release): ${version}`]);
+        else logger.info("nothing to commit");
+      }
+
+      if (opts.tag) {
+        for (const t of tags) git(["tag", "-a", t, "-m", t]);
+        logger.info(`tagged ${tags.join(", ")}`);
+      }
+
+      if (push) {
+        git(["push", "origin", "HEAD"]);
+        // Push every tag in ONE invocation: each push triggers a workflow, and a
+        // partial push would release half the set at this version.
+        if (opts.tag) git(["push", "origin", ...tags]);
+        logger.success(`pushed ${opts.tag ? tags.join(", ") : "HEAD"} to origin`);
+      } else {
+        logger.info("skipped push (--no-push / --no-publish)");
+      }
+
+      // Local registry (e.g. verdaccio): publish AFTER the tag push so the
+      // GitHub release still owns the public registry. Skipped under
+      // `--no-version` (nothing bumped to publish).
+      const localRegistry = resolveLocalRegistry(opts.localRegistry);
+      const publishToLocalRegistry = opts.version && localRegistry;
+      if (opts.version === false && localRegistry) {
+        logger.info("skipped local publish (--no-version left package.json unbumped)");
+      }
+      if (publishToLocalRegistry) {
+        logger.info(`publishing ${version} to local registry ${localRegistry}`);
+        const runIn = (cwd: string, command: string, args: string[]) =>
+          exec.spawnSync(command, args, {
+            cwd,
+            stdout: "inherit",
+            stderr: "inherit",
+            stdin: "ignore",
+            check: true,
+          });
+        const runInRepo = (command: string, args: string[]) =>
+          runIn(process.cwd(), command, args);
+        // Each package keeps `version: 0.0.0` on disk (projen owns the
+        // manifest); the root bump above only touched the root. Mirror the CI
+        // `release` workflow: stamp the release version on EVERY package (they're
+        // projen-readonly, so unlock first) so `pnpm -r publish` publishes them
+        // as `version` (and rewrites `workspace:*` sibling pins to it) instead of
+        // `0.0.0`. No restore needed - the next `projen` synth rewrites these
+        // manifests back to `0.0.0`; the release version lives in the git tag.
+        runInRepo("chmod", ["-R", "u+w", "."]);
+        runInRepo("pnpm", [
+          "-r",
+          "exec",
+          "npm",
+          "version",
+          version,
+          "--no-git-tag-version",
+          "--allow-same-version",
+        ]);
+        // Provenance is opt-in (see `.projenrc.ts`): the generated
+        // `publishConfig` omits it, so local (verdaccio) publishes never try to
+        // attest. CI turns it on with `npm_config_provenance=true`.
+        runInRepo("pnpm", [
+          "-r",
+          "publish",
+          "--registry",
+          localRegistry,
+          "--no-git-checks",
+          "--access",
+          "public",
+        ]);
+        // `pnpm -r` cannot see a sibling (not a workspace member), so publish each
+        // one on its own. Skipping this is what left a local registry serving a
+        // current CLI against a months-old engine.
+        for (const s of siblings) {
+          runIn(s.dir, "pnpm", [
+            "publish",
+            "--registry",
+            localRegistry,
+            "--no-git-checks",
+            "--access",
+            "public",
+          ]);
+        }
+        logger.success(`published ${version} to ${localRegistry}`);
+      }
+    },
+  );
+
+await program.parseAsync();

package/tasks/clean.ts

@@ -2,7 +2,7 @@
 import { relative } from "node:path";
 import { listGeneratedFiles, listNodeModulesDirs, removePaths } from "../src/clean";
 import { log, string } from "@dbx-tools/shared-core";
-import { repoRoot, toPosix } from "../src/workspace";
+import { repoRoot, toPosix } from "../src/packages";
 
 const logger = log.logger("projen:clean");
 const yes = process.argv.includes("-y") || process.argv.includes("--yes");

package/tasks/projenrc.ts

@@ -3,7 +3,7 @@ import { resolve } from "node:path";
 import { log } from "@dbx-tools/shared-core";
 import { runSynth } from "../src/scaffold";
 import { watchLoop } from "../src/watch";
-import { repoRoot, syncResynthPaths } from "../src/workspace";
+import { repoRoot, syncResynthPaths } from "../src/packages";
 
 const logger = log.logger("projen:projenrc");
 

package/tasks/sync.ts

@@ -6,13 +6,27 @@ import { runSynth } from "../src/scaffold";
 
 const logger = log.logger("projen:sync");
 
+/**
+ * Backoff before a crashed watcher is respawned. A watcher that dies during startup
+ * (unparseable config, a bad import) would otherwise hot-loop, so this debounces the
+ * retry into something readable while still recovering promptly once the offending
+ * file is fixed. Deliberately a flat delay rather than concurrently's `"exponential"`,
+ * whose unbounded `2^n` growth would leave a watcher dead for hours after a bad
+ * afternoon of crashes.
+ */
+const RESTART_DELAY_MS = 5_000;
+
+/** How long to let the watcher process trees die on shutdown before exiting regardless. */
+const STOP_GRACE_MS = 2_000;
+
 /** Absolute path to a sibling task script, so `concurrently`'s cwd doesn't matter. */
 function taskPath(script: string): string {
   return fileURLToPath(new URL(`./${script}`, import.meta.url));
 }
 
 if (!process.argv.includes("--watch")) {
-  // One-shot: full synth (+install + barrels via the post-synth component).
+  // One-shot: full synth (+install + barrels via the post-synth component). This is
+  // the scriptable path, so a failed synth stays a failed exit code.
   logger.start("synthesizing");
   runSynth({ post: true });
   logger.success("synced");
@@ -22,16 +36,66 @@ if (!process.argv.includes("--watch")) {
   // for stock `projen --watch` - it re-synths (+install) ONLY when `.projenrc.ts` or
   // a configured `syncResynthPaths` entry changes, while barrels/openapi keep generated
   // OUTPUT fresh on source edits with no full synth.
+  //
+  // VS Code auto-runs this on folder open, so from here down nothing is allowed to be
+  // fatal: errors are logged and retried, and only a stop signal ends the task.
   logger.start("initial sync");
-  runSynth({ post: true });
-  logger.success("synced - watching (Ctrl-C to stop)");
+  try {
+    runSynth({ post: true });
+    logger.success("synced - watching (Ctrl-C to stop)");
+  } catch (err) {
+    // A tree that doesn't synth is precisely when the watcher is most useful: the edit
+    // that repairs it is the one the projenrc watcher is sitting there waiting for.
+    logger.error(
+      "initial sync failed - watching anyway:",
+      err instanceof Error ? err.message : err,
+    );
+  }
+
   const { result } = concurrently(
     [
       { command: `tsx "${taskPath("projenrc.ts")}"`, name: "projenrc", prefixColor: "magenta" },
       { command: `tsx "${taskPath("barrels.ts")}" --watch`, name: "barrels", prefixColor: "cyan" },
       { command: `tsx "${taskPath("openapi.ts")}" --watch`, name: "openapi", prefixColor: "green" },
     ],
-    { prefix: "name", killOthersOn: ["failure"] },
+    {
+      prefix: "name",
+      // No `killOthersOn`: one watcher falling over is no reason to tear the other two
+      // down. `-1` is concurrently's spelling for "restart forever", so a crashed
+      // watcher comes back instead of silently leaving its outputs stale.
+      restartTries: -1,
+      restartDelay: RESTART_DELAY_MS,
+    },
   );
-  await result.catch(() => process.exit(1));
+
+  let stopping = false;
+
+  /**
+   * Wind the watchers down for good.
+   *
+   * Restarting forever means an ordinary SIGTERM would be answered by respawning every
+   * watcher, so the task has to opt out explicitly. SIGINT is the one signal concurrently
+   * neutralizes - it rewrites that exit to 0 before the restart controller sees it - so
+   * re-emitting it is how we say "stop" in a language the supervisor understands.
+   *
+   * Killing is asynchronous (concurrently shells out to `ps` to walk each process tree)
+   * and can outlive `result`, which is how a plain SIGTERM used to leave orphaned
+   * watchers behind. The timer holds the process open until the kills land, and doubles
+   * as the backstop that leaves anyway if one of them wedges.
+   */
+  function stop(): void {
+    if (stopping) return;
+    stopping = true;
+    process.emit("SIGINT", "SIGINT");
+    setTimeout(() => process.exit(0), STOP_GRACE_MS);
+  }
+
+  // Registered after `concurrently()` so its own signal handler - the one that actually
+  // kills the children - is already in place by the time ours can fire.
+  for (const signal of ["SIGTERM", "SIGHUP"] as const) process.on(signal, stop);
+
+  // With infinite restarts this settles only once a stop signal has wound the watchers
+  // down, so there is no failure left to report. When `stop()` is driving, the pending
+  // grace timer keeps us alive past this point and owns the exit.
+  await result.catch(() => {});
 }

package/tasks/publish.ts

@@ -1,30 +0,0 @@
-#!/usr/bin/env -S npx tsx
-/**
- * Projen task entry for release (`publish`, `package`, `release:tag`).
- */
-import { Command, Option } from "commander";
-import { buildFromTag, packForRelease, publish, type BumpLevel } from "../src/publish";
-
-const INCREMENT_LEVELS = ["patch", "minor", "major"] as const;
-
-function parseIncrement(value: string): BumpLevel {
-  if ((INCREMENT_LEVELS as readonly string[]).includes(value)) return value as BumpLevel;
-  throw new Error(`invalid --increment: ${value} (expected patch, minor, or major)`);
-}
-
-const program = new Command();
-program
-  .option("--pack", "sync version and pnpm pack into dist/js (projen package task)")
-  .option("--ci", "CI: build and pack from the git tag (projen release:tag task)")
-  .addOption(
-    new Option("--increment [level]", "semver bump level")
-      .choices([...INCREMENT_LEVELS])
-      .default("patch"),
-  )
-  .action((opts: { pack?: boolean; ci?: boolean; increment: string }) => {
-    if (opts.ci) buildFromTag();
-    else if (opts.pack) packForRelease();
-    else publish(undefined, parseIncrement(opts.increment));
-  });
-
-await program.parseAsync();