@dbx-tools/projen 0.6.101 → 0.6.103

package/README.md

@@ -251,23 +251,28 @@ Every repo-wide task lives on the root, and the root's `compile` / `test`
 delegate with `bun run --filter '*'` rather than emitting a step per member - so
 a new package is covered without a re-synth. Work from the root:
 
-| Task              | What it does                                       |
-| ----------------- | -------------------------------------------------- |
-| `bun run build`   | `compile` + `test` + `package` across every member |
-| `bun run compile` | `tsc --build` in each member, in parallel          |
-| `bun run test`    | `eslint` once, then each member's tests            |
-| `bun run sync`    | re-synth (`--watch` to keep synthing)              |
-| `bun run barrels` | regenerate the read-only `index.ts` barrels        |
-| `bun run bump`    | version, tag, and publish                          |
+| Task              | What it does                                          |
+| ----------------- | ----------------------------------------------------- |
+| `bun run build`   | workspace `compile` + `test`; no root package fan-out |
+| `bun run compile` | `tsc --build` in each member, in parallel             |
+| `bun run test`    | `eslint` once, then each member's tests               |
+| `bun run sync`    | re-synth (`--watch` to keep synthing)                 |
+| `bun run barrels` | regenerate the read-only `index.ts` barrels           |
+| `bun run bump`    | version, tag, and publish                             |
 
 `bump` also mirrors a release into local registries when the active clients are
 pointed at loopback services. npm uses `npm config get registry` and publishes
-to a local Verdaccio automatically. Python prefers uv's default index and only
+to a local Verdaccio automatically. Publishable JavaScript members compile once
+from the root in parallel, then upload through a bounded pool without rerunning
+their `prepack` tasks. When synth already made the manifests and Bun workspace
+lock release-current, publishing also skips redundant version stamping and the
+lockfile reinstall. Python prefers uv's default index and only
 treats a loopback `.../+simple/` URL as writable devpi; a read-only cache such as
 proxpi (`.../index/`) is deliberately ignored. The task stamps every Python
 member and its sibling dependencies to the release version, builds the workspace
 with uv, then runs `devpi upload --from-dir` against the derived writable index.
-Devpi client authentication remains in its normal `~/.devpi` state.
+The npm and Python mirrors run concurrently because they touch disjoint package
+trees. Devpi client authentication remains in its normal `~/.devpi` state.
 
 Use `--local-registry false` or `--local-pypi false` to disable either local
 publish. An explicit `--local-pypi http://localhost:3141/user/index/` overrides
@@ -282,14 +287,19 @@ Members intentionally keep only the tasks that something OTHER than a human
 invokes, so there is no second place to run the same thing:
 
 - `compile` / `test` - what the root's `--filter '*'` delegation calls.
-- `prepack` - what `bun publish` runs per package while packing a tarball
-  (27 of 33 members; a package with nothing to pack has none).
+- `prepack` - standalone-publish safety that compiles one package before packing
+  (27 of 33 members; the workspace release driver compiles them from the root
+  and publishes with lifecycle scripts disabled).
 - `watch` - a single-package `tsc --build -w`, for narrowing a long
   edit/compile loop to one package.
-- `build` / `install` / `install:ci` / `default` / `pre-compile` /
-  `post-compile` / `package` - projen's own lifecycle scaffolding, emitted for
-  every member because projen's task model expects them. Nothing in this repo's
-  workflow calls them per member.
+- `build` / `package` - a complete compile/test/pack lifecycle when invoked in
+  one package. Root bump deliberately bypasses these and uses filtered compile
+  plus concurrent `bun publish --ignore-scripts`. The package phase also packs
+  with `--ignore-scripts` because its build already compiled; `prepack` remains
+  available for a standalone publish that did not run `build` first.
+- `install` / `install:ci` / `default` / `pre-compile` / `post-compile` -
+  projen's lifecycle scaffolding, emitted for every member because its task model
+  expects them.
 
 Do NOT run `projen default` (or `bunx projen`) from inside a member. Synth is a
 whole-tree operation driven by the ROOT `.projenrc.ts`, so a member-level run

package/package.json

@@ -26,9 +26,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.101",
-    "@dbx-tools/path": "0.6.101",
-    "@dbx-tools/shared-core": "0.6.101",
+    "@dbx-tools/core": "0.6.103",
+    "@dbx-tools/path": "0.6.103",
+    "@dbx-tools/shared-core": "0.6.103",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -47,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.101",
+  "version": "0.6.103",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-js.ts

@@ -380,13 +380,13 @@ function defaultProjectOptions(
     ...(isRoot ? {} : { npmAccess: javascript.NpmAccess.PUBLIC }),
     buildWorkflow: false,
     release: false,
-    // No `npm pack` step on any project. projen wires `package` into `build`, so
-    // `bunx projen build` would tarball all 36 manifests (root included) into
-    // gitignored `dist/js` on every CI run and never read them: publishing here
-    // is `bun publish` driving each package's own `prepack` (see
-    // {@link applyCompiledPublish} and the `publish` task), and `release: false`
-    // means no projen Publisher exists to consume the artifacts either.
-    package: false,
+    // The root build validates the whole workspace and must not also pack every
+    // member into unused `dist/js` tarballs. Child projects keep projen's package
+    // task so `bun run build` in ONE package remains a complete compile/test/pack
+    // operation. The root bump does not invoke child builds: its publish driver
+    // compiles once with filtered root tasks and packs via
+    // `bun publish --ignore-scripts` (see {@link applyCompiledPublish}).
+    ...(isRoot ? { package: false } : {}),
     jest: false,
     github: false,
     npmignoreEnabled: false,
@@ -969,6 +969,15 @@ function initProject(
 
   if (project.parent) {
     project.package.file.readonly = true;
+    // `build` already compiles before its `package` phase. Keep the package's
+    // `prepack` for standalone `bun publish`, but suppress lifecycle scripts in
+    // this generated pack step so a direct child build does not compile twice.
+    const packageStep = project.packageTask.steps.find(
+      (step) => step.execArgs?.[0] === "npm" && step.execArgs[1] === "pack",
+    );
+    if (packageStep?.execArgs && !packageStep.execArgs.includes("--ignore-scripts")) {
+      packageStep.execArgs.push("--ignore-scripts");
+    }
     // Stamp `repository` (with this package's `directory` subpath) so a published
     // package passes npm provenance validation.
     applyRepository(project, options.repository);

package/src/release.ts

@@ -18,12 +18,13 @@ const BUN_VERSION = "1.3.14";
  *
  * Bun has no `pnpm -r publish` equivalent, so this drives the engine's
  * `tasks/publish.ts` (shipped in the engine tarball, run via bun): it reads the
- * workspace members from the root `package.json`, stamps the tag version onto
- * every manifest (rewriting `@dbx-tools/*` `workspace:*` sibling deps to
- * `^<version>` so the tarballs resolve each other), then `bun publish`es each
- * non-`private` package. `bun publish` substitutes `publishConfig` (the compiled
- * `lib/` entry points) at pack time, runs `prepack` (compile) so `lib/` exists,
- * and honors `NPM_CONFIG_PROVENANCE`.
+ * workspace members from the root `package.json`, ensures manifests and the Bun
+ * lock carry the tag version so `workspace:*` siblings resolve to it, then
+ * `bun publish`es each non-`private` package. The driver compiles publishable members once from the
+ * root, then runs a bounded pool of `bun publish --ignore-scripts` calls so the
+ * already-built packages upload concurrently. It also folds `publishConfig`'s
+ * compiled `lib/` entry points into each packed manifest and honors
+ * `NPM_CONFIG_PROVENANCE`.
  *
  * Two ways in: a pushed `<prefix>*` tag (the real release - `GITHUB_REF_NAME` is
  * the version) and a manual `workflow_dispatch` (no tag, so a throwaway

package/tasks/bump.ts

@@ -179,7 +179,7 @@ program
   )
   .option("--python-root <path>", "Python workspace package root", "packages/py")
   .action(
-    (opts: {
+    async (opts: {
       level: Level;
       prefix: string;
       sibling: Sibling[];
@@ -257,8 +257,17 @@ program
         // plus anything synth regenerated. Skip the commit when nothing changed.
         git(["add", "-A"]);
         const staged = git(["diff", "--cached", "--name-only"], true);
-        if (staged) git(["commit", "-m", `chore(release): ${version}`]);
-        else logger.info("nothing to commit");
+        if (staged) {
+          git([
+            "commit",
+            "-m",
+            `chore(release): ${version}`,
+            "-m",
+            "🌸 Shipped with Kanna — https://kanna.sh",
+            "-m",
+            "Co-Authored-By: Kanna <noreply@kanna.sh>\nKanna-Agent: codex/gpt",
+          ]);
+        } else logger.info("nothing to commit");
       }
 
       if (opts.tag) {
@@ -284,32 +293,6 @@ program
       if (opts.version === false && localRegistry) {
         logger.info("skipped local publish (--no-version left package.json unbumped)");
       }
-      if (publishToLocalRegistry) {
-        logger.info(`publishing ${version} to local registry ${localRegistry}`);
-        // Mirror the CI `release` workflow via the shared publish task: it
-        // re-affirms the release version on every workspace member (`bun pm pkg
-        // set`; the manifests already carry the shared `VERSION`, projen-owned, so
-        // it unlocks each briefly), then `bun publish`es each non-private one - and
-        // bun natively strips the `workspace:`/`catalog:` protocols in the packed
-        // tarball, resolving each to that version. `publish.ts` restores every
-        // manifest it touched at exit, so this leaves the worktree matching the
-        // release commit that was just pushed. Provenance is off for a local
-        // registry (no OIDC), so `NPM_CONFIG_PROVENANCE` is unset.
-        // `publish.ts` is this task's SIBLING in the engine's `tasks/` dir; resolve
-        // it off `import.meta.url` (works whether the engine is source-linked in-repo
-        // or installed under node_modules) rather than a repo-relative `tasks/...`
-        // that only exists inside `projen/`.
-        const publishScript = fileURLToPath(new URL("./publish.ts", import.meta.url));
-        exec.spawnSync("bun", [publishScript, version, "--registry", localRegistry], {
-          cwd: process.cwd(),
-          stdout: "inherit",
-          stderr: "inherit",
-          stdin: "ignore",
-          check: true,
-        });
-        logger.success(`published ${version} to ${localRegistry}`);
-      }
-
       // Scan EVERY active index (primary index-url + every extra-index-url,
       // across uv and pip): auto-mode publishes to the first that is a loopback
       // devpi +simple, so the corp proxy stays primary and a local devpi added
@@ -328,31 +311,61 @@ program
       }
       if (opts.version === false && localPypi) {
         logger.info("skipped local Python publish (--no-version left packages unstamped)");
-      } else if (opts.version && localPypi && existsSync(pythonRoot)) {
+      }
+
+      // npm and Python touch disjoint package trees and registries. Start both
+      // mirrors together so local publishing takes the slower duration rather
+      // than the sum of both. Each child still owns its internal build/upload
+      // ordering and restores its temporary manifest edits on exit.
+      const localPublishes: Promise<unknown>[] = [];
+      if (publishToLocalRegistry) {
+        logger.info(`publishing ${version} to local registry ${localRegistry}`);
+        // The shared driver skips stamping/install when synth already made the
+        // workspace release-current, compiles publishable members once from the
+        // root, then publishes through a bounded pool. Temporary publishConfig
+        // edits are restored before this child exits.
+        const publishScript = fileURLToPath(new URL("./publish.ts", import.meta.url));
+        localPublishes.push(
+          exec
+            .spawn("bun", [publishScript, version, "--registry", localRegistry], {
+              cwd: process.cwd(),
+              stdout: "inherit",
+              stderr: "inherit",
+              stdin: "ignore",
+              check: true,
+            })
+            .then(() => logger.success(`published ${version} to ${localRegistry}`)),
+        );
+      }
+      if (opts.version && localPypi && existsSync(pythonRoot)) {
         logger.info(`publishing Python ${version} to local devpi ${localPypi.publishUrl}`);
         const publishPythonScript = fileURLToPath(new URL("./publish-python.ts", import.meta.url));
-        exec.spawnSync(
-          "bun",
-          [
-            publishPythonScript,
-            version,
-            "--root",
-            pythonRoot,
-            "--index-url",
-            localPypi.indexUrl,
-            "--publish-url",
-            localPypi.publishUrl,
-          ],
-          {
-            cwd: process.cwd(),
-            stdout: "inherit",
-            stderr: "inherit",
-            stdin: "ignore",
-            check: true,
-          },
+        localPublishes.push(
+          exec
+            .spawn(
+              "bun",
+              [
+                publishPythonScript,
+                version,
+                "--root",
+                pythonRoot,
+                "--index-url",
+                localPypi.indexUrl,
+                "--publish-url",
+                localPypi.publishUrl,
+              ],
+              {
+                cwd: process.cwd(),
+                stdout: "inherit",
+                stderr: "inherit",
+                stdin: "ignore",
+                check: true,
+              },
+            )
+            .then(() => logger.success(`published Python ${version} to ${localPypi.publishUrl}`)),
         );
-        logger.success(`published Python ${version} to ${localPypi.publishUrl}`);
       }
+      await Promise.all(localPublishes);
     },
   );
 

package/tasks/publish.ts

@@ -1,16 +1,17 @@
 #!/usr/bin/env -S bun
 /**
  * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run]`
- * - set a release version on every workspace member and publish each non-private
- * one with `bun publish`.
+ * - ensure every workspace member and the Bun lock carry the release version,
+ * then publish each non-private one with `bun publish`.
  *
  * Bun has no `pnpm -r publish`, so this loop is the recursive-publish stand-in.
  * It leans on native bun for everything bun already does:
  *
- *   - **version stamping** is `bun pm pkg set version=<version>` per member (bun's
- *     native package.json editor - idempotent, edits only that dir's manifest, no
- *     git side effects; `bun pm version` is for bumping and errors on an unchanged
- *     version, so `pkg set` is the right tool for an exact release value);
+ *   - **version stamping**, when needed, is `bun pm pkg set version=<version>`
+ *     per member (bun's native package.json editor - idempotent, edits only that
+ *     dir's manifest, no git side effects; `bun pm version` is for bumping and
+ *     errors on an unchanged version, so `pkg set` is the right tool for an exact
+ *     release value);
  *   - **`workspace:` / `catalog:` rewriting** is NOT done here - `bun publish`
  *     strips both protocols in the PACKED tarball, resolving `workspace:*` to the
  *     sibling's version and `catalog:` to the root catalog entry. (Verified: a
@@ -18,7 +19,9 @@
  *     while the on-disk manifest keeps the protocols.) Setting each member's
  *     version first is the only prerequisite, so a sibling resolves the release
  *     version; the disk manifest already carries the workspace `VERSION`, and
- *     this makes doubly sure it matches the value being published;
+ *     this makes doubly sure it matches the value being published. When every
+ *     manifest and Bun's workspace lock already carry the version, both this
+ *     stamp and the lockfile refresh are skipped;
  *   - **`publishConfig` substitution** (compiled `lib/` entry points) is done
  *     HERE, by {@link applyPublishConfig}, NOT by bun: unlike pnpm/npm, `bun
  *     publish`/`bun pm pack` do NOT fold `publishConfig`'s `main`/`types`/`bin`/
@@ -28,10 +31,13 @@
  *     its `#!/usr/bin/env node` shebang, node chokes on the `.ts`
  *     (ERR_UNKNOWN_FILE_EXTENSION). We merge `publishConfig` onto the top-level
  *     manifest before packing so the tarball advertises the compiled `lib/` tree;
- *   - the **`prepack` (compile) run** that emits that `lib/` tree is `bun
- *     publish`'s own pack behavior.
+ *   - **compiled output** is emitted once, before publishing, by one root-level
+ *     filtered `bun run` that fans out to every publishable member in parallel.
+ *     The later `bun publish --ignore-scripts` calls therefore pack the already
+ *     compiled `lib/` trees instead of serially repeating each member's
+ *     `prepack`. Packages retain their `prepack` task for standalone publishes.
  *
- * `--dry-run` forwards to `bun publish`: it packs + validates (running prepack)
+ * `--dry-run` forwards to `bun publish`: it packs + validates
  * but uploads nothing, so the `release` workflow is testable end-to-end via a
  * `workflow_dispatch` run without anything reaching npm. `--registry` targets a
  * non-default registry (a local verdaccio); `--exclude <dir>` (repeatable,
@@ -55,6 +61,7 @@ import { chmodSync, existsSync, readFileSync, rmSync, statSync, writeFileSync }
 import { dirname, join, resolve } from "node:path";
 import { exec } from "@dbx-tools/core";
 import { log } from "@dbx-tools/shared-core";
+import ts from "typescript";
 import { parse } from "yaml";
 
 const logger = log.logger("dbx-tools:publish");
@@ -95,6 +102,42 @@ function workspaceMembers(root: string): string[] {
   return (doc?.packages ?? []).map((m) => resolve(root, m));
 }
 
+/** Whether every workspace member already carries the requested release version. */
+function manifestsMatchVersion(members: readonly string[], version: string): boolean {
+  return members.every((dir) => {
+    const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
+      version?: string;
+    };
+    return pkg.version === version;
+  });
+}
+
+/** Whether Bun's workspace lock records the requested version for every member. */
+function lockfileMatchesVersion(
+  root: string,
+  members: readonly string[],
+  version: string,
+): boolean {
+  const lockfile = join(root, "bun.lock");
+  if (!existsSync(lockfile)) return false;
+  try {
+    const parsed = ts.parseConfigFileTextToJson(lockfile, readFileSync(lockfile, "utf8"));
+    if (parsed.error) return false;
+    const lock = parsed.config as {
+      workspaces?: Record<string, { version?: string }>;
+    };
+    return members.every((dir) => {
+      const relative = dir
+        .slice(resolve(root).length + 1)
+        .split("\\")
+        .join("/");
+      return lock.workspaces?.[relative]?.version === version;
+    });
+  } catch {
+    return false;
+  }
+}
+
 /** Spawn `command` in `cwd` with `PATH` overridden, failing the task on non-zero. */
 function run(cwd: string, command: string, args: string[], path: string): void {
   exec.spawnSync(command, args, {
@@ -107,6 +150,37 @@ function run(cwd: string, command: string, args: string[], path: string): void {
   });
 }
 
+/** Asynchronous counterpart used for bounded parallel stamping and publishing. */
+async function runAsync(cwd: string, command: string, args: string[], path: string): Promise<void> {
+  await exec.spawn(command, args, {
+    cwd,
+    stdout: "inherit",
+    stderr: "inherit",
+    stdin: "ignore",
+    check: true,
+    env: { ...process.env, PATH: path },
+  });
+}
+
+/** Run independent jobs with a small fixed worker pool. */
+async function runConcurrent<T>(
+  values: readonly T[],
+  concurrency: number,
+  worker: (value: T) => Promise<void>,
+): Promise<void> {
+  let next = 0;
+  const results = await Promise.allSettled(
+    Array.from({ length: Math.min(concurrency, values.length) }, async () => {
+      while (next < values.length) {
+        const value = values[next++];
+        await worker(value);
+      }
+    }),
+  );
+  const failure = results.find((result) => result.status === "rejected");
+  if (failure?.status === "rejected") throw failure.reason;
+}
+
 /**
  * Make a projen-readonly manifest writable so `bun pm pkg set` / `bun publish` can
  * edit it, recording its original bytes + mode for {@link restoreManifests} the
@@ -173,12 +247,9 @@ function applyPublishConfig(pkgPath: string): void {
 }
 
 /**
- * PATH with the workspace-root `node_modules/.bin` prepended. `bun publish` runs
- * each package's `prepack` (compile) through projen's dax shell, which resolves
- * `tsc` off PATH - but under the hoisted linker `tsc` lives ONLY in the root
- * `.bin`, not a per-package one, so without this the compile fails with
- * `dax: tsc: command not found`. (In CI `bun install` already puts it there; this
- * makes the task self-sufficient when invoked directly too.)
+ * PATH with the workspace-root `node_modules/.bin` prepended. The root-level
+ * compile reaches each package's projen/dax task, which resolves `tsc` off PATH;
+ * under the hoisted linker `tsc` lives only in the root `.bin`.
  */
 function enrichedPath(root: string): string {
   const binDir = join(root, "node_modules", ".bin");
@@ -196,6 +267,12 @@ if (!version) {
 const registryIdx = rest.indexOf("--registry");
 const registry = registryIdx >= 0 ? rest[registryIdx + 1] : undefined;
 const dryRun = rest.includes("--dry-run");
+const concurrencyIdx = rest.indexOf("--concurrency");
+const parsedConcurrency = Number(concurrencyIdx >= 0 ? rest[concurrencyIdx + 1] : 4);
+if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
+  throw new Error(`--concurrency must be a positive integer, got ${String(parsedConcurrency)}`);
+}
+const concurrency = parsedConcurrency;
 // `--stamp-only`: set versions + refresh the lockfile, then STOP (no publish).
 // The standalone `projen-release` uses this to version-stamp the workspace so its
 // own `bun publish` (run separately, in `projen/`) resolves `workspace:*` siblings
@@ -218,26 +295,31 @@ const members = workspaceMembers(root)
   .filter((dir) => existsSync(join(dir, "package.json")))
   .filter((dir) => !excluded.has(resolve(root, dir).replace(`${resolve(root)}/`, "")));
 
-// Set the version on EVERY member first (native `bun pm pkg set`), so a sibling
-// published later has its `workspace:*` dep resolved to the release version by
-// `bun publish`'s own protocol rewriting. The disk manifests already carry the
-// workspace `VERSION`; this re-affirms it against the value being published.
-logger.info(`setting ${version} across ${members.length} members`);
-for (const dir of members) {
-  unlockManifest(join(dir, "package.json"));
-  run(dir, "bun", ["pm", "pkg", "set", `version=${version}`], path);
+// Ensure every member carries the release version before packing. A normal bump
+// already synthesized it everywhere; dry runs and standalone invocations may not
+// have, so retain the native `bun pm pkg set` fallback for those paths.
+if (manifestsMatchVersion(members, version)) {
+  logger.info(`all ${members.length} member manifests already carry ${version}`);
+} else {
+  logger.info(`setting ${version} across ${members.length} members`);
+  await runConcurrent(members, concurrency, async (dir) => {
+    unlockManifest(join(dir, "package.json"));
+    await runAsync(dir, "bun", ["pm", "pkg", "set", `version=${version}`], path);
+  });
 }
 
-// Refresh the lockfile so `bun publish` resolves each `workspace:*` to the version
-// just set. `bun publish`/`pm pack` reads the workspace version from the LOCKFILE,
-// not the live manifest, and a plain `bun install` (even `--force`) does NOT
-// re-resolve it after only a version-field change - deleting the lockfile first
-// does. Without this a `workspace:*` dep could publish against a stale resolved
-// version instead of the one just set.
+// Ensure the lockfile resolves each `workspace:*` to the release version.
+// `bun publish`/`pm pack` reads workspace versions from the LOCKFILE, not just
+// live manifests. A normal bump's synth/install already makes it current; after
+// fallback stamping, deleting it before install is what forces re-resolution.
 const lockfile = join(root, "bun.lock");
-if (existsSync(lockfile)) rmSync(lockfile);
-logger.info("refreshing lockfile so workspace deps resolve to the release version");
-run(root, "bun", ["install"], path);
+if (lockfileMatchesVersion(root, members, version)) {
+  logger.info(`workspace lock already resolves members at ${version}`);
+} else {
+  if (existsSync(lockfile)) rmSync(lockfile);
+  logger.info("refreshing lockfile so workspace deps resolve to the release version");
+  run(root, "bun", ["install"], path);
+}
 
 if (stampOnly) {
   logger.success(`stamped ${members.length} members @ ${version} (no publish)`);
@@ -247,14 +329,16 @@ if (stampOnly) {
 const publishArgs = [
   "--access",
   "public",
+  "--ignore-scripts",
   ...(registry ? ["--registry", registry] : []),
   ...(dryRun ? ["--dry-run"] : []),
 ];
-let published = 0;
+const publishable: Array<{ dir: string; name: string; compile: boolean }> = [];
 for (const dir of members) {
   const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
     name?: string;
     private?: boolean;
+    scripts?: Record<string, string>;
   };
   if (pkg.private) {
     logger.info(`skip private ${pkg.name ?? dirname(dir)}`);
@@ -265,8 +349,26 @@ for (const dir of members) {
   const manifestPath = join(dir, "package.json");
   unlockManifest(manifestPath);
   applyPublishConfig(manifestPath);
-  logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${pkg.name} @ ${version}`);
-  run(dir, "bun", ["publish", ...publishArgs], path);
-  published += 1;
+  publishable.push({
+    dir,
+    name: pkg.name ?? dirname(dir),
+    compile: Boolean(pkg.scripts && typeof pkg.scripts === "object" && "prepack" in pkg.scripts),
+  });
+}
+
+const compiled = publishable.filter((pkg) => pkg.compile);
+if (compiled.length > 0) {
+  logger.info(`compiling ${compiled.length} publishable packages from the workspace root`);
+  run(root, "bun", ["run", ...compiled.flatMap((pkg) => ["--filter", pkg.name]), "compile"], path);
 }
-logger.success(`${dryRun ? "dry-run: packed" : "published"} ${published} packages @ ${version}`);
+
+logger.info(
+  `${dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
+);
+await runConcurrent(publishable, concurrency, async ({ dir, name }) => {
+  logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${name} @ ${version}`);
+  await runAsync(dir, "bun", ["publish", ...publishArgs], path);
+});
+logger.success(
+  `${dryRun ? "dry-run: packed" : "published"} ${publishable.length} packages @ ${version}`,
+);