@dbx-tools/projen 0.6.163 → 0.6.168

package/README.md

@@ -96,10 +96,29 @@ derives the crate name and repository from the parent project. A crate containin
 automatically wires matching private Node and Python binding packages using the
 same capability name. Repository-specific dependencies and features remain
 declarative options in `.projenrc.ts`; generated bindings are built separately
-from projen synthesis.
+from projen synthesis. Target-independent Node binding TypeScript is committed
+and remains generated/read-only, while native libraries stay ignored. Node
+facades compile to `lib/` and publish JavaScript entry points that plain Node
+can load from `node_modules`. The generated barrel exports the binding API from
+the package root. Do not create a `nodeExports` binding subpath or a
+handwritten type facade.
+
+Rust dependencies between binding-enabled workspace crates become Node
+`workspace:*` and Python `internalDependencies` automatically. Python generation
+selects the owning crate and supplies `external_packages` imports. UBRN currently
+emits every linked component; the generation task discards dependency outputs
+and rewrites their imports to the owning package root, including its generated
+`uniffiModule` converter table. It never copies a dependency's records or enums.
+Foreign callback adapters must first be wrapped in an object created by their
+own native library (`createStorageHandle` for auth), because callback registries
+are library-local. Release wheels replace sibling Git requirements with matching
+native-wheel versions, and dependent publishers wait for their dependencies.
+Each crate builds its own `<crate>-uniffi-bindgen` executable so a workspace
+build has no colliding binary outputs. Packaging runs that prebuilt executable.
 
 `sync --watch` runs a focused Rust watcher beside the OpenAPI watcher. Changes
-inside an existing UniFFI crate regenerate only that crate's bindings; adding or
+inside an existing UniFFI crate regenerate that crate and its dependent bindings
+in dependency order; adding or
 removing a crate or `setup_scaffolding!()` marker triggers a full synth. Repos
 without Rust crates start no Rust watcher. When Rust projects are detected,
 Cargo is required and the focused task fails immediately if it is unavailable.
@@ -133,11 +152,17 @@ and the UBRN Cargo build. Release packaging passes the cached executable directl
 to the Node binding generator and keeps the package barrel copied from source,
 so it does not need the installed projen dependency graph. A miss saves the
 validated executable immediately, before workspace build and packaging can fail.
-Bun runtime setup still runs because the binding generator is TypeScript. Cargo registry caches
+Bun runtime setup still runs in the single facade row because the binding
+generator and facade bundle are TypeScript. The bundle points its type surface
+at the committed generated source and needs no standalone TypeScript compiler
+or workspace install on a UBRN cache hit. Non-facade rows skip the complete
+Bun/UBRN path.
+Stable Windows rows verify and use the hosted runner's installed Rust toolchain
+and select `rust-lld` for the workspace build. Cargo registry caches
 and the `SCCACHE_GHA_VERSION` namespace stay stable per target/toolchain across
 version tags. Cache keys, restore results, sccache statistics, and phase timings
 are written to each build log. Python generation executes the already-built
-`target/<triple>/release/uniffi-bindgen` directly. Artifact packaging therefore
+`target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 
 Artifacts identify their crate, target, and type. Download-only publication

package/index.ts

@@ -58,7 +58,7 @@ export { DOWNSTREAM_RELEASE_EVENT, RUST_RELEASE_EVENT, RELEASE_TAG, RELEASE_SHA
 export { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS } from "./src/tags.ts";
 export type { PackageTag } from "./src/tags.ts";
 export { DBXToolsRootTsconfig } from "./src/tsconfig.ts";
-export { makeDefaultedInterfaceParametersOptional, addExplicitInterfaceReexports } from "./src/uniffi.ts";
+export { makeDefaultedInterfaceParametersOptional, addTypeScriptExtensionsToBindingImports, addExplicitInterfaceReexports } from "./src/uniffi.ts";
 export type { TypeScriptBindingModule } from "./src/uniffi.ts";
 export { DBXToolsVsCode } from "./src/vscode.ts";
 export type { IgnoreGroupOptions } from "./src/watch.ts";

package/package.json

@@ -26,9 +26,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.163",
-    "@dbx-tools/path": "0.6.163",
-    "@dbx-tools/shared-core": "0.6.163",
+    "@dbx-tools/core": "0.6.168",
+    "@dbx-tools/path": "0.6.168",
+    "@dbx-tools/shared-core": "0.6.168",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -48,7 +48,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.163",
+  "version": "0.6.168",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-js.ts

@@ -446,13 +446,13 @@ function defaultProjectOptions(
     devDeps: ["@types/node@^24.6.0"],
     ...(isRoot
       ? {
-          prettier: true,
-          prettierOptions: {
-            settings: PRETTIER_SETTINGS,
-            ignoreFile: true,
-            ignoreFileOptions: { ignorePatterns: [...ignore.ignorePatterns({ test: false })] },
-          },
-        }
+        prettier: true,
+        prettierOptions: {
+          settings: PRETTIER_SETTINGS,
+          ignoreFile: true,
+          ignoreFileOptions: { ignorePatterns: [...ignore.ignorePatterns({ test: false })] },
+        },
+      }
       : {}),
     ...options,
     ...copiedGitIgnoreOptions(options),
@@ -495,24 +495,23 @@ function defaultTypeScriptProjectOptions(
     // ESLint is configured once on the ROOT (see initProject) and lints the whole
     // tree, so packages don't emit their own config. A caller can still override.
     eslint: false,
-    devDeps: [...(base.devDeps ?? []), "typescript@^5.9.3", "@types/bun@^1.3.14"],
+    devDeps: [...(base.devDeps ?? []), "typescript@^5.9.3", `@types/bun@${BUN_VERSION}`],
     ...options,
     ...copiedGitIgnoreOptions(options),
   };
 }
 
-// Pinned to match the subproject defaults so bun resolves a single typescript
-// across the workspace (a bare name -> `*` could pull a second, newer major).
-// `@types/bun` gives the `Bun.*` globals the server/app tags now use.
-const DEV_DEPS_ROOT: string[] = ["typescript@^5.9.3", "@types/bun@^1.3.14"];
+// Pinned to match the subproject defaults so bun resolves one TypeScript and
+// one runtime-compatible set of Bun globals across the workspace.
+const DEV_DEPS_ROOT: string[] = ["typescript@^5.9.3", `@types/bun@${BUN_VERSION}`];
 
 /** Options for {@link DBXToolsNodeProject} (the monorepo root). */
 export interface DBXToolsJavaScriptProjectOptions
   extends
-    CommonProjectOptions,
-    Partial<javascript.NodeProjectOptions>,
-    DBXToolsConfigOptions,
-    DBXToolsPNPMWorkspaceOptions {
+  CommonProjectOptions,
+  Partial<javascript.NodeProjectOptions>,
+  DBXToolsConfigOptions,
+  DBXToolsPNPMWorkspaceOptions {
   /**
    * The npm scope for generated package names (`@<scope>/<seg-...>`). Defaults to
    * the (resolved) project name; a leading `@` is optional.
@@ -593,8 +592,7 @@ export interface DBXToolsTypeScriptProjectOptions
  */
 export class DBXToolsNodeProject
   extends javascript.NodeProject
-  implements DBXToolsJavaScriptProject
-{
+  implements DBXToolsJavaScriptProject {
   readonly language = "javascript" as const;
   readonly scope: string;
   readonly dbxToolsConfig: DBXToolsConfig;
@@ -694,8 +692,8 @@ export const ROOT_INSTALL_ONLY_MIXIN = mixin.create(
       installDependencies(trigger: unknown): void;
       logInstallTrigger(trigger: unknown): void;
     };
-    nodePackage.installDependencies = () => {};
-    nodePackage.logInstallTrigger = () => {};
+    nodePackage.installDependencies = () => { };
+    nodePackage.logInstallTrigger = () => { };
   },
 );
 
@@ -708,8 +706,7 @@ export const ROOT_INSTALL_ONLY_MIXIN = mixin.create(
  */
 export class DBXToolsTypeScriptProject
   extends typescript.TypeScriptProject
-  implements DBXToolsJavaScriptProject
-{
+  implements DBXToolsJavaScriptProject {
   readonly language = "javascript" as const;
   readonly scope: string;
   readonly dbxToolsConfig: DBXToolsConfig;

package/src/project-py.ts

@@ -683,7 +683,10 @@ export class DBXToolsPythonWorkspace extends Component {
     const linesBeforeAuthentication = [
       "# PyPI Trusted Publisher Setup Instructions",
       "",
-      "Use a browser to audit and configure the PyPI trusted publishers below.",
+      "Use the system browser to audit and configure the PyPI trusted publishers below.",
+      "Do not use an in-app browser or embedded webview.",
+      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and branch value is provided below and is authoritative.",
+      "Use only PyPI pages for this task.",
       "",
       "## Audit and confirmation",
       "",
@@ -691,7 +694,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "- Confirm that the active PyPI account can administer the listed projects and pending publishers.",
       "- Start at https://pypi.org/manage/projects/ and determine which listed projects exist.",
-      "- Inspect every existing GitHub publisher for each project and compare its owner, repository name, workflow name, and environment name with the desired values below.",
+      "- On PyPI, inspect every existing GitHub Actions publisher for each project and compare its owner, repository name, workflow name, and environment name with the desired values below.",
       "- Identify duplicate and mismatched trusted publishers that must be replaced by removing the publisher entry and adding the correct one.",
       "- For projects that do not exist, identify the pending publisher that must be created.",
       "- Report the active account and a proposed reconciliation plan grouped by publishers that will be left unchanged, updated, replaced, created, or removed.",
@@ -700,9 +703,9 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## GitHub environment policy",
       "",
-      `- Configure every environment listed below to permit deployments from the ${releaseBranch} branch.`,
-      "- Branch-scoped release workflows use the environment names below; tag-only deployment policies reject their trusted-publishing jobs.",
-      "- Keep the GitHub environment name synchronized with the PyPI trusted publisher environment.",
+      `- The supplied branch policy value is ${releaseBranch}.`,
+      "- Do not inspect or configure GitHub environments during this task.",
+      "- GitHub environment administration is a separate task; use the supplied values only when comparing PyPI publisher entries.",
       "",
       "## Authentication",
       "",
@@ -714,7 +717,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## Efficient browser workflow",
       "",
-      "- Reuse or claim an existing PyPI browser tab when available.",
+      "- Reuse an existing PyPI tab in the system browser when available.",
       "- For an existing project, open its publisher page directly at https://pypi.org/manage/project/<project-name>/settings/publishing/.",
       "- For a project that does not exist, use the pending-publisher page at https://pypi.org/manage/account/publishing/.",
       "- Treat the publisher table shown after submission as authoritative confirmation of success, even if the navigation header unexpectedly appears signed out.",
@@ -769,7 +772,7 @@ export class DBXToolsPythonWorkspace extends Component {
       ],
     });
     project.root.addTask("pypiTrustedPublisherInstructions", {
-      description: "Print browser-agent instructions for PyPI trusted publishers",
+      description: "Print system-browser instructions for PyPI trusted publishers",
       exec: `node ${helper}`,
       receiveArgs: true,
     });

package/src/project-rs.ts

@@ -28,6 +28,7 @@ export interface CargoDependencyOptions {
   readonly workspace?: boolean;
   readonly path?: string;
   readonly optional?: boolean;
+  readonly package?: string;
   readonly defaultFeatures?: boolean;
   readonly features?: readonly string[];
 }
@@ -156,6 +157,8 @@ export const UNIFFI_RELEASE_TARGETS: readonly UniFFIReleaseTarget[] = [
 ] as const;
 
 const RUST_CACHE_ENV = {
+  CARGO_INCREMENTAL: "0",
+  CARGO_TERM_COLOR: "always",
   RUSTC_WRAPPER: "sccache",
   SCCACHE_GHA_ENABLED: "true",
 } as const;
@@ -203,8 +206,9 @@ function releaseTargets(options: DBXToolsRustWorkspaceOptions): readonly UniFFIR
     const target = UNIFFI_RELEASE_TARGETS.find(
       (candidate) => candidate.os === platform.os && candidate.cpu === platform.cpu,
     );
-    if (!target)
+    if (!target) {
       throw new Error(`Unsupported Rust release platform: ${platform.os}-${platform.cpu}`);
+    }
     return target;
   });
 }
@@ -247,6 +251,7 @@ export interface RustBindingMapping {
   readonly pythonPackage?: string;
   readonly pythonModule?: string;
   readonly facadeTarget?: boolean;
+  readonly dependencies?: readonly string[];
 }
 
 /** Persisted Rust workspace state consumed by `sync --watch`. */
@@ -257,6 +262,28 @@ export interface RustWorkspaceMapping {
   readonly releaseWorkflow?: string;
 }
 
+export function orderRustBindings(bindings: readonly RustBindingMapping[]): RustBindingMapping[] {
+  const ordered: RustBindingMapping[] = [];
+  const visiting = new Set<string>();
+  const completed = new Set<string>();
+  const visit = (binding: RustBindingMapping): void => {
+    if (completed.has(binding.crate)) return;
+    if (visiting.has(binding.crate))
+      throw new Error(`Cyclic Rust binding dependency: ${binding.crate}`);
+    visiting.add(binding.crate);
+    for (const name of binding.dependencies ?? []) {
+      const dependency = bindings.find((candidate) => candidate.crate === name);
+      if (!dependency) throw new Error(`Missing Rust binding dependency: ${name}`);
+      visit(dependency);
+    }
+    visiting.delete(binding.crate);
+    completed.add(binding.crate);
+    ordered.push(binding);
+  };
+  for (const binding of bindings) visit(binding);
+  return ordered;
+}
+
 function rustSources(directory: string): string[] {
   if (!existsSync(directory)) return [];
   const files: string[] = [];
@@ -294,6 +321,7 @@ function cargoDependency(
     ...(!value.version && value.path && workspaceVersion ? { version: workspaceVersion } : {}),
     ...(value.workspace ? { workspace: true } : {}),
     ...(value.path ? { path: value.path } : {}),
+    ...(value.package ? { package: value.package } : {}),
     ...(value.optional ? { optional: true } : {}),
     ...(value.defaultFeatures === false ? { "default-features": false } : {}),
     ...(value.features?.length ? { features: [...value.features] } : {}),
@@ -366,7 +394,7 @@ export class DBXToolsRustProject extends Project implements DBXToolsProject {
       ...(this.uniffi || binary
         ? {
             bin: this.uniffi
-              ? { name: "uniffi-bindgen", path: "uniffi-bindgen.rs" }
+              ? { name: `${crateName}-uniffi-bindgen`, path: "uniffi-bindgen.rs" }
               : { name: binaryName, path: "src/main.rs" },
           }
         : {}),
@@ -447,27 +475,75 @@ export class DBXToolsRustWorkspace {
     );
 
     const bindings = this.packages.filter((pkg) => pkg.uniffi);
-    this.bindingMappings = bindings.map((pkg) => {
-      const targets = pkg.packageOptions.bindings ?? ["node", "python"];
-      const packageName = pkg.packageOptions.directory.toLowerCase().replace(/[^a-z0-9-]+/g, "-");
-      return {
-        crate: pkg.crateName,
-        rust: `${root}/${pkg.packageOptions.directory}`,
-        ...(targets.includes("node")
-          ? {
-              node: `${nodeRoot}/${pkg.packageOptions.directory}`,
-              nodePackage: `@${scope}/${packageName}`,
-            }
-          : {}),
-        ...(targets.includes("python")
-          ? {
-              python: `${options.pythonRoot ?? "packages/py"}/${pkg.packageOptions.directory}`,
-              pythonPackage: pkg.crateName,
-              pythonModule: pythonModuleName(pythonModulePrefix, pkg.packageOptions.directory),
-            }
-          : {}),
-      };
-    });
+    const bindingDependencies = (pkg: DBXToolsRustProject, language: "node" | "python") =>
+      bindings.filter(
+        (dependency) =>
+          dependency !== pkg &&
+          (dependency.packageOptions.bindings ?? ["node", "python"]).includes(language) &&
+          Object.entries(pkg.packageOptions.dependencies ?? {}).some(([name, value]) => {
+            const resolved =
+              typeof value === "object" && value.workspace
+                ? (options.workspaceDependencies?.[name] ?? value)
+                : value;
+            return (
+              name === dependency.crateName ||
+              (typeof resolved === "object" &&
+                (resolved.package === dependency.crateName ||
+                  (resolved.path !== undefined &&
+                    resolve(
+                      typeof value === "object" && value.workspace ? project.outdir : pkg.outdir,
+                      resolved.path,
+                    ) === dependency.outdir)))
+            );
+          }),
+      );
+    this.bindingMappings = orderRustBindings(
+      bindings.map((pkg) => {
+        const targets = pkg.packageOptions.bindings ?? ["node", "python"];
+        const packageName = pkg.packageOptions.directory.toLowerCase().replace(/[^a-z0-9-]+/g, "-");
+        const dependencies = [
+          ...new Set([...bindingDependencies(pkg, "node"), ...bindingDependencies(pkg, "python")]),
+        ].map((dependency) => dependency.crateName);
+        return {
+          crate: pkg.crateName,
+          ...(dependencies.length ? { dependencies } : {}),
+          rust: `${root}/${pkg.packageOptions.directory}`,
+          ...(targets.includes("node")
+            ? {
+                node: `${nodeRoot}/${pkg.packageOptions.directory}`,
+                nodePackage: `@${scope}/${packageName}`,
+              }
+            : {}),
+          ...(targets.includes("python")
+            ? {
+                python: `${options.pythonRoot ?? "packages/py"}/${pkg.packageOptions.directory}`,
+                pythonPackage: pkg.crateName,
+                pythonModule: pythonModuleName(pythonModulePrefix, pkg.packageOptions.directory),
+              }
+            : {}),
+        };
+      }),
+    );
+    for (const pkg of bindings) {
+      const dependencies = bindingDependencies(pkg, "python");
+      if (dependencies.length === 0) continue;
+      pkg.tryRemoveFile("uniffi.toml");
+      new TextFile(pkg, "uniffi.toml", {
+        lines: renderToml({
+          "bindings.python": { cdylib_name: pkg.crateName.replaceAll("-", "_") },
+          "bindings.typescript": { strictTypeChecking: true },
+          ...pkg.packageOptions.uniffiConfig,
+          "bindings.python.external_packages": Object.fromEntries(
+            dependencies.map((dependency) => [
+              dependency.crateName.replaceAll("-", "_"),
+              `${pythonModuleName(pythonModulePrefix, dependency.packageOptions.directory)}.bindings`,
+            ]),
+          ),
+        })
+          .trimEnd()
+          .split("\n"),
+      });
+    }
     const releaseEnabled =
       (options.release ?? true) &&
       (this.bindingMappings.length > 0 ||
@@ -484,13 +560,7 @@ export class DBXToolsRustWorkspace {
     project.gitignore.addPatterns(
       "target/",
       ...this.bindingMappings.flatMap((binding) => [
-        ...(binding.node
-          ? [
-              `${binding.node}/src/bindings.ts`,
-              `${binding.node}/src/_bindings*.ts`,
-              `${binding.node}/src/*${binding.crate.replaceAll("-", "_")}.*`,
-            ]
-          : []),
+        ...(binding.node ? [`${binding.node}/src/*${binding.crate.replaceAll("-", "_")}.*`] : []),
         ...(binding.python && binding.pythonModule
           ? [
               `${binding.python}/src/${binding.pythonModule.replaceAll(".", "/")}/bindings.py`,
@@ -499,6 +569,13 @@ export class DBXToolsRustWorkspace {
           : []),
       ]),
     );
+    for (const binding of this.bindingMappings) {
+      if (!binding.node) {
+        continue;
+      }
+      project.prettier?.addIgnorePattern(`${binding.node}/src/bindings.ts`);
+      project.prettier?.addIgnorePattern(`${binding.node}/src/_bindings*.ts`);
+    }
     this.pythonPackages = bindings
       .filter((pkg) => (pkg.packageOptions.bindings ?? ["node", "python"]).includes("python"))
       .map((pkg) => {
@@ -509,6 +586,9 @@ export class DBXToolsRustWorkspace {
           module,
           description: `Python bindings for ${pkg.crateName}`,
           private: true,
+          internalDependencies: bindingDependencies(pkg, "python").map(
+            (dependency) => dependency.packageOptions.directory,
+          ),
           generatedSources: [`src/${module.replaceAll(".", "/")}/bindings.py`],
           trustedPublisher: {
             workflowName: options.releaseWorkflowName ?? "rust-release",
@@ -544,7 +624,6 @@ export class DBXToolsRustWorkspace {
         `@${scope}/${directory.toLowerCase().replace(/[^a-z0-9-]+/g, "-")}`,
       );
       node.package.addField("private", true);
-      node.package.file.addDeletionOverride("publishConfig");
       node.package.addField("description", `Node bindings for ${binding.crateName}`);
       const nativeTargets = releaseTargets(options);
       if (options.release ?? true) {
@@ -559,6 +638,11 @@ export class DBXToolsRustWorkspace {
         );
       }
       node.addDeps("@ubjs/core@0.31.0-5", "@ubjs/node@0.31.0-5");
+      node.addDeps(
+        ...bindingDependencies(binding, "node").map(
+          (dependency) => `@${scope}/${dependency.packageOptions.directory}@workspace:*`,
+        ),
+      );
       if (binding.packageOptions.nodeDependencies?.length) {
         node.addDeps(...binding.packageOptions.nodeDependencies);
       }
@@ -566,7 +650,6 @@ export class DBXToolsRustWorkspace {
       if (binding.packageOptions.nodeDevDependencies?.length) {
         node.addDevDeps(...binding.packageOptions.nodeDevDependencies);
       }
-      node.compileTask.reset();
       new TextFile(node, "exports.ts", {
         lines: ['export * from "./src/bindings.ts";', ""],
       });
@@ -607,10 +690,13 @@ export class DBXToolsRustWorkspace {
     project.addTask("rs:lint", { exec: "cargo clippy --workspace --all-targets --all-features" });
     project.addTask("rs:test", { exec: "cargo test --workspace" });
     project.addTask("rs:build", { exec: "cargo build --workspace" });
-    project.addTask("rs:bindings", {
+    const bindingsTask = project.addTask("rs:bindings", {
       exec: "bun node_modules/@dbx-tools/projen/tasks/rust.ts",
       description: "Generate language bindings for UniFFI-enabled Rust crates",
     });
+    if (this.bindingMappings.some((binding) => binding.node)) {
+      project.tasks.tryFind("pre-compile")?.spawn(bindingsTask);
+    }
     project.addTask("rs:bindings:demo", {
       description: "Generate and run UniFFI Node and Python example CLIs",
       exec: [
@@ -662,12 +748,20 @@ export class DBXToolsRustWorkspace {
       }));
     const publicCrates = this.packages
       .filter((pkg) => !pkg.packageOptions.private)
+      .sort((first, second) => {
+        const order = this.bindingMappings.map((binding) => binding.crate);
+        return order.indexOf(first.crateName) - order.indexOf(second.crateName);
+      })
       .map((pkg) => pkg.crateName);
     const targetMatrix = targets.map((target, index) => ({
       target: { ...target, facade: index === 0 },
     }));
     const hasNodeBindings = bindings.some((binding) => binding.node);
     const hasPythonBindings = bindings.some((binding) => binding.python);
+    const facadeCondition = "matrix.target.facade";
+    const facadeCacheMissCondition =
+      "matrix.target.facade && steps.ubrn_cache.outputs.cache-hit != 'true'";
+    const usePreinstalledWindowsRust = releaseRustVersion === "stable";
     const hasTargetOutputs =
       bindings.length > 0 || releaseBinaries.length > 0 || publicCrates.length > 0;
     if (hasTargetOutputs && targetMatrix.length === 0) {
@@ -779,15 +873,32 @@ export class DBXToolsRustWorkspace {
         ...(hasPythonBindings ? [{ name: "Setup uv", uses: "astral-sh/setup-uv@v7" }] : []),
         {
           name: "Setup Rust",
+          ...(usePreinstalledWindowsRust ? { if: "${{ matrix.target.os != 'win32' }}" } : {}),
           uses: `dtolnay/rust-toolchain@${releaseRustVersion}`,
           with: { targets: "${{ matrix.target.cargo }}" },
         },
+        ...(usePreinstalledWindowsRust
+          ? [
+              {
+                name: "Verify preinstalled Windows Rust",
+                if: "${{ matrix.target.os == 'win32' }}",
+                shell: "bash",
+                run: [
+                  "rustc --version --verbose",
+                  "cargo --version",
+                  'rustup target list --installed | grep -Fx "${{ matrix.target.cargo }}"',
+                  'test -f "$(rustc --print sysroot)/lib/rustlib/${{ matrix.target.cargo }}/bin/rust-lld.exe"',
+                ].join("\n"),
+              },
+            ]
+          : []),
         ...rustCacheSteps(`release-\${{ matrix.target.cargo }}-rust-${releaseRustVersion}`),
         ...(hasNodeBindings
           ? [
               {
                 name: "Restore UBRN executable",
                 id: "ubrn_cache",
+                if: "${{ matrix.target.facade }}",
                 uses: "actions/cache/restore@v5",
                 with: {
                   path: ".cache/ubrn",
@@ -798,7 +909,8 @@ export class DBXToolsRustWorkspace {
           : []),
         ...(hasNodeBindings
           ? bunCacheRestoreSteps(project, {
-              condition: "steps.ubrn_cache.outputs.cache-hit != 'true'",
+              setupCondition: facadeCondition,
+              condition: facadeCacheMissCondition,
             })
           : []),
         {
@@ -827,12 +939,12 @@ export class DBXToolsRustWorkspace {
           ? [
               {
                 name: "Install Node tooling",
-                if: "${{ steps.ubrn_cache.outputs.cache-hit != 'true' }}",
+                if: "${{ matrix.target.facade && steps.ubrn_cache.outputs.cache-hit != 'true' }}",
                 shell: "bash",
                 run: timedBash("node_tooling", "bun install"),
               },
               bunCacheSaveStep({
-                condition: "steps.ubrn_cache.outputs.cache-hit != 'true'",
+                condition: facadeCacheMissCondition,
               }),
             ]
           : []),
@@ -840,7 +952,7 @@ export class DBXToolsRustWorkspace {
           ? [
               {
                 name: "Prepare UBRN generator",
-                if: "${{ steps.ubrn_cache.outputs.cache-hit != 'true' }}",
+                if: "${{ matrix.target.facade && steps.ubrn_cache.outputs.cache-hit != 'true' }}",
                 env: {
                   CARGO_TARGET_DIR: "${{ github.workspace }}/target/ubrn",
                   UBRN_EXECUTABLE: ubrnExecutable,
@@ -858,13 +970,14 @@ export class DBXToolsRustWorkspace {
               },
               {
                 name: "Verify UBRN executable",
+                if: "${{ matrix.target.facade }}",
                 env: { UBRN_EXECUTABLE: ubrnExecutable },
                 shell: "bash",
                 run: 'test -f "$UBRN_EXECUTABLE"',
               },
               {
                 name: "Save UBRN executable",
-                if: "${{ steps.ubrn_cache.outputs.cache-hit != 'true' }}",
+                if: "${{ matrix.target.facade && steps.ubrn_cache.outputs.cache-hit != 'true' }}",
                 uses: "actions/cache/save@v5",
                 with: {
                   path: ".cache/ubrn",
@@ -876,6 +989,10 @@ export class DBXToolsRustWorkspace {
         {
           name: "Build Rust outputs",
           shell: "bash",
+          env: {
+            CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER:
+              "${{ matrix.target.os == 'win32' && 'rust-lld' || '' }}",
+          },
           run: timedBash(
             "rust_workspace",
             'cargo build --release --workspace --target "${{ matrix.target.cargo }}"',
@@ -921,7 +1038,10 @@ export class DBXToolsRustWorkspace {
         `publish-${binding.crate}`,
         {
           if: "${{ github.event_name == 'repository_dispatch' }}",
-          needs: ["build"],
+          needs: [
+            "build",
+            ...(binding.dependencies ?? []).map((dependency) => `publish-${dependency}`),
+          ],
           "runs-on": "ubuntu-latest",
           permissions: {
             contents: "read",

package/src/uniffi.ts

@@ -36,6 +36,14 @@ export interface TypeScriptBindingModule {
   readonly source: string;
 }
 
+/** Add source extensions to UBRN's generated relative binding imports. */
+export const addTypeScriptExtensionsToBindingImports = (source: string): string =>
+  source.replace(
+    /(["'])\.\/_bindings(-ffi)?\1/g,
+    (_specifier, quote: string, suffix: string | undefined) =>
+      `${quote}./_bindings${suffix ?? ""}.ts${quote}`,
+  );
+
 /** Add explicit type exports for interfaces that TypeScript misses through UBRN's star exports. */
 export const addExplicitInterfaceReexports = (
   facade: string,

package/tasks/rust.ts

@@ -8,6 +8,7 @@ import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import {
   discoverRustCrates,
   hasUniFFIBindings,
+  orderRustBindings,
   type RustBindingMapping,
   type RustWorkspaceMapping,
 } from "../src/project-rs.ts";
@@ -84,6 +85,19 @@ function generate(binding: RustBindingMapping): void {
   if (result.status !== 0) throw new Error(`binding generation exited with ${result.status}`);
 }
 
+export function affectedRustBindings(
+  bindings: readonly RustBindingMapping[],
+  changed: ReadonlySet<string>,
+): RustBindingMapping[] {
+  const affected = new Set(changed);
+  const ordered = orderRustBindings(bindings);
+  for (const binding of ordered) {
+    if (binding.dependencies?.some((dependency) => affected.has(dependency)))
+      affected.add(binding.crate);
+  }
+  return ordered.filter((binding) => affected.has(binding.crate));
+}
+
 const config = rustConfig();
 
 async function main(): Promise<void> {
@@ -92,7 +106,7 @@ async function main(): Promise<void> {
     throw new Error("Cargo is required because Rust projects were detected");
   }
   if (!process.argv.includes("--watch")) {
-    for (const binding of config.bindings) generate(binding);
+    for (const binding of orderRustBindings(config.bindings)) generate(binding);
     return;
   }
 
@@ -109,7 +123,7 @@ async function main(): Promise<void> {
         const binding = ownerBinding(path, refreshed.bindings);
         if (binding) targets.set(binding.crate, binding);
       }
-      for (const binding of targets.values()) {
+      for (const binding of affectedRustBindings(refreshed.bindings, new Set(targets.keys()))) {
         logger.start(`generating ${binding.crate} bindings`);
         generate(binding);
         logger.success(`generated ${binding.crate} bindings`);
@@ -121,7 +135,7 @@ async function main(): Promise<void> {
       const binding = ownerBinding(path, latest.bindings);
       if (binding) targets.set(binding.crate, binding);
     }
-    for (const binding of targets.values()) {
+    for (const binding of affectedRustBindings(latest.bindings, new Set(targets.keys()))) {
       logger.start(`generating ${binding.crate} bindings`);
       generate(binding);
       logger.success(`generated ${binding.crate} bindings`);

package/tasks/uniffi-release.mjs

@@ -65,6 +65,82 @@ const run = (command, args, cwd = root) => {
   if (result.status !== 0) throw new Error(`${invocation.command} exited with ${result.status}`);
 };
 
+const singlePackage = (directory) => {
+  const packages = readdirSync(directory)
+    .filter((file) => file.endsWith(".tgz"))
+    .map((file) => resolve(directory, file));
+  if (packages.length !== 1) {
+    throw new Error(`Expected one npm package in ${directory}, found ${packages.length}`);
+  }
+  return packages[0];
+};
+
+const localWorkspacePackages = () => {
+  const manifest = JSON.parse(readFileSync(resolve(root, "package.json"), "utf8"));
+  const workspaces = Array.isArray(manifest.workspaces) ? manifest.workspaces : [];
+  return new Map(
+    workspaces.flatMap((directory) => {
+      const manifestPath = resolve(root, directory, "package.json");
+      if (!existsSync(manifestPath)) return [];
+      const workspaceManifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+      return workspaceManifest.name ? [[workspaceManifest.name, workspaceManifest.version]] : [];
+    }),
+  );
+};
+
+const testNodeFacade = ({ facadePackage, manifest, nativePackage, nodePackage }) => {
+  const installDirectory = mkdtempSync(join(tmpdir(), "uniffi-facade-install-"));
+  try {
+    const workspacePackages = localWorkspacePackages();
+    const bindings =
+      JSON.parse(readFileSync(join(root, "package.json"), "utf8")).dbxToolsConfig?.rust?.bindings ??
+      [];
+    const localDependencies = Object.keys(manifest.dependencies ?? {}).flatMap((name, index) => {
+      const workspaceVersion = workspacePackages.get(name);
+      if (!workspaceVersion) return [];
+      const binding = bindings.find((binding) => binding.nodePackage === name);
+      if (binding) {
+        const output = resolve(root, "dist/release", binding.crate, required("node-triple"));
+        return [singlePackage(join(output, "npm-facade")), singlePackage(join(output, "npm"))];
+      }
+      const directory = join(installDirectory, "local-dependencies", String(index));
+      mkdirSync(directory, { recursive: true });
+      writeFileSync(
+        join(directory, "package.json"),
+        `${JSON.stringify({
+          name,
+          version: workspaceVersion,
+          type: "module",
+          exports: "./index.js",
+        })}\n`,
+      );
+      writeFileSync(join(directory, "index.js"), "export {};\n");
+      return [directory];
+    });
+    writeFileSync(
+      join(installDirectory, "package.json"),
+      `${JSON.stringify({ private: true, type: "module" })}\n`,
+    );
+    run(
+      "npm",
+      [
+        "install",
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        "--package-lock=false",
+        facadePackage,
+        nativePackage,
+        ...localDependencies,
+      ],
+      installDirectory,
+    );
+    run("node", ["-e", `import(${JSON.stringify(nodePackage)})`], installDirectory);
+  } finally {
+    rmSync(installDirectory, { recursive: true, force: true });
+  }
+};
+
 const replaceVersion = (source, version) =>
   source.replace(/^version = "[^"]+"$/m, `version = "${version}"`);
 
@@ -135,8 +211,6 @@ const packageNode = ({
       typeof dependency === "string" && dependency.startsWith("workspace:") ? version : dependency,
     ]),
   );
-  delete manifest.scripts;
-  delete manifest.devDependencies;
   writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
   run("bun", [
     resolve(root, nodeGenerator),
@@ -153,8 +227,44 @@ const packageNode = ({
     ...(parsed.values.ubrn ? ["--ubrn", parsed.values.ubrn, "--skip-barrels"] : []),
     "--skip-build",
   ]);
-  mkdirSync(resolve(output, "npm-facade"), { recursive: true });
-  run("npm", ["pack", "--pack-destination", resolve(output, "npm-facade")], facadeDirectory);
+  // Node loads the facade from node_modules, so every TypeScript entry point
+  // must be emitted and advertised as JavaScript. Bun is always available in
+  // the facade row, including when the UBRN cache skips the workspace install.
+  rmSync(join(facadeDirectory, "lib"), { recursive: true, force: true });
+  run(
+    "bun",
+    [
+      "build",
+      "index.ts",
+      "--outdir",
+      "lib",
+      "--target",
+      "node",
+      "--format",
+      "esm",
+      "--packages",
+      "external",
+    ],
+    facadeDirectory,
+  );
+  const compiledPublish = { ...(manifest.publishConfig ?? {}) };
+  delete compiledPublish.access;
+  Object.assign(manifest, compiledPublish);
+  manifest.types = "./index.ts";
+  manifest.exports["."].types = "./index.ts";
+  delete manifest.publishConfig;
+  delete manifest.scripts;
+  delete manifest.devDependencies;
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+  const facadeOutput = resolve(output, "npm-facade");
+  mkdirSync(facadeOutput, { recursive: true });
+  run("npm", ["pack", "--pack-destination", facadeOutput], facadeDirectory);
+  testNodeFacade({
+    facadePackage: singlePackage(facadeOutput),
+    manifest,
+    nativePackage: singlePackage(resolve(output, "npm")),
+    nodePackage,
+  });
 };
 
 const packagePython = ({
@@ -172,6 +282,19 @@ const packagePython = ({
   const pyproject = join(pythonRoot, "pyproject.toml");
   writable(pyproject);
   writeFileSync(pyproject, replaceVersion(readFileSync(pyproject, "utf8"), version));
+  const workspaceBindings =
+    JSON.parse(readFileSync(join(root, "package.json"), "utf8")).dbxToolsConfig?.rust?.bindings ??
+    [];
+  let metadata = readFileSync(pyproject, "utf8");
+  for (const binding of workspaceBindings) {
+    if (!binding.pythonPackage) continue;
+    const escaped = binding.pythonPackage.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    metadata = metadata.replace(
+      new RegExp(`"${escaped} @ git\\+[^"\\n]+"`, "g"),
+      JSON.stringify(`${binding.pythonPackage}==${version}`),
+    );
+  }
+  writeFileSync(pyproject, metadata);
 
   const packageName = crate.replace(/^dbx-tools-/, "").replaceAll("-", "_");
   const packageDirectory = resolve(pythonRoot, "src", "dbx_tools", packageName);
@@ -181,10 +304,19 @@ const packagePython = ({
     "target",
     cargoTarget,
     "release",
-    `uniffi-bindgen${os === "win32" ? ".exe" : ""}`,
+    `${crate}-uniffi-bindgen${os === "win32" ? ".exe" : ""}`,
   );
   if (!existsSync(generator)) throw new Error(`Missing UniFFI generator ${generator}`);
-  run(generator, ["generate", "--language", "python", "--out-dir", generatedDirectory, library]);
+  run(generator, [
+    "generate",
+    "--language",
+    "python",
+    "--crate",
+    crate.replaceAll("-", "_"),
+    "--out-dir",
+    generatedDirectory,
+    library,
+  ]);
   const bindings = join(packageDirectory, "bindings.py");
   writable(bindings);
   const body = readFileSync(join(generatedDirectory, `${crate.replaceAll("-", "_")}.py`), "utf8");

package/tasks/uniffi.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env -S bun
+import { spawnSync } from "node:child_process";
 import {
   cpSync,
   existsSync,
@@ -14,10 +15,11 @@ import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { spawnSync } from "node:child_process";
 import { makeReadonly, makeWritable, stampGenerated } from "../src/generated.ts";
+import type { RustWorkspaceMapping } from "../src/project-rs.ts";
 import {
   addExplicitInterfaceReexports,
+  addTypeScriptExtensionsToBindingImports,
   makeDefaultedInterfaceParametersOptional,
 } from "../src/uniffi.ts";
 
@@ -43,6 +45,11 @@ const root = values.root
   : resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const crate = values.crate;
 const libraryName = crate.replaceAll("-", "_");
+const workspace = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).dbxToolsConfig
+  ?.rust as RustWorkspaceMapping | undefined;
+const binding = workspace?.bindings.find((binding) => binding.crate === crate);
+const dependencies =
+  workspace?.bindings.filter((candidate) => binding?.dependencies?.includes(candidate.crate)) ?? [];
 const extension =
   process.platform === "darwin" ? "dylib" : process.platform === "win32" ? "dll" : "so";
 const prefix = process.platform === "win32" ? "" : "lib";
@@ -61,6 +68,9 @@ const run = (command: string, args: string[]) => {
   const stderr = normalizedOutput(result.stderr ?? "");
   if (stdout) process.stdout.write(`${stdout}\n`);
   if (stderr) process.stderr.write(`${stderr}\n`);
+  if (result.error) {
+    throw new Error(`${command} failed: ${result.error.message}`, { cause: result.error });
+  }
   if (result.status !== 0) throw new Error(`${command} exited with ${result.status}`);
 };
 
@@ -126,42 +136,60 @@ if (values.node) {
   const generatedModules = readdirSync(nodeOutput).filter(
     (file) => file.endsWith(".ts") && file !== "index.ts",
   );
-  const linkedComponents = generatedModules.length > 2;
-  const nodeBindings = join(nodeSource, "bindings.ts");
-  const linkedNames = new Map(generatedModules.map((file) => [file, `_bindings-${file}`]));
-  const generatedFiles = linkedComponents
-    ? generatedModules.map((file) => join(nodeSource, linkedNames.get(file)!))
-    : [join(nodeSource, "_bindings.ts"), join(nodeSource, "_bindings-ffi.ts")];
-  replaceGenerated(join(nodeOutput, "index.ts"), nodeBindings);
-  if (linkedComponents) {
-    for (const file of generatedModules) {
-      replaceGenerated(join(nodeOutput, file), join(nodeSource, linkedNames.get(file)!));
+  for (const dependency of dependencies) {
+    if (!dependency.nodePackage) throw new Error(`Missing Node binding for ${dependency.crate}`);
+    const namespace = dependency.crate.replaceAll("-", "_");
+    for (const file of readdirSync(nodeOutput).filter((file) => file.endsWith(".ts"))) {
+      const path = join(nodeOutput, file);
+      const source = readFileSync(path, "utf8")
+        .replace(
+          new RegExp(`import (\\w+) from ["']\\./${namespace}["'];`, "g"),
+          `import { uniffiModule as $1 } from "${dependency.nodePackage}";`,
+        )
+        .replaceAll(`'./${namespace}'`, `'${dependency.nodePackage}'`)
+        .replaceAll(`"./${namespace}"`, `"${dependency.nodePackage}"`);
+      writeFileSync(path, source);
     }
-  } else {
-    replaceGenerated(join(nodeOutput, `${libraryName}.ts`), generatedFiles[0]);
-    replaceGenerated(join(nodeOutput, `${libraryName}-ffi.ts`), generatedFiles[1]);
-    writeFileSync(
-      nodeBindings,
-      readFileSync(nodeBindings, "utf8").replaceAll(`./${libraryName}`, "./_bindings"),
-    );
-    writeFileSync(
-      generatedFiles[0],
-      readFileSync(generatedFiles[0], "utf8").replaceAll(`./${libraryName}-ffi`, "./_bindings-ffi"),
-    );
-  }
-  if (linkedComponents) {
-    for (const file of [nodeBindings, ...generatedFiles]) {
-      let source = readFileSync(file, "utf8");
-      for (const [generated, destination] of linkedNames) {
-        const from = generated.slice(0, -3);
-        const to = destination.slice(0, -3);
-        source = source
-          .replaceAll(`'./${from}'`, `'./${to}'`)
-          .replaceAll(`"./${from}"`, `"./${to}"`);
-      }
-      writeFileSync(file, source);
+    for (const suffix of [".ts", "-ffi.ts"]) {
+      const file = `${namespace}${suffix}`;
+      rmSync(join(nodeOutput, file), { force: true });
+      const index = generatedModules.indexOf(file);
+      if (index >= 0) generatedModules.splice(index, 1);
     }
   }
+  const ownModules = generatedModules.filter(
+    (file) => file === `${libraryName}.ts` || file === `${libraryName}-ffi.ts`,
+  );
+  if (ownModules.length !== 2 || generatedModules.length !== 2) {
+    throw new Error(`Unmapped UniFFI components in ${crate}: ${generatedModules.join(", ")}`);
+  }
+  writeFileSync(
+    join(nodeOutput, "index.ts"),
+    [
+      `export * from './${libraryName}';`,
+      `import uniffiModule from './${libraryName}';`,
+      "uniffiModule.initialize();",
+      "export { uniffiModule };",
+      "export async function uniffiInitAsync() {}",
+      "",
+    ].join("\n"),
+  );
+  const nodeBindings = join(nodeSource, "bindings.ts");
+  const generatedFiles = [join(nodeSource, "_bindings.ts"), join(nodeSource, "_bindings-ffi.ts")];
+  replaceGenerated(join(nodeOutput, "index.ts"), nodeBindings);
+  replaceGenerated(join(nodeOutput, libraryName + ".ts"), generatedFiles[0]);
+  replaceGenerated(join(nodeOutput, libraryName + "-ffi.ts"), generatedFiles[1]);
+  writeFileSync(
+    nodeBindings,
+    readFileSync(nodeBindings, "utf8").replaceAll("./" + libraryName, "./_bindings"),
+  );
+  writeFileSync(
+    generatedFiles[0],
+    readFileSync(generatedFiles[0], "utf8").replaceAll(
+      "./" + libraryName + "-ffi",
+      "./_bindings-ffi",
+    ),
+  );
   for (const file of generatedFiles) {
     writeFileSync(file, makeDefaultedInterfaceParametersOptional(readFileSync(file, "utf8")));
   }
@@ -176,6 +204,13 @@ if (values.node) {
     ),
   );
   for (const file of [nodeBindings, ...generatedFiles]) {
+    // Consumers type-check these files through workspace source exports, while
+    // the generated runtime internals are validated by UniFFI's own build.
+    const source = addTypeScriptExtensionsToBindingImports(readFileSync(file, "utf8")).replace(
+      /[ \t]+$/gm,
+      "",
+    );
+    writeFileSync(file, `/* eslint-disable */\n// @ts-nocheck\n${source}`);
     stampGenerated(file, {
       tool: "UniFFI binding generation",
       source: `the ${crate} Rust exports`,
@@ -206,31 +241,26 @@ if (values.python) {
     crate.replace(/^dbx-tools-/, "").replaceAll("-", "_"),
   );
   const pythonOutput = mkdtempSync(join(tmpdir(), `${libraryName}-python-`));
-  run("cargo", [
-    "run",
-    "--release",
-    "--package",
-    crate,
-    "--bin",
-    "uniffi-bindgen",
-    "--",
-    "generate",
-    "--language",
-    "python",
-    "--out-dir",
-    pythonOutput,
-    library,
-  ]);
+  run(
+    join(targetDirectory, `${crate}-uniffi-bindgen${process.platform === "win32" ? ".exe" : ""}`),
+    [
+      "generate",
+      "--language",
+      "python",
+      "--crate",
+      libraryName,
+      "--out-dir",
+      pythonOutput,
+      library,
+    ],
+  );
   const generated = join(pythonOutput, `${libraryName}.py`);
   const pythonBindings = join(pythonPackage, "bindings.py");
   replaceGenerated(generated, pythonBindings);
   stampGeneratedPython(pythonBindings);
   const pythonInit = join(pythonPackage, "__init__.py");
   if (!existsSync(pythonInit)) {
-    writeFileSync(
-      pythonInit,
-      `\"\"\"Python bindings for ${crate}.\"\"\"\n\nfrom .bindings import *  # noqa: F403\n`,
-    );
+    writeFileSync(pythonInit, "");
   }
   const pythonLibrary = join(pythonPackage, basename(library));
   makeWritable(pythonLibrary);