@dbx-tools/projen 0.6.163 → 0.6.174

package/README.md

@@ -93,13 +93,37 @@ VS Code component; dbx-tools reuses it rather than constructing a second
 configurable `root` (default `packages/rs`), generates its Cargo manifest, and
 derives the crate name and repository from the parent project. A crate containing
 `uniffi::setup_scaffolding!()`
-automatically wires matching private Node and Python binding packages using the
+automatically wires matching public Node and Python binding packages using the
 same capability name. Repository-specific dependencies and features remain
 declarative options in `.projenrc.ts`; generated bindings are built separately
-from projen synthesis.
+from projen synthesis. Target-independent Node binding TypeScript is committed
+and remains generated/read-only, while native libraries stay ignored. Node
+facades compile to `lib/` and publish JavaScript entry points that plain Node
+can load from `node_modules`. A complete `bindings.ts` / `_bindings.ts` /
+`_bindings-ffi.ts` triplet is exported directly from the generated package
+barrel. Python keeps `bindings.py` as the generated implementation and exports
+its public names from a fully generated `__init__.py` with no editable marker
+blocks. Node generation fails when direct binding names conflict with another
+package-root export; Python generation refuses to overwrite a non-generated
+package root. Do not create a `nodeExports` binding subpath or a handwritten
+type facade.
+
+Rust dependencies between binding-enabled workspace crates become Node
+`workspace:*` and Python `internalDependencies` automatically. Python generation
+selects the owning crate and supplies `external_packages` imports. UBRN currently
+emits every linked component; the generation task discards dependency outputs
+and rewrites their imports to the owning package root, including its generated
+`uniffiModule` converter table. It never copies a dependency's records or enums.
+Foreign callback adapters must first be wrapped in an object created by their
+own native library (`createStorageHandle` for auth), because callback registries
+are library-local. Release wheels replace sibling Git requirements with matching
+native-wheel versions, and dependent publishers wait for their dependencies.
+Each crate builds its own `<crate>-uniffi-bindgen` executable so a workspace
+build has no colliding binary outputs. Packaging runs that prebuilt executable.
 
 `sync --watch` runs a focused Rust watcher beside the OpenAPI watcher. Changes
-inside an existing UniFFI crate regenerate only that crate's bindings; adding or
+inside an existing UniFFI crate regenerate that crate and its dependent bindings
+in dependency order; adding or
 removing a crate or `setup_scaffolding!()` marker triggers a full synth. Repos
 without Rust crates start no Rust watcher. When Rust projects are detected,
 Cargo is required and the focused task fails immediately if it is unavailable.
@@ -113,44 +137,27 @@ both the tag target and `HEAD` to equal that SHA before building. Its matrix has
 one row per target. Each row installs native dependencies and restores
 Cargo/sccache once,
 builds the Rust workspace once, then packages every discovered output from that
-shared build. Bun and the workspace install are present only when a Node binding
-needs TypeScript generation; uv is present only when a Python wheel is needed.
+shared build. Rust rows package native npm archives and Python wheels; they do
+not install Bun or UBRN and do not build Node facades.
 A new dispatch cancels queued and in-progress release and docs workflows before
 starting, and each workflow's concurrency group also cancels its previous run.
-A binary-only workspace therefore installs neither. `rustVersion` remains the
+A binary-only workspace therefore installs no language package tool. `rustVersion` remains the
 MSRV recorded in package manifests, while `releaseRustVersion` independently
-defaults release compilation to `stable`. UBRN uses that same release toolchain
-unless `ubrnRustVersion` explicitly selects another one.
-
-Generated build and release workflows share the Bun cache helpers from
-`bun-workflow.ts`. One `BUN_VERSION` value drives setup and cache keys, while a
-generated dependency-only fingerprint keeps release version bumps from
-invalidating Bun's global package cache. `node_modules` remains uncached.
-
-The final host UBRN executable is cached by pinned UBRN version, Rust toolchain,
-runner OS, and runner architecture. A hit skips both the workspace `bun install`
-and the UBRN Cargo build. Release packaging passes the cached executable directly
-to the Node binding generator and keeps the package barrel copied from source,
-so it does not need the installed projen dependency graph. A miss saves the
-validated executable immediately, before workspace build and packaging can fail.
-Bun runtime setup still runs because the binding generator is TypeScript. Cargo registry caches
+defaults release compilation to `stable`.
+Stable Windows rows verify and use the hosted runner's installed Rust toolchain
+and select `rust-lld` for the workspace build. Cargo registry caches
 and the `SCCACHE_GHA_VERSION` namespace stay stable per target/toolchain across
 version tags. Cache keys, restore results, sccache statistics, and phase timings
 are written to each build log. Python generation executes the already-built
-`target/<triple>/release/uniffi-bindgen` directly. Artifact packaging therefore
+`target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 
-Artifacts identify their crate, target, and type. Download-only publication
-jobs publish native npm platform archives before the facade and publish
-platform-tagged Python wheels without checkout, Bun, or `bun install`.
-Non-private Cargo crates publish from a source-only job with
-`cargo publish --no-verify`; GitHub Release uploads likewise consume prebuilt
-binary artifacts without reinstalling a toolchain.
-
-Set the repository variable `LOCAL_REPOSITORIES=true` to enable generated
-self-hosted publication from the prebuilt artifacts. Configure `LOCAL_NPM_REGISTRY` and
-`LOCAL_PYPI_PUBLISH_URL` with their matching `LOCAL_*` credentials. Set
-`LOCAL_CARGO_REGISTRY` to a named Cargo registry such as a loopback
+Artifacts identify their crate, target, and type. `rust-release` publishes
+non-private Cargo crates with `cargo publish --no-verify`, uploads requested
+binary assets to the GitHub release, then dispatches the verified Rust run id
+with the tag and SHA. It never publishes npm or PyPI packages.
+
+Set `LOCAL_CARGO_REGISTRY` to a named Cargo registry such as a loopback
 [Kellnr](https://kellnr.io/) instance and provide `LOCAL_CARGO_TOKEN`. Public
 Cargo crates also publish directly to crates.io
 with `CARGO_REGISTRY_TOKEN`. Override `releaseTargets` only when a consumer has
@@ -161,12 +168,19 @@ architecture. Omit both filters to regenerate the complete maintained matrix.
 `DBX_TOOLS_RELEASE_PLATFORMS` can select the generated matrix without repeating
 environment parsing in a consumer.
 
-Private Python binding projects are marked with `[tool.dbx-tools] private =
-true`. They stay out of the standard uv/Python release and docs surfaces;
-`rust-release` publishes their prebuilt native wheels directly.
-After Rust's public artifacts finish, it dispatches the downstream `release`
-event. Python, Node, standalone Node, and docs consume that event independently
-and start together with the same verified tag and SHA. Without Rust,
+Public UniFFI facades are marked with `dbxToolsConfig.uniffi = true` in Node
+manifests and `[tool.dbx_tools.config] uniffi = true` in Python manifests. The
+Node release downloads and publishes native archives first, publishes normal
+workspace packages, then builds and publishes facades from the committed
+generated TypeScript in dependency order. The Python release downloads every
+platform wheel and publishes them from one trusted-publisher job per
+distribution. The docs generators include them because they are publicly installable.
+When a conventional Node binding path already belongs to a root subproject,
+Rust mapping reuses that project and adds binding dependencies and metadata to
+its existing manifest.
+After Rust's artifacts finish, it dispatches the downstream `release` event
+with its run id and attempt. Python, Node, and docs consume that event
+independently with the same verified tag and SHA. Without Rust,
 `release-dispatch` sends that event immediately. Configure release GitHub
 environments to permit the generated release branch; the trusted-publisher
 instructions list that branch with the workflow and environment identity PyPI
@@ -249,8 +263,9 @@ never as a blanket `<package>/src/**`. A codegen package may hold hand-written
 modules beside its generated ones, and those must stay linted.
 
 `generateBarrels()` writes package-root `index.ts` barrels with module
-namespaces and flat unique type exports, returning the number that actually
-changed. A name two modules both declare is ambiguous and stays namespace-only —
+namespaces, flat unique type exports, `PACKAGE_IDENTIFIER`, and
+`PACKAGE_VERSION`, returning the number that actually changed. A name two
+modules both declare is ambiguous and stays namespace-only —
 except when one of them is generated: the hand-written module is the curated view
 of the generated shape (`shared-genie`'s `genie-model.ts` extends its own
 codegen'd `dashboards.ts`), so it owns the name and stays hoisted. A barrel whose export surface is unchanged is left untouched,

package/index.ts

@@ -3,6 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
+export const PACKAGE_VERSION = "0.6.173";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -58,7 +59,7 @@ export { DOWNSTREAM_RELEASE_EVENT, RUST_RELEASE_EVENT, RELEASE_TAG, RELEASE_SHA
 export { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS } from "./src/tags.ts";
 export type { PackageTag } from "./src/tags.ts";
 export { DBXToolsRootTsconfig } from "./src/tsconfig.ts";
-export { makeDefaultedInterfaceParametersOptional, addExplicitInterfaceReexports } from "./src/uniffi.ts";
+export { makeDefaultedInterfaceParametersOptional, addTypeScriptExtensionsToBindingImports, addExplicitInterfaceReexports } from "./src/uniffi.ts";
 export type { TypeScriptBindingModule } from "./src/uniffi.ts";
 export { DBXToolsVsCode } from "./src/vscode.ts";
 export type { IgnoreGroupOptions } from "./src/watch.ts";

package/package.json

@@ -2,7 +2,6 @@
   "name": "@dbx-tools/projen",
   "scripts": {
     "build": "projen build",
-    "bump": "projen bump",
     "clobber": "projen clobber",
     "compile": "projen compile",
     "default": "projen default",
@@ -26,9 +25,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.163",
-    "@dbx-tools/path": "0.6.163",
-    "@dbx-tools/shared-core": "0.6.163",
+    "@dbx-tools/core": "0.6.174",
+    "@dbx-tools/path": "0.6.174",
+    "@dbx-tools/shared-core": "0.6.174",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -48,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.163",
+  "version": "0.6.174",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/barrels.ts

@@ -16,6 +16,12 @@
  * takes priority. This keeps the barrel auto-generated while letting you add or
  * override individual exports.
  *
+ * A UniFFI source triplet (`bindings.ts`, `_bindings.ts`, and
+ * `_bindings-ffi.ts`) is one special case: the internal underscore modules stay
+ * private, while `bindings.ts` is re-exported directly instead of under a
+ * `bindings` namespace. Generation fails when one of those direct binding names
+ * conflicts with another top-level package export.
+ *
  * Each eligible module becomes `export * as <name> from "./src/x.ts"` (camelCase
  * namespace from its path segments; invalid identifiers suffixed with `Module`),
  * sorted by module path.
@@ -28,9 +34,10 @@
  * `export { ... }`. The module namespaces stay either way, so a namespaced call
  * site keeps working.
  *
- * Every generated barrel also exports `PACKAGE_IDENTIFIER` from the package's own
- * `package.json`. Runtime helpers can retain the package specifier without
- * trying to recover it from an ESM namespace object or loader function.
+ * Every generated barrel also exports `PACKAGE_IDENTIFIER` and
+ * `PACKAGE_VERSION` from the package's own `package.json`. Runtime helpers can
+ * retain package identity without trying to recover it from an ESM namespace
+ * object or loader function.
  *
  * Uniqueness is tallied over types and values TOGETHER: a name carried by two
  * modules is ambiguous whichever kind it is, and hoisting one module's value
@@ -107,10 +114,16 @@ const BARREL_HEADER: HeaderOpts = {
   source: "the exporting modules in ./src",
 };
 
-/** Generated package identity export, reserved against source-module hoisting. */
+/** Generated package metadata exports, reserved against source-module hoisting. */
 const PACKAGE_IDENTIFIER_EXPORT = "PACKAGE_IDENTIFIER";
+const PACKAGE_VERSION_EXPORT = "PACKAGE_VERSION";
 const PACKAGE_IDENTIFIER_LINE = `export const ${PACKAGE_IDENTIFIER_EXPORT} = "";`;
+const PACKAGE_VERSION_LINE = `export const ${PACKAGE_VERSION_EXPORT} = "";`;
 const PACKAGE_IDENTIFIER_LINE_RE = /^export const PACKAGE_IDENTIFIER = .*;$/m;
+const PACKAGE_VERSION_LINE_RE = /^export const PACKAGE_VERSION = .*;$/m;
+const UNIFFI_BINDINGS_FILE = "bindings.ts";
+const UNIFFI_GENERATED_FILE = "_bindings.ts";
+const UNIFFI_FFI_FILE = "_bindings-ffi.ts";
 
 /** `pnpm-workspace` -> `pnpmWorkspace`; `local-fs` -> `localFS` (`fs` -> `FS`). */
 function kebabToCamel(segment: string): string {
@@ -266,8 +279,9 @@ function customExportNames(file: string): Set<string> {
  * `export * as`), then the whole module is re-exported last.
  */
 function mergeCustomExports(content: string, pkgDir: string): string {
-  if (!existsSync(join(pkgDir, CUSTOM_EXPORTS_FILE))) return content;
-  const overridden = customExportNames(join(pkgDir, CUSTOM_EXPORTS_FILE));
+  const customPath = join(pkgDir, CUSTOM_EXPORTS_FILE);
+  if (!existsSync(customPath) || isLegacyBindingsExport(customPath)) return content;
+  const overridden = customExportNames(customPath);
   const kept = content.split("\n").filter((line) => {
     const ns = /^export \* as (\w+) from /.exec(line)?.[1];
     return !(ns && overridden.has(ns));
@@ -275,29 +289,101 @@ function mergeCustomExports(content: string, pkgDir: string): string {
   return `${kept.join("\n").replace(/\n+$/, "")}\nexport * from "./exports.ts";\n`;
 }
 
-/** Read the authoritative npm package name emitted by the package project. */
-function packageIdentifier(pkgDir: string): string {
+function isLegacyBindingsExport(file: string): boolean {
+  return readFileSync(file, "utf8").trim() === 'export * from "./src/bindings.ts";';
+}
+
+function hasUniFFIBindings(srcDir: string): boolean {
+  return [UNIFFI_BINDINGS_FILE, UNIFFI_GENERATED_FILE, UNIFFI_FFI_FILE].every((file) =>
+    existsSync(join(srcDir, file)),
+  );
+}
+
+function bindingExportNames(srcDir: string): Set<string> {
+  return new Set(
+    [UNIFFI_BINDINGS_FILE, UNIFFI_GENERATED_FILE].flatMap((file) =>
+      moduleExports(join(srcDir, file)).map((entry) => entry.name),
+    ),
+  );
+}
+
+function barrelExportNames(content: string, customPath: string): Set<string> {
+  const names = new Set<string>([PACKAGE_IDENTIFIER_EXPORT, PACKAGE_VERSION_EXPORT]);
+  for (const match of content.matchAll(/^export \* as (\w+) from /gm)) {
+    names.add(match[1]!);
+  }
+  for (const match of content.matchAll(/^export(?: type)? \{([^}]+)\} from /gm)) {
+    for (const specifier of match[1]!.split(",")) {
+      const parts = specifier.trim().split(/\s+as\s+/);
+      const name = parts.at(-1);
+      if (name) names.add(name);
+    }
+  }
+  if (existsSync(customPath) && !isLegacyBindingsExport(customPath)) {
+    const statements = moduleStatements(customPath) as ReadonlyArray<{
+      type: string;
+      exported?: unknown;
+    }>;
+    if (
+      statements.some(
+        (statement) => statement.type === "ExportAllDeclaration" && !statement.exported,
+      )
+    ) {
+      throw new Error(
+        `Cannot verify UniFFI export conflicts through a bare export in ${customPath}`,
+      );
+    }
+    for (const name of customExportNames(customPath)) names.add(name);
+  }
+  return names;
+}
+
+function assertNoBindingExportConflicts(srcDir: string, content: string, customPath: string): void {
+  const other = barrelExportNames(content, customPath);
+  const conflicts = [...bindingExportNames(srcDir)].filter((name) => other.has(name)).sort();
+  if (conflicts.length > 0) {
+    throw new Error(
+      `UniFFI binding exports conflict with package exports in ${srcDir}: ${conflicts.join(", ")}`,
+    );
+  }
+}
+
+/** Read the authoritative npm package name and version emitted by the package project. */
+function packageMetadata(pkgDir: string): { identifier: string; version: string } {
   const manifestPath = join(pkgDir, "package.json");
-  const name = existsSync(manifestPath)
-    ? json.parseRecord(readFileSync(manifestPath, "utf8"))?.name
+  const manifest = existsSync(manifestPath)
+    ? json.parseRecord(readFileSync(manifestPath, "utf8"))
     : undefined;
+  const name = manifest?.name;
   if (typeof name !== "string" || !name.trim()) {
     throw new Error(`Cannot generate barrel without package.json name: ${manifestPath}`);
   }
-  return name;
+  const version = manifest?.version;
+  if (typeof version !== "string" || !version.trim()) {
+    throw new Error(`Cannot generate barrel without package.json version: ${manifestPath}`);
+  }
+  return { identifier: name, version };
 }
 
-/** Normalize package identity so structural barrel comparisons need no manifest read. */
-function withoutPackageIdentifier(content: string): string {
-  return content.replace(PACKAGE_IDENTIFIER_LINE_RE, PACKAGE_IDENTIFIER_LINE);
+/** Normalize package metadata before comparing the barrel's export structure. */
+function withoutPackageMetadata(content: string): string {
+  return content
+    .replace(PACKAGE_IDENTIFIER_LINE_RE, PACKAGE_IDENTIFIER_LINE)
+    .replace(PACKAGE_VERSION_LINE_RE, PACKAGE_VERSION_LINE);
 }
 
-/** Resolve and insert package identity only when a barrel is about to be written. */
-function withPackageIdentifier(content: string, pkgDir: string): string {
-  const line = `export const ${PACKAGE_IDENTIFIER_EXPORT} = ${JSON.stringify(
-    packageIdentifier(pkgDir),
-  )};`;
-  return content.replace(PACKAGE_IDENTIFIER_LINE_RE, () => line);
+/** Resolve and insert package metadata when a barrel is about to be written. */
+function withPackageMetadata(content: string, pkgDir: string): string {
+  const metadata = packageMetadata(pkgDir);
+  return content
+    .replace(
+      PACKAGE_IDENTIFIER_LINE_RE,
+      () => `export const ${PACKAGE_IDENTIFIER_EXPORT} = ${JSON.stringify(metadata.identifier)};`,
+    )
+    .replace(
+      PACKAGE_VERSION_LINE_RE,
+      () => `export const ${PACKAGE_VERSION_EXPORT} = ${JSON.stringify(metadata.version)};`,
+    );
 }
 
 /**
@@ -353,6 +439,10 @@ function generateForPackage(pkgDir: string): number {
     if (!existing || (!isSourceExt(existing) && isSourceExt(f))) byModulePath.set(stem, f);
   }
   const modulePaths = [...byModulePath.keys()].sort((a, b) => a.localeCompare(b));
+  const uniffiBindings = hasUniFFIBindings(srcDir);
+  const namespacedModulePaths = uniffiBindings
+    ? modulePaths.filter((modulePath) => modulePath !== "bindings")
+    : modulePaths;
 
   // No eligible modules -> no barrel: drop any stale root barrel and bail.
   if (modulePaths.length === 0) {
@@ -368,35 +458,45 @@ function generateForPackage(pkgDir: string): number {
   // extension is written because `tsc` rewrites it on emit
   // (`rewriteRelativeImportExtensions`) - an extensionless specifier would be
   // copied through verbatim and Node's ESM resolver cannot probe for it.
-  const namespaceExports = modulePaths
+  const namespaceExports = namespacedModulePaths
     .map((stem) => {
       const modulePath = `./src/${byModulePath.get(stem)!}`;
       return `export * as ${modulePathToNamespace(modulePath)} from "${modulePath}";`;
     })
     .join("\n");
-  let content = `${PACKAGE_IDENTIFIER_LINE}\n${namespaceExports}`;
+  let content = `${PACKAGE_IDENTIFIER_LINE}\n${PACKAGE_VERSION_LINE}\n${namespaceExports}`;
   // Hoist package-unique named exports to the top level. Names a hand-authored
   // `exports.ts` declares are suppressed so that file stays authoritative.
   const customPath = join(pkgDir, CUSTOM_EXPORTS_FILE);
-  const suppress = existsSync(customPath) ? customExportNames(customPath) : new Set<string>();
+  const suppress =
+    existsSync(customPath) && !isLegacyBindingsExport(customPath)
+      ? customExportNames(customPath)
+      : new Set<string>();
   suppress.add(PACKAGE_IDENTIFIER_EXPORT);
+  suppress.add(PACKAGE_VERSION_EXPORT);
   content = hoistUniqueExports(content, pkgDir, suppress);
   // A sibling `exports.ts` overrides/extends the generated barrel and wins on conflict.
   content = mergeCustomExports(content, pkgDir);
+  if (uniffiBindings) {
+    assertNoBindingExportConflicts(srcDir, content, customPath);
+    content = content.replace(
+      PACKAGE_VERSION_LINE,
+      `${PACKAGE_VERSION_LINE}\nexport * from "./src/bindings.ts";`,
+    );
+  }
 
-  // The barrel only *changes* when its export structure does. Package identity is
-  // blanked on both sides of this comparison, so a no-op cycle never reads
-  // package.json merely to reconstruct a value the existing barrel already has.
-  // If the structural result matches what's on disk, leave the file - and its
-  // read-only bit - completely untouched and report no change (0). This keeps the
-  // watcher quiet on ordinary in-file edits (which leave the export * as … list
-  // identical), and it is also what keeps a no-op cycle off the read-only bit
-  // entirely: see {@link writeBarrel} for why unlocking a barrel we are not about
-  // to rewrite is what produced spurious EACCES failures.
+  // Package metadata is blanked for the structural comparison, then restored
+  // from package.json so a version-only change still rewrites the barrel.
+  // If the structural result and package metadata match what's on disk, leave
+  // the file and its read-only bit untouched and report no change (0). This
+  // keeps the watcher quiet on ordinary in-file edits while allowing a version
+  // bump to update PACKAGE_VERSION.
   content = `${content.replace(/\n+$/, "")}\n`;
   const template = `${header(BARREL_HEADER)}\n${content}`;
-  if (before !== undefined && withoutPackageIdentifier(before) === template) return 0;
-  const next = withPackageIdentifier(template, pkgDir);
+  const next = withPackageMetadata(template, pkgDir);
+  if (before !== undefined && withoutPackageMetadata(before) === template && before === next) {
+    return 0;
+  }
 
   // Written whole (header included) rather than via `stampGenerated`, which would
   // re-read and rewrite the file to prepend the same header - a second write, and

package/src/project-js.ts

@@ -446,13 +446,13 @@ function defaultProjectOptions(
     devDeps: ["@types/node@^24.6.0"],
     ...(isRoot
       ? {
-          prettier: true,
-          prettierOptions: {
-            settings: PRETTIER_SETTINGS,
-            ignoreFile: true,
-            ignoreFileOptions: { ignorePatterns: [...ignore.ignorePatterns({ test: false })] },
-          },
-        }
+        prettier: true,
+        prettierOptions: {
+          settings: PRETTIER_SETTINGS,
+          ignoreFile: true,
+          ignoreFileOptions: { ignorePatterns: [...ignore.ignorePatterns({ test: false })] },
+        },
+      }
       : {}),
     ...options,
     ...copiedGitIgnoreOptions(options),
@@ -495,24 +495,23 @@ function defaultTypeScriptProjectOptions(
     // ESLint is configured once on the ROOT (see initProject) and lints the whole
     // tree, so packages don't emit their own config. A caller can still override.
     eslint: false,
-    devDeps: [...(base.devDeps ?? []), "typescript@^5.9.3", "@types/bun@^1.3.14"],
+    devDeps: [...(base.devDeps ?? []), "typescript@^5.9.3", `@types/bun@${BUN_VERSION}`],
     ...options,
     ...copiedGitIgnoreOptions(options),
   };
 }
 
-// Pinned to match the subproject defaults so bun resolves a single typescript
-// across the workspace (a bare name -> `*` could pull a second, newer major).
-// `@types/bun` gives the `Bun.*` globals the server/app tags now use.
-const DEV_DEPS_ROOT: string[] = ["typescript@^5.9.3", "@types/bun@^1.3.14"];
+// Pinned to match the subproject defaults so bun resolves one TypeScript and
+// one runtime-compatible set of Bun globals across the workspace.
+const DEV_DEPS_ROOT: string[] = ["typescript@^5.9.3", `@types/bun@${BUN_VERSION}`];
 
 /** Options for {@link DBXToolsNodeProject} (the monorepo root). */
 export interface DBXToolsJavaScriptProjectOptions
   extends
-    CommonProjectOptions,
-    Partial<javascript.NodeProjectOptions>,
-    DBXToolsConfigOptions,
-    DBXToolsPNPMWorkspaceOptions {
+  CommonProjectOptions,
+  Partial<javascript.NodeProjectOptions>,
+  DBXToolsConfigOptions,
+  DBXToolsPNPMWorkspaceOptions {
   /**
    * The npm scope for generated package names (`@<scope>/<seg-...>`). Defaults to
    * the (resolved) project name; a leading `@` is optional.
@@ -593,8 +592,7 @@ export interface DBXToolsTypeScriptProjectOptions
  */
 export class DBXToolsNodeProject
   extends javascript.NodeProject
-  implements DBXToolsJavaScriptProject
-{
+  implements DBXToolsJavaScriptProject {
   readonly language = "javascript" as const;
   readonly scope: string;
   readonly dbxToolsConfig: DBXToolsConfig;
@@ -694,8 +692,8 @@ export const ROOT_INSTALL_ONLY_MIXIN = mixin.create(
       installDependencies(trigger: unknown): void;
       logInstallTrigger(trigger: unknown): void;
     };
-    nodePackage.installDependencies = () => {};
-    nodePackage.logInstallTrigger = () => {};
+    nodePackage.installDependencies = () => { };
+    nodePackage.logInstallTrigger = () => { };
   },
 );
 
@@ -708,8 +706,7 @@ export const ROOT_INSTALL_ONLY_MIXIN = mixin.create(
  */
 export class DBXToolsTypeScriptProject
   extends typescript.TypeScriptProject
-  implements DBXToolsJavaScriptProject
-{
+  implements DBXToolsJavaScriptProject {
   readonly language = "javascript" as const;
   readonly scope: string;
   readonly dbxToolsConfig: DBXToolsConfig;