@dbx-tools/projen 0.6.168 → 0.6.174

package/README.md

@@ -93,15 +93,20 @@ VS Code component; dbx-tools reuses it rather than constructing a second
 configurable `root` (default `packages/rs`), generates its Cargo manifest, and
 derives the crate name and repository from the parent project. A crate containing
 `uniffi::setup_scaffolding!()`
-automatically wires matching private Node and Python binding packages using the
+automatically wires matching public Node and Python binding packages using the
 same capability name. Repository-specific dependencies and features remain
 declarative options in `.projenrc.ts`; generated bindings are built separately
 from projen synthesis. Target-independent Node binding TypeScript is committed
 and remains generated/read-only, while native libraries stay ignored. Node
 facades compile to `lib/` and publish JavaScript entry points that plain Node
-can load from `node_modules`. The generated barrel exports the binding API from
-the package root. Do not create a `nodeExports` binding subpath or a
-handwritten type facade.
+can load from `node_modules`. A complete `bindings.ts` / `_bindings.ts` /
+`_bindings-ffi.ts` triplet is exported directly from the generated package
+barrel. Python keeps `bindings.py` as the generated implementation and exports
+its public names from a fully generated `__init__.py` with no editable marker
+blocks. Node generation fails when direct binding names conflict with another
+package-root export; Python generation refuses to overwrite a non-generated
+package root. Do not create a `nodeExports` binding subpath or a handwritten
+type facade.
 
 Rust dependencies between binding-enabled workspace crates become Node
 `workspace:*` and Python `internalDependencies` automatically. Python generation
@@ -132,31 +137,13 @@ both the tag target and `HEAD` to equal that SHA before building. Its matrix has
 one row per target. Each row installs native dependencies and restores
 Cargo/sccache once,
 builds the Rust workspace once, then packages every discovered output from that
-shared build. Bun and the workspace install are present only when a Node binding
-needs TypeScript generation; uv is present only when a Python wheel is needed.
+shared build. Rust rows package native npm archives and Python wheels; they do
+not install Bun or UBRN and do not build Node facades.
 A new dispatch cancels queued and in-progress release and docs workflows before
 starting, and each workflow's concurrency group also cancels its previous run.
-A binary-only workspace therefore installs neither. `rustVersion` remains the
+A binary-only workspace therefore installs no language package tool. `rustVersion` remains the
 MSRV recorded in package manifests, while `releaseRustVersion` independently
-defaults release compilation to `stable`. UBRN uses that same release toolchain
-unless `ubrnRustVersion` explicitly selects another one.
-
-Generated build and release workflows share the Bun cache helpers from
-`bun-workflow.ts`. One `BUN_VERSION` value drives setup and cache keys, while a
-generated dependency-only fingerprint keeps release version bumps from
-invalidating Bun's global package cache. `node_modules` remains uncached.
-
-The final host UBRN executable is cached by pinned UBRN version, Rust toolchain,
-runner OS, and runner architecture. A hit skips both the workspace `bun install`
-and the UBRN Cargo build. Release packaging passes the cached executable directly
-to the Node binding generator and keeps the package barrel copied from source,
-so it does not need the installed projen dependency graph. A miss saves the
-validated executable immediately, before workspace build and packaging can fail.
-Bun runtime setup still runs in the single facade row because the binding
-generator and facade bundle are TypeScript. The bundle points its type surface
-at the committed generated source and needs no standalone TypeScript compiler
-or workspace install on a UBRN cache hit. Non-facade rows skip the complete
-Bun/UBRN path.
+defaults release compilation to `stable`.
 Stable Windows rows verify and use the hosted runner's installed Rust toolchain
 and select `rust-lld` for the workspace build. Cargo registry caches
 and the `SCCACHE_GHA_VERSION` namespace stay stable per target/toolchain across
@@ -165,17 +152,12 @@ are written to each build log. Python generation executes the already-built
 `target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 
-Artifacts identify their crate, target, and type. Download-only publication
-jobs publish native npm platform archives before the facade and publish
-platform-tagged Python wheels without checkout, Bun, or `bun install`.
-Non-private Cargo crates publish from a source-only job with
-`cargo publish --no-verify`; GitHub Release uploads likewise consume prebuilt
-binary artifacts without reinstalling a toolchain.
-
-Set the repository variable `LOCAL_REPOSITORIES=true` to enable generated
-self-hosted publication from the prebuilt artifacts. Configure `LOCAL_NPM_REGISTRY` and
-`LOCAL_PYPI_PUBLISH_URL` with their matching `LOCAL_*` credentials. Set
-`LOCAL_CARGO_REGISTRY` to a named Cargo registry such as a loopback
+Artifacts identify their crate, target, and type. `rust-release` publishes
+non-private Cargo crates with `cargo publish --no-verify`, uploads requested
+binary assets to the GitHub release, then dispatches the verified Rust run id
+with the tag and SHA. It never publishes npm or PyPI packages.
+
+Set `LOCAL_CARGO_REGISTRY` to a named Cargo registry such as a loopback
 [Kellnr](https://kellnr.io/) instance and provide `LOCAL_CARGO_TOKEN`. Public
 Cargo crates also publish directly to crates.io
 with `CARGO_REGISTRY_TOKEN`. Override `releaseTargets` only when a consumer has
@@ -186,12 +168,19 @@ architecture. Omit both filters to regenerate the complete maintained matrix.
 `DBX_TOOLS_RELEASE_PLATFORMS` can select the generated matrix without repeating
 environment parsing in a consumer.
 
-Private Python binding projects are marked with `[tool.dbx-tools] private =
-true`. They stay out of the standard uv/Python release and docs surfaces;
-`rust-release` publishes their prebuilt native wheels directly.
-After Rust's public artifacts finish, it dispatches the downstream `release`
-event. Python, Node, standalone Node, and docs consume that event independently
-and start together with the same verified tag and SHA. Without Rust,
+Public UniFFI facades are marked with `dbxToolsConfig.uniffi = true` in Node
+manifests and `[tool.dbx_tools.config] uniffi = true` in Python manifests. The
+Node release downloads and publishes native archives first, publishes normal
+workspace packages, then builds and publishes facades from the committed
+generated TypeScript in dependency order. The Python release downloads every
+platform wheel and publishes them from one trusted-publisher job per
+distribution. The docs generators include them because they are publicly installable.
+When a conventional Node binding path already belongs to a root subproject,
+Rust mapping reuses that project and adds binding dependencies and metadata to
+its existing manifest.
+After Rust's artifacts finish, it dispatches the downstream `release` event
+with its run id and attempt. Python, Node, and docs consume that event
+independently with the same verified tag and SHA. Without Rust,
 `release-dispatch` sends that event immediately. Configure release GitHub
 environments to permit the generated release branch; the trusted-publisher
 instructions list that branch with the workflow and environment identity PyPI
@@ -274,8 +263,9 @@ never as a blanket `<package>/src/**`. A codegen package may hold hand-written
 modules beside its generated ones, and those must stay linted.
 
 `generateBarrels()` writes package-root `index.ts` barrels with module
-namespaces and flat unique type exports, returning the number that actually
-changed. A name two modules both declare is ambiguous and stays namespace-only —
+namespaces, flat unique type exports, `PACKAGE_IDENTIFIER`, and
+`PACKAGE_VERSION`, returning the number that actually changed. A name two
+modules both declare is ambiguous and stays namespace-only —
 except when one of them is generated: the hand-written module is the curated view
 of the generated shape (`shared-genie`'s `genie-model.ts` extends its own
 codegen'd `dashboards.ts`), so it owns the name and stays hoisted. A barrel whose export surface is unchanged is left untouched,

package/index.ts

@@ -3,6 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
+export const PACKAGE_VERSION = "0.6.173";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -2,7 +2,6 @@
   "name": "@dbx-tools/projen",
   "scripts": {
     "build": "projen build",
-    "bump": "projen bump",
     "clobber": "projen clobber",
     "compile": "projen compile",
     "default": "projen default",
@@ -26,9 +25,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.168",
-    "@dbx-tools/path": "0.6.168",
-    "@dbx-tools/shared-core": "0.6.168",
+    "@dbx-tools/core": "0.6.174",
+    "@dbx-tools/path": "0.6.174",
+    "@dbx-tools/shared-core": "0.6.174",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -48,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.168",
+  "version": "0.6.174",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/barrels.ts

@@ -16,6 +16,12 @@
  * takes priority. This keeps the barrel auto-generated while letting you add or
  * override individual exports.
  *
+ * A UniFFI source triplet (`bindings.ts`, `_bindings.ts`, and
+ * `_bindings-ffi.ts`) is one special case: the internal underscore modules stay
+ * private, while `bindings.ts` is re-exported directly instead of under a
+ * `bindings` namespace. Generation fails when one of those direct binding names
+ * conflicts with another top-level package export.
+ *
  * Each eligible module becomes `export * as <name> from "./src/x.ts"` (camelCase
  * namespace from its path segments; invalid identifiers suffixed with `Module`),
  * sorted by module path.
@@ -28,9 +34,10 @@
  * `export { ... }`. The module namespaces stay either way, so a namespaced call
  * site keeps working.
  *
- * Every generated barrel also exports `PACKAGE_IDENTIFIER` from the package's own
- * `package.json`. Runtime helpers can retain the package specifier without
- * trying to recover it from an ESM namespace object or loader function.
+ * Every generated barrel also exports `PACKAGE_IDENTIFIER` and
+ * `PACKAGE_VERSION` from the package's own `package.json`. Runtime helpers can
+ * retain package identity without trying to recover it from an ESM namespace
+ * object or loader function.
  *
  * Uniqueness is tallied over types and values TOGETHER: a name carried by two
  * modules is ambiguous whichever kind it is, and hoisting one module's value
@@ -107,10 +114,16 @@ const BARREL_HEADER: HeaderOpts = {
   source: "the exporting modules in ./src",
 };
 
-/** Generated package identity export, reserved against source-module hoisting. */
+/** Generated package metadata exports, reserved against source-module hoisting. */
 const PACKAGE_IDENTIFIER_EXPORT = "PACKAGE_IDENTIFIER";
+const PACKAGE_VERSION_EXPORT = "PACKAGE_VERSION";
 const PACKAGE_IDENTIFIER_LINE = `export const ${PACKAGE_IDENTIFIER_EXPORT} = "";`;
+const PACKAGE_VERSION_LINE = `export const ${PACKAGE_VERSION_EXPORT} = "";`;
 const PACKAGE_IDENTIFIER_LINE_RE = /^export const PACKAGE_IDENTIFIER = .*;$/m;
+const PACKAGE_VERSION_LINE_RE = /^export const PACKAGE_VERSION = .*;$/m;
+const UNIFFI_BINDINGS_FILE = "bindings.ts";
+const UNIFFI_GENERATED_FILE = "_bindings.ts";
+const UNIFFI_FFI_FILE = "_bindings-ffi.ts";
 
 /** `pnpm-workspace` -> `pnpmWorkspace`; `local-fs` -> `localFS` (`fs` -> `FS`). */
 function kebabToCamel(segment: string): string {
@@ -266,8 +279,9 @@ function customExportNames(file: string): Set<string> {
  * `export * as`), then the whole module is re-exported last.
  */
 function mergeCustomExports(content: string, pkgDir: string): string {
-  if (!existsSync(join(pkgDir, CUSTOM_EXPORTS_FILE))) return content;
-  const overridden = customExportNames(join(pkgDir, CUSTOM_EXPORTS_FILE));
+  const customPath = join(pkgDir, CUSTOM_EXPORTS_FILE);
+  if (!existsSync(customPath) || isLegacyBindingsExport(customPath)) return content;
+  const overridden = customExportNames(customPath);
   const kept = content.split("\n").filter((line) => {
     const ns = /^export \* as (\w+) from /.exec(line)?.[1];
     return !(ns && overridden.has(ns));
@@ -275,29 +289,101 @@ function mergeCustomExports(content: string, pkgDir: string): string {
   return `${kept.join("\n").replace(/\n+$/, "")}\nexport * from "./exports.ts";\n`;
 }
 
-/** Read the authoritative npm package name emitted by the package project. */
-function packageIdentifier(pkgDir: string): string {
+function isLegacyBindingsExport(file: string): boolean {
+  return readFileSync(file, "utf8").trim() === 'export * from "./src/bindings.ts";';
+}
+
+function hasUniFFIBindings(srcDir: string): boolean {
+  return [UNIFFI_BINDINGS_FILE, UNIFFI_GENERATED_FILE, UNIFFI_FFI_FILE].every((file) =>
+    existsSync(join(srcDir, file)),
+  );
+}
+
+function bindingExportNames(srcDir: string): Set<string> {
+  return new Set(
+    [UNIFFI_BINDINGS_FILE, UNIFFI_GENERATED_FILE].flatMap((file) =>
+      moduleExports(join(srcDir, file)).map((entry) => entry.name),
+    ),
+  );
+}
+
+function barrelExportNames(content: string, customPath: string): Set<string> {
+  const names = new Set<string>([PACKAGE_IDENTIFIER_EXPORT, PACKAGE_VERSION_EXPORT]);
+  for (const match of content.matchAll(/^export \* as (\w+) from /gm)) {
+    names.add(match[1]!);
+  }
+  for (const match of content.matchAll(/^export(?: type)? \{([^}]+)\} from /gm)) {
+    for (const specifier of match[1]!.split(",")) {
+      const parts = specifier.trim().split(/\s+as\s+/);
+      const name = parts.at(-1);
+      if (name) names.add(name);
+    }
+  }
+  if (existsSync(customPath) && !isLegacyBindingsExport(customPath)) {
+    const statements = moduleStatements(customPath) as ReadonlyArray<{
+      type: string;
+      exported?: unknown;
+    }>;
+    if (
+      statements.some(
+        (statement) => statement.type === "ExportAllDeclaration" && !statement.exported,
+      )
+    ) {
+      throw new Error(
+        `Cannot verify UniFFI export conflicts through a bare export in ${customPath}`,
+      );
+    }
+    for (const name of customExportNames(customPath)) names.add(name);
+  }
+  return names;
+}
+
+function assertNoBindingExportConflicts(srcDir: string, content: string, customPath: string): void {
+  const other = barrelExportNames(content, customPath);
+  const conflicts = [...bindingExportNames(srcDir)].filter((name) => other.has(name)).sort();
+  if (conflicts.length > 0) {
+    throw new Error(
+      `UniFFI binding exports conflict with package exports in ${srcDir}: ${conflicts.join(", ")}`,
+    );
+  }
+}
+
+/** Read the authoritative npm package name and version emitted by the package project. */
+function packageMetadata(pkgDir: string): { identifier: string; version: string } {
   const manifestPath = join(pkgDir, "package.json");
-  const name = existsSync(manifestPath)
-    ? json.parseRecord(readFileSync(manifestPath, "utf8"))?.name
+  const manifest = existsSync(manifestPath)
+    ? json.parseRecord(readFileSync(manifestPath, "utf8"))
     : undefined;
+  const name = manifest?.name;
   if (typeof name !== "string" || !name.trim()) {
     throw new Error(`Cannot generate barrel without package.json name: ${manifestPath}`);
   }
-  return name;
+  const version = manifest?.version;
+  if (typeof version !== "string" || !version.trim()) {
+    throw new Error(`Cannot generate barrel without package.json version: ${manifestPath}`);
+  }
+  return { identifier: name, version };
 }
 
-/** Normalize package identity so structural barrel comparisons need no manifest read. */
-function withoutPackageIdentifier(content: string): string {
-  return content.replace(PACKAGE_IDENTIFIER_LINE_RE, PACKAGE_IDENTIFIER_LINE);
+/** Normalize package metadata before comparing the barrel's export structure. */
+function withoutPackageMetadata(content: string): string {
+  return content
+    .replace(PACKAGE_IDENTIFIER_LINE_RE, PACKAGE_IDENTIFIER_LINE)
+    .replace(PACKAGE_VERSION_LINE_RE, PACKAGE_VERSION_LINE);
 }
 
-/** Resolve and insert package identity only when a barrel is about to be written. */
-function withPackageIdentifier(content: string, pkgDir: string): string {
-  const line = `export const ${PACKAGE_IDENTIFIER_EXPORT} = ${JSON.stringify(
-    packageIdentifier(pkgDir),
-  )};`;
-  return content.replace(PACKAGE_IDENTIFIER_LINE_RE, () => line);
+/** Resolve and insert package metadata when a barrel is about to be written. */
+function withPackageMetadata(content: string, pkgDir: string): string {
+  const metadata = packageMetadata(pkgDir);
+  return content
+    .replace(
+      PACKAGE_IDENTIFIER_LINE_RE,
+      () => `export const ${PACKAGE_IDENTIFIER_EXPORT} = ${JSON.stringify(metadata.identifier)};`,
+    )
+    .replace(
+      PACKAGE_VERSION_LINE_RE,
+      () => `export const ${PACKAGE_VERSION_EXPORT} = ${JSON.stringify(metadata.version)};`,
+    );
 }
 
 /**
@@ -353,6 +439,10 @@ function generateForPackage(pkgDir: string): number {
     if (!existing || (!isSourceExt(existing) && isSourceExt(f))) byModulePath.set(stem, f);
   }
   const modulePaths = [...byModulePath.keys()].sort((a, b) => a.localeCompare(b));
+  const uniffiBindings = hasUniFFIBindings(srcDir);
+  const namespacedModulePaths = uniffiBindings
+    ? modulePaths.filter((modulePath) => modulePath !== "bindings")
+    : modulePaths;
 
   // No eligible modules -> no barrel: drop any stale root barrel and bail.
   if (modulePaths.length === 0) {
@@ -368,35 +458,45 @@ function generateForPackage(pkgDir: string): number {
   // extension is written because `tsc` rewrites it on emit
   // (`rewriteRelativeImportExtensions`) - an extensionless specifier would be
   // copied through verbatim and Node's ESM resolver cannot probe for it.
-  const namespaceExports = modulePaths
+  const namespaceExports = namespacedModulePaths
     .map((stem) => {
       const modulePath = `./src/${byModulePath.get(stem)!}`;
       return `export * as ${modulePathToNamespace(modulePath)} from "${modulePath}";`;
     })
     .join("\n");
-  let content = `${PACKAGE_IDENTIFIER_LINE}\n${namespaceExports}`;
+  let content = `${PACKAGE_IDENTIFIER_LINE}\n${PACKAGE_VERSION_LINE}\n${namespaceExports}`;
   // Hoist package-unique named exports to the top level. Names a hand-authored
   // `exports.ts` declares are suppressed so that file stays authoritative.
   const customPath = join(pkgDir, CUSTOM_EXPORTS_FILE);
-  const suppress = existsSync(customPath) ? customExportNames(customPath) : new Set<string>();
+  const suppress =
+    existsSync(customPath) && !isLegacyBindingsExport(customPath)
+      ? customExportNames(customPath)
+      : new Set<string>();
   suppress.add(PACKAGE_IDENTIFIER_EXPORT);
+  suppress.add(PACKAGE_VERSION_EXPORT);
   content = hoistUniqueExports(content, pkgDir, suppress);
   // A sibling `exports.ts` overrides/extends the generated barrel and wins on conflict.
   content = mergeCustomExports(content, pkgDir);
+  if (uniffiBindings) {
+    assertNoBindingExportConflicts(srcDir, content, customPath);
+    content = content.replace(
+      PACKAGE_VERSION_LINE,
+      `${PACKAGE_VERSION_LINE}\nexport * from "./src/bindings.ts";`,
+    );
+  }
 
-  // The barrel only *changes* when its export structure does. Package identity is
-  // blanked on both sides of this comparison, so a no-op cycle never reads
-  // package.json merely to reconstruct a value the existing barrel already has.
-  // If the structural result matches what's on disk, leave the file - and its
-  // read-only bit - completely untouched and report no change (0). This keeps the
-  // watcher quiet on ordinary in-file edits (which leave the export * as … list
-  // identical), and it is also what keeps a no-op cycle off the read-only bit
-  // entirely: see {@link writeBarrel} for why unlocking a barrel we are not about
-  // to rewrite is what produced spurious EACCES failures.
+  // Package metadata is blanked for the structural comparison, then restored
+  // from package.json so a version-only change still rewrites the barrel.
+  // If the structural result and package metadata match what's on disk, leave
+  // the file and its read-only bit untouched and report no change (0). This
+  // keeps the watcher quiet on ordinary in-file edits while allowing a version
+  // bump to update PACKAGE_VERSION.
   content = `${content.replace(/\n+$/, "")}\n`;
   const template = `${header(BARREL_HEADER)}\n${content}`;
-  if (before !== undefined && withoutPackageIdentifier(before) === template) return 0;
-  const next = withPackageIdentifier(template, pkgDir);
+  const next = withPackageMetadata(template, pkgDir);
+  if (before !== undefined && withoutPackageMetadata(before) === template && before === next) {
+    return 0;
+  }
 
   // Written whole (header included) rather than via `stampGenerated`, which would
   // re-read and rewrite the file to prepend the same header - a second write, and

package/src/project-py.ts

@@ -7,8 +7,8 @@ import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission } from "projen/lib/github/workflows-model";
 import { parse, stringify } from "smol-toml";
 import { projectReleaseBranch, projectRepositoryUrl } from "./project-js.ts";
-import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
+import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
 import { DOWNSTREAM_RELEASE_EVENT, RELEASE_TAG, releaseSourceSteps } from "./release-dispatch.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
@@ -29,8 +29,8 @@ export interface PythonPackageOptions extends DBXToolsProjectOptions {
   /** Workspace package directories rendered as standalone Git dependencies. */
   readonly internalDependencies?: readonly string[];
   readonly scripts?: Readonly<Record<string, string>>;
-  /** Keep this package unpublished and out of public docs and releases. */
-  readonly private?: boolean;
+  /** Publish this package through the Rust UniFFI release flow instead of the Python workflow. */
+  readonly uniffi?: boolean;
   /** Generated source files excluded from strict static analysis. Package-relative. */
   readonly generatedSources?: readonly string[];
   /** Trusted publisher used outside the standard Python release workflow. */
@@ -75,6 +75,7 @@ interface PythonPublication {
   readonly environment: string;
   readonly workflowName: string;
   readonly artifacts?: string;
+  readonly dependencies?: readonly string[];
 }
 
 /** Options for {@link DBXToolsPythonWorkspace}. */
@@ -214,8 +215,8 @@ export class DBXToolsPythonProject extends python.PythonProject implements DBXTo
     if (pkg.scripts) {
       this.uv.file.addOverride("project.scripts", pkg.scripts);
     }
-    if (pkg.private) {
-      this.uv.file.addOverride("tool.dbx-tools.private", true);
+    if (pkg.uniffi !== undefined) {
+      this.uv.file.addOverride("tool.dbx_tools.config.uniffi", pkg.uniffi);
     }
     formatPyproject(this.uv.file);
     this.uv.file.readonly = true;
@@ -319,7 +320,7 @@ export class DBXToolsPythonWorkspace extends Component {
       projectVscode(project)?.settings.addSetting("python.defaultInterpreterPath", interpreterPath);
     }
 
-    if (options.release && this.packages.some((pkg) => !pkg.packageOptions.private)) {
+    if (options.release && this.packages.length > 0) {
       if (isDBXToolsJavaScriptProject()(project)) {
         project.dbxToolsConfig.pythonReleaseWorkflow =
           releaseOptions.workflowName ?? "python-release";
@@ -428,7 +429,10 @@ export class DBXToolsPythonWorkspace extends Component {
   private addReleaseWorkflow(project: javascript.NodeProject, options: PythonReleaseOptions): void {
     if (!project.github) return;
     const publications = this.publications(options);
-    if (publications.length === 0) return;
+    const uniffiPublications = this.uniffiPublications(options);
+    const allPublications = [...publications, ...uniffiPublications];
+    if (allPublications.length === 0) return;
+    const usesRustArtifacts = uniffiPublications.length > 0;
     const workflowName = options.workflowName ?? "python-release";
     const workflow = new GithubWorkflow(project.github, workflowName, {
       limitConcurrency: true,
@@ -436,7 +440,7 @@ export class DBXToolsPythonWorkspace extends Component {
     });
     workflow.file?.addOverride("permissions", {
       contents: "read",
-      ...(options.upstreamWorkflow ? { actions: "read" } : {}),
+      ...(options.upstreamWorkflow || usesRustArtifacts ? { actions: "read" } : {}),
     });
     const upstreamWorkflow = options.upstreamWorkflow;
     const branchDispatch = upstreamWorkflow === undefined && isDBXToolsJavaScriptProject()(project);
@@ -487,7 +491,7 @@ export class DBXToolsPythonWorkspace extends Component {
       runsOn: ["ubuntu-latest"],
       permissions: {
         contents: JobPermission.READ,
-        ...(upstreamWorkflow ? { actions: JobPermission.READ } : {}),
+        ...(upstreamWorkflow || usesRustArtifacts ? { actions: JobPermission.READ } : {}),
       },
       timeoutMinutes: 20,
       steps: [
@@ -555,6 +559,35 @@ export class DBXToolsPythonWorkspace extends Component {
             ]
           : []),
         { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
+        ...(usesRustArtifacts
+          ? [
+              {
+                name: "Require Rust artifact handoff",
+                if: "${{ github.event_name == 'repository_dispatch' || github.event_name == 'workflow_run' }}",
+                shell: "bash",
+                env: {
+                  RUST_RUN_ID:
+                    "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_id || github.event.workflow_run.id }}",
+                  RUST_RUN_ATTEMPT:
+                    "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_attempt || github.event.workflow_run.run_attempt }}",
+                },
+                run: ['test -n "$RUST_RUN_ID"', 'test -n "$RUST_RUN_ATTEMPT"'].join("\n"),
+              },
+            ]
+          : []),
+        ...uniffiPublications.map((publication) => ({
+          name: `Download ${publication.distribution} native wheels`,
+          if: "${{ github.event_name == 'repository_dispatch' || github.event_name == 'workflow_run' }}",
+          uses: "actions/download-artifact@v8",
+          with: {
+            pattern: `${publication.distribution}--*--python-wheel`,
+            path: `dist/${publication.directory}`,
+            "merge-multiple": true,
+            "run-id":
+              "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_id || github.event.workflow_run.id }}",
+            "github-token": "${{ github.token }}",
+          },
+        })),
         {
           name: "Stamp workspace versions",
           env: {
@@ -594,8 +627,15 @@ export class DBXToolsPythonWorkspace extends Component {
         {
           name: "Validate distributions",
           run: [
-            `test "$(find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq ${publications.length * 2}`,
-            "uvx twine check dist/*/*.whl dist/*/*.tar.gz",
+            ...publications.map(
+              (publication) =>
+                `test "$(find dist/${publication.directory} -maxdepth 1 -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq 2`,
+            ),
+            ...uniffiPublications.map(
+              (publication) =>
+                `if [ "$GITHUB_EVENT_NAME" = "repository_dispatch" ] || [ "$GITHUB_EVENT_NAME" = "workflow_run" ]; then find dist/${publication.directory} -maxdepth 1 -name '*.whl' -print -quit | grep -q .; fi`,
+            ),
+            "find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check",
           ].join("\n"),
         },
         {
@@ -610,12 +650,15 @@ export class DBXToolsPythonWorkspace extends Component {
         },
       ],
     });
-    for (const publication of publications) {
+    for (const publication of allPublications) {
       workflow.addJob(`publish-${publication.directory}`, {
         if: branchDispatch
           ? "${{ github.event_name == 'repository_dispatch' }}"
           : "${{ github.event_name == 'push' || github.event_name == 'workflow_run' }}",
-        needs: ["build"],
+        needs: [
+          "build",
+          ...(publication.dependencies ?? []).map((dependency) => `publish-${dependency}`),
+        ],
         environment: {
           name: publication.environment,
           url:
@@ -643,7 +686,7 @@ export class DBXToolsPythonWorkspace extends Component {
 
   private publications(options: PythonReleaseOptions): readonly PythonPublication[] {
     return this.packages
-      .filter((pkg) => !pkg.packageOptions.private)
+      .filter((pkg) => pkg.packageOptions.uniffi !== true)
       .map((pkg) => ({
         directory: pkg.packageOptions.directory,
         distribution: pkg.packageOptions.name,
@@ -653,6 +696,22 @@ export class DBXToolsPythonWorkspace extends Component {
       }));
   }
 
+  private uniffiPublications(options: PythonReleaseOptions): readonly PythonPublication[] {
+    return this.packages
+      .filter((pkg) => pkg.packageOptions.uniffi === true)
+      .map((pkg) => ({
+        directory: pkg.packageOptions.directory,
+        distribution: pkg.packageOptions.name,
+        environment:
+          pkg.packageOptions.trustedPublisher?.environment ??
+          options.environments?.[pkg.packageOptions.name] ??
+          `pypi-${pkg.packageOptions.name}`,
+        workflowName: options.workflowName ?? "python-release",
+        artifacts: pkg.packageOptions.trustedPublisher?.artifacts,
+        dependencies: pkg.packageOptions.internalDependencies,
+      }));
+  }
+
   private trustedPublisherPublications(
     options: PythonReleaseOptions,
   ): readonly PythonPublication[] {