@dbx-tools/projen 0.6.222 → 0.6.224

package/tasks/publish-npm.ts

@@ -1,8 +1,17 @@
 #!/usr/bin/env -S bun
 /** Idempotent npm archive publication for release recovery. */
 import { createHash } from "node:crypto";
-import { readFileSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import {
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative, resolve } from "node:path";
 import { exec } from "@dbx-tools/core";
 import { log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
@@ -11,6 +20,7 @@ const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 const logger = log.logger("dbx-tools:publish-npm");
 
 export interface NpmReleaseIdentity {
+  readonly contentDigest?: string;
   readonly integrity?: string;
   readonly name: string;
   readonly repository?: unknown;
@@ -47,7 +57,18 @@ export function npmReleaseMatches(
   if (localRepository && publishedRepository && localRepository !== publishedRepository) {
     throw new Error(`Published npm repository does not match ${local.name}@${local.version}`);
   }
-  if (local.integrity && published.integrity !== local.integrity) {
+  if (
+    local.contentDigest &&
+    published.contentDigest &&
+    local.contentDigest !== published.contentDigest
+  ) {
+    throw new Error(`Published npm content does not match ${local.name}@${local.version}`);
+  }
+  if (
+    !(local.contentDigest && published.contentDigest) &&
+    local.integrity &&
+    published.integrity !== local.integrity
+  ) {
     throw new Error(`Published npm integrity does not match ${local.name}@${local.version}`);
   }
   return true;
@@ -66,7 +87,7 @@ export async function publishedNpmRelease(
     throw new Error(`npm registry lookup failed for ${name}@${version}: ${response.status}`);
   }
   const metadata = (await response.json()) as {
-    dist?: { integrity?: string };
+    dist?: { integrity?: string; tarball?: string };
     name?: string;
     repository?: unknown;
     version?: string;
@@ -74,7 +95,23 @@ export async function publishedNpmRelease(
   if (!metadata.name || !metadata.version) {
     throw new Error(`npm registry returned an incomplete identity for ${name}@${version}`);
   }
+  let contentDigest: string | undefined;
+  if (metadata.dist?.tarball) {
+    const archive = await fetch(metadata.dist.tarball);
+    if (!archive.ok) {
+      throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
+    }
+    const temp = mkdtempSync(join(tmpdir(), "dbx-tools-published-npm-"));
+    const path = join(temp, "package.tgz");
+    try {
+      writeFileSync(path, Buffer.from(await archive.arrayBuffer()));
+      contentDigest = npmArchiveContentDigest(path);
+    } finally {
+      rmSync(temp, { recursive: true, force: true });
+    }
+  }
   return {
+    ...(contentDigest ? { contentDigest } : {}),
     integrity: metadata.dist?.integrity,
     name: metadata.name,
     repository: metadata.repository,
@@ -102,6 +139,7 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
     throw new Error(`npm archive has no package name or version: ${path}`);
   }
   return {
+    contentDigest: npmArchiveContentDigest(path),
     integrity: `sha512-${createHash("sha512").update(readFileSync(path)).digest("base64")}`,
     name: manifest.name,
     repository: manifest.repository,
@@ -109,6 +147,39 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
   };
 }
 
+/** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
+export function npmArchiveContentDigest(path: string): string {
+  const temp = mkdtempSync(join(tmpdir(), "dbx-tools-npm-content-"));
+  try {
+    exec.spawnSync("tar", ["-xzf", path, "-C", temp], {
+      cwd: process.cwd(),
+      stdout: "ignore",
+      stderr: "capture",
+      stdin: "ignore",
+      check: true,
+    });
+    const hash = createHash("sha512");
+    const visit = (directory: string): void => {
+      for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) =>
+        a.name.localeCompare(b.name),
+      )) {
+        const entryPath = join(directory, entry.name);
+        const name = relative(temp, entryPath).split("\\").join("/");
+        const stat = lstatSync(entryPath);
+        hash.update(`${entry.isDirectory() ? "D" : entry.isSymbolicLink() ? "L" : "F"}\0`);
+        hash.update(`${name}\0${stat.mode & 0o111}\0`);
+        if (entry.isDirectory()) visit(entryPath);
+        else if (entry.isSymbolicLink()) hash.update(readlinkSync(entryPath));
+        else hash.update(readFileSync(entryPath));
+      }
+    };
+    visit(temp);
+    return `sha512-${hash.digest("base64")}`;
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
 export function packNpmPackage(
   directory: string,
   destination: string,

package/tasks/publish-python.ts

@@ -13,20 +13,18 @@ import { tmpdir } from "node:os";
 import { basename, join, resolve } from "node:path";
 import { exec } from "@dbx-tools/core";
 import { Command } from "commander";
+import { parse, stringify } from "smol-toml";
+import { pythonProjectInfo, stampPythonProject } from "./uniffi-python.js";
 
 interface PythonProjectFile {
   readonly directory: string;
   readonly mode: number;
   readonly name: string;
   readonly path: string;
+  readonly private: boolean;
   readonly source: string;
 }
 
-function isPrivatePythonProject(source: string): boolean {
-  const section = source.match(/^\[tool\.dbx-tools\]\s*\n([\s\S]*?)(?=^\[|(?![\s\S]))/m)?.[1] ?? "";
-  return /^\s*private\s*=\s*true\s*$/m.test(section);
-}
-
 export interface StampPythonProjectsOptions {
   readonly rewriteDependencies?: boolean;
 }
@@ -36,10 +34,6 @@ export interface RestorePythonProjects {
   readonly paths: readonly string[];
 }
 
-function escapeRegExp(value: string): string {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
 export function stampPythonProjects(
   root: string,
   version: string,
@@ -52,37 +46,27 @@ export function stampPythonProjects(
     .sort();
   const allProjects: PythonProjectFile[] = packageFiles.map((path) => {
     const source = readFileSync(path, "utf8");
-    const name = /^name = "([^"]+)"$/m.exec(source)?.[1];
-    if (!name) throw new Error(`Missing project name in ${path}`);
+    const info = pythonProjectInfo(source, { parse, stringify });
     return {
       directory: basename(resolve(path, "..")),
       mode: statSync(path).mode,
-      name,
+      name: info.name,
       path,
+      private: info.private,
       source,
     };
   });
-  const projects = allProjects.filter((project) => !isPrivatePythonProject(project.source));
+  const projects = allProjects.filter((project) => !project.private);
   if (projects.length === 0) throw new Error(`No Python packages found under ${root}`);
 
   try {
     for (const project of projects) {
-      const versionPattern = /^version = "[^"]+"$/m;
-      if (!versionPattern.test(project.source)) {
-        throw new Error(`Expected one project version in ${project.path}`);
-      }
-      let stamped = project.source.replace(versionPattern, `version = "${version}"`);
-      if (options.rewriteDependencies ?? true) {
-        for (const sibling of allProjects) {
-          stamped = stamped.replace(
-            new RegExp(
-              `${escapeRegExp(sibling.name)} @ git\\+[^" ]+#subdirectory=[^" ]+/${escapeRegExp(sibling.directory)}`,
-              "g",
-            ),
-            `${sibling.name}==${version}`,
-          );
-        }
-      }
+      const stamped = stampPythonProject(project.source, {
+        packages: allProjects,
+        rewriteDependencies: options.rewriteDependencies,
+        toml: { parse, stringify },
+        version,
+      });
       chmodSync(project.path, project.mode | 0o200);
       writeFileSync(project.path, stamped);
       chmodSync(project.path, project.mode);

package/tasks/publish-uniffi-local.ts

@@ -6,6 +6,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { log } from "@dbx-tools/shared-core";
+import { parse, stringify } from "smol-toml";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import type { RustBindingMapping, RustWorkspaceMapping } from "../src/project-rs.ts";
 
@@ -110,19 +111,21 @@ function publishCargo(config: RustWorkspaceMapping, registry: string, version: s
     );
     for (const manifest of manifests) {
       const mode = statSync(manifest).mode;
-      let source = readFileSync(manifest, "utf8");
+      const document = parse(readFileSync(manifest, "utf8")) as Record<string, unknown>;
       for (const crateName of crateNames) {
         if (!crateName) continue;
-        source = source.replace(
-          new RegExp(
-            `(${crateName.replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")} = \\{[^}]*)( \\})`,
-            "g",
-          ),
-          `$1, registry = "${registry}"$2`,
-        );
+        for (const sectionName of ["dependencies", "dev-dependencies", "build-dependencies"]) {
+          const section = document[sectionName];
+          if (!section || typeof section !== "object" || Array.isArray(section)) continue;
+          const dependency = (section as Record<string, unknown>)[crateName];
+          if (!dependency || typeof dependency !== "object" || Array.isArray(dependency)) {
+            continue;
+          }
+          (dependency as Record<string, unknown>).registry = registry;
+        }
       }
       chmodSync(manifest, mode | 0o200);
-      writeFileSync(manifest, source);
+      writeFileSync(manifest, `${stringify(document).trimEnd()}\n`);
       chmodSync(manifest, mode);
     }
     for (const crateName of crateNames) {

package/tasks/publish.ts

@@ -62,7 +62,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { delimiter, dirname, join, resolve } from "node:path";
 import { exec } from "@dbx-tools/core";
 import { log } from "@dbx-tools/shared-core";
 import ts from "typescript";
@@ -253,7 +253,7 @@ function applyPublishConfig(pkgPath: string): void {
 function enrichedPath(root: string): string {
   const binDir = join(root, "node_modules", ".bin");
   const current = process.env.PATH ?? "";
-  return current.split(":").includes(binDir) ? current : `${binDir}:${current}`;
+  return current.split(delimiter).includes(binDir) ? current : `${binDir}${delimiter}${current}`;
 }
 
 const [version, ...rest] = process.argv.slice(2);

package/tasks/release-pr.ts

@@ -13,6 +13,7 @@ import { fileURLToPath } from "node:url";
 import { exec, project } from "@dbx-tools/core";
 import { log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
+import { publishLocalRelease } from "./local-publish.ts";
 import {
   releaseArchitectureOption,
   releaseLevelOption,
@@ -21,7 +22,12 @@ import {
   type ReleaseOs,
   type VersionLevel,
 } from "../src/_release-platform.ts";
-import { publishLocalRelease } from "./local-publish.ts";
+import {
+  githubRepositoryIdentity,
+  githubRepositorySpecifier,
+  githubTokenArguments,
+  githubTokenEnvironmentName,
+} from "../src/release-github.ts";
 import { readWorkspaceVersion, resolveNextVersion } from "../src/workspace-version.ts";
 
 const logger = log.logger("projen:release");
@@ -100,13 +106,17 @@ function runIgnoringStdout(root: string, command: string, args: string[]): void
   });
 }
 
-function githubAccount(root: string): { owner: string; repository: string; token: string } {
+function githubAccount(root: string): {
+  hostname: string;
+  owner: string;
+  repository: string;
+  token: string;
+} {
   const repository = project.repositoryUrl(root);
   if (!repository) throw new Error("Release preparation requires a GitHub repository");
-  const [owner, name] = new URL(repository).pathname.split("/").filter(Boolean);
-  if (!owner || !name) throw new Error(`Cannot determine GitHub identity from ${repository}`);
+  const identity = githubRepositoryIdentity(repository);
   const token = exec
-    .spawnSync("gh", ["auth", "token", "--user", owner], {
+    .spawnSync("gh", githubTokenArguments(identity.hostname), {
       cwd: root,
       stdout: "capture",
       stderr: "ignore",
@@ -114,8 +124,10 @@ function githubAccount(root: string): { owner: string; repository: string; token
       check: true,
     })
     .stdout?.trim();
-  if (!token) throw new Error(`No GitHub CLI authentication found for ${owner}`);
-  return { owner, repository: name.replace(/\.git$/, ""), token };
+  if (!token) {
+    throw new Error(`No GitHub CLI authentication found for ${identity.hostname}`);
+  }
+  return { ...identity, token };
 }
 
 const program = new Command();
@@ -129,7 +141,7 @@ program
   .addOption(releaseArchitectureOption())
   .option("--local-registry <value>", "local npm registry: auto, false, or an explicit URL", "auto")
   .option("--local-pypi <value>", "local PyPI index: auto, false, or an explicit URL", "auto")
-  .option("--python-root <path>", "Python workspace package root", "packages/py")
+  .option("--python-root <path>", "Python workspace package root")
   .option("--no-local-cargo", "skip local Cargo publication")
   .option("--approve", "merge the release branch directly into the release base")
   .action(
@@ -142,7 +154,7 @@ program
       arch: ReleaseArch[];
       localRegistry: string;
       localPypi: string;
-      pythonRoot: string;
+      pythonRoot?: string;
       localCargo: boolean;
       approve: boolean;
     }) => {
@@ -268,7 +280,12 @@ program
         "",
         "Merging this PR updates VERSION on main and starts the public release workflow.",
       ].join("\n");
-      const githubEnvironment = { ...process.env, GH_TOKEN: account.token };
+      const githubEnvironment = {
+        ...process.env,
+        GH_HOST: account.hostname,
+        GH_REPO: githubRepositorySpecifier(account),
+        [githubTokenEnvironmentName(account.hostname)]: account.token,
+      };
       const ensurePullRequest = (): void => {
         if (commandSucceeds(root, "gh", ["pr", "view", releaseBranch], githubEnvironment)) return;
         run(

package/tasks/uniffi-python.d.ts

@@ -0,0 +1,56 @@
+export interface TomlCodec {
+  parse(source: string): unknown;
+  stringify(document: unknown): string;
+}
+
+export interface PythonPackageMapping {
+  readonly directory: string;
+  readonly name: string;
+}
+
+export interface PythonProjectInfo {
+  readonly name: string;
+  readonly private: boolean;
+}
+
+/** Read the project identity and publication flag from parsed TOML metadata. */
+export function pythonProjectInfo(source: string, toml: TomlCodec): PythonProjectInfo;
+
+/** Stamp a temporary publication version and exact sibling dependencies. */
+export function stampPythonProject(
+  source: string,
+  options: {
+    readonly packages: readonly PythonPackageMapping[];
+    readonly rewriteDependencies?: boolean;
+    readonly toml: TomlCodec;
+    readonly version: string;
+  },
+): string;
+
+/** Return the target-specific UniFFI generator executable name. */
+export function pythonBindingGeneratorName(crate: string, platform: string): string;
+
+/** Build the canonical UniFFI Python generator argument list. */
+export function pythonBindingGeneratorArgs(options: {
+  readonly crate: string;
+  readonly library: string;
+  readonly output: string;
+}): string[];
+
+export interface InstalledPythonBindings {
+  readonly bindings: string;
+  readonly init: string;
+  readonly library: string;
+}
+
+/** Generate and place one Python binding module and its native library. */
+export function installPythonBindings(options: {
+  readonly crate: string;
+  readonly library: string;
+  readonly module: string;
+  readonly packageRoot: string;
+  readonly platform: string;
+  readonly readonly?: boolean;
+  readonly run: (command: string, args: string[]) => void;
+  readonly targetDirectory: string;
+}): InstalledPythonBindings;

package/tasks/uniffi-python.js

@@ -0,0 +1,160 @@
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+
+const READONLY = 0o444;
+const WRITABLE = 0o644;
+
+const projectTable = (document) => {
+  const project = document?.project;
+  if (!project || typeof project !== "object" || Array.isArray(project)) {
+    throw new Error("Missing Python project metadata");
+  }
+  return project;
+};
+
+const directSibling = (dependency, sibling) => {
+  const prefix = `${sibling.name} @ git+`;
+  if (!dependency.startsWith(prefix)) return false;
+  const marker = "#subdirectory=";
+  const markerIndex = dependency.indexOf(marker, prefix.length);
+  if (markerIndex < 0) return false;
+  const directory = dependency.slice(markerIndex + marker.length);
+  return directory === sibling.directory || directory.endsWith(`/${sibling.directory}`);
+};
+
+const setWritable = (path) => {
+  if (existsSync(path)) chmodSync(path, WRITABLE);
+};
+
+const setReadonly = (path) => {
+  if (existsSync(path)) chmodSync(path, READONLY);
+};
+
+const generatedHeader = (crate) =>
+  [
+    "# GENERATED by UniFFI binding generation - DO NOT EDIT.",
+    `# Regenerated from the ${crate} Rust exports.`,
+    "# Hand edits are overwritten on the next watch; this file is read-only.",
+    "",
+  ].join("\n");
+
+export const pythonProjectInfo = (source, toml) => {
+  const document = toml.parse(source);
+  const project = projectTable(document);
+  if (typeof project.name !== "string" || !project.name) {
+    throw new Error("Missing Python project name");
+  }
+  const config = document?.tool?.["dbx-tools"];
+  return {
+    name: project.name,
+    private: Boolean(config && typeof config === "object" && config.private === true),
+  };
+};
+
+export const stampPythonProject = (
+  source,
+  { packages, rewriteDependencies = true, toml, version },
+) => {
+  const marker = source.startsWith("# ") ? source.slice(0, source.indexOf("\n")) : undefined;
+  const document = toml.parse(source);
+  const project = projectTable(document);
+  if (typeof project.version !== "string") {
+    throw new Error("Missing Python project version");
+  }
+  project.version = version;
+  if (rewriteDependencies) {
+    const dependencies = project.dependencies;
+    if (dependencies !== undefined && !Array.isArray(dependencies)) {
+      throw new Error("Python project dependencies must be an array");
+    }
+    if (dependencies) {
+      project.dependencies = dependencies.map((dependency) => {
+        if (typeof dependency !== "string") {
+          throw new Error("Python project dependencies must be strings");
+        }
+        const sibling = packages.find((candidate) => directSibling(dependency, candidate));
+        return sibling ? `${sibling.name}==${version}` : dependency;
+      });
+    }
+  }
+  const body = toml.stringify(document).trimEnd();
+  return `${marker ? `${marker}\n\n` : ""}${body}\n`;
+};
+
+export const pythonBindingGeneratorName = (crate, platform) =>
+  `${crate}-uniffi-bindgen${platform === "win32" ? ".exe" : ""}`;
+
+export const pythonBindingGeneratorArgs = ({ crate, library, output }) => [
+  "generate",
+  "--language",
+  "python",
+  "--crate",
+  crate.replaceAll("-", "_"),
+  "--out-dir",
+  output,
+  library,
+];
+
+export const installPythonBindings = ({
+  crate,
+  library,
+  module,
+  packageRoot,
+  platform,
+  readonly = false,
+  run,
+  targetDirectory,
+}) => {
+  const packageName = module.split(".").at(-1);
+  if (!packageName) throw new Error(`Invalid Python module ${module}`);
+  const packageDirectory = resolve(packageRoot, "src", ...module.split("."));
+  const generatedDirectory = mkdtempSync(join(tmpdir(), `${packageName}-python-`));
+  const generator = resolve(targetDirectory, pythonBindingGeneratorName(crate, platform));
+  if (!existsSync(generator)) throw new Error(`Missing UniFFI generator ${generator}`);
+
+  try {
+    run(
+      generator,
+      pythonBindingGeneratorArgs({
+        crate,
+        library,
+        output: generatedDirectory,
+      }),
+    );
+    const generated = join(generatedDirectory, `${crate.replaceAll("-", "_")}.py`);
+    if (!existsSync(generated)) throw new Error(`Missing generated binding ${generated}`);
+    mkdirSync(packageDirectory, { recursive: true });
+
+    const bindings = join(packageDirectory, "bindings.py");
+    setWritable(bindings);
+    writeFileSync(bindings, `${generatedHeader(crate)}${readFileSync(generated, "utf8")}`);
+
+    const init = join(packageDirectory, "__init__.py");
+    setWritable(init);
+    writeFileSync(init, "");
+
+    const nativeLibrary = join(packageDirectory, basename(library));
+    setWritable(nativeLibrary);
+    cpSync(library, nativeLibrary);
+
+    if (readonly) {
+      setReadonly(bindings);
+      setReadonly(init);
+      setReadonly(nativeLibrary);
+    }
+    rmSync(join(packageDirectory, "_generated"), { recursive: true, force: true });
+    return { bindings, init, library: nativeLibrary };
+  } finally {
+    rmSync(generatedDirectory, { recursive: true, force: true });
+  }
+};

package/tasks/uniffi-release.mjs

@@ -14,8 +14,14 @@ import {
 import { basename, dirname, join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
 import { parseArgs } from "node:util";
 import { spawnSync } from "node:child_process";
+import { installPythonBindings, stampPythonProject } from "./uniffi-python.js";
+
+const require = createRequire(import.meta.url);
+const bundledToml = fileURLToPath(new URL("./smol-toml.cjs", import.meta.url));
+const toml = require(existsSync(bundledToml) ? bundledToml : "smol-toml");
 
 const parsed = parseArgs({
   allowPositionals: true,
@@ -215,9 +221,6 @@ const testNodeFacade = ({
   }
 };
 
-const replaceVersion = (source, version) =>
-  source.replace(/^version = "[^"]+"$/m, `version = "${version}"`);
-
 /** Resolve workspace and generated catalog protocols for a publishable facade. */
 const facadeDependency = (name, dependency, version, catalog) => {
   if (typeof dependency !== "string") return dependency;
@@ -411,57 +414,30 @@ const packagePython = ({
   cpSync(resolve(root, pythonDirectory), pythonRoot, { recursive: true });
   const pyproject = join(pythonRoot, "pyproject.toml");
   writable(pyproject);
-  writeFileSync(pyproject, replaceVersion(readFileSync(pyproject, "utf8"), version));
   const workspaceBindings =
     JSON.parse(readFileSync(join(root, "package.json"), "utf8")).dbxToolsConfig?.rust?.bindings ??
     [];
-  let metadata = readFileSync(pyproject, "utf8");
-  for (const binding of workspaceBindings) {
-    if (!binding.pythonPackage) continue;
-    const escaped = binding.pythonPackage.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    metadata = metadata.replace(
-      new RegExp(`"${escaped} @ git\\+[^"\\n]+"`, "g"),
-      JSON.stringify(`${binding.pythonPackage}==${version}`),
-    );
-  }
-  writeFileSync(pyproject, metadata);
-
-  const packageName = pythonModule.split(".").at(-1);
-  if (!packageName) throw new Error(`Invalid Python module ${pythonModule}`);
-  const packageDirectory = resolve(pythonRoot, "src", ...pythonModule.split("."));
-  const generatedDirectory = mkdtempSync(join(tmpdir(), `${packageName}-python-`));
-  const generator = resolve(
-    cargoTargetRoot,
-    cargoTarget,
-    "release",
-    `${crate}-uniffi-bindgen${os === "win32" ? ".exe" : ""}`,
-  );
-  if (!existsSync(generator)) throw new Error(`Missing UniFFI generator ${generator}`);
-  run(generator, [
-    "generate",
-    "--language",
-    "python",
-    "--crate",
-    crate.replaceAll("-", "_"),
-    "--out-dir",
-    generatedDirectory,
-    library,
-  ]);
-  const bindings = join(packageDirectory, "bindings.py");
-  writable(bindings);
-  const body = readFileSync(join(generatedDirectory, `${crate.replaceAll("-", "_")}.py`), "utf8");
   writeFileSync(
-    bindings,
-    [
-      "# GENERATED by UniFFI binding generation - DO NOT EDIT.",
-      `# Regenerated from the ${crate} Rust exports.`,
-      "# Hand edits are overwritten on the next watch; this file is read-only.",
-      "",
-      body,
-    ].join("\n"),
+    pyproject,
+    stampPythonProject(readFileSync(pyproject, "utf8"), {
+      packages: workspaceBindings.flatMap((binding) =>
+        binding.pythonPackage && binding.python
+          ? [{ name: binding.pythonPackage, directory: binding.python }]
+          : [],
+      ),
+      toml,
+      version,
+    }),
   );
-  cpSync(library, join(packageDirectory, basename(library)));
-  rmSync(generatedDirectory, { recursive: true, force: true });
+  installPythonBindings({
+    crate,
+    library,
+    module: pythonModule,
+    packageRoot: pythonRoot,
+    platform: os,
+    run,
+    targetDirectory: resolve(cargoTargetRoot, cargoTarget, "release"),
+  });
 
   const wheelDirectory = resolve(output, "python");
   mkdirSync(wheelDirectory, { recursive: true });