@dbx-tools/projen 0.6.229 → 0.7.0

package/README.md

@@ -173,30 +173,31 @@ a host Rust build. Regenerate bindings through the focused watcher or explicit
 task while changing a UniFFI API. Release preparation runs Cargo workspace tests
 without invoking UBRN.
 
-The workspace generates one `release.yml` workflow for every ecosystem. A push
-to the configured release branch starts it only when `VERSION` changed. The
-context job requires the version to differ from its parent and exceed the latest
-tag, creates the corresponding annotated `v*` tag, and exposes the verified tag,
-commit, and version to every source job. If the tag already exists, it must be
-annotated and reference the same commit. A manual run accepts that same tag and
-commit but requires dry-run mode, so it builds and validates without publishing
-packages or deploying documentation. One non-cancelling `release` concurrency
-group serializes publication.
+The workspace generates one `release.yml` workflow for every ecosystem.
+Independent mode runs Release Please on default-branch pushes. It owns the
+combined release PR, per-component semantic increments, component-qualified
+tags, and GitHub Releases. A Projen reconciliation pass reads the reviewed
+manifest, regenerates every owned version surface, validates a clean second
+synthesis, and commits component-qualified release notes to the release PR.
+One non-cancelling `release` concurrency group serializes publication.
 
 Release generation writes `release.yml` without scanning for or removing other
 workflow files. Consumers explicitly delete exact workflow files they no longer
 want.
 
-Failed-job reruns consume successful Rust artifacts from the same workflow run.
-For a separate recovery run, choose `node`, `python`, or `docs` instead of
-`all`. Node and Python recovery can supply the prior `release.yml` run ID; the
-workflow verifies that run used the commit selected by the annotated release
-tag before downloading its artifacts. Dispatch the workflow with the release
-tag as its Git ref so recovery checks out the immutable release boundary. Manual recovery
-defaults to dry-run and publishes only when `dry_run` is cleared. npm retries skip an exact version only
-after the local archive integrity and repository identity match registry
-metadata. PyPI retries enable Twine's hash-aware existing-file behavior, which
-skips matching files and fails when an existing filename has different content.
+The release-plan job compares the previous and reviewed release-unit graphs and
+selects only changed units, required dependents, packages, native targets,
+assets, and docs. A Node-only release allocates no Rust runner. Manual recovery
+names one component, reviewed version, and publication stage; it reconstructs
+that component's plan without changing any other version. npm retries compare
+archive content and repository identity, PyPI uses hash-aware existing-file
+behavior, Cargo checks existing versions, and GitHub assets upload to the
+component release.
+
+Set `releaseSyncBranch` when a repository retains a long-lived source branch.
+After publication the workflow fast-forwards that branch only when it exists
+and is an ancestor of released `main`; missing or diverged branches are left
+untouched.
 
 The Rust matrix has one row per target. Each row installs native dependencies,
 builds the Cargo workspace once, then packages every discovered output from
@@ -415,6 +416,8 @@ file contract as the CLI.
 - `barrels` / `moduleExports` - public entrypoint generation.
 - `codegen` - `.d.ts` to zod schema generation.
 - `openapi` - tsoa/OpenAPI package generation.
+- `releaseCatalog` / `releasePlan` / `releasePlease` - cross-language ownership,
+  affected planning, and Release Please graph propagation.
 - `bunApp` / `tsconfig` / `vscode` - generated support files/components.
 - `generated` / `clean` / `watch` / `scaffold` - read-only file stamping,
   cleanup, watchers, and synth orchestration.
@@ -433,51 +436,28 @@ Every repo-wide task lives on the root, and the root's `compile` / `test`
 delegate with `bun run --filter '*'` rather than emitting a step per member - so
 a new package is covered without a re-synth. Work from the root:
 
-| Task                    | What it does                                            |
-| ----------------------- | ------------------------------------------------------- |
-| `bun run build`         | synth + workspace compile and tests                     |
-| `bun run compile`       | `tsc --build` in each member, in parallel               |
-| `bun run test`          | `eslint` once, then each member's tests                 |
-| `bun run sync`          | re-synth (`--watch` to keep synthing)                   |
-| `bun run barrels`       | regenerate the read-only `index.ts` barrels             |
-| `bun run bump`          | increment `VERSION` and synchronize generated versions  |
-| `bun run version:check` | verify every version surface matches `VERSION`          |
-| `bun run release`       | run full local preflight and open a reviewed release PR |
-
-`release` commits pending work on the current branch, merges the latest remote
-release branch when needed, and pushes it. It prepares the dedicated
-`release/v<version>` branch inside `.worktrees/<tag>`, leaving the source
-checkout on its current branch throughout validation, local publication, and
-PR creation. Failed preparation can resume from that worktree; success removes
-it. `--message` sets the source commit message. The task never merges
-the PR unless `--approve` is passed; that option merges the release branch
-directly through GitHub's merge API so no PR checks are created. A repository
-that blocks direct merges falls back to an immediate admin-merged PR. The task
-then fast-forwards the still-active source branch to the release commit.
-
-After validation, release preparation optionally generates an immutable
-`docs/releases/v<version>.md`. It tries the installed Cursor agent first, then
-Codex, then Claude, all in non-interactive read-only modes against bounded Git
-context. An unavailable, unauthenticated, failed, or empty provider falls
-through to the next; if none works, release preparation continues without a
-summary. The same file is included in the release PR and prepended to GitHub's
-generated release notes, so repository and GitHub views share one source.
-
-npm
-uses `npm config get registry` and publishes to a local Verdaccio automatically.
-Publishable JavaScript members compile once
-from the root in parallel, then upload through a bounded pool without rerunning
-their `prepack` tasks. Python prefers uv's default index and only
-treats a loopback `.../+simple/` URL as writable devpi; a read-only cache such as
-proxpi (`.../index/`) is deliberately ignored. The task stamps every Python
-member and its sibling dependencies to the release version, builds the workspace
-with uv, then runs `devpi upload --from-dir` against the derived writable index.
-The npm and Python mirrors run concurrently because they touch disjoint package
-trees. Devpi client authentication remains in its normal `~/.devpi` state.
-
-Use `--local-registry false` or `--local-pypi false` to disable either local
-publish. An explicit `--local-pypi http://localhost:3141/user/index/` overrides
-auto-detection; `--python-root` defaults to `packages/py`.
+| Task                        | What it does                                          |
+| --------------------------- | ----------------------------------------------------- |
+| `bun run build`             | synth + workspace compile and tests                   |
+| `bun run compile`           | `tsc --build` in each member, in parallel             |
+| `bun run test`              | `eslint` once, then each member's tests               |
+| `bun run sync`              | re-synth (`--watch` to keep synthing)                 |
+| `bun run barrels`           | regenerate the read-only `index.ts` barrels           |
+| `bun run release:bootstrap` | initialize writable Release Please state once         |
+| `bun run release:plan`      | emit the affected component and publication plan      |
+| `bun run version:check`     | verify every package against its owning release unit  |
+| `bun run release`           | refresh Release Please PRs, tags, and GitHub Releases |
+
+`release` runs the pinned Release Please library with the generated
+cross-language graph plugin. Direct changes retain their conventional semantic
+increment, while required dependents receive patches. The combined release PR
+is reconciled by Projen before review. Merging it creates component tags and
+GitHub Releases, then the affected plan selects publication jobs.
+
+Each changed component receives
+`docs/releases/<component>-v<version>.md`. Summary generation tries Cursor,
+Codex, and Claude in order, logs provider events, and falls back to Git. The
+committed file becomes that component's GitHub Release body.
 
 The GitHub PR workflow runs the explicit `pr:validate` task through Projen's
 public `BuildWorkflow` `buildTask` option. That task runs synth plus the
@@ -486,13 +466,10 @@ preparation has already run Rust tests, workspace type-checking, and local
 package preflight before opening the PR. JavaScript behavior tests remain an
 explicit developer task.
 
-The configured release branch publishes only when a reviewed PR changes
-`VERSION`. Its workflow creates the annotated `v*` public release boundary.
-Available workflow
-stages form the generated chain Rust -> Python -> Node -> docs: Rust builds and
-publishes native artifacts and Cargo crates, Python publishes standard
-distributions, Node publishes standard workspace packages, and docs deploys
-after publication. A stage with no corresponding outputs is omitted.
+The generated workflow runs Release Please on the configured branch. A merged
+release PR produces an affected plan, then selected Rust, Python, Node, GitHub
+asset, and docs jobs run behind a publication barrier. A stage with no selected
+outputs is skipped before runner allocation.
 
 Members intentionally keep only the tasks that something OTHER than a human
 invokes, so there is no second place to run the same thing:
@@ -519,17 +496,14 @@ from the root instead.
 
 ## Versioning
 
-The whole repo shares ONE version, stored in the root `VERSION` file (a plain
-`x.y.z` string; a fresh tree with no file defaults to `0.0.1`). Synth COPIES that
-value into every generated manifest - the root and `projen/` `package.json`, every
-JS member, every Python `pyproject.toml`, the generated openapi packages, and the
-example apps - so the packages, the engine, and the examples always match.
-`src/workspace-version.ts` owns reading and writing it. Synth only ever reads it;
-it never resets, upgrades, or downgrades a version on its own.
-
-`bun run bump` is the only command that changes the number: it fetches remote
-tags once, takes the highest `v*` tag as the base, increments by `--level`, writes
-`VERSION`, then synths so every manifest copies it. It has no git or publication
-side effects. `bun run release` invokes it while preparing the reviewed release
-PR. The remote is consulted only on `bump` and on one-time creation of a missing
-`VERSION` file, never on an ordinary synth.
+`DBXToolsReleaseCatalog` is the language-neutral version seam. It generates
+`.projen/release-units.json` from attached projects, explicit external members,
+UniFFI families, and binary assets. Independent mode reads component versions
+from `.release-please-manifest.json`; fixed mode reads `VERSION`.
+
+Every unit has `.release-units/<component>/source.json`, generated from
+release-affecting inputs. Release Please owns the adjacent `version.txt` and
+`CHANGELOG.md`. Real package manifests remain Projen-owned and reproduce the
+reviewed manifest exactly. `versioningMode: "fixed"` remains the default for
+consumers during migration; `versioningMode: "independent"` enables the
+Release Please and affected-workflow surface.

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.6.229";
+export const PACKAGE_VERSION = "0.7.0";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -24,8 +24,11 @@ export * as projectPy from "./src/project-py.ts";
 export * as projectRs from "./src/project-rs.ts";
 export * as publish from "./src/publish.ts";
 export * as release from "./src/release.ts";
+export * as releaseCatalog from "./src/release-catalog.ts";
 export * as releaseDispatch from "./src/release-dispatch.ts";
 export * as releaseGithub from "./src/release-github.ts";
+export * as releasePlan from "./src/release-plan.ts";
+export * as releasePlease from "./src/release-please.ts";
 export * as scaffold from "./src/scaffold.ts";
 export * as tags from "./src/tags.ts";
 export * as tsconfig from "./src/tsconfig.ts";
@@ -56,9 +59,14 @@ export type { CargoDependencyOptions, CargoDependency, RustCliOptions, RustPacka
 export { COMPILED_DIR, COMPILED_COMPILER_OPTIONS } from "./src/publish.ts";
 export { DBXToolsRelease } from "./src/release.ts";
 export type { ReleaseStage, ReleaseDocsOptions, ReleaseSummaryOptions, DBXToolsReleaseOptions } from "./src/release.ts";
+export { DBXToolsReleaseCatalog } from "./src/release-catalog.ts";
+export type { DBXToolsVersioningMode, ReleaseProjectLanguage, ReleaseArtifactKind, ReleaseEdgeKind, ReleasePropagation, ReleaseUnitRule, DBXToolsReleaseCatalogOptions, ReleaseDependencyInput, ReleaseProjectRegistration, ExternalReleaseProjectRegistration, ReleaseArtifactRegistration, ReleaseProjectNode, ReleaseArtifact, ReleaseDependencyEdge, ReleaseUnit, ReleaseUnitGraph } from "./src/release-catalog.ts";
 export { RELEASE_TAG, RELEASE_SHA, RELEASE_VERSION, RELEASE_SUMMARY_DIRECTORY, RELEASE_SUMMARY_PROVIDER_NAMES, RELEASE_SUMMARY_FILE } from "./src/release-dispatch.ts";
 export type { ReleaseSummaryProviderName } from "./src/release-dispatch.ts";
 export type { GithubRepositoryIdentity } from "./src/release-github.ts";
+export type { ReleaseReason, PlannedReleaseUnit, PlannedPackage, PlannedArtifact, PlannedRustTarget, ReleasePlan } from "./src/release-plan.ts";
+export { ReleaseUnitWorkspacePlugin } from "./src/release-please.ts";
+export type { ReleaseUnitWorkspacePluginOptions } from "./src/release-please.ts";
 export { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS } from "./src/tags.ts";
 export type { PackageTag } from "./src/tags.ts";
 export { DBXToolsRootTsconfig } from "./src/tsconfig.ts";

package/package.json

@@ -18,6 +18,7 @@
   },
   "devDependencies": {
     "@types/node": "^24.6.0",
+    "@types/semver": "^7.7.1",
     "constructs": "^10.0.0",
     "projen": "^0.101.6",
     "tsoa": "^6.6.0",
@@ -25,9 +26,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.229",
-    "@dbx-tools/path": "0.6.229",
-    "@dbx-tools/shared-core": "0.6.229",
+    "@dbx-tools/core": "^0.6.229",
+    "@dbx-tools/path": "^0.6.229",
+    "@dbx-tools/shared-core": "^0.6.229",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -35,7 +36,9 @@
     "openapi-typescript": "^7.13.0",
     "oxc-parser": "^0.90.0",
     "projen": "^0.101.16",
-    "smol-toml": "^1.7.1",
+    "release-please": "17.11.2",
+    "semver": "^7.7.3",
+    "smol-toml": "1.8.0",
     "ts-to-zod": "^5.1.0",
     "yaml": "^2.9.0"
   },
@@ -47,7 +50,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.229",
+  "version": "0.7.0",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/openapi.ts

@@ -48,6 +48,7 @@ import {
   toPosix,
   recordedPackages,
 } from "./packages.ts";
+import type { ReleaseUnitGraph } from "./release-catalog.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
 const logger = log.logger("projen:openapi");
@@ -174,9 +175,16 @@ export async function generateOpenapi(): Promise<string[]> {
     skipLibCheck: true,
   };
 
-  const specVersion = readWorkspaceVersion(repoRoot);
+  const releaseGraphPath = join(repoRoot, ".projen/release-units.json");
+  const releaseGraph = existsSync(releaseGraphPath)
+    ? (JSON.parse(readFileSync(releaseGraphPath, "utf8")) as ReleaseUnitGraph)
+    : undefined;
   const written: string[] = [];
   for (const p of pkgs) {
+    const releaseProject = releaseGraph?.projects.find((project) => project.path === p.path);
+    const specVersion =
+      releaseGraph?.units.find((unit) => unit.id === releaseProject?.unit)?.version ??
+      readWorkspaceVersion(repoRoot);
     // The generated package's folder is the source's leaf folder name (`api`), not
     // its npm name - `p.name` is the (possibly-overridden) manifest name.
     const leaf = p.relPath.split("/").pop() ?? p.relPath;

package/src/project-js.ts

@@ -41,11 +41,18 @@ import {
 import { PnpmWorkspaceState, type DBXToolsPNPMWorkspaceOptions } from "./pnpm-workspace.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions as CommonProjectOptions } from "./project.ts";
 import { applyCompiledPublish } from "./publish.ts";
+import {
+  DBXToolsReleaseCatalog,
+  type DBXToolsVersioningMode,
+  type ExternalReleaseProjectRegistration,
+  type ReleaseDependencyInput,
+  type ReleaseUnitRule,
+} from "./release-catalog.ts";
 import { DBXToolsRelease, type ReleaseDocsOptions, type ReleaseSummaryOptions } from "./release.ts";
 import { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS, type PackageTag } from "./tags.ts";
 import { DBXToolsRootTsconfig } from "./tsconfig.ts";
 import { DBXToolsVsCode } from "./vscode.ts";
-import { readWorkspaceVersion, syncWorkspaceManifestVersion } from "./workspace-version.ts";
+import { syncWorkspaceManifestVersion } from "./workspace-version.ts";
 
 /**
  * The dbx-tools project surface, backed by projen's Node toolchain. A single
@@ -70,6 +77,8 @@ export interface DBXToolsJavaScriptProject extends DBXToolsProject, javascript.N
   vsCode?: DBXToolsVsCode;
   /** Repository outputs excluded from generated workflow dependency-cache hashing. */
   readonly workflowCacheIgnorePaths: readonly string[];
+  /** Cross-language release-unit ownership and version lookup. */
+  readonly releaseCatalog: DBXToolsReleaseCatalog;
 }
 
 /** Parsed npm package identifier: optional scope plus the unscoped package name. */
@@ -625,10 +634,20 @@ export type DBXToolsJavaScriptProjectOptions = CommonProjectOptions &
     readonly releaseValidationTasks?: readonly string[];
     /** Optional AI-generated release summary. Defaults to enabled. */
     readonly releaseSummary?: boolean | ReleaseSummaryOptions;
+    /** Existing source branch safely fast-forwarded after an independent release. */
+    readonly releaseSyncBranch?: string | false;
     /** Set to `false` to omit normal npm workspace publication. */
     readonly nodeRelease?: boolean;
     /** Unified dbx-tools release workflow, or no release surface. Defaults to `dbx-tools`. */
     readonly releaseMode?: DBXToolsReleaseMode;
+    /** Package version ownership mode. Defaults to `fixed`. */
+    readonly versioningMode?: DBXToolsVersioningMode;
+    /** Explicit stable release-unit grouping rules. */
+    readonly releaseUnits?: readonly ReleaseUnitRule[];
+    /** Commit before the first independent Release Please history. */
+    readonly releaseBootstrapSha?: string;
+    /** Publishable workspace members synthesized outside the attached project tree. */
+    readonly externalReleaseProjects?: readonly ExternalReleaseProjectRegistration[];
     /** Prefix for generated release tags. Defaults to `v`. */
     readonly releaseTagPrefix?: string;
     /** Semantic PR title validation policy. Omitted or `false` disables title validation. */
@@ -682,6 +701,7 @@ export class DBXToolsNodeProject
   readonly extraWorkspaceMembers: readonly string[];
   readonly releaseBranch: string;
   readonly workflowCacheIgnorePaths: readonly string[];
+  readonly releaseCatalog: DBXToolsReleaseCatalog;
   private readonly rootInstallOnly: boolean;
 
   constructor(options: DBXToolsJavaScriptProjectOptions = {}) {
@@ -708,9 +728,14 @@ export class DBXToolsNodeProject
     // component, but the file is still required by the Databricks Apps platform
     // (its build phase installs with pnpm and reads catalog + `allowBuilds`).
     pnpmWorkspace.attachWorkspaceFile(this);
-    // Copy the single workspace version onto the root manifest. The `VERSION` file
-    // at the workspace root is the source of truth; synth only reads it.
-    this.package.addField("version", readWorkspaceVersion(this.outdir));
+    this.releaseCatalog = new DBXToolsReleaseCatalog(this, {
+      mode: options.versioningMode,
+      units: options.releaseUnits,
+      externalProjects: options.externalReleaseProjects,
+      bootstrapSha: options.releaseBootstrapSha,
+    });
+    registerJavaScriptReleaseProject(this);
+    this.package.addField("version", () => this.releaseCatalog.versionFor(this));
     this.scope = scope;
     this.extraWorkspaceMembers = options.extraWorkspaceMembers ?? [];
     this.releaseBranch = options.defaultReleaseBranch ?? "main";
@@ -795,6 +820,7 @@ export class DBXToolsTypeScriptProject
   readonly extraWorkspaceMembers: readonly string[];
   readonly releaseBranch: string;
   readonly workflowCacheIgnorePaths: readonly string[];
+  readonly releaseCatalog: DBXToolsReleaseCatalog;
   private readonly rootInstallOnly: boolean;
 
   constructor(options: DBXToolsTypeScriptProjectOptions) {
@@ -837,6 +863,16 @@ export class DBXToolsTypeScriptProject
     this.releaseBranch = options.defaultReleaseBranch ?? "main";
     this.workflowCacheIgnorePaths = options.workflowCacheIgnorePaths ?? [];
     this.rootInstallOnly = options.rootInstallOnly !== false;
+    this.releaseCatalog =
+      parent &&
+      (parent instanceof DBXToolsNodeProject || parent instanceof DBXToolsTypeScriptProject)
+        ? parent.releaseCatalog
+        : new DBXToolsReleaseCatalog(this, {
+            mode: options.versioningMode,
+            units: options.releaseUnits,
+            externalProjects: options.externalReleaseProjects,
+            bootstrapSha: options.releaseBootstrapSha,
+          });
     // Pairs with `jsx` in SHARED_COMPILER_OPTIONS: projen's default `include` is
     // `src/**/*.ts` only, which silently omits a `.tsx` file from the program
     // instead of failing, so authoring a React component would otherwise need
@@ -852,10 +888,8 @@ export class DBXToolsTypeScriptProject
       ".": "./index.ts",
       "./package.json": "./package.json",
     });
-    // Every package carries the single workspace version, copied from the root
-    // `VERSION` file (the source of truth). `this.root` is the workspace root for a
-    // discovered member and this project itself for a standalone compiling root.
-    this.package.addField("version", readWorkspaceVersion(this.root.outdir));
+    this.package.addField("version", () => this.releaseCatalog.versionFor(this));
+    registerJavaScriptReleaseProject(this);
     addPackageFiles(this, "index.ts", "src");
     // `bun test` intercepts `node:test` (the suites keep using node:test) and
     // runs it with bun's own fast runner. The native no-tests option is portable
@@ -878,6 +912,27 @@ export class DBXToolsTypeScriptProject
   }
 }
 
+function registerJavaScriptReleaseProject(project: DBXToolsJavaScriptProject): void {
+  const projectPath = toPosix(relative(project.root.outdir, project.outdir));
+  project.releaseCatalog.registerProject(project, {
+    language: "javascript",
+    identity: () => String(project.package.manifest.name ?? project.name),
+    publish: () => project.package.manifest.private !== true,
+    sourcePaths: ["src", "bin", "tasks"].map((path) =>
+      projectPath ? `${projectPath}/${path}` : path,
+    ),
+    dependencies: () =>
+      project.deps.all.map<ReleaseDependencyInput>((dependency) => ({
+        target: dependency.name,
+        kind:
+          dependency.type === "devenv" || dependency.type === "override"
+            ? "development"
+            : dependency.type,
+        ...(dependency.version ? { requirement: dependency.version } : {}),
+      })),
+  });
+}
+
 function configureBuildWorkflow(
   project: DBXToolsNodeProject | DBXToolsTypeScriptProject,
   options: DBXToolsJavaScriptProjectOptions,
@@ -951,9 +1006,11 @@ function resolveRootWorkspace(
   extraWorkspaceMembers: readonly string[],
 ): void {
   if (project.parent) return;
-  const version = readWorkspaceVersion(project.outdir);
   for (const member of extraWorkspaceMembers) {
-    syncWorkspaceManifestVersion(join(project.outdir, member, "package.json"), version);
+    syncWorkspaceManifestVersion(
+      join(project.outdir, member, "package.json"),
+      project.releaseCatalog.versionForPath(member),
+    );
   }
   project.pnpmWorkspace?.resolveMembers(project, extraWorkspaceMembers);
 }
@@ -1546,6 +1603,7 @@ function initProject(
       pythonRoot: options.releasePythonRoot,
       validationTasks: options.releaseValidationTasks,
       summary: options.releaseSummary,
+      syncBranch: options.releaseSyncBranch,
     });
   }
 }

package/src/project-py.ts

@@ -9,6 +9,8 @@ import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
 import { RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
 import {
+  independentReleaseSetupSteps,
+  registerIndependentPublicationJob,
   releaseArtifactSteps,
   releasePublishCondition,
   releaseStageCondition,
@@ -128,6 +130,14 @@ export function pythonModuleName(scope: string, directory: string): string {
   return [scope, ...directory.split("/")].map((part) => part.replaceAll("-", "_")).join(".");
 }
 
+/** Published requirement for one internal Python dependency. */
+export function pythonReleaseRequirement(version: string, exact = false): string {
+  if (exact) return `==${version}`;
+  const [major, minor] = version.split(".").map(Number);
+  const upper = major === 0 ? `0.${minor + 1}.0` : `${major + 1}.0.0`;
+  return `>=${version},<${upper}`;
+}
+
 function projectVscode(project: Project): vscode.VsCode | undefined {
   return (project as Project & { readonly vscode?: vscode.VsCode }).vscode;
 }
@@ -264,9 +274,10 @@ export class DBXToolsPythonWorkspace extends Component {
     }));
     const resolvedOptions = { ...options, packages };
     this.requiresPython = options.requiresPython ?? ">=3.10";
-    // The single workspace version, copied from the root `VERSION` file so Python
-    // members carry the same number as their JS siblings.
-    this.version = readWorkspaceVersion(project.outdir);
+    this.version =
+      isDBXToolsJavaScriptProject()(project) && project.releaseCatalog.mode === "independent"
+        ? "0.0.0"
+        : readWorkspaceVersion(project.outdir);
     this.file = this.emitWorkspace(project, resolvedOptions, scope);
     this.packages = packages.map(
       (pkg) =>
@@ -275,9 +286,45 @@ export class DBXToolsPythonWorkspace extends Component {
           package: pkg,
           repository: this.repository,
           requiresPython: this.requiresPython,
-          version: this.version,
+          version: isDBXToolsJavaScriptProject()(project)
+            ? project.releaseCatalog.versionForRegistration(
+                "python",
+                pkg.name,
+                pythonPackagePath(this.repository, pkg.directory),
+              )
+            : this.version,
         }),
     );
+    if (isDBXToolsJavaScriptProject()(project)) {
+      for (const pkg of this.packages) {
+        project.releaseCatalog.registerProject(pkg, {
+          language: "python",
+          identity: pkg.packageOptions.name,
+          sourcePaths: [`${pythonPackagePath(this.repository, pkg.packageOptions.directory)}/src`],
+          dependencies: (pkg.packageOptions.internalDependencies ?? []).map((directory) => {
+            const dependency = packagesByDirectory.get(directory);
+            if (!dependency) {
+              throw new Error(
+                `Python package ${pkg.packageOptions.directory} references unknown internal package ${directory}`,
+              );
+            }
+            const version = project.releaseCatalog.versionForRegistration(
+              "python",
+              dependency.name,
+              pythonPackagePath(this.repository, dependency.directory),
+            );
+            return {
+              target: dependency.name,
+              kind: "runtime" as const,
+              requirement: pythonReleaseRequirement(version, dependency.uniffi === true),
+              propagation: "outside-range" as const,
+              publishOrder: true,
+              internal: true,
+            };
+          }),
+        });
+      }
+    }
     for (const pkg of this.packages) {
       const pyproject = `/${pythonPackagePath(this.repository, pkg.packageOptions.directory)}/pyproject.toml`;
       project.gitignore.include(pyproject);
@@ -415,6 +462,88 @@ export class DBXToolsPythonWorkspace extends Component {
     if (!workflow) {
       throw new Error("Python release requires the root dbx-tools release mode");
     }
+    if (project.releaseCatalog.mode === "independent") {
+      workflow.addJob("build-python", {
+        if: usesRustArtifacts
+          ? "${{ always() && needs.release-plan.outputs.python == 'true' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
+          : "${{ needs.release-plan.outputs.python == 'true' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}",
+        needs: ["release-plan", ...(usesRustArtifacts ? ["rust-build"] : [])],
+        runsOn: ["ubuntu-latest"],
+        permissions: { actions: JobPermission.READ, contents: JobPermission.READ },
+        timeoutMinutes: 20,
+        env: { BUN_VERSION },
+        steps: [
+          ...independentReleaseSetupSteps(project),
+          { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
+          ...uniffiPublications.map((publication) => ({
+            name: `Download ${publication.distribution} native wheels`,
+            uses: "actions/download-artifact@v8",
+            with: {
+              pattern: `${publication.distribution}--*--python-wheel`,
+              path: `dist/${publication.directory}`,
+              "merge-multiple": true,
+            },
+          })),
+          {
+            name: "Build affected distributions",
+            shell: "bash",
+            run: publications
+              .map(
+                (publication) =>
+                  `if jq -e --arg package ${quote(publication.distribution)} '.pythonPackages[] | select(.identity == $package)' dist/release-plan.json >/dev/null; then uv build --package ${quote(publication.distribution)} --out-dir dist/${publication.directory}; fi`,
+              )
+              .join("\n"),
+          },
+          {
+            name: "Validate affected distributions",
+            run: "find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check",
+          },
+          {
+            name: "Upload distributions",
+            uses: "actions/upload-artifact@v7",
+            with: { name: "python-distributions", path: "dist", "retention-days": 7 },
+          },
+        ],
+      });
+      for (const publication of allPublications) {
+        const dependencyJobs = (publication.dependencies ?? []).map(
+          (dependency) => `publish-pypi-${dependency}`,
+        );
+        const dependencyCondition = dependencyJobs
+          .map((job) => `needs.${job}.result != 'failure' && needs.${job}.result != 'cancelled'`)
+          .join(" && ");
+        workflow.addJob(`publish-pypi-${publication.directory}`, {
+          if: `\${{ always() && needs.build-python.result == 'success' && contains(needs.release-plan.outputs.python_packages, '"identity":"${publication.distribution}"') && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python')${dependencyCondition ? ` && ${dependencyCondition}` : ""} }}`,
+          needs: ["release-plan", "build-python", ...dependencyJobs],
+          environment: {
+            name: publication.environment,
+            url:
+              options.environmentUrl ??
+              `https://pypi.org/project/${publication.distribution.replaceAll("_", "-")}/`,
+          },
+          runsOn: ["ubuntu-latest"],
+          permissions: { idToken: JobPermission.WRITE },
+          timeoutMinutes: 10,
+          steps: [
+            {
+              name: "Download distributions",
+              uses: "actions/download-artifact@v8",
+              with: { name: "python-distributions", path: "dist" },
+            },
+            {
+              name: `Publish ${publication.distribution} to PyPI`,
+              uses: "pypa/gh-action-pypi-publish@release/v1",
+              with: {
+                "packages-dir": `dist/${publication.directory}`,
+                "skip-existing": true,
+              },
+            },
+          ],
+        });
+        registerIndependentPublicationJob(workflow, `publish-pypi-${publication.directory}`);
+      }
+      return;
+    }
     workflow.addJob("build-python", {
       if: usesRustArtifacts
         ? "${{ always() && needs.verify-context.result == 'success' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"