@dbx-tools/projen 0.6.39 → 0.6.41

package/src/project.ts

@@ -22,7 +22,13 @@ import { applyCompiledPublish } from "./publish.ts";
 import { DBXToolsRelease, type StandaloneRelease } from "./release.ts";
 import { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS, type PackageTag } from "./tags.ts";
 import { DBXToolsRootTsconfig } from "./tsconfig.ts";
-import { DEFAULT_VITE_OVERRIDES, ViteConfigFile } from "./vite.ts";
+import {
+  BUN_APP_OVERRIDES,
+  BunBuildFile,
+  BunDevServerFile,
+  BunfigFile,
+  RootBunfigFile,
+} from "./bun-app.ts";
 import { DBXToolsVsCode } from "./vscode.ts";
 import {
   DEFAULT_PACKAGE_ROOTS,
@@ -147,11 +153,11 @@ function applyRepository(project: javascript.NodeProject, override?: string): vo
   });
 }
 
-/** Inherit a parent's package manager, else pnpm. */
+/** Inherit a parent's package manager, else bun. */
 function inheritedPackageManager(
   parent: javascript.NodeProject | undefined,
 ): javascript.NodePackageManager {
-  return parent?.package.packageManager ?? javascript.NodePackageManager.PNPM;
+  return parent?.package.packageManager ?? javascript.NodePackageManager.BUN;
 }
 
 /** Override a package's generated tsconfig `compilerOptions` (later-wins per key). */
@@ -328,12 +334,19 @@ export const PROJEN_VERSION = "^0.101.16";
 function defaultProjectOptions(options: DBXToolsProjectOptions): DBXToolsProjectOptions {
   const isRoot = options.parent === undefined;
   return {
-    packageManager: javascript.NodePackageManager.PNPM,
+    // Bun owns install/run/build/test locally and in CI. projen renders
+    // `bun install`/`bunx` and a native `trustedDependencies` field from this.
+    // The engine still emits `pnpm-workspace.yaml` itself (see
+    // {@link PnpmWorkspaceState}) for the Databricks Apps platform, whose build
+    // phase installs with pnpm - so a deployed app keeps its catalog + build
+    // allowances even though the local/CI manager is bun.
+    packageManager: javascript.NodePackageManager.BUN,
     // Pinned rather than left to projen's "latest": 0.101.16 is the first release
-    // whose `NodePackage` owns `pnpm-workspace.yaml` natively, and this engine
-    // writes that file itself ({@link DBXToolsPNPMWorkspace}). Floating would let
-    // an install cross that boundary silently, so the version the engine is known
-    // to co-exist with is stated here and bumped deliberately.
+    // whose `NodePackage` renders bun's `trustedDependencies` natively. Under bun,
+    // projen does NOT create the `pnpm-workspace.yaml` component itself (that call
+    // site is gated to pnpm), so the engine constructs it directly ({@link
+    // PnpmWorkspaceState}). Floating would let an install cross that boundary
+    // silently, so the co-tested version is stated here and bumped deliberately.
     projenVersion: PROJEN_VERSION,
     defaultReleaseBranch: "main",
     projenrcJs: false,
@@ -403,8 +416,8 @@ function copiedGitIgnoreOptions(
 /**
  * The engine's `TypeScriptProject` defaults - a superset of {@link defaultProjectOptions}.
  * A DBXTools TS project can itself be the ROOT (a standalone compiling root), so the
- * same parent-based root/child logic applies; this just layers on tsx/typescript and
- * disables sample code.
+ * same parent-based root/child logic applies; this just layers on typescript +
+ * bun types and disables sample code. No `tsx`: bun runs `.ts` directly.
  */
 function defaultTypeScriptProjectOptions(
   options: DBXToolsTypeScriptProjectOptions,
@@ -417,15 +430,16 @@ function defaultTypeScriptProjectOptions(
     // ESLint is configured once on the ROOT (see initProject) and lints the whole
     // tree, so packages don't emit their own config. A caller can still override.
     eslint: false,
-    devDeps: [...(base.devDeps ?? []), "tsx@^4.23.0", "typescript@^5.9.3"],
+    devDeps: [...(base.devDeps ?? []), "typescript@^5.9.3", "@types/bun@^1.3.14"],
     ...options,
     ...copiedGitIgnoreOptions(options),
   };
 }
 
-// Pinned to match the subproject defaults so pnpm resolves a single tsx/typescript
+// Pinned to match the subproject defaults so bun resolves a single typescript
 // across the workspace (a bare name -> `*` could pull a second, newer major).
-const DEV_DEPS_ROOT: string[] = ["tsx@^4.23.0", "typescript@^5.9.3"];
+// `@types/bun` gives the `Bun.*` globals the server/app tags now use.
+const DEV_DEPS_ROOT: string[] = ["typescript@^5.9.3", "@types/bun@^1.3.14"];
 
 /** Options for {@link DBXToolsNodeProject} (the monorepo root). */
 export interface DBXToolsProjectOptions
@@ -478,13 +492,22 @@ export interface DBXToolsProjectOptions
    * `@dbx-tools/projen` engine in `projen/`, tagged `projen-v*`).
    */
   readonly standaloneReleases?: readonly StandaloneRelease[];
+  /**
+   * Extra workspace member paths (repo-relative, POSIX) to list in the workspace
+   * config ALONGSIDE the discovered `packageRoots` members - for a package that
+   * is synthesized by its OWN `.projenrc.ts` (so it isn't a root subproject) but
+   * should still resolve as a workspace sibling. The `@dbx-tools/projen` engine in
+   * `projen/` is the case: it synthesizes itself (avoiding a dogfooding cycle) yet
+   * is a member of the single bun workspace, so the root links it from source.
+   */
+  readonly extraWorkspaceMembers?: readonly string[];
 }
 
 /** Options for {@link DBXToolsTypeScriptProject} (a package, or a compiling root). */
 export interface DBXToolsTypeScriptProjectOptions
   extends Partial<typescript.TypeScriptProjectOptions>, DBXToolsProjectOptions {
-  /** Emit a projen-owned `vite.config.ts`. */
-  readonly viteConfig?: boolean;
+  /** Emit the projen-owned bun app scaffolding (`bunfig.toml`/`dev.ts`/`build.ts`). */
+  readonly bunApp?: boolean;
 }
 
 /**
@@ -498,6 +521,7 @@ export class DBXToolsNodeProject extends javascript.NodeProject implements DBXTo
   pnpmWorkspace?: PnpmWorkspaceState;
   rootTsconfig?: DBXToolsRootTsconfig;
   vsCode?: DBXToolsVsCode;
+  private readonly extraWorkspaceMembers: readonly string[];
 
   constructor(options: DBXToolsProjectOptions = {}) {
     const { name, scope } = resolveIdentity(options);
@@ -505,11 +529,12 @@ export class DBXToolsNodeProject extends javascript.NodeProject implements DBXTo
       options.release && options.releaseTrigger === undefined
         ? { releaseTrigger: ReleaseTrigger.tagged({ tags: ["v*"] }) }
         : {};
-    // Before `super`, since `NodePackage` creates the native
-    // `javascript.PnpmWorkspaceYaml` from these options inside the base
-    // constructor and `this` is unreachable until it returns. Given nothing,
-    // projen writes no workspace file at all - it never derives members from
-    // `project.subprojects` (see `pnpm-workspace.ts`).
+    // Holds the workspace state (members/catalog/allowBuilds/overrides). Under
+    // bun, projen's base constructor does NOT create the `PnpmWorkspaceYaml`
+    // component (its `configurePnpm` call site is gated to pnpm), so this state's
+    // options are wired into a directly-constructed component below - AND mirrored
+    // into `package.json` (`workspaces`/`catalog`) for bun to read. The
+    // `pnpm-workspace.yaml` is still emitted for the Databricks Apps pnpm install.
     const pnpmWorkspace = new PnpmWorkspaceState(options);
     super({
       ...defaultProjectOptions(options),
@@ -522,7 +547,12 @@ export class DBXToolsNodeProject extends javascript.NodeProject implements DBXTo
     });
 
     this.pnpmWorkspace = pnpmWorkspace;
+    // Emit `pnpm-workspace.yaml` ourselves: under bun projen skips the native
+    // component, but the file is still required by the Databricks Apps platform
+    // (its build phase installs with pnpm and reads catalog + `allowBuilds`).
+    pnpmWorkspace.attachWorkspaceFile(this);
     this.scope = scope;
+    this.extraWorkspaceMembers = options.extraWorkspaceMembers ?? [];
     this.dbxToolsConfig = new DBXToolsConfig(this, options);
     initProject(this, options);
   }
@@ -531,7 +561,8 @@ export class DBXToolsNodeProject extends javascript.NodeProject implements DBXTo
     super.preSynthesize();
     // Members come from the attached subprojects, which the root's scan appends
     // after construction - so the list is filled here, not in the constructor.
-    this.pnpmWorkspace?.resolveMembers(this);
+    // `extraWorkspaceMembers` adds self-synthesizing siblings (e.g. `projen/`).
+    this.pnpmWorkspace?.resolveMembers(this, this.extraWorkspaceMembers);
     preSynthesizeProject(this);
   }
 }
@@ -588,8 +619,19 @@ export class DBXToolsTypeScriptProject
       "./package.json": "./package.json",
     });
     addPackageFiles(this, "index.ts", "src");
-    this.testTask.exec("tsx --test 'test/**/*.test.ts'");
-    if (options.viteConfig ?? false) new ViteConfigFile(this);
+    // `bun test` intercepts `node:test` (the suites keep using node:test) and
+    // runs it with bun's own fast runner. Args are FILTERS, not globs; a bare
+    // directory auto-discovers `*.test.ts` recursively. But `bun test` EXITS 1
+    // when it matches no files (unlike the old `tsx --test 'glob'`, which was a
+    // no-op), so guard it: only invoke when a `*.test.ts` exists, else succeed.
+    this.testTask.exec(
+      'find test -name "*.test.ts" 2>/dev/null | grep -q . && bun test test || true',
+    );
+    if (options.bunApp ?? false) {
+      new BunfigFile(this);
+      new BunDevServerFile(this);
+      new BunBuildFile(this);
+    }
     initProject(this, options);
   }
 
@@ -746,15 +788,17 @@ function registerRootTasks(project: javascript.NodeProject): void {
 }
 
 /**
- * `tsx <rel>/tasks/<script>` command for a projen task, relative to `project.outdir`.
- * Resolves the engine's `tasks/` dir off its installed package root (via
- * {@link resolvePkgRoot}), so it works both in-repo and when the engine is a
- * dependency in a consumer's `node_modules` - no filesystem walking.
+ * `bun node_modules/@dbx-tools/projen/tasks/<script>` command for a projen task.
+ *
+ * Use the stable package symlink, never `require.resolve()`'s physical store
+ * path. A later install can change the peer-hash directory while leaving the
+ * package symlink valid; persisting the physical path made every generated task
+ * fail with ERR_MODULE_NOT_FOUND after such an update. bun runs the `.ts`
+ * directly (no tsx, no build step).
  */
-export function taskScript(project: javascript.NodeProject, script: string, args = ""): string {
-  const scriptPath = join(resolvePkgRoot(), "tasks", script);
-  const rel = toPosix(relative(resolve(project.outdir), scriptPath));
-  return args ? `tsx ${rel} ${args}` : `tsx ${rel}`;
+export function taskScript(_project: javascript.NodeProject, script: string, args = ""): string {
+  const scriptPath = toPosix(join("node_modules", "@dbx-tools", "projen", "tasks", script));
+  return args ? `bun ${scriptPath} ${args}` : `bun ${scriptPath}`;
 }
 
 /**
@@ -787,20 +831,21 @@ function initProject(
   project.package.file.readonly = false;
 
   // NodeProject has no built-in TS projenrc support (unlike TypeScriptProject), so
-  // wire `.projenrc.ts` through the tsx runner - this also populates the `default`
-  // task that `pnpm exec projen` runs (and that the `sync` watcher invokes to re-synth).
+  // wire `.projenrc.ts` through a runner - this also populates the `default` task
+  // that `bunx projen` runs (and that the `sync` watcher invokes to re-synth).
+  // The runner choice is immaterial since the exec is reset to plain `bun` below;
+  // `nodejs()` avoids declaring a `ts-node`/`tsx` dependency.
   new typescript.ProjenrcTs(project, {
-    runner: typescript.TypeScriptRunner.tsx(),
+    runner: typescript.TypeScriptRunner.nodejs(),
   });
-  // ProjenrcTs wraps that step in `npx -y -p tsx -c "tsx .projenrc.ts"` because the
-  // tsx runner declares a `tsx` dependency (so it runs even uninstalled). tsx IS a
-  // devDep here, so that wrapper is not merely redundant but harmful: `npx -c` exports
-  // `npm_config_call="tsx .projenrc.ts"` into the environment, which every nested
-  // `pnpm` inherits and then dies on ("Failed parsing JSON config key call"), failing
-  // each subproject's post-synth install; the same `npx`/`npm` process also emits the
-  // "Unknown env config" warnings for pnpm's `catalog`/`@jsr:registry`/etc. Reset to a
-  // plain exec (tsx resolves from `node_modules/.bin`, which pnpm puts on PATH).
-  project.defaultTask?.reset("tsx .projenrc.ts");
+  // bun runs `.projenrc.ts` directly (native TS, no loader to register). Reset to
+  // a plain `bun` exec rather than any wrapper: the default task is spawned by
+  // nested installs/synths, and a wrapper that exported `npm_config_*` broke them.
+  project.defaultTask?.reset("bun .projenrc.ts");
+
+  // Pin bun's hoisted linker workspace-wide (see RootBunfigFile) so a peer dep
+  // resolves to one copy and singletons/types stay coherent.
+  new RootBunfigFile(project);
 
   // Only reached on a ROOT (early-returned above otherwise), so the root devDeps
   // always apply; the self-dep is added only when the engine is an installed pkg.
@@ -863,11 +908,12 @@ function initProject(
     eslint.addIgnorePattern(`${root}/openapi/**`);
     eslint.addIgnorePattern(`${root}/**/index.ts`);
   }
-  eslint.addIgnorePattern("**/vite.config.ts");
-  // The unmanaged vite overrides live at the package root, outside any `src/**`
-  // tsconfig include, so the type-aware parser cannot resolve them to a project.
-  // They are hand-authored (not generated), but ESLint still cannot parse them.
-  for (const override of DEFAULT_VITE_OVERRIDES) {
+  // The generated bun app scripts + unmanaged overrides live at the package root,
+  // outside any `src/**` tsconfig include, so the type-aware parser cannot resolve
+  // them to a project. ESLint still cannot parse them.
+  eslint.addIgnorePattern("**/dev.ts");
+  eslint.addIgnorePattern("**/build.ts");
+  for (const override of BUN_APP_OVERRIDES) {
     eslint.addIgnorePattern(`**/${override}`);
   }
   // Codegen packages declare `codegen.inputs` via mixins after construction; ignore

package/src/release.ts

@@ -11,7 +11,44 @@ import { applyTasks, taskScript, type DBXToolsNodeProject } from "./project.ts";
 
 const NODE_VERSION = "lts/*";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
-const PNPM_VERSION = "10.33.0";
+const BUN_VERSION = "1.3.14";
+
+/**
+ * The `release` workflow's version-stamp + publish step, as a shell script.
+ *
+ * Bun has no `pnpm -r publish` equivalent, so this drives the engine's
+ * `tasks/publish.ts` (shipped in the engine tarball, run via bun): it reads the
+ * workspace members from the root `package.json`, stamps the tag version onto
+ * every manifest (rewriting `@dbx-tools/*` `workspace:*` sibling deps to
+ * `^<version>` so the tarballs resolve each other), then `bun publish`es each
+ * non-`private` package. `bun publish` substitutes `publishConfig` (the compiled
+ * `lib/` entry points) at pack time, runs `prepack` (compile) so `lib/` exists,
+ * and honors `NPM_CONFIG_PROVENANCE`.
+ *
+ * Two ways in: a pushed `<prefix>*` tag (the real release - `GITHUB_REF_NAME` is
+ * the version) and a manual `workflow_dispatch` (no tag, so a throwaway
+ * `0.0.0-dry.<run>` version is used and `--dry-run` is FORCED regardless of the
+ * input, since a dispatch never has a tag to publish as). The `dry_run` input
+ * (default true) is what lets a maintainer exercise the whole workflow - setup,
+ * install, stamp, compile, pack, validate - with nothing reaching npm.
+ */
+function BUN_PUBLISH_SCRIPT(tagPrefix: string, excludeDirs: readonly string[]): string {
+  const script = "node_modules/@dbx-tools/projen/tasks/publish.ts";
+  const excludes = excludeDirs.map((dir) => ` --exclude ${dir}`).join("");
+  return [
+    'if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then',
+    // A manual run has no tag: use a throwaway version and never really publish.
+    '  VERSION="0.0.0-dry.${GITHUB_RUN_NUMBER}"',
+    "  DRY_RUN=--dry-run",
+    "else",
+    `  VERSION="\${GITHUB_REF_NAME#${tagPrefix}}"`,
+    // A tag push honors the input too, so a dry-run tag can be tested if wanted.
+    '  DRY_RUN="${DRY_RUN_INPUT}"',
+    "fi",
+    "chmod -R u+w . || true",
+    `bun ${script} "$VERSION"${excludes} $DRY_RUN`,
+  ].join("\n");
+}
 
 interface PublishWorkflow {
   readonly name: string;
@@ -24,17 +61,18 @@ interface PublishWorkflow {
 function publishSetupSteps(): JobStep[] {
   return [
     { name: "Checkout", uses: "actions/checkout@v6", with: { "fetch-depth": 0 } },
-    { name: "Setup pnpm", uses: "pnpm/action-setup@v5", with: { version: PNPM_VERSION } },
+    { name: "Setup Bun", uses: "oven-sh/setup-bun@v2", with: { "bun-version": BUN_VERSION } },
     {
       name: "Setup Node.js",
       uses: "actions/setup-node@v6",
       // setup-node writes the temporary npmrc that maps NODE_AUTH_TOKEN onto
       // npmjs. Omitting this leaves the secret in the environment but gives npm
       // no registry-scoped auth entry, and every publish fails with ENEEDAUTH.
+      // (Bun installs deps; publishing still goes through `npm publish`.)
       with: { "node-version": NODE_VERSION, "registry-url": NPM_REGISTRY_URL },
     },
-    // The lockfile is intentionally untracked and may be absent or stale in CI.
-    { name: "Install", run: "pnpm install --no-frozen-lockfile" },
+    // Bun's install; the lockfile may be absent or stale in CI so it is not frozen.
+    { name: "Install", run: "bun install" },
   ];
 }
 
@@ -160,12 +198,30 @@ export class DBXToolsRelease extends Component {
     // the publish job below overrides it with the `id-token` it needs.
     workflow.file?.addOverride("permissions", { contents: "read" });
     workflow.on({ push: { tags: [`${tagPrefix}*`] } });
+    // Manual trigger for testing the workflow WITHOUT reaching npm: a
+    // `workflow_dispatch` run has no tag, so the publish script forces
+    // `--dry-run` (pack + validate only). The `dry_run` input (default true)
+    // additionally lets a tag push be dry-run on demand.
+    workflow.file?.addOverride("on.workflow_dispatch", {
+      inputs: {
+        dry_run: {
+          description: "Pack and validate but do not upload to npm",
+          type: "boolean",
+          default: true,
+        },
+      },
+    });
     workflow.addJob("publish", {
       runsOn: ["ubuntu-latest"],
       // `id-token: write` lets npm mint the OIDC token for provenance attestation.
       permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
       timeoutMinutes: 30,
-      env: { CI: "true" },
+      // `DRY_RUN_INPUT` is `--dry-run` when the dispatch input is true, else empty;
+      // the publish script also FORCES it on any `workflow_dispatch` run.
+      env: {
+        CI: "true",
+        DRY_RUN_INPUT: "${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}",
+      },
       steps: [...publishSetupSteps(), ...steps],
       ...(workingDirectory ? { defaults: { run: { workingDirectory } } } : {}),
     });
@@ -182,26 +238,25 @@ export class DBXToolsRelease extends Component {
       name: "release",
       tagPrefix: this.tagPrefix,
       steps: [
-        // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. Set it on
-        // every package (manifests are projen-readonly, so unlock them first).
+        // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. Stamp it on
+        // every workspace package (manifests are projen-readonly, so unlock
+        // first), rewriting `workspace:*` sibling deps to `^<version>` so the
+        // published tarballs resolve each other. `bun publish` honors
+        // `publishConfig` (compiled `lib/` entry points) and provenance.
         {
-          name: "Set version from tag",
-          run: [
-            `VERSION="\${GITHUB_REF_NAME#${this.tagPrefix}}"`,
-            "chmod -R u+w . || true",
-            'pnpm -r exec npm version "$VERSION" --no-git-tag-version --allow-same-version',
-          ].join("\n"),
-        },
-        {
-          name: "Publish to npm",
-          // `pnpm -r publish` publishes every non-private package,
-          // rewriting `workspace:*` deps to the published version. Provenance is
-          // opt-in (omitted from each package's `publishConfig` so local
-          // publishes work); CI turns it on here via `npm_config_provenance`.
-          run: "pnpm -r publish --no-git-checks --access public",
+          name: "Set version from tag and publish",
+          // Exclude every standalone-release dir (e.g. `projen`): it publishes on
+          // its own `<prefix>-v*` tag via its own workflow, not the main `v*` one.
+          run: BUN_PUBLISH_SCRIPT(
+            this.tagPrefix,
+            this.standaloneReleases.map((s) => s.directory),
+          ),
           env: {
+            // `bun publish` authenticates via NPM_CONFIG_TOKEN (not NODE_AUTH_TOKEN,
+            // which is the `npm publish` convention). Set both so either tool works.
+            NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
             NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
-            npm_config_provenance: "true",
+            NPM_CONFIG_PROVENANCE: "true",
           },
         },
       ],
@@ -210,34 +265,55 @@ export class DBXToolsRelease extends Component {
 
   /**
    * Emit a {@link StandaloneRelease}'s workflow: push `<prefix>1.2.3` and the
-   * single package in `directory` (a non-workspace-member project) is published
-   * at 1.2.3 via `npm pack` + `npm publish`. Its `package.json` is
-   * projen-generated read-only, so it is unlocked before `npm version` rewrites
-   * it. No bump math - the pushed tag IS the published version.
+   * single package in `directory` is published at 1.2.3 via `bun publish`.
+   *
+   * `directory` (e.g. `projen/`) is a WORKSPACE MEMBER whose `@dbx-tools/*` deps
+   * are `workspace:*`. `bun publish` resolves those to whatever version its
+   * SIBLINGS carry (via the lockfile), so before publishing we set the version on
+   * the package AND its in-scope siblings, then refresh the lockfile - otherwise
+   * the published engine would depend on the siblings' on-disk `0.0.0`. The
+   * `Install` step already ran `bun install` from the repo root (the member
+   * subdir walks up to it), so the workspace is linked. The manifests are
+   * projen-readonly, hence the `chmod`. A manual `workflow_dispatch` run has no
+   * tag, so it uses a throwaway version and forces `--dry-run` (nothing to npm).
    */
   private authorStandaloneReleaseWorkflow(
     project: DBXToolsNodeProject,
     { name, directory, tagPrefix }: StandaloneRelease,
   ): void {
+    // The engine's release also stamps its in-scope siblings so `bun publish`
+    // resolves their `workspace:*` to the release version. Stamping the WHOLE
+    // workspace is simplest and harmless (only `directory` is published here).
+    const stampScript = "node_modules/@dbx-tools/projen/tasks/publish.ts";
     this.authorPublishWorkflow(project, {
       name,
       tagPrefix,
-      workingDirectory: directory,
       steps: [
-        // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. package.json
-        // is projen-generated read-only, so unlock it before `npm version` writes.
         {
-          name: "Set version from tag",
+          name: "Set version from tag and publish",
           run: [
-            "chmod u+w package.json",
-            `npm version "\${GITHUB_REF_NAME#${tagPrefix}}" --no-git-tag-version --allow-same-version`,
+            'if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then',
+            '  VERSION="0.0.0-dry.${GITHUB_RUN_NUMBER}"',
+            "  DRY_RUN=--dry-run",
+            "else",
+            `  VERSION="\${GITHUB_REF_NAME#${tagPrefix}}"`,
+            '  DRY_RUN="${DRY_RUN_INPUT}"',
+            "fi",
+            "chmod -R u+w . || true",
+            // Set the version across every member + refresh the lockfile (the
+            // publish task's stamp phase), so bun resolves the engine's
+            // `workspace:*` sibling deps to the release version at pack time.
+            `bun ${stampScript} "$VERSION" --stamp-only`,
+            // Then publish ONLY the standalone directory.
+            `cd ${directory} && bun publish --access public $DRY_RUN`,
           ].join("\n"),
-        },
-        { name: "Pack", run: "pnpm pack --pack-destination dist/js" },
-        {
-          name: "Publish to npm",
-          run: "npm publish dist/js/*.tgz --access public",
-          env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" },
+          env: {
+            // `bun publish` authenticates via NPM_CONFIG_TOKEN (not NODE_AUTH_TOKEN,
+            // which is the `npm publish` convention). Set both so either tool works.
+            NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
+            NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
+            NPM_CONFIG_PROVENANCE: "true",
+          },
         },
       ],
     });

package/src/tags.ts

@@ -15,6 +15,7 @@
  */
 import type { IMixin as ConstructsMixin } from "constructs";
 import { javascript } from "projen";
+import { BunBuildFile, BunDevServerFile, BunfigFile } from "./bun-app.ts";
 import { create } from "./mixin.ts";
 import {
   addPackageFiles,
@@ -25,7 +26,6 @@ import {
   srcModuleExports,
 } from "./project.ts";
 import * as projectPredicate from "./project-predicate.ts";
-import { ViteConfigFile } from "./vite.ts";
 
 /** Node compiler options: ES2022 lib + node types, deliberately no DOM. */
 const NODE_COMPILER_OPTIONS: javascript.TypeScriptCompilerOptions = {
@@ -81,30 +81,42 @@ export const PACKAGE_TAG_MIXINS = {
       "./package.json": "./package.json",
     });
   }),
-  // `app`: a full browser app built + served by Vite (needs an `index.html`
-  // entry). Self-contained React app: React + DOM lib + JSX + the vite toolchain
-  // and app tasks (`dev`/`build`/`preview`). `build` resets the compile task, so
-  // `compile` bundles with vite rather than `tsc`.
+  // `app`: a full browser app built + served by BUN (needs an `index.html`
+  // entry). Self-contained React app: React + DOM lib + JSX + bun's fullstack
+  // dev server (`dev.ts`, `Bun.serve` + HMR) and production bundle (`build.ts`,
+  // `Bun.build`). Tailwind v4 is compiled by `bun-plugin-tailwind` (wired in the
+  // generated `bunfig.toml`). No Vite.
   app: create(projectPredicate.hasTag("app"), (p) => {
     p.addDeps("react@catalog:", "react-dom@catalog:");
     p.addDevDeps(
-      "vite@catalog:",
-      "@vitejs/plugin-react@catalog:",
       "@types/react@catalog:",
       "@types/react-dom@catalog:",
+      // The Tailwind plugin the dev server + build load. Tailwind itself is a
+      // catalog dep the app declares (it also owns the Tailwind entry CSS).
+      "bun-plugin-tailwind@catalog:",
     );
     applyCompilerOptions(p, {
       target: "ES2022",
       lib: [...DOM_LIB],
       jsx: javascript.TypeScriptJsxMode.REACT_JSX,
-      types: ["vite/client"],
+      // `@types/bun` (a root/subproject devDep) supplies the `Bun.*` globals the
+      // generated `dev.ts`/`build.ts` use; no `vite/client`.
+      types: ["bun"],
+      // `@/` -> `src/` alias, resolved by both tsc and bun's bundler (bun reads
+      // tsconfig `paths`). Replaces the old Vite `resolve.alias` for `@`.
+      baseUrl: ".",
+      paths: { "@/*": ["./src/*"] },
     });
+    // bun runs the generated scripts directly. `build` resets the compile task so
+    // `compile` bundles with `Bun.build` rather than `tsc`.
     applyTasks(p, {
-      dev: { exec: "vite" },
-      build: { exec: "vite build" },
-      preview: { exec: "vite preview" },
+      dev: { exec: "bun dev.ts" },
+      build: { exec: "bun build.ts" },
+      preview: { exec: "bun dev.ts" },
     });
-    new ViteConfigFile(p);
+    new BunfigFile(p);
+    new BunDevServerFile(p);
+    new BunBuildFile(p);
     // An app has a single root entry, not a component library's subpaths - so it
     // replaces the `ui` tag's `./react`/`./styles.css` surface with a `.` root.
     applyExports(p, {
@@ -147,9 +159,11 @@ export const PACKAGE_TAG_MIXINS = {
       ...NODE_COMPILER_OPTIONS,
       experimentalDecorators: true,
     });
+    // bun runs the server `.ts` directly (native TS, no tsx). `--watch` restarts
+    // on change - the tsx-watch replacement.
     applyTasks(p, {
-      dev: { exec: "tsx watch src/server.ts" },
-      start: { exec: "tsx src/server.ts" },
+      dev: { exec: "bun --watch src/server.ts" },
+      start: { exec: "bun src/server.ts" },
     });
   }),
   node: create(projectPredicate.hasTag("node"), (p) => {