@dbx-tools/projen 0.9.12 → 0.9.18

package/src/openapi.ts

@@ -1,9 +1,9 @@
 /**
- * OpenAPI generator (tsoa-based).
+ * OpenAPI generator for tsoa controllers and code-first Rust producers.
  *
- * Scans `server`/`node` packages for modules that **import tsoa**
- * (`from 'tsoa'` / `from '@tsoa/runtime'`) and, for each package that has them,
- * generates a read-only `<root>/openapi/<name>` package:
+ * TypeScript packages are discovered from tsoa imports. Rust producers are
+ * recorded by `DBXToolsRustWorkspace`. Both feed the same optimized generated
+ * package:
  *
  *   - `openapi.json`   - the OpenAPI 3 spec (tsoa `generateSpec`, then Speakeasy
  *     optimization to extract duplicate inline schemas into components).
@@ -33,11 +33,11 @@ import {
   writeFileSync,
 } from "node:fs";
 import { createRequire } from "node:module";
-import { join } from "node:path";
+import { isAbsolute, join, relative, resolve } from "node:path";
 import { promisify } from "node:util";
 import * as bin from "@dbx-tools/core/bin";
 import { find } from "@dbx-tools/path";
-import { log, stringUtils } from "@dbx-tools/shared-core";
+import { log, object, stringUtils } from "@dbx-tools/shared-core";
 import type * as ts from "typescript";
 import { lazyRequire } from "./_lazy-require.ts";
 import { makeReadonly, makeWritable, stampGenerated } from "./generated.ts";
@@ -48,6 +48,7 @@ import {
   toPosix,
   recordedPackages,
 } from "./packages.ts";
+import type { RustOpenApiMapping, RustWorkspaceMapping } from "./project-rs.ts";
 import type { ReleaseUnitGraph } from "./release-catalog.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
@@ -62,45 +63,95 @@ const SPEAKEASY_OPENAPI_RELEASE_URL = `https://github.com/speakeasy-api/openapi/
 const execFileAsync = promisify(execFile);
 
 // prettier-ignore
-const CLIENT_TEMPLATE = (
-  // ============================================================================
-  /*ts*/`
-  import createClient, { type ClientOptions } from "openapi-fetch";
-  import type { paths } from "./schema";
-
-  /** Create a typed OpenAPI client (openapi-fetch); safe to use in the browser. */
-  export function createApiClient(options?: ClientOptions) {
-    return createClient<paths>(options);
-  }
-  `
-  // ============================================================================
-);
-const CLIENT_SRC = stringUtils.dedent(CLIENT_TEMPLATE, { trimEnd: false });
+const CLIENT_SRC =
+  stringUtils.dedent(
+    // ============================================================================
+    /*ts*/`
+    import createClient, { type ClientOptions } from "openapi-fetch";
+    import type { paths } from "./schema";
+
+    /** Create a typed OpenAPI client (openapi-fetch); safe to use in the browser. */
+    export function createApiClient(options?: ClientOptions) {
+      return createClient<paths>(options);
+    }
+    `
+    // ============================================================================
+  ) + "\n";
 
 /** True if any module file in `<pkg>/src` matches {@link TSOA_IMPORT}. */
 function hasTsoaControllers(pkg: Pick<RecordedPackage, "dir">): boolean {
-  const srcDir = join(pkg.dir, "src");
-  return [...find.findFiles("**/*", { cwd: srcDir })]
+  const srcDir = tsoaSource(pkg);
+  return object
+    .sequence(find.findFiles("**/*", { cwd: srcDir }))
     .filter(isModuleFile)
-    .some((f) => TSOA_IMPORT.test(readFileSync(join(srcDir, f), "utf8")));
+    .some((file) => TSOA_IMPORT.test(readFileSync(join(srcDir, file), "utf8")));
+}
+
+function tsoaSource(pkg: Pick<RecordedPackage, "dir">): string {
+  return join(pkg.dir, "src");
+}
+
+function isTsoaCandidate(pkg: RecordedPackage): boolean {
+  return pkg.tags.includes("server") || pkg.tags.includes("node");
 }
 
 /** `server`/`node` packages (never the generated `openapi` tag) with a tsoa import. */
-function controllerPackages(): RecordedPackage[] {
-  return recordedPackages().filter(
-    (p) => (p.tags.includes("server") || p.tags.includes("node")) && hasTsoaControllers(p),
-  );
+function controllerPackages(): object.Sequence<RecordedPackage> {
+  return object.sequence(recordedPackages()).filter(isTsoaCandidate).filter(hasTsoaControllers);
+}
+
+function rustOpenapiMappings(): RustOpenApiMapping[] {
+  const manifest = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8")) as unknown;
+  if (!object.isRecord(manifest)) return [];
+  const config = manifest.dbxToolsConfig;
+  if (!object.isRecord(config) || !object.isRecord(config.rust)) return [];
+  const mapping = config.rust as unknown as Partial<RustWorkspaceMapping>;
+  return Array.isArray(mapping.openapi) ? [...mapping.openapi] : [];
+}
+
+function inside(path: string, directory: string): boolean {
+  const child = relative(resolve(directory), resolve(path));
+  return child === "" || (!child.startsWith("..") && !isAbsolute(child));
+}
+
+/** Whether one changed source belongs to any producing package directory. */
+export function isOpenapiProducerSource(path: string, producers: readonly string[]): boolean {
+  const absolute = resolve(path);
+  return object.sequence(producers).some((producer) => inside(absolute, producer));
+}
+
+function rustOpenapiSources(mapping: RustOpenApiMapping): string[] {
+  return [resolve(repoRoot, mapping.rust, "src"), resolve(repoRoot, mapping.rust, "Cargo.toml")];
 }
 
-/** True if the changed path is a source file that matches {@link TSOA_IMPORT}. */
-export function isTsoaController(path: string): boolean {
-  const posix = toPosix(path);
-  return (
-    !posix.includes(`/${OPENAPI_TAG}/`) &&
-    isModuleFile(path) &&
-    existsSync(path) &&
-    TSOA_IMPORT.test(readFileSync(path, "utf8"))
-  );
+/** Source roots consumed by TypeScript and Rust OpenAPI producers. */
+export function openapiWatchRoots(): string[] {
+  return [
+    ...controllerPackages()
+      .map((pkg) => resolve(tsoaSource(pkg)))
+      .join(object.sequence(rustOpenapiMappings()).flatMap(rustOpenapiSources))
+      .distinct(),
+  ];
+}
+
+/** Whether one changed source belongs to an OpenAPI-producing package. */
+export function isOpenapiSource(path: string): boolean {
+  const absolute = resolve(path);
+  const segments = toPosix(relative(repoRoot, absolute)).split("/");
+  if (segments.includes(OPENAPI_TAG)) return false;
+  if (
+    object
+      .sequence(rustOpenapiMappings())
+      .flatMap(rustOpenapiSources)
+      .some((source) => inside(absolute, source))
+  ) {
+    return true;
+  }
+  return object
+    .sequence(recordedPackages())
+    .filter(isTsoaCandidate)
+    .filter((pkg) => inside(absolute, tsoaSource(pkg)))
+    .some(hasTsoaControllers);
 }
 
 /** GitHub release asset name for Speakeasy's OpenAPI binary. */
@@ -145,6 +196,59 @@ export async function optimizeOpenapiSpec(specPath: string, executable?: string)
   await execFileAsync(openapi, ["spec", "optimize", specPath, "--write", "--non-interactive"]);
 }
 
+/** Cargo arguments that export one Rust producer's aide document. */
+export function rustOpenapiArgs(
+  mapping: RustOpenApiMapping,
+  output: string,
+  targetDir = join(repoRoot, "target/openapi"),
+): string[] {
+  return [
+    "run",
+    "--quiet",
+    "--target-dir",
+    targetDir,
+    "--package",
+    mapping.crate,
+    ...(mapping.noDefaultFeatures ? ["--no-default-features"] : []),
+    ...(mapping.features.length ? ["--features", mapping.features.join(",")] : []),
+    ...(mapping.binary ? ["--bin", mapping.binary] : []),
+    "--",
+    "--generate-spec",
+    output,
+  ];
+}
+
+type OpenApiTypeTools = {
+  openapiTS: typeof import("openapi-typescript").default;
+  astToString: typeof import("openapi-typescript").astToString;
+};
+
+async function writeClientPackage(
+  outDir: string,
+  source: string,
+  tools: OpenApiTypeTools,
+): Promise<void> {
+  const srcDir = join(outDir, "src");
+  mkdirSync(srcDir, { recursive: true });
+  const specPath = join(outDir, "openapi.json");
+  const spec = JSON.parse(readFileSync(specPath, "utf8"));
+  const schemaPath = join(srcDir, "schema.ts");
+  makeWritable(schemaPath);
+  writeFileSync(schemaPath, tools.astToString(await tools.openapiTS(spec)));
+  stampGenerated(schemaPath, {
+    tool: "projen openapi (Speakeasy + openapi-typescript)",
+    source,
+  });
+
+  const clientPath = join(srcDir, "client.ts");
+  makeWritable(clientPath);
+  writeFileSync(clientPath, CLIENT_SRC);
+  stampGenerated(clientPath, {
+    tool: "projen openapi (openapi-fetch)",
+    source: "./schema",
+  });
+}
+
 /**
  * Regenerate the `openapi` packages from every server/node package with a tsoa
  * import. Returns the package dirs it wrote so the caller can rebuild their barrels.
@@ -152,35 +256,43 @@ export async function optimizeOpenapiSpec(specPath: string, executable?: string)
  * members in `pnpm-workspace.yaml`.
  */
 export async function generateOpenapi(): Promise<string[]> {
-  const pkgs = controllerPackages();
+  const pkgs = controllerPackages().toArray();
+  const rustMappings = rustOpenapiMappings();
   // Same reasoning as codegen's empty case: a workspace with no tsoa controllers
   // is not a condition worth a line on every synth.
-  if (pkgs.length === 0) {
-    logger.debug("no tsoa controllers found in any server/node package");
+  if (pkgs.length === 0 && rustMappings.length === 0) {
+    logger.debug("no TypeScript or Rust OpenAPI producers found");
     return [];
   }
 
   // Lazy, resilient loads: tsoa + typescript are CJS (require), openapi-typescript
   // is ESM (dynamic import).
-  const require = createRequire(import.meta.url);
-  const { generateSpec } = lazyRequire<typeof import("tsoa")>(
-    require,
-    "tsoa",
-    "openapi generation",
-  );
-  const tsRuntime = lazyRequire<typeof ts>(require, "typescript", "openapi generation");
   const { default: openapiTS, astToString } = await import("openapi-typescript");
+  const tools = { openapiTS, astToString };
 
-  // Read tsoa's controllers with decorator support; skipLibCheck keeps third-party
-  // `.d.ts` out of the spec-generation compile.
-  const compilerOptions: ts.CompilerOptions = {
-    experimentalDecorators: true,
-    target: tsRuntime.ScriptTarget.ES2022,
-    module: tsRuntime.ModuleKind.ESNext,
-    moduleResolution: tsRuntime.ModuleResolutionKind.Bundler,
-    esModuleInterop: true,
-    skipLibCheck: true,
-  };
+  const typescript =
+    pkgs.length > 0
+      ? (() => {
+          const require = createRequire(import.meta.url);
+          const { generateSpec } = lazyRequire<typeof import("tsoa")>(
+            require,
+            "tsoa",
+            "openapi generation",
+          );
+          const runtime = lazyRequire<typeof ts>(require, "typescript", "openapi generation");
+          return {
+            generateSpec,
+            compilerOptions: {
+              experimentalDecorators: true,
+              target: runtime.ScriptTarget.ES2022,
+              module: runtime.ModuleKind.ESNext,
+              moduleResolution: runtime.ModuleResolutionKind.Bundler,
+              esModuleInterop: true,
+              skipLibCheck: true,
+            } satisfies ts.CompilerOptions,
+          };
+        })()
+      : undefined;
 
   const releaseGraphPath = join(repoRoot, ".projen/release-units.json");
   const releaseGraph = existsSync(releaseGraphPath)
@@ -196,8 +308,7 @@ export async function generateOpenapi(): Promise<string[]> {
     // its npm name - `p.name` is the (possibly-overridden) manifest name.
     const leaf = p.relPath.split("/").pop() ?? p.relPath;
     const outDir = join(repoRoot, p.root, OPENAPI_TAG, leaf);
-    const srcDir = join(outDir, "src");
-    mkdirSync(srcDir, { recursive: true });
+    mkdirSync(outDir, { recursive: true });
 
     // 1) tsoa writes a temporary openapi.json, Speakeasy optimizes it there, then
     // the complete spec moves into place so readers never observe an intermediate file.
@@ -205,7 +316,7 @@ export async function generateOpenapi(): Promise<string[]> {
     const tempDir = mkdtempSync(join(outDir, ".openapi-"));
     const tempSpecPath = join(tempDir, "openapi.json");
     try {
-      await generateSpec(
+      await typescript!.generateSpec(
         {
           entryFile: "",
           noImplicitAdditionalProperties: "throw-on-extras",
@@ -216,7 +327,7 @@ export async function generateOpenapi(): Promise<string[]> {
           name: `${p.relPath} API`,
           version: specVersion,
         },
-        compilerOptions,
+        typescript!.compilerOptions,
       );
       await optimizeOpenapiSpec(tempSpecPath);
       makeWritable(specPath);
@@ -225,28 +336,29 @@ export async function generateOpenapi(): Promise<string[]> {
       rmSync(tempDir, { recursive: true, force: true });
     }
     makeReadonly(specPath);
-
-    // 2) src/schema.ts: types generated from the spec (openapi-typescript).
-    const spec = JSON.parse(readFileSync(specPath, "utf8"));
-    const schemaPath = join(srcDir, "schema.ts");
-    makeWritable(schemaPath);
-    writeFileSync(schemaPath, astToString(await openapiTS(spec)));
-    stampGenerated(schemaPath, {
-      tool: "projen openapi (tsoa + Speakeasy + openapi-typescript)",
-      source: `the tsoa controllers in ${p.relPath}`,
-    });
-
-    // 3) src/client.ts: a typed openapi-fetch client over those types.
-    const clientPath = join(srcDir, "client.ts");
-    makeWritable(clientPath);
-    writeFileSync(clientPath, CLIENT_SRC);
-    stampGenerated(clientPath, {
-      tool: "projen openapi (openapi-fetch)",
-      source: "./schema",
-    });
+    await writeClientPackage(outDir, `the tsoa controllers in ${p.relPath}`, tools);
 
     written.push(outDir);
     logger.success(`openapi/${leaf} (from ${p.relPath})`);
   }
+  for (const mapping of rustMappings) {
+    const outDir = resolve(repoRoot, mapping.output);
+    mkdirSync(outDir, { recursive: true });
+    const specPath = join(outDir, "openapi.json");
+    const tempDir = mkdtempSync(join(outDir, ".openapi-"));
+    const tempSpecPath = join(tempDir, "openapi.json");
+    try {
+      await execFileAsync("cargo", rustOpenapiArgs(mapping, tempSpecPath), { cwd: repoRoot });
+      await optimizeOpenapiSpec(tempSpecPath);
+      makeWritable(specPath);
+      renameSync(tempSpecPath, specPath);
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+    makeReadonly(specPath);
+    await writeClientPackage(outDir, `the aide routes in ${mapping.rust}`, tools);
+    written.push(outDir);
+    logger.success(`${mapping.output} (from ${mapping.rust})`);
+  }
   return written;
 }

package/src/project-js.ts

@@ -1064,18 +1064,14 @@ class GeneratedSource extends Component {
  *
  * projen gives a monorepo root empty `compile`/`test` tasks - a child's tasks
  * are the child's business - so `bun run build` at the root type-checked nothing
- * and ran no package tests. The fan-out is delegated to bun's own workspace
- * filter rather than one `exec` per member, which matters three ways: bun runs
- * the members in PARALLEL (measured ~2.5x faster across this repo than the
- * sequential per-`cwd` form), a member that does not define the script is
- * skipped instead of needing a guard, and the filter reads the workspace from
- * `package.json` - so it stays correct when a package is added without a
- * re-synth. A non-zero member exit still fails the run.
+ * and ran no package tests. Compilation groups ordinary `tsc --build` members
+ * into a few TypeScript processes and runs custom compile tasks alongside them. Tests
+ * still use Bun's filtered workspace fan-out. Both read the current workspace
+ * list from `package.json`, so a newly added member needs no re-synth.
  *
- * `*` matches every workspace MEMBER and never the root itself, so the root
+ * `*` matches every workspace MEMBER and never the root itself, so the test
  * task delegating to it cannot recurse. Members declared outside the scanned
- * package roots (`extraWorkspaceMembers`) are workspace members too, so they are
- * covered by the same filter.
+ * package roots (`extraWorkspaceMembers`) are covered by both tasks.
  */
 class WorkspaceValidationTasks extends Component {
   private configured = false;
@@ -1087,9 +1083,8 @@ class WorkspaceValidationTasks extends Component {
     if (project.subprojects.length === 0 && project.extraWorkspaceMembers.length === 0) {
       return;
     }
-    for (const task of [project.compileTask, project.testTask]) {
-      task.exec(`bun run --filter '*' ${task.name}`);
-    }
+    project.compileTask.exec(taskScript(project, "compile-workspace.ts"));
+    project.testTask.exec("bun run --filter '*' test");
   }
 }
 

package/src/project-py.ts

@@ -7,7 +7,7 @@ import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workf
 import { DBX_TOOLS_LICENSE, projectReleaseBranch, projectRepositoryUrl } from "./project-js.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
-import { RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
+import { RELEASE_TAG, RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
 import {
   independentReleaseSetupSteps,
   registerIndependentPublicationJob,
@@ -546,9 +546,9 @@ export class DBXToolsPythonWorkspace extends Component {
     }
     workflow.addJob("build-python", {
       if: usesRustArtifacts
-        ? "${{ always() && needs.verify-context.result == 'success' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
+        ? "${{ always() && needs.verify-context.result == 'success' && needs.rust-assets.result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
         : releaseStageCondition("python"),
-      needs: ["verify-context", ...(usesRustArtifacts ? ["rust-build"] : [])],
+      needs: ["verify-context", ...(usesRustArtifacts ? ["rust-assets"] : [])],
       runsOn: ["ubuntu-latest"],
       permissions: { actions: JobPermission.READ, contents: JobPermission.READ },
       timeoutMinutes: 20,
@@ -567,8 +567,27 @@ export class DBXToolsPythonWorkspace extends Component {
             recoveredName: `Download recovered ${publication.distribution} native wheels`,
             pattern: `${publication.distribution}--*--python-wheel`,
             path: `dist/${publication.directory}`,
+            condition: "needs.verify-context.outputs.build_mode == 'remote'",
           }),
         ),
+        ...(uniffiPublications.length
+          ? [
+              {
+                name: "Download locally built native wheels",
+                if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
+                env: { GH_TOKEN: "${{ github.token }}", RELEASE_TAG },
+                shell: "bash",
+                run: [
+                  "mkdir -p dist/local-wheels",
+                  'gh release download "$RELEASE_TAG" --pattern "*.whl" --dir dist/local-wheels',
+                  ...uniffiPublications.flatMap((publication) => [
+                    `mkdir -p dist/${publication.directory}`,
+                    `cp dist/local-wheels/${publication.distribution.replaceAll("-", "_")}-*.whl dist/${publication.directory}/`,
+                  ]),
+                ].join("\n"),
+              },
+            ]
+          : []),
         {
           name: "Stamp workspace versions",
           env: { VERSION: RELEASE_VERSION },

package/src/project-rs.ts

@@ -1,9 +1,10 @@
 /** Filesystem-discovered Rust workspaces and UniFFI binding package wiring. */
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join, relative, resolve } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 import * as projectUtils from "@dbx-tools/core/project-utils";
 import { stringUtils } from "@dbx-tools/shared-core";
 import { Component, Project, TextFile, TomlFile, javascript } from "projen";
+import { releaseBinaryAssetName } from "./_release-platform.ts";
 import {
   RustProject,
   type CargoExampleOptions as RustCargoExampleOptions,
@@ -15,8 +16,10 @@ import {
   type DBXToolsRustProjectOptions as RustProjectOptions,
   type RustCrateOptions as RustCrateConfiguration,
   type RustCliOptions as RustCliConfiguration,
+  type RustOpenApiOptions as RustOpenApiConfiguration,
 } from "./_rust-project.ts";
 import {
+  rustAssetsJob,
   configureRustReleaseTask,
   independentRustCargoPublishJob,
   independentRustGitHubReleaseJob,
@@ -24,7 +27,6 @@ import {
   independentRustNodeFacadePublishJob,
   orderRustBindings,
   planRustRelease,
-  releaseBinaryAssetName,
   rustBuildJob,
   rustCargoPublishJob,
   rustGitHubReleaseJob,
@@ -57,6 +59,7 @@ export type CargoExampleOptions = RustCargoExampleOptions;
 export type DBXToolsRustProjectOptions = RustProjectOptions;
 export type RustCrateOptions = RustCrateConfiguration;
 export type RustCliOptions = RustCliConfiguration;
+export type RustOpenApiOptions = RustOpenApiConfiguration;
 
 /** Public Rust project facade; implementation lives apart from workspace/release coordination. */
 export class DBXToolsRustProject extends RustProject {
@@ -116,6 +119,7 @@ export interface UniFFIReleaseTarget {
   readonly os: RustReleaseOs;
   readonly cpu: RustReleaseCpu;
   readonly libc?: "glibc";
+  readonly glibcVersion?: string;
 }
 
 /** Native targets built on matching GitHub-hosted runners. */
@@ -128,6 +132,7 @@ export const UNIFFI_RELEASE_TARGETS: readonly UniFFIReleaseTarget[] = [
     os: RustReleaseOs.LINUX,
     cpu: RustReleaseCpu.X64,
     libc: "glibc",
+    glibcVersion: "2.35",
   },
   {
     runner: "ubuntu-24.04-arm",
@@ -137,6 +142,7 @@ export const UNIFFI_RELEASE_TARGETS: readonly UniFFIReleaseTarget[] = [
     os: RustReleaseOs.LINUX,
     cpu: RustReleaseCpu.ARM64,
     libc: "glibc",
+    glibcVersion: "2.39",
   },
   {
     runner: "macos-15-intel",
@@ -269,12 +275,23 @@ export interface RustBindingMapping {
   readonly dependencies?: readonly string[];
 }
 
+/** Persisted Rust OpenAPI producer consumed by the shared OpenAPI task. */
+export interface RustOpenApiMapping {
+  readonly crate: string;
+  readonly rust: string;
+  readonly output: string;
+  readonly binary?: string;
+  readonly features: readonly string[];
+  readonly noDefaultFeatures: boolean;
+}
+
 /** Persisted Rust workspace state consumed by `sync --watch`. */
 export interface RustWorkspaceMapping {
   readonly root: string;
   readonly crates: readonly string[];
   readonly bindings: readonly RustBindingMapping[];
   readonly binaries: readonly RustReleaseBinaryMapping[];
+  readonly openapi: readonly RustOpenApiMapping[];
 }
 
 /** One platform archive published for a Rust CLI binary. */
@@ -296,6 +313,10 @@ export interface RustReleaseBinaryMapping {
   readonly tagPrefix: string;
   readonly tag: string;
   readonly repository: string;
+  /** Cargo crate published or mirrored for `cargo install` when GitHub has no archive. */
+  readonly crateName: string;
+  /** Feature flags passed to `cargo install --features` for this binary target. */
+  readonly cargoFeatures: readonly string[];
   readonly assets: readonly RustReleaseBinaryAssetMapping[];
 }
 
@@ -392,6 +413,7 @@ function planRustReleaseBinaries(
               release: pkg.packageOptions.release,
               excludedOs: pkg.packageOptions.releaseExcludeOs,
               cli: pkg.packageOptions.cli,
+              requiredFeatures: undefined,
             },
           ]
         : []),
@@ -404,6 +426,7 @@ function planRustReleaseBinaries(
           release: binary.release,
           excludedOs: binary.releaseExcludeOs,
           cli: binary.cli!,
+          requiredFeatures: binary.requiredFeatures,
         })),
     ];
     return configuredBinaries.map((binary) => {
@@ -450,6 +473,8 @@ function planRustReleaseBinaries(
         tagPrefix,
         tag: `${tagPrefix}${identity.version}`,
         repository: resolved.repository,
+        crateName: pkg.crateName,
+        cargoFeatures: [...(binary.requiredFeatures ?? [])],
         assets: resolved.nativeTargets
           .filter((target) => !excludedOs.has(target.os))
           .map((target) => ({
@@ -770,11 +795,26 @@ function createRustWorkspaceMapping(
   binaries: readonly RustReleaseBinaryMapping[],
   resolved: ResolvedRustWorkspaceOptions,
 ): RustWorkspaceMapping {
+  const openapiRoot = join(dirname(resolved.nodeRoot), "openapi");
   return {
     root: resolved.root,
     crates: packages.map((pkg) => `${resolved.root}/${pkg.packageOptions.directory}`),
     bindings,
     binaries,
+    openapi: packages.flatMap((pkg) => {
+      if (!pkg.packageOptions.openapi) return [];
+      const options = pkg.packageOptions.openapi === true ? {} : pkg.packageOptions.openapi;
+      return [
+        {
+          crate: pkg.crateName,
+          rust: `${resolved.root}/${pkg.packageOptions.directory}`,
+          output: toPosix(join(openapiRoot, pkg.packageOptions.directory)),
+          ...(options.binary ? { binary: options.binary } : {}),
+          features: [...(options.features ?? [])],
+          noDefaultFeatures: options.noDefaultFeatures ?? false,
+        },
+      ];
+    }),
   };
 }
 
@@ -963,6 +1003,9 @@ export class DBXToolsRustWorkspace extends Component {
           name: binary.binaryName,
           generated: true,
           data: {
+            binary: binary.binaryName,
+            crate: binary.crateName,
+            features: binary.cargoFeatures,
             targets: resolved.nativeTargets.filter((target) =>
               binary.assets.some((asset) => asset.os === target.os && asset.cpu === target.cpu),
             ),
@@ -1059,7 +1102,7 @@ export class DBXToolsRustWorkspace extends Component {
     }
     configureRustReleaseTask(project, plan);
     if (project.releaseCatalog.mode === "independent") {
-      if (plan.hasTargetOutputs && plan.targets.length) {
+      if (plan.targets.length) {
         workflow.addJob("rust-build", rustBuildJob(plan, independentReleaseSetupSteps(project)));
       }
       if (plan.publicCrates.length) {
@@ -1081,15 +1124,16 @@ export class DBXToolsRustWorkspace extends Component {
       }
       return;
     }
-    if (plan.hasTargetOutputs && plan.targets.length) {
+    if (plan.targets.length) {
       workflow.addJob("rust-build", rustBuildJob(plan));
+      workflow.addJob("rust-assets", rustAssetsJob());
     }
     if (plan.publicCrates.length) {
       workflow.addJob("publish-cargo", rustCargoPublishJob(plan, false));
       workflow.addJob("publish-local-cargo", rustCargoPublishJob(plan, true));
     }
-    if (plan.releaseBinaries.length) {
-      workflow.addJob("publish-github-release", rustGitHubReleaseJob());
+    if (plan.hasTargetOutputs) {
+      workflow.addJob("publish-github-release", rustGitHubReleaseJob(plan));
     }
     if (plan.nodeBindings.length && hasNodeRelease(project)) {
       workflow.addJob("publish-native-npm", rustNativeNpmPublishJob(project));

package/src/release-github.ts

@@ -28,6 +28,29 @@ export interface GithubAuthenticatedAccount {
   scopes: string[];
 }
 
+/** Repository capabilities returned for one authenticated actor. */
+export interface GithubRepositoryPermissions {
+  readonly push: boolean;
+  readonly maintain: boolean;
+  readonly admin: boolean;
+}
+
+/** Read normalized repository permissions from a GitHub repository response. */
+export function githubRepositoryPermissions(value: unknown): GithubRepositoryPermissions {
+  const repository = object.isRecord(value) ? value : undefined;
+  const permissions = object.isRecord(repository?.permissions) ? repository.permissions : undefined;
+  return {
+    push: permissions?.push === true,
+    maintain: permissions?.maintain === true,
+    admin: permissions?.admin === true,
+  };
+}
+
+/** Whether the actor can manage releases rather than only push source. */
+export function githubRepositoryCanManage(permissions: GithubRepositoryPermissions): boolean {
+  return permissions.maintain || permissions.admin;
+}
+
 /** Parse successful GitHub CLI accounts with the active account first. */
 export function githubAuthenticatedAccounts(
   statusOutput: string,