@dbx-tools/projen 0.9.151 → 0.9.153

package/src/project-py.ts

@@ -1,9 +1,11 @@
 /** Reusable uv workspace generation for Python packages hosted in a projen tree. */
+import { existsSync, readdirSync } from "node:fs";
+import { resolve } from "node:path";
 import * as projectUtils from "@dbx-tools/core/project-utils";
 import { stringUtils, type OneOrMany } from "@dbx-tools/shared-core";
 import { Component, License, TextFile, type Project, github, javascript, python } from "projen";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
-import { PYTHON_GENERATED_PACKAGE } from "./generated.ts";
+import { header, PYTHON_GENERATED_PACKAGE } from "./generated.ts";
 import { LICENSE, projectRepositoryUrl, taskCommand } from "./project-js.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
@@ -107,7 +109,10 @@ interface PythonPublication {
 
 /** Options for {@link DBXToolsPythonWorkspace}. */
 export interface DBXToolsPythonWorkspaceOptions {
-  readonly packages: readonly PythonPackageOptions[];
+  /** Package-specific options merged over packages discovered under the Python root. */
+  readonly packages?: readonly PythonPackageOptions[];
+  /** Discover direct child directories containing `src/`. Defaults to true. */
+  readonly discoverPackages?: boolean;
   readonly repository?: PythonRepositoryOptions;
   /** Repository-relative Python package root. Defaults to `packages/py`. */
   readonly root?: string;
@@ -214,6 +219,15 @@ export function pythonModuleName(scope: string, directory: string): string {
   return [scope, ...directory.split("/")].map((part) => part.replaceAll("-", "_")).join(".");
 }
 
+/** Discover direct Python workspace members by their conventional source directory. */
+function discoverPythonPackages(root: string): string[] {
+  if (!existsSync(root)) return [];
+  return readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && existsSync(resolve(root, entry.name, "src")))
+    .map((entry) => entry.name)
+    .sort();
+}
+
 /** A Python package implemented with projen's `PythonProject` and uv backend. */
 export class DBXToolsPythonProject extends python.PythonProject implements DBXToolsProject {
   readonly language = "python" as const;
@@ -349,11 +363,30 @@ export class DBXToolsPythonWorkspace extends Component {
       ref: options.repository?.ref ?? "main",
       root: options.root ?? options.repository?.root ?? "packages/py",
     };
-    const packageIdentities: ResolvedPythonPackageOptions[] = options.packages.map((pkg) => ({
-      ...pkg,
-      name: pkg.name ?? `${scope}-${stringUtils.toSlug(pkg.directory)}`,
-      module: pkg.module ?? pythonModuleName(scope, pkg.directory),
-    }));
+    const configuredPackages = new Map((options.packages ?? []).map((pkg) => [pkg.directory, pkg]));
+    const discoveredDirectories =
+      options.discoverPackages === false
+        ? []
+        : discoverPythonPackages(resolve(project.outdir, this.repository.root));
+    const directories = [
+      ...configuredPackages.keys(),
+      ...discoveredDirectories.filter((directory) => !configuredPackages.has(directory)),
+    ];
+    const packageIdentities: ResolvedPythonPackageOptions[] = directories.map((directory) => {
+      const pkg = configuredPackages.get(directory);
+      return {
+        directory,
+        description: `${scope} ${directory} Python package.`,
+        ...pkg,
+        name: pkg?.name ?? `${scope}-${stringUtils.toSlug(directory)}`,
+        module: pkg?.module ?? pythonModuleName(scope, directory),
+      };
+    });
+    if (packageIdentities.length === 0) {
+      throw new Error(
+        `No Python packages were configured or discovered under ${this.repository.root}`,
+      );
+    }
     const configuredNodeRuntimes = packageIdentities.filter(({ nodeRuntime }) => nodeRuntime);
     if (configuredNodeRuntimes.length > 1) {
       throw new Error("A Python workspace can configure only one shared Node runtime package");
@@ -760,26 +793,24 @@ export class DBXToolsPythonWorkspace extends Component {
       }),
     ];
     const helper = ".projen/pypi-trusted-publisher-instructions.mjs";
+    const helperHeader = header({ tool: "projen", source: ".projenrc.ts" })
+      .trimEnd()
+      .replaceAll("\n", "\n          ");
     new TextFile(project.root, helper, {
+      marker: true,
+      readonly: true,
       // prettier-ignore
       lines: stringUtils.dedent(
         // ============================================================================
         /*js*/`
           #!/usr/bin/env bun
-          import { parseArgs } from "node:util";
+          ${helperHeader}
+          import { printPypiTrustedPublisherInstructions } from "@dbx-tools/projen/pypi-trusted-publisher-instructions";
 
-          const { values } = parseArgs({
-            options: { secretFile: { type: "string" } },
+          await printPypiTrustedPublisherInstructions({
+            beforeAuthentication: ${JSON.stringify(linesBeforeAuthentication)},
+            afterAuthentication: ${JSON.stringify(linesAfterAuthentication)},
           });
-          const beforeAuthentication = ${JSON.stringify(linesBeforeAuthentication)};
-          const afterAuthentication = ${JSON.stringify(linesAfterAuthentication)};
-          const authentication = values.secretFile
-            ? [
-                \`- If browser authentication is required, read credentials from \${values.secretFile} directly into the browser without printing, logging, or exposing secret values.\`,
-                \`- If \${values.secretFile} is absent, invalid, or insufficient for authentication, pause and ask the user to complete authentication.\`,
-              ]
-            : ["- If browser authentication is required, pause and ask the user to complete authentication."];
-          process.stdout.write(\`\${[...beforeAuthentication, ...authentication, ...afterAuthentication].join("\\n").trimEnd()}\\n\`);
         `
         // ============================================================================
       ).split("\n"),

package/src/tsconfig.ts

@@ -3,6 +3,12 @@
  */
 import { Component, type Project, javascript, typescript } from "projen";
 
+/** Consumer overrides for the repository-root TypeScript program. */
+export interface DBXToolsRootTsconfigOptions {
+  readonly compilerOptions?: javascript.TypeScriptCompilerOptions;
+  readonly include?: readonly string[];
+}
+
 /**
  * Compiler options for the ROOT program only (`.projenrc.ts` + the engine as
  * seen from the root). Each package owns its own projen-generated
@@ -40,7 +46,7 @@ export class DBXToolsRootTsconfig extends Component {
   /** Root program config inherited by the generated Projen config. */
   readonly config?: javascript.TypescriptConfig;
 
-  constructor(scope: Project) {
+  constructor(scope: Project, options: DBXToolsRootTsconfigOptions = {}) {
     super(scope);
 
     if (scope instanceof typescript.TypeScriptProject) {
@@ -56,8 +62,10 @@ export class DBXToolsRootTsconfig extends Component {
       compilerOptions: {
         lib: ["ESNext"],
         types: ["node", "bun"],
+        jsx: javascript.TypeScriptJsxMode.REACT_JSX,
+        ...options.compilerOptions,
       },
-      include: [".projenrc.ts"],
+      include: [".projenrc.ts", "test/**/*.ts", "test/**/*.tsx", ...(options.include ?? [])],
       exclude: ["node_modules", "**/dist", "**/node_modules"],
     });
   }

package/src/workspace-manifest.ts

@@ -0,0 +1,182 @@
+/**
+ * Workspace dependency protocol materialization for external npm consumers.
+ *
+ * @module
+ */
+import {
+  chmodSync,
+  copyFileSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import * as exec from "@dbx-tools/core/exec";
+
+const DEPENDENCY_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies",
+] as const;
+
+interface StoredManifest {
+  readonly path: string;
+  readonly mode: number;
+  readonly text: string;
+}
+
+/** Replace workspace and catalogue protocols with concrete registry ranges. */
+export function materializeWorkspaceManifest(
+  source: Readonly<Record<string, unknown>>,
+  workspace: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  const manifest = structuredClone(source) as Record<string, unknown>;
+  const version = workspace.version;
+  const catalog =
+    workspace.catalog && typeof workspace.catalog === "object"
+      ? (workspace.catalog as Readonly<Record<string, unknown>>)
+      : {};
+  const overrides =
+    workspace.overrides && typeof workspace.overrides === "object"
+      ? (workspace.overrides as Readonly<Record<string, unknown>>)
+      : {};
+  if (typeof version !== "string" || !version) {
+    throw new Error("Workspace manifest has no version");
+  }
+  for (const field of DEPENDENCY_FIELDS) {
+    const dependencies = manifest[field];
+    if (!dependencies || typeof dependencies !== "object") continue;
+    manifest[field] = Object.fromEntries(
+      Object.entries(dependencies).map(([name, value]) => [
+        name,
+        materializeDependency(name, value, version, catalog, overrides),
+      ]),
+    );
+  }
+  return manifest;
+}
+
+/**
+ * Materialize every generated workspace manifest for one external command and
+ * restore exact bytes and permissions afterward.
+ */
+export async function withMaterializedWorkspaceManifests<T>(
+  root: string,
+  callback: () => Promise<T>,
+): Promise<T> {
+  const rootManifestPath = resolve(root, "package.json");
+  const rootManifest = readManifest(rootManifestPath);
+  const workspaces = Array.isArray(rootManifest.workspaces)
+    ? rootManifest.workspaces.filter((value): value is string => typeof value === "string")
+    : [];
+  const originals = [
+    rootManifestPath,
+    ...workspaces.map((workspace) => resolve(root, workspace, "package.json")),
+  ].map(storeManifest);
+
+  try {
+    for (const original of originals) {
+      const source = JSON.parse(original.text) as Record<string, unknown>;
+      writeManifest(original.path, materializeWorkspaceManifest(source, rootManifest));
+    }
+    return await callback();
+  } finally {
+    for (const original of originals) restoreManifest(original);
+  }
+}
+
+/**
+ * Copy tracked and non-ignored source into a temporary directory, materialize
+ * its manifests, and keep that snapshot stable for one external command.
+ */
+export async function withStagedWorkspaceManifests<T>(
+  root: string,
+  callback: (stage: string) => Promise<T>,
+): Promise<T> {
+  const stage = mkdtempSync(join(tmpdir(), "dbx-tools-app-deploy-"));
+  try {
+    const listed = exec.spawnSync(
+      "git",
+      ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
+      {
+        cwd: root,
+        stdin: "ignore",
+        stdout: "capture",
+        stderr: "capture",
+      },
+    );
+    if (listed.exitCode !== 0) {
+      throw new Error(`Could not enumerate app source: ${listed.stderr}`);
+    }
+    for (const relativePath of listed.stdout.split("\0").filter(Boolean)) {
+      const source = resolve(root, relativePath);
+      if (!existsSync(source)) continue;
+      const destination = resolve(stage, relativePath);
+      mkdirSync(dirname(destination), { recursive: true });
+      copyFileSync(source, destination);
+      chmodSync(destination, statSync(source).mode & 0o777);
+    }
+    const bundleState = resolve(root, ".databricks");
+    if (existsSync(bundleState)) {
+      cpSync(bundleState, resolve(stage, ".databricks"), { recursive: true });
+    }
+    return await withMaterializedWorkspaceManifests(stage, () => callback(stage));
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+
+function materializeDependency(
+  name: string,
+  value: unknown,
+  version: string,
+  catalog: Readonly<Record<string, unknown>>,
+  overrides: Readonly<Record<string, unknown>>,
+): unknown {
+  const override = overrides[name];
+  if (typeof override === "string" && override && !override.startsWith("$")) {
+    return override;
+  }
+  if (value === "catalog:") {
+    const resolved = catalog[name];
+    if (typeof resolved !== "string" || !resolved) {
+      throw new Error(`Workspace catalog has no version for ${name}`);
+    }
+    return resolved;
+  }
+  if (typeof value !== "string" || !value.startsWith("workspace:")) return value;
+  const selector = value.slice("workspace:".length);
+  if (selector === "*" || !selector) return version;
+  if (selector === "^" || selector === "~") return `${selector}${version}`;
+  return selector;
+}
+
+function readManifest(path: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
+}
+
+function storeManifest(path: string): StoredManifest {
+  return {
+    path,
+    mode: statSync(path).mode & 0o777,
+    text: readFileSync(path, "utf8"),
+  };
+}
+
+function writeManifest(path: string, manifest: Readonly<Record<string, unknown>>): void {
+  chmodSync(path, 0o644);
+  writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+
+function restoreManifest(manifest: StoredManifest): void {
+  chmodSync(manifest.path, 0o644);
+  writeFileSync(manifest.path, manifest.text);
+  chmodSync(manifest.path, manifest.mode);
+}

package/tasks/appkit-deploy.ts

@@ -0,0 +1,245 @@
+#!/usr/bin/env -S bun
+/** Deploy an AppKit workspace through npm-compatible temporary manifests. */
+import { existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { profile } from "@dbx-tools/auth";
+import { serializeArgs } from "@dbx-tools/cli-args";
+import * as exec from "@dbx-tools/core/exec";
+import { errorUtils, log } from "@dbx-tools/shared-core";
+import { z } from "zod";
+import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
+import { withStagedWorkspaceManifests } from "../src/workspace-manifest.ts";
+
+const logger = log.logger("projen:appkit-deploy");
+
+export const AppKitDeployContextOptionsSchema = z.object({
+  target: z
+    .string()
+    .trim()
+    .min(1)
+    .optional()
+    .describe("Databricks bundle target")
+    .meta({ env: [], short: "t" }),
+  profile: z.string().trim().min(1).optional().describe("Databricks CLI profile").meta({
+    env: [],
+    helpDefault: false,
+    short: "p",
+  }),
+  var: z
+    .array(z.string().trim().min(1))
+    .default([])
+    .describe("Databricks bundle variable assignment")
+    .meta({ env: [] }),
+});
+
+export const AppKitDeployOptionsSchema = AppKitDeployContextOptionsSchema.extend({
+  autoApprove: z
+    .boolean()
+    .default(false)
+    .describe("Skip interactive deployment approval")
+    .meta({ env: [] }),
+  failOnActiveRuns: z
+    .boolean()
+    .default(true)
+    .describe("Fail when bundle jobs or pipelines are active")
+    .meta({ env: [] }),
+  skipTests: z
+    .boolean()
+    .default(true)
+    .describe("Skip Databricks CLI tests after the Bun validation")
+    .meta({ env: [] }),
+  skipValidation: z
+    .boolean()
+    .default(true)
+    .describe("Skip Databricks CLI npm validation after the Bun validation")
+    .meta({ env: [] }),
+});
+
+export type AppKitDeployOptions = z.output<typeof AppKitDeployOptionsSchema>;
+
+interface DeployCommandResult {
+  readonly exitCode: number;
+  readonly stderr?: string;
+  readonly stdout?: string;
+}
+
+/** Effects accepted by the AppKit deploy task for focused tests. */
+export interface AppKitDeployDependencies {
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly logs?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
+  readonly plan?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
+  readonly root?: string;
+  readonly resolveProfile?: () => string | undefined;
+  readonly run?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
+  readonly validate?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
+}
+
+/** Run Databricks Apps deploy while generated workspace manifests are materialized. */
+export async function deployApp(
+  args: readonly string[],
+  dependencies: AppKitDeployDependencies = {},
+): Promise<void> {
+  const root = dependencies.root ?? process.cwd();
+  const options = await resolveDeployOptions(args, dependencies);
+  const context = AppKitDeployContextOptionsSchema.parse({
+    target: options.target,
+    profile: options.profile,
+    var: options.var,
+  });
+  const contextArgs = serializeArgs(context);
+  const deployArgs = serializeArgs({
+    ...context,
+    ...(options.autoApprove ? { autoApprove: true } : {}),
+    ...(options.failOnActiveRuns ? { failOnActiveRuns: true } : {}),
+    ...(options.skipTests ? { skipTests: true } : {}),
+    ...(options.skipValidation ? { skipValidation: true } : {}),
+  });
+  const validate =
+    dependencies.validate ??
+    (dependencies.run
+      ? undefined
+      : (validateArgs: readonly string[], cwd: string) =>
+          exec.spawn(
+            "databricks",
+            ["bundle", "validate", ...serializeArgs({ strict: true }), ...validateArgs],
+            {
+              cwd,
+              env: dependencies.environment ?? process.env,
+              stdin: "ignore",
+              stdout: "inherit",
+              stderr: "inherit",
+            },
+          ));
+  if (validate) {
+    const validation = await validate(contextArgs, root);
+    if (validation.exitCode !== 0) {
+      throw new Error(`databricks bundle validate exited with code ${validation.exitCode}`);
+    }
+  }
+  const run =
+    dependencies.run ??
+    ((deployArgs: readonly string[], cwd: string) =>
+      exec.spawn("databricks", ["apps", "deploy", ...deployArgs], {
+        cwd,
+        env: dependencies.environment ?? process.env,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+      }));
+  await withStagedWorkspaceManifests(root, async (stage) => {
+    await reconcileStagedBundleState(stage, contextArgs, options.target, dependencies);
+    const result = await run(deployArgs, stage);
+    if (result.exitCode !== 0) {
+      await printAppLogs(contextArgs, stage, dependencies);
+      throw new Error(`databricks apps deploy exited with code ${result.exitCode}`);
+    }
+  });
+}
+
+async function reconcileStagedBundleState(
+  stage: string,
+  contextArgs: readonly string[],
+  target: string | undefined,
+  dependencies: AppKitDeployDependencies,
+): Promise<void> {
+  const plan =
+    dependencies.plan ??
+    (dependencies.run
+      ? undefined
+      : (args: readonly string[], cwd: string) =>
+          Promise.resolve(
+            exec.spawnSync(
+              "databricks",
+              ["bundle", "plan", ...serializeArgs({ quiet: true }), ...args],
+              {
+                cwd,
+                env: dependencies.environment ?? process.env,
+                stdin: "ignore",
+                stdout: "capture",
+                stderr: "capture",
+              },
+            ),
+          ));
+  if (!plan) return;
+  const result = await plan(contextArgs, stage);
+  if (result.exitCode === 0) return;
+  const output = `${result.stderr ?? ""}\n${result.stdout ?? ""}`.toLowerCase();
+  if (
+    !output.includes("lineage mismatch in state files") ||
+    !output.includes("remote direct state")
+  ) {
+    return;
+  }
+  if (!target) return;
+  const state = join(stage, ".databricks", "bundle", target, "resources.json");
+  if (!existsSync(state)) return;
+  rmSync(state);
+  logger.warn("Removed stale staged bundle state", { target });
+}
+
+async function printAppLogs(
+  contextArgs: readonly string[],
+  cwd: string,
+  dependencies: AppKitDeployDependencies,
+): Promise<void> {
+  logger.error("Databricks Apps deployment failed; recent app logs follow");
+  const showLogs =
+    dependencies.logs ??
+    ((args: readonly string[], logsCwd: string) =>
+      exec.spawn("databricks", ["apps", "logs", ...serializeArgs({ tailLines: 200 }), ...args], {
+        cwd: logsCwd,
+        env: dependencies.environment ?? process.env,
+        stdin: "ignore",
+        stdout: "inherit",
+        stderr: "inherit",
+      }));
+  try {
+    const result = await showLogs(contextArgs, cwd);
+    if (result.exitCode !== 0) {
+      logger.warn("Could not read Databricks App logs", { exitCode: result.exitCode });
+    }
+  } catch (error) {
+    logger.warn("Could not read Databricks App logs", {
+      message: errorUtils.toError(error).message,
+    });
+  }
+}
+
+async function resolveDeployOptions(
+  args: readonly string[],
+  dependencies: AppKitDeployDependencies,
+): Promise<AppKitDeployOptions> {
+  const parsed = await taskOptions(
+    taskCommand(
+      import.meta.url,
+      "Validate and deploy an AppKit workspace through Databricks Apps",
+      AppKitDeployOptionsSchema,
+    ),
+    AppKitDeployOptionsSchema,
+    args,
+  );
+  const environment = dependencies.environment ?? process.env;
+  const hasEnvironmentAuth =
+    Boolean(environment.DATABRICKS_HOST) &&
+    (Boolean(environment.DATABRICKS_TOKEN) ||
+      (Boolean(environment.DATABRICKS_CLIENT_ID) && Boolean(environment.DATABRICKS_CLIENT_SECRET)));
+  const configuredProfile = environment.DATABRICKS_CONFIG_PROFILE ?? environment.DATABRICKS_PROFILE;
+  const resolvedProfile =
+    parsed.profile ??
+    configuredProfile ??
+    (hasEnvironmentAuth
+      ? undefined
+      : (dependencies.resolveProfile ?? (() => profile.resolveProfile()?.name))());
+  if (!hasEnvironmentAuth && !resolvedProfile) {
+    throw new Error(
+      "Select a Databricks profile with --profile or configure Databricks environment credentials",
+    );
+  }
+  return AppKitDeployOptionsSchema.parse({
+    ...parsed,
+    target: parsed.target ?? environment.DATABRICKS_BUNDLE_TARGET,
+    profile: resolvedProfile,
+  });
+}
+
+await runTaskMain(import.meta, () => deployApp(process.argv.slice(2)));

package/tasks/compile-workspace.ts

@@ -50,7 +50,8 @@ function hasLifecycle(task: TaskSpec | undefined): boolean {
 /** Read the root's concrete workspace paths on every run, including newly added members. */
 export function compilePlan(root: string): CompilePlan {
   const workspace = readJson<PackageManifest>(join(root, "package.json"));
-  const typescriptConfigs: string[] = [];
+  const rootConfig = join(root, "tsconfig.json");
+  const typescriptConfigs: string[] = existsSync(rootConfig) ? [rootConfig] : [];
   const customPackages: CompilePlan["customPackages"] = [];
   for (const member of workspace.workspaces ?? []) {
     const directory = resolve(root, member);

package/tasks/publish-npm.ts

@@ -20,6 +20,9 @@ import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { TaskConcurrencyOptionSchema, TaskDryRunOptionSchema } from "./options.ts";
 import { runTaskCommandAsync } from "../src/_task-command.ts";
+import { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
+
+export { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
 
 const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 const DEFAULT_PUBLISH_CONCURRENCY = 4;
@@ -52,60 +55,6 @@ export type NpmArchiveManifestTransform = (
 
 /** Entry-point fields projected from publishConfig into a packed manifest. */
 const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const;
-const DEPENDENCY_FIELDS = [
-  "dependencies",
-  "devDependencies",
-  "optionalDependencies",
-  "peerDependencies",
-] as const;
-
-/** Replace workspace and catalogue protocols with publishable registry ranges. */
-export function materializeWorkspaceManifest(
-  source: Readonly<Record<string, unknown>>,
-  workspace: Readonly<Record<string, unknown>>,
-): Readonly<Record<string, unknown>> {
-  const manifest = structuredClone(source) as Record<string, unknown>;
-  const version = workspace.version;
-  const catalog =
-    workspace.catalog && typeof workspace.catalog === "object"
-      ? (workspace.catalog as Readonly<Record<string, unknown>>)
-      : {};
-  if (typeof version !== "string" || !version) {
-    throw new Error("Workspace manifest has no version");
-  }
-  for (const field of DEPENDENCY_FIELDS) {
-    const dependencies = manifest[field];
-    if (!dependencies || typeof dependencies !== "object") continue;
-    manifest[field] = Object.fromEntries(
-      Object.entries(dependencies).map(([name, value]) => [
-        name,
-        materializeDependency(name, value, version, catalog),
-      ]),
-    );
-  }
-  return manifest;
-}
-
-function materializeDependency(
-  name: string,
-  value: unknown,
-  version: string,
-  catalog: Readonly<Record<string, unknown>>,
-): unknown {
-  if (value === "catalog:") {
-    const resolved = catalog[name];
-    if (typeof resolved !== "string" || !resolved) {
-      throw new Error(`Workspace catalog has no version for ${name}`);
-    }
-    return resolved;
-  }
-  if (typeof value !== "string" || !value.startsWith("workspace:")) return value;
-  const selector = value.slice("workspace:".length);
-  if (selector === "*" || !selector) return version;
-  if (selector === "^" || selector === "~") return `${selector}${version}`;
-  return selector;
-}
-
 /**
  * Fold compiled publish entry points onto an archive manifest without changing
  * the source checkout.