@dbx-tools/projen 0.9.152 → 0.9.154

package/src/release.ts

@@ -16,12 +16,17 @@ import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
 import { BUN_VERSION } from "./bun-workflow.ts";
 import { projectReleaseBranch, taskCommand, type DBXToolsJavaScriptProject } from "./project-js.ts";
-import { RELEASE_VERSION, RELEASE_WORKFLOW_FILE } from "./release-context.ts";
+import {
+  PUBLIC_NPM_REGISTRY_URL,
+  RELEASE_VERSION,
+  RELEASE_WORKFLOW_FILE,
+} from "./release-context.ts";
 import type { ReleaseStepSelection } from "./release-options.ts";
 
 const NODE_VERSION = "24";
 const NPM_VERSION = "11.4.2";
-const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const PUBLICATION_VERIFIER_ARTIFACT = "release-publication-verifier";
+const PUBLICATION_VERIFIER_JOB = "verify-publications";
 const releaseTagPrefixes = new WeakMap<DBXToolsJavaScriptProject, string>();
 const releaseWorkflows = new WeakMap<DBXToolsJavaScriptProject, GithubWorkflow>();
 
@@ -95,7 +100,7 @@ export function nodeReleaseSetupSteps(): readonly JobStep[] {
       uses: github.ActionRefs.ACTIONS_SETUP_NODE,
       with: {
         "node-version": NODE_VERSION,
-        "registry-url": NPM_REGISTRY_URL,
+        "registry-url": PUBLIC_NPM_REGISTRY_URL,
         "package-manager-cache": false,
       },
     },
@@ -114,19 +119,14 @@ export function uvSetupStep(): JobStep {
 function refreshDocsRegistryDependencies(workflow: GithubWorkflow): void {
   const docs = workflow.getJob("deploy-docs") as Job | undefined;
   if (!docs) return;
-  const registryJobs = Object.keys(workflow.jobs).filter(
-    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
-  );
-  if (registryJobs.length > 0) {
+  if (workflow.getJob(PUBLICATION_VERIFIER_JOB)) {
     workflow.updateJob("deploy-docs", {
       ...docs,
-      needs: ["build-release", ...registryJobs],
+      needs: ["build-release", PUBLICATION_VERIFIER_JOB],
       if: releaseCondition([
         "needs['build-release'].result == 'success'",
         "needs['build-release'].outputs.docs == 'true'",
-        ...registryJobs.map(
-          (name) => `needs['${name}'].result == 'success' || needs['${name}'].result == 'skipped'`,
-        ),
+        `needs['${PUBLICATION_VERIFIER_JOB}'].result == 'success' || needs['${PUBLICATION_VERIFIER_JOB}'].result == 'skipped'`,
       ]),
     });
   }
@@ -140,6 +140,107 @@ export function refreshReleaseDocsDependencies(project: DBXToolsJavaScriptProjec
   }
 }
 
+function publicationRegistryJobs(workflow: GithubWorkflow): string[] {
+  return Object.keys(workflow.jobs).filter(
+    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
+  );
+}
+
+/** Keep one public availability barrier behind every configured registry publisher. */
+export function refreshPublicationVerification(project: DBXToolsJavaScriptProject): void {
+  const workflow = releaseWorkflows.get(project);
+  if (!workflow) return;
+  const registryJobs = publicationRegistryJobs(workflow);
+  if (registryJobs.length === 0) return;
+  const hasNpm = registryJobs.includes("publish-node");
+  const hasPypi = registryJobs.some((name) => name.startsWith("publish-pypi-"));
+  const selected = [
+    ...(hasNpm ? ["needs['build-release'].outputs.npm == 'true'"] : []),
+    ...(hasPypi ? ["needs['build-release'].outputs.pypi == 'true'"] : []),
+  ].join(" || ");
+  const prerequisites = registryJobs.map((name) => {
+    const output = name === "publish-node" ? "npm" : "pypi";
+    return `needs['build-release'].outputs.${output} != 'true' || needs['${name}'].result == 'success'`;
+  });
+  const job: Job = {
+    if: releaseCondition([
+      "needs['build-release'].result == 'success'",
+      selected,
+      ...prerequisites,
+    ]),
+    needs: ["build-release", ...registryJobs],
+    runsOn: ["ubuntu-latest"],
+    permissions: { contents: JobPermission.READ },
+    timeoutMinutes: 15,
+    steps: [
+      {
+        name: "Download publication verifier",
+        uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+        with: { name: PUBLICATION_VERIFIER_ARTIFACT, path: ".release/verifier" },
+      },
+      ...(hasNpm
+        ? [
+            {
+              name: "Download npm archives",
+              if: "${{ needs.build-release.outputs.npm == 'true' }}",
+              uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+              with: { name: "release-npm", path: ".release/npm" },
+            },
+          ]
+        : []),
+      ...(hasPypi
+        ? [
+            {
+              name: "Download Python distributions",
+              if: "${{ needs.build-release.outputs.pypi == 'true' }}",
+              uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+              with: {
+                pattern: "release-python-*",
+                path: ".release/python",
+                "merge-multiple": true,
+              },
+            },
+          ]
+        : []),
+      {
+        name: "Setup Bun",
+        uses: github.ActionRefs.OVEN_SH_SETUP_BUN,
+        with: { "bun-version": BUN_VERSION },
+      },
+      {
+        name: "Wait for public package availability",
+        shell: "bash",
+        env: {
+          RELEASE_VERSION,
+          VERIFY_NPM: hasNpm ? "${{ needs.build-release.outputs.npm }}" : "false",
+          VERIFY_PYPI: hasPypi ? "${{ needs.build-release.outputs.pypi }}" : "false",
+        },
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+            args=(--version "$RELEASE_VERSION")
+            if [[ "$VERIFY_NPM" == "true" ]]; then
+              args+=(--npm-directory .release/npm)
+            fi
+            if [[ "$VERIFY_PYPI" == "true" ]]; then
+              args+=(--pypi-directory .release/python)
+            fi
+            bun .release/verifier/verify-publications.mjs "\${args[@]}"
+          `
+          // ============================================================================
+        ),
+      },
+    ],
+  };
+  if (workflow.getJob(PUBLICATION_VERIFIER_JOB)) {
+    workflow.updateJob(PUBLICATION_VERIFIER_JOB, job);
+  } else {
+    workflow.addJob(PUBLICATION_VERIFIER_JOB, job);
+  }
+  refreshDocsRegistryDependencies(workflow);
+}
+
 function releaseBuildJob(
   project: DBXToolsJavaScriptProject,
   tagPrefix: string,
@@ -229,6 +330,24 @@ function releaseBuildJob(
               with: { name: "release-npm", path: ".release/npm", "if-no-files-found": "error" },
             },
           ])),
+      {
+        name: "Build publication verifier",
+        if: "${{ success() && (steps.release.outputs.npm == 'true' || steps.release.outputs.pypi == 'true') }}",
+        run: [
+          "mkdir -p .release/verifier",
+          "bun build node_modules/@dbx-tools/projen/tasks/verify-publications.ts --target=bun --outfile=.release/verifier/verify-publications.mjs",
+        ].join("\n"),
+      },
+      {
+        name: "Upload publication verifier",
+        if: "${{ success() && (steps.release.outputs.npm == 'true' || steps.release.outputs.pypi == 'true') }}",
+        uses: github.ActionRefs.ACTIONS_UPLOAD_ARTIFACT,
+        with: {
+          name: PUBLICATION_VERIFIER_ARTIFACT,
+          path: ".release/verifier/verify-publications.mjs",
+          "if-no-files-found": "error",
+        },
+      },
       ...(options.docs
         ? releaseBuildSteps("docs", [
             ...options.docs.prepareSteps,
@@ -356,6 +475,7 @@ export class DBXToolsRelease extends Component {
     if (options.nodeRelease !== false) {
       workflow.addJob("publish-node", nodePublishJob());
     }
+    refreshPublicationVerification(project);
     if (options.docs) {
       addDocsJobs(workflow);
     }

package/src/tsconfig.ts

@@ -3,6 +3,12 @@
  */
 import { Component, type Project, javascript, typescript } from "projen";
 
+/** Consumer overrides for the repository-root TypeScript program. */
+export interface DBXToolsRootTsconfigOptions {
+  readonly compilerOptions?: javascript.TypeScriptCompilerOptions;
+  readonly include?: readonly string[];
+}
+
 /**
  * Compiler options for the ROOT program only (`.projenrc.ts` + the engine as
  * seen from the root). Each package owns its own projen-generated
@@ -40,7 +46,7 @@ export class DBXToolsRootTsconfig extends Component {
   /** Root program config inherited by the generated Projen config. */
   readonly config?: javascript.TypescriptConfig;
 
-  constructor(scope: Project) {
+  constructor(scope: Project, options: DBXToolsRootTsconfigOptions = {}) {
     super(scope);
 
     if (scope instanceof typescript.TypeScriptProject) {
@@ -57,8 +63,9 @@ export class DBXToolsRootTsconfig extends Component {
         lib: ["ESNext"],
         types: ["node", "bun"],
         jsx: javascript.TypeScriptJsxMode.REACT_JSX,
+        ...options.compilerOptions,
       },
-      include: [".projenrc.ts", "test/**/*.ts", "test/**/*.tsx"],
+      include: [".projenrc.ts", "test/**/*.ts", "test/**/*.tsx", ...(options.include ?? [])],
       exclude: ["node_modules", "**/dist", "**/node_modules"],
     });
   }

package/src/workspace-manifest.ts

@@ -43,6 +43,10 @@ export function materializeWorkspaceManifest(
     workspace.catalog && typeof workspace.catalog === "object"
       ? (workspace.catalog as Readonly<Record<string, unknown>>)
       : {};
+  const overrides =
+    workspace.overrides && typeof workspace.overrides === "object"
+      ? (workspace.overrides as Readonly<Record<string, unknown>>)
+      : {};
   if (typeof version !== "string" || !version) {
     throw new Error("Workspace manifest has no version");
   }
@@ -52,7 +56,7 @@ export function materializeWorkspaceManifest(
     manifest[field] = Object.fromEntries(
       Object.entries(dependencies).map(([name, value]) => [
         name,
-        materializeDependency(name, value, version, catalog),
+        materializeDependency(name, value, version, catalog, overrides),
       ]),
     );
   }
@@ -134,7 +138,12 @@ function materializeDependency(
   value: unknown,
   version: string,
   catalog: Readonly<Record<string, unknown>>,
+  overrides: Readonly<Record<string, unknown>>,
 ): unknown {
+  const override = overrides[name];
+  if (typeof override === "string" && override && !override.startsWith("$")) {
+    return override;
+  }
   if (value === "catalog:") {
     const resolved = catalog[name];
     if (typeof resolved !== "string" || !resolved) {

package/tasks/appkit-deploy.ts

@@ -1,16 +1,77 @@
 #!/usr/bin/env -S bun
 /** Deploy an AppKit workspace through npm-compatible temporary manifests. */
+import { existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
 import { profile } from "@dbx-tools/auth";
+import { serializeArgs } from "@dbx-tools/cli-args";
 import * as exec from "@dbx-tools/core/exec";
-import { runTaskMain } from "./cli.ts";
+import { errorUtils, log } from "@dbx-tools/shared-core";
+import { z } from "zod";
+import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { withStagedWorkspaceManifests } from "../src/workspace-manifest.ts";
 
+const logger = log.logger("projen:appkit-deploy");
+
+export const AppKitDeployContextOptionsSchema = z.object({
+  target: z
+    .string()
+    .trim()
+    .min(1)
+    .optional()
+    .describe("Databricks bundle target")
+    .meta({ env: [], short: "t" }),
+  profile: z.string().trim().min(1).optional().describe("Databricks CLI profile").meta({
+    env: [],
+    helpDefault: false,
+    short: "p",
+  }),
+  var: z
+    .array(z.string().trim().min(1))
+    .default([])
+    .describe("Databricks bundle variable assignment")
+    .meta({ env: [] }),
+});
+
+export const AppKitDeployOptionsSchema = AppKitDeployContextOptionsSchema.extend({
+  autoApprove: z
+    .boolean()
+    .default(false)
+    .describe("Skip interactive deployment approval")
+    .meta({ env: [] }),
+  failOnActiveRuns: z
+    .boolean()
+    .default(true)
+    .describe("Fail when bundle jobs or pipelines are active")
+    .meta({ env: [] }),
+  skipTests: z
+    .boolean()
+    .default(true)
+    .describe("Skip Databricks CLI tests after the Bun validation")
+    .meta({ env: [] }),
+  skipValidation: z
+    .boolean()
+    .default(true)
+    .describe("Skip Databricks CLI npm validation after the Bun validation")
+    .meta({ env: [] }),
+});
+
+export type AppKitDeployOptions = z.output<typeof AppKitDeployOptionsSchema>;
+
+interface DeployCommandResult {
+  readonly exitCode: number;
+  readonly stderr?: string;
+  readonly stdout?: string;
+}
+
 /** Effects accepted by the AppKit deploy task for focused tests. */
 export interface AppKitDeployDependencies {
   readonly environment?: NodeJS.ProcessEnv;
+  readonly logs?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
+  readonly plan?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
   readonly root?: string;
   readonly resolveProfile?: () => string | undefined;
-  readonly run?: (args: readonly string[], cwd: string) => Promise<{ readonly exitCode: number }>;
+  readonly run?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
+  readonly validate?: (args: readonly string[], cwd: string) => Promise<DeployCommandResult>;
 }
 
 /** Run Databricks Apps deploy while generated workspace manifests are materialized. */
@@ -19,7 +80,42 @@ export async function deployApp(
   dependencies: AppKitDeployDependencies = {},
 ): Promise<void> {
   const root = dependencies.root ?? process.cwd();
-  const deployArgs = resolveDeployArgs(args, dependencies);
+  const options = await resolveDeployOptions(args, dependencies);
+  const context = AppKitDeployContextOptionsSchema.parse({
+    target: options.target,
+    profile: options.profile,
+    var: options.var,
+  });
+  const contextArgs = serializeArgs(context);
+  const deployArgs = serializeArgs({
+    ...context,
+    ...(options.autoApprove ? { autoApprove: true } : {}),
+    ...(options.failOnActiveRuns ? { failOnActiveRuns: true } : {}),
+    ...(options.skipTests ? { skipTests: true } : {}),
+    ...(options.skipValidation ? { skipValidation: true } : {}),
+  });
+  const validate =
+    dependencies.validate ??
+    (dependencies.run
+      ? undefined
+      : (validateArgs: readonly string[], cwd: string) =>
+          exec.spawn(
+            "databricks",
+            ["bundle", "validate", ...serializeArgs({ strict: true }), ...validateArgs],
+            {
+              cwd,
+              env: dependencies.environment ?? process.env,
+              stdin: "ignore",
+              stdout: "inherit",
+              stderr: "inherit",
+            },
+          ));
+  if (validate) {
+    const validation = await validate(contextArgs, root);
+    if (validation.exitCode !== 0) {
+      throw new Error(`databricks bundle validate exited with code ${validation.exitCode}`);
+    }
+  }
   const run =
     dependencies.run ??
     ((deployArgs: readonly string[], cwd: string) =>
@@ -31,40 +127,119 @@ export async function deployApp(
         stderr: "inherit",
       }));
   await withStagedWorkspaceManifests(root, async (stage) => {
+    await reconcileStagedBundleState(stage, contextArgs, options.target, dependencies);
     const result = await run(deployArgs, stage);
     if (result.exitCode !== 0) {
+      await printAppLogs(contextArgs, stage, dependencies);
       throw new Error(`databricks apps deploy exited with code ${result.exitCode}`);
     }
   });
 }
 
-function resolveDeployArgs(
+async function reconcileStagedBundleState(
+  stage: string,
+  contextArgs: readonly string[],
+  target: string | undefined,
+  dependencies: AppKitDeployDependencies,
+): Promise<void> {
+  const plan =
+    dependencies.plan ??
+    (dependencies.run
+      ? undefined
+      : (args: readonly string[], cwd: string) =>
+          Promise.resolve(
+            exec.spawnSync(
+              "databricks",
+              ["bundle", "plan", ...serializeArgs({ quiet: true }), ...args],
+              {
+                cwd,
+                env: dependencies.environment ?? process.env,
+                stdin: "ignore",
+                stdout: "capture",
+                stderr: "capture",
+              },
+            ),
+          ));
+  if (!plan) return;
+  const result = await plan(contextArgs, stage);
+  if (result.exitCode === 0) return;
+  const output = `${result.stderr ?? ""}\n${result.stdout ?? ""}`.toLowerCase();
+  if (
+    !output.includes("lineage mismatch in state files") ||
+    !output.includes("remote direct state")
+  ) {
+    return;
+  }
+  if (!target) return;
+  const state = join(stage, ".databricks", "bundle", target, "resources.json");
+  if (!existsSync(state)) return;
+  rmSync(state);
+  logger.warn("Removed stale staged bundle state", { target });
+}
+
+async function printAppLogs(
+  contextArgs: readonly string[],
+  cwd: string,
+  dependencies: AppKitDeployDependencies,
+): Promise<void> {
+  logger.error("Databricks Apps deployment failed; recent app logs follow");
+  const showLogs =
+    dependencies.logs ??
+    ((args: readonly string[], logsCwd: string) =>
+      exec.spawn("databricks", ["apps", "logs", ...serializeArgs({ tailLines: 200 }), ...args], {
+        cwd: logsCwd,
+        env: dependencies.environment ?? process.env,
+        stdin: "ignore",
+        stdout: "inherit",
+        stderr: "inherit",
+      }));
+  try {
+    const result = await showLogs(contextArgs, cwd);
+    if (result.exitCode !== 0) {
+      logger.warn("Could not read Databricks App logs", { exitCode: result.exitCode });
+    }
+  } catch (error) {
+    logger.warn("Could not read Databricks App logs", {
+      message: errorUtils.toError(error).message,
+    });
+  }
+}
+
+async function resolveDeployOptions(
   args: readonly string[],
   dependencies: AppKitDeployDependencies,
-): readonly string[] {
-  const environment = dependencies.environment ?? process.env;
-  const hasProfile = args.some(
-    (argument) =>
-      argument === "--profile" || argument === "-p" || argument.startsWith("--profile="),
+): Promise<AppKitDeployOptions> {
+  const parsed = await taskOptions(
+    taskCommand(
+      import.meta.url,
+      "Validate and deploy an AppKit workspace through Databricks Apps",
+      AppKitDeployOptionsSchema,
+    ),
+    AppKitDeployOptionsSchema,
+    args,
   );
+  const environment = dependencies.environment ?? process.env;
   const hasEnvironmentAuth =
     Boolean(environment.DATABRICKS_HOST) &&
     (Boolean(environment.DATABRICKS_TOKEN) ||
       (Boolean(environment.DATABRICKS_CLIENT_ID) && Boolean(environment.DATABRICKS_CLIENT_SECRET)));
+  const configuredProfile = environment.DATABRICKS_CONFIG_PROFILE ?? environment.DATABRICKS_PROFILE;
   const resolvedProfile =
-    hasProfile || hasEnvironmentAuth
+    parsed.profile ??
+    configuredProfile ??
+    (hasEnvironmentAuth
       ? undefined
-      : (dependencies.resolveProfile ?? (() => profile.resolveProfile()?.name))();
-  if (!hasProfile && !hasEnvironmentAuth && !resolvedProfile) {
+      : (dependencies.resolveProfile ?? (() => profile.resolveProfile()?.name))());
+  if (!hasEnvironmentAuth && !resolvedProfile) {
     throw new Error(
       "Select a Databricks profile with --profile or configure Databricks environment credentials",
     );
   }
-  return [
-    ...(args.includes("--skip-validation") ? [] : ["--skip-validation"]),
-    ...args,
-    ...(resolvedProfile ? ["--profile", resolvedProfile] : []),
-  ];
+  return AppKitDeployOptionsSchema.parse({
+    ...parsed,
+    target: parsed.target ?? environment.DATABRICKS_BUNDLE_TARGET,
+    profile: resolvedProfile,
+  });
 }
 
 await runTaskMain(import.meta, () => deployApp(process.argv.slice(2)));

package/tasks/publish-npm.ts

@@ -20,11 +20,11 @@ import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { TaskConcurrencyOptionSchema, TaskDryRunOptionSchema } from "./options.ts";
 import { runTaskCommandAsync } from "../src/_task-command.ts";
+import { PUBLIC_NPM_REGISTRY_URL } from "../src/release-context.ts";
 import { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
 
 export { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
 
-const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 const DEFAULT_PUBLISH_CONCURRENCY = 4;
 const logger = log.logger("projen:publish-npm");
 
@@ -132,10 +132,12 @@ export function npmReleaseMatches(
 export async function publishedNpmRelease(
   name: string,
   version: string,
-  registry = process.env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY,
+  registry = process.env.NPM_CONFIG_REGISTRY ?? PUBLIC_NPM_REGISTRY_URL,
+  signal?: AbortSignal,
 ): Promise<NpmReleaseIdentity | undefined> {
   const response = await fetch(registryUrl(registry, name, version), {
     headers: { accept: "application/json" },
+    signal,
   });
   if (response.status === 404) return undefined;
   if (!response.ok) {
@@ -152,7 +154,7 @@ export async function publishedNpmRelease(
   }
   let contentDigest: string | undefined;
   if (metadata.dist?.tarball) {
-    const archive = await fetch(metadata.dist.tarball);
+    const archive = await fetch(metadata.dist.tarball, { signal });
     if (!archive.ok) {
       throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
     }

package/tasks/pypi-trusted-publisher-instructions.ts

@@ -0,0 +1,54 @@
+/** Parse and print generated PyPI trusted-publisher setup instructions. */
+import { z } from "zod";
+import { taskCommand, taskOptions } from "./cli.ts";
+
+export const PypiTrustedPublisherInstructionsOptionsSchema = z
+  .object({
+    secretFile: z
+      .string()
+      .trim()
+      .min(1)
+      .optional()
+      .describe("Credential file used only when browser authentication is required")
+      .meta({ env: [], helpDefault: false, short: false }),
+  })
+  .describe("Options for rendering PyPI trusted-publisher setup instructions");
+
+/** Project-specific instruction sections wrapped around browser authentication guidance. */
+export interface PypiTrustedPublisherInstructions {
+  readonly afterAuthentication: readonly string[];
+  readonly beforeAuthentication: readonly string[];
+}
+
+/** Parse task options and write the complete trusted-publisher instructions. */
+export async function printPypiTrustedPublisherInstructions(
+  instructions: PypiTrustedPublisherInstructions,
+  argv: readonly string[] = process.argv.slice(2),
+): Promise<void> {
+  const { secretFile } = await taskOptions(
+    taskCommand(
+      import.meta.url,
+      "Print system-browser instructions for PyPI trusted publishers",
+      PypiTrustedPublisherInstructionsOptionsSchema,
+    ),
+    PypiTrustedPublisherInstructionsOptionsSchema,
+    argv,
+  );
+  const authentication = secretFile
+    ? [
+        `- If browser authentication is required, read credentials from ${secretFile} directly into the browser without printing, logging, or exposing secret values.`,
+        `- If ${secretFile} is absent, invalid, or insufficient for authentication, pause and ask the user to complete authentication.`,
+      ]
+    : [
+        "- If browser authentication is required, pause and ask the user to complete authentication.",
+      ];
+  process.stdout.write(
+    `${[
+      ...instructions.beforeAuthentication,
+      ...authentication,
+      ...instructions.afterAuthentication,
+    ]
+      .join("\n")
+      .trimEnd()}\n`,
+  );
+}

package/tasks/python-node-bindings.ts

@@ -13,7 +13,7 @@ import ts from "typescript";
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { TaskCheckOptionSchema, TaskForceOptionSchema, TaskRootOptionSchema } from "./options.ts";
-import { header, makeReadonly, makeWritable } from "../src/generated.ts";
+import { header, headerLines, makeReadonly, makeWritable } from "../src/generated.ts";
 import { publicFunctionExports } from "../src/module-exports.ts";
 import { resolveRepoRoot } from "../src/packages.ts";
 import {
@@ -434,9 +434,11 @@ export async function main(args: string[] = process.argv.slice(2)): Promise<void
       section.includes("Callable["),
     );
     return [
-      "# GENERATED by projen/tasks/python-node-bindings.ts - DO NOT EDIT.",
-      `# Regenerated from ${source}.`,
-      "# Hand edits are overwritten; this file is read-only.",
+      ...headerLines({
+        comment: "#",
+        tool: "projen/tasks/python-node-bindings.ts",
+        source,
+      }),
       "",
       "from __future__ import annotations",
       "",
@@ -1162,9 +1164,11 @@ function removeEmptyDirectories(directory: string): void {
 
 function pythonRuntimeLoader(source: string): string {
   return [
-    "# GENERATED by projen/tasks/python-node-bindings.ts - DO NOT EDIT.",
-    `# Regenerated from ${source}.`,
-    "# Hand edits are overwritten; this file is read-only.",
+    ...headerLines({
+      comment: "#",
+      tool: "projen/tasks/python-node-bindings.ts",
+      source,
+    }),
     "",
     "from __future__ import annotations",
     "",