@dbx-tools/projen 0.9.153 → 0.9.157

package/src/project.ts

@@ -3,18 +3,13 @@
  * dbx-tools project implementations.
  */
 import { type PathMatchInput } from "@dbx-tools/path";
-import { object, type OneOrMany } from "@dbx-tools/shared-core";
+import { type OneOrMany, toOneOrMany } from "@dbx-tools/shared-core";
 import { type IConstruct } from "constructs";
 import { Project, type ProjectOptions } from "projen";
 import * as mixin from "./mixin.ts";
 import type { DBXToolsJavaScriptProject } from "./project-js.ts";
 import * as projectPredicate from "./project-predicate.ts";
 
-export * from "./project-js.ts";
-export * from "./project-py.ts";
-export * from "./python-node-bindings-component.ts";
-export * from "./python-node-runtime.ts";
-
 /** Runtime family implemented by a dbx-tools project. */
 export type DBXToolsProjectLanguage = "javascript" | "python";
 
@@ -91,29 +86,27 @@ export function applyToProjects<P extends Project>(
   if (!options?.includeRoots) predicate = predicate.and((project) => project.parent != null);
   if (options?.identifierPackageName) {
     predicate = predicate.and(
-      projectPredicate.hasIdentifierPackageName(
-        ...object.toOneOrMany(options.identifierPackageName),
-      ),
+      projectPredicate.hasIdentifierPackageName(...toOneOrMany(options.identifierPackageName)),
     );
   }
   if (options?.name) {
-    predicate = predicate.and(projectPredicate.hasName(...object.toOneOrMany(options.name)));
+    predicate = predicate.and(projectPredicate.hasName(...toOneOrMany(options.name)));
   }
   if (options?.identifierScope) {
     predicate = predicate.and(
-      projectPredicate.hasIdentifierScope(...object.toOneOrMany(options.identifierScope)),
+      projectPredicate.hasIdentifierScope(...toOneOrMany(options.identifierScope)),
     );
   }
   if (options?.identifierName) {
     predicate = predicate.and(
-      projectPredicate.hasIdentifierName(...object.toOneOrMany(options.identifierName)),
+      projectPredicate.hasIdentifierName(...toOneOrMany(options.identifierName)),
     );
   }
   if (options?.tags) {
-    predicate = predicate.and(projectPredicate.hasTag(...object.toOneOrMany(options.tags)));
+    predicate = predicate.and(projectPredicate.hasTag(...toOneOrMany(options.tags)));
   }
   if (options?.path) {
-    predicate = predicate.and(projectPredicate.hasPath(...object.toOneOrMany(options.path)));
+    predicate = predicate.and(projectPredicate.hasPath(...toOneOrMany(options.path)));
   }
   const projectMixin = mixin.create(predicate, (project) => {
     callbacks.forEach((callback) => callback(project as Project));

package/src/publish.ts

@@ -16,7 +16,7 @@
  *
  * Two compiler options make the emitted tree loadable, both native `tsc`:
  *
- * - `rootDir: "."` so the package-ROOT `index.ts` barrel is compiled at all.
+ * - `rootDir: "."` so package-root `index*.ts` barrels are compiled at all.
  *   projen's default `rootDir: "src"` puts the barrel outside the compilation,
  *   which is why `lib/` would otherwise have no `index.js`.
  * - `rewriteRelativeImportExtensions`, which turns the `./x.ts` specifiers this
@@ -80,7 +80,7 @@ function compiledStem(target: string): string | undefined {
  * target that ships as-is (`./package.json`, a stylesheet, an SVG asset).
  *
  * `rootDir: "."` means the emitted tree mirrors the package layout, so the
- * mapping is positional: `./src/react/index.ts` -> `./lib/src/react/index.js`.
+ * mapping is positional: `./index.react.ts` -> `./lib/index.react.js`.
  */
 function compiledTarget(target: string): { types: string; default: string } | undefined {
   const stem = compiledStem(target);
@@ -145,7 +145,7 @@ export function applyCompiledPublish(pkg: javascript.NodeProject): void {
   if (!publishesCompiled(pkg)) return;
 
   applyCompilerOptions(pkg, COMPILED_COMPILER_OPTIONS);
-  applyIncludes(pkg, "index.ts");
+  applyIncludes(pkg, "index*.ts");
   addPackageFiles(pkg, COMPILED_DIR);
 
   const config = publishConfig(pkg);

package/src/python-node-bindings.ts

@@ -1,10 +1,11 @@
 /** Shared pyproject-backed configuration for PythonMonkey Node bindings. */
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { createRequire } from "node:module";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { find } from "@dbx-tools/path";
-import { object, stringUtils } from "@dbx-tools/shared-core";
+import { findFilesSync } from "@dbx-tools/path";
+import { isRecord, toIdentifierWithOptions } from "@dbx-tools/shared-core";
 import { parse } from "smol-toml";
 import ts from "typescript";
 import { runTaskCommand } from "./_task-command.ts";
@@ -137,7 +138,7 @@ export function resolvePythonNodeBindingModules(
   config: ResolvedPythonNodeBindings,
 ): ResolvedPythonNodeBindings {
   if (config.modules.length > 0) return config;
-  const packageEntrypoint = Bun.resolveSync(config.entrypoint, config.projectDirectory);
+  const packageEntrypoint = resolveModule(config.entrypoint, config.projectDirectory);
   const modules = publicNamespaceExports(packageEntrypoint).filter(
     (module) =>
       publicFunctionExports(resolvePythonNodeBindingModule(packageEntrypoint, module)).length > 0,
@@ -147,7 +148,7 @@ export function resolvePythonNodeBindingModules(
 
 /** Map a JavaScript export or namespace to its generated Python identifier. */
 export function pythonNodeBindingFunctionName(javascriptName: string): string {
-  const name = stringUtils.toIdentifierWithOptions({ delimiter: "_" }, javascriptName);
+  const name = toIdentifierWithOptions({ delimiter: "_" }, javascriptName);
   if (!isPythonNodeBindingIdentifier(name)) {
     throw new Error(
       `JavaScript export ${javascriptName} does not map to a valid Python function name`,
@@ -184,7 +185,7 @@ export function pythonNodeBindingInputFingerprint(
     for (const input of config.watchInputs) files.add(canonicalPath(resolve(root, input)));
     for (const { handlerFile } of config.functionOverrides) files.add(canonicalPath(handlerFile));
     const packageEntrypoint = canonicalPath(
-      Bun.resolveSync(config.entrypoint, config.projectDirectory),
+      resolveModule(config.entrypoint, config.projectDirectory),
     );
     files.add(packageEntrypoint);
     const packageManifest = nearestPackageManifest(packageEntrypoint);
@@ -327,8 +328,7 @@ export function resolveAllPythonNodeBindings(
 /** Repository-relative Python projects that configure generated Node bindings. */
 export function pythonNodeBindingProjects(projectRoot: string): string[] {
   return [
-    ...find
-      .findFilesSync("**/pyproject.toml", { cwd: projectRoot })
+    ...findFilesSync("**/pyproject.toml", { cwd: projectRoot })
       .filter((file) => {
         const manifest = parse(readFileSync(resolve(projectRoot, file), "utf8")) as {
           tool?: { dbx_tools?: { node_bindings?: unknown } };
@@ -443,7 +443,7 @@ type BindingSourceConfig = Omit<ResolvedPythonNodeBindings, "watchInputs">;
 
 /** Transitive workspace source files reachable from configured binding modules. */
 function bindingSourceInputs(root: string, config: BindingSourceConfig): string[] {
-  const packageEntrypoint = Bun.resolveSync(config.entrypoint, config.projectDirectory);
+  const packageEntrypoint = resolveModule(config.entrypoint, config.projectDirectory);
   const entrypoints =
     config.modules.length > 0
       ? config.modules.map((module) => resolvePythonNodeBindingModule(packageEntrypoint, module))
@@ -479,7 +479,7 @@ function transitiveSourceFiles(
     const dependencies = ts.preProcessFile(source, true, true).importedFiles;
     for (const dependency of dependencies) {
       try {
-        pending.push(Bun.resolveSync(dependency.fileName, dirname(candidate)));
+        pending.push(resolveModule(dependency.fileName, dirname(candidate)));
       } catch {
         // Built-ins and external packages are outside the workspace source graph.
       }
@@ -501,7 +501,11 @@ export function resolvePythonNodeBindingModule(entrypoint: string, module: strin
   if (!match?.[1]) {
     throw new Error(`${entrypoint} does not export namespace ${module}`);
   }
-  return Bun.resolveSync(match[1], dirname(entrypoint));
+  return resolveModule(match[1], dirname(entrypoint));
+}
+
+function resolveModule(specifier: string, directory: string): string {
+  return createRequire(join(directory, "package.json")).resolve(specifier);
 }
 
 function canonicalPath(path: string): string {
@@ -578,11 +582,11 @@ function validateBindings(configs: readonly ResolvedPythonNodeBindings[]): void
 
 function nodePackageName(packageName: string): string {
   const unscoped = packageName.split("/").at(-1) ?? packageName;
-  return stringUtils.toIdentifierWithOptions({ delimiter: "_" }, unscoped);
+  return toIdentifierWithOptions({ delimiter: "_" }, unscoped);
 }
 
 function record(value: unknown, path: string): Record<string, unknown> {
-  if (!object.isRecord(value)) throw new Error(`${path} must be a table`);
+  if (!isRecord(value)) throw new Error(`${path} must be a table`);
   return value;
 }
 

package/src/python-packaging.ts

@@ -0,0 +1,177 @@
+/** Side-effect-free Python workspace distribution packaging. */
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { projectUtils } from "@dbx-tools/core";
+import { parse, stringify } from "smol-toml";
+import { runTaskCommand } from "./_task-command.ts";
+import { preparePythonProjectForPublication, pythonProjectInfo } from "./python-release.ts";
+
+interface PythonProjectFile {
+  readonly directory: string;
+  readonly name: string;
+  readonly version: string;
+  readonly path: string;
+  readonly private: boolean;
+  readonly source: string;
+}
+
+/** Python wheel and source archives accepted by Twine and package indexes. */
+export function pythonDistributionPaths(directory: string): string[] {
+  return readdirSync(directory)
+    .filter((file) => file.endsWith(".whl") || file.endsWith(".tar.gz"))
+    .sort()
+    .map((file) => join(directory, file));
+}
+
+function removeTemporaryTree(root: string): void {
+  if (!existsSync(root)) return;
+  const makeWritable = (directory: string): void => {
+    chmodSync(directory, 0o700);
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isDirectory()) makeWritable(join(directory, entry.name));
+    }
+  };
+  makeWritable(root);
+  rmSync(root, { recursive: true, force: true });
+}
+
+function pythonProjects(root: string): PythonProjectFile[] {
+  const packageFiles = readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => resolve(root, entry.name, "pyproject.toml"))
+    .filter(existsSync)
+    .sort();
+  const allProjects: PythonProjectFile[] = packageFiles.map((path) => {
+    const source = readFileSync(path, "utf8");
+    const info = pythonProjectInfo(source, { parse });
+    return {
+      directory: basename(resolve(path, "..")),
+      name: info.name,
+      version: info.version,
+      path,
+      private: info.private,
+      source,
+    };
+  });
+  return allProjects;
+}
+
+/** Build and upload every selected public Python workspace distribution. */
+export function publishPythonProjects(options: {
+  readonly dryRun?: boolean;
+  readonly indexUrl: string;
+  readonly publishUrl: string;
+  readonly root: string;
+  readonly version: string;
+}): void {
+  const output = mkdtempSync(join(tmpdir(), "projen-python-publish-"));
+  try {
+    buildPythonProjectsInternal({ ...options, output }, true);
+    runTaskCommand(
+      process.cwd(),
+      "uvx",
+      [
+        "--from",
+        "devpi-client",
+        "devpi",
+        "upload",
+        "--index",
+        options.publishUrl,
+        "--from-dir",
+        ...(options.dryRun ? ["--dry-run"] : []),
+        output,
+      ],
+      { env: { ...process.env, UV_DEFAULT_INDEX: options.indexUrl } },
+    );
+  } finally {
+    removeTemporaryTree(output);
+  }
+}
+
+/** Build the exact Python release distributions without publishing them. */
+export function buildPythonProjects(options: {
+  readonly allowEmpty?: boolean;
+  readonly output: string;
+  readonly packages?: readonly string[];
+  /** Place each package's artifacts in its directory beneath output. */
+  readonly packageDirectories?: boolean;
+  readonly root: string;
+  readonly version: string;
+}): void {
+  buildPythonProjectsInternal(options, false);
+}
+
+function buildPythonProjectsInternal(
+  options: Parameters<typeof buildPythonProjects>[0],
+  allowOutputOutsideWorkspace: boolean,
+): void {
+  const root = resolve(options.root);
+  const output = resolve(options.output);
+  const workspace = projectUtils.root(root) ?? dirname(root);
+  const outputPath = relative(workspace, output);
+  if (
+    !allowOutputOutsideWorkspace &&
+    (!outputPath || outputPath.startsWith("..") || isAbsolute(outputPath))
+  ) {
+    throw new Error("Python release output must be a non-root directory inside the workspace");
+  }
+  rmSync(output, { recursive: true, force: true });
+  const allProjects = pythonProjects(root);
+  const requested = new Set(options.packages ?? []);
+  const missing = [...requested].filter(
+    (directory) => !allProjects.some((project) => project.directory === directory),
+  );
+  if (missing.length > 0) throw new Error(`Unknown Python packages: ${missing.join(", ")}`);
+  const projects = allProjects.filter(
+    (project) => !project.private && (requested.size === 0 || requested.has(project.directory)),
+  );
+  if (projects.length === 0 && options.allowEmpty) {
+    mkdirSync(output, { recursive: true });
+    return;
+  }
+  if (projects.length === 0) throw new Error(`No Python packages found under ${root}`);
+
+  const temporaryRoot = mkdtempSync(join(tmpdir(), "projen-python-release-"));
+  try {
+    mkdirSync(output, { recursive: true });
+    for (const project of projects) {
+      const packageRoot = join(temporaryRoot, project.directory);
+      cpSync(dirname(project.path), packageRoot, { recursive: true });
+      const manifestPath = join(packageRoot, "pyproject.toml");
+      chmodSync(manifestPath, 0o644);
+      writeFileSync(
+        manifestPath,
+        preparePythonProjectForPublication(project.source, {
+          packages: allProjects,
+          toml: { parse, stringify },
+          version: options.version,
+        }),
+      );
+      const packageOutput = options.packageDirectories ? join(output, project.directory) : output;
+      runTaskCommand(root, "uv", ["build", "--out-dir", packageOutput, packageRoot]);
+      if (pythonDistributionPaths(packageOutput).length === 0) {
+        throw new Error(`No Python distributions found for ${project.name}`);
+      }
+    }
+    const distributions = options.packageDirectories
+      ? projects.flatMap((project) => pythonDistributionPaths(join(output, project.directory)))
+      : pythonDistributionPaths(output);
+    if (distributions.length === 0) {
+      throw new Error(`No Python distributions found in ${output}`);
+    }
+    runTaskCommand(process.cwd(), "uvx", ["twine", "check", ...distributions]);
+  } finally {
+    removeTemporaryTree(temporaryRoot);
+  }
+}

package/src/release-context.ts

@@ -3,3 +3,7 @@
 export const RELEASE_VERSION = "${{ needs.build-release.outputs.release_version }}";
 /** Generated GitHub Actions workflow triggered by release tags. */
 export const RELEASE_WORKFLOW_FILE = "release.yml";
+/** Public npm registry queried after npm publication completes. */
+export const PUBLIC_NPM_REGISTRY_URL = "https://registry.npmjs.org";
+/** Public PyPI JSON API queried after Python publication completes. */
+export const PUBLIC_PYPI_REGISTRY_URL = "https://pypi.org/pypi";

package/src/release-options.ts

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import { json } from "@dbx-tools/shared-core";
+import { parseRecord } from "@dbx-tools/shared-core";
 import { z } from "zod";
 
 /** Publication scopes accepted by the release task; auto preserves normal publication. */
@@ -70,7 +70,7 @@ export function parseReleaseTagAnnotation(annotation: string): ReleaseStepSelect
   const selections = annotation.split("\n").filter((line) => line.startsWith(ANNOTATION_MARKER));
   if (selections.length === 0) return releaseStepSelection();
   if (selections.length !== 1) throw new Error("Release tag contains multiple step selections");
-  const value = json.parseRecord(selections[0]!.slice(ANNOTATION_MARKER.length));
+  const value = parseRecord(selections[0]!.slice(ANNOTATION_MARKER.length));
   const parsed = ReleaseStepSelectionSchema.safeParse(value);
   if (!parsed.success) throw new Error("Invalid release tag step selection");
   return parsed.data;

package/src/release.ts

@@ -10,18 +10,23 @@
  * jobs download them. `DBXToolsRelease` therefore remains separate while native
  * workflow and project primitives own the YAML model and setup steps.
  */
-import { stringUtils } from "@dbx-tools/shared-core";
+import { dedent } from "@dbx-tools/shared-core";
 import { Component, github } from "projen";
 import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
 import { BUN_VERSION } from "./bun-workflow.ts";
 import { projectReleaseBranch, taskCommand, type DBXToolsJavaScriptProject } from "./project-js.ts";
-import { RELEASE_VERSION, RELEASE_WORKFLOW_FILE } from "./release-context.ts";
+import {
+  PUBLIC_NPM_REGISTRY_URL,
+  RELEASE_VERSION,
+  RELEASE_WORKFLOW_FILE,
+} from "./release-context.ts";
 import type { ReleaseStepSelection } from "./release-options.ts";
 
 const NODE_VERSION = "24";
 const NPM_VERSION = "11.4.2";
-const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const PUBLICATION_VERIFIER_ARTIFACT = "release-publication-verifier";
+const PUBLICATION_VERIFIER_JOB = "verify-publications";
 const releaseTagPrefixes = new WeakMap<DBXToolsJavaScriptProject, string>();
 const releaseWorkflows = new WeakMap<DBXToolsJavaScriptProject, GithubWorkflow>();
 
@@ -95,7 +100,7 @@ export function nodeReleaseSetupSteps(): readonly JobStep[] {
       uses: github.ActionRefs.ACTIONS_SETUP_NODE,
       with: {
         "node-version": NODE_VERSION,
-        "registry-url": NPM_REGISTRY_URL,
+        "registry-url": PUBLIC_NPM_REGISTRY_URL,
         "package-manager-cache": false,
       },
     },
@@ -114,19 +119,14 @@ export function uvSetupStep(): JobStep {
 function refreshDocsRegistryDependencies(workflow: GithubWorkflow): void {
   const docs = workflow.getJob("deploy-docs") as Job | undefined;
   if (!docs) return;
-  const registryJobs = Object.keys(workflow.jobs).filter(
-    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
-  );
-  if (registryJobs.length > 0) {
+  if (workflow.getJob(PUBLICATION_VERIFIER_JOB)) {
     workflow.updateJob("deploy-docs", {
       ...docs,
-      needs: ["build-release", ...registryJobs],
+      needs: ["build-release", PUBLICATION_VERIFIER_JOB],
       if: releaseCondition([
         "needs['build-release'].result == 'success'",
         "needs['build-release'].outputs.docs == 'true'",
-        ...registryJobs.map(
-          (name) => `needs['${name}'].result == 'success' || needs['${name}'].result == 'skipped'`,
-        ),
+        `needs['${PUBLICATION_VERIFIER_JOB}'].result == 'success' || needs['${PUBLICATION_VERIFIER_JOB}'].result == 'skipped'`,
       ]),
     });
   }
@@ -140,6 +140,107 @@ export function refreshReleaseDocsDependencies(project: DBXToolsJavaScriptProjec
   }
 }
 
+function publicationRegistryJobs(workflow: GithubWorkflow): string[] {
+  return Object.keys(workflow.jobs).filter(
+    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
+  );
+}
+
+/** Keep one public availability barrier behind every configured registry publisher. */
+export function refreshPublicationVerification(project: DBXToolsJavaScriptProject): void {
+  const workflow = releaseWorkflows.get(project);
+  if (!workflow) return;
+  const registryJobs = publicationRegistryJobs(workflow);
+  if (registryJobs.length === 0) return;
+  const hasNpm = registryJobs.includes("publish-node");
+  const hasPypi = registryJobs.some((name) => name.startsWith("publish-pypi-"));
+  const selected = [
+    ...(hasNpm ? ["needs['build-release'].outputs.npm == 'true'"] : []),
+    ...(hasPypi ? ["needs['build-release'].outputs.pypi == 'true'"] : []),
+  ].join(" || ");
+  const prerequisites = registryJobs.map((name) => {
+    const output = name === "publish-node" ? "npm" : "pypi";
+    return `needs['build-release'].outputs.${output} != 'true' || needs['${name}'].result == 'success'`;
+  });
+  const job: Job = {
+    if: releaseCondition([
+      "needs['build-release'].result == 'success'",
+      selected,
+      ...prerequisites,
+    ]),
+    needs: ["build-release", ...registryJobs],
+    runsOn: ["ubuntu-latest"],
+    permissions: { contents: JobPermission.READ },
+    timeoutMinutes: 15,
+    steps: [
+      {
+        name: "Download publication verifier",
+        uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+        with: { name: PUBLICATION_VERIFIER_ARTIFACT, path: ".release/verifier" },
+      },
+      ...(hasNpm
+        ? [
+            {
+              name: "Download npm archives",
+              if: "${{ needs.build-release.outputs.npm == 'true' }}",
+              uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+              with: { name: "release-npm", path: ".release/npm" },
+            },
+          ]
+        : []),
+      ...(hasPypi
+        ? [
+            {
+              name: "Download Python distributions",
+              if: "${{ needs.build-release.outputs.pypi == 'true' }}",
+              uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+              with: {
+                pattern: "release-python-*",
+                path: ".release/python",
+                "merge-multiple": true,
+              },
+            },
+          ]
+        : []),
+      {
+        name: "Setup Bun",
+        uses: github.ActionRefs.OVEN_SH_SETUP_BUN,
+        with: { "bun-version": BUN_VERSION },
+      },
+      {
+        name: "Wait for public package availability",
+        shell: "bash",
+        env: {
+          RELEASE_VERSION,
+          VERIFY_NPM: hasNpm ? "${{ needs.build-release.outputs.npm }}" : "false",
+          VERIFY_PYPI: hasPypi ? "${{ needs.build-release.outputs.pypi }}" : "false",
+        },
+        // prettier-ignore
+        run: dedent(
+          // ============================================================================
+          /*bash*/`
+            args=(--version "$RELEASE_VERSION")
+            if [[ "$VERIFY_NPM" == "true" ]]; then
+              args+=(--npm-directory .release/npm)
+            fi
+            if [[ "$VERIFY_PYPI" == "true" ]]; then
+              args+=(--pypi-directory .release/python)
+            fi
+            bun .release/verifier/verify-publications.mjs "\${args[@]}"
+          `
+          // ============================================================================
+        ),
+      },
+    ],
+  };
+  if (workflow.getJob(PUBLICATION_VERIFIER_JOB)) {
+    workflow.updateJob(PUBLICATION_VERIFIER_JOB, job);
+  } else {
+    workflow.addJob(PUBLICATION_VERIFIER_JOB, job);
+  }
+  refreshDocsRegistryDependencies(workflow);
+}
+
 function releaseBuildJob(
   project: DBXToolsJavaScriptProject,
   tagPrefix: string,
@@ -181,7 +282,7 @@ function releaseBuildJob(
           RELEASE_TAG: "${{ github.ref_name }}",
         },
         // prettier-ignore
-        run: stringUtils.dedent(
+        run: dedent(
           // ============================================================================
           /*bash*/`
           case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac
@@ -229,6 +330,24 @@ function releaseBuildJob(
               with: { name: "release-npm", path: ".release/npm", "if-no-files-found": "error" },
             },
           ])),
+      {
+        name: "Build publication verifier",
+        if: "${{ success() && (steps.release.outputs.npm == 'true' || steps.release.outputs.pypi == 'true') }}",
+        run: [
+          "mkdir -p .release/verifier",
+          "bun build node_modules/@dbx-tools/projen/tasks/verify-publications.ts --target=bun --outfile=.release/verifier/verify-publications.mjs",
+        ].join("\n"),
+      },
+      {
+        name: "Upload publication verifier",
+        if: "${{ success() && (steps.release.outputs.npm == 'true' || steps.release.outputs.pypi == 'true') }}",
+        uses: github.ActionRefs.ACTIONS_UPLOAD_ARTIFACT,
+        with: {
+          name: PUBLICATION_VERIFIER_ARTIFACT,
+          path: ".release/verifier/verify-publications.mjs",
+          "if-no-files-found": "error",
+        },
+      },
       ...(options.docs
         ? releaseBuildSteps("docs", [
             ...options.docs.prepareSteps,
@@ -356,6 +475,7 @@ export class DBXToolsRelease extends Component {
     if (options.nodeRelease !== false) {
       workflow.addJob("publish-node", nodePublishJob());
     }
+    refreshPublicationVerification(project);
     if (options.docs) {
       addDocsJobs(workflow);
     }

package/src/shared-core-usage.ts

@@ -7,9 +7,9 @@
  */
 import { readFileSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
-import { find } from "@dbx-tools/path";
+import { findFiles } from "@dbx-tools/path";
 import * as core from "@dbx-tools/shared-core";
-import { PACKAGE_IDENTIFIER, object } from "@dbx-tools/shared-core";
+import { PACKAGE_IDENTIFIER, sequence } from "@dbx-tools/shared-core";
 import { PYTHON_GENERATED_PACKAGE } from "./generated.ts";
 import { readPackageManifest, recordedPackages, repoRoot } from "./packages.ts";
 
@@ -33,6 +33,7 @@ export const SHARED_CORE_BINDING_EXPORTS = [
 
 const SOURCE_PATTERN = "**/*.{ts,tsx,js,mjs}";
 const NAMESPACE_EXPORT = /^export \* as (\w+) from "\.\/src\/([^"]+)\.ts";$/gm;
+const ROOT_NAMED_IMPORT = /import\s*\{([\s\S]*?)\}\s*from\s*["']@dbx-tools\/shared-core["']/g;
 const LOCAL_OWNED_HELPER =
   /(?:export\s+)?(?:async\s+)?function(?:\s*\*)?\s+(isRecord|sleep|escapeRegExp|trimToNull|trimToUndefined|trimToEmpty)\s*\(|(?:export\s+)?const\s+(isRecord|sleep|escapeRegExp|trimToNull|trimToUndefined|trimToEmpty)\s*=/g;
 
@@ -70,7 +71,7 @@ async function sourceFiles(root: string, includeGenerated: boolean): Promise<str
   ];
   if (!includeGenerated) ignore.push(`**/${PYTHON_GENERATED_PACKAGE}/**`);
   const files: string[] = [];
-  for await (const file of find.findFiles(SOURCE_PATTERN, { cwd: root, ignore })) {
+  for await (const file of findFiles(SOURCE_PATTERN, { cwd: root, ignore })) {
     files.push(resolve(root, file));
   }
   return files.sort();
@@ -109,6 +110,18 @@ function mentionsExport(
   moduleFile: string,
 ): boolean {
   if (source.includes(`${namespace}.${name}`)) return true;
+  ROOT_NAMED_IMPORT.lastIndex = 0;
+  for (const match of source.matchAll(ROOT_NAMED_IMPORT)) {
+    const specifiers = match[1]!.split(",").map((specifier) => specifier.trim());
+    if (
+      specifiers.some((specifier) => {
+        if (!specifier || specifier.startsWith("type ")) return false;
+        return specifier.split(/\s+as\s+/u, 1)[0] === name;
+      })
+    ) {
+      return true;
+    }
+  }
   const imported =
     source.includes(`from "@dbx-tools/shared-core/${moduleFile}"`) ||
     source.includes(`from "./${moduleFile}.ts"`) ||
@@ -173,7 +186,7 @@ export async function duplicatedOwnedHelpers(root: string = repoRoot): Promise<s
 
 /** Render a compact usage table for `shared-core:usage`. */
 export function formatSharedCoreUsage(usage: readonly SharedCoreExportUsage[]): string {
-  const counts = object.sequence(usage).group({
+  const counts = sequence(usage).group({
     production: (row) => row.kind === "production",
     binding: (row) => row.kind === "binding",
     internal: (row) => row.kind === "internal",