@dbx-tools/projen 0.9.153 → 0.9.157

package/tasks/publish-npm.ts

@@ -1,214 +1,22 @@
 #!/usr/bin/env -S bun
 /** Idempotent npm archive publication for release recovery. */
-import { createHash } from "node:crypto";
-import {
-  chmodSync,
-  lstatSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  readlinkSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join, relative, resolve } from "node:path";
-import * as exec from "@dbx-tools/core/exec";
-import * as projectUtils from "@dbx-tools/core/project-utils";
-import { asyncUtils, log } from "@dbx-tools/shared-core";
+import { readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { log, mapConcurrent } from "@dbx-tools/shared-core";
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { TaskConcurrencyOptionSchema, TaskDryRunOptionSchema } from "./options.ts";
 import { runTaskCommandAsync } from "../src/_task-command.ts";
-import { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
-
-export { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
+import {
+  npmReleaseMatches,
+  publishedNpmRelease,
+  readNpmArchiveIdentity,
+  readNpmArchiveManifest,
+} from "../src/npm-release.ts";
 
-const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 const DEFAULT_PUBLISH_CONCURRENCY = 4;
 const logger = log.logger("projen:publish-npm");
 
-/** Registry and archive identity used to verify idempotent npm publication. */
-export interface NpmReleaseIdentity {
-  readonly access?: "public" | "restricted";
-  readonly contentDigest?: string;
-  readonly integrity?: string;
-  readonly name: string;
-  readonly repository?: unknown;
-  readonly version: string;
-}
-
-interface NpmArchiveManifest {
-  readonly [key: string]: unknown;
-  readonly dependencies?: Readonly<Record<string, string>>;
-  readonly optionalDependencies?: Readonly<Record<string, string>>;
-  readonly name?: string;
-  readonly publishConfig?: { readonly access?: unknown };
-  readonly repository?: unknown;
-  readonly version?: string;
-}
-
-/** Transform applied to a packed npm manifest before archive verification. */
-export type NpmArchiveManifestTransform = (
-  manifest: NpmArchiveManifest,
-) => Readonly<Record<string, unknown>>;
-
-/** Entry-point fields projected from publishConfig into a packed manifest. */
-const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const;
-/**
- * Fold compiled publish entry points onto an archive manifest without changing
- * the source checkout.
- */
-export function applyPublishConfig(
-  source: Readonly<Record<string, unknown>>,
-): Readonly<Record<string, unknown>> {
-  const manifest = { ...source };
-  const publishConfig = manifest.publishConfig as Record<string, unknown> | undefined;
-  if (!publishConfig) return manifest;
-  for (const field of PUBLISH_CONFIG_ENTRY_FIELDS) {
-    if (field in publishConfig) manifest[field] = publishConfig[field];
-  }
-  return manifest;
-}
-
-function archiveFileEntries(directory: string, prefix = ""): string[] {
-  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
-    const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
-    return entry.isDirectory()
-      ? archiveFileEntries(join(directory, entry.name), relativePath)
-      : [relativePath];
-  });
-}
-
-function normalizedRepository(value: unknown): string | undefined {
-  const url =
-    typeof value === "string"
-      ? value
-      : value && typeof value === "object" && "url" in value
-        ? String(value.url)
-        : undefined;
-  return url
-    ?.replace(/^git\+/, "")
-    .replace(/\.git$/, "")
-    .replace(/\/$/, "");
-}
-
-function registryUrl(registry: string, name: string, version: string): string {
-  return `${registry.replace(/\/$/, "")}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
-}
-
-/** Verify that registry metadata represents the exact locally packed release. */
-export function npmReleaseMatches(
-  local: NpmReleaseIdentity,
-  published: NpmReleaseIdentity | undefined,
-): boolean {
-  if (!published) return false;
-  if (published.name !== local.name || published.version !== local.version) {
-    throw new Error(`Published npm identity does not match ${local.name}@${local.version}`);
-  }
-  const localRepository = normalizedRepository(local.repository);
-  const publishedRepository = normalizedRepository(published.repository);
-  if (localRepository && publishedRepository && localRepository !== publishedRepository) {
-    throw new Error(`Published npm repository does not match ${local.name}@${local.version}`);
-  }
-  if (
-    local.contentDigest &&
-    published.contentDigest &&
-    local.contentDigest !== published.contentDigest
-  ) {
-    throw new Error(`Published npm content does not match ${local.name}@${local.version}`);
-  }
-  if (
-    !(local.contentDigest && published.contentDigest) &&
-    local.integrity &&
-    published.integrity !== local.integrity
-  ) {
-    throw new Error(`Published npm integrity does not match ${local.name}@${local.version}`);
-  }
-  return true;
-}
-
-/** Read one published npm release identity, or `undefined` when it is absent. */
-export async function publishedNpmRelease(
-  name: string,
-  version: string,
-  registry = process.env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY,
-): Promise<NpmReleaseIdentity | undefined> {
-  const response = await fetch(registryUrl(registry, name, version), {
-    headers: { accept: "application/json" },
-  });
-  if (response.status === 404) return undefined;
-  if (!response.ok) {
-    throw new Error(`npm registry lookup failed for ${name}@${version}: ${response.status}`);
-  }
-  const metadata = (await response.json()) as {
-    dist?: { integrity?: string; tarball?: string };
-    name?: string;
-    repository?: unknown;
-    version?: string;
-  };
-  if (!metadata.name || !metadata.version) {
-    throw new Error(`npm registry returned an incomplete identity for ${name}@${version}`);
-  }
-  let contentDigest: string | undefined;
-  if (metadata.dist?.tarball) {
-    const archive = await fetch(metadata.dist.tarball);
-    if (!archive.ok) {
-      throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
-    }
-    const temp = mkdtempSync(join(tmpdir(), "projen-published-npm-"));
-    const path = join(temp, "package.tgz");
-    try {
-      writeFileSync(path, Buffer.from(await archive.arrayBuffer()));
-      contentDigest = npmArchiveContentDigest(path);
-    } finally {
-      rmSync(temp, { recursive: true, force: true });
-    }
-  }
-  return {
-    ...(contentDigest ? { contentDigest } : {}),
-    integrity: metadata.dist?.integrity,
-    name: metadata.name,
-    repository: metadata.repository,
-    version: metadata.version,
-  };
-}
-
-function readNpmArchiveManifest(path: string): NpmArchiveManifest {
-  const result = exec.spawnSync("tar", ["-xOf", path, "package/package.json"], {
-    cwd: process.cwd(),
-    stdout: "capture",
-    stderr: "capture",
-    stdin: "ignore",
-    check: false,
-  });
-  if (result.exitCode !== 0 || !result.stdout) {
-    throw new Error(`Cannot read npm package manifest from ${path}: ${result.stderr}`);
-  }
-  return JSON.parse(result.stdout) as NpmArchiveManifest;
-}
-
-/** Read and hash the release identity embedded in an npm archive. */
-export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
-  const manifest = readNpmArchiveManifest(path);
-  if (!manifest.name || !manifest.version) {
-    throw new Error(`npm archive has no package name or version: ${path}`);
-  }
-  const access = manifest.publishConfig?.access;
-  if (access !== undefined && access !== "public" && access !== "restricted") {
-    throw new Error(`npm archive has invalid publishConfig.access: ${String(access)}`);
-  }
-  return {
-    ...(access ? { access } : {}),
-    contentDigest: npmArchiveContentDigest(path),
-    integrity: `sha512-${createHash("sha512").update(readFileSync(path)).digest("base64")}`,
-    name: manifest.name,
-    repository: manifest.repository,
-    version: manifest.version,
-  };
-}
-
-/** Group npm archives into dependency-ordered layers that can publish concurrently. */
 function npmArchiveLayers(archives: readonly string[]): string[][] {
   const byName = new Map(
     archives.map((archive) => {
@@ -241,9 +49,7 @@ function npmArchiveLayers(archives: readonly string[]): string[][] {
       );
     }
     layers.push(ready.map((name) => byName.get(name)!.archive));
-    for (const name of ready) {
-      remaining.delete(name);
-    }
+    for (const name of ready) remaining.delete(name);
     for (const dependencies of remaining.values()) {
       for (const name of ready) dependencies.delete(name);
     }
@@ -251,118 +57,6 @@ function npmArchiveLayers(archives: readonly string[]): string[][] {
   return layers;
 }
 
-/** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
-export function npmArchiveContentDigest(path: string): string {
-  const temp = mkdtempSync(join(tmpdir(), "projen-npm-content-"));
-  try {
-    exec.spawnSync("tar", ["-xzf", path, "-C", temp], {
-      cwd: process.cwd(),
-      stdout: "ignore",
-      stderr: "capture",
-      stdin: "ignore",
-      check: true,
-    });
-    const hash = createHash("sha512");
-    const visit = (directory: string): void => {
-      for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) =>
-        a.name.localeCompare(b.name),
-      )) {
-        const entryPath = join(directory, entry.name);
-        const name = relative(temp, entryPath).split("\\").join("/");
-        const stat = lstatSync(entryPath);
-        hash.update(`${entry.isDirectory() ? "D" : entry.isSymbolicLink() ? "L" : "F"}\0`);
-        hash.update(`${name}\0${stat.mode & 0o111}\0`);
-        if (entry.isDirectory()) visit(entryPath);
-        else if (entry.isSymbolicLink()) hash.update(readlinkSync(entryPath));
-        else hash.update(readFileSync(entryPath));
-      }
-    };
-    visit(temp);
-    return `sha512-${hash.digest("base64")}`;
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-}
-
-/** Pack one workspace package and optionally transform only its archived manifest. */
-export function packNpmPackage(
-  directory: string,
-  destination: string,
-  path = process.env.PATH ?? "",
-  transformManifest?: NpmArchiveManifestTransform,
-): string {
-  const executable = process.versions.bun ? process.execPath : "bun";
-  const manifest = join(directory, "package.json");
-  const originalManifest = readFileSync(manifest, "utf8");
-  const workspaceRoot = projectUtils.root(directory) ?? directory;
-  const workspaceManifest = JSON.parse(
-    readFileSync(join(workspaceRoot, "package.json"), "utf8"),
-  ) as Record<string, unknown>;
-  const packedManifest = `${JSON.stringify(
-    materializeWorkspaceManifest(
-      JSON.parse(originalManifest) as Record<string, unknown>,
-      workspaceManifest,
-    ),
-    null,
-    2,
-  )}\n`;
-  const manifestMode = lstatSync(manifest).mode & 0o777;
-  const restoreManifestMode = (manifestMode & 0o200) === 0;
-  const existingArchives = new Set(readdirSync(destination));
-  if (restoreManifestMode) chmodSync(manifest, manifestMode | 0o200);
-  try {
-    writeFileSync(manifest, packedManifest);
-    exec.spawnSync(
-      executable,
-      ["pm", "pack", "--destination", destination, "--ignore-scripts", "--quiet"],
-      {
-        cwd: directory,
-        env: { ...process.env, PATH: path },
-        stdout: "inherit",
-        stderr: "inherit",
-        stdin: "ignore",
-        check: true,
-      },
-    );
-  } finally {
-    writeFileSync(manifest, originalManifest);
-    if (restoreManifestMode) chmodSync(manifest, manifestMode);
-  }
-  const archives = readdirSync(destination).filter(
-    (file) => file.endsWith(".tgz") && !existingArchives.has(file),
-  );
-  if (archives.length !== 1) {
-    throw new Error(`Expected one packed npm archive, found ${archives.length}`);
-  }
-  const archive = join(destination, archives[0]);
-  if (!transformManifest) return archive;
-
-  const temp = mkdtempSync(join(tmpdir(), "projen-npm-project-"));
-  try {
-    exec.spawnSync("tar", ["-xzf", archive, "-C", temp], {
-      cwd: process.cwd(),
-      stdout: "ignore",
-      stderr: "inherit",
-      stdin: "ignore",
-      check: true,
-    });
-    const manifestPath = join(temp, "package", "package.json");
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as NpmArchiveManifest;
-    writeFileSync(manifestPath, `${JSON.stringify(transformManifest(manifest), null, 2)}\n`);
-    rmSync(archive, { force: true });
-    exec.spawnSync("tar", ["-czf", archive, "-C", temp, ...archiveFileEntries(temp)], {
-      cwd: process.cwd(),
-      stdout: "ignore",
-      stderr: "inherit",
-      stdin: "ignore",
-      check: true,
-    });
-    return archive;
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-}
-
 /** Publish dependency-ordered npm archives, skipping only exact registry matches. */
 export async function publishNpmArchives(options: {
   readonly concurrency?: number;
@@ -381,7 +75,7 @@ export async function publishNpmArchives(options: {
   if (layers.length === 0) throw new Error(`No npm archives found in ${directory}`);
 
   for (const archives of layers) {
-    await asyncUtils.mapConcurrent(
+    await mapConcurrent(
       archives,
       async (archive) => {
         const local = readNpmArchiveIdentity(archive);

package/tasks/publish-python.ts

@@ -1,23 +1,5 @@
 #!/usr/bin/env -S bun
-/**
- * Build selected uv workspace packages from isolated publication copies and
- * optionally publish the resulting distributions.
- */
-import {
-  chmodSync,
-  cpSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import * as projectUtils from "@dbx-tools/core/project-utils";
-import { parse, stringify } from "smol-toml";
+/** Build or publish selected Python workspace distributions. */
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions, taskPositionals } from "./cli.ts";
 import {
@@ -25,167 +7,7 @@ import {
   TaskDryRunOptionSchema,
   TaskOutputOptionSchema,
 } from "./options.ts";
-import { preparePythonProjectForPublication, pythonProjectInfo } from "./python-release.ts";
-import { runTaskCommand } from "../src/_task-command.ts";
-
-interface PythonProjectFile {
-  readonly directory: string;
-  readonly name: string;
-  readonly version: string;
-  readonly path: string;
-  readonly private: boolean;
-  readonly source: string;
-}
-
-/** Python wheel and source archives accepted by Twine and package indexes. */
-export function pythonDistributionPaths(directory: string): string[] {
-  return readdirSync(directory)
-    .filter((file) => file.endsWith(".whl") || file.endsWith(".tar.gz"))
-    .sort()
-    .map((file) => join(directory, file));
-}
-
-function removeTemporaryTree(root: string): void {
-  if (!existsSync(root)) return;
-  const makeWritable = (directory: string): void => {
-    chmodSync(directory, 0o700);
-    for (const entry of readdirSync(directory, { withFileTypes: true })) {
-      if (entry.isDirectory()) makeWritable(join(directory, entry.name));
-    }
-  };
-  makeWritable(root);
-  rmSync(root, { recursive: true, force: true });
-}
-
-function pythonProjects(root: string): PythonProjectFile[] {
-  const packageFiles = readdirSync(root, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => resolve(root, entry.name, "pyproject.toml"))
-    .filter(existsSync)
-    .sort();
-  const allProjects: PythonProjectFile[] = packageFiles.map((path) => {
-    const source = readFileSync(path, "utf8");
-    const info = pythonProjectInfo(source, { parse });
-    return {
-      directory: basename(resolve(path, "..")),
-      name: info.name,
-      version: info.version,
-      path,
-      private: info.private,
-      source,
-    };
-  });
-  return allProjects;
-}
-
-/** Build and upload every selected public Python workspace distribution. */
-export function publishPythonProjects(options: {
-  readonly dryRun?: boolean;
-  readonly indexUrl: string;
-  readonly publishUrl: string;
-  readonly root: string;
-  readonly version: string;
-}): void {
-  const output = mkdtempSync(join(tmpdir(), "projen-python-publish-"));
-  try {
-    buildPythonProjectsInternal({ ...options, output }, true);
-    runTaskCommand(
-      process.cwd(),
-      "uvx",
-      [
-        "--from",
-        "devpi-client",
-        "devpi",
-        "upload",
-        "--index",
-        options.publishUrl,
-        "--from-dir",
-        ...(options.dryRun ? ["--dry-run"] : []),
-        output,
-      ],
-      { env: { ...process.env, UV_DEFAULT_INDEX: options.indexUrl } },
-    );
-  } finally {
-    removeTemporaryTree(output);
-  }
-}
-
-/** Build the exact Python release distributions without publishing them. */
-export function buildPythonProjects(options: {
-  readonly allowEmpty?: boolean;
-  readonly output: string;
-  readonly packages?: readonly string[];
-  /** Place each package's artifacts in its directory beneath output. */
-  readonly packageDirectories?: boolean;
-  readonly root: string;
-  readonly version: string;
-}): void {
-  buildPythonProjectsInternal(options, false);
-}
-
-function buildPythonProjectsInternal(
-  options: Parameters<typeof buildPythonProjects>[0],
-  allowOutputOutsideWorkspace: boolean,
-): void {
-  const root = resolve(options.root);
-  const output = resolve(options.output);
-  const workspace = projectUtils.root(root) ?? dirname(root);
-  const outputPath = relative(workspace, output);
-  if (
-    !allowOutputOutsideWorkspace &&
-    (!outputPath || outputPath.startsWith("..") || isAbsolute(outputPath))
-  ) {
-    throw new Error("Python release output must be a non-root directory inside the workspace");
-  }
-  rmSync(output, { recursive: true, force: true });
-  const allProjects = pythonProjects(root);
-  const requested = new Set(options.packages ?? []);
-  const missing = [...requested].filter(
-    (directory) => !allProjects.some((project) => project.directory === directory),
-  );
-  if (missing.length > 0) throw new Error(`Unknown Python packages: ${missing.join(", ")}`);
-  const projects = allProjects.filter(
-    (project) => !project.private && (requested.size === 0 || requested.has(project.directory)),
-  );
-  if (projects.length === 0 && options.allowEmpty) {
-    mkdirSync(output, { recursive: true });
-    return;
-  }
-  if (projects.length === 0) throw new Error(`No Python packages found under ${root}`);
-
-  const temporaryRoot = mkdtempSync(join(tmpdir(), "projen-python-release-"));
-  try {
-    mkdirSync(output, { recursive: true });
-    for (const project of projects) {
-      const packageRoot = join(temporaryRoot, project.directory);
-      cpSync(dirname(project.path), packageRoot, { recursive: true });
-      const manifestPath = join(packageRoot, "pyproject.toml");
-      chmodSync(manifestPath, 0o644);
-      writeFileSync(
-        manifestPath,
-        preparePythonProjectForPublication(project.source, {
-          packages: allProjects,
-          toml: { parse, stringify },
-          version: options.version,
-        }),
-      );
-      const packageOutput = options.packageDirectories ? join(output, project.directory) : output;
-      runTaskCommand(root, "uv", ["build", "--out-dir", packageOutput, packageRoot]);
-      if (pythonDistributionPaths(packageOutput).length === 0) {
-        throw new Error(`No Python distributions found for ${project.name}`);
-      }
-    }
-    const distributions = options.packageDirectories
-      ? projects.flatMap((project) => pythonDistributionPaths(join(output, project.directory)))
-      : pythonDistributionPaths(output);
-    if (distributions.length === 0) {
-      throw new Error(`No Python distributions found in ${output}`);
-    }
-    runTaskCommand(process.cwd(), "uvx", ["twine", "check", ...distributions]);
-  } finally {
-    removeTemporaryTree(temporaryRoot);
-  }
-}
+import { buildPythonProjects, publishPythonProjects } from "../src/python-packaging.ts";
 
 /** Parse command-line publication options and run the Python release task. */
 export const PublishPythonOptionsSchema = z.object({

package/tasks/publish.ts

@@ -46,7 +46,7 @@
 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { asyncUtils, log, object } from "@dbx-tools/shared-core";
+import { log, mapConcurrent, sequence } from "@dbx-tools/shared-core";
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions, taskPositionals, taskRoot } from "./cli.ts";
 import {
@@ -56,20 +56,17 @@ import {
   TaskOutputOptionSchema,
   TaskRootOptionSchema,
 } from "./options.ts";
+import { runTaskCommand, runTaskCommandAsync } from "../src/_task-command.ts";
+import { applyPublishConfig, packNpmPackage } from "../src/npm-packaging.ts";
 import {
-  applyPublishConfig,
   npmReleaseMatches,
-  packNpmPackage,
   publishedNpmRelease,
   readNpmArchiveIdentity,
-} from "./publish-npm.ts";
-import { runTaskCommand, runTaskCommandAsync } from "../src/_task-command.ts";
+} from "../src/npm-release.ts";
 import { recordedPackages } from "../src/packages.ts";
 
 const logger = log.logger("projen:publish");
 
-export { applyPublishConfig };
-
 /** Whether selected workspace members carry the reviewed workspace version. */
 function manifestsMatchVersion(members: readonly string[], version: string): boolean {
   return members.every((dir) => {
@@ -187,9 +184,7 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
         `${pkg.name ?? dirname(dir)} has invalid publishConfig.access ${String(access)}`,
       );
     }
-    const compiledTargets = [
-      ...object.sequence(compiledPublishTargets(pkg.publishConfig)).distinct(),
-    ];
+    const compiledTargets = [...sequence(compiledPublishTargets(pkg.publishConfig)).distinct()];
     publishable.push({
       dir,
       name: pkg.name ?? dirname(dir),
@@ -232,7 +227,7 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
     rmSync(output, { recursive: true, force: true });
     mkdirSync(output, { recursive: true });
   }
-  await asyncUtils.mapConcurrent(
+  await mapConcurrent(
     publishable,
     async ({ dir, name, version: packageVersion, access }) => {
       const packed = mkdtempSync(join(tmpdir(), "projen-npm-release-"));

package/tasks/python-node-bindings.ts

@@ -6,7 +6,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { log, stringUtils } from "@dbx-tools/shared-core";
+import { log, toIdentifierWithOptions } from "@dbx-tools/shared-core";
 import type { BunPlugin } from "bun";
 import stdLibBrowser from "node-stdlib-browser";
 import ts from "typescript";
@@ -949,7 +949,7 @@ export async function main(args: string[] = process.argv.slice(2)): Promise<void
   function pythonObjectName(type: ts.Type, path: string, suffix: string): string {
     const name = type.aliasSymbol?.getName() ?? type.getSymbol()?.getName();
     if (name && name !== "__type") return name;
-    const identifier = stringUtils.toIdentifierWithOptions({ delimiter: "_" }, path);
+    const identifier = toIdentifierWithOptions({ delimiter: "_" }, path);
     return `${identifier
       .split("_")
       .filter(Boolean)

package/tasks/python-registry.ts

@@ -2,7 +2,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { net, stringUtils } from "@dbx-tools/shared-core";
+import { isLoopbackHost, parseList } from "@dbx-tools/shared-core";
 import { parse } from "smol-toml";
 import { captureTaskCommand } from "../src/_task-command.ts";
 
@@ -97,7 +97,7 @@ export function devpiRegistry(index: string): LocalPythonRegistry | undefined {
   } catch {
     return undefined;
   }
-  if (!net.isLoopbackHost(url)) return undefined;
+  if (!isLoopbackHost(url)) return undefined;
 
   // A globally-configured publish-url wins: it names the deploy target directly,
   // so we honor it even if the index URL isn't the conventional `+simple` shape.
@@ -147,8 +147,8 @@ export function activePythonIndexes(): string[] {
   // uv: env vars first (primary, then extras), then uv.toml's index blocks.
   add(process.env.UV_DEFAULT_INDEX);
   add(process.env.UV_INDEX_URL);
-  for (const url of stringUtils.parseList(process.env.UV_INDEX)) add(url);
-  for (const url of stringUtils.parseList(process.env.UV_EXTRA_INDEX_URL)) add(url);
+  for (const url of parseList(process.env.UV_INDEX)) add(url);
+  for (const url of parseList(process.env.UV_EXTRA_INDEX_URL)) add(url);
   const uvConfig = process.env.UV_CONFIG_FILE ?? resolve(homedir(), ".config/uv/uv.toml");
   if (existsSync(uvConfig)) {
     for (const url of parseUvIndexes(readFileSync(uvConfig, "utf8"))) add(url);
@@ -156,9 +156,9 @@ export function activePythonIndexes(): string[] {
 
   // pip: env vars (primary + extras), then `pip config` (index-url + extra-index-url).
   add(process.env.PIP_INDEX_URL);
-  for (const url of stringUtils.parseList(process.env.PIP_EXTRA_INDEX_URL)) add(url);
+  for (const url of parseList(process.env.PIP_EXTRA_INDEX_URL)) add(url);
   add(pipConfig("global.index-url"));
-  for (const url of stringUtils.parseList(pipConfig("global.extra-index-url"))) add(url);
+  for (const url of parseList(pipConfig("global.extra-index-url"))) add(url);
 
   return out;
 }

package/tasks/python-sync.ts

@@ -20,8 +20,7 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import * as exec from "@dbx-tools/core/exec";
-import { withFileLock } from "@dbx-tools/core/file-lock";
+import { spawnSync, withFileLock } from "@dbx-tools/core";
 import { parse } from "smol-toml";
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
@@ -253,7 +252,7 @@ function localizeImports(
     ? segments.join(".")
     : "";
   // Captured stderr carries the localizer's reason into the thrown error.
-  const { stdout } = exec.spawnSync(
+  const { stdout } = spawnSync(
     "uv",
     [
       "run",