@dbx-tools/projen 0.9.154 → 0.9.157

package/src/bun-app.ts

@@ -22,7 +22,7 @@
  * `src/`), they are outside the package's `tsconfig` include, so their `Bun.*`
  * usage never trips the `app` package's DOM-only `compile`.
  */
-import { stringUtils } from "@dbx-tools/shared-core";
+import { dedentLines } from "@dbx-tools/shared-core";
 import { type Project, TextFile } from "projen";
 import { header, headerLines } from "./generated.ts";
 
@@ -35,6 +35,17 @@ export const BUN_APP_OVERRIDES = [BUN_DEV_OVERRIDE, BUN_BUILD_OVERRIDE];
 const PROJEN_HEADER = { tool: "projen", source: ".projenrc.ts" } as const;
 const PROJEN_TS_HEADER = header(PROJEN_HEADER).trimEnd().replaceAll("\n", "\n      ");
 
+/** Paths owned by a generated Bun browser build. */
+export interface BunBuildFileOptions {
+  readonly entrypoint?: string;
+  readonly outdir?: string;
+  readonly publicDir?: string;
+  /** Root resolved by the conventional `@/` source import alias. */
+  readonly sourceRoot?: string;
+  /** TypeScript configuration used by Bun for path aliases and JSX settings. */
+  readonly tsconfig?: string;
+}
+
 /**
  * Root `bunfig.toml`: pin bun's HOISTED linker workspace-wide.
  *
@@ -126,14 +137,17 @@ export class BunDevServerFile extends TextFile {
     super(project, "dev.ts", {
       marker: true,
       readonly: true,
-      lines: stringUtils.dedentLines(source, { trimEnd: false }),
+      lines: dedentLines(source, { trimEnd: false }),
     });
   }
 }
 
 /** `build.ts`: a `Bun.build()` production bundle (Tailwind via the plugin API). */
 export class BunBuildFile extends TextFile {
-  constructor(project: Project) {
+  constructor(project: Project, options: BunBuildFileOptions = {}) {
+    const entrypoint = options.entrypoint ?? "index.html";
+    const outdir = options.outdir ?? "dist";
+    const publicDir = options.publicDir ?? "public";
     // Raw template preserves backslashes in generated regular expression literals.
     // prettier-ignore
     const source = (
@@ -143,21 +157,51 @@ export class BunBuildFile extends TextFile {
       ${PROJEN_TS_HEADER}
       import { existsSync } from "node:fs";
       import { cp, rm } from "node:fs/promises";
-      import { basename } from "node:path";
+      import { createRequire } from "node:module";
+      import { basename${options.sourceRoot ? ", resolve" : ""} } from "node:path";
+      import type { BunPlugin } from "bun";
       import tailwind from "bun-plugin-tailwind";
 
+      const require = createRequire(import.meta.url);
+      const reactEntries = new Map(
+        ["react", "react/jsx-runtime", "react/jsx-dev-runtime", "react-dom", "react-dom/client"].map(
+          (specifier) => [specifier, require.resolve(specifier)],
+        ),
+      );
+      const dedupeReact: BunPlugin = {
+        name: "dedupe-react",
+        setup(build) {
+          build.onResolve({ filter: /^react(?:-dom)?(?:\/.*)?$/ }, ({ path }) => {
+            const resolved = reactEntries.get(path);
+            return resolved ? { path: resolved } : undefined;
+          });
+        },
+      };
+${options.sourceRoot ? /*ts*/ `
+      const sourceRoot = resolve(import.meta.dirname, ${JSON.stringify(options.sourceRoot)});
+      const sourceAlias: BunPlugin = {
+        name: "source-alias",
+        setup(build) {
+          build.onResolve({ filter: new RegExp("^@/") }, ({ path }) => ({
+            path: Bun.resolveSync(\`./\${path.slice(2)}\`, sourceRoot),
+          }));
+        },
+      };
+` : ""}
+
       // Unmanaged override (${BUN_BUILD_OVERRIDE}): its default export is merged over
       // the generated build options - later wins.
       let options: Bun.BuildConfig = {
-        entrypoints: ["./index.html"],
-        outdir: "./dist",
+        entrypoints: [${JSON.stringify(entrypoint)}],
+        outdir: ${JSON.stringify(outdir)},
         define: { "process.env.NODE_ENV": JSON.stringify("production") },
         minify: true,
         splitting: true,
         publicPath: "/",
         external: ["/fonts/*"],
         sourcemap: "none",
-        plugins: [tailwind],
+        plugins: [tailwind, dedupeReact${options.sourceRoot ? ", sourceAlias" : ""}],
+${options.tsconfig ? `        tsconfig: ${JSON.stringify(options.tsconfig)},` : ""}
       };
 
       const overrideUrl = new URL("./${BUN_BUILD_OVERRIDE}", import.meta.url);
@@ -167,7 +211,7 @@ export class BunBuildFile extends TextFile {
         options = { ...options, ...override, plugins: [...(options.plugins ?? []), ...(override.plugins ?? [])] };
       }
 
-      const outdir = options.outdir ?? "./dist";
+      const outdir = options.outdir ?? ${JSON.stringify(outdir)};
       await rm(outdir, { recursive: true, force: true });
 
       const result = await Bun.build(options);
@@ -195,7 +239,7 @@ export class BunBuildFile extends TextFile {
         await Bun.write(htmlOut.path, html);
       }
 
-      const publicDir = "./public";
+      const publicDir = ${JSON.stringify(publicDir)};
       if (existsSync(publicDir)) {
         await cp(publicDir, outdir, { recursive: true });
       }
@@ -207,7 +251,7 @@ export class BunBuildFile extends TextFile {
     super(project, "build.ts", {
       marker: true,
       readonly: true,
-      lines: stringUtils.dedentLines(source, { trimEnd: false }),
+      lines: dedentLines(source, { trimEnd: false }),
     });
   }
 }

package/src/clean.ts

@@ -19,8 +19,8 @@
  */
 import { existsSync, readFileSync, rmSync, statSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
-import { find } from "@dbx-tools/path";
-import { json } from "@dbx-tools/shared-core";
+import { findFiles } from "@dbx-tools/path";
+import { parseRecord } from "@dbx-tools/shared-core";
 import { isGenerated, makeWritable } from "./generated.ts";
 import { resolveRepoRoot, toPosix } from "./packages.ts";
 
@@ -39,11 +39,11 @@ const CLEAN_SKIP_FILES: ReadonlySet<string> = new Set([".gitignore"]);
  */
 async function nativeGeneratedFiles(root: string): Promise<string[]> {
   const files = new Set<string>();
-  for await (const manifestPath of find.findFiles("**/.projen/files.json", {
+  for await (const manifestPath of findFiles("**/.projen/files.json", {
     cwd: root,
     ignoreOptions: { dot: false },
   })) {
-    const manifest = json.parseRecord(readFileSync(resolve(root, manifestPath), "utf8"));
+    const manifest = parseRecord(readFileSync(resolve(root, manifestPath), "utf8"));
     const projectRoot = dirname(dirname(resolve(root, manifestPath)));
     const entries = manifest?.files;
     if (!Array.isArray(entries)) continue;
@@ -57,7 +57,7 @@ async function nativeGeneratedFiles(root: string): Promise<string[]> {
 export async function listGeneratedFiles(root: string = resolveRepoRoot()): Promise<string[]> {
   const rel = (f: string): string => toPosix(relative(root, f));
   const custom: string[] = [];
-  for await (const file of find.findFiles("**/*", { cwd: root })) {
+  for await (const file of findFiles("**/*", { cwd: root })) {
     const absolute = join(root, file);
     if (isGenerated(absolute)) custom.push(absolute);
   }
@@ -85,7 +85,7 @@ export async function listNodeModulesDirs(root: string = resolveRepoRoot()): Pro
   if (!existsSync(root)) return [];
   const rel = (f: string): string => toPosix(relative(root, f));
   const directories: string[] = [];
-  for await (const match of find.findFiles("**/node_modules", {
+  for await (const match of findFiles("**/node_modules", {
     cwd: root,
     ignoreOptions: { dot: false },
   })) {

package/src/engine-root.ts

@@ -6,8 +6,8 @@
  */
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import * as projectUtils from "@dbx-tools/core/project-utils";
-import { functionUtils } from "@dbx-tools/shared-core";
+import { root } from "@dbx-tools/core";
+import { memoize } from "@dbx-tools/shared-core";
 
 const ENGINE_PKG = "@dbx-tools/projen";
 
@@ -20,8 +20,8 @@ const ENGINE_PKG = "@dbx-tools/projen";
  * {@link functionUtils.memoize}, which caches only a successful result - a
  * throw is retried on the next call.
  */
-export const resolvePkgRoot = functionUtils.memoize((): string => {
-  const found = projectUtils.root(dirname(fileURLToPath(import.meta.url)));
+export const resolvePkgRoot = memoize((): string => {
+  const found = root(dirname(fileURLToPath(import.meta.url)));
   if (!found) throw new Error(`${ENGINE_PKG} package root not found`);
   return found;
 });

package/src/mixin.ts

@@ -9,8 +9,6 @@
 import type { Predicate } from "@dbx-tools/shared-core";
 import type { IConstruct, IMixin as ConstructsMixin } from "constructs";
 
-export type { ConstructsMixin };
-
 /**
  * Builds a {@link ConstructsMixin} from `supports` and `applyTo` callbacks.
  *

package/src/module-exports.ts

@@ -86,13 +86,12 @@ const FUNCTION_DECLARATIONS = new Set(["FunctionDeclaration", "TSDeclareFunction
 export function moduleExports(file: string): ModuleExport[] {
   const body = moduleStatements(file);
 
-  // Dedupe within the module: an overloaded `export function f(...)` declares
-  // `f` once per signature, but it's a single exported name. First occurrence
-  // wins (a value declaration and a same-named type would be unusual and are
-  // collapsed to whichever appears first).
+  // Dedupe within the module. When TypeScript merges a type and value with the
+  // same name, the value export carries both namespaces and must win.
   const byName = new Map<string, ModuleExport>();
   const push = (e: ModuleExport): void => {
-    if (!byName.has(e.name)) byName.set(e.name, e);
+    const existing = byName.get(e.name);
+    if (!existing || (existing.isType && !e.isType)) byName.set(e.name, e);
   };
   for (const stmt of body) {
     if (stmt.type !== "ExportNamedDeclaration") continue;

package/src/npm-packaging.ts

@@ -0,0 +1,128 @@
+/** Side-effect-free npm archive packing helpers. */
+import {
+  chmodSync,
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { spawnSync, root } from "@dbx-tools/core";
+
+import type { NpmArchiveManifest } from "./npm-release.ts";
+import { materializeWorkspaceManifest } from "./workspace-manifest.ts";
+
+/** Transform applied to a packed npm manifest before archive verification. */
+export type NpmArchiveManifestTransform = (
+  manifest: NpmArchiveManifest,
+) => Readonly<Record<string, unknown>>;
+
+const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const;
+
+/** Fold compiled publish entry points onto an archive manifest. */
+export function applyPublishConfig(
+  source: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  const manifest = { ...source };
+  const publishConfig = manifest.publishConfig as Record<string, unknown> | undefined;
+  if (!publishConfig) return manifest;
+  for (const field of PUBLISH_CONFIG_ENTRY_FIELDS) {
+    if (field in publishConfig) manifest[field] = publishConfig[field];
+  }
+  return manifest;
+}
+
+function archiveFileEntries(directory: string, prefix = ""): string[] {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+    return entry.isDirectory()
+      ? archiveFileEntries(join(directory, entry.name), relativePath)
+      : [relativePath];
+  });
+}
+
+/** Pack one workspace package and optionally transform only its archived manifest. */
+export function packNpmPackage(
+  directory: string,
+  destination: string,
+  path = process.env.PATH ?? "",
+  transformManifest?: NpmArchiveManifestTransform,
+): string {
+  const executable = process.versions.bun ? process.execPath : "bun";
+  const manifest = join(directory, "package.json");
+  const originalManifest = readFileSync(manifest, "utf8");
+  const workspaceRoot = root(directory) ?? directory;
+  const workspaceManifest = JSON.parse(
+    readFileSync(join(workspaceRoot, "package.json"), "utf8"),
+  ) as Record<string, unknown>;
+  const packedManifest = `${JSON.stringify(
+    materializeWorkspaceManifest(
+      JSON.parse(originalManifest) as Record<string, unknown>,
+      workspaceManifest,
+    ),
+    null,
+    2,
+  )}\n`;
+  const manifestMode = lstatSync(manifest).mode & 0o777;
+  const restoreManifestMode = (manifestMode & 0o200) === 0;
+  const existingArchives = new Set(readdirSync(destination));
+  if (restoreManifestMode) chmodSync(manifest, manifestMode | 0o200);
+  try {
+    writeFileSync(manifest, packedManifest);
+    spawnSync(
+      executable,
+      ["pm", "pack", "--destination", destination, "--ignore-scripts", "--quiet"],
+      {
+        cwd: directory,
+        env: { ...process.env, PATH: path },
+        stdout: "inherit",
+        stderr: "inherit",
+        stdin: "ignore",
+        check: true,
+      },
+    );
+  } finally {
+    writeFileSync(manifest, originalManifest);
+    if (restoreManifestMode) chmodSync(manifest, manifestMode);
+  }
+  const archives = readdirSync(destination).filter(
+    (file) => file.endsWith(".tgz") && !existingArchives.has(file),
+  );
+  if (archives.length !== 1) {
+    throw new Error(`Expected one packed npm archive, found ${archives.length}`);
+  }
+  const archive = join(destination, archives[0]!);
+  if (!transformManifest) return archive;
+
+  const temp = mkdtempSync(join(tmpdir(), "projen-npm-project-"));
+  try {
+    spawnSync("tar", ["-xzf", archive, "-C", temp], {
+      cwd: process.cwd(),
+      stdout: "ignore",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    });
+    const manifestPath = join(temp, "package", "package.json");
+    const archivedManifest = JSON.parse(readFileSync(manifestPath, "utf8")) as NpmArchiveManifest;
+    writeFileSync(
+      manifestPath,
+      `${JSON.stringify(transformManifest(archivedManifest), null, 2)}\n`,
+    );
+    rmSync(archive, { force: true });
+    spawnSync("tar", ["-czf", archive, "-C", temp, ...archiveFileEntries(temp)], {
+      cwd: process.cwd(),
+      stdout: "ignore",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    });
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+  return archive;
+}

package/src/npm-release.ts

@@ -0,0 +1,200 @@
+/** Side-effect-free npm release identity and public registry helpers. */
+import { createHash } from "node:crypto";
+import {
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import { spawnSync } from "@dbx-tools/core";
+import { PUBLIC_NPM_REGISTRY_URL } from "./release-context.ts";
+
+/** Registry and archive identity used to verify idempotent npm publication. */
+export interface NpmReleaseIdentity {
+  readonly access?: "public" | "restricted";
+  readonly contentDigest?: string;
+  readonly integrity?: string;
+  readonly name: string;
+  readonly repository?: unknown;
+  readonly version: string;
+}
+
+/** npm package fields read directly from one release archive. */
+export interface NpmArchiveManifest {
+  readonly [key: string]: unknown;
+  readonly dependencies?: Readonly<Record<string, string>>;
+  readonly optionalDependencies?: Readonly<Record<string, string>>;
+  readonly name?: string;
+  readonly publishConfig?: { readonly access?: unknown };
+  readonly repository?: unknown;
+  readonly version?: string;
+}
+
+/** Verify that registry metadata represents the exact locally packed release. */
+export function npmReleaseMatches(
+  local: NpmReleaseIdentity,
+  published: NpmReleaseIdentity | undefined,
+): boolean {
+  if (!published) return false;
+  if (published.name !== local.name || published.version !== local.version) {
+    throw new Error(`Published npm identity does not match ${local.name}@${local.version}`);
+  }
+  const localRepository = normalizedRepository(local.repository);
+  const publishedRepository = normalizedRepository(published.repository);
+  if (localRepository && publishedRepository && localRepository !== publishedRepository) {
+    throw new Error(`Published npm repository does not match ${local.name}@${local.version}`);
+  }
+  if (
+    local.contentDigest &&
+    published.contentDigest &&
+    local.contentDigest !== published.contentDigest
+  ) {
+    throw new Error(`Published npm content does not match ${local.name}@${local.version}`);
+  }
+  if (
+    !(local.contentDigest && published.contentDigest) &&
+    local.integrity &&
+    published.integrity !== local.integrity
+  ) {
+    throw new Error(`Published npm integrity does not match ${local.name}@${local.version}`);
+  }
+  return true;
+}
+
+/** Read one published npm release identity, or `undefined` when it is absent. */
+export async function publishedNpmRelease(
+  name: string,
+  version: string,
+  registry = process.env.NPM_CONFIG_REGISTRY ?? PUBLIC_NPM_REGISTRY_URL,
+  signal?: AbortSignal,
+): Promise<NpmReleaseIdentity | undefined> {
+  const response = await fetch(registryUrl(registry, name, version), {
+    headers: { accept: "application/json" },
+    signal,
+  });
+  if (response.status === 404) return undefined;
+  if (!response.ok) {
+    throw new Error(`npm registry lookup failed for ${name}@${version}: ${response.status}`);
+  }
+  const metadata = (await response.json()) as {
+    dist?: { integrity?: string; tarball?: string };
+    name?: string;
+    repository?: unknown;
+    version?: string;
+  };
+  if (!metadata.name || !metadata.version) {
+    throw new Error(`npm registry returned an incomplete identity for ${name}@${version}`);
+  }
+  let contentDigest: string | undefined;
+  if (metadata.dist?.tarball) {
+    const archive = await fetch(metadata.dist.tarball, { signal });
+    if (!archive.ok) {
+      throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
+    }
+    const temp = mkdtempSync(join(tmpdir(), "projen-published-npm-"));
+    const path = join(temp, "package.tgz");
+    try {
+      writeFileSync(path, Buffer.from(await archive.arrayBuffer()));
+      contentDigest = npmArchiveContentDigest(path);
+    } finally {
+      rmSync(temp, { recursive: true, force: true });
+    }
+  }
+  return {
+    ...(contentDigest ? { contentDigest } : {}),
+    integrity: metadata.dist?.integrity,
+    name: metadata.name,
+    repository: metadata.repository,
+    version: metadata.version,
+  };
+}
+
+/** Read one npm package manifest directly from its archive. */
+export function readNpmArchiveManifest(path: string): NpmArchiveManifest {
+  const result = spawnSync("tar", ["-xOf", path, "package/package.json"], {
+    cwd: process.cwd(),
+    stdout: "capture",
+    stderr: "capture",
+    stdin: "ignore",
+    check: false,
+  });
+  if (result.exitCode !== 0 || !result.stdout) {
+    throw new Error(`Cannot read npm package manifest from ${path}: ${result.stderr}`);
+  }
+  return JSON.parse(result.stdout) as NpmArchiveManifest;
+}
+
+/** Read and hash the release identity embedded in an npm archive. */
+export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
+  const manifest = readNpmArchiveManifest(path);
+  if (!manifest.name || !manifest.version) {
+    throw new Error(`npm archive has no package name or version: ${path}`);
+  }
+  const access = manifest.publishConfig?.access;
+  if (access !== undefined && access !== "public" && access !== "restricted") {
+    throw new Error(`npm archive has invalid publishConfig.access: ${String(access)}`);
+  }
+  return {
+    ...(access ? { access } : {}),
+    contentDigest: npmArchiveContentDigest(path),
+    integrity: `sha512-${createHash("sha512").update(readFileSync(path)).digest("base64")}`,
+    name: manifest.name,
+    repository: manifest.repository,
+    version: manifest.version,
+  };
+}
+
+/** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
+export function npmArchiveContentDigest(path: string): string {
+  const temp = mkdtempSync(join(tmpdir(), "projen-npm-content-"));
+  try {
+    spawnSync("tar", ["-xzf", path, "-C", temp], {
+      cwd: process.cwd(),
+      stdout: "ignore",
+      stderr: "capture",
+      stdin: "ignore",
+      check: true,
+    });
+    const hash = createHash("sha512");
+    const visit = (directory: string): void => {
+      for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) =>
+        a.name.localeCompare(b.name),
+      )) {
+        const entryPath = join(directory, entry.name);
+        const name = relative(temp, entryPath).split("\\").join("/");
+        const stat = lstatSync(entryPath);
+        hash.update(`${entry.isDirectory() ? "D" : entry.isSymbolicLink() ? "L" : "F"}\0`);
+        hash.update(`${name}\0${stat.mode & 0o111}\0`);
+        if (entry.isDirectory()) visit(entryPath);
+        else if (entry.isSymbolicLink()) hash.update(readlinkSync(entryPath));
+        else hash.update(readFileSync(entryPath));
+      }
+    };
+    visit(temp);
+    return `sha512-${hash.digest("base64")}`;
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+function normalizedRepository(value: unknown): string | undefined {
+  const url =
+    typeof value === "string"
+      ? value
+      : value && typeof value === "object" && "url" in value
+        ? String(value.url)
+        : undefined;
+  return url
+    ?.replace(/^git\+/, "")
+    .replace(/\.git$/, "")
+    .replace(/\/$/, "");
+}
+
+function registryUrl(registry: string, name: string, version: string): string {
+  return `${registry.replace(/\/$/, "")}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
+}

package/src/packages.ts

@@ -25,9 +25,9 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { extname, relative, resolve, sep } from "node:path";
-import * as projectUtils from "@dbx-tools/core/project-utils";
-import { find } from "@dbx-tools/path";
-import { json, object, stringUtils } from "@dbx-tools/shared-core";
+import { projectUtils } from "@dbx-tools/core";
+import { findFilesSync } from "@dbx-tools/path";
+import { parseRecord, isRecord, toSlug, parseList } from "@dbx-tools/shared-core";
 import { parse } from "yaml";
 import { DBXToolsConfigDataSchema, type DBXToolsConfigData } from "./dbx-tools-config.ts";
 import { isGenerated } from "./generated.ts";
@@ -77,7 +77,7 @@ function nestingTagsFromSegments(segments: readonly string[]): string[] {
   const out: string[] = [];
   let acc = "";
   for (const segment of prefix) {
-    const token = stringUtils.toSlug(segment);
+    const token = toSlug(segment);
     if (!token) continue;
     acc = acc ? `${acc}-${token}` : token;
     out.push(acc);
@@ -154,7 +154,7 @@ export class DiscoveredPackage {
    * Matched against `packageTagPaths` to resolve applied mixin tags.
    */
   get tagCandidates(): string[] {
-    const leaf = stringUtils.toSlug(this.name);
+    const leaf = toSlug(this.name);
     if (leaf === "app" || leaf === "server") return [leaf];
     return nestingTagsFromSegments(this.relSegments);
   }
@@ -189,7 +189,7 @@ function packageOfMember(projectRoot: string, member: string): DiscoveredPackage
  */
 function collectPackageDirs(rootAbs: string): string[] {
   const owners = new Set<string>();
-  for (const file of find.findFilesSync(SRC_MODULE_GLOB, { cwd: rootAbs })) {
+  for (const file of findFilesSync(SRC_MODULE_GLOB, { cwd: rootAbs })) {
     if (!isModuleFile(file)) continue;
     const segs = toPosix(file).split("/");
     const srcIdx = segs.indexOf("src");
@@ -255,7 +255,7 @@ export function readPackageManifest(dir: string): Record<string, unknown> | unde
   const path = resolve(dir, "package.json");
   if (!existsSync(path)) return undefined;
   try {
-    return json.parseRecord(readFileSync(path, "utf8"));
+    return parseRecord(readFileSync(path, "utf8"));
   } catch {
     return undefined; // unreadable (permissions, race with a concurrent write)
   }
@@ -282,13 +282,13 @@ function readManifestTags(dir: string): string[] | undefined {
  */
 export function syncResynthPaths(projectRoot: string = resolveRepoRoot()): string[] {
   const paths = readDbxToolsConfig(projectRoot)?.syncResynthPaths;
-  return Array.isArray(paths) ? stringUtils.parseList(paths.map((p) => String(p))) : [];
+  return Array.isArray(paths) ? parseList(paths.map((p) => String(p))) : [];
 }
 
 /** Projen task names supervised as focused processes by `sync --watch`. */
 export function syncWatchTasks(projectRoot: string = resolveRepoRoot()): string[] {
   const tasks = readDbxToolsConfig(projectRoot)?.syncWatchTasks;
-  return Array.isArray(tasks) ? stringUtils.parseList(tasks.map((task) => String(task))) : [];
+  return Array.isArray(tasks) ? parseList(tasks.map((task) => String(task))) : [];
 }
 
 /**
@@ -338,7 +338,7 @@ export function workspaceDependencyDirectories(
     directories.add(pkg.dir);
     for (const field of ["dependencies", "optionalDependencies", "peerDependencies"] as const) {
       const dependencies = pkg.manifest[field];
-      if (!object.isRecord(dependencies)) continue;
+      if (!isRecord(dependencies)) continue;
       for (const dependency of Object.keys(dependencies)) visit(dependency);
     }
   };
@@ -354,7 +354,7 @@ export function workspaceDependencyDirectories(
 export function recordedRoots(projectRoot: string = resolveRepoRoot()): string[] {
   const configured = readDbxToolsConfig(projectRoot)?.packageRoots;
   const configuredRoots = Array.isArray(configured)
-    ? stringUtils.parseList(configured.map((root) => String(root)))
+    ? parseList(configured.map((root) => String(root)))
     : [];
   const roots = new Set<string>(configuredRoots.length ? configuredRoots : DEFAULT_PACKAGE_ROOTS);
   for (const member of readRecordedMembers(projectRoot)) {