@dbx-tools/projen 0.9.158 → 0.9.161

package/README.md

@@ -340,9 +340,12 @@ to `appkit:deploy` unless the repository already owns `deploy`. The AppKit task
 runs `databricks apps deploy --skip-validation` with all forwarded arguments
 from an isolated source snapshot, so the Databricks CLI never runs npm locally.
 Because the remote builder selects npm when no portable pnpm lockfile is
-uploaded, the snapshot replaces `catalog:` and `workspace:` dependency protocols
-with concrete versions and keeps every manifest stable through upload. The
-generated working tree is never modified. The task passes an explicit profile,
+uploaded, the snapshot replaces `catalog:` protocols with concrete versions.
+When the application uses `workspace:` dependencies, the task packs their
+transitive runtime workspace closure and links those archives from the staged
+application, so deployment does not wait for a matching public release. Every
+source manifest stays stable through upload and the generated working tree is
+never modified. The task passes an explicit profile,
 using the supplied flag or resolving one through `@dbx-tools/auth`, and fails
 before staging when neither profile nor complete environment credentials are
 available. It validates the bundle strictly, removes only stale direct-engine
@@ -574,9 +577,10 @@ the current branch is pushed first. A non-`main` branch then fast-forwards
 diverged. From `main`, it calls the existing `bump` task, commits the generated
 version changes, pushes `main`, and pushes the matching annotated `vX.Y.Z` tag.
 Pass `--no-bump` only to release an existing synchronized local bump. The tag
-workflow verifies that the tag points at the exact `origin/main` commit. The
-local task completes local publication and demo deployment first, then waits for
-this workflow by default. It prints the initial job and step state, then only
+workflow verifies that the tag points at the exact `origin/main` commit. A newer
+tag cancels the previous release run, including leftover publish, wait, and docs
+jobs. The local task completes local publication and demo deployment first, then
+waits for this workflow by default. It prints the initial job and step state, then only
 append-only status changes, without annotations. Successful runs omit full logs;
 unsuccessful runs print failed-step logs only. Local-only releases and
 repositories without a resolved authenticated GitHub account skip the watcher.
@@ -590,8 +594,10 @@ site. Install validation prerequisites through `releaseSetupSteps`.
 Publication jobs download the resulting artifacts rather than rebuilding the
 workspace. Each Python package retains its own publishing environment and waits
 for its package dependencies to publish. The npm job uses the bundled archive
-publisher without a checkout or workspace install. After all selected public
-publishers finish, one verifier downloads the complete release artifact set and
+publisher without a checkout or workspace install. If npm reports that a version
+is already staged, that publisher waits for the public artifact instead of
+publishing the version again. After all selected public publishers finish, one
+verifier downloads the complete release artifact set and
 polls only unresolved packages concurrently. It validates npm tarball contents
 and PyPI distribution hashes before Pages deploys the already built site. Local
 npm and Python registry publication remains available through the direct local

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.158";
+export const PACKAGE_VERSION = "0.9.161";
 export * as appkitWorkspace from "./src/appkit-workspace.ts";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
@@ -41,6 +41,7 @@ export * as vscode from "./src/vscode.ts";
 export * as watch from "./src/watch.ts";
 export * as workspaceLock from "./src/workspace-lock.ts";
 export * as workspaceManifest from "./src/workspace-manifest.ts";
+export * as workspaceVendor from "./src/workspace-vendor.ts";
 export * as workspaceVersion from "./src/workspace-version.ts";
 export { isAppKitApplication, AppKitWorkspace } from "./src/appkit-workspace.ts";
 export type { AppKitWorkspaceMode, AppKitBundleOptions, AppKitWorkspaceOptions } from "./src/appkit-workspace.ts";
@@ -61,8 +62,8 @@ export { moduleStatements, moduleExports, publicFunctionExports, publicNamespace
 export type { ModuleStatement, ModuleExport, PublicFunctionExport } from "./src/module-exports.ts";
 export { applyPublishConfig, packNpmPackage } from "./src/npm-packaging.ts";
 export type { NpmArchiveManifestTransform } from "./src/npm-packaging.ts";
-export { npmReleaseMatches, publishedNpmRelease, readNpmArchiveManifest, readNpmArchiveIdentity, npmArchiveContentDigest } from "./src/npm-release.ts";
-export type { NpmReleaseIdentity, NpmArchiveManifest } from "./src/npm-release.ts";
+export { npmReleaseMatches, publishedNpmRelease, isNpmStagedVersionConflict, waitForMatchingNpmRelease, publishNpmArchive, readNpmArchiveManifest, readNpmArchiveIdentity, npmArchiveContentDigest } from "./src/npm-release.ts";
+export type { NpmReleaseIdentity, NpmArchiveManifest, NpmPublishOutcome } from "./src/npm-release.ts";
 export { resolveRepoRoot, repoRoot, DEFAULT_PACKAGE_ROOTS, projectName, toPosix, isGeneratedFile, isModuleFile, DiscoveredPackage, scanPackages, readPackageManifest, readDbxToolsConfig, syncResynthPaths, syncWatchTasks, recordedPackages, workspaceDependencyDirectories, recordedRoots } from "./src/packages.ts";
 export type { RecordedPackage } from "./src/packages.ts";
 export { PnpmWorkspaceState } from "./src/pnpm-workspace.ts";
@@ -84,7 +85,7 @@ export { PYTHON_NODE_RUNTIME_DISTRIBUTION, PYTHON_NODE_RUNTIME_MODULE, PYTHON_NO
 export type { PythonNodeRuntimeOptions } from "./src/python-node-runtime.ts";
 export { pythonDistributionPaths, publishPythonProjects, buildPythonProjects } from "./src/python-packaging.ts";
 export { pythonProjectInfo, preparePythonProjectForPublication } from "./src/python-release.ts";
-export { RELEASE_VERSION, RELEASE_WORKFLOW_FILE, PUBLIC_NPM_REGISTRY_URL, PUBLIC_PYPI_REGISTRY_URL } from "./src/release-context.ts";
+export { RELEASE_VERSION, RELEASE_WORKFLOW_FILE, PUBLIC_NPM_REGISTRY_URL, PUBLIC_PYPI_REGISTRY_URL, PUBLICATION_WAIT_TIMEOUT_SECONDS, PUBLICATION_WAIT_INTERVAL_SECONDS } from "./src/release-context.ts";
 export { RELEASE_PUBLISH_TARGETS, RELEASE_INSTALL_MODES, ReleaseStepSelectionSchema, releaseStepSelection, releaseTagAnnotation, parseReleaseTagAnnotation, releasePublishesLocally } from "./src/release-options.ts";
 export type { ReleasePublishTarget, ReleaseInstallMode, ReleaseStepSelection, ReleaseSelectionOptions } from "./src/release-options.ts";
 export { tryReleaseWorkflow, releaseTagPattern, releaseCondition, releaseBuildSteps, nodeReleaseSetupSteps, uvSetupStep, refreshReleaseDocsDependencies, refreshPublicationVerification, DBXToolsRelease } from "./src/release.ts";
@@ -100,7 +101,9 @@ export { configureVsCode } from "./src/vscode.ts";
 export { watchRoots, watchLoop } from "./src/watch.ts";
 export type { IgnoreGroupOptions, WatchLoopOptions } from "./src/watch.ts";
 export { withWorkspaceMutationLock } from "./src/workspace-lock.ts";
-export type { WorkspaceMutationLockOptions } from "./src/workspace-lock.ts";
+export type { WorkspaceMutationLockTimer, WorkspaceMutationLockScheduler, WorkspaceMutationLockOptions } from "./src/workspace-lock.ts";
 export { materializeWorkspaceManifest, withMaterializedWorkspaceManifests, withStagedWorkspaceManifests } from "./src/workspace-manifest.ts";
+export { vendorWorkspaceDependencies } from "./src/workspace-vendor.ts";
+export type { VendoredWorkspaceDependencies } from "./src/workspace-vendor.ts";
 export { VERSION_FILE, DEFAULT_VERSION, parseSemver, compareSemver, incrementSemver, versionPath, readWorkspaceVersion, writeWorkspaceVersion, syncWorkspaceManifestVersion, resolveNextVersion } from "./src/workspace-version.ts";
 export type { Semver, VersionLevel } from "./src/workspace-version.ts";

package/package.json

@@ -30,11 +30,11 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/auth": "^0.9.158",
-    "@dbx-tools/cli-args": "^0.9.158",
-    "@dbx-tools/core": "^0.9.158",
-    "@dbx-tools/path": "^0.9.158",
-    "@dbx-tools/shared-core": "^0.9.158",
+    "@dbx-tools/auth": "^0.9.161",
+    "@dbx-tools/cli-args": "^0.9.161",
+    "@dbx-tools/core": "^0.9.161",
+    "@dbx-tools/path": "^0.9.161",
+    "@dbx-tools/shared-core": "^0.9.161",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -56,7 +56,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.158",
+  "version": "0.9.161",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/npm-release.ts

@@ -11,8 +11,15 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, relative } from "node:path";
-import { spawnSync } from "@dbx-tools/core";
-import { PUBLIC_NPM_REGISTRY_URL } from "./release-context.ts";
+import { spawn, spawnSync } from "@dbx-tools/core";
+import { log, poll, toError } from "@dbx-tools/shared-core";
+import {
+  PUBLIC_NPM_REGISTRY_URL,
+  PUBLICATION_WAIT_INTERVAL_SECONDS,
+  PUBLICATION_WAIT_TIMEOUT_SECONDS,
+} from "./release-context.ts";
+
+const logger = log.logger("projen:npm-release");
 
 /** Registry and archive identity used to verify idempotent npm publication. */
 export interface NpmReleaseIdentity {
@@ -72,6 +79,7 @@ export async function publishedNpmRelease(
   version: string,
   registry = process.env.NPM_CONFIG_REGISTRY ?? PUBLIC_NPM_REGISTRY_URL,
   signal?: AbortSignal,
+  options: { readonly content?: boolean } = {},
 ): Promise<NpmReleaseIdentity | undefined> {
   const response = await fetch(registryUrl(registry, name, version), {
     headers: { accept: "application/json" },
@@ -91,7 +99,7 @@ export async function publishedNpmRelease(
     throw new Error(`npm registry returned an incomplete identity for ${name}@${version}`);
   }
   let contentDigest: string | undefined;
-  if (metadata.dist?.tarball) {
+  if (options.content !== false && metadata.dist?.tarball) {
     const archive = await fetch(metadata.dist.tarball, { signal });
     if (!archive.ok) {
       throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
@@ -114,6 +122,106 @@ export async function publishedNpmRelease(
   };
 }
 
+/** Whether npm refused a retry because it already accepted this version for staging. */
+export function isNpmStagedVersionConflict(error: unknown): boolean {
+  const message = toError(error).message;
+  return /409\b/.test(message) && /previously staged version/i.test(message);
+}
+
+/** Wait until the public registry serves the exact local npm archive. */
+export async function waitForMatchingNpmRelease(
+  local: NpmReleaseIdentity,
+  registry?: string,
+  options: { readonly intervalMs?: number; readonly timeoutMs?: number } = {},
+): Promise<void> {
+  const selectedRegistry = registry ?? process.env.NPM_CONFIG_REGISTRY ?? PUBLIC_NPM_REGISTRY_URL;
+  try {
+    for await (const _available of poll(
+      async ({ signal }) => {
+        const published = await publishedNpmRelease(
+          local.name,
+          local.version,
+          selectedRegistry,
+          signal,
+          { content: false },
+        );
+        if (!published) return false;
+        return npmReleaseMatches(
+          local,
+          await publishedNpmRelease(local.name, local.version, selectedRegistry, signal),
+        );
+      },
+      {
+        intervalMs: options.intervalMs ?? PUBLICATION_WAIT_INTERVAL_SECONDS * 1_000,
+        timeoutMs: options.timeoutMs ?? PUBLICATION_WAIT_TIMEOUT_SECONDS * 1_000,
+        predicate: (available) => !available,
+      },
+    )) {
+      void _available;
+    }
+  } catch (error) {
+    throw new Error(
+      `Staged npm version ${local.name}@${local.version} did not become available`,
+      { cause: error },
+    );
+  }
+}
+
+/** Outcome of one idempotent npm archive publication. */
+export type NpmPublishOutcome = "published" | "skipped" | "staged";
+
+/** Publish one archive, or wait when npm has already staged that exact version. */
+export async function publishNpmArchive(options: {
+  readonly archive: string;
+  readonly identity: NpmReleaseIdentity;
+  readonly cwd?: string;
+  readonly dryRun?: boolean;
+  readonly env?: NodeJS.ProcessEnv;
+  readonly intervalMs?: number;
+  readonly registry?: string;
+  readonly timeoutMs?: number;
+}): Promise<NpmPublishOutcome> {
+  const { archive, identity } = options;
+  if (!options.dryRun) {
+    const published = await publishedNpmRelease(identity.name, identity.version, options.registry);
+    if (npmReleaseMatches(identity, published)) return "skipped";
+  }
+  const result = await spawn(
+    "npm",
+    [
+      "publish",
+      archive,
+      "--ignore-scripts",
+      ...(identity.access ? ["--access", identity.access] : []),
+      ...(options.registry ? ["--registry", options.registry] : []),
+      ...(options.dryRun ? ["--dry-run"] : []),
+    ],
+    {
+      cwd: options.cwd ?? process.cwd(),
+      env: options.env,
+      stdin: "ignore",
+      stdout: "inherit",
+      stderr: "capture",
+      check: false,
+    },
+  );
+  if (result.stderr) process.stderr.write(result.stderr.endsWith("\n") ? result.stderr : `${result.stderr}\n`);
+  if (result.exitCode === 0) return "published";
+  const error = new Error(
+    `npm publish failed (exit ${result.exitCode})${result.stderr ? `: ${result.stderr}` : ""}`,
+  );
+  if (options.dryRun) throw error;
+  const published = await publishedNpmRelease(identity.name, identity.version, options.registry);
+  if (npmReleaseMatches(identity, published)) return "skipped";
+  if (!isNpmStagedVersionConflict(error)) throw error;
+  logger.info(`waiting for staged ${identity.name}@${identity.version}`);
+  await waitForMatchingNpmRelease(identity, options.registry, {
+    intervalMs: options.intervalMs,
+    timeoutMs: options.timeoutMs,
+  });
+  return "staged";
+}
+
 /** Read one npm package manifest directly from its archive. */
 export function readNpmArchiveManifest(path: string): NpmArchiveManifest {
   const result = spawnSync("tar", ["-xOf", path, "package/package.json"], {

package/src/project-js.ts

@@ -1397,7 +1397,11 @@ function initProject(
   // repairs the worktree it is meant to validate; `eslint:fix` is the explicit
   // local mutation path.
   const eslint = new javascript.Eslint(project, {
-    dirs: [...roots, ...project.extraWorkspaceMembers],
+    dirs: [
+      ...roots,
+      ...project.extraWorkspaceMembers,
+      ...(configuredAppRoot ? [configuredAppRoot] : []),
+    ],
     fileExtensions: [".ts", ".tsx"],
     projectService: true,
     prettier: Boolean(project.prettier),
@@ -1605,9 +1609,12 @@ function preSynthesizeProject(project: javascript.NodeProject): void {
   const subtree = project.node.findAll().filter(Project.isProject);
   if (project.prettier) {
     const ignorePatterns = new Set<string>();
+    const root = resolve(project.outdir);
     for (const p of subtree) {
+      const prefix = toPosix(relative(root, p.outdir));
       p.files.forEach((file) => {
-        if (file.readonly) ignorePatterns.add(file.path);
+        if (!file.readonly) return;
+        ignorePatterns.add(prefix ? `${prefix}/${file.path}` : file.path);
       });
     }
     ignorePatterns.forEach((pattern) => project.prettier!.addIgnorePattern(pattern));

package/src/release-context.ts

@@ -7,3 +7,7 @@ export const RELEASE_WORKFLOW_FILE = "release.yml";
 export const PUBLIC_NPM_REGISTRY_URL = "https://registry.npmjs.org";
 /** Public PyPI JSON API queried after Python publication completes. */
 export const PUBLIC_PYPI_REGISTRY_URL = "https://pypi.org/pypi";
+/** Shared wait for every unresolved public npm and PyPI artifact. */
+export const PUBLICATION_WAIT_TIMEOUT_SECONDS = 20 * 60;
+/** Delay between public registry probes while a release is still invisible. */
+export const PUBLICATION_WAIT_INTERVAL_SECONDS = 5;

package/src/release.ts

@@ -18,6 +18,7 @@ import { BUN_VERSION } from "./bun-workflow.ts";
 import { projectReleaseBranch, taskCommand, type DBXToolsJavaScriptProject } from "./project-js.ts";
 import {
   PUBLIC_NPM_REGISTRY_URL,
+  PUBLICATION_WAIT_TIMEOUT_SECONDS,
   RELEASE_VERSION,
   RELEASE_WORKFLOW_FILE,
 } from "./release-context.ts";
@@ -73,7 +74,7 @@ export function releaseTagPattern(project: DBXToolsJavaScriptProject): string {
 /** Run a release job after all explicit prerequisite results succeed. */
 export function releaseCondition(prerequisites: readonly string[] = []): string {
   if (prerequisites.length === 0) return "${{ success() }}";
-  return `\${{ always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} }}`;
+  return `\${{ always() && !cancelled() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} }}`;
 }
 
 /** Gate shared-build steps using the same per-run flag, preserving their existing conditions. */
@@ -171,7 +172,7 @@ export function refreshPublicationVerification(project: DBXToolsJavaScriptProjec
     needs: ["build-release", ...registryJobs],
     runsOn: ["ubuntu-latest"],
     permissions: { contents: JobPermission.READ },
-    timeoutMinutes: 15,
+    timeoutMinutes: Math.ceil(PUBLICATION_WAIT_TIMEOUT_SECONDS / 60) + 5,
     steps: [
       {
         name: "Download publication verifier",

package/src/workspace-lock.ts

@@ -7,6 +7,26 @@ const MUTATION_LOCK_SCOPE = "dbx-tools-workspace-mutation";
 const WAIT_LOG_INTERVAL_MS = 5_000;
 const logger = log.logger("projen:workspace-lock");
 
+/** Cancelable recurring task returned by a workspace-lock scheduler. */
+export interface WorkspaceMutationLockTimer {
+  cancel(): void;
+}
+
+/** Clock and recurring scheduler used by workspace-lock wait logging. */
+export interface WorkspaceMutationLockScheduler {
+  now(): number;
+  repeat(callback: () => void, intervalMs: number): WorkspaceMutationLockTimer;
+}
+
+const _systemScheduler: WorkspaceMutationLockScheduler = {
+  now: Date.now,
+  repeat(callback, intervalMs) {
+    const timer = setInterval(callback, intervalMs);
+    timer.unref?.();
+    return { cancel: () => clearInterval(timer) };
+  },
+};
+
 /** Optional preflight used before and after acquiring the workspace mutation lock. */
 export interface WorkspaceMutationLockOptions {
   /**
@@ -15,6 +35,8 @@ export interface WorkspaceMutationLockOptions {
    * without taking the critical section only to return.
    */
   check?: () => boolean | Promise<boolean>;
+  /** Scheduler override for deterministic wait-logging tests. */
+  scheduler?: WorkspaceMutationLockScheduler;
 }
 
 /**
@@ -31,10 +53,11 @@ export async function withWorkspaceMutationLock<T>(
 ): Promise<T | undefined> {
   const repository = resolve(root);
   const check = options?.check;
+  const scheduler = options?.scheduler ?? _systemScheduler;
   if (check && !(await check())) {
     return undefined;
   }
-  let waitLogTimer: ReturnType<typeof setInterval> | undefined;
+  let waitLogTimer: WorkspaceMutationLockTimer | undefined;
   try {
     return await withFileLock(
       [MUTATION_LOCK_SCOPE, repository],
@@ -48,20 +71,19 @@ export async function withWorkspaceMutationLock<T>(
         backends: process.platform === "win32" ? ["file"] : ["flock", "file"],
         onWait: () => {
           if (waitLogTimer) return;
-          const startedAt = Date.now();
-          waitLogTimer = setInterval(
+          const startedAt = scheduler.now();
+          waitLogTimer = scheduler.repeat(
             () =>
               logger.info("waiting for workspace mutation lock", {
                 repository,
-                elapsedMs: Date.now() - startedAt,
+                elapsedMs: scheduler.now() - startedAt,
               }),
             WAIT_LOG_INTERVAL_MS,
           );
-          waitLogTimer.unref?.();
         },
       },
     );
   } finally {
-    if (waitLogTimer) clearInterval(waitLogTimer);
+    waitLogTimer?.cancel();
   }
 }

package/src/workspace-vendor.ts

@@ -0,0 +1,103 @@
+/** Workspace package vendoring for isolated AppKit deployment snapshots. */
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { isRecord } from "@dbx-tools/shared-core";
+import { applyPublishConfig, packNpmPackage } from "./npm-packaging.ts";
+import { readPackageManifest, workspaceDependencyDirectories } from "./packages.ts";
+
+const RUNTIME_DEPENDENCY_FIELDS = [
+  "dependencies",
+  "optionalDependencies",
+  "peerDependencies",
+] as const;
+
+/** Result of staging a workspace package dependency closure. */
+export interface VendoredWorkspaceDependencies {
+  readonly archives: readonly string[];
+  readonly packages: readonly string[];
+}
+
+/** Whether a runtime manifest field contains a workspace protocol dependency. */
+function _workspaceDependencyNames(manifest: Readonly<Record<string, unknown>>): string[] {
+  return RUNTIME_DEPENDENCY_FIELDS.flatMap((field) => {
+    const dependencies = manifest[field];
+    if (!isRecord(dependencies)) return [];
+    return Object.entries(dependencies).flatMap(([name, value]) =>
+      typeof value === "string" && value.startsWith("workspace:") ? [name] : [],
+    );
+  });
+}
+
+/** Ensure generated archives survive the staged application's ignore rules. */
+function _includeVendorArchives(application: string): void {
+  const gitignore = join(application, ".gitignore");
+  const before = existsSync(gitignore) ? readFileSync(gitignore, "utf8") : "";
+  const lines = ["!/vendor/", "!/vendor/npm/", "!/vendor/npm/*.tgz"];
+  const missing = lines.filter((line) => !before.split(/\r?\n/).includes(line));
+  if (missing.length === 0) return;
+  if (existsSync(gitignore)) chmodSync(gitignore, statSync(gitignore).mode | 0o200);
+  writeFileSync(gitignore, `${before.replace(/\s*$/, "")}\n${missing.join("\n")}\n`);
+}
+
+/**
+ * Pack the transitive runtime workspace closure and link every archive directly
+ * from the staged application manifest. Returns without writing when the source
+ * application has no workspace protocol dependencies.
+ */
+export function vendorWorkspaceDependencies(
+  sourceRoot: string,
+  stageRoot: string,
+  applicationPath: string,
+): VendoredWorkspaceDependencies {
+  const sourceApplication = resolve(sourceRoot, applicationPath);
+  const sourceManifest = readPackageManifest(sourceApplication);
+  if (!sourceManifest || typeof sourceManifest.name !== "string") {
+    throw new Error(`Application package manifest is missing: ${sourceApplication}`);
+  }
+  const directWorkspaceDependencies = _workspaceDependencyNames(sourceManifest);
+  if (directWorkspaceDependencies.length === 0) return { archives: [], packages: [] };
+
+  const selected = workspaceDependencyDirectories(sourceManifest.name, sourceRoot)
+    .filter((directory) => resolve(directory) !== sourceApplication)
+    .map((directory) => {
+      const manifest = readPackageManifest(directory);
+      if (!manifest || typeof manifest.name !== "string") {
+        throw new Error(`Workspace package manifest is missing: ${directory}`);
+      }
+      return { directory, name: manifest.name };
+    });
+  const selectedNames = new Set(selected.map(({ name }) => name));
+  const unresolved = directWorkspaceDependencies.filter((name) => !selectedNames.has(name));
+  if (unresolved.length > 0) {
+    throw new Error(`Workspace dependencies are not recorded: ${unresolved.join(", ")}`);
+  }
+
+  const stagedApplication = resolve(stageRoot, applicationPath);
+  const archiveDirectory = join(stagedApplication, "vendor", "npm");
+  mkdirSync(archiveDirectory, { recursive: true });
+  const links = Object.fromEntries(
+    selected.map(({ directory, name }) => {
+      const archive = packNpmPackage(
+        directory,
+        archiveDirectory,
+        process.env.PATH,
+        applyPublishConfig,
+      );
+      return [name, `file:./vendor/npm/${basename(archive)}`];
+    }),
+  );
+  const stagedManifestPath = join(stagedApplication, "package.json");
+  const stagedManifest = JSON.parse(readFileSync(stagedManifestPath, "utf8")) as Record<
+    string,
+    unknown
+  >;
+  const dependencies = isRecord(stagedManifest.dependencies) ? stagedManifest.dependencies : {};
+  stagedManifest.dependencies = { ...dependencies, ...links };
+  chmodSync(stagedManifestPath, statSync(stagedManifestPath).mode | 0o200);
+  writeFileSync(stagedManifestPath, `${JSON.stringify(stagedManifest, null, 2)}\n`);
+  _includeVendorArchives(stagedApplication);
+  return {
+    archives: Object.values(links),
+    packages: selected.map(({ name }) => name),
+  };
+}

package/tasks/appkit-deploy.ts

@@ -9,6 +9,7 @@ import { log, toError } from "@dbx-tools/shared-core";
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { withStagedWorkspaceManifests } from "../src/workspace-manifest.ts";
+import { vendorWorkspaceDependencies } from "../src/workspace-vendor.ts";
 
 const logger = log.logger("projen:appkit-deploy");
 
@@ -146,6 +147,13 @@ export async function deployApp(
       }));
   await withStagedWorkspaceManifests(root, async (stage) => {
     const stagedApplication = resolve(stage, options.directory);
+    const vendored = vendorWorkspaceDependencies(root, stage, applicationPath);
+    if (vendored.packages.length > 0) {
+      logger.info("Vendored workspace packages for deployment", {
+        count: vendored.packages.length,
+        packages: vendored.packages,
+      });
+    }
     cpSync(clientDist, join(stagedApplication, "client", "dist"), { recursive: true });
     await reconcileStagedBundleState(stagedApplication, contextArgs, options.target, dependencies);
     const result = await run(deployArgs, stagedApplication);

package/tasks/publish-npm.ts

@@ -6,10 +6,8 @@ import { log, mapConcurrent } from "@dbx-tools/shared-core";
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { TaskConcurrencyOptionSchema, TaskDryRunOptionSchema } from "./options.ts";
-import { runTaskCommandAsync } from "../src/_task-command.ts";
 import {
-  npmReleaseMatches,
-  publishedNpmRelease,
+  publishNpmArchive,
   readNpmArchiveIdentity,
   readNpmArchiveManifest,
 } from "../src/npm-release.ts";
@@ -84,20 +82,15 @@ export async function publishNpmArchives(options: {
             `npm archive ${archive} carries ${local.version}, expected ${options.version}`,
           );
         }
-        if (!options.dryRun) {
-          const published = await publishedNpmRelease(local.name, local.version, options.registry);
-          if (npmReleaseMatches(local, published)) {
-            logger.info(`skip published ${local.name}@${local.version}`);
-            return;
-          }
-        }
-        await runTaskCommandAsync(process.cwd(), "npm", [
-          "publish",
+        const outcome = await publishNpmArchive({
           archive,
-          ...(local.access ? ["--access", local.access] : []),
-          ...(options.registry ? ["--registry", options.registry] : []),
-          ...(options.dryRun ? ["--dry-run"] : []),
-        ]);
+          identity: local,
+          dryRun: options.dryRun,
+          registry: options.registry,
+        });
+        if (outcome === "skipped") {
+          logger.info(`skip published ${local.name}@${local.version}`);
+        }
       },
       {
         concurrency: options.concurrency ?? DEFAULT_PUBLISH_CONCURRENCY,

package/tasks/publish.ts

@@ -32,7 +32,8 @@
  *     standalone publishes.
  *   - **release recovery** compares each packed archive's integrity and
  *     repository identity with registry metadata. A matching immutable version
- *     is skipped, while any mismatch fails the retry.
+ *     is skipped. A 409 for a previously staged version waits for that exact
+ *     public artifact instead of publishing again. Any other mismatch fails.
  *
  * `--dry-run` forwards to `npm publish`: it packs + validates
  * but uploads nothing. `--registry` targets a non-default registry (a local
@@ -56,13 +57,9 @@ import {
   TaskOutputOptionSchema,
   TaskRootOptionSchema,
 } from "./options.ts";
-import { runTaskCommand, runTaskCommandAsync } from "../src/_task-command.ts";
+import { runTaskCommand } from "../src/_task-command.ts";
 import { applyPublishConfig, packNpmPackage } from "../src/npm-packaging.ts";
-import {
-  npmReleaseMatches,
-  publishedNpmRelease,
-  readNpmArchiveIdentity,
-} from "../src/npm-release.ts";
+import { publishNpmArchive, readNpmArchiveIdentity } from "../src/npm-release.ts";
 import { recordedPackages } from "../src/packages.ts";
 
 const logger = log.logger("projen:publish");
@@ -153,11 +150,6 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
   }
   logger.info(`validated ${members.length} selected member manifests`);
 
-  const publishArgs = [
-    "--ignore-scripts",
-    ...(registry ? ["--registry", registry] : []),
-    ...(dryRun ? ["--dry-run"] : []),
-  ];
   const publishable: Array<{
     dir: string;
     name: string;
@@ -253,20 +245,19 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
           logger.info(`packed ${name} @ ${packageVersion}`);
           return;
         }
-        if (!dryRun) {
-          const published = await publishedNpmRelease(local.name, local.version, registry);
-          if (npmReleaseMatches(local, published)) {
-            logger.info(`skip published ${name} @ ${packageVersion}`);
-            return;
-          }
+        const outcome = await publishNpmArchive({
+          archive,
+          identity: local,
+          cwd: dir,
+          dryRun,
+          env: { ...process.env, PATH: path },
+          registry,
+        });
+        if (outcome === "skipped") {
+          logger.info(`skip published ${name} @ ${packageVersion}`);
+          return;
         }
-        logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${name} @ ${packageVersion}`);
-        await runTaskCommandAsync(
-          dir,
-          "npm",
-          ["publish", ...(access ? ["--access", access] : []), ...publishArgs, archive],
-          { env: { ...process.env, PATH: path } },
-        );
+        logger.info(`${dryRun ? "dry-run published" : "published"} ${name} @ ${packageVersion}`);
       } finally {
         rmSync(packed, { recursive: true, force: true });
       }

package/tasks/release.ts

@@ -2,6 +2,7 @@
 /** Run the configured release transaction. */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { serializeArgs } from "@dbx-tools/cli-args";
 import { projectUtils, type ProjectGhAccount, resolveProjectGhAccount } from "@dbx-tools/core";
 import { log, toError, parse } from "@dbx-tools/shared-core";
 import type { Command } from "commander";
@@ -598,10 +599,14 @@ export async function runRelease(
   }
 
   if (options.demoDeploy) {
+    const demoArgs = serializeArgs({
+      ...(selection.validation ? {} : { validation: false }),
+      ...(options.demoProfile ? { profile: options.demoProfile } : {}),
+    });
     runTaskCommand(root, "bun", [
       "run",
       "demo:deploy",
-      ...(options.demoProfile ? ["--", "--profile", options.demoProfile] : []),
+      ...(demoArgs.length > 0 ? ["--", ...demoArgs] : []),
     ]);
   }
 

package/tasks/verify-publications.ts

@@ -11,11 +11,16 @@ import {
   publishedNpmRelease,
   readNpmArchiveIdentity,
 } from "../src/npm-release.ts";
-import { PUBLIC_NPM_REGISTRY_URL, PUBLIC_PYPI_REGISTRY_URL } from "../src/release-context.ts";
+import {
+  PUBLIC_NPM_REGISTRY_URL,
+  PUBLIC_PYPI_REGISTRY_URL,
+  PUBLICATION_WAIT_INTERVAL_SECONDS,
+  PUBLICATION_WAIT_TIMEOUT_SECONDS,
+} from "../src/release-context.ts";
 
 const DEFAULT_CONCURRENCY = 8;
-const DEFAULT_INTERVAL_SECONDS = 5;
-const DEFAULT_TIMEOUT_SECONDS = 10 * 60;
+const DEFAULT_INTERVAL_SECONDS = PUBLICATION_WAIT_INTERVAL_SECONDS;
+const DEFAULT_TIMEOUT_SECONDS = PUBLICATION_WAIT_TIMEOUT_SECONDS;
 const logger = log.logger("projen:verify-publications");
 
 const PypiReleaseSchema = z