@dbx-tools/projen 0.9.17 → 0.9.19

package/README.md

@@ -233,16 +233,14 @@ branch that already contains released `main`, and merges `main` into a diverged
 branch when the merge is conflict-free. Missing branches and conflicted merges
 are left untouched.
 
-Rust release generation creates separate UniFFI and binary matrices with one row
-per target. A UniFFI row builds all discovered binding packages together. A
-binary row builds all selected release binaries in one Cargo invocation with
-the union of their required features, so a feature-gated companion does not
-trigger a second compile graph. Each matrix has its own source-scoped
-fingerprint, raw bundle, and Cargo cache namespace. Set a source-only crate's or
-release-enabled binary's `releaseExcludeOs` package option to omit it from
-incompatible binary rows. Release binary packaging and artifact upload are
-skipped in those rows. UniFFI crates cannot use this option because every
-configured target must produce their artifacts.
+Rust release generation creates one uncached matrix with one row per target.
+Each row builds all discovered bindings and selected release binaries together
+with the union of their required features, then packages every native artifact
+from that one Cargo output. Set a source-only crate's or release-enabled
+binary's `releaseExcludeOs` package option to omit it from incompatible rows.
+Release binary packaging and artifact upload are skipped in those rows. UniFFI
+crates cannot use this option because every configured target must produce
+their artifacts.
 Set a release binary's `cli` package option and the workspace
 `cliRegistryPath` to generate a typed `dbx` command registry from the same
 selected targets. The generated entries carry only the archives that the
@@ -254,18 +252,12 @@ archives and Python wheels; they do not install Bun or UBRN and do not build
 Node facades. A binary-only row therefore installs no language package tool.
 `rustVersion` remains the MSRV recorded in package manifests, while
 `releaseRustVersion` independently defaults release compilation to `stable`.
-Stable Windows rows verify and use the hosted runner's installed Rust toolchain
-and select `rust-lld` for compilation. Rust release rows restore and update
-dependency-only Cargo caches in the release branch's category-and-target cache
-scope. The cache key excludes workspace version changes, and manual tag recovery
-restores without saving a tag-scoped copy. There is no separate cache workflow
-or sccache layer. After publishing the current raw Rust bundles and build manifests,
-the GitHub release job deletes those internal assets from published
-`vMAJOR.MINOR.PATCH` releases strictly lower than the current version while
-leaving versioned consumer binaries in place. Phase timings are written to each
-build log. Python generation executes the already-built
-`target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging
-therefore does no Rust compilation after the UniFFI build.
+Rows use the target runner's standard Rust toolchain without sccache, Cargo
+cache actions, source fingerprints, or reusable raw bundles. Phase timings are
+written to each build log. GitHub-hosted Python generation executes the
+already-built `target/<triple>/release/<crate>-uniffi-bindgen` directly. A local
+macOS build compiles one host generator and reuses it while packaging the
+Darwin, Linux, and Windows libraries.
 
 Artifacts identify their crate, target, and type. Rust jobs publish non-private
 Cargo crates with `cargo publish --no-verify` and upload requested binary assets
@@ -282,18 +274,28 @@ architecture. Omit both filters to regenerate the complete maintained matrix.
 `DBX_TOOLS_RELEASE_PLATFORMS` can select the generated matrix without repeating
 environment parsing in a consumer.
 
+`bun run release` always prepares the production candidate locally. After the
+reviewed release pull request merges, the local process checks out the exact
+merge commit, builds the complete npm, Python, native binding, and Rust binary
+artifact set, then creates an annotated tag and draft GitHub Release. The draft
+contains `release-manifest.json`, `SHA256SUMS`, and every registry or binary
+artifact bound to that commit. A manager can rebuild an interrupted draft from
+the exact source with
+`bun run release:assets --version <version> --tag <tag> --sha <commit> --upload`.
+Publishing the draft is the production promotion event; `release.yml` verifies
+the tag, commit, version, manifest, checksums, and asset set before publishing
+the approved npm archives, Python distributions, and Cargo crates. GitHub-hosted
+runners never rebuild native release artifacts for singular-version releases.
+
 Public UniFFI facades are marked with `dbxToolsConfig.uniffi = true` in Node
 manifests and `[tool.dbx_tools.config] uniffi = true` in Python manifests. The
-Node jobs consume same-run artifacts, publish native archives first with npm
-provenance, compile and publish normal workspace packages including the Projen
-engine, then build facades from committed generated TypeScript without UBRN and
-publish them in binding dependency order. Local Verdaccio publication does not
-enable provenance. Set the `UNIFFI_FACADE_SMOKE` repository variable to `true`
-to run the optional nonblocking registry install and import check after facade
-publication. Python combines same-run platform wheels with standard wheel and
-source builds, then publishes each distribution through its own PyPI
-trusted-publisher environment. Binding publishers wait for their dependencies.
-Trusted-publisher instructions name `release.yml` and the release branch policy.
+approved npm archives are dependency-ordered and published through npm OIDC
+Trusted Publishing with provenance. Local Verdaccio publication does not enable
+provenance. Python publishes the exact approved wheels and source distributions
+through package-specific PyPI trusted-publisher environments; binding publishers
+wait for their dependencies. Trusted-publisher instructions name `release.yml`
+and the `v*` deployment tag policy. Cargo publication checks the approved source
+commit and skips an already-published version during recovery.
 The docs jobs generate README and TypeScript API content and deploy GitHub Pages
 from the same workflow. When a conventional Node binding path already belongs
 to a root subproject, Rust mapping reuses that project and adds binding
@@ -483,14 +485,15 @@ bootstrap a folder that has no `.projenrc.ts` or toolchain yet.
 
 ## Run Tasks From The ROOT
 
-Every repo-wide task lives on the root, and the root's `compile` / `test`
-delegate with `bun run --filter '*'` rather than emitting a step per member - so
-a new package is covered without a re-synth. Work from the root:
+Every repo-wide task lives on the root. `compile` batches ordinary TypeScript
+packages in up to four `tsc --build` processes and runs custom compile tasks alongside them;
+`test` delegates with `bun run --filter '*'`. Both read the current workspace
+list, so a new package is covered without a re-synth. Work from the root:
 
 | Task                           | What it does                                         |
 | ------------------------------ | ---------------------------------------------------- |
 | `bun run build`                | synth + workspace compile and tests                  |
-| `bun run compile`              | `tsc --build` in each member, in parallel            |
+| `bun run compile`              | Batched `tsc --build` plus custom member compiles    |
 | `bun run test`                 | `eslint` once, then each member's tests              |
 | `bun run sync`                 | re-synth (`--watch` to keep synthing)                |
 | `bun run barrels`              | regenerate the read-only `index.ts` barrels          |

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.17";
+export const PACKAGE_VERSION = "0.9.19";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -66,7 +66,7 @@ export { DBXToolsReleaseCatalog } from "./src/release-catalog.ts";
 export type { DBXToolsVersioningMode, ReleaseProjectLanguage, ReleaseArtifactKind, ReleaseEdgeKind, ReleasePropagation, ReleaseUnitRule, DBXToolsReleaseCatalogOptions, ReleaseDependencyInput, ReleaseProjectRegistration, ExternalReleaseProjectRegistration, ReleaseArtifactRegistration, ReleaseProjectNode, ReleaseArtifact, ReleaseDependencyEdge, ReleaseUnit, ReleaseUnitGraph } from "./src/release-catalog.ts";
 export { RELEASE_TAG, RELEASE_SHA, RELEASE_VERSION, RELEASE_SUMMARY_DIRECTORY, RELEASE_SUMMARY_PROVIDER_NAMES, RELEASE_SUMMARY_FILE } from "./src/release-dispatch.ts";
 export type { ReleaseSummaryProviderName } from "./src/release-dispatch.ts";
-export type { GithubRepositoryIdentity, GithubAuthenticatedAccount } from "./src/release-github.ts";
+export type { GithubRepositoryIdentity, GithubAuthenticatedAccount, GithubRepositoryPermissions } from "./src/release-github.ts";
 export type { ReleaseReason, PlannedReleaseUnit, PlannedPackage, PlannedArtifact, PlannedRustTarget, ReleasePlan } from "./src/release-plan.ts";
 export { ReleaseUnitWorkspacePlugin } from "./src/release-please.ts";
 export type { ReleaseUnitWorkspacePluginOptions } from "./src/release-please.ts";

package/package.json

@@ -2,7 +2,6 @@
   "name": "@dbx-tools/projen",
   "scripts": {
     "build": "projen build",
-    "bundle:rust-release": "projen bundle:rust-release",
     "clobber": "projen clobber",
     "compile": "projen compile",
     "default": "projen default",
@@ -30,9 +29,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.17",
-    "@dbx-tools/path": "^0.9.17",
-    "@dbx-tools/shared-core": "^0.9.17",
+    "@dbx-tools/core": "^0.9.19",
+    "@dbx-tools/path": "^0.9.19",
+    "@dbx-tools/shared-core": "^0.9.19",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -53,7 +52,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.17",
+  "version": "0.9.19",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/_release-platform.ts

@@ -22,6 +22,16 @@ export type ReleaseArch = (typeof RELEASE_ARCHES)[number];
 
 export type { VersionLevel } from "./workspace-version.ts";
 
+/** Stable archive name for one native release binary. */
+export function releaseBinaryAssetName(
+  binaryName: string,
+  nodeTarget: string,
+  operatingSystem: ReleaseOs,
+): string {
+  const extension = operatingSystem === "win32" ? "zip" : "tar.gz";
+  return `${binaryName}-${nodeTarget}.${extension}`;
+}
+
 function collectValue<T extends string>(value: T, previous: T[]): T[] {
   return [...previous, value];
 }

package/src/_rust-project.ts

@@ -71,6 +71,8 @@ export interface RustCrateOptions {
   readonly release?: boolean;
   /** Omit this crate and any release binary artifact from these operating systems. */
   readonly releaseExcludeOs?: readonly RustReleaseOs[];
+  /** Cargo features used only by the macOS cross-platform release builder. */
+  readonly releaseLocalFeatures?: readonly string[];
   readonly dependencies?: Readonly<Record<string, CargoDependency>>;
   /** Cargo dependencies scoped by a target cfg expression. */
   readonly targetDependencies?: Readonly<Record<string, Readonly<Record<string, CargoDependency>>>>;
@@ -221,6 +223,7 @@ function packageOptions(
     ...(options.private !== undefined ? { private: options.private } : {}),
     ...(options.release !== undefined ? { release: options.release } : {}),
     ...(options.releaseExcludeOs ? { releaseExcludeOs: options.releaseExcludeOs } : {}),
+    ...(options.releaseLocalFeatures ? { releaseLocalFeatures: options.releaseLocalFeatures } : {}),
     ...(options.dependencies ? { dependencies: options.dependencies } : {}),
     ...(options.targetDependencies ? { targetDependencies: options.targetDependencies } : {}),
     ...(options.devDependencies ? { devDependencies: options.devDependencies } : {}),