@dbx-tools/projen 0.9.18 → 0.9.21

package/tasks/publish-uniffi-local.ts

@@ -1,7 +1,17 @@
 #!/usr/bin/env -S bun
-import { chmodSync, existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { arch, platform } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import {
+  cpSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { arch, platform, tmpdir } from "node:os";
+import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { json, log, object } from "@dbx-tools/shared-core";
@@ -12,33 +22,21 @@ import type { RustBindingMapping, RustWorkspaceMapping } from "../src/project-rs
 
 const logger = log.logger("projen:publish-uniffi-local");
 
-const parsed = parseArgs({
-  options: {
-    version: { type: "string" },
-    registry: { type: "string" },
-    "pypi-publish-url": { type: "string" },
-    "cargo-registry": { type: "string" },
-  },
-});
-
-function run(command: string, args: string[], capture = false): string {
-  if (capture) return captureTaskCommand(repoRoot, command, args, { check: true });
-  runTaskCommand(repoRoot, command, args);
-  return "";
-}
-
 function commandAvailable(command: string): boolean {
   return taskCommandSucceeds(repoRoot, command, ["--version"]);
 }
 
 function rustHost(): string {
-  const host = run("rustc", ["-vV"], true).match(/^host:\s+(.+)$/m)?.[1];
+  const host = captureTaskCommand(repoRoot, "rustc", ["-vV"], { check: true }).match(
+    /^host:\s+(.+)$/m,
+  )?.[1];
   if (!host) throw new Error("Unable to detect the local Rust target from rustc -vV");
   return host;
 }
 
 function pythonTag(): string {
-  const value = run(
+  const value = captureTaskCommand(
+    repoRoot,
     "uv",
     [
       "run",
@@ -47,7 +45,7 @@ function pythonTag(): string {
       "-c",
       "import sysconfig; print(sysconfig.get_platform().replace('-', '_').replace('.', '_'))",
     ],
-    true,
+    { check: true },
   );
   if (!value) throw new Error("Unable to detect the local Python wheel platform tag");
   return value;
@@ -99,12 +97,18 @@ interface CargoMetadataPackage {
   dependencies: Array<{ name: string; source?: string | null }>;
   manifest_path: string;
   name: string;
+  version: string;
 }
 
-function orderedCargoManifests(config: RustWorkspaceMapping): string[] {
-  const configured = new Set(config.crates.map((crate) => resolve(repoRoot, crate, "Cargo.toml")));
+function orderedCargoManifests(root: string, config: RustWorkspaceMapping): CargoMetadataPackage[] {
+  const configured = new Set(config.crates.map((crate) => resolve(root, crate, "Cargo.toml")));
   const metadata = json.parseRecord(
-    run("cargo", ["metadata", "--format-version", "1", "--no-deps", "--locked"], true),
+    captureTaskCommand(
+      root,
+      "cargo",
+      ["metadata", "--format-version", "1", "--no-deps", "--locked"],
+      { check: true },
+    ),
   );
   if (!metadata || !Array.isArray(metadata.packages)) {
     throw new Error("Cargo metadata did not return workspace packages");
@@ -112,6 +116,7 @@ function orderedCargoManifests(config: RustWorkspaceMapping): string[] {
   const packages = metadata.packages.filter(object.isRecord).map((pkg) => {
     if (
       typeof pkg.name !== "string" ||
+      typeof pkg.version !== "string" ||
       typeof pkg.manifest_path !== "string" ||
       !Array.isArray(pkg.dependencies)
     ) {
@@ -119,6 +124,7 @@ function orderedCargoManifests(config: RustWorkspaceMapping): string[] {
     }
     return {
       name: pkg.name,
+      version: pkg.version,
       manifest_path: resolve(pkg.manifest_path),
       dependencies: pkg.dependencies.filter(object.isRecord).map((dependency) => {
         if (typeof dependency.name !== "string") {
@@ -161,79 +167,103 @@ function orderedCargoManifests(config: RustWorkspaceMapping): string[] {
     ordered.push(pkg);
   };
   for (const pkg of publishable.values()) visit(pkg);
-  return ordered.map((pkg) => pkg.manifest_path);
+  return ordered;
+}
+
+function copyCargoWorkspace(config: RustWorkspaceMapping): string {
+  const root = mkdtempSync(join(tmpdir(), "dbx-tools-local-cargo-"));
+  for (const path of ["Cargo.toml", "Cargo.lock", "LICENSE", "README.md", "rust-toolchain.toml"]) {
+    const source = join(repoRoot, path);
+    if (!existsSync(source)) continue;
+    cpSync(source, join(root, path));
+  }
+  const cargoConfig = join(repoRoot, ".cargo");
+  if (existsSync(cargoConfig)) cpSync(cargoConfig, join(root, ".cargo"), { recursive: true });
+  for (const crate of config.crates) {
+    const source = resolve(repoRoot, crate);
+    const destination = resolve(root, relative(repoRoot, source));
+    mkdirSync(dirname(destination), { recursive: true });
+    cpSync(source, destination, { recursive: true });
+  }
+  return root;
+}
+
+export function projectCargoRegistry(
+  document: Record<string, unknown>,
+  crateNames: ReadonlySet<string>,
+  registry: string,
+): void {
+  const sections: unknown[] = [
+    document.dependencies,
+    document["dev-dependencies"],
+    document["build-dependencies"],
+  ];
+  const workspace = document.workspace;
+  if (workspace && typeof workspace === "object" && !Array.isArray(workspace)) {
+    sections.push((workspace as Record<string, unknown>).dependencies);
+  }
+  for (const value of sections) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const section = value as Record<string, unknown>;
+    for (const crateName of crateNames) {
+      const dependency = section[crateName];
+      if (!dependency || typeof dependency !== "object" || Array.isArray(dependency)) continue;
+      const record = dependency as Record<string, unknown>;
+      if (record.workspace === true) continue;
+      record.registry = registry;
+    }
+  }
 }
 
 function publishCargo(config: RustWorkspaceMapping, registry: string, version: string): void {
-  const manifests = orderedCargoManifests(config);
-  const originals = new Map(
-    manifests.map((manifest) => [manifest, readFileSync(manifest, "utf8")]),
-  );
+  const root = copyCargoWorkspace(config);
   try {
-    const crateNames = manifests.map((manifest) => {
-      const document = parse(readFileSync(manifest, "utf8")) as {
-        package?: { name?: string };
-      };
-      if (!document.package?.name) {
-        throw new Error(`Cargo manifest has no package name: ${manifest}`);
+    const packages = orderedCargoManifests(root, config);
+    const crateNames = new Set(packages.map((pkg) => pkg.name));
+    for (const pkg of packages) {
+      if (pkg.version !== version) {
+        throw new Error(`${pkg.name} version ${pkg.version} does not match release ${version}`);
       }
-      return document.package.name;
-    });
+    }
+    const manifests = [join(root, "Cargo.toml"), ...packages.map((pkg) => pkg.manifest_path)];
     for (const manifest of manifests) {
-      const mode = statSync(manifest).mode;
       const document = parse(readFileSync(manifest, "utf8")) as Record<string, unknown>;
-      for (const crateName of crateNames) {
-        if (!crateName) continue;
-        for (const sectionName of ["dependencies", "dev-dependencies", "build-dependencies"]) {
-          const section = document[sectionName];
-          if (!section || typeof section !== "object" || Array.isArray(section)) continue;
-          const dependency = (section as Record<string, unknown>)[crateName];
-          if (!dependency || typeof dependency !== "object" || Array.isArray(dependency)) {
-            continue;
-          }
-          (dependency as Record<string, unknown>).registry = registry;
-        }
-      }
-      chmodSync(manifest, mode | 0o200);
+      projectCargoRegistry(document, crateNames, registry);
+      chmodSync(manifest, 0o644);
       writeFileSync(manifest, `${stringify(document).trimEnd()}\n`);
-      chmodSync(manifest, mode);
     }
-    for (const crateName of crateNames) {
-      if (!crateName) continue;
-      if (cargoVersionExists(crateName, version, registry)) {
-        logger.info(`skip published ${crateName} @ ${version}`);
+    for (const pkg of packages) {
+      if (cargoVersionExists(pkg.name, version, registry)) {
+        logger.info(`skip published ${pkg.name} @ ${version}`);
         continue;
       }
-      run("cargo", [
+      runTaskCommand(root, "cargo", [
         "publish",
-        "--package",
-        crateName,
+        "--manifest-path",
+        pkg.manifest_path,
         "--registry",
         registry,
-        "--allow-dirty",
-        "--no-verify",
+        "--locked",
       ]);
     }
   } finally {
-    for (const [manifest, source] of originals) {
-      const mode = statSync(manifest).mode;
-      chmodSync(manifest, mode | 0o200);
-      writeFileSync(manifest, source);
-      chmodSync(manifest, mode);
-    }
+    rmSync(root, { recursive: true, force: true });
   }
 }
 
-function buildAndPublish(binding: RustBindingMapping, version: string): void {
-  const registry = parsed.values.registry;
-  const pypiPublishUrl = parsed.values["pypi-publish-url"];
+function buildAndPublish(
+  binding: RustBindingMapping,
+  version: string,
+  registry: string | undefined,
+  pypiPublishUrl: string | undefined,
+): void {
   const includeNode = Boolean(registry && binding.node && binding.nodePackage);
   const includePython = Boolean(pypiPublishUrl && binding.python && binding.pythonPackage);
   if (!includeNode && !includePython) return;
 
   const target = nativeTarget();
   const output = resolve(repoRoot, "dist/uniffi");
-  run("node", [
+  runTaskCommand(repoRoot, "node", [
     resolve(dirname(fileURLToPath(import.meta.url)), "uniffi-release.mjs"),
     "build",
     "--crate",
@@ -272,7 +302,7 @@ function buildAndPublish(binding: RustBindingMapping, version: string): void {
     const publishNpmScript = resolve(dirname(fileURLToPath(import.meta.url)), "publish-npm.ts");
     for (const directory of [join(output, "npm"), join(output, "npm-facade")]) {
       if (artifacts(directory, ".tgz").length === 0) continue;
-      run(process.execPath, [
+      runTaskCommand(repoRoot, process.execPath, [
         publishNpmScript,
         "--directory",
         directory,
@@ -286,7 +316,7 @@ function buildAndPublish(binding: RustBindingMapping, version: string): void {
   if (includePython) {
     const wheels = artifacts(join(output, "python"), ".whl");
     if (wheels.length === 0) throw new Error(`No wheel produced for ${binding.crate}`);
-    run("uvx", [
+    runTaskCommand(repoRoot, "uvx", [
       "--from",
       "devpi-client",
       "devpi",
@@ -299,16 +329,31 @@ function buildAndPublish(binding: RustBindingMapping, version: string): void {
   }
 }
 
-const version = parsed.values.version;
-if (!version) throw new Error("Missing --version");
-const config = rustConfig();
-if (config?.bindings.length) {
-  if (!commandAvailable("cargo") || !commandAvailable("rustc")) {
-    throw new Error("Cargo and rustc are required because UniFFI Rust projects were detected");
+function main(args: string[] = process.argv.slice(2)): void {
+  const parsed = parseArgs({
+    args,
+    options: {
+      version: { type: "string" },
+      registry: { type: "string" },
+      "pypi-publish-url": { type: "string" },
+      "cargo-registry": { type: "string" },
+    },
+  });
+  const version = parsed.values.version;
+  if (!version) throw new Error("Missing --version");
+  const config = rustConfig();
+  if (config?.bindings.length) {
+    if (!commandAvailable("cargo") || !commandAvailable("rustc")) {
+      throw new Error("Cargo and rustc are required because UniFFI Rust projects were detected");
+    }
+    for (const binding of config.bindings) {
+      buildAndPublish(binding, version, parsed.values.registry, parsed.values["pypi-publish-url"]);
+    }
+  }
+  const cargoRegistry = parsed.values["cargo-registry"];
+  if (cargoRegistry && config?.crates.length) {
+    publishCargo(config, cargoRegistry, version);
   }
-  for (const binding of config.bindings) buildAndPublish(binding, version);
-}
-const cargoRegistry = parsed.values["cargo-registry"];
-if (cargoRegistry && config?.crates.length) {
-  publishCargo(config, cargoRegistry, version);
 }
+
+if (import.meta.main) main();

package/tasks/publish.ts

@@ -18,14 +18,14 @@
  *     version. When Bun's workspace lock already carries the version, its
  *     refresh is skipped;
  *   - **`publishConfig` substitution** (compiled `lib/` entry points) is done
- *     HERE, by {@link applyPublishConfig}, NOT by bun: unlike pnpm/npm, `bun
+ *     inside the temporary archive, NOT in the checkout: unlike pnpm/npm, `bun
  *     publish`/`bun pm pack` do NOT fold `publishConfig`'s `main`/`types`/`bin`/
  *     `exports` into the packed manifest (verified: the packed manifest keeps the
  *     raw `.ts` source paths and an inert `publishConfig`). Left unsubstituted, a
  *     published CLI's `bin` points at `./bin/x.ts`, and because the bin runs via
  *     its `#!/usr/bin/env node` shebang, node chokes on the `.ts`
  *     (ERR_UNKNOWN_FILE_EXTENSION). We merge `publishConfig` onto the top-level
- *     manifest before packing so the tarball advertises the compiled `lib/` tree;
+ *     manifest after packing so the tarball advertises the compiled `lib/` tree;
  *   - **compiled output** is emitted once, before packing, by one root-level
  *     filtered `bun run` that fans out to every publishable member in parallel.
  *     Every package is then packed once with lifecycle scripts disabled. The
@@ -42,26 +42,10 @@
  * non-default registry (a local verdaccio); `--exclude <dir>` (repeatable,
  * repo-relative) skips a member owned by another publication flow.
  *
- * `--no-restore` keeps the transient publishConfig edits on disk instead of
- * undoing them at exit.
- *
- * The disk manifests carry the workspace `VERSION` (projen owns them, read-only);
- * this unlocks each only long enough to fold in the `publishConfig` entry points
- * and publish, then RESTORES every one it touched
- * byte-for-byte (and re-locks the mode) on the way out - see
- * {@link restoreManifests}. Restore returns each manifest to its committed
- * content, which already equals the release version, so the worktree is never
- * left regressed.
+ * The checkout remains byte-for-byte unchanged. A stale manifest or lockfile is
+ * a release error rather than something publication repairs.
  */
-import {
-  chmodSync,
-  existsSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { asyncUtils, log } from "@dbx-tools/shared-core";
@@ -75,25 +59,9 @@ import {
 } from "./publish-npm.ts";
 import { runTaskCommand, runTaskCommandAsync } from "../src/_task-command.ts";
 import { toPosix } from "../src/packages.ts";
-import type { ReleasePlan } from "../src/release-plan.ts";
 
 const logger = log.logger("projen:publish");
 
-/** A manifest's on-disk bytes + mode, captured before this task edits it. */
-interface ManifestBackup {
-  readonly content: string;
-  readonly mode: number;
-}
-
-/**
- * Original state of every manifest this task has unlocked, keyed by path.
- *
- * Bun does not apply `publishConfig` while packing, so publication temporarily
- * projects those entry points onto projen-owned manifests. The projection is
- * only meant for the packed tarball and is restored before the process exits.
- */
-const manifestBackups = new Map<string, ManifestBackup>();
-
 /**
  * Workspace member dirs (absolute), read from the root `pnpm-workspace.yaml` - the
  * file the engine keeps for the Databricks Apps pnpm deploy, which also lists every
@@ -107,18 +75,13 @@ function workspaceMembers(root: string): string[] {
   return (doc?.packages ?? []).map((m) => resolve(root, m));
 }
 
-/** Whether selected workspace members carry their planned versions. */
-function manifestsMatchVersions(
-  root: string,
-  members: readonly string[],
-  expected: ReadonlyMap<string, string>,
-): boolean {
+/** Whether selected workspace members carry the reviewed workspace version. */
+function manifestsMatchVersion(members: readonly string[], version: string): boolean {
   return members.every((dir) => {
     const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
       version?: string;
     };
-    const path = toPosix(dir.slice(resolve(root).length + 1));
-    return pkg.version === expected.get(path);
+    return pkg.version === version;
   });
 }
 
@@ -144,41 +107,6 @@ function lockfileMatchesManifestVersions(root: string, members: readonly string[
   }
 }
 
-/**
- * Make a projen-readonly manifest writable so the publishConfig projection can
- * edit it, recording its original bytes and mode for {@link restoreManifests}
- * the first time it is seen.
- */
-function unlockManifest(pkgPath: string): void {
-  const mode = statSync(pkgPath).mode;
-  if (!manifestBackups.has(pkgPath)) {
-    manifestBackups.set(pkgPath, { content: readFileSync(pkgPath, "utf8"), mode });
-  }
-  chmodSync(pkgPath, mode | 0o200);
-}
-
-/**
- * Put every manifest this task edited back exactly as it was found, mode included.
- *
- * Runs from an `exit` handler so a clean finish and a failure partway through the
- * publish loop are covered alike - a `bun publish` that dies on package 12 of 34
- * must not leave the first 11 projected. Best-effort per file: one unwritable
- * manifest is logged and the rest are still restored, since a partial restore
- * beats none.
- */
-function restoreManifests(): void {
-  for (const [pkgPath, backup] of manifestBackups) {
-    try {
-      chmodSync(pkgPath, backup.mode | 0o200);
-      writeFileSync(pkgPath, backup.content);
-      chmodSync(pkgPath, backup.mode);
-    } catch (cause) {
-      logger.warn(`could not restore ${pkgPath}`, { cause });
-    }
-  }
-  manifestBackups.clear();
-}
-
 /** Entry-point fields projen writes as `.ts` source in-repo and rewrites to `lib/` for publish. */
 const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const;
 
@@ -193,23 +121,18 @@ function compiledPublishTargets(value: unknown): string[] {
 /**
  * Fold a package's `publishConfig` entry-point fields onto the top-level manifest,
  * the way pnpm/npm do at pack time but `bun publish` does NOT (see the module
- * doc). Idempotent, writes only when something changes, and leaves `publishConfig`
- * in place (npm ignores it once the top-level fields already point at `lib/`). The
- * manifest must already be unlocked. {@link restoreManifests} puts the `.ts` entry
- * points back at exit, so this only ever affects the packed tarball.
+ * doc). The input is the temporary archive manifest, never the checkout.
  */
-function applyPublishConfig(pkgPath: string): void {
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as Record<string, unknown>;
+export function applyPublishConfig(
+  source: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  const pkg = { ...source };
   const publishConfig = pkg.publishConfig as Record<string, unknown> | undefined;
-  if (!publishConfig) return;
-  let changed = false;
+  if (!publishConfig) return pkg;
   for (const field of PUBLISH_CONFIG_ENTRY_FIELDS) {
-    if (field in publishConfig) {
-      pkg[field] = publishConfig[field];
-      changed = true;
-    }
+    if (field in publishConfig) pkg[field] = publishConfig[field];
   }
-  if (changed) writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+  return pkg;
 }
 
 /**
@@ -227,19 +150,16 @@ const argv = process.argv.slice(2);
 const version = argv[0] && !argv[0].startsWith("--") ? argv[0] : undefined;
 const rest = version ? argv.slice(1) : argv;
 const root = process.cwd();
-const planIdx = rest.indexOf("--plan");
-const plan =
-  planIdx >= 0
-    ? (JSON.parse(readFileSync(resolve(root, rest[planIdx + 1]), "utf8")) as ReleasePlan)
-    : undefined;
-if (!version && !plan) {
+if (!version) {
   logger.error(
-    "usage: bun tasks/publish.ts <version> [--plan <path>] [--registry <url>] [--exclude <dir>] [--dry-run] [--skip-compile]",
+    "usage: bun tasks/publish.ts <version> [--registry <url>] [--output <dir>] [--exclude <dir>] [--dry-run] [--skip-compile]",
   );
   process.exit(1);
 }
 const registryIdx = rest.indexOf("--registry");
 const registry = registryIdx >= 0 ? rest[registryIdx + 1] : undefined;
+const outputIdx = rest.indexOf("--output");
+const output = outputIdx >= 0 ? resolve(root, rest[outputIdx + 1]) : undefined;
 const dryRun = rest.includes("--dry-run");
 const skipCompile = rest.includes("--skip-compile");
 const concurrencyIdx = rest.indexOf("--concurrency");
@@ -248,46 +168,25 @@ if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
   throw new Error(`--concurrency must be a positive integer, got ${String(parsedConcurrency)}`);
 }
 const concurrency = parsedConcurrency;
-// Undo transient publishConfig edits at exit.
-const restore = !rest.includes("--no-restore");
 const excluded = new Set(
   rest.reduce<string[]>((acc, arg, i) => (arg === "--exclude" ? [...acc, rest[i + 1]] : acc), []),
 );
 
 const path = enrichedPath(root);
-// Registered BEFORE the first manifest edit so no exit path can skip it: a clean
-// finish and a `bun publish` failure mid-loop both land here, so a publish that
-// dies partway does not leave half the workspace stamped.
-if (restore) process.on("exit", restoreManifests);
 const allMembers = workspaceMembers(root)
   .filter((dir) => existsSync(join(dir, "package.json")))
   .filter((dir) => !excluded.has(resolve(root, dir).replace(`${resolve(root)}/`, "")));
-const expectedVersions = new Map(
-  plan
-    ? plan.nodePackages.map((pkg) => [pkg.path, pkg.version] as const)
-    : allMembers.map((dir) => [toPosix(dir.slice(resolve(root).length + 1)), version!]),
-);
-const members = plan
-  ? allMembers.filter((dir) => expectedVersions.has(toPosix(dir.slice(resolve(root).length + 1))))
-  : allMembers;
+const members = allMembers;
 
-if (!manifestsMatchVersions(root, members, expectedVersions)) {
-  throw new Error("workspace manifests do not match the reviewed release plan; run projen");
+if (!manifestsMatchVersion(members, version)) {
+  throw new Error(`workspace manifests do not match release ${version}; run projen`);
 }
 logger.info(`validated ${members.length} selected member manifests`);
 
-// Ensure the lockfile resolves each `workspace:*` to the release version.
-// `bun publish`/`pm pack` reads workspace versions from the LOCKFILE, not just
-// live manifests. A normal bump's synth/install already makes it current; after
-// fallback stamping, deleting it before install is what forces re-resolution.
-const lockfile = join(root, "bun.lock");
-if (lockfileMatchesManifestVersions(root, allMembers)) {
-  logger.info("workspace lock already resolves live member versions");
-} else {
-  if (existsSync(lockfile)) rmSync(lockfile);
-  logger.info("refreshing lockfile so workspace deps resolve to the release version");
-  runTaskCommand(root, "bun", ["install"], { env: { ...process.env, PATH: path } });
+if (!lockfileMatchesManifestVersions(root, allMembers)) {
+  throw new Error("bun.lock does not match workspace versions; run bun install and commit it");
 }
+logger.info("validated workspace lock versions");
 
 const publishArgs = [
   "--ignore-scripts",
@@ -361,24 +260,19 @@ if (compiled.length > 0) {
   }
 }
 
-// Compile against workspace source exports first. Switching manifests to their
-// publishConfig entries before compilation makes consumers resolve sibling
-// `lib/*.d.ts` files that have not been emitted yet in a clean checkout.
-for (const { dir } of publishable) {
-  const manifestPath = join(dir, "package.json");
-  unlockManifest(manifestPath);
-  applyPublishConfig(manifestPath);
-}
-
 logger.info(
-  `${dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
+  `${output ? "packing" : dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
 );
+if (output) {
+  rmSync(output, { recursive: true, force: true });
+  mkdirSync(output, { recursive: true });
+}
 await asyncUtils.mapConcurrent(
   publishable,
   async ({ dir, name, version: packageVersion, access }) => {
     const packed = mkdtempSync(join(tmpdir(), "projen-npm-release-"));
     try {
-      const archive = packNpmPackage(dir, packed, path);
+      const archive = packNpmPackage(dir, packed, path, applyPublishConfig);
       const local = readNpmArchiveIdentity(archive);
       if (local.name !== name || local.version !== packageVersion) {
         throw new Error(
@@ -390,6 +284,15 @@ await asyncUtils.mapConcurrent(
           `Packed npm access ${String(local.access)} does not match ${String(access)} for ${name}`,
         );
       }
+      if (output) {
+        const destination = join(output, archive.split(/[\\/]/).at(-1)!);
+        if (existsSync(destination)) {
+          throw new Error(`Duplicate npm archive name: ${destination}`);
+        }
+        copyFileSync(archive, destination);
+        logger.info(`packed ${name} @ ${packageVersion}`);
+        return;
+      }
       if (!dryRun) {
         const published = await publishedNpmRelease(local.name, local.version, registry);
         if (npmReleaseMatches(local, published)) {
@@ -410,4 +313,6 @@ await asyncUtils.mapConcurrent(
   },
   { concurrency, errorMode: "settle" },
 );
-logger.success(`${dryRun ? "dry-run: packed" : "published"} ${publishable.length} packages`);
+logger.success(
+  `${output || dryRun ? "packed" : "published"} ${publishable.length} packages${output ? ` to ${output}` : ""}`,
+);

package/tasks/python-registry.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import * as exec from "@dbx-tools/core/exec";
 import { net } from "@dbx-tools/shared-core";
+import { captureTaskCommand } from "../src/_task-command.ts";
 
 export interface LocalPythonRegistry {
   readonly indexUrl: string;
@@ -126,14 +126,7 @@ function splitIndexList(value: string | undefined): string[] {
 
 /** Read a `pip config get <key>`, treating pip's literal "undefined" as unset. */
 function pipConfig(key: string): string | undefined {
-  const res = exec.spawnSync("python", ["-m", "pip", "config", "get", key], {
-    cwd: process.cwd(),
-    stdout: "capture",
-    stderr: "ignore",
-    stdin: "ignore",
-    check: false,
-  });
-  const out = res.stdout?.trim();
+  const out = captureTaskCommand(process.cwd(), "python", ["-m", "pip", "config", "get", key]);
   return out && out !== "undefined" ? out : undefined;
 }