@dbx-tools/projen 0.9.47 → 0.9.51

package/tasks/publish-npm.ts

@@ -1,6 +1,468 @@
 #!/usr/bin/env -S bun
-import { main } from "./lib/publish-npm.ts";
+/** Idempotent npm archive publication for release recovery. */
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative, resolve } from "node:path";
+import * as exec from "@dbx-tools/core/exec";
+import * as projectUtils from "@dbx-tools/core/project-utils";
+import { log } from "@dbx-tools/shared-core";
+import { Command } from "commander";
+import { runTaskCommand } from "../src/_task-command.ts";
 
-export * from "./lib/publish-npm.ts";
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+const logger = log.logger("projen:publish-npm");
+
+/** Registry and archive identity used to verify idempotent npm publication. */
+export interface NpmReleaseIdentity {
+  readonly access?: "public" | "restricted";
+  readonly contentDigest?: string;
+  readonly integrity?: string;
+  readonly name: string;
+  readonly repository?: unknown;
+  readonly version: string;
+}
+
+interface NpmArchiveManifest {
+  readonly [key: string]: unknown;
+  readonly dependencies?: Readonly<Record<string, string>>;
+  readonly optionalDependencies?: Readonly<Record<string, string>>;
+  readonly name?: string;
+  readonly publishConfig?: { readonly access?: unknown };
+  readonly repository?: unknown;
+  readonly version?: string;
+}
+
+/** Transform applied to a packed npm manifest before archive verification. */
+export type NpmArchiveManifestTransform = (
+  manifest: NpmArchiveManifest,
+) => Readonly<Record<string, unknown>>;
+
+/** Entry-point fields projected from publishConfig into a packed manifest. */
+const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const;
+const DEPENDENCY_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies",
+] as const;
+
+/** Replace workspace and catalogue protocols with publishable registry ranges. */
+export function materializeWorkspaceManifest(
+  source: Readonly<Record<string, unknown>>,
+  workspace: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  const manifest = structuredClone(source) as Record<string, unknown>;
+  const version = workspace.version;
+  const catalog =
+    workspace.catalog && typeof workspace.catalog === "object"
+      ? (workspace.catalog as Readonly<Record<string, unknown>>)
+      : {};
+  if (typeof version !== "string" || !version) {
+    throw new Error("Workspace manifest has no version");
+  }
+  for (const field of DEPENDENCY_FIELDS) {
+    const dependencies = manifest[field];
+    if (!dependencies || typeof dependencies !== "object") continue;
+    manifest[field] = Object.fromEntries(
+      Object.entries(dependencies).map(([name, value]) => [
+        name,
+        materializeDependency(name, value, version, catalog),
+      ]),
+    );
+  }
+  return manifest;
+}
+
+function materializeDependency(
+  name: string,
+  value: unknown,
+  version: string,
+  catalog: Readonly<Record<string, unknown>>,
+): unknown {
+  if (value === "catalog:") {
+    const resolved = catalog[name];
+    if (typeof resolved !== "string" || !resolved) {
+      throw new Error(`Workspace catalog has no version for ${name}`);
+    }
+    return resolved;
+  }
+  if (typeof value !== "string" || !value.startsWith("workspace:")) return value;
+  const selector = value.slice("workspace:".length);
+  if (selector === "*" || !selector) return version;
+  if (selector === "^" || selector === "~") return `${selector}${version}`;
+  return selector;
+}
+
+/**
+ * Fold compiled publish entry points onto an archive manifest without changing
+ * the source checkout.
+ */
+export function applyPublishConfig(
+  source: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  const manifest = { ...source };
+  const publishConfig = manifest.publishConfig as Record<string, unknown> | undefined;
+  if (!publishConfig) return manifest;
+  for (const field of PUBLISH_CONFIG_ENTRY_FIELDS) {
+    if (field in publishConfig) manifest[field] = publishConfig[field];
+  }
+  return manifest;
+}
+
+function archiveFileEntries(directory: string, prefix = ""): string[] {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+    return entry.isDirectory()
+      ? archiveFileEntries(join(directory, entry.name), relativePath)
+      : [relativePath];
+  });
+}
+
+function normalizedRepository(value: unknown): string | undefined {
+  const url =
+    typeof value === "string"
+      ? value
+      : value && typeof value === "object" && "url" in value
+        ? String(value.url)
+        : undefined;
+  return url
+    ?.replace(/^git\+/, "")
+    .replace(/\.git$/, "")
+    .replace(/\/$/, "");
+}
+
+function registryUrl(registry: string, name: string, version: string): string {
+  return `${registry.replace(/\/$/, "")}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
+}
+
+/** Verify that registry metadata represents the exact locally packed release. */
+export function npmReleaseMatches(
+  local: NpmReleaseIdentity,
+  published: NpmReleaseIdentity | undefined,
+): boolean {
+  if (!published) return false;
+  if (published.name !== local.name || published.version !== local.version) {
+    throw new Error(`Published npm identity does not match ${local.name}@${local.version}`);
+  }
+  const localRepository = normalizedRepository(local.repository);
+  const publishedRepository = normalizedRepository(published.repository);
+  if (localRepository && publishedRepository && localRepository !== publishedRepository) {
+    throw new Error(`Published npm repository does not match ${local.name}@${local.version}`);
+  }
+  if (
+    local.contentDigest &&
+    published.contentDigest &&
+    local.contentDigest !== published.contentDigest
+  ) {
+    throw new Error(`Published npm content does not match ${local.name}@${local.version}`);
+  }
+  if (
+    !(local.contentDigest && published.contentDigest) &&
+    local.integrity &&
+    published.integrity !== local.integrity
+  ) {
+    throw new Error(`Published npm integrity does not match ${local.name}@${local.version}`);
+  }
+  return true;
+}
+
+/** Read one published npm release identity, or `undefined` when it is absent. */
+export async function publishedNpmRelease(
+  name: string,
+  version: string,
+  registry = process.env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY,
+): Promise<NpmReleaseIdentity | undefined> {
+  const response = await fetch(registryUrl(registry, name, version), {
+    headers: { accept: "application/json" },
+  });
+  if (response.status === 404) return undefined;
+  if (!response.ok) {
+    throw new Error(`npm registry lookup failed for ${name}@${version}: ${response.status}`);
+  }
+  const metadata = (await response.json()) as {
+    dist?: { integrity?: string; tarball?: string };
+    name?: string;
+    repository?: unknown;
+    version?: string;
+  };
+  if (!metadata.name || !metadata.version) {
+    throw new Error(`npm registry returned an incomplete identity for ${name}@${version}`);
+  }
+  let contentDigest: string | undefined;
+  if (metadata.dist?.tarball) {
+    const archive = await fetch(metadata.dist.tarball);
+    if (!archive.ok) {
+      throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
+    }
+    const temp = mkdtempSync(join(tmpdir(), "projen-published-npm-"));
+    const path = join(temp, "package.tgz");
+    try {
+      writeFileSync(path, Buffer.from(await archive.arrayBuffer()));
+      contentDigest = npmArchiveContentDigest(path);
+    } finally {
+      rmSync(temp, { recursive: true, force: true });
+    }
+  }
+  return {
+    ...(contentDigest ? { contentDigest } : {}),
+    integrity: metadata.dist?.integrity,
+    name: metadata.name,
+    repository: metadata.repository,
+    version: metadata.version,
+  };
+}
+
+function readNpmArchiveManifest(path: string): NpmArchiveManifest {
+  const result = exec.spawnSync("tar", ["-xOf", path, "package/package.json"], {
+    cwd: process.cwd(),
+    stdout: "capture",
+    stderr: "capture",
+    stdin: "ignore",
+    check: false,
+  });
+  if (result.exitCode !== 0 || !result.stdout) {
+    throw new Error(`Cannot read npm package manifest from ${path}: ${result.stderr}`);
+  }
+  return JSON.parse(result.stdout) as NpmArchiveManifest;
+}
+
+/** Read and hash the release identity embedded in an npm archive. */
+export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
+  const manifest = readNpmArchiveManifest(path);
+  if (!manifest.name || !manifest.version) {
+    throw new Error(`npm archive has no package name or version: ${path}`);
+  }
+  const access = manifest.publishConfig?.access;
+  if (access !== undefined && access !== "public" && access !== "restricted") {
+    throw new Error(`npm archive has invalid publishConfig.access: ${String(access)}`);
+  }
+  return {
+    ...(access ? { access } : {}),
+    contentDigest: npmArchiveContentDigest(path),
+    integrity: `sha512-${createHash("sha512").update(readFileSync(path)).digest("base64")}`,
+    name: manifest.name,
+    repository: manifest.repository,
+    version: manifest.version,
+  };
+}
+
+function orderNpmArchives(archives: readonly string[]): string[] {
+  const byName = new Map(
+    archives.map((archive) => {
+      const manifest = readNpmArchiveManifest(archive);
+      if (!manifest.name) throw new Error(`npm archive has no package name: ${archive}`);
+      return [manifest.name, { archive, manifest }] as const;
+    }),
+  );
+  if (byName.size !== archives.length) throw new Error("Release contains duplicate npm packages");
+  const remaining = new Map(
+    [...byName].map(([name, value]) => [
+      name,
+      new Set(
+        [
+          ...Object.keys(value.manifest.dependencies ?? {}),
+          ...Object.keys(value.manifest.optionalDependencies ?? {}),
+        ].filter((dependency) => byName.has(dependency)),
+      ),
+    ]),
+  );
+  const ordered: string[] = [];
+  while (remaining.size > 0) {
+    const ready = [...remaining]
+      .filter(([, dependencies]) => dependencies.size === 0)
+      .map(([name]) => name)
+      .sort();
+    if (ready.length === 0) {
+      throw new Error(
+        `Cyclic npm release dependencies: ${[...remaining.keys()].sort().join(", ")}`,
+      );
+    }
+    for (const name of ready) {
+      ordered.push(byName.get(name)!.archive);
+      remaining.delete(name);
+    }
+    for (const dependencies of remaining.values()) {
+      for (const name of ready) dependencies.delete(name);
+    }
+  }
+  return ordered;
+}
+
+/** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
+export function npmArchiveContentDigest(path: string): string {
+  const temp = mkdtempSync(join(tmpdir(), "projen-npm-content-"));
+  try {
+    exec.spawnSync("tar", ["-xzf", path, "-C", temp], {
+      cwd: process.cwd(),
+      stdout: "ignore",
+      stderr: "capture",
+      stdin: "ignore",
+      check: true,
+    });
+    const hash = createHash("sha512");
+    const visit = (directory: string): void => {
+      for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) =>
+        a.name.localeCompare(b.name),
+      )) {
+        const entryPath = join(directory, entry.name);
+        const name = relative(temp, entryPath).split("\\").join("/");
+        const stat = lstatSync(entryPath);
+        hash.update(`${entry.isDirectory() ? "D" : entry.isSymbolicLink() ? "L" : "F"}\0`);
+        hash.update(`${name}\0${stat.mode & 0o111}\0`);
+        if (entry.isDirectory()) visit(entryPath);
+        else if (entry.isSymbolicLink()) hash.update(readlinkSync(entryPath));
+        else hash.update(readFileSync(entryPath));
+      }
+    };
+    visit(temp);
+    return `sha512-${hash.digest("base64")}`;
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+/** Pack one workspace package and optionally transform only its archived manifest. */
+export function packNpmPackage(
+  directory: string,
+  destination: string,
+  path = process.env.PATH ?? "",
+  transformManifest?: NpmArchiveManifestTransform,
+): string {
+  const executable = process.versions.bun ? process.execPath : "bun";
+  const manifest = join(directory, "package.json");
+  const originalManifest = readFileSync(manifest, "utf8");
+  const workspaceRoot = projectUtils.root(directory) ?? directory;
+  const workspaceManifest = JSON.parse(
+    readFileSync(join(workspaceRoot, "package.json"), "utf8"),
+  ) as Record<string, unknown>;
+  const packedManifest = `${JSON.stringify(
+    materializeWorkspaceManifest(
+      JSON.parse(originalManifest) as Record<string, unknown>,
+      workspaceManifest,
+    ),
+    null,
+    2,
+  )}\n`;
+  const manifestMode = lstatSync(manifest).mode & 0o777;
+  const restoreManifestMode = (manifestMode & 0o200) === 0;
+  const existingArchives = new Set(readdirSync(destination));
+  if (restoreManifestMode) chmodSync(manifest, manifestMode | 0o200);
+  try {
+    writeFileSync(manifest, packedManifest);
+    exec.spawnSync(
+      executable,
+      ["pm", "pack", "--destination", destination, "--ignore-scripts", "--quiet"],
+      {
+        cwd: directory,
+        env: { ...process.env, PATH: path },
+        stdout: "inherit",
+        stderr: "inherit",
+        stdin: "ignore",
+        check: true,
+      },
+    );
+  } finally {
+    writeFileSync(manifest, originalManifest);
+    if (restoreManifestMode) chmodSync(manifest, manifestMode);
+  }
+  const archives = readdirSync(destination).filter(
+    (file) => file.endsWith(".tgz") && !existingArchives.has(file),
+  );
+  if (archives.length !== 1) {
+    throw new Error(`Expected one packed npm archive, found ${archives.length}`);
+  }
+  const archive = join(destination, archives[0]);
+  if (!transformManifest) return archive;
+
+  const temp = mkdtempSync(join(tmpdir(), "projen-npm-project-"));
+  try {
+    exec.spawnSync("tar", ["-xzf", archive, "-C", temp], {
+      cwd: process.cwd(),
+      stdout: "ignore",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    });
+    const manifestPath = join(temp, "package", "package.json");
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as NpmArchiveManifest;
+    writeFileSync(manifestPath, `${JSON.stringify(transformManifest(manifest), null, 2)}\n`);
+    rmSync(archive, { force: true });
+    exec.spawnSync("tar", ["-czf", archive, "-C", temp, ...archiveFileEntries(temp)], {
+      cwd: process.cwd(),
+      stdout: "ignore",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    });
+    return archive;
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+/** Publish dependency-ordered npm archives, skipping only exact registry matches. */
+export async function publishNpmArchives(options: {
+  readonly directory: string;
+  readonly dryRun?: boolean;
+  readonly registry?: string;
+  readonly version?: string;
+}): Promise<void> {
+  const directory = resolve(options.directory);
+  const archives = orderNpmArchives(
+    readdirSync(directory)
+      .filter((file) => file.endsWith(".tgz"))
+      .sort()
+      .map((file) => join(directory, file)),
+  );
+  if (archives.length === 0) throw new Error(`No npm archives found in ${directory}`);
+
+  for (const archive of archives) {
+    const local = readNpmArchiveIdentity(archive);
+    if (options.version && local.version !== options.version) {
+      throw new Error(
+        `npm archive ${archive} carries ${local.version}, expected ${options.version}`,
+      );
+    }
+    if (!options.dryRun) {
+      const published = await publishedNpmRelease(local.name, local.version, options.registry);
+      if (npmReleaseMatches(local, published)) {
+        logger.info(`skip published ${local.name}@${local.version}`);
+        continue;
+      }
+    }
+    runTaskCommand(process.cwd(), "npm", [
+      "publish",
+      archive,
+      ...(local.access ? ["--access", local.access] : []),
+      ...(options.registry ? ["--registry", options.registry] : []),
+      ...(options.dryRun ? ["--dry-run"] : []),
+    ]);
+  }
+}
+
+/** Parse npm archive publication options and execute the publisher. */
+export async function main(): Promise<void> {
+  const program = new Command();
+  program
+    .requiredOption("--directory <path>", "Directory containing npm archives")
+    .option("--version <version>", "Expected npm release version")
+    .option("--registry <url>", "npm registry URL")
+    .option("--dry-run", "Validate archives without publishing")
+    .action(
+      (options: { directory: string; dryRun?: boolean; registry?: string; version?: string }) =>
+        publishNpmArchives(options),
+    );
+  await program.parseAsync();
+}
 
 if (import.meta.main) await main();

package/tasks/publish-python.ts

@@ -1,6 +1,227 @@
 #!/usr/bin/env -S bun
-import { main } from "./lib/publish-python.ts";
+/**
+ * Build selected uv workspace packages from isolated publication copies and
+ * optionally publish the resulting distributions.
+ */
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import * as projectUtils from "@dbx-tools/core/project-utils";
+import { Command } from "commander";
+import { parse, stringify } from "smol-toml";
+import { preparePythonProjectForPublication, pythonProjectInfo } from "./python-release.ts";
+import { runTaskCommand } from "../src/_task-command.ts";
 
-export * from "./lib/publish-python.ts";
+interface PythonProjectFile {
+  readonly directory: string;
+  readonly name: string;
+  readonly version: string;
+  readonly path: string;
+  readonly private: boolean;
+  readonly source: string;
+}
+
+/** Python wheel and source archives accepted by Twine and package indexes. */
+export function pythonDistributionPaths(directory: string): string[] {
+  return readdirSync(directory)
+    .filter((file) => file.endsWith(".whl") || file.endsWith(".tar.gz"))
+    .sort()
+    .map((file) => join(directory, file));
+}
+
+function removeTemporaryTree(root: string): void {
+  if (!existsSync(root)) return;
+  const makeWritable = (directory: string): void => {
+    chmodSync(directory, 0o700);
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isDirectory()) makeWritable(join(directory, entry.name));
+    }
+  };
+  makeWritable(root);
+  rmSync(root, { recursive: true, force: true });
+}
+
+function pythonProjects(root: string): PythonProjectFile[] {
+  const packageFiles = readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => resolve(root, entry.name, "pyproject.toml"))
+    .filter(existsSync)
+    .sort();
+  const allProjects: PythonProjectFile[] = packageFiles.map((path) => {
+    const source = readFileSync(path, "utf8");
+    const info = pythonProjectInfo(source, { parse });
+    return {
+      directory: basename(resolve(path, "..")),
+      name: info.name,
+      version: info.version,
+      path,
+      private: info.private,
+      source,
+    };
+  });
+  return allProjects;
+}
+
+export function publishPythonProjects(options: {
+  readonly dryRun?: boolean;
+  readonly indexUrl: string;
+  readonly publishUrl: string;
+  readonly root: string;
+  readonly version: string;
+}): void {
+  const root = resolve(options.root);
+  const workspace = projectUtils.root(root) ?? dirname(root);
+  const output = mkdtempSync(join(workspace, ".projen-python-publish-"));
+  try {
+    buildPythonProjects({ ...options, output });
+    runTaskCommand(
+      process.cwd(),
+      "uvx",
+      [
+        "--from",
+        "devpi-client",
+        "devpi",
+        "upload",
+        "--index",
+        options.publishUrl,
+        "--from-dir",
+        ...(options.dryRun ? ["--dry-run"] : []),
+        output,
+      ],
+      { env: { ...process.env, UV_DEFAULT_INDEX: options.indexUrl } },
+    );
+  } finally {
+    rmSync(output, { recursive: true, force: true });
+  }
+}
+
+/** Build the exact Python release distributions without publishing them. */
+export function buildPythonProjects(options: {
+  readonly allowEmpty?: boolean;
+  readonly output: string;
+  readonly packages?: readonly string[];
+  /** Place each package's artifacts in its directory beneath output. */
+  readonly packageDirectories?: boolean;
+  readonly root: string;
+  readonly version: string;
+}): void {
+  const root = resolve(options.root);
+  const output = resolve(options.output);
+  const workspace = projectUtils.root(root) ?? dirname(root);
+  const outputPath = relative(workspace, output);
+  if (!outputPath || outputPath.startsWith("..") || isAbsolute(outputPath)) {
+    throw new Error("Python release output must be a non-root directory inside the workspace");
+  }
+  rmSync(output, { recursive: true, force: true });
+  const allProjects = pythonProjects(root);
+  const requested = new Set(options.packages ?? []);
+  const missing = [...requested].filter(
+    (directory) => !allProjects.some((project) => project.directory === directory),
+  );
+  if (missing.length > 0) throw new Error(`Unknown Python packages: ${missing.join(", ")}`);
+  const projects = allProjects.filter(
+    (project) => !project.private && (requested.size === 0 || requested.has(project.directory)),
+  );
+  if (projects.length === 0 && options.allowEmpty) {
+    mkdirSync(output, { recursive: true });
+    return;
+  }
+  if (projects.length === 0) throw new Error(`No Python packages found under ${root}`);
+
+  const temporaryRoot = mkdtempSync(join(tmpdir(), "projen-python-release-"));
+  try {
+    mkdirSync(output, { recursive: true });
+    for (const project of projects) {
+      const packageRoot = join(temporaryRoot, project.directory);
+      cpSync(dirname(project.path), packageRoot, { recursive: true });
+      const manifestPath = join(packageRoot, "pyproject.toml");
+      chmodSync(manifestPath, 0o644);
+      writeFileSync(
+        manifestPath,
+        preparePythonProjectForPublication(project.source, {
+          packages: allProjects,
+          toml: { parse, stringify },
+          version: options.version,
+        }),
+      );
+      const packageOutput = options.packageDirectories ? join(output, project.directory) : output;
+      runTaskCommand(root, "uv", ["build", "--out-dir", packageOutput, packageRoot]);
+      if (pythonDistributionPaths(packageOutput).length === 0) {
+        throw new Error(`No Python distributions found for ${project.name}`);
+      }
+    }
+    const distributions = options.packageDirectories
+      ? projects.flatMap((project) => pythonDistributionPaths(join(output, project.directory)))
+      : pythonDistributionPaths(output);
+    if (distributions.length === 0) {
+      throw new Error(`No Python distributions found in ${output}`);
+    }
+    runTaskCommand(process.cwd(), "uvx", ["twine", "check", ...distributions]);
+  } finally {
+    removeTemporaryTree(temporaryRoot);
+  }
+}
+
+export async function main(): Promise<void> {
+  const program = new Command();
+  program
+    .argument("<version>", "Python package version")
+    .option("--index-url <url>", "devpi Simple API URL")
+    .option("--publish-url <url>", "devpi writable index URL")
+    .option("--root <path>", "Python workspace package root", "packages/py")
+    .option("--package <directory...>", "Build only selected package directories")
+    .option("--output <path>", "Build distributions into a directory without publishing")
+    .option(
+      "--package-directories",
+      "Keep each package's distributions in its own output directory",
+    )
+    .option("--dry-run", "build and inspect distributions without uploading")
+    .action(
+      (
+        version: string,
+        options: {
+          dryRun?: boolean;
+          indexUrl?: string;
+          package?: string[];
+          packageDirectories?: boolean;
+          publishUrl?: string;
+          root: string;
+          output?: string;
+        },
+      ) => {
+        if (options.output) {
+          buildPythonProjects({
+            output: options.output,
+            packages: options.package,
+            packageDirectories: options.packageDirectories,
+            root: options.root,
+            version,
+          });
+        } else {
+          if (!options.indexUrl || !options.publishUrl) {
+            throw new Error("--index-url and --publish-url are required when publishing");
+          }
+          publishPythonProjects({
+            dryRun: options.dryRun,
+            indexUrl: options.indexUrl,
+            publishUrl: options.publishUrl,
+            root: options.root,
+            version,
+          });
+        }
+      },
+    );
+  await program.parseAsync();
+}
 
 if (import.meta.main) await main();