@dbx-tools/projen 0.9.5 → 0.9.6

package/src/projen-version.ts

@@ -0,0 +1,9 @@
+/**
+ * Co-tested Projen release used by the engine and every generated project.
+ *
+ * The engine exposes Projen as a peer dependency so consumers and generated
+ * projects share one runtime instance. Keep the peer range and generated
+ * development dependency on this single value; duplicate Projen instances can
+ * break its remaining `instanceof`-based file detection.
+ */
+export const PROJEN_VERSION = "^0.103.27";

package/src/publish.ts

@@ -148,10 +148,9 @@ export function applyCompiledPublish(pkg: javascript.NodeProject): void {
   const config = publishConfig(pkg);
   if (config) pkg.package.addField("publishConfig", config);
 
-  // The release workflow publishes straight after `bun install`, with no build
-  // in between, so the compiled output has to be produced by the pack itself
-  // rather than assumed present. This also covers a bare `pnpm pack` and the
-  // bump task's local-registry publish.
+  // The workspace publisher compiles every selected package once and disables
+  // lifecycle scripts while packing. Keep `prepack` for a standalone package
+  // publish that did not pass through that workspace-level build.
   if (!pkg.tasks.tryFind("prepack")) {
     pkg.addTask("prepack", { description: "Compile before packing the published tarball" });
   }

package/src/release-catalog.ts

@@ -9,8 +9,8 @@
  * @module
  */
 
-import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { basename, join, relative, resolve } from "node:path";
 import { Component, JsonFile, type Project } from "projen";

package/src/release.ts

@@ -188,6 +188,12 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           "fetch-depth": 2,
         },
       },
+      {
+        name: "Setup Bun",
+        uses: "oven-sh/setup-bun@v2",
+        with: { "bun-version": BUN_VERSION },
+      },
+      { name: "Install release validation dependencies", run: "bun install --frozen-lockfile" },
       {
         name: "Verify release context",
         id: "release",
@@ -206,7 +212,7 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           '  RELEASE_SHA="$GITHUB_SHA"',
           '  test "$(git rev-parse HEAD)" = "$RELEASE_SHA"',
           "  RELEASE_VERSION=\"$(tr -d '\\r\\n' < VERSION)\"",
-          '  [[ "$RELEASE_VERSION" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+$ ]]',
+          '  bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"',
           '  PREVIOUS_VERSION="$(git show "$RELEASE_SHA^:VERSION" | tr -d \'\\r\\n\')"',
           '  test "$PREVIOUS_VERSION" != "$RELEASE_VERSION"',
           `  RELEASE_TAG="${tagPrefix}$RELEASE_VERSION"`,
@@ -216,16 +222,7 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           '    test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$RELEASE_SHA"',
           "  else",
           "    git fetch --force --tags origin",
-          '    LATEST_VERSION=""',
-          `    for TAG in $(git tag --list '${tagPrefix}*' '*-${tagPrefix}*'); do`,
-          `      if [[ "$TAG" == ${tagPrefix}* ]]; then CANDIDATE="\${TAG#${tagPrefix}}"; else CANDIDATE="\${TAG##*-${tagPrefix}}"; fi`,
-          '      if [[ "$CANDIDATE" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+$ ]]; then',
-          '        if [ -z "$LATEST_VERSION" ] || node -e \'const a=process.argv[1].split(".").map(Number); const b=process.argv[2].split(".").map(Number); process.exit(b[0]>a[0] || b[0]===a[0] && (b[1]>a[1] || b[1]===a[1] && b[2]>a[2]) ? 0 : 1)\' "$LATEST_VERSION" "$CANDIDATE"; then LATEST_VERSION="$CANDIDATE"; fi',
-          "      fi",
-          "    done",
-          '    if [ -n "$LATEST_VERSION" ]; then',
-          '      node -e \'const a=process.argv[1].split(".").map(Number); const b=process.argv[2].split(".").map(Number); if (!(b[0]>a[0] || b[0]===a[0] && (b[1]>a[1] || b[1]===a[1] && b[2]>a[2]))) process.exit(1)\' "$LATEST_VERSION" "$RELEASE_VERSION"',
-          "    fi",
+          `    bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION" --prefix ${JSON.stringify(tagPrefix)} --assert-next`,
           '    git config user.name "github-actions[bot]"',
           '    git config user.email "41898282+github-actions[bot]@users.noreply.github.com"',
           '    git tag -a "$RELEASE_TAG" "$RELEASE_SHA" -m "$RELEASE_TAG"',
@@ -233,6 +230,8 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           "  fi",
           "else",
           `  case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac`,
+          `  RELEASE_VERSION="\${RELEASE_TAG#${tagPrefix}}"`,
+          '  bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"',
           '  git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
           '  test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
           '  RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"',
@@ -245,7 +244,7 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           "fi",
           'echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"',
           'echo "expected_sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"',
-          `echo "release_version=\${RELEASE_TAG#${tagPrefix}}" >> "$GITHUB_OUTPUT"`,
+          'echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"',
         ].join("\n"),
       },
       {

package/src/scaffold.ts

@@ -2,7 +2,7 @@
  * Runs a projen re-synth, for the `sync` task and its watchers.
  */
 import { join } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { repoRoot } from "./packages.ts";
 
 /**

package/src/uniffi.ts

@@ -31,6 +31,13 @@ export const makeDefaultedInterfaceParametersOptional = (source: string): string
   );
 };
 
+/** Remove UBRN's obsolete `*Interface` aliases once the `*Like` owner exists. */
+export const removeObsoleteInterfaceAliases = (source: string): string =>
+  source.replace(
+    /\n\/\*\*\n \* @deprecated Use `\w+Like` instead\.\n \*\/\nexport type \w+Interface = \w+Like;\n/g,
+    "\n",
+  );
+
 export interface TypeScriptBindingModule {
   readonly specifier: string;
   readonly source: string;

package/src/watch.ts

@@ -17,7 +17,7 @@
  */
 import { isAbsolute, resolve } from "node:path";
 import { watch as pathWatch } from "@dbx-tools/path";
-import { async, log } from "@dbx-tools/shared-core";
+import { asyncUtils, log } from "@dbx-tools/shared-core";
 import { isGeneratedFile, recordedRoots, repoRoot } from "./packages.ts";
 
 const logger = log.logger("projen:watch");
@@ -132,7 +132,7 @@ export function watchLoop(
     if (closing) return;
     closing = true;
     clearTimeout(timer);
-    await Promise.race([watcher.close().catch(() => {}), async.sleep(CLOSE_GRACE_MS)]);
+    await Promise.race([watcher.close().catch(() => {}), asyncUtils.sleep(CLOSE_GRACE_MS)]);
     process.exit(code);
   }
 

package/src/workspace-version.ts

@@ -17,7 +17,8 @@
  */
 import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { exec } from "@dbx-tools/core";
+import { parse as parseVersion } from "semver";
+import { captureTaskCommand } from "./_task-command.ts";
 
 /** Name of the repo-root file holding the workspace version. */
 export const VERSION_FILE = "VERSION";
@@ -33,10 +34,20 @@ export type Semver = [number, number, number];
 /** Supported semantic release increments. */
 export type VersionLevel = "patch" | "minor" | "major";
 
-/** Parse `x.y.z` (ignoring any leading `v`/prefix), or `undefined` when it does not match. */
+/** Parse an exact stable `x.y.z`, or `undefined` for prefixes, prereleases, or embedded versions. */
 export function parseSemver(raw: string): Semver | undefined {
-  const m = /(\d+)\.(\d+)\.(\d+)/.exec(raw.trim());
-  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : undefined;
+  const value = raw.trim();
+  if (!SEMVER.test(value)) return undefined;
+  const parsed = parseVersion(value);
+  if (
+    !parsed ||
+    parsed.version !== value ||
+    parsed.prerelease.length > 0 ||
+    parsed.build.length > 0
+  ) {
+    return undefined;
+  }
+  return [parsed.major, parsed.minor, parsed.patch];
 }
 
 /** Ordering comparator: negative when `a < b`, positive when `a > b`, zero when equal. */
@@ -66,7 +77,7 @@ export function readWorkspaceVersion(root: string): string {
   const path = versionPath(root);
   if (!existsSync(path)) return DEFAULT_VERSION;
   const raw = readFileSync(path, "utf8").trim();
-  if (!SEMVER.test(raw)) {
+  if (!parseSemver(raw)) {
     throw new Error(`${VERSION_FILE} must contain an x.y.z version, got ${JSON.stringify(raw)}`);
   }
   return raw;
@@ -74,7 +85,7 @@ export function readWorkspaceVersion(root: string): string {
 
 /** Write the workspace version to `<root>/VERSION`. Only `bump` and bootstrap call this. */
 export function writeWorkspaceVersion(root: string, version: string): void {
-  if (!SEMVER.test(version)) {
+  if (!parseSemver(version)) {
     throw new Error(`workspace version must be x.y.z, got ${JSON.stringify(version)}`);
   }
   writeFileSync(versionPath(root), `${version}\n`);
@@ -107,14 +118,7 @@ export function syncWorkspaceManifestVersion(manifestPath: string, version: stri
 /** Run git in `cwd`, capturing stdout and swallowing failure (offline, no repo). */
 function gitCapture(cwd: string, args: string[]): string {
   try {
-    const res = exec.spawnSync("git", args, {
-      cwd,
-      stdout: "capture",
-      stderr: "ignore",
-      stdin: "ignore",
-      check: false,
-    });
-    return res.stdout?.trim() ?? "";
+    return captureTaskCommand(cwd, "git", args);
   } catch {
     return "";
   }
@@ -131,7 +135,8 @@ export function latestTagVersion(cwd: string, prefix: string): Semver | undefine
     `${prefix}*`,
   ]);
   for (const tag of out.split("\n")) {
-    const v = parseSemver(tag.replace(prefix, ""));
+    if (!tag.startsWith(prefix)) continue;
+    const v = parseSemver(tag.slice(prefix.length));
     if (v) return v;
   }
   return undefined;

package/tasks/barrels.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S bun
 import { sep } from "node:path";
 import { parseArgs } from "node:util";
-import { log, string } from "@dbx-tools/shared-core";
+import { log, stringUtils } from "@dbx-tools/shared-core";
 import { generateBarrels } from "../src/barrels.ts";
 import { recordedPackages } from "../src/packages.ts";
 import { watchLoop, watchRoots } from "../src/watch.ts";
@@ -43,14 +43,14 @@ if (values.watch) {
     if (dirs.size === 0) {
       if (unowned.length) {
         logger.warn(
-          `no recorded package owns ${string.pluralize(unowned.length, "change")}; ` +
+          `no recorded package owns ${stringUtils.pluralize(unowned.length, "change")}; ` +
             "run `bun run default` (or touch .projenrc.ts) to pick up a new package folder",
         );
       }
       return;
     }
     const n = generateBarrels({ dirs: [...dirs] });
-    if (n) logger.success(`rebuilt ${string.pluralize(n, "barrel")}`);
+    if (n) logger.success(`rebuilt ${stringUtils.pluralize(n, "barrel")}`);
   });
 } else {
   const dirs = Array.isArray(values.dir)
@@ -58,6 +58,6 @@ if (values.watch) {
     : [];
   const n = generateBarrels(dirs.length ? { dirs } : undefined);
   logger.success(
-    n === 0 ? "barrels already up to date" : `updated ${string.pluralize(n, "barrel")}`,
+    n === 0 ? "barrels already up to date" : `updated ${stringUtils.pluralize(n, "barrel")}`,
   );
 }

package/tasks/build-rust-release.ts

@@ -0,0 +1,68 @@
+#!/usr/bin/env -S bun
+/** Bundle the owning Rust release helper source into a standalone Node module. */
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import * as exec from "@dbx-tools/core/exec";
+
+const root = resolve(import.meta.dirname, "..");
+const temporary = mkdtempSync(join(tmpdir(), "dbx-rust-release-bundle-"));
+try {
+  const bundled = join(temporary, "rust-release.mjs");
+  const declarations = join(temporary, "declarations");
+  exec.spawnSync(
+    process.execPath,
+    [
+      "build",
+      resolve(root, "src/_rust-release.ts"),
+      "--target=node",
+      "--format=esm",
+      `--outfile=${bundled}`,
+    ],
+    {
+      cwd: root,
+      stdout: "inherit",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    },
+  );
+  const output = resolve(root, "tasks/rust-release.mjs");
+  const source = readFileSync(bundled, "utf8");
+  writeFileSync(
+    output,
+    `#!/usr/bin/env node\n// GENERATED from src/_rust-release.ts by tasks/build-rust-release.ts.\n${source.replace(/^#![^\n]*\n/, "")}`,
+  );
+  chmodSync(output, 0o755);
+  exec.spawnSync(
+    "bunx",
+    [
+      "tsc",
+      resolve(root, "src/_rust-release.ts"),
+      "--declaration",
+      "--emitDeclarationOnly",
+      "--module",
+      "ESNext",
+      "--moduleResolution",
+      "Bundler",
+      "--target",
+      "ES2022",
+      "--skipLibCheck",
+      "--outDir",
+      declarations,
+    ],
+    {
+      cwd: root,
+      stdout: "inherit",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    },
+  );
+  writeFileSync(
+    resolve(root, "tasks/rust-release.d.ts"),
+    readFileSync(join(declarations, "_rust-release.d.ts")),
+  );
+} finally {
+  rmSync(temporary, { recursive: true, force: true });
+}

package/tasks/bump.ts

@@ -4,7 +4,8 @@
  * generated version surface. This task has no git, registry, or publication
  * side effects; release preparation owns those operations.
  */
-import { exec, project } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
+import * as projectUtils from "@dbx-tools/core/project-utils";
 import { log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 import {
@@ -36,7 +37,7 @@ program
       arch: ReleaseArch[];
       synth: boolean;
     }) => {
-      const root = project.root() ?? process.cwd();
+      const root = projectUtils.root() ?? process.cwd();
       const next = resolveNextVersion(root, [opts.prefix], opts.level);
       const releasePlatforms = releasePlatformFilter(opts.os, opts.arch);
 

package/tasks/clean.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env -S bun
 import { relative } from "node:path";
-import { log, string } from "@dbx-tools/shared-core";
+import { log, stringUtils } from "@dbx-tools/shared-core";
 import { listGeneratedFiles, listNodeModulesDirs, removePaths } from "../src/clean.ts";
 import { repoRoot, toPosix } from "../src/packages.ts";
 
@@ -24,7 +24,7 @@ const regenHint = (removedNodeModules: boolean): string =>
 if (yes) {
   const n = removePaths(targets);
   logger.success(
-    `removed ${string.pluralize(n, "path")} (${files.length} generated + ${nodeModules.length} node_modules) - ${regenHint(nodeModules.length > 0)}`,
+    `removed ${stringUtils.pluralize(n, "path")} (${files.length} generated + ${nodeModules.length} node_modules) - ${regenHint(nodeModules.length > 0)}`,
   );
   process.exit(0);
 }
@@ -64,4 +64,4 @@ if (picked.length === 0) {
 
 const removedNodeModules = picked.some((p) => nodeModules.includes(p));
 const n = removePaths(picked);
-clack.outro(`removed ${string.pluralize(n, "path")} - ${regenHint(removedNodeModules)}`);
+clack.outro(`removed ${stringUtils.pluralize(n, "path")} - ${regenHint(removedNodeModules)}`);

package/tasks/local-publish.ts

@@ -3,7 +3,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { exec, project } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
+import * as projectUtils from "@dbx-tools/core/project-utils";
 import { log, net } from "@dbx-tools/shared-core";
 import { activePythonIndexes, resolveLocalPypi } from "./python-registry.ts";
 import { readDbxToolsConfig } from "../src/packages.ts";
@@ -18,13 +19,15 @@ export interface LocalPublishOptions {
   readonly localPypi: string;
   readonly pythonRoot?: string;
   readonly localCargo: boolean;
+  /** Reuse the root TypeScript compile that immediately preceded local publication. */
+  readonly reuseValidatedNodeCompile?: boolean;
 }
 
 function resolveLocalRegistry(value: string): string | undefined {
   const trimmed = value.trim();
   if (!trimmed || trimmed.toLowerCase() === "false") return undefined;
   if (trimmed.toLowerCase() === "auto") {
-    const registry = project.npmRegistry();
+    const registry = projectUtils.npmRegistry();
     return registry && net.isLoopbackHost(registry) ? registry.href : undefined;
   }
   return trimmed;
@@ -45,6 +48,21 @@ function localCargoRegistry(): string | undefined {
   return undefined;
 }
 
+/** Arguments for the workspace npm publisher used by local release preflight. */
+export function localNodePublishArguments(
+  publishScript: string,
+  options: Pick<LocalPublishOptions, "version" | "reuseValidatedNodeCompile">,
+  registry: string,
+): string[] {
+  return [
+    publishScript,
+    options.version,
+    "--registry",
+    registry,
+    ...(options.reuseValidatedNodeCompile ? ["--skip-compile"] : []),
+  ];
+}
+
 /** Publish the exact release candidate to local npm, PyPI, and Cargo mirrors. */
 export async function publishLocalRelease(options: LocalPublishOptions): Promise<void> {
   const localRegistry = resolveLocalRegistry(options.localRegistry);
@@ -68,7 +86,7 @@ export async function publishLocalRelease(options: LocalPublishOptions): Promise
     logger.info(`publishing ${options.version} to local registry ${localRegistry}`);
     localPublishes.push(
       exec
-        .spawn(process.execPath, [publishScript, options.version, "--registry", localRegistry], {
+        .spawn(process.execPath, localNodePublishArguments(publishScript, options, localRegistry), {
           cwd: options.root,
           stdout: "inherit",
           stderr: "inherit",

package/tasks/openapi.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env -S bun
-import { log, string } from "@dbx-tools/shared-core";
+import { log, stringUtils } from "@dbx-tools/shared-core";
 import { generateBarrels } from "../src/barrels.ts";
 import { generateOpenapi, isTsoaController } from "../src/openapi.ts";
 import { runSynth } from "../src/scaffold.ts";
@@ -16,7 +16,7 @@ if (process.argv.includes("--watch")) {
     const dirs = await generateOpenapi();
     if (dirs.length) {
       generateBarrels({ dirs });
-      logger.success(`regenerated openapi (${string.pluralize(dirs.length, "package")})`);
+      logger.success(`regenerated openapi (${stringUtils.pluralize(dirs.length, "package")})`);
     }
   });
 } else {

package/tasks/publish-npm.ts

@@ -12,14 +12,15 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, relative, resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 
 const DEFAULT_REGISTRY = "https://registry.npmjs.org";
-const logger = log.logger("dbx-tools:publish-npm");
+const logger = log.logger("projen:publish-npm");
 
 export interface NpmReleaseIdentity {
+  readonly access?: "public" | "restricted";
   readonly contentDigest?: string;
   readonly integrity?: string;
   readonly name: string;
@@ -101,7 +102,7 @@ export async function publishedNpmRelease(
     if (!archive.ok) {
       throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
     }
-    const temp = mkdtempSync(join(tmpdir(), "dbx-tools-published-npm-"));
+    const temp = mkdtempSync(join(tmpdir(), "projen-published-npm-"));
     const path = join(temp, "package.tgz");
     try {
       writeFileSync(path, Buffer.from(await archive.arrayBuffer()));
@@ -132,13 +133,19 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
   }
   const manifest = JSON.parse(result.stdout) as {
     name?: string;
+    publishConfig?: { access?: unknown };
     repository?: unknown;
     version?: string;
   };
   if (!manifest.name || !manifest.version) {
     throw new Error(`npm archive has no package name or version: ${path}`);
   }
+  const access = manifest.publishConfig?.access;
+  if (access !== undefined && access !== "public" && access !== "restricted") {
+    throw new Error(`npm archive has invalid publishConfig.access: ${String(access)}`);
+  }
   return {
+    ...(access ? { access } : {}),
     contentDigest: npmArchiveContentDigest(path),
     integrity: `sha512-${createHash("sha512").update(readFileSync(path)).digest("base64")}`,
     name: manifest.name,
@@ -149,7 +156,7 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
 
 /** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
 export function npmArchiveContentDigest(path: string): string {
-  const temp = mkdtempSync(join(tmpdir(), "dbx-tools-npm-content-"));
+  const temp = mkdtempSync(join(tmpdir(), "projen-npm-content-"));
   try {
     exec.spawnSync("tar", ["-xzf", path, "-C", temp], {
       cwd: process.cwd(),
@@ -237,8 +244,7 @@ export async function publishNpmArchives(options: {
       [
         "publish",
         archive,
-        "--access",
-        "public",
+        ...(local.access ? ["--access", local.access] : []),
         ...(options.registry ? ["--registry", options.registry] : []),
         ...(options.dryRun ? ["--dry-run"] : []),
       ],

package/tasks/publish-python.ts

@@ -11,7 +11,7 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, join, resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { Command } from "commander";
 import { parse, stringify } from "smol-toml";
 import { pythonProjectInfo, stampPythonProject } from "./uniffi-python.js";
@@ -111,7 +111,7 @@ export function publishPythonProjects(options: {
   readonly plan?: ReleasePlan;
 }): void {
   const root = resolve(options.root);
-  const output = mkdtempSync(join(tmpdir(), "dbx-tools-python-publish-"));
+  const output = mkdtempSync(join(tmpdir(), "projen-python-publish-"));
   const planned = new Map(
     options.plan?.pythonPackages.map((pkg) => [pkg.path.replace(/^.*\//, ""), pkg.version]) ?? [],
   );

package/tasks/publish-uniffi-local.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env -S bun
-import { spawnSync } from "node:child_process";
 import { chmodSync, existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -7,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { log } from "@dbx-tools/shared-core";
 import { parse, stringify } from "smol-toml";
+import { captureTaskCommand, runTaskCommand, taskCommandSucceeds } from "../src/_task-command.ts";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import type { RustBindingMapping, RustWorkspaceMapping } from "../src/project-rs.ts";
 
@@ -22,17 +22,13 @@ const parsed = parseArgs({
 });
 
 function run(command: string, args: string[], capture = false): string {
-  const result = spawnSync(command, args, {
-    cwd: repoRoot,
-    encoding: capture ? "utf8" : undefined,
-    stdio: capture ? "pipe" : "inherit",
-  });
-  if (result.status !== 0) throw new Error(`${command} exited with ${result.status}`);
-  return capture ? String(result.stdout).trim() : "";
+  if (capture) return captureTaskCommand(repoRoot, command, args, { check: true });
+  runTaskCommand(repoRoot, command, args);
+  return "";
 }
 
 function commandAvailable(command: string): boolean {
-  return spawnSync(command, ["--version"], { stdio: "ignore" }).status === 0;
+  return taskCommandSucceeds(repoRoot, command, ["--version"]);
 }
 
 function rustHost(): string {
@@ -90,12 +86,12 @@ function artifacts(directory: string, suffix: string): string[] {
 }
 
 function cargoVersionExists(crateName: string, version: string, registry: string): boolean {
-  return (
-    spawnSync("cargo", ["info", `${crateName}@${version}`, "--registry", registry], {
-      cwd: repoRoot,
-      stdio: "ignore",
-    }).status === 0
-  );
+  return taskCommandSucceeds(repoRoot, "cargo", [
+    "info",
+    `${crateName}@${version}`,
+    "--registry",
+    registry,
+  ]);
 }
 
 function publishCargo(config: RustWorkspaceMapping, registry: string, version: string): void {