@dbx-tools/projen 0.9.5 → 0.9.7

package/tasks/barrels.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S bun
 import { sep } from "node:path";
 import { parseArgs } from "node:util";
-import { log, string } from "@dbx-tools/shared-core";
+import { log, stringUtils } from "@dbx-tools/shared-core";
 import { generateBarrels } from "../src/barrels.ts";
 import { recordedPackages } from "../src/packages.ts";
 import { watchLoop, watchRoots } from "../src/watch.ts";
@@ -43,14 +43,14 @@ if (values.watch) {
     if (dirs.size === 0) {
       if (unowned.length) {
         logger.warn(
-          `no recorded package owns ${string.pluralize(unowned.length, "change")}; ` +
+          `no recorded package owns ${stringUtils.pluralize(unowned.length, "change")}; ` +
             "run `bun run default` (or touch .projenrc.ts) to pick up a new package folder",
         );
       }
       return;
     }
     const n = generateBarrels({ dirs: [...dirs] });
-    if (n) logger.success(`rebuilt ${string.pluralize(n, "barrel")}`);
+    if (n) logger.success(`rebuilt ${stringUtils.pluralize(n, "barrel")}`);
   });
 } else {
   const dirs = Array.isArray(values.dir)
@@ -58,6 +58,6 @@ if (values.watch) {
     : [];
   const n = generateBarrels(dirs.length ? { dirs } : undefined);
   logger.success(
-    n === 0 ? "barrels already up to date" : `updated ${string.pluralize(n, "barrel")}`,
+    n === 0 ? "barrels already up to date" : `updated ${stringUtils.pluralize(n, "barrel")}`,
   );
 }

package/tasks/build-rust-release.ts

@@ -0,0 +1,68 @@
+#!/usr/bin/env -S bun
+/** Bundle the owning Rust release helper source into a standalone Node module. */
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import * as exec from "@dbx-tools/core/exec";
+
+const root = resolve(import.meta.dirname, "..");
+const temporary = mkdtempSync(join(tmpdir(), "dbx-rust-release-bundle-"));
+try {
+  const bundled = join(temporary, "rust-release.mjs");
+  const declarations = join(temporary, "declarations");
+  exec.spawnSync(
+    process.execPath,
+    [
+      "build",
+      resolve(root, "src/_rust-release.ts"),
+      "--target=node",
+      "--format=esm",
+      `--outfile=${bundled}`,
+    ],
+    {
+      cwd: root,
+      stdout: "inherit",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    },
+  );
+  const output = resolve(root, "tasks/rust-release.mjs");
+  const source = readFileSync(bundled, "utf8");
+  writeFileSync(
+    output,
+    `#!/usr/bin/env node\n// GENERATED from src/_rust-release.ts by tasks/build-rust-release.ts.\n${source.replace(/^#![^\n]*\n/, "")}`,
+  );
+  chmodSync(output, 0o755);
+  exec.spawnSync(
+    "bunx",
+    [
+      "tsc",
+      resolve(root, "src/_rust-release.ts"),
+      "--declaration",
+      "--emitDeclarationOnly",
+      "--module",
+      "ESNext",
+      "--moduleResolution",
+      "Bundler",
+      "--target",
+      "ES2022",
+      "--skipLibCheck",
+      "--outDir",
+      declarations,
+    ],
+    {
+      cwd: root,
+      stdout: "inherit",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    },
+  );
+  writeFileSync(
+    resolve(root, "tasks/rust-release.d.ts"),
+    readFileSync(join(declarations, "_rust-release.d.ts")),
+  );
+} finally {
+  rmSync(temporary, { recursive: true, force: true });
+}

package/tasks/bump.ts

@@ -4,7 +4,8 @@
  * generated version surface. This task has no git, registry, or publication
  * side effects; release preparation owns those operations.
  */
-import { exec, project } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
+import * as projectUtils from "@dbx-tools/core/project-utils";
 import { log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 import {
@@ -36,7 +37,7 @@ program
       arch: ReleaseArch[];
       synth: boolean;
     }) => {
-      const root = project.root() ?? process.cwd();
+      const root = projectUtils.root() ?? process.cwd();
       const next = resolveNextVersion(root, [opts.prefix], opts.level);
       const releasePlatforms = releasePlatformFilter(opts.os, opts.arch);
 

package/tasks/clean.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env -S bun
 import { relative } from "node:path";
-import { log, string } from "@dbx-tools/shared-core";
+import { log, stringUtils } from "@dbx-tools/shared-core";
 import { listGeneratedFiles, listNodeModulesDirs, removePaths } from "../src/clean.ts";
 import { repoRoot, toPosix } from "../src/packages.ts";
 
@@ -24,7 +24,7 @@ const regenHint = (removedNodeModules: boolean): string =>
 if (yes) {
   const n = removePaths(targets);
   logger.success(
-    `removed ${string.pluralize(n, "path")} (${files.length} generated + ${nodeModules.length} node_modules) - ${regenHint(nodeModules.length > 0)}`,
+    `removed ${stringUtils.pluralize(n, "path")} (${files.length} generated + ${nodeModules.length} node_modules) - ${regenHint(nodeModules.length > 0)}`,
   );
   process.exit(0);
 }
@@ -64,4 +64,4 @@ if (picked.length === 0) {
 
 const removedNodeModules = picked.some((p) => nodeModules.includes(p));
 const n = removePaths(picked);
-clack.outro(`removed ${string.pluralize(n, "path")} - ${regenHint(removedNodeModules)}`);
+clack.outro(`removed ${stringUtils.pluralize(n, "path")} - ${regenHint(removedNodeModules)}`);

package/tasks/local-publish.ts

@@ -3,7 +3,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { exec, project } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
+import * as projectUtils from "@dbx-tools/core/project-utils";
 import { log, net } from "@dbx-tools/shared-core";
 import { activePythonIndexes, resolveLocalPypi } from "./python-registry.ts";
 import { readDbxToolsConfig } from "../src/packages.ts";
@@ -18,13 +19,15 @@ export interface LocalPublishOptions {
   readonly localPypi: string;
   readonly pythonRoot?: string;
   readonly localCargo: boolean;
+  /** Reuse the root TypeScript compile that immediately preceded local publication. */
+  readonly reuseValidatedNodeCompile?: boolean;
 }
 
 function resolveLocalRegistry(value: string): string | undefined {
   const trimmed = value.trim();
   if (!trimmed || trimmed.toLowerCase() === "false") return undefined;
   if (trimmed.toLowerCase() === "auto") {
-    const registry = project.npmRegistry();
+    const registry = projectUtils.npmRegistry();
     return registry && net.isLoopbackHost(registry) ? registry.href : undefined;
   }
   return trimmed;
@@ -45,6 +48,21 @@ function localCargoRegistry(): string | undefined {
   return undefined;
 }
 
+/** Arguments for the workspace npm publisher used by local release preflight. */
+export function localNodePublishArguments(
+  publishScript: string,
+  options: Pick<LocalPublishOptions, "version" | "reuseValidatedNodeCompile">,
+  registry: string,
+): string[] {
+  return [
+    publishScript,
+    options.version,
+    "--registry",
+    registry,
+    ...(options.reuseValidatedNodeCompile ? ["--skip-compile"] : []),
+  ];
+}
+
 /** Publish the exact release candidate to local npm, PyPI, and Cargo mirrors. */
 export async function publishLocalRelease(options: LocalPublishOptions): Promise<void> {
   const localRegistry = resolveLocalRegistry(options.localRegistry);
@@ -68,7 +86,7 @@ export async function publishLocalRelease(options: LocalPublishOptions): Promise
     logger.info(`publishing ${options.version} to local registry ${localRegistry}`);
     localPublishes.push(
       exec
-        .spawn(process.execPath, [publishScript, options.version, "--registry", localRegistry], {
+        .spawn(process.execPath, localNodePublishArguments(publishScript, options, localRegistry), {
           cwd: options.root,
           stdout: "inherit",
           stderr: "inherit",

package/tasks/openapi.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env -S bun
-import { log, string } from "@dbx-tools/shared-core";
+import { log, stringUtils } from "@dbx-tools/shared-core";
 import { generateBarrels } from "../src/barrels.ts";
 import { generateOpenapi, isTsoaController } from "../src/openapi.ts";
 import { runSynth } from "../src/scaffold.ts";
@@ -16,7 +16,7 @@ if (process.argv.includes("--watch")) {
     const dirs = await generateOpenapi();
     if (dirs.length) {
       generateBarrels({ dirs });
-      logger.success(`regenerated openapi (${string.pluralize(dirs.length, "package")})`);
+      logger.success(`regenerated openapi (${stringUtils.pluralize(dirs.length, "package")})`);
     }
   });
 } else {

package/tasks/publish-npm.ts

@@ -12,14 +12,15 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, relative, resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 
 const DEFAULT_REGISTRY = "https://registry.npmjs.org";
-const logger = log.logger("dbx-tools:publish-npm");
+const logger = log.logger("projen:publish-npm");
 
 export interface NpmReleaseIdentity {
+  readonly access?: "public" | "restricted";
   readonly contentDigest?: string;
   readonly integrity?: string;
   readonly name: string;
@@ -101,7 +102,7 @@ export async function publishedNpmRelease(
     if (!archive.ok) {
       throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
     }
-    const temp = mkdtempSync(join(tmpdir(), "dbx-tools-published-npm-"));
+    const temp = mkdtempSync(join(tmpdir(), "projen-published-npm-"));
     const path = join(temp, "package.tgz");
     try {
       writeFileSync(path, Buffer.from(await archive.arrayBuffer()));
@@ -132,13 +133,19 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
   }
   const manifest = JSON.parse(result.stdout) as {
     name?: string;
+    publishConfig?: { access?: unknown };
     repository?: unknown;
     version?: string;
   };
   if (!manifest.name || !manifest.version) {
     throw new Error(`npm archive has no package name or version: ${path}`);
   }
+  const access = manifest.publishConfig?.access;
+  if (access !== undefined && access !== "public" && access !== "restricted") {
+    throw new Error(`npm archive has invalid publishConfig.access: ${String(access)}`);
+  }
   return {
+    ...(access ? { access } : {}),
     contentDigest: npmArchiveContentDigest(path),
     integrity: `sha512-${createHash("sha512").update(readFileSync(path)).digest("base64")}`,
     name: manifest.name,
@@ -149,7 +156,7 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
 
 /** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
 export function npmArchiveContentDigest(path: string): string {
-  const temp = mkdtempSync(join(tmpdir(), "dbx-tools-npm-content-"));
+  const temp = mkdtempSync(join(tmpdir(), "projen-npm-content-"));
   try {
     exec.spawnSync("tar", ["-xzf", path, "-C", temp], {
       cwd: process.cwd(),
@@ -237,8 +244,7 @@ export async function publishNpmArchives(options: {
       [
         "publish",
         archive,
-        "--access",
-        "public",
+        ...(local.access ? ["--access", local.access] : []),
         ...(options.registry ? ["--registry", options.registry] : []),
         ...(options.dryRun ? ["--dry-run"] : []),
       ],

package/tasks/publish-python.ts

@@ -11,7 +11,7 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, join, resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { Command } from "commander";
 import { parse, stringify } from "smol-toml";
 import { pythonProjectInfo, stampPythonProject } from "./uniffi-python.js";
@@ -111,7 +111,7 @@ export function publishPythonProjects(options: {
   readonly plan?: ReleasePlan;
 }): void {
   const root = resolve(options.root);
-  const output = mkdtempSync(join(tmpdir(), "dbx-tools-python-publish-"));
+  const output = mkdtempSync(join(tmpdir(), "projen-python-publish-"));
   const planned = new Map(
     options.plan?.pythonPackages.map((pkg) => [pkg.path.replace(/^.*\//, ""), pkg.version]) ?? [],
   );

package/tasks/publish-uniffi-local.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env -S bun
-import { spawnSync } from "node:child_process";
 import { chmodSync, existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -7,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { log } from "@dbx-tools/shared-core";
 import { parse, stringify } from "smol-toml";
+import { captureTaskCommand, runTaskCommand, taskCommandSucceeds } from "../src/_task-command.ts";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import type { RustBindingMapping, RustWorkspaceMapping } from "../src/project-rs.ts";
 
@@ -22,17 +22,13 @@ const parsed = parseArgs({
 });
 
 function run(command: string, args: string[], capture = false): string {
-  const result = spawnSync(command, args, {
-    cwd: repoRoot,
-    encoding: capture ? "utf8" : undefined,
-    stdio: capture ? "pipe" : "inherit",
-  });
-  if (result.status !== 0) throw new Error(`${command} exited with ${result.status}`);
-  return capture ? String(result.stdout).trim() : "";
+  if (capture) return captureTaskCommand(repoRoot, command, args, { check: true });
+  runTaskCommand(repoRoot, command, args);
+  return "";
 }
 
 function commandAvailable(command: string): boolean {
-  return spawnSync(command, ["--version"], { stdio: "ignore" }).status === 0;
+  return taskCommandSucceeds(repoRoot, command, ["--version"]);
 }
 
 function rustHost(): string {
@@ -90,12 +86,12 @@ function artifacts(directory: string, suffix: string): string[] {
 }
 
 function cargoVersionExists(crateName: string, version: string, registry: string): boolean {
-  return (
-    spawnSync("cargo", ["info", `${crateName}@${version}`, "--registry", registry], {
-      cwd: repoRoot,
-      stdio: "ignore",
-    }).status === 0
-  );
+  return taskCommandSucceeds(repoRoot, "cargo", [
+    "info",
+    `${crateName}@${version}`,
+    "--registry",
+    registry,
+  ]);
 }
 
 function publishCargo(config: RustWorkspaceMapping, registry: string, version: string): void {

package/tasks/publish.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env -S bun
 /**
- * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run]`
+ * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run] [--skip-compile]`
  * - verify every workspace member and the Bun lock carry the release version,
- * then publish each package owned by the standard Node release with `bun publish`.
+ * then pack and publish each package owned by the standard Node release.
  *
  * Bun has no `pnpm -r publish`, so this loop is the recursive-publish stand-in.
  * It leans on native bun for everything bun already does:
@@ -26,14 +26,15 @@
  *     its `#!/usr/bin/env node` shebang, node chokes on the `.ts`
  *     (ERR_UNKNOWN_FILE_EXTENSION). We merge `publishConfig` onto the top-level
  *     manifest before packing so the tarball advertises the compiled `lib/` tree;
- *   - **compiled output** is emitted once, before publishing, by one root-level
+ *   - **compiled output** is emitted once, before packing, by one root-level
  *     filtered `bun run` that fans out to every publishable member in parallel.
- *     The later `bun publish --ignore-scripts` calls therefore pack the already
- *     compiled `lib/` trees instead of serially repeating each member's
- *     `prepack`. Packages retain their `prepack` task for standalone publishes.
- *   - **release recovery** packs each exact version before upload and compares
- *     its integrity and repository identity with registry metadata. A matching
- *     immutable version is skipped, while any mismatch fails the retry.
+ *     Every package is then packed once with lifecycle scripts disabled. The
+ *     exact validated archive is passed to `bun publish`, so upload never
+ *     repacks or repeats a member's `prepack`. Packages retain `prepack` for
+ *     standalone publishes.
+ *   - **release recovery** compares each packed archive's integrity and
+ *     repository identity with registry metadata. A matching immutable version
+ *     is skipped, while any mismatch fails the retry.
  *
  * `--dry-run` forwards to `bun publish`: it packs + validates
  * but uploads nothing, so the `release` workflow is testable end-to-end via a
@@ -63,8 +64,7 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
-import { log } from "@dbx-tools/shared-core";
+import { asyncUtils, log } from "@dbx-tools/shared-core";
 import ts from "typescript";
 import { parse } from "yaml";
 import {
@@ -73,9 +73,11 @@ import {
   publishedNpmRelease,
   readNpmArchiveIdentity,
 } from "./publish-npm.ts";
+import { runTaskCommand, runTaskCommandAsync } from "../src/_task-command.ts";
+import { toPosix } from "../src/packages.ts";
 import type { ReleasePlan } from "../src/release-plan.ts";
 
-const logger = log.logger("dbx-tools:publish");
+const logger = log.logger("projen:publish");
 
 /** A manifest's on-disk bytes + mode, captured before this task edits it. */
 interface ManifestBackup {
@@ -115,7 +117,7 @@ function manifestsMatchVersions(
     const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
       version?: string;
     };
-    const path = dir.slice(resolve(root).length + 1).replaceAll("\\", "/");
+    const path = toPosix(dir.slice(resolve(root).length + 1));
     return pkg.version === expected.get(path);
   });
 }
@@ -134,10 +136,7 @@ function lockfileMatchesManifestVersions(root: string, members: readonly string[
       const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
         version?: string;
       };
-      const relative = dir
-        .slice(resolve(root).length + 1)
-        .split("\\")
-        .join("/");
+      const relative = toPosix(dir.slice(resolve(root).length + 1));
       return lock.workspaces?.[relative]?.version === manifest.version;
     });
   } catch {
@@ -145,51 +144,6 @@ function lockfileMatchesManifestVersions(root: string, members: readonly string[
   }
 }
 
-/** Spawn `command` in `cwd` with `PATH` overridden, failing the task on non-zero. */
-function run(cwd: string, command: string, args: string[], path: string): void {
-  const executable = command === "bun" && process.versions.bun ? process.execPath : command;
-  exec.spawnSync(executable, args, {
-    cwd,
-    stdout: "inherit",
-    stderr: "inherit",
-    stdin: "ignore",
-    check: true,
-    env: { ...process.env, PATH: path },
-  });
-}
-
-/** Asynchronous counterpart used for bounded parallel stamping and publishing. */
-async function runAsync(cwd: string, command: string, args: string[], path: string): Promise<void> {
-  const executable = command === "bun" && process.versions.bun ? process.execPath : command;
-  await exec.spawn(executable, args, {
-    cwd,
-    stdout: "inherit",
-    stderr: "inherit",
-    stdin: "ignore",
-    check: true,
-    env: { ...process.env, PATH: path },
-  });
-}
-
-/** Run independent jobs with a small fixed worker pool. */
-async function runConcurrent<T>(
-  values: readonly T[],
-  concurrency: number,
-  worker: (value: T) => Promise<void>,
-): Promise<void> {
-  let next = 0;
-  const results = await Promise.allSettled(
-    Array.from({ length: Math.min(concurrency, values.length) }, async () => {
-      while (next < values.length) {
-        const value = values[next++];
-        await worker(value);
-      }
-    }),
-  );
-  const failure = results.find((result) => result.status === "rejected");
-  if (failure?.status === "rejected") throw failure.reason;
-}
-
 /**
  * Make a projen-readonly manifest writable so the publishConfig projection can
  * edit it, recording its original bytes and mode for {@link restoreManifests}
@@ -228,6 +182,14 @@ function restoreManifests(): void {
 /** Entry-point fields projen writes as `.ts` source in-repo and rewrites to `lib/` for publish. */
 const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const;
 
+/** Compiled files referenced by a publishConfig entry-point tree. */
+function compiledPublishTargets(value: unknown): string[] {
+  if (typeof value === "string") return value.startsWith("./lib/") ? [value] : [];
+  if (Array.isArray(value)) return value.flatMap(compiledPublishTargets);
+  if (!value || typeof value !== "object") return [];
+  return Object.values(value).flatMap(compiledPublishTargets);
+}
+
 /**
  * Fold a package's `publishConfig` entry-point fields onto the top-level manifest,
  * the way pnpm/npm do at pack time but `bun publish` does NOT (see the module
@@ -272,13 +234,14 @@ const plan =
     : undefined;
 if (!version && !plan) {
   logger.error(
-    "usage: bun tasks/publish.ts <version> [--plan <path>] [--registry <url>] [--exclude <dir>] [--dry-run]",
+    "usage: bun tasks/publish.ts <version> [--plan <path>] [--registry <url>] [--exclude <dir>] [--dry-run] [--skip-compile]",
   );
   process.exit(1);
 }
 const registryIdx = rest.indexOf("--registry");
 const registry = registryIdx >= 0 ? rest[registryIdx + 1] : undefined;
 const dryRun = rest.includes("--dry-run");
+const skipCompile = rest.includes("--skip-compile");
 const concurrencyIdx = rest.indexOf("--concurrency");
 const parsedConcurrency = Number(concurrencyIdx >= 0 ? rest[concurrencyIdx + 1] : 4);
 if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
@@ -302,15 +265,10 @@ const allMembers = workspaceMembers(root)
 const expectedVersions = new Map(
   plan
     ? plan.nodePackages.map((pkg) => [pkg.path, pkg.version] as const)
-    : allMembers.map((dir) => [
-        dir.slice(resolve(root).length + 1).replaceAll("\\", "/"),
-        version!,
-      ]),
+    : allMembers.map((dir) => [toPosix(dir.slice(resolve(root).length + 1)), version!]),
 );
 const members = plan
-  ? allMembers.filter((dir) =>
-      expectedVersions.has(dir.slice(resolve(root).length + 1).replaceAll("\\", "/")),
-    )
+  ? allMembers.filter((dir) => expectedVersions.has(toPosix(dir.slice(resolve(root).length + 1))))
   : allMembers;
 
 if (!manifestsMatchVersions(root, members, expectedVersions)) {
@@ -328,12 +286,10 @@ if (lockfileMatchesManifestVersions(root, allMembers)) {
 } else {
   if (existsSync(lockfile)) rmSync(lockfile);
   logger.info("refreshing lockfile so workspace deps resolve to the release version");
-  run(root, "bun", ["install"], path);
+  runTaskCommand(root, "bun", ["install"], { env: { ...process.env, PATH: path } });
 }
 
 const publishArgs = [
-  "--access",
-  "public",
   "--ignore-scripts",
   ...(registry ? ["--registry", registry] : []),
   ...(dryRun ? ["--dry-run"] : []),
@@ -343,6 +299,8 @@ const publishable: Array<{
   name: string;
   version: string;
   compile: boolean;
+  compiledTargets: string[];
+  access?: "public" | "restricted";
 }> = [];
 for (const dir of members) {
   const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
@@ -350,7 +308,7 @@ for (const dir of members) {
     version?: string;
     private?: boolean;
     dbxToolsConfig?: { uniffi?: boolean };
-    scripts?: Record<string, string>;
+    publishConfig?: { access?: unknown };
   };
   if (pkg.private) {
     logger.info(`skip private ${pkg.name ?? dirname(dir)}`);
@@ -361,18 +319,46 @@ for (const dir of members) {
     continue;
   }
   if (!pkg.version) throw new Error(`Missing package version for ${pkg.name ?? dirname(dir)}`);
+  const access = pkg.publishConfig?.access;
+  if (access !== undefined && access !== "public" && access !== "restricted") {
+    throw new Error(
+      `${pkg.name ?? dirname(dir)} has invalid publishConfig.access ${String(access)}`,
+    );
+  }
+  const compiledTargets = [...new Set(compiledPublishTargets(pkg.publishConfig))];
   publishable.push({
     dir,
     name: pkg.name ?? dirname(dir),
     version: pkg.version,
-    compile: Boolean(pkg.scripts && typeof pkg.scripts === "object" && "prepack" in pkg.scripts),
+    compile: compiledTargets.length > 0,
+    compiledTargets,
+    ...(access ? { access } : {}),
   });
 }
 
 const compiled = publishable.filter((pkg) => pkg.compile);
 if (compiled.length > 0) {
-  logger.info(`compiling ${compiled.length} publishable packages from the workspace root`);
-  run(root, "bun", ["run", ...compiled.flatMap((pkg) => ["--filter", pkg.name]), "compile"], path);
+  if (skipCompile) {
+    const missing = compiled.flatMap((pkg) =>
+      pkg.compiledTargets
+        .filter((target) => !existsSync(resolve(pkg.dir, target)))
+        .map((target) => `${pkg.name}:${target}`),
+    );
+    if (missing.length > 0) {
+      throw new Error(
+        `--skip-compile requires validated compiled output; missing ${missing.join(", ")}`,
+      );
+    }
+    logger.info(`reusing validated compiled output for ${compiled.length} publishable packages`);
+  } else {
+    logger.info(`compiling ${compiled.length} publishable packages from the workspace root`);
+    runTaskCommand(
+      root,
+      "bun",
+      ["run", ...compiled.flatMap((pkg) => ["--filter", pkg.name]), "compile"],
+      { env: { ...process.env, PATH: path } },
+    );
+  }
 }
 
 // Compile against workspace source exports first. Switching manifests to their
@@ -387,9 +373,10 @@ for (const { dir } of publishable) {
 logger.info(
   `${dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
 );
-await runConcurrent(publishable, concurrency, async ({ dir, name, version: packageVersion }) => {
-  if (!dryRun) {
-    const packed = mkdtempSync(join(tmpdir(), "dbx-tools-npm-release-"));
+await asyncUtils.mapConcurrent(
+  publishable,
+  async ({ dir, name, version: packageVersion, access }) => {
+    const packed = mkdtempSync(join(tmpdir(), "projen-npm-release-"));
     try {
       const archive = packNpmPackage(dir, packed, path);
       const local = readNpmArchiveIdentity(archive);
@@ -398,16 +385,29 @@ await runConcurrent(publishable, concurrency, async ({ dir, name, version: packa
           `Packed npm identity ${local.name}@${local.version} does not match ${name}@${packageVersion}`,
         );
       }
-      const published = await publishedNpmRelease(local.name, local.version, registry);
-      if (npmReleaseMatches(local, published)) {
-        logger.info(`skip published ${name} @ ${packageVersion}`);
-        return;
+      if (local.access !== access) {
+        throw new Error(
+          `Packed npm access ${String(local.access)} does not match ${String(access)} for ${name}`,
+        );
+      }
+      if (!dryRun) {
+        const published = await publishedNpmRelease(local.name, local.version, registry);
+        if (npmReleaseMatches(local, published)) {
+          logger.info(`skip published ${name} @ ${packageVersion}`);
+          return;
+        }
       }
+      logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${name} @ ${packageVersion}`);
+      await runTaskCommandAsync(
+        dir,
+        "bun",
+        ["publish", ...(access ? ["--access", access] : []), ...publishArgs, archive],
+        { env: { ...process.env, PATH: path } },
+      );
     } finally {
       rmSync(packed, { recursive: true, force: true });
     }
-  }
-  logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${name} @ ${packageVersion}`);
-  await runAsync(dir, "bun", ["publish", ...publishArgs], path);
-});
+  },
+  { concurrency, errorMode: "settle" },
+);
 logger.success(`${dryRun ? "dry-run: packed" : "published"} ${publishable.length} packages`);