@dbx-tools/projen 0.9.6 → 0.9.7

package/README.md

@@ -254,7 +254,11 @@ and select `rust-lld` for the workspace build. Rust release rows restore and
 update dependency-only Cargo caches in the release branch's cache scope. The
 cache key excludes workspace version changes, and manual tag recovery restores
 without saving a tag-scoped copy. There is no separate cache workflow or
-sccache layer. Phase timings are written to each build log. Python generation executes the already-built
+sccache layer. After publishing the current raw Rust bundles and build manifests,
+the GitHub release job deletes those internal assets from published
+`vMAJOR.MINOR.PATCH` releases strictly lower than the current version while
+leaving versioned consumer binaries in place. Phase timings are written to each
+build log. Python generation executes the already-built
 `target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.6";
+export const PACKAGE_VERSION = "0.9.7";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.6",
-    "@dbx-tools/path": "^0.9.6",
-    "@dbx-tools/shared-core": "^0.9.6",
+    "@dbx-tools/core": "^0.9.7",
+    "@dbx-tools/path": "^0.9.7",
+    "@dbx-tools/shared-core": "^0.9.7",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -53,7 +53,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/_rust-release-workflow.ts

@@ -3,6 +3,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { stringUtils } from "@dbx-tools/shared-core";
 import { TextFile, javascript } from "projen";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
 import type { RustProject } from "./_rust-project.ts";
@@ -482,29 +483,34 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
               id: "raw-native",
               shell: "bash",
               env: { GH_TOKEN: "${{ github.token }}" },
-              run: [
-                'KEY="${{ steps.rust-fingerprint.outputs.key }}"',
-                'test -n "$KEY"',
-                'ASSET="rust-raw-${{ matrix.node }}-$KEY.tar.gz"',
-                "mkdir -p dist/rust-raw",
-                'MATCH="$(gh api --paginate "repos/${{ github.repository }}/releases?per_page=100" --jq \'.[] | select(.draft == false) | . as $release | .assets[] | select(.name == "\'"$ASSET"\'") | [$release.tag_name, .url] | @tsv\' | head -n 1)"',
-                'if [ -n "$MATCH" ]; then',
-                "  TAG=\"${MATCH%%$'\\t'*}\"",
-                "  URL=\"${MATCH#*$'\\t'}\"",
-                '  CHECKSUM_URL="$(gh api "repos/${{ github.repository }}/releases/tags/$TAG" --jq \'.assets[] | select(.name == "\'"$ASSET.sha256"\'") | .url\')"',
-                '  rm -rf "target/${{ matrix.cargo }}/release"',
-                '  if test -n "$CHECKSUM_URL" && gh api "$URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET" && gh api "$CHECKSUM_URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET.sha256" && (cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum --check "$ASSET.sha256"; else shasum -a 256 --check "$ASSET.sha256"; fi) && tar -xzf "dist/rust-raw/$ASSET"; then',
-                '    echo "hit=true" >> "$GITHUB_OUTPUT"',
-                "  else",
-                '    rm -rf "target/${{ matrix.cargo }}/release" "dist/rust-raw/$ASSET" "dist/rust-raw/$ASSET.sha256"',
-                '    echo "::warning::matching raw Rust bundle failed validation; rebuilding"',
-                '    echo "hit=false" >> "$GITHUB_OUTPUT"',
-                "  fi",
-                "else",
-                '  echo "hit=false" >> "$GITHUB_OUTPUT"',
-                "fi",
-                'echo "asset=$ASSET" >> "$GITHUB_OUTPUT"',
-              ].join("\n"),
+              // prettier-ignore
+              run: stringUtils.dedent(
+                // ============================================================================
+                /*bash*/`
+                KEY="\${{ steps.rust-fingerprint.outputs.key }}"
+                test -n "$KEY"
+                ASSET="rust-raw-\${{ matrix.node }}-$KEY.tar.gz"
+                mkdir -p dist/rust-raw
+                MATCH="$(gh api --paginate "repos/\${{ github.repository }}/releases?per_page=100" --jq '.[] | select(.draft == false) | . as $release | .assets[] | select(.name == "'"$ASSET"'") | [$release.tag_name, .url] | @tsv' | head -n 1)"
+                if [ -n "$MATCH" ]; then
+                  TAG="\${MATCH%%$'\\t'*}"
+                  URL="\${MATCH#*$'\\t'}"
+                  CHECKSUM_URL="$(gh api "repos/\${{ github.repository }}/releases/tags/$TAG" --jq '.assets[] | select(.name == "'"$ASSET.sha256"'") | .url')"
+                  rm -rf "target/\${{ matrix.cargo }}/release"
+                  if test -n "$CHECKSUM_URL" && gh api "$URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET" && gh api "$CHECKSUM_URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET.sha256" && (cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum --check "$ASSET.sha256"; else shasum -a 256 --check "$ASSET.sha256"; fi) && tar -xzf "dist/rust-raw/$ASSET"; then
+                    echo "hit=true" >> "$GITHUB_OUTPUT"
+                  else
+                    rm -rf "target/\${{ matrix.cargo }}/release" "dist/rust-raw/$ASSET" "dist/rust-raw/$ASSET.sha256"
+                    echo "::warning::matching raw Rust bundle failed validation; rebuilding"
+                    echo "hit=false" >> "$GITHUB_OUTPUT"
+                  fi
+                else
+                  echo "hit=false" >> "$GITHUB_OUTPUT"
+                fi
+                echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
+              `
+                // ============================================================================
+              ),
             },
           ]
         : []),
@@ -757,6 +763,53 @@ export function rustGitHubReleaseJob(): Job {
           target_commitish: RELEASE_SHA,
         },
       },
+      {
+        name: "Delete superseded raw Rust release assets",
+        uses: "actions/github-script@v8",
+        env: { CURRENT_RELEASE_TAG: RELEASE_TAG },
+        with: {
+          // prettier-ignore
+          script: stringUtils.dedent(
+            // ============================================================================
+            /*js*/`
+            const currentTag = process.env.CURRENT_RELEASE_TAG;
+            if (!currentTag) throw new Error("CURRENT_RELEASE_TAG is required");
+            const parseVersion = (tag) => {
+              const match = /^v(\\d+)\\.(\\d+)\\.(\\d+)$/.exec(tag);
+              return match ? match.slice(1).map(Number) : undefined;
+            };
+            const compareVersions = (left, right) => {
+              for (let index = 0; index < 3; index += 1) {
+                if (left[index] !== right[index]) return left[index] - right[index];
+              }
+              return 0;
+            };
+            const currentVersion = parseVersion(currentTag);
+            if (!currentVersion) throw new Error(\`Unsupported release tag: \${currentTag}\`);
+            const releases = await github.paginate(github.rest.repos.listReleases, {
+              ...context.repo,
+              per_page: 100,
+            });
+            const assets = releases.flatMap((release) => {
+              const version = parseVersion(release.tag_name);
+              if (release.draft || !version || compareVersions(version, currentVersion) >= 0) {
+                return [];
+              }
+              return release.assets.filter((asset) => /^rust-(?:raw|build)-/.test(asset.name));
+            });
+            for (const asset of assets) {
+              core.info(\`Deleting \${asset.name} (\${asset.id})\`);
+              await github.rest.repos.deleteReleaseAsset({
+                ...context.repo,
+                asset_id: asset.id,
+              });
+            }
+            core.info(\`Deleted \${assets.length} superseded raw Rust release assets\`);
+          `
+            // ============================================================================
+          ),
+        },
+      },
     ],
   };
 }

package/src/barrels.ts

@@ -523,10 +523,9 @@ const WRITE_ATTEMPTS = 3;
  * and the projenrc watcher's post-synth `generateBarrels()` sweep), so any gap
  * between `makeWritable` and the write is a window in which another process's
  * `makeReadonly` lands and this write fails with
- * `EACCES: permission denied, open '<pkg>/index.ts'`. The gap used to span all of
- * the oxc parsing done for export hoisting, which made it wide enough to hit
- * routinely. Keeping the unlock adjacent to the write shrinks it to nothing much,
- * and a retry absorbs what is left.
+ * `EACCES: permission denied, open '<pkg>/index.ts'`. Keeping the unlock adjacent
+ * to the write avoids a gap during export parsing, and a retry absorbs what is
+ * left.
  *
  * Do NOT "simplify" this back to a single unlock-then-write: the failure is
  * timing-dependent, so it looks fine until a full-repo sweep runs against a

package/src/bun-app.ts

@@ -23,6 +23,7 @@
  * `src/`), they are outside the package's `tsconfig` include, so their `Bun.*`
  * usage never trips the `app` package's DOM-only `compile`.
  */
+import { stringUtils } from "@dbx-tools/shared-core";
 import { type Project, TextFile } from "projen";
 
 /** Unmanaged dev-server override module, merged over the generated options if present. */
@@ -90,34 +91,38 @@ export class BunfigFile extends TextFile {
 /** `dev.ts`: a `Bun.serve()` fullstack dev server with React HMR. */
 export class BunDevServerFile extends TextFile {
   constructor(project: Project) {
-    super(project, "dev.ts", {
-      marker: true,
-      readonly: true,
-      lines: String.raw`
-import { existsSync } from "node:fs";
-import index from "./index.html";
+    // prettier-ignore
+    const source = (
+      // ============================================================================
+      /*ts*/`
+      import { existsSync } from "node:fs";
+      import index from "./index.html";
 
-// Unmanaged override (${BUN_DEV_OVERRIDE}): its default export is merged over the
-// generated serve options - later wins - so a package tweaks the dev server
-// without editing this generated file.
-let options: Bun.ServeFunctionOptions<unknown, {}> = {
-  port: Number(process.env.PORT ?? 5173),
-  development: { hmr: true, console: true },
-  routes: { "/*": index },
-};
+      // Unmanaged override (${BUN_DEV_OVERRIDE}): its default export is merged over the
+      // generated serve options - later wins - so a package tweaks the dev server
+      // without editing this generated file.
+      let options: Bun.ServeFunctionOptions<unknown, {}> = {
+        port: Number(process.env.PORT ?? 5173),
+        development: { hmr: true, console: true },
+        routes: { "/*": index },
+      };
 
-const overrideUrl = new URL("./${BUN_DEV_OVERRIDE}", import.meta.url);
-if (existsSync(overrideUrl)) {
-  const mod = await import(overrideUrl.href);
-  const override = typeof mod.default === "function" ? await mod.default() : mod.default;
-  options = { ...options, ...override };
-}
+      const overrideUrl = new URL("./${BUN_DEV_OVERRIDE}", import.meta.url);
+      if (existsSync(overrideUrl)) {
+        const mod = await import(overrideUrl.href);
+        const override = typeof mod.default === "function" ? await mod.default() : mod.default;
+        options = { ...options, ...override };
+      }
 
-const server = Bun.serve(options);
-console.log("dev server running at " + server.url.href);
-`
-        .trimStart()
-        .split("\n"),
+      const server = Bun.serve(options);
+      console.log("dev server running at " + server.url.href);
+      `
+      // ============================================================================
+    );
+    super(project, "dev.ts", {
+      marker: true,
+      readonly: true,
+      lines: stringUtils.dedentLines(source, { trimEnd: false }),
     });
   }
 }
@@ -125,73 +130,79 @@ console.log("dev server running at " + server.url.href);
 /** `build.ts`: a `Bun.build()` production bundle (Tailwind via the plugin API). */
 export class BunBuildFile extends TextFile {
   constructor(project: Project) {
-    super(project, "build.ts", {
-      marker: true,
-      readonly: true,
-      lines: String.raw`
-import { existsSync } from "node:fs";
-import { cp, rm } from "node:fs/promises";
-import { basename } from "node:path";
-import tailwind from "bun-plugin-tailwind";
+    // Raw template preserves backslashes in generated regular expression literals.
+    // prettier-ignore
+    const source = (
+      String.raw
+      // ============================================================================
+      /*ts*/`
+      import { existsSync } from "node:fs";
+      import { cp, rm } from "node:fs/promises";
+      import { basename } from "node:path";
+      import tailwind from "bun-plugin-tailwind";
 
-// Unmanaged override (${BUN_BUILD_OVERRIDE}): its default export is merged over
-// the generated build options - later wins.
-let options: Bun.BuildConfig = {
-  entrypoints: ["./index.html"],
-  outdir: "./dist",
-  define: { "process.env.NODE_ENV": JSON.stringify("production") },
-  minify: true,
-  splitting: true,
-  publicPath: "/",
-  external: ["/fonts/*"],
-  sourcemap: "none",
-  plugins: [tailwind],
-};
+      // Unmanaged override (${BUN_BUILD_OVERRIDE}): its default export is merged over
+      // the generated build options - later wins.
+      let options: Bun.BuildConfig = {
+        entrypoints: ["./index.html"],
+        outdir: "./dist",
+        define: { "process.env.NODE_ENV": JSON.stringify("production") },
+        minify: true,
+        splitting: true,
+        publicPath: "/",
+        external: ["/fonts/*"],
+        sourcemap: "none",
+        plugins: [tailwind],
+      };
 
-const overrideUrl = new URL("./${BUN_BUILD_OVERRIDE}", import.meta.url);
-if (existsSync(overrideUrl)) {
-  const mod = await import(overrideUrl.href);
-  const override = typeof mod.default === "function" ? await mod.default() : mod.default;
-  options = { ...options, ...override, plugins: [...(options.plugins ?? []), ...(override.plugins ?? [])] };
-}
+      const overrideUrl = new URL("./${BUN_BUILD_OVERRIDE}", import.meta.url);
+      if (existsSync(overrideUrl)) {
+        const mod = await import(overrideUrl.href);
+        const override = typeof mod.default === "function" ? await mod.default() : mod.default;
+        options = { ...options, ...override, plugins: [...(options.plugins ?? []), ...(override.plugins ?? [])] };
+      }
 
-const outdir = options.outdir ?? "./dist";
-await rm(outdir, { recursive: true, force: true });
+      const outdir = options.outdir ?? "./dist";
+      await rm(outdir, { recursive: true, force: true });
 
-const result = await Bun.build(options);
-if (!result.success) {
-  for (const message of result.logs) console.error(message);
-  process.exit(1);
-}
+      const result = await Bun.build(options);
+      if (!result.success) {
+        for (const message of result.logs) console.error(message);
+        process.exit(1);
+      }
 
-// Fix a Bun bug: with \`splitting: true\` and an HTML entrypoint, the emitted
-// HTML's <script src> is wired to an arbitrary chunk instead of the JS
-// entry-point, so the app never boots (a blank page). Rewrite the HTML script
-// (and stylesheet) to the real entry-point outputs. No-op when they already
-// match (e.g. splitting off), so it is always safe to run.
-const htmlOut = result.outputs.find((o) => o.path.endsWith(".html"));
-const entryJs = result.outputs.find((o) => o.kind === "entry-point" && o.path.endsWith(".js"));
-const entryCss = result.outputs.find((o) => o.kind === "entry-point" && o.path.endsWith(".css"));
-if (htmlOut && entryJs) {
-  let html = await Bun.file(htmlOut.path).text();
-  const jsName = basename(entryJs.path);
-  html = html.replace(/(<script[^>]*\bsrc=")([^"]*\/)?[^"/]+\.js(")/i, "$1$2" + jsName + "$3");
-  if (entryCss) {
-    const cssName = basename(entryCss.path);
-    html = html.replace(/(<link[^>]*\bhref=")([^"]*\/)?[^"/]+\.css(")/i, "$1$2" + cssName + "$3");
-  }
-  await Bun.write(htmlOut.path, html);
-}
+      // Fix a Bun bug: with \`splitting: true\` and an HTML entrypoint, the emitted
+      // HTML's <script src> is wired to an arbitrary chunk instead of the JS
+      // entry-point, so the app never boots (a blank page). Rewrite the HTML script
+      // (and stylesheet) to the real entry-point outputs. No-op when they already
+      // match (e.g. splitting off), so it is always safe to run.
+      const htmlOut = result.outputs.find((o) => o.path.endsWith(".html"));
+      const entryJs = result.outputs.find((o) => o.kind === "entry-point" && o.path.endsWith(".js"));
+      const entryCss = result.outputs.find((o) => o.kind === "entry-point" && o.path.endsWith(".css"));
+      if (htmlOut && entryJs) {
+        let html = await Bun.file(htmlOut.path).text();
+        const jsName = basename(entryJs.path);
+        html = html.replace(/(<script[^>]*\bsrc=")([^"]*\/)?[^"/]+\.js(")/i, "$1$2" + jsName + "$3");
+        if (entryCss) {
+          const cssName = basename(entryCss.path);
+          html = html.replace(/(<link[^>]*\bhref=")([^"]*\/)?[^"/]+\.css(")/i, "$1$2" + cssName + "$3");
+        }
+        await Bun.write(htmlOut.path, html);
+      }
 
-const publicDir = "./public";
-if (existsSync(publicDir)) {
-  await cp(publicDir, outdir, { recursive: true });
-}
+      const publicDir = "./public";
+      if (existsSync(publicDir)) {
+        await cp(publicDir, outdir, { recursive: true });
+      }
 
-console.log("built " + result.outputs.length + " files to " + options.outdir);
-`
-        .trimStart()
-        .split("\n"),
+      console.log("built " + result.outputs.length + " files to " + options.outdir);
+      `
+      // ============================================================================
+    );
+    super(project, "build.ts", {
+      marker: true,
+      readonly: true,
+      lines: stringUtils.dedentLines(source, { trimEnd: false }),
     });
   }
 }

package/src/bun-workflow.ts

@@ -1,4 +1,5 @@
 /** Shared Bun setup and package-cache steps for generated workflows. */
+import { stringUtils } from "@dbx-tools/shared-core";
 import { TextFile, javascript } from "projen";
 
 export const BUN_VERSION = "1.3.14";
@@ -16,61 +17,68 @@ const DEFAULT_CACHE_IGNORE_PATHS = [
 
 function cacheKeyScript(extraIgnorePaths: readonly string[]): string {
   const ignorePaths = [...new Set(extraIgnorePaths)].sort();
-  return `#!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { readdirSync, readFileSync } from "node:fs";
-import { join, sep } from "node:path";
+  // prettier-ignore
+  const source = (
+    // ============================================================================
+    /*js*/`
+  #!/usr/bin/env node
+  import { createHash } from "node:crypto";
+  import { readdirSync, readFileSync } from "node:fs";
+  import { join, sep } from "node:path";
 
-const root = process.cwd();
-const ignoredNames = new Set(${JSON.stringify(DEFAULT_CACHE_IGNORE_PATHS)});
-const ignoredPaths = new Set(${JSON.stringify(ignorePaths)});
-const manifests = [];
-const walk = (directory) => {
-  for (const entry of readdirSync(directory, { withFileTypes: true })) {
-    const path = join(directory, entry.name);
-    const relativePath = path.slice(root.length + 1).split(sep).join("/");
-    if (ignoredNames.has(entry.name) || ignoredPaths.has(relativePath)) continue;
-    if (entry.isDirectory()) walk(path);
-    else if (entry.name === "package.json") manifests.push(path);
-  }
-};
-walk(root);
+  const root = process.cwd();
+  const ignoredNames = new Set(${JSON.stringify(DEFAULT_CACHE_IGNORE_PATHS)});
+  const ignoredPaths = new Set(${JSON.stringify(ignorePaths)});
+  const manifests = [];
+  const walk = (directory) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const path = join(directory, entry.name);
+      const relativePath = path.slice(root.length + 1).split(sep).join("/");
+      if (ignoredNames.has(entry.name) || ignoredPaths.has(relativePath)) continue;
+      if (entry.isDirectory()) walk(path);
+      else if (entry.name === "package.json") manifests.push(path);
+    }
+  };
+  walk(root);
 
-const dependencyFields = [
-  "catalog",
-  "dependencies",
-  "devDependencies",
-  "optionalDependencies",
-  "overrides",
-  "peerDependencies",
-  "peerDependenciesMeta",
-  "resolutions",
-  "trustedDependencies",
-];
-const canonical = (value) => {
-  if (Array.isArray(value)) return value.map(canonical);
-  if (!value || typeof value !== "object") return value;
-  return Object.fromEntries(
-    Object.entries(value)
-      .sort(([left], [right]) => left.localeCompare(right))
-      .map(([key, child]) => [key, canonical(child)]),
+  const dependencyFields = [
+    "catalog",
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "overrides",
+    "peerDependencies",
+    "peerDependenciesMeta",
+    "resolutions",
+    "trustedDependencies",
+  ];
+  const canonical = (value) => {
+    if (Array.isArray(value)) return value.map(canonical);
+    if (!value || typeof value !== "object") return value;
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, child]) => [key, canonical(child)]),
+    );
+  };
+  const dependencies = manifests
+    .sort()
+    .map((path) => {
+      const manifest = JSON.parse(readFileSync(path, "utf8"));
+      return [
+        path.slice(root.length + 1),
+        Object.fromEntries(
+          dependencyFields
+            .filter((field) => manifest[field] !== undefined)
+            .map((field) => [field, canonical(manifest[field])]),
+        ),
+      ];
+    });
+  process.stdout.write(createHash("sha256").update(JSON.stringify(dependencies)).digest("hex"));
+  `
+    // ============================================================================
   );
-};
-const dependencies = manifests
-  .sort()
-  .map((path) => {
-    const manifest = JSON.parse(readFileSync(path, "utf8"));
-    return [
-      path.slice(root.length + 1),
-      Object.fromEntries(
-        dependencyFields
-          .filter((field) => manifest[field] !== undefined)
-          .map((field) => [field, canonical(manifest[field])]),
-      ),
-    ];
-  });
-process.stdout.write(createHash("sha256").update(JSON.stringify(dependencies)).digest("hex"));
-`;
+  return stringUtils.dedent(source, { trimEnd: false });
 }
 
 const configured = new WeakMap<javascript.NodeProject, string>();

package/src/openapi.ts

@@ -37,7 +37,7 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 import * as bin from "@dbx-tools/core/bin";
 import { find } from "@dbx-tools/path";
-import { log } from "@dbx-tools/shared-core";
+import { log, stringUtils } from "@dbx-tools/shared-core";
 import type * as ts from "typescript";
 import { lazyRequire } from "./_lazy-require.ts";
 import { makeReadonly, makeWritable, stampGenerated } from "./generated.ts";
@@ -61,14 +61,21 @@ const SPEAKEASY_OPENAPI_VERSION = "1.24.0";
 const SPEAKEASY_OPENAPI_RELEASE_URL = `https://github.com/speakeasy-api/openapi/releases/download/v${SPEAKEASY_OPENAPI_VERSION}`;
 const execFileAsync = promisify(execFile);
 
-const CLIENT_SRC = `import createClient, { type ClientOptions } from "openapi-fetch";
-import type { paths } from "./schema";
+// prettier-ignore
+const CLIENT_TEMPLATE = (
+  // ============================================================================
+  /*ts*/`
+  import createClient, { type ClientOptions } from "openapi-fetch";
+  import type { paths } from "./schema";
 
-/** Create a typed OpenAPI client (openapi-fetch); safe to use in the browser. */
-export function createApiClient(options?: ClientOptions) {
-  return createClient<paths>(options);
-}
-`;
+  /** Create a typed OpenAPI client (openapi-fetch); safe to use in the browser. */
+  export function createApiClient(options?: ClientOptions) {
+    return createClient<paths>(options);
+  }
+  `
+  // ============================================================================
+);
+const CLIENT_SRC = stringUtils.dedent(CLIENT_TEMPLATE, { trimEnd: false });
 
 /** True if any module file in `<pkg>/src` matches {@link TSOA_IMPORT}. */
 function hasTsoaControllers(pkg: Pick<RecordedPackage, "dir">): boolean {

package/src/project-py.ts

@@ -766,23 +766,28 @@ export class DBXToolsPythonWorkspace extends Component {
     ];
     const helper = ".projen/pypi-trusted-publisher-instructions.mjs";
     new TextFile(project.root, helper, {
-      lines: [
-        "#!/usr/bin/env node",
-        'import { parseArgs } from "node:util";',
-        "",
-        "const { values } = parseArgs({",
-        '  options: { secretFile: { type: "string" } },',
-        "});",
-        `const beforeAuthentication = ${JSON.stringify(linesBeforeAuthentication)};`,
-        `const afterAuthentication = ${JSON.stringify(linesAfterAuthentication)};`,
-        "const authentication = values.secretFile",
-        "  ? [",
-        "      `- If browser authentication is required, read credentials from ${values.secretFile} directly into the browser without printing, logging, or exposing secret values.`,",
-        "      `- If ${values.secretFile} is absent, invalid, or insufficient for authentication, pause and ask the user to complete authentication.`,",
-        "    ]",
-        '  : ["- If browser authentication is required, pause and ask the user to complete authentication."];',
-        'process.stdout.write(`${[...beforeAuthentication, ...authentication, ...afterAuthentication].join("\\n").trimEnd()}\\n`);',
-      ],
+      // prettier-ignore
+      lines: stringUtils.dedent(
+        // ============================================================================
+        /*js*/`
+          #!/usr/bin/env node
+          import { parseArgs } from "node:util";
+
+          const { values } = parseArgs({
+            options: { secretFile: { type: "string" } },
+          });
+          const beforeAuthentication = ${JSON.stringify(linesBeforeAuthentication)};
+          const afterAuthentication = ${JSON.stringify(linesAfterAuthentication)};
+          const authentication = values.secretFile
+            ? [
+                \`- If browser authentication is required, read credentials from \${values.secretFile} directly into the browser without printing, logging, or exposing secret values.\`,
+                \`- If \${values.secretFile} is absent, invalid, or insufficient for authentication, pause and ask the user to complete authentication.\`,
+              ]
+            : ["- If browser authentication is required, pause and ask the user to complete authentication."];
+          process.stdout.write(\`\${[...beforeAuthentication, ...authentication, ...afterAuthentication].join("\\n").trimEnd()}\\n\`);
+        `
+        // ============================================================================
+      ).split("\n"),
     });
     project.root.addTask("pypiTrustedPublisherInstructions", {
       description: "Print system-browser instructions for PyPI trusted publishers",

package/src/release.ts

@@ -1,4 +1,5 @@
 /** Unified default-branch release workflow generation. */
+import { stringUtils } from "@dbx-tools/shared-core";
 import { Component } from "projen";
 import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
@@ -205,47 +206,52 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
             "${{ github.event_name == 'workflow_dispatch' && inputs.expected_sha || '' }}",
           DRY_RUN: "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}",
         },
-        run: [
-          'if [ "$GITHUB_EVENT_NAME" = "push" ]; then',
-          '  test "$GITHUB_REF_TYPE" = "branch"',
-          `  test "$GITHUB_REF_NAME" = "${releaseBranch}"`,
-          '  RELEASE_SHA="$GITHUB_SHA"',
-          '  test "$(git rev-parse HEAD)" = "$RELEASE_SHA"',
-          "  RELEASE_VERSION=\"$(tr -d '\\r\\n' < VERSION)\"",
-          '  bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"',
-          '  PREVIOUS_VERSION="$(git show "$RELEASE_SHA^:VERSION" | tr -d \'\\r\\n\')"',
-          '  test "$PREVIOUS_VERSION" != "$RELEASE_VERSION"',
-          `  RELEASE_TAG="${tagPrefix}$RELEASE_VERSION"`,
-          '  if git ls-remote --exit-code --tags origin "refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then',
-          '    git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
-          '    test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
-          '    test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$RELEASE_SHA"',
-          "  else",
-          "    git fetch --force --tags origin",
-          `    bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION" --prefix ${JSON.stringify(tagPrefix)} --assert-next`,
-          '    git config user.name "github-actions[bot]"',
-          '    git config user.email "41898282+github-actions[bot]@users.noreply.github.com"',
-          '    git tag -a "$RELEASE_TAG" "$RELEASE_SHA" -m "$RELEASE_TAG"',
-          '    git push origin "refs/tags/$RELEASE_TAG"',
-          "  fi",
-          "else",
-          `  case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac`,
-          `  RELEASE_VERSION="\${RELEASE_TAG#${tagPrefix}}"`,
-          '  bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"',
-          '  git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
-          '  test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
-          '  RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"',
-          '  test "$(git rev-parse HEAD)" = "$RELEASE_SHA"',
-          '  test "$RELEASE_SHA" = "$EXPECTED_SHA"',
-          '  if [ -n "${{ inputs.source_run_id }}" ]; then',
-          '    case "${{ inputs.stage }}" in node|python) ;; *) exit 1 ;; esac',
-          '    case "${{ inputs.source_run_id }}" in *[!0-9]*|"") exit 1 ;; esac',
-          "  fi",
-          "fi",
-          'echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"',
-          'echo "expected_sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"',
-          'echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"',
-        ].join("\n"),
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
+            test "$GITHUB_REF_TYPE" = "branch"
+            test "$GITHUB_REF_NAME" = "${releaseBranch}"
+            RELEASE_SHA="$GITHUB_SHA"
+            test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
+            RELEASE_VERSION="$(tr -d '\\r\\n' < VERSION)"
+            bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"
+            PREVIOUS_VERSION="$(git show "$RELEASE_SHA^:VERSION" | tr -d '\\r\\n')"
+            test "$PREVIOUS_VERSION" != "$RELEASE_VERSION"
+            RELEASE_TAG="${tagPrefix}$RELEASE_VERSION"
+            if git ls-remote --exit-code --tags origin "refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then
+              git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+              test "$(git cat-file -t "$RELEASE_TAG")" = "tag"
+              test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$RELEASE_SHA"
+            else
+              git fetch --force --tags origin
+              bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION" --prefix ${JSON.stringify(tagPrefix)} --assert-next
+              git config user.name "github-actions[bot]"
+              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+              git tag -a "$RELEASE_TAG" "$RELEASE_SHA" -m "$RELEASE_TAG"
+              git push origin "refs/tags/$RELEASE_TAG"
+            fi
+          else
+            case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac
+            RELEASE_VERSION="\${RELEASE_TAG#${tagPrefix}}"
+            bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"
+            git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+            test "$(git cat-file -t "$RELEASE_TAG")" = "tag"
+            RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"
+            test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
+            test "$RELEASE_SHA" = "$EXPECTED_SHA"
+            if [ -n "\${{ inputs.source_run_id }}" ]; then
+              case "\${{ inputs.stage }}" in node|python) ;; *) exit 1 ;; esac
+              case "\${{ inputs.source_run_id }}" in *[!0-9]*|"") exit 1 ;; esac
+            fi
+          fi
+          echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
+          echo "expected_sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
+          echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
+        `
+          // ============================================================================
+        ),
       },
       {
         name: "Verify source artifact run",
@@ -256,15 +262,20 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           SOURCE_RUN_ID: "${{ inputs.source_run_id }}",
         },
         with: {
-          script: [
-            "const run = await github.rest.actions.getWorkflowRun({",
-            "  owner: context.repo.owner,",
-            "  repo: context.repo.repo,",
-            "  run_id: Number(process.env.SOURCE_RUN_ID),",
-            "});",
-            'if (run.data.path !== ".github/workflows/release.yml") core.setFailed("Source run is not release.yml");',
-            'if (run.data.head_sha !== process.env.EXPECTED_SHA) core.setFailed("Source run commit does not match the release tag");',
-          ].join("\n"),
+          // prettier-ignore
+          script: stringUtils.dedent(
+            // ============================================================================
+            /*js*/`
+            const run = await github.rest.actions.getWorkflowRun({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: Number(process.env.SOURCE_RUN_ID),
+            });
+            if (run.data.path !== ".github/workflows/release.yml") core.setFailed("Source run is not release.yml");
+            if (run.data.head_sha !== process.env.EXPECTED_SHA) core.setFailed("Source run commit does not match the release tag");
+          `
+            // ============================================================================
+          ),
         },
       },
     ],
@@ -422,44 +433,49 @@ function independentReleasePleaseJob(project: DBXToolsJavaScriptProject, branch:
           RELEASE_PRS: "${{ steps.release.outputs.prs }}",
         },
         shell: "bash",
-        run: [
-          'BRANCH="$(jq -r \'.[0].headBranchName\' <<<"$RELEASE_PRS")"',
-          'test -n "$BRANCH" && test "$BRANCH" != "null"',
-          'git fetch origin "$BRANCH"',
-          'git switch --force-create "$BRANCH" "origin/$BRANCH"',
-          "bun install",
-          "bunx projen",
-          "bun node_modules/@dbx-tools/projen/tasks/version-check.ts",
-          `bun node_modules/@dbx-tools/projen/tasks/release-plan.ts --base-ref origin/${branch}`,
-          `bun node_modules/@dbx-tools/projen/tasks/release-summary-units.ts --from-ref origin/${branch}`,
-          'if ! git diff --quiet || test -n "$(git ls-files --others --exclude-standard)"; then',
-          '  git config user.name "github-actions[bot]"',
-          '  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"',
-          "  git add -A",
-          '  git commit -m "chore: reconcile release metadata"',
-          '  git push origin "HEAD:$BRANCH"',
-          "fi",
-          'MERGED="false"',
-          "for ATTEMPT in $(seq 1 15); do",
-          '  STATE="$(gh pr view "$BRANCH" --json state,mergeable --jq \'[.state,.mergeable] | join(" ")\')"',
-          '  if [[ "$STATE" == MERGED* ]]; then MERGED="true"; break; fi',
-          '  if [ "$STATE" = "OPEN CONFLICTING" ]; then',
-          '    echo "::error::release pull request has merge conflicts"',
-          "    exit 1",
-          "  fi",
-          '  if [ "$STATE" = "OPEN MERGEABLE" ] && gh pr merge "$BRANCH" --merge; then',
-          '    MERGED="true"',
-          "    break",
-          "  fi",
-          '  echo "release pull request is not mergeable yet (attempt $ATTEMPT/15)"',
-          "  sleep 2",
-          "done",
-          'if [ "$MERGED" != "true" ]; then',
-          '  echo "::error::release pull request did not become mergeable"',
-          "  exit 1",
-          "fi",
-          'gh workflow run release.yml --ref "$RELEASE_BRANCH" -f automatic=true',
-        ].join("\n"),
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+          BRANCH="$(jq -r '.[0].headBranchName' <<<"$RELEASE_PRS")"
+          test -n "$BRANCH" && test "$BRANCH" != "null"
+          git fetch origin "$BRANCH"
+          git switch --force-create "$BRANCH" "origin/$BRANCH"
+          bun install
+          bunx projen
+          bun node_modules/@dbx-tools/projen/tasks/version-check.ts
+          bun node_modules/@dbx-tools/projen/tasks/release-plan.ts --base-ref origin/${branch}
+          bun node_modules/@dbx-tools/projen/tasks/release-summary-units.ts --from-ref origin/${branch}
+          if ! git diff --quiet || test -n "$(git ls-files --others --exclude-standard)"; then
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git add -A
+            git commit -m "chore: reconcile release metadata"
+            git push origin "HEAD:$BRANCH"
+          fi
+          MERGED="false"
+          for ATTEMPT in $(seq 1 15); do
+            STATE="$(gh pr view "$BRANCH" --json state,mergeable --jq '[.state,.mergeable] | join(" ")')"
+            if [[ "$STATE" == MERGED* ]]; then MERGED="true"; break; fi
+            if [ "$STATE" = "OPEN CONFLICTING" ]; then
+              echo "::error::release pull request has merge conflicts"
+              exit 1
+            fi
+            if [ "$STATE" = "OPEN MERGEABLE" ] && gh pr merge "$BRANCH" --merge; then
+              MERGED="true"
+              break
+            fi
+            echo "release pull request is not mergeable yet (attempt $ATTEMPT/15)"
+            sleep 2
+          done
+          if [ "$MERGED" != "true" ]; then
+            echo "::error::release pull request did not become mergeable"
+            exit 1
+          fi
+          gh workflow run release.yml --ref "$RELEASE_BRANCH" -f automatic=true
+        `
+          // ============================================================================
+        ),
       },
     ],
   };
@@ -499,22 +515,27 @@ function configureReleaseRequestWorkflow(
         name: "Read release request",
         id: "request",
         shell: "bash",
-        run: [
-          'MESSAGE="$(git log -1 --format=%B)"',
-          'if ! grep -q "^Release-Request: true$" <<<"$MESSAGE"; then',
-          '  echo "requested=false" >> "$GITHUB_OUTPUT"',
-          "  exit 0",
-          "fi",
-          `git fetch origin ${JSON.stringify(baseBranch)}`,
-          `if git diff --quiet "origin/${baseBranch}...HEAD"; then`,
-          '  echo "requested=false" >> "$GITHUB_OUTPUT"',
-          "  exit 0",
-          "fi",
-          'echo "requested=true" >> "$GITHUB_OUTPUT"',
-          'echo "branch=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"',
-          'echo "notes_path=$(sed -n \'s/^Release-Notes-Path: //p\' <<<"$MESSAGE" | tail -1)" >> "$GITHUB_OUTPUT"',
-          'echo "title=$(git log -1 --skip=1 --format=%s)" >> "$GITHUB_OUTPUT"',
-        ].join("\n"),
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+          MESSAGE="$(git log -1 --format=%B)"
+          if ! grep -q "^Release-Request: true$" <<<"$MESSAGE"; then
+            echo "requested=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git fetch origin ${JSON.stringify(baseBranch)}
+          if git diff --quiet "origin/${baseBranch}...HEAD"; then
+            echo "requested=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "requested=true" >> "$GITHUB_OUTPUT"
+          echo "branch=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
+          echo "notes_path=$(sed -n 's/^Release-Notes-Path: //p' <<<"$MESSAGE" | tail -1)" >> "$GITHUB_OUTPUT"
+          echo "title=$(git log -1 --skip=1 --format=%s)" >> "$GITHUB_OUTPUT"
+        `
+          // ============================================================================
+        ),
       },
       {
         name: "Create, merge, and release source pull request",
@@ -527,20 +548,25 @@ function configureReleaseRequestWorkflow(
           NOTES_PATH: "${{ steps.request.outputs.notes_path }}",
         },
         shell: "bash",
-        run: [
-          'test -f "$NOTES_PATH"',
-          'NOTES="$(cat "$NOTES_PATH")"',
-          'BODY="$(printf \'## Release notes\\n\\n%s\\n\' "$NOTES")"',
-          'PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq \'.[0].number // empty\')"',
-          'if [ -n "$PR" ]; then',
-          '  gh pr edit "$PR" --title "$TITLE" --body "$BODY"',
-          "else",
-          '  gh pr create --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --title "$TITLE" --body "$BODY"',
-          '  PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq \'.[0].number\')"',
-          "fi",
-          'gh pr merge "$PR" --merge',
-          'gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref "$BASE_BRANCH" -f automatic=true',
-        ].join("\n"),
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+          test -f "$NOTES_PATH"
+          NOTES="$(cat "$NOTES_PATH")"
+          BODY="$(printf '## Release notes\\n\\n%s\\n' "$NOTES")"
+          PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq '.[0].number // empty')"
+          if [ -n "$PR" ]; then
+            gh pr edit "$PR" --title "$TITLE" --body "$BODY"
+          else
+            gh pr create --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --title "$TITLE" --body "$BODY"
+            PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq '.[0].number')"
+          fi
+          gh pr merge "$PR" --merge
+          gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref "$BASE_BRANCH" -f automatic=true
+        `
+          // ============================================================================
+        ),
       },
     ],
   });
@@ -672,20 +698,25 @@ function independentReleaseNotesJob(project: DBXToolsJavaScriptProject): Job {
       {
         name: "Remove consumed release notes",
         shell: "bash",
-        run: [
-          `git fetch origin ${JSON.stringify(projectReleaseBranch(project))}`,
-          `if [ "$(git rev-parse origin/${projectReleaseBranch(project)})" != "$(git rev-parse HEAD)" ]; then`,
-          '  echo "::warning::main advanced before release-note cleanup; leaving temporary notes for the next release"',
-          "  exit 0",
-          "fi",
-          "git rm -r --ignore-unmatch .release-notes",
-          "if ! git diff --cached --quiet; then",
-          '  git config user.name "github-actions[bot]"',
-          '  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"',
-          '  git commit -m "chore: remove consumed release notes"',
-          `  git push origin "HEAD:${projectReleaseBranch(project)}"`,
-          "fi",
-        ].join("\n"),
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+          git fetch origin ${JSON.stringify(projectReleaseBranch(project))}
+          if [ "$(git rev-parse origin/${projectReleaseBranch(project)})" != "$(git rev-parse HEAD)" ]; then
+            echo "::warning::main advanced before release-note cleanup; leaving temporary notes for the next release"
+            exit 0
+          fi
+          git rm -r --ignore-unmatch .release-notes
+          if ! git diff --cached --quiet; then
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git commit -m "chore: remove consumed release notes"
+            git push origin "HEAD:${projectReleaseBranch(project)}"
+          fi
+        `
+          // ============================================================================
+        ),
       },
     ],
   };
@@ -769,44 +800,49 @@ function addIndependentBranchSyncJob(
         name: `Safely sync ${branch}`,
         shell: "bash",
         env: { SOURCE_BRANCH: branch, RELEASE_BRANCH: releaseBranch },
-        run: [
-          'if ! git ls-remote --exit-code --heads origin "refs/heads/$SOURCE_BRANCH" >/dev/null 2>&1; then',
-          '  echo "source branch $SOURCE_BRANCH no longer exists; nothing to sync"',
-          "  exit 0",
-          "fi",
-          'git fetch origin "refs/heads/$SOURCE_BRANCH:refs/remotes/origin/$SOURCE_BRANCH"',
-          'git fetch origin "refs/heads/$RELEASE_BRANCH:refs/remotes/origin/$RELEASE_BRANCH"',
-          'if git merge-base --is-ancestor "origin/$SOURCE_BRANCH" "origin/$RELEASE_BRANCH"; then',
-          '  git push origin "refs/remotes/origin/$RELEASE_BRANCH:refs/heads/$SOURCE_BRANCH"',
-          'elif git merge-base --is-ancestor "origin/$RELEASE_BRANCH" "origin/$SOURCE_BRANCH"; then',
-          '  echo "source branch $SOURCE_BRANCH already contains released main"',
-          "else",
-          '  git config user.name "github-actions[bot]"',
-          '  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"',
-          '  git switch --force-create "$SOURCE_BRANCH" "origin/$SOURCE_BRANCH"',
-          '  if git merge --no-ff --no-edit "origin/$RELEASE_BRANCH"; then',
-          '    git push origin "HEAD:refs/heads/$SOURCE_BRANCH"',
-          "  else",
-          '    SAFE_GENERATED="true"',
-          "    while IFS= read -r FILE; do",
-          '      case "$FILE" in',
-          "        .projen/release-units.json|.release-please-manifest.json|.release-units/*/source.json|.release-units/*/version.txt|.release-units/*/CHANGELOG.md|Cargo.lock|*/Cargo.toml|*/package.json|*/pyproject.toml|*/index.ts) ;;",
-          '        *) SAFE_GENERATED="false" ;;',
-          "      esac",
-          "    done < <(git diff --name-only --diff-filter=U)",
-          '    if [ "$SAFE_GENERATED" = "true" ] && bunx projen; then',
-          "      git add -A",
-          '      if [ -z "$(git diff --name-only --diff-filter=U)" ]; then',
-          "        git commit --no-edit",
-          '        git push origin "HEAD:refs/heads/$SOURCE_BRANCH"',
-          "        exit 0",
-          "      fi",
-          "    fi",
-          "    git merge --abort",
-          '    echo "::warning::source branch $SOURCE_BRANCH has handwritten or unresolved conflicts with released main; leaving it untouched"',
-          "  fi",
-          "fi",
-        ].join("\n"),
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+          if ! git ls-remote --exit-code --heads origin "refs/heads/$SOURCE_BRANCH" >/dev/null 2>&1; then
+            echo "source branch $SOURCE_BRANCH no longer exists; nothing to sync"
+            exit 0
+          fi
+          git fetch origin "refs/heads/$SOURCE_BRANCH:refs/remotes/origin/$SOURCE_BRANCH"
+          git fetch origin "refs/heads/$RELEASE_BRANCH:refs/remotes/origin/$RELEASE_BRANCH"
+          if git merge-base --is-ancestor "origin/$SOURCE_BRANCH" "origin/$RELEASE_BRANCH"; then
+            git push origin "refs/remotes/origin/$RELEASE_BRANCH:refs/heads/$SOURCE_BRANCH"
+          elif git merge-base --is-ancestor "origin/$RELEASE_BRANCH" "origin/$SOURCE_BRANCH"; then
+            echo "source branch $SOURCE_BRANCH already contains released main"
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git switch --force-create "$SOURCE_BRANCH" "origin/$SOURCE_BRANCH"
+            if git merge --no-ff --no-edit "origin/$RELEASE_BRANCH"; then
+              git push origin "HEAD:refs/heads/$SOURCE_BRANCH"
+            else
+              SAFE_GENERATED="true"
+              while IFS= read -r FILE; do
+                case "$FILE" in
+                  .projen/release-units.json|.release-please-manifest.json|.release-units/*/source.json|.release-units/*/version.txt|.release-units/*/CHANGELOG.md|Cargo.lock|*/Cargo.toml|*/package.json|*/pyproject.toml|*/index.ts) ;;
+                  *) SAFE_GENERATED="false" ;;
+                esac
+              done < <(git diff --name-only --diff-filter=U)
+              if [ "$SAFE_GENERATED" = "true" ] && bunx projen; then
+                git add -A
+                if [ -z "$(git diff --name-only --diff-filter=U)" ]; then
+                  git commit --no-edit
+                  git push origin "HEAD:refs/heads/$SOURCE_BRANCH"
+                  exit 0
+                fi
+              fi
+              git merge --abort
+              echo "::warning::source branch $SOURCE_BRANCH has handwritten or unresolved conflicts with released main; leaving it untouched"
+            fi
+          fi
+        `
+          // ============================================================================
+        ),
       },
     ],
   });

package/tasks/sync.ts

@@ -95,9 +95,9 @@ if (!process.argv.includes("--watch")) {
    * re-emitting it is how we say "stop" in a language the supervisor understands.
    *
    * Killing is asynchronous (concurrently shells out to `ps` to walk each process tree)
-   * and can outlive `result`, which is how a plain SIGTERM used to leave orphaned
-   * watchers behind. The timer holds the process open until the kills land, and doubles
-   * as the backstop that leaves anyway if one of them wedges.
+   * and can outlive `result`. The timer keeps the process open until the kills
+   * land, which prevents orphaned watchers after SIGTERM. It also stops waiting
+   * if one of them wedges.
    */
   function stop(): void {
     if (stopping) return;