@dbx-tools/projen 0.9.7 → 0.9.9

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.7";
+export const PACKAGE_VERSION = "0.9.9";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -36,6 +36,7 @@ export * as tsconfig from "./src/tsconfig.ts";
 export * as uniffi from "./src/uniffi.ts";
 export * as vscode from "./src/vscode.ts";
 export * as watch from "./src/watch.ts";
+export * as workspaceLock from "./src/workspace-lock.ts";
 export * as workspaceVersion from "./src/workspace-version.ts";
 export { BUN_DEV_OVERRIDE, BUN_BUILD_OVERRIDE, BUN_APP_OVERRIDES, RootBunfigFile, BunfigFile, BunDevServerFile, BunBuildFile } from "./src/bun-app.ts";
 export { BUN_VERSION } from "./src/bun-workflow.ts";

package/package.json

@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.7",
-    "@dbx-tools/path": "^0.9.7",
-    "@dbx-tools/shared-core": "^0.9.7",
+    "@dbx-tools/core": "^0.9.9",
+    "@dbx-tools/path": "^0.9.9",
+    "@dbx-tools/shared-core": "^0.9.9",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -53,7 +53,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/_rust-project.ts

@@ -26,6 +26,19 @@ export interface RustCliOptions {
   readonly command?: string;
   /** Root CLI help text. Defaults to the Rust package description. */
   readonly description?: string;
+  /** Keep the binary installable by registry lookup without exposing a root command. */
+  readonly hidden?: boolean;
+}
+
+/** One explicit Cargo binary target and its optional release registration. */
+export interface RustBinaryOptions {
+  readonly name: string;
+  readonly path: string;
+  readonly requiredFeatures?: readonly string[];
+  readonly release?: boolean;
+  readonly releaseExcludeOs?: readonly RustReleaseOs[];
+  readonly description?: string;
+  readonly cli?: boolean | RustCliOptions;
 }
 
 /** Explicit Cargo example target and the feature gate required to compile it. */
@@ -47,6 +60,8 @@ export interface RustCrateOptions {
   /** Omit this crate and any release binary artifact from these operating systems. */
   readonly releaseExcludeOs?: readonly RustReleaseOs[];
   readonly dependencies?: Readonly<Record<string, CargoDependency>>;
+  /** Cargo dependencies scoped by a target cfg expression. */
+  readonly targetDependencies?: Readonly<Record<string, Readonly<Record<string, CargoDependency>>>>;
   readonly devDependencies?: Readonly<Record<string, CargoDependency>>;
   readonly features?: Readonly<Record<string, readonly string[]>>;
   readonly defaultFeatures?: readonly string[];
@@ -54,6 +69,10 @@ export interface RustCrateOptions {
   readonly examples?: readonly CargoExampleOptions[];
   /** Cargo and release executable name. Defaults to the generated package name. */
   readonly binaryName?: string;
+  /** Additional Cargo binary targets owned by this crate. */
+  readonly binaries?: readonly RustBinaryOptions[];
+  /** Cargo binary selected by `cargo run` when this crate has multiple binaries. */
+  readonly defaultRun?: string;
   /** Publish this release binary through the generated `dbx` command registry. */
   readonly cli?: boolean | RustCliOptions;
   readonly bindings?: readonly ("node" | "python")[];
@@ -187,10 +206,12 @@ function packageOptions(
     ...(options.release !== undefined ? { release: options.release } : {}),
     ...(options.releaseExcludeOs ? { releaseExcludeOs: options.releaseExcludeOs } : {}),
     ...(options.dependencies ? { dependencies: options.dependencies } : {}),
+    ...(options.targetDependencies ? { targetDependencies: options.targetDependencies } : {}),
     ...(options.devDependencies ? { devDependencies: options.devDependencies } : {}),
     ...(options.features ? { features: options.features } : {}),
     ...(options.defaultFeatures ? { defaultFeatures: options.defaultFeatures } : {}),
     ...(options.binaryName ? { binaryName: options.binaryName } : {}),
+    ...(options.binaries ? { binaries: options.binaries } : {}),
     ...(options.cli !== undefined ? { cli: options.cli } : {}),
     ...(options.bindings ? { bindings: options.bindings } : {}),
     ...(options.uniffiConfig ? { uniffiConfig: options.uniffiConfig } : {}),
@@ -244,6 +265,7 @@ export class RustProject extends Project implements DBXToolsProject {
       ...(!workspace ? { workspace: {} } : {}),
       package: {
         name: this.crateName,
+        ...(options.defaultRun ? { "default-run": options.defaultRun } : {}),
         version: inheritedCargoValue(workspace, options.version, "0.1.0"),
         edition: inheritedCargoValue(workspace, options.edition, "2021"),
         "rust-version": inheritedCargoValue(workspace, options.rustVersion, "1.82"),
@@ -272,6 +294,13 @@ export class RustProject extends Project implements DBXToolsProject {
                 ? [{ name: `${this.crateName}-uniffi-bindgen`, path: "uniffi-bindgen.rs" }]
                 : []),
               ...(binary ? [{ name: binaryName, path: "src/main.rs" }] : []),
+              ...(options.binaries ?? []).map((target) => ({
+                name: target.name,
+                path: target.path,
+                ...(target.requiredFeatures?.length
+                  ? { "required-features": [...target.requiredFeatures] }
+                  : {}),
+              })),
             ],
           }
         : {}),
@@ -304,6 +333,23 @@ export class RustProject extends Project implements DBXToolsProject {
             ),
           }
         : {}),
+      ...(options.targetDependencies
+        ? {
+            target: Object.fromEntries(
+              Object.entries(options.targetDependencies).map(([target, dependencies]) => [
+                target,
+                {
+                  dependencies: Object.fromEntries(
+                    Object.entries(dependencies).map(([name, value]) => [
+                      name,
+                      cargoDependency(value, dependencyVersion),
+                    ]),
+                  ),
+                },
+              ]),
+            ),
+          }
+        : {}),
       ...(options.devDependencies
         ? {
             "dev-dependencies": Object.fromEntries(

package/src/_rust-release-workflow.ts

@@ -128,6 +128,7 @@ interface RustReleaseBinaryPlan {
   readonly crate: string;
   readonly binary: string;
   readonly excludedOs: readonly RustReleaseOs[];
+  readonly requiredFeatures: readonly string[];
 }
 
 type RustReleaseTargetPlan = Readonly<Record<string, string | boolean | number>>;
@@ -165,13 +166,26 @@ export function planRustRelease(
     nodePackage: binding.nodePackage ?? "",
     pythonPackage: binding.pythonPackage ?? "",
   }));
-  const releaseBinaries = packages
-    .filter((pkg) => pkg.packageOptions.release)
-    .map((pkg) => ({
-      crate: pkg.crateName,
-      binary: pkg.packageOptions.binaryName ?? pkg.crateName,
-      excludedOs: pkg.packageOptions.releaseExcludeOs ?? [],
-    }));
+  const releaseBinaries = packages.flatMap((pkg) => [
+    ...(pkg.packageOptions.release
+      ? [
+          {
+            crate: pkg.crateName,
+            binary: pkg.packageOptions.binaryName ?? pkg.crateName,
+            excludedOs: pkg.packageOptions.releaseExcludeOs ?? [],
+            requiredFeatures: [],
+          },
+        ]
+      : []),
+    ...(pkg.packageOptions.binaries ?? [])
+      .filter((binary) => binary.release)
+      .map((binary) => ({
+        crate: pkg.crateName,
+        binary: binary.name,
+        excludedOs: binary.releaseExcludeOs ?? [],
+        requiredFeatures: binary.requiredFeatures ?? [],
+      })),
+  ]);
   const publicCrates = orderRustBindings(
     packages
       .filter((pkg) => !pkg.packageOptions.private)
@@ -338,7 +352,31 @@ function rustBinaryCommands(plan: RustReleasePlan, independent: boolean): string
   });
 }
 
+function rustAdditionalBinaryBuildCommands(plan: RustReleasePlan, independent: boolean): string[] {
+  return plan.releaseBinaries
+    .filter((binary) => binary.requiredFeatures.length)
+    .flatMap((binary) => {
+      const command = `cargo build --release --package "${binary.crate}" --bin "${binary.binary}" --features "${binary.requiredFeatures.join(",")}"${
+        plan.usesCargoLock ? " --locked" : ""
+      } --target "\${{ matrix.cargo }}"`;
+      const excludedCondition = binary.excludedOs
+        .map((os) => `[ "\${{ matrix.os }}" != "${os}" ]`)
+        .join(" && ");
+      const platformCommands = excludedCondition
+        ? [`if ${excludedCondition}; then`, `  ${command}`, "fi"]
+        : [command];
+      if (!independent) return platformCommands;
+      const unit = defaultReleaseUnitId("rust", binary.crate);
+      return [
+        `if jq -e --arg unit "${unit}" '.units[] | select(.id == $unit)' dist/release-plan.json >/dev/null; then`,
+        ...platformCommands.map((line) => `  ${line}`),
+        "fi",
+      ];
+    });
+}
+
 function rustArtifactSteps(plan: RustReleasePlan): JobStep[] {
+  const binaryCrates = [...new Set(plan.releaseBinaries.map((binary) => binary.crate))];
   return [
     ...plan.bindings.flatMap((binding) => [
       ...(binding.node
@@ -368,24 +406,35 @@ function rustArtifactSteps(plan: RustReleasePlan): JobStep[] {
           ]
         : []),
     ]),
-    ...plan.releaseBinaries.map((pkg) => ({
-      name: `Upload ${pkg.crate} release binary`,
-      uses: "actions/upload-artifact@v7",
-      ...(rustReleaseBinaryCondition(pkg.excludedOs)
-        ? { if: rustReleaseBinaryCondition(pkg.excludedOs) }
-        : {}),
-      with: {
-        name: `${pkg.crate}-\${{ matrix.node }}-binary`,
-        path: `dist/release/${pkg.crate}/\${{ matrix.node }}/binary/*`,
-        "retention-days": 7,
-      },
-    })),
+    ...binaryCrates.map((crate) => {
+      const binaries = plan.releaseBinaries.filter((binary) => binary.crate === crate);
+      const excludedOs =
+        binaries[0]?.excludedOs.filter((os) =>
+          binaries.every((binary) => binary.excludedOs.includes(os)),
+        ) ?? [];
+      return {
+        name: `Upload ${crate} release binary`,
+        uses: "actions/upload-artifact@v7",
+        ...(rustReleaseBinaryCondition(excludedOs)
+          ? { if: rustReleaseBinaryCondition(excludedOs) }
+          : {}),
+        with: {
+          name: `${crate}-\${{ matrix.node }}-binary`,
+          path: `dist/release/${crate}/\${{ matrix.node }}/binary/*`,
+          "retention-days": 7,
+        },
+      };
+    }),
   ];
 }
 
 export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly JobStep[]): Job {
   const bindingCommands = rustBindingCommands(plan, Boolean(independentSetup));
   const binaryCommands = rustBinaryCommands(plan, Boolean(independentSetup));
+  const additionalBinaryBuildCommands = rustAdditionalBinaryBuildCommands(
+    plan,
+    Boolean(independentSetup),
+  );
   return {
     if: independentSetup
       ? "${{ needs.release-plan.outputs.rust_targets != '[]' && (github.event_name == 'push' || inputs.stage != 'docs') }}"
@@ -524,16 +573,19 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
         },
         run: timedBash(
           "rust_workspace",
-          independentSetup
-            ? [
-                "mapfile -t PACKAGES < <(jq -r '.[]' <<<'${{ toJSON(matrix.packages) }}')",
-                "PACKAGE_ARGS=()",
-                'for PACKAGE in "${PACKAGES[@]}"; do PACKAGE_ARGS+=(--package "$PACKAGE"); done',
-                `cargo build --release --timings "\${PACKAGE_ARGS[@]}"${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"`,
-              ].join("\n")
-            : `cargo build --release --timings --workspace${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
-                plan.hasReleaseExclusions ? " ${{ matrix.cargoExcludes }}" : ""
-              }`,
+          [
+            independentSetup
+              ? [
+                  "mapfile -t PACKAGES < <(jq -r '.[]' <<<'${{ toJSON(matrix.packages) }}')",
+                  "PACKAGE_ARGS=()",
+                  'for PACKAGE in "${PACKAGES[@]}"; do PACKAGE_ARGS+=(--package "$PACKAGE"); done',
+                  `cargo build --release --timings "\${PACKAGE_ARGS[@]}"${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"`,
+                ].join("\n")
+              : `cargo build --release --timings --workspace${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
+                  plan.hasReleaseExclusions ? " ${{ matrix.cargoExcludes }}" : ""
+                }`,
+            ...additionalBinaryBuildCommands,
+          ].join("\n"),
         ),
       },
       ...(!independentSetup

package/src/project-rs.ts

@@ -289,9 +289,11 @@ export interface RustReleaseBinaryMapping {
   readonly command: string;
   readonly description: string;
   readonly binaryName: string;
+  readonly hidden: boolean;
   readonly unit: string;
   readonly component: string;
   readonly version: string;
+  readonly tagPrefix: string;
   readonly tag: string;
   readonly repository: string;
   readonly assets: readonly RustReleaseBinaryAssetMapping[];
@@ -379,17 +381,40 @@ function planRustReleaseBinaries(
   resolved: ResolvedRustWorkspaceOptions,
 ): RustReleaseBinaryMapping[] {
   const commands = new Set<string>();
-  const binaries = packages
-    .filter((pkg) => Boolean(pkg.packageOptions.cli))
-    .map((pkg) => {
-      if (!pkg.packageOptions.release) {
+  const binaries = packages.flatMap((pkg) => {
+    const configuredBinaries = [
+      ...(pkg.packageOptions.cli
+        ? [
+            {
+              name: pkg.packageOptions.binaryName ?? pkg.crateName,
+              defaultCommand: pkg.packageOptions.directory,
+              description: pkg.packageOptions.description,
+              release: pkg.packageOptions.release,
+              excludedOs: pkg.packageOptions.releaseExcludeOs,
+              cli: pkg.packageOptions.cli,
+            },
+          ]
+        : []),
+      ...(pkg.packageOptions.binaries ?? [])
+        .filter((binary) => Boolean(binary.cli))
+        .map((binary) => ({
+          name: binary.name,
+          defaultCommand: binary.name,
+          description: binary.description ?? pkg.packageOptions.description,
+          release: binary.release,
+          excludedOs: binary.releaseExcludeOs,
+          cli: binary.cli!,
+        })),
+    ];
+    return configuredBinaries.map((binary) => {
+      if (!binary.release) {
         throw new Error(`${pkg.crateName} must set release when cli is configured`);
       }
-      const configured = pkg.packageOptions.cli;
+      const configured = binary.cli;
       const command =
         typeof configured === "object" && configured.command
           ? configured.command
-          : pkg.packageOptions.directory;
+          : binary.defaultCommand;
       if (!/^[a-z0-9][a-z0-9-]*$/.test(command)) {
         throw new Error(`Invalid Rust CLI command: ${command}`);
       }
@@ -399,24 +424,31 @@ function planRustReleaseBinaries(
       commands.add(command);
       const description =
         (typeof configured === "object" ? configured.description : undefined) ??
-        pkg.packageOptions.description ??
+        binary.description ??
         pkg.crateName;
-      const excludedOs = new Set(pkg.packageOptions.releaseExcludeOs ?? []);
-      const binaryName = pkg.packageOptions.binaryName ?? pkg.crateName;
+      const hidden = typeof configured === "object" && configured.hidden === true;
+      const excludedOs = new Set(binary.excludedOs ?? []);
+      const binaryName = binary.name;
       const identity = isDBXToolsJavaScriptProject()(project)
         ? project.releaseCatalog.releaseIdentityFor(pkg)
         : {
             component: defaultReleaseUnitId("rust", pkg.crateName),
             version: readWorkspaceVersion(project.outdir),
           };
+      const tagPrefix =
+        isDBXToolsJavaScriptProject()(project) && project.releaseCatalog.mode === "independent"
+          ? `${identity.component}-v`
+          : "v";
       return {
         command,
         description,
         binaryName,
+        hidden,
         unit: "id" in identity ? identity.id : identity.component,
         component: identity.component,
         version: identity.version,
-        tag: `${identity.component}-v${identity.version}`,
+        tagPrefix,
+        tag: `${tagPrefix}${identity.version}`,
         repository: resolved.repository,
         assets: resolved.nativeTargets
           .filter((target) => !excludedOs.has(target.os))
@@ -427,6 +459,7 @@ function planRustReleaseBinaries(
           })),
       };
     });
+  });
   if (binaries.length && !resolved.repository) {
     throw new Error("A repository URL is required when Rust CLI commands are configured");
   }
@@ -894,6 +927,10 @@ export class DBXToolsRustWorkspace extends Component {
           identity: pkg.crateName,
           publish: !pkg.packageOptions.private || pkg.packageOptions.release === true,
           sourcePaths: [`${toPosix(relative(project.outdir, pkg.outdir))}/src`],
+        });
+      }
+      for (const pkg of this.packages) {
+        project.releaseCatalog.configureProject(pkg, {
           dependencies: [
             ...rustReleaseDependencies(
               project,
@@ -921,7 +958,7 @@ export class DBXToolsRustWorkspace extends Component {
     if (isDBXToolsJavaScriptProject()(project)) {
       for (const binary of this.releaseBinaries) {
         project.releaseCatalog.registerArtifact(binary.unit, {
-          id: `${binary.unit}:github-binary`,
+          id: `${binary.unit}:github-binary:${binary.binaryName}`,
           kind: "github-binary",
           name: binary.binaryName,
           generated: true,

package/src/release-catalog.ts

@@ -311,7 +311,10 @@ export class DBXToolsReleaseCatalog extends Component {
   /** Replace grouping metadata for an already registered project. */
   configureProject(
     project: Project,
-    options: Pick<ReleaseProjectRegistration, "unit" | "component" | "publish" | "sourcePaths">,
+    options: Pick<
+      ReleaseProjectRegistration,
+      "unit" | "component" | "publish" | "sourcePaths" | "dependencies"
+    >,
   ): void {
     const current = this.projects.get(project);
     if (!current) throw new Error(`Release project is not registered: ${project.outdir}`);

package/src/watch.ts

@@ -19,6 +19,7 @@ import { isAbsolute, resolve } from "node:path";
 import { watch as pathWatch } from "@dbx-tools/path";
 import { asyncUtils, log } from "@dbx-tools/shared-core";
 import { isGeneratedFile, recordedRoots, repoRoot } from "./packages.ts";
+import { withWorkspaceMutationLock } from "./workspace-lock.ts";
 
 const logger = log.logger("projen:watch");
 const DEBOUNCE_MS = 250;
@@ -103,7 +104,9 @@ export function watchLoop(
       .filter((p) => !ignoredPath(p));
     pending.clear();
     try {
-      if (relevant.length) await onBatch(relevant);
+      if (relevant.length) {
+        await withWorkspaceMutationLock(repoRoot, () => onBatch(relevant));
+      }
     } catch (err) {
       logger.error(`${tag} cycle failed:`, err instanceof Error ? err.message : err);
     } finally {

package/src/workspace-lock.ts

@@ -0,0 +1,22 @@
+/** Cross-process coordination for generated workspace mutations. */
+import { resolve } from "node:path";
+import * as fileLock from "@dbx-tools/core/file-lock";
+import { log } from "@dbx-tools/shared-core";
+
+const MUTATION_LOCK_SCOPE = "dbx-tools-workspace-mutation";
+const logger = log.logger("projen:workspace-lock");
+
+/**
+ * Serialize synthesis, generated-file watchers, and release preparation for one
+ * repository without coordinating unrelated worktrees or repositories.
+ */
+export function withWorkspaceMutationLock<T>(
+  root: string,
+  callback: () => T | Promise<T>,
+): Promise<T> {
+  const repository = resolve(root);
+  return fileLock.withFileLock([MUTATION_LOCK_SCOPE, repository], callback, {
+    backends: process.platform === "win32" ? ["file"] : ["flock", "file"],
+    onWait: () => logger.info("waiting for workspace mutation lock", { repository }),
+  });
+}

package/tasks/publish-uniffi-local.ts

@@ -4,7 +4,7 @@ import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { log } from "@dbx-tools/shared-core";
+import { json, log, object } from "@dbx-tools/shared-core";
 import { parse, stringify } from "smol-toml";
 import { captureTaskCommand, runTaskCommand, taskCommandSucceeds } from "../src/_task-command.ts";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
@@ -42,6 +42,7 @@ function pythonTag(): string {
     "uv",
     [
       "run",
+      "--no-project",
       "python",
       "-c",
       "import sysconfig; print(sysconfig.get_platform().replace('-', '_').replace('.', '_'))",
@@ -94,17 +95,90 @@ function cargoVersionExists(crateName: string, version: string, registry: string
   ]);
 }
 
+interface CargoMetadataPackage {
+  dependencies: Array<{ name: string; source?: string | null }>;
+  manifest_path: string;
+  name: string;
+}
+
+function orderedCargoManifests(config: RustWorkspaceMapping): string[] {
+  const configured = new Set(config.crates.map((crate) => resolve(repoRoot, crate, "Cargo.toml")));
+  const metadata = json.parseRecord(
+    run("cargo", ["metadata", "--format-version", "1", "--no-deps", "--locked"], true),
+  );
+  if (!metadata || !Array.isArray(metadata.packages)) {
+    throw new Error("Cargo metadata did not return workspace packages");
+  }
+  const packages = metadata.packages.filter(object.isRecord).map((pkg) => {
+    if (
+      typeof pkg.name !== "string" ||
+      typeof pkg.manifest_path !== "string" ||
+      !Array.isArray(pkg.dependencies)
+    ) {
+      throw new Error("Cargo metadata returned an invalid package");
+    }
+    return {
+      name: pkg.name,
+      manifest_path: resolve(pkg.manifest_path),
+      dependencies: pkg.dependencies.filter(object.isRecord).map((dependency) => {
+        if (typeof dependency.name !== "string") {
+          throw new Error(`Cargo metadata returned an invalid dependency for ${pkg.name}`);
+        }
+        return {
+          name: dependency.name,
+          source: typeof dependency.source === "string" ? dependency.source : null,
+        };
+      }),
+    } satisfies CargoMetadataPackage;
+  });
+  const publishable = new Map(
+    packages
+      .filter((pkg) => configured.has(pkg.manifest_path))
+      .filter((pkg) => {
+        const manifest = parse(readFileSync(pkg.manifest_path, "utf8")) as {
+          package?: { publish?: boolean };
+        };
+        return manifest.package?.publish !== false;
+      })
+      .map((pkg) => [pkg.name, pkg]),
+  );
+  const ordered: CargoMetadataPackage[] = [];
+  const visiting = new Set<string>();
+  const completed = new Set<string>();
+  const visit = (pkg: CargoMetadataPackage): void => {
+    if (completed.has(pkg.name)) return;
+    if (visiting.has(pkg.name)) {
+      throw new Error(`Cyclic Cargo publication dependency: ${pkg.name}`);
+    }
+    visiting.add(pkg.name);
+    for (const dependency of pkg.dependencies) {
+      if (dependency.source) continue;
+      const workspaceDependency = publishable.get(dependency.name);
+      if (workspaceDependency) visit(workspaceDependency);
+    }
+    visiting.delete(pkg.name);
+    completed.add(pkg.name);
+    ordered.push(pkg);
+  };
+  for (const pkg of publishable.values()) visit(pkg);
+  return ordered.map((pkg) => pkg.manifest_path);
+}
+
 function publishCargo(config: RustWorkspaceMapping, registry: string, version: string): void {
-  const manifests = config.crates
-    .map((crate) => resolve(repoRoot, crate, "Cargo.toml"))
-    .filter((manifest) => !/^publish = false$/m.test(readFileSync(manifest, "utf8")));
+  const manifests = orderedCargoManifests(config);
   const originals = new Map(
     manifests.map((manifest) => [manifest, readFileSync(manifest, "utf8")]),
   );
   try {
-    const crateNames = manifests.map(
-      (manifest) => readFileSync(manifest, "utf8").match(/^name = "([^"]+)"$/m)?.[1],
-    );
+    const crateNames = manifests.map((manifest) => {
+      const document = parse(readFileSync(manifest, "utf8")) as {
+        package?: { name?: string };
+      };
+      if (!document.package?.name) {
+        throw new Error(`Cargo manifest has no package name: ${manifest}`);
+      }
+      return document.package.name;
+    });
     for (const manifest of manifests) {
       const mode = statSync(manifest).mode;
       const document = parse(readFileSync(manifest, "utf8")) as Record<string, unknown>;

package/tasks/release-pr.ts

@@ -48,6 +48,7 @@ import {
   resolveBaseVersion,
   resolveNextVersion,
 } from "../src/workspace-version.ts";
+import { withWorkspaceMutationLock } from "../src/workspace-lock.ts";
 
 const logger = log.logger("projen:release");
 
@@ -303,227 +304,237 @@ program
       waitTimeoutMinutes: string;
     }) => {
       const root = projectUtils.root() ?? process.cwd();
-      const waitTimeoutMinutes = object.toNumber(opts.waitTimeoutMinutes, {
-        separators: false,
-        percent: false,
-      });
-      if (
-        waitTimeoutMinutes === undefined ||
-        !Number.isInteger(waitTimeoutMinutes) ||
-        waitTimeoutMinutes <= 0
-      ) {
-        throw new Error("--wait-timeout-minutes must be a positive integer");
-      }
-      const waitTimeoutMs = waitTimeoutMinutes * 60_000;
-      const currentBranch = git(root, ["branch", "--show-current"], { capture: true });
-      if (!currentBranch) throw new Error("Release preparation requires a local branch");
-      const account = githubAccount(root);
-      git(root, ["fetch", "--tags", "origin", opts.base]);
-      const comparisonBase = resolveBaseVersion(root, [opts.prefix], {
-        fetch: false,
-        includeComponentTags: false,
-      }).version;
-      const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
-      const releaseVersionScript = fileURLToPath(new URL("./release-version.ts", import.meta.url));
-      runTaskCommand(root, process.execPath, [
-        releaseVersionScript,
-        "--version",
-        next.version,
-        "--prefix",
-        opts.prefix,
-        "--assert-next",
-      ]);
-      const releaseTag = `${opts.prefix}${next.version}`;
-      const releaseBranch = `release/${releaseTag}`;
-      const releaseRoot = join(root, ".worktrees", releaseTag);
-      if (currentBranch.startsWith("release/")) {
-        throw new Error("Release preparation must start from a source branch");
-      }
-      if (
-        git(root, ["ls-remote", "--tags", "origin", `refs/tags/${releaseTag}`], {
-          capture: true,
-          check: false,
-        })
-      ) {
-        throw new Error(`Release tag already exists: ${releaseTag}`);
-      }
-
-      const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"], {
-        capture: true,
-      });
-      if (status) {
-        git(root, ["add", "-A"]);
-        git(root, ["commit", "-m", opts.message]);
-      }
-      if (!gitSucceeds(root, ["merge-base", "--is-ancestor", `origin/${opts.base}`, "HEAD"])) {
-        git(root, ["merge", "--no-edit", `origin/${opts.base}`]);
-      }
-      pushCurrentBranch(root, currentBranch);
-
-      const worktreeExists = existsSync(join(releaseRoot, ".git"));
-      if (!worktreeExists) {
-        git(root, ["worktree", "prune"]);
-        const localBranch = git(root, ["branch", "--list", releaseBranch], { capture: true });
-        const remoteBranch = git(
-          root,
-          ["ls-remote", "--heads", "origin", `refs/heads/${releaseBranch}`],
-          { capture: true, check: false },
-        );
-        if (localBranch || remoteBranch) {
-          throw new Error(`Release branch already exists without its worktree: ${releaseBranch}`);
+      await withWorkspaceMutationLock(root, async () => {
+        const waitTimeoutMinutes = object.toNumber(opts.waitTimeoutMinutes, {
+          separators: false,
+          percent: false,
+        });
+        if (
+          waitTimeoutMinutes === undefined ||
+          !Number.isInteger(waitTimeoutMinutes) ||
+          waitTimeoutMinutes <= 0
+        ) {
+          throw new Error("--wait-timeout-minutes must be a positive integer");
         }
-        git(root, ["worktree", "add", "-b", releaseBranch, releaseRoot, "HEAD"]);
-      } else {
-        const releaseStatus = git(
-          releaseRoot,
-          ["status", "--porcelain=v1", "--untracked-files=all"],
-          { capture: true },
+        const waitTimeoutMs = waitTimeoutMinutes * 60_000;
+        const currentBranch = git(root, ["branch", "--show-current"], { capture: true });
+        if (!currentBranch) throw new Error("Release preparation requires a local branch");
+        const account = githubAccount(root);
+        git(root, ["fetch", "--tags", "origin", opts.base]);
+        const comparisonBase = resolveBaseVersion(root, [opts.prefix], {
+          fetch: false,
+          includeComponentTags: false,
+        }).version;
+        const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
+        const releaseVersionScript = fileURLToPath(
+          new URL("./release-version.ts", import.meta.url),
         );
-        if (releaseStatus) {
-          git(releaseRoot, ["stash", "push", "--include-untracked", "--message", "release-resume"]);
+        runTaskCommand(root, process.execPath, [
+          releaseVersionScript,
+          "--version",
+          next.version,
+          "--prefix",
+          opts.prefix,
+          "--assert-next",
+        ]);
+        const releaseTag = `${opts.prefix}${next.version}`;
+        const releaseBranch = `release/${releaseTag}`;
+        const releaseRoot = join(root, ".worktrees", releaseTag);
+        if (currentBranch.startsWith("release/")) {
+          throw new Error("Release preparation must start from a source branch");
+        }
+        if (
+          git(root, ["ls-remote", "--tags", "origin", `refs/tags/${releaseTag}`], {
+            capture: true,
+            check: false,
+          })
+        ) {
+          throw new Error(`Release tag already exists: ${releaseTag}`);
         }
-        if (!gitSucceeds(releaseRoot, ["merge-base", "--is-ancestor", currentBranch, "HEAD"])) {
-          git(releaseRoot, ["merge", "--no-edit", currentBranch]);
+
+        const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"], {
+          capture: true,
+        });
+        if (status) {
+          git(root, ["add", "-A"]);
+          git(root, ["commit", "-m", opts.message]);
         }
-        if (releaseStatus) {
-          git(releaseRoot, ["stash", "pop"]);
+        if (!gitSucceeds(root, ["merge-base", "--is-ancestor", `origin/${opts.base}`, "HEAD"])) {
+          git(root, ["merge", "--no-edit", `origin/${opts.base}`]);
         }
-        logger.info(`resuming ${releaseBranch} in ${releaseRoot}`);
-      }
-      runTaskCommand(releaseRoot, process.execPath, ["install"]);
+        pushCurrentBranch(root, currentBranch);
 
-      const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
-      const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
-      runTaskCommand(releaseRoot, process.execPath, [
-        bumpScript,
-        "--level",
-        opts.level,
-        "--prefix",
-        opts.prefix,
-        ...opts.os.flatMap((value) => ["--os", value]),
-        ...opts.arch.flatMap((value) => ["--arch", value]),
-      ]);
-      if (readWorkspaceVersion(releaseRoot) !== next.version) {
-        throw new Error(`Release preparation did not produce ${next.version}`);
-      }
+        const worktreeExists = existsSync(join(releaseRoot, ".git"));
+        if (!worktreeExists) {
+          git(root, ["worktree", "prune"]);
+          const localBranch = git(root, ["branch", "--list", releaseBranch], { capture: true });
+          const remoteBranch = git(
+            root,
+            ["ls-remote", "--heads", "origin", `refs/heads/${releaseBranch}`],
+            { capture: true, check: false },
+          );
+          if (localBranch || remoteBranch) {
+            throw new Error(`Release branch already exists without its worktree: ${releaseBranch}`);
+          }
+          git(root, ["worktree", "add", "-b", releaseBranch, releaseRoot, "HEAD"]);
+        } else {
+          const releaseStatus = git(
+            releaseRoot,
+            ["status", "--porcelain=v1", "--untracked-files=all"],
+            { capture: true },
+          );
+          if (releaseStatus) {
+            git(releaseRoot, [
+              "stash",
+              "push",
+              "--include-untracked",
+              "--message",
+              "release-resume",
+            ]);
+          }
+          if (!gitSucceeds(releaseRoot, ["merge-base", "--is-ancestor", currentBranch, "HEAD"])) {
+            git(releaseRoot, ["merge", "--no-edit", currentBranch]);
+          }
+          if (releaseStatus) {
+            git(releaseRoot, ["stash", "pop"]);
+          }
+          logger.info(`resuming ${releaseBranch} in ${releaseRoot}`);
+        }
+        runTaskCommand(releaseRoot, process.execPath, ["install"]);
 
-      runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
-      if (opts.validate) {
-        for (const task of opts.validateTask) {
-          runTaskCommand(releaseRoot, process.execPath, ["run", task]);
+        const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
+        const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
+        runTaskCommand(releaseRoot, process.execPath, [
+          bumpScript,
+          "--level",
+          opts.level,
+          "--prefix",
+          opts.prefix,
+          ...opts.os.flatMap((value) => ["--os", value]),
+          ...opts.arch.flatMap((value) => ["--arch", value]),
+        ]);
+        if (readWorkspaceVersion(releaseRoot) !== next.version) {
+          throw new Error(`Release preparation did not produce ${next.version}`);
         }
-        if (existsSync(join(releaseRoot, "Cargo.toml"))) {
-          runTaskCommand(releaseRoot, "cargo", [
-            "test",
-            "--workspace",
-            ...(existsSync(join(releaseRoot, "Cargo.lock")) ? ["--locked"] : []),
-          ]);
+
+        runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
+        if (opts.validate) {
+          for (const task of opts.validateTask) {
+            runTaskCommand(releaseRoot, process.execPath, ["run", task]);
+          }
+          if (existsSync(join(releaseRoot, "Cargo.toml"))) {
+            runTaskCommand(releaseRoot, "cargo", [
+              "test",
+              "--workspace",
+              ...(existsSync(join(releaseRoot, "Cargo.lock")) ? ["--locked"] : []),
+            ]);
+          }
+          runTaskCommand(releaseRoot, process.execPath, ["run", "compile"]);
+        } else {
+          logger.warn("release validation skipped by --no-validate");
         }
-        runTaskCommand(releaseRoot, process.execPath, ["run", "compile"]);
-      } else {
-        logger.warn("release validation skipped by --no-validate");
-      }
-      if (opts.localPublish) {
-        await publishLocalRelease({
-          root: releaseRoot,
-          version: next.version,
-          localRegistry: opts.localRegistry,
-          localPypi: opts.localPypi,
-          pythonRoot: opts.pythonRoot,
-          localCargo: opts.localCargo,
-          reuseValidatedNodeCompile: opts.validate,
-        });
-      } else {
-        logger.info("local publication skipped by --no-local-publish");
-      }
-      runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
-      const releaseSummary = opts.releaseSummary
-        ? await generateReleaseSummary({
+        if (opts.localPublish) {
+          await publishLocalRelease({
             root: releaseRoot,
             version: next.version,
-            fromRef: `${opts.prefix}${comparisonBase}`,
-            providers: releaseSummaryProviders(opts.releaseSummaryProviders),
-          })
-        : undefined;
+            localRegistry: opts.localRegistry,
+            localPypi: opts.localPypi,
+            pythonRoot: opts.pythonRoot,
+            localCargo: opts.localCargo,
+            reuseValidatedNodeCompile: opts.validate,
+          });
+        } else {
+          logger.info("local publication skipped by --no-local-publish");
+        }
+        runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
+        const releaseSummary = opts.releaseSummary
+          ? await generateReleaseSummary({
+              root: releaseRoot,
+              version: next.version,
+              fromRef: `${opts.prefix}${comparisonBase}`,
+              providers: releaseSummaryProviders(opts.releaseSummaryProviders),
+            })
+          : undefined;
 
-      git(releaseRoot, ["add", "-A"]);
-      const staged = git(releaseRoot, ["diff", "--cached", "--name-only"], { capture: true });
-      if (staged) {
-        git(releaseRoot, ["commit", "-m", `chore(release): ${next.version}`]);
-      } else if (!worktreeExists) {
-        throw new Error("Release preparation produced no changes");
-      }
-      // The source push and release commit hooks have already scanned every new
-      // byte. A new remote branch has no upstream comparison point, so the
-      // managed pre-push hook would rescan the repository's complete history.
-      git(releaseRoot, ["push", "--no-verify", "--set-upstream", "origin", releaseBranch]);
+        git(releaseRoot, ["add", "-A"]);
+        const staged = git(releaseRoot, ["diff", "--cached", "--name-only"], { capture: true });
+        if (staged) {
+          git(releaseRoot, ["commit", "-m", `chore(release): ${next.version}`]);
+        } else if (!worktreeExists) {
+          throw new Error("Release preparation produced no changes");
+        }
+        // The source push and release commit hooks have already scanned every new
+        // byte. A new remote branch has no upstream comparison point, so the
+        // managed pre-push hook would rescan the repository's complete history.
+        git(releaseRoot, ["push", "--no-verify", "--set-upstream", "origin", releaseBranch]);
 
-      const title = `chore(release): ${next.version}`;
-      const body = [
-        `Release ${releaseTag}.`,
-        "",
-        `Source commit: ${git(releaseRoot, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
-        "",
-        "Merging this PR updates VERSION on main and starts the public release workflow.",
-        ...(releaseSummary ? ["", releaseSummary] : []),
-      ].join("\n");
-      const githubEnvironment = {
-        ...process.env,
-        GH_HOST: account.hostname,
-        GH_REPO: githubRepositorySpecifier(account),
-        [githubTokenEnvironmentName(account.hostname)]: account.token,
-      };
-      const ensurePullRequest = (): void => {
-        if (
-          taskCommandSucceeds(root, "gh", ["pr", "view", releaseBranch], {
+        const title = `chore(release): ${next.version}`;
+        const body = [
+          `Release ${releaseTag}.`,
+          "",
+          `Source commit: ${git(releaseRoot, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
+          "",
+          "Merging this PR updates VERSION on main and starts the public release workflow.",
+          ...(releaseSummary ? ["", releaseSummary] : []),
+        ].join("\n");
+        const githubEnvironment = {
+          ...process.env,
+          GH_HOST: account.hostname,
+          GH_REPO: githubRepositorySpecifier(account),
+          [githubTokenEnvironmentName(account.hostname)]: account.token,
+        };
+        const ensurePullRequest = (): void => {
+          if (
+            taskCommandSucceeds(root, "gh", ["pr", "view", releaseBranch], {
+              env: githubEnvironment,
+            })
+          ) {
+            return;
+          }
+          runTaskCommand(
+            root,
+            "gh",
+            [
+              "pr",
+              "create",
+              "--base",
+              opts.base,
+              "--head",
+              releaseBranch,
+              "--title",
+              title,
+              "--body",
+              body,
+            ],
+            { env: githubEnvironment },
+          );
+        };
+        ensurePullRequest();
+        if (opts.approve) {
+          runTaskCommand(root, "gh", ["pr", "merge", releaseBranch, "--auto", "--merge"], {
             env: githubEnvironment,
-          })
-        ) {
-          return;
+          });
         }
-        runTaskCommand(
-          root,
-          "gh",
-          [
-            "pr",
-            "create",
-            "--base",
-            opts.base,
-            "--head",
+        git(root, ["worktree", "remove", "--force", releaseRoot]);
+        git(root, ["branch", "--delete", "--force", releaseBranch]);
+        if (opts.approve && opts.wait) {
+          const mergeSha = await waitForPullRequestMerge(
+            root,
             releaseBranch,
-            "--title",
-            title,
-            "--body",
-            body,
-          ],
-          { env: githubEnvironment },
-        );
-      };
-      ensurePullRequest();
-      if (opts.approve) {
-        runTaskCommand(root, "gh", ["pr", "merge", releaseBranch, "--auto", "--merge"], {
-          env: githubEnvironment,
-        });
-      }
-      git(root, ["worktree", "remove", "--force", releaseRoot]);
-      git(root, ["branch", "--delete", "--force", releaseBranch]);
-      if (opts.approve && opts.wait) {
-        const mergeSha = await waitForPullRequestMerge(
-          root,
-          releaseBranch,
-          githubEnvironment,
-          waitTimeoutMs,
+            githubEnvironment,
+            waitTimeoutMs,
+          );
+          logger.info("release pull request merged", { releaseBranch, mergeSha });
+          await waitForReleaseWorkflow(root, opts.base, mergeSha, githubEnvironment, waitTimeoutMs);
+          logger.success(`published ${releaseTag} from ${mergeSha}`);
+          return;
+        }
+        logger.success(
+          `${
+            opts.approve ? "enabled automatic merge for" : "opened"
+          } ${releaseBranch} for ${releaseTag}${opts.approve && !opts.wait ? " without waiting" : ""}`,
         );
-        logger.info("release pull request merged", { releaseBranch, mergeSha });
-        await waitForReleaseWorkflow(root, opts.base, mergeSha, githubEnvironment, waitTimeoutMs);
-        logger.success(`published ${releaseTag} from ${mergeSha}`);
-        return;
-      }
-      logger.success(
-        `${
-          opts.approve ? "enabled automatic merge for" : "opened"
-        } ${releaseBranch} for ${releaseTag}${opts.approve && !opts.wait ? " without waiting" : ""}`,
-      );
+      });
     },
   );
 

package/tasks/sync.ts

@@ -4,6 +4,7 @@ import { log } from "@dbx-tools/shared-core";
 import concurrently from "concurrently";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import { runSynth } from "../src/scaffold.ts";
+import { withWorkspaceMutationLock } from "../src/workspace-lock.ts";
 
 const logger = log.logger("projen:sync");
 
@@ -39,7 +40,7 @@ if (!process.argv.includes("--watch")) {
   // One-shot: full synth (+install + barrels via the post-synth component). This is
   // the scriptable path, so a failed synth stays a failed exit code.
   logger.start("synthesizing");
-  runSynth({ post: true });
+  await withWorkspaceMutationLock(repoRoot, () => runSynth({ post: true }));
   logger.success("synced");
 } else {
   // Watch: one initial full synth to bring the tree up to date, then focused
@@ -52,7 +53,7 @@ if (!process.argv.includes("--watch")) {
   // fatal: errors are logged and retried, and only a stop signal ends the task.
   logger.start("initial sync");
   try {
-    runSynth({ post: true });
+    await withWorkspaceMutationLock(repoRoot, () => runSynth({ post: true }));
     logger.success("synced - watching (Ctrl-C to stop)");
   } catch (err) {
     // A tree that doesn't synth is precisely when the watcher is most useful: the edit