@dereekb/dbx-cli 13.42.0 → 14.0.0

package/validate/index.js

@@ -2909,6 +2909,96 @@ var RULE_CATALOG = [
     whenItApplies: "When a key on `<app>SystemStateStoredDataConverterMap` is neither a local `<NAME>_SYSTEM_STATE_TYPE` constant nor an imported identifier.",
     whenItDoesNotApply: "Keys imported from upstream packages \u2014 those are detected via `importedIdentifiers` and skipped.",
     canonicalFix: "Either declare the missing constant locally or import it from the upstream package that owns it."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A configuration's file-replacement or esbuild-config path does not exist on disk",
+    whatItFlags: "A configuration's file-replacement or esbuild-config path does not exist on disk.",
+    whenItApplies: "When a `fileReplacements` `replace` / `with` path, or a configuration's `esbuildConfig` path, names a file that is absent from the working tree.",
+    whenItDoesNotApply: "Generated files produced by an earlier target in the same pipeline \u2014 declare them as that target's `outputs` so the dependency is explicit, or the reference is genuinely broken.",
+    canonicalFix: "Create the missing file or correct the path. An Angular build fails loudly on a missing replacement, but an esbuild `additionalProperties: true` schema accepts a bad path silently."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_UNREFERENCED",
+    source: "dbx_workspace_validate",
+    severity: "warning",
+    title: "An `environment.<name>.ts` file exists but no build configuration references it",
+    whatItFlags: "An `environment.<name>.ts` file exists but no build configuration references it.",
+    whenItApplies: "When a file matching `environment.*.ts` sits in a project's `src/environments/` directory and appears in no configuration's `fileReplacements`, and no `esbuildConfig` file references it.",
+    whenItDoesNotApply: "The base `environment.ts` (always the replacement source, never a target), and environment files imported directly by application code rather than swapped in by the build.",
+    canonicalFix: "Add the configuration that consumes it, or delete the file. An unreachable environment file reads as a working deploy lane that does not exist \u2014 the file is edited, reviewed, and never compiled."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_HOSTING_TARGET_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A deploy command targets a firebase hosting target that `firebase.json` does not declare",
+    whatItFlags: "A deploy command targets a firebase hosting target that `firebase.json` does not declare.",
+    whenItApplies: "When a deploy command runs `firebase deploy --only hosting:<target>` and `<target>` matches no `target` (or `site`) entry under `hosting` in `firebase.json`.",
+    whenItDoesNotApply: "Workspaces that resolve hosting targets through `.firebaserc` target aliases the scanner does not read \u2014 verify manually if this misfires.",
+    canonicalFix: "Add the hosting entry to `firebase.json`, or point the command at a declared target. `firebase deploy` fails on an unknown hosting target, so this breaks the lane outright."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_LANE_ASYMMETRIC",
+    source: "dbx_workspace_validate",
+    severity: "warning",
+    title: "A deploy lane is wired on one side of the app/api pair but not the other",
+    whatItFlags: "A deploy lane is wired on one side of the app/api pair but not the other.",
+    whenItApplies: "When one project in the workspace declares `ci-deploy-<lane>` and a sibling project that declares at least one other `ci-deploy-*` lane does not declare this one.",
+    whenItDoesNotApply: "Projects deliberately deployed on their own cadence, and workspaces with a single deployable project. Suppress by giving the sibling the lane, or accept the warning.",
+    canonicalFix: "Add the missing `ci-deploy-<lane>` target to the sibling project. A lane present on the API but not the web app (or vice versa) deploys half an application and leaves the two halves on different builds."
+  },
+  {
+    code: "WORKSPACE_DEPLOY_LANE_NO_ENVIRONMENT_SELECTION",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A deploy lane builds a configuration that selects no environment file",
+    whatItFlags: "A deploy lane builds a configuration that selects no environment file.",
+    whenItApplies: "When a `ci-deploy-<lane>` target builds a configuration that provides no environment-selection mechanism for its executor \u2014 no `fileReplacements` for an Angular `application` build, or no lane-specific `esbuildConfig` for an `@nx/esbuild:esbuild` build.",
+    whenItDoesNotApply: "Non-deploy configurations such as `development`, which are expected to compile the base `environment.ts`. Only configurations reachable from a `ci-deploy-*` target are checked.",
+    canonicalFix: "Add the `fileReplacements` entry (or the lane's `esbuildConfig`) to the configuration. Without it the lane deploys the unreplaced `environment.ts` \u2014 localhost URLs, dev credentials, and any developer-only function map \u2014 to a live project."
+  },
+  {
+    code: "WORKSPACE_TARGET_OUTPUT_ESCAPES_ROOT",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "A target's `outputs` entry resolves outside the workspace root",
+    whatItFlags: "A target's `outputs` entry resolves outside the workspace root.",
+    whenItApplies: 'When an `outputs` entry \u2014 after `{options.<name>}` substitution from the target\'s own options \u2014 resolves to a path above the workspace root. The common shape is `outputs: ["{options.reportsDirectory}"]` with a `../../`-relative option value.',
+    whenItDoesNotApply: "Entries anchored by `{workspaceRoot}` or `{projectRoot}`, and entries whose `{options.<name>}` token has no resolvable value (skipped rather than guessed).",
+    canonicalFix: 'Anchor the entry explicitly, e.g. `"{workspaceRoot}/coverage/{projectRoot}"`. Nx refuses to cache an output it cannot place inside the workspace and will report the task as flaky instead of failing loudly.'
+  },
+  {
+    code: "WORKSPACE_TARGET_REF_CONFIGURATION_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "An `nx run <project>:<target>:<configuration>` reference names a configuration the target does not declare",
+    whatItFlags: "An `nx run <project>:<target>:<configuration>` reference names a configuration the target does not declare.",
+    whenItApplies: "Whenever a reference carries a configuration segment and the target's `configurations` map has no such key.",
+    whenItDoesNotApply: "Targets that declare no `configurations` at all \u2014 Nx tolerates a configuration argument there, so it is not reported.",
+    canonicalFix: "Rename the reference to a declared configuration (a `prod` / `production` mismatch is the usual cause), or add the configuration to the target. Nx does NOT error on an unknown configuration: `create-task-graph.js` silently substitutes `defaultConfiguration`, so a mismatch here ships whatever that default builds \u2014 and ships the base options with no configuration merged at all when no default is set."
+  },
+  {
+    code: "WORKSPACE_TARGET_REF_PROJECT_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "An `nx run <project>:...` reference names a project that does not exist in the workspace",
+    whatItFlags: "An `nx run <project>:...` reference names a project that does not exist in the workspace.",
+    whenItApplies: "When a target reference in a `project.json` command, CI config, shell script, or npm script names a project with no matching entry in the workspace project graph.",
+    whenItDoesNotApply: "References built from shell variables or CI interpolation the scanner cannot resolve \u2014 those are skipped rather than reported.",
+    canonicalFix: "Create the project, or update the reference to the project's real name. A renamed or deleted project leaves these references behind and they only fail at deploy time."
+  },
+  {
+    code: "WORKSPACE_TARGET_REF_TARGET_MISSING",
+    source: "dbx_workspace_validate",
+    severity: "error",
+    title: "An `nx run <project>:<target>` reference names a target the project does not declare",
+    whatItFlags: "An `nx run <project>:<target>` reference names a target the project does not declare.",
+    whenItApplies: "When the referenced project exists but has no target by that name (after `nx.json` `targetDefaults` are accounted for).",
+    whenItDoesNotApply: "Targets contributed by an inferred-target plugin the scanner does not evaluate \u2014 declare the plugin's targets explicitly if this misfires.",
+    canonicalFix: "Add the target to the project, or point the reference at an existing one. This is the single most common way a CI lane silently stops doing anything."
   }
 ];
 
@@ -2996,22 +3086,22 @@ function formatSeeAlso(ref) {
 // packages/dbx-cli/validate/src/lib/_core/validate-input.ts
 import { glob as fsGlob, readFile, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";
-function ensurePathInsideCwd(relative12, cwd) {
+function ensurePathInsideCwd(relative13, cwd) {
   const cwdPrefix = cwd.endsWith(sep) ? cwd : cwd + sep;
-  const absolute = resolve(cwd, relative12);
+  const absolute = resolve(cwd, relative13);
   if (!absolute.startsWith(cwdPrefix) && absolute !== cwd) {
-    throw new Error(`Path \`${relative12}\` resolves outside the server cwd and is not allowed.`);
+    throw new Error(`Path \`${relative13}\` resolves outside the server cwd and is not allowed.`);
   }
 }
 async function resolveFolderPaths(config) {
   const { paths, glob, cwd } = config;
   const collected = [];
   const seen = /* @__PURE__ */ new Set();
-  const accept = (relative12) => {
-    if (seen.has(relative12)) return;
-    ensurePathInsideCwd(relative12, cwd);
-    seen.add(relative12);
-    collected.push(relative12);
+  const accept = (relative13) => {
+    if (seen.has(relative13)) return;
+    ensurePathInsideCwd(relative13, cwd);
+    seen.add(relative13);
+    collected.push(relative13);
   };
   if (paths) {
     for (const p of paths) {
@@ -3054,13 +3144,13 @@ async function resolveValidatorSources(config) {
       pathList.push(match);
     }
   }
-  for (const relative12 of pathList) {
-    if (seenNames.has(relative12)) continue;
-    ensurePathInsideCwd(relative12, cwd);
-    const absolute = resolve(cwd, relative12);
+  for (const relative13 of pathList) {
+    if (seenNames.has(relative13)) continue;
+    ensurePathInsideCwd(relative13, cwd);
+    const absolute = resolve(cwd, relative13);
     const text = await readFile(absolute, "utf8");
-    seenNames.add(relative12);
-    collected.push({ name: relative12, text });
+    seenNames.add(relative13);
+    collected.push({ name: relative13, text });
   }
   return collected;
 }
@@ -3115,12 +3205,12 @@ function formatRemediationBlock(hint) {
   return lines.join("\n");
 }
 function aggregateFolderRules(config) {
-  const { inspections, runRules: runRules9 } = config;
+  const { inspections, runRules: runRules10 } = config;
   const violations = [];
   let errorCount = 0;
   let warningCount = 0;
   for (const inspection of inspections) {
-    const folderViolations = runRules9(inspection);
+    const folderViolations = runRules10(inspection);
     for (const v of folderViolations) {
       violations.push(v);
       if (v.severity === "error") {
@@ -6335,6 +6425,11 @@ var RESERVED_MODEL_FOLDERS = [
     reason: "StorageFile is a canonical group from `@dereekb/firebase` with a richer layout than the base 5 files (group, upload, file, etc.); downstream projects extend rather than redeclare it.",
     recommendedTool: "dbx_storagefile_m_validate_folder"
   },
+  {
+    name: "formspace",
+    reason: "FormSpace is a canonical group from `@dereekb/firebase` with a richer layout than the base 5 files (type, upload, task, util, etc.); a downstream project only registers its own types and does not redeclare the model.",
+    recommendedTool: "dbx_model_validate_folder"
+  },
   {
     name: "calendar",
     reason: "Calendar is a canonical group from `@dereekb/firebase` with a richer layout than the base 5 files (type, expand, ics, processing, etc.); downstream projects extend rather than redeclare it.",
@@ -12734,6 +12829,901 @@ function appendDiagnosticEntry(lines, d) {
   }
 }
 
+// packages/dbx-cli/validate/src/lib/workspace-validate/index.ts
+var workspace_validate_exports = {};
+__export(workspace_validate_exports, {
+  DEPLOY_TARGET_PREFIX: () => DEPLOY_TARGET_PREFIX,
+  WORKSPACE_RULE_GROUPS: () => WORKSPACE_RULE_GROUPS,
+  WorkspaceValidateCode: () => WorkspaceValidateCode,
+  formatResult: () => formatResult11,
+  inspectWorkspace: () => inspectWorkspace,
+  pathEscapesWorkspaceRoot: () => pathEscapesWorkspaceRoot,
+  scanDocumentTargetReferences: () => scanDocumentTargetReferences,
+  scanHostingTargets: () => scanHostingTargets,
+  scanTargetReferences: () => scanTargetReferences,
+  validateWorkspace: () => validateWorkspace
+});
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/codes.ts
+var WorkspaceValidateCode = /* @__PURE__ */ ((WorkspaceValidateCode2) => {
+  WorkspaceValidateCode2["WORKSPACE_TARGET_REF_PROJECT_MISSING"] = "WORKSPACE_TARGET_REF_PROJECT_MISSING";
+  WorkspaceValidateCode2["WORKSPACE_TARGET_REF_TARGET_MISSING"] = "WORKSPACE_TARGET_REF_TARGET_MISSING";
+  WorkspaceValidateCode2["WORKSPACE_TARGET_REF_CONFIGURATION_MISSING"] = "WORKSPACE_TARGET_REF_CONFIGURATION_MISSING";
+  WorkspaceValidateCode2["WORKSPACE_TARGET_OUTPUT_ESCAPES_ROOT"] = "WORKSPACE_TARGET_OUTPUT_ESCAPES_ROOT";
+  WorkspaceValidateCode2["WORKSPACE_DEPLOY_LANE_NO_ENVIRONMENT_SELECTION"] = "WORKSPACE_DEPLOY_LANE_NO_ENVIRONMENT_SELECTION";
+  WorkspaceValidateCode2["WORKSPACE_DEPLOY_ENVIRONMENT_FILE_MISSING"] = "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_MISSING";
+  WorkspaceValidateCode2["WORKSPACE_DEPLOY_ENVIRONMENT_FILE_UNREFERENCED"] = "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_UNREFERENCED";
+  WorkspaceValidateCode2["WORKSPACE_DEPLOY_HOSTING_TARGET_MISSING"] = "WORKSPACE_DEPLOY_HOSTING_TARGET_MISSING";
+  WorkspaceValidateCode2["WORKSPACE_DEPLOY_LANE_ASYMMETRIC"] = "WORKSPACE_DEPLOY_LANE_ASYMMETRIC";
+  return WorkspaceValidateCode2;
+})(WorkspaceValidateCode || {});
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/format.ts
+function formatResult11(result) {
+  return formatFileGroupedResult({
+    title: "Workspace convention validation",
+    summary: `Checked ${result.projectsChecked} project(s) and ${result.referencesChecked} target reference(s) across group(s) [${result.groups.join(", ")}].`,
+    innerKey: (violation) => violation.project,
+    result
+  });
+}
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/inspect.ts
+import { readdir as readdir8, readFile as readFile11, stat as stat10 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname2, join as join10, relative as relative6, resolve as resolve3 } from "node:path";
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/references.ts
+var NX_SUBCOMMANDS = /* @__PURE__ */ new Set(["run", "run-many", "affected", "affected:graph", "affected:test", "affected:build", "graph", "dep-graph", "print-affected", "show", "list", "report", "migrate", "reset", "repair", "generate", "g", "add", "init", "import", "sync", "release", "format", "format:check", "format:write", "daemon", "connect", "login", "logout", "view-logs", "exec", "watch", "documentation", "help", "register", "record", "start-ci-run"]);
+var INTERPOLATION_PATTERN = /[$`{}()*?]|\\\\/;
+var TOKEN_LEADING_CHARS = `"'`;
+var TOKEN_TRAILING_CHARS = `"',;`;
+var PROJECT_TOKEN_PATTERN = /^[a-zA-Z0-9@][a-zA-Z0-9@/_.-]*$/;
+var TARGET_TOKEN_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/;
+function isFlag(token) {
+  return token.startsWith("-");
+}
+function isResolvable(token) {
+  return token.length > 0 && !INTERPOLATION_PATTERN.test(token);
+}
+function trimTokenPunctuation(raw) {
+  let start = 0;
+  let end = raw.length;
+  while (start < end && TOKEN_LEADING_CHARS.includes(raw[start])) {
+    start += 1;
+  }
+  while (end > start && TOKEN_TRAILING_CHARS.includes(raw[end - 1])) {
+    end -= 1;
+  }
+  return raw.slice(start, end);
+}
+function tokenize(text) {
+  const out = [];
+  for (const raw of text.split(/\s+/)) {
+    const token = trimTokenPunctuation(raw);
+    if (token.length > 0) {
+      out.push(token);
+    }
+  }
+  return out;
+}
+function isNxBinary(token) {
+  return token === "nx" || token.endsWith("/nx");
+}
+function changesToForeignDirectory(tokens) {
+  let result = false;
+  for (let i = 0; i < tokens.length - 1 && !result; i += 1) {
+    if (tokens[i] === "cd") {
+      const destination = tokens[i + 1];
+      result = destination.startsWith("~") || destination.startsWith("/");
+    }
+  }
+  return result;
+}
+function parseExplicitForm(tokens, runIndex) {
+  let result;
+  for (let i = runIndex + 1; i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (isFlag(token)) {
+      continue;
+    }
+    if (isResolvable(token) && token.includes(":")) {
+      const [project, target, configuration] = token.split(":");
+      if (project && target && PROJECT_TOKEN_PATTERN.test(project) && TARGET_TOKEN_PATTERN.test(target)) {
+        result = { project, target, configuration: configuration || void 0, raw: token };
+      }
+    }
+    break;
+  }
+  return result;
+}
+function parseShorthandForm(tokens, nxIndex) {
+  const positional = [];
+  for (let i = nxIndex + 1; i < tokens.length && positional.length < 2; i += 1) {
+    const token = tokens[i];
+    if (!isFlag(token)) {
+      positional.push(token);
+    }
+  }
+  let result;
+  const [target, project] = positional;
+  if (target !== void 0 && project !== void 0 && !NX_SUBCOMMANDS.has(target) && !target.includes(":") && isResolvable(target) && isResolvable(project) && TARGET_TOKEN_PATTERN.test(target) && PROJECT_TOKEN_PATTERN.test(project)) {
+    result = { project, target, raw: `${target} ${project}` };
+  }
+  return result;
+}
+function scanTargetReferences(input) {
+  const { text, sourceFile, sourceTarget, line } = input;
+  const references = [];
+  const tokens = tokenize(text);
+  if (changesToForeignDirectory(tokens)) {
+    return references;
+  }
+  for (let i = 0; i < tokens.length; i += 1) {
+    if (!isNxBinary(tokens[i])) {
+      continue;
+    }
+    let firstPositional;
+    let firstPositionalIndex = -1;
+    for (let j = i + 1; j < tokens.length; j += 1) {
+      if (!isFlag(tokens[j])) {
+        firstPositional = tokens[j];
+        firstPositionalIndex = j;
+        break;
+      }
+    }
+    if (firstPositional === void 0) {
+      continue;
+    }
+    if (firstPositional === "run") {
+      const parsed = parseExplicitForm(tokens, firstPositionalIndex);
+      if (parsed) {
+        references.push({ project: parsed.project, target: parsed.target, configuration: parsed.configuration, sourceFile, line, sourceTarget, raw: parsed.raw });
+      }
+    } else if (!NX_SUBCOMMANDS.has(firstPositional)) {
+      const parsed = parseShorthandForm(tokens, i);
+      if (parsed) {
+        references.push({ project: parsed.project, target: parsed.target, configuration: void 0, sourceFile, line, sourceTarget, raw: parsed.raw });
+      }
+    }
+  }
+  return references;
+}
+function stripComment(line) {
+  const trimmed = line.trimStart();
+  let result;
+  if (trimmed.startsWith("#")) {
+    result = "";
+  } else {
+    const index = line.indexOf(" #");
+    result = index === -1 ? line : line.slice(0, index);
+  }
+  return result;
+}
+function scanDocumentTargetReferences(input) {
+  const { text, sourceFile } = input;
+  const references = [];
+  const lines = text.split("\n");
+  for (const [index, line] of lines.entries()) {
+    for (const reference of scanTargetReferences({ text: stripComment(line), sourceFile, line: index + 1 })) {
+      references.push(reference);
+    }
+  }
+  return references;
+}
+function scanHostingTargets(command) {
+  const out = [];
+  const pattern = /hosting:([a-zA-Z0-9_-]+)/g;
+  let match = pattern.exec(command);
+  while (match !== null) {
+    out.push(match[1]);
+    match = pattern.exec(command);
+  }
+  return out;
+}
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/inspect.ts
+var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "tmp", "coverage", ".nx", ".git", ".firebase", ".angular", ".cache", "templates"]);
+var MAX_WALK_DEPTH = 4;
+var PROJECT_CONFIG_FILENAME = "project.json";
+var ENVIRONMENTS_SUBPATH = join10("src", "environments");
+var ENVIRONMENT_FILE_PATTERN = /^environment\..+\.ts$/;
+var EXTRA_REFERENCE_SOURCES = [".circleci/config.yml", ".circleci/config.yaml", ".github/workflows"];
+async function pathExists(path) {
+  let result;
+  try {
+    await stat10(path);
+    result = true;
+  } catch {
+    result = false;
+  }
+  return result;
+}
+async function readJsonFile(path) {
+  let result;
+  try {
+    const text = await readFile11(path, "utf8");
+    const parsed = JSON.parse(text);
+    result = parsed !== null && typeof parsed === "object" ? parsed : void 0;
+  } catch {
+    result = void 0;
+  }
+  return result;
+}
+async function collectProjectConfigPaths(config) {
+  const { workspaceRoot, relativeDir, depth } = config;
+  const collected = [];
+  const absoluteDir = join10(workspaceRoot, relativeDir);
+  const entries = await readdir8(absoluteDir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name === PROJECT_CONFIG_FILENAME) {
+      collected.push(relativeDir === "" ? PROJECT_CONFIG_FILENAME : join10(relativeDir, PROJECT_CONFIG_FILENAME));
+    } else if (entry.isDirectory() && depth < MAX_WALK_DEPTH && !SKIPPED_DIRECTORIES.has(entry.name) && !entry.name.startsWith("firebase-export-")) {
+      const nested = await collectProjectConfigPaths({ workspaceRoot, relativeDir: relativeDir === "" ? entry.name : join10(relativeDir, entry.name), depth: depth + 1 });
+      for (const path of nested) {
+        collected.push(path);
+      }
+    }
+  }
+  return collected;
+}
+function extractCommands(options) {
+  const collected = [];
+  const single = options["command"];
+  if (typeof single === "string") {
+    collected.push(single);
+  }
+  const many = options["commands"];
+  if (Array.isArray(many)) {
+    for (const entry of many) {
+      if (typeof entry === "string") {
+        collected.push(entry);
+      } else if (entry !== null && typeof entry === "object") {
+        const command = entry["command"];
+        if (typeof command === "string") {
+          collected.push(command);
+        }
+      }
+    }
+  }
+  return collected;
+}
+async function resolveFileReplacements(config) {
+  const { workspaceRoot, raw } = config;
+  const collected = [];
+  if (Array.isArray(raw)) {
+    for (const entry of raw) {
+      if (entry === null || typeof entry !== "object") {
+        continue;
+      }
+      const record = entry;
+      const replace = record["replace"];
+      const withPath = record["with"];
+      if (typeof replace === "string" && typeof withPath === "string") {
+        collected.push({
+          replace,
+          with: withPath,
+          replaceExists: await pathExists(join10(workspaceRoot, replace)),
+          withExists: await pathExists(join10(workspaceRoot, withPath))
+        });
+      }
+    }
+  }
+  return collected;
+}
+async function resolveConfigurations(config) {
+  const { workspaceRoot, raw } = config;
+  const collected = [];
+  if (raw !== null && typeof raw === "object") {
+    for (const [name, value] of Object.entries(raw)) {
+      const options = value !== null && typeof value === "object" ? value : {};
+      const esbuildConfigValue = options["esbuildConfig"];
+      const esbuildConfig = typeof esbuildConfigValue === "string" ? esbuildConfigValue : void 0;
+      collected.push({
+        name,
+        fileReplacements: await resolveFileReplacements({ workspaceRoot, raw: options["fileReplacements"] }),
+        esbuildConfig,
+        esbuildConfigExists: esbuildConfig === void 0 ? false : await pathExists(join10(workspaceRoot, esbuildConfig))
+      });
+    }
+  }
+  return collected;
+}
+async function resolveTargets(config) {
+  const { workspaceRoot, raw } = config;
+  const collected = [];
+  if (raw !== null && typeof raw === "object") {
+    for (const [name, value] of Object.entries(raw)) {
+      const target = value !== null && typeof value === "object" ? value : {};
+      const executorValue = target["executor"];
+      const defaultConfigurationValue = target["defaultConfiguration"];
+      const optionsValue = target["options"];
+      const options = optionsValue !== null && typeof optionsValue === "object" ? optionsValue : {};
+      const outputsValue = target["outputs"];
+      collected.push({
+        name,
+        executor: typeof executorValue === "string" ? executorValue : void 0,
+        configurations: await resolveConfigurations({ workspaceRoot, raw: target["configurations"] }),
+        defaultConfiguration: typeof defaultConfigurationValue === "string" ? defaultConfigurationValue : void 0,
+        outputs: Array.isArray(outputsValue) ? outputsValue.filter((o) => typeof o === "string") : [],
+        options,
+        commands: extractCommands(options)
+      });
+    }
+  }
+  return collected;
+}
+async function collectEnvironmentFiles(config) {
+  const { workspaceRoot, projectRoot } = config;
+  const relativeDir = projectRoot === "" ? ENVIRONMENTS_SUBPATH : join10(projectRoot, ENVIRONMENTS_SUBPATH);
+  const collected = [];
+  const entries = await readdir8(join10(workspaceRoot, relativeDir), { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isFile() && ENVIRONMENT_FILE_PATTERN.test(entry.name)) {
+      collected.push(join10(relativeDir, entry.name));
+    }
+  }
+  return collected.sort((a, b) => a.localeCompare(b));
+}
+var ENVIRONMENT_MENTION_PATTERN = /environment(?:\.[A-Za-z0-9_-]+)*\.ts/g;
+async function collectReferencedEnvironmentFiles(config) {
+  const { workspaceRoot, targets, environmentFiles } = config;
+  const referenced = /* @__PURE__ */ new Set();
+  const esbuildConfigPaths = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    const baseEsbuildConfig = target.options["esbuildConfig"];
+    if (typeof baseEsbuildConfig === "string") {
+      esbuildConfigPaths.add(baseEsbuildConfig);
+    }
+    for (const configuration of target.configurations) {
+      for (const replacement of configuration.fileReplacements) {
+        referenced.add(replacement.with);
+      }
+      if (configuration.esbuildConfig !== void 0) {
+        esbuildConfigPaths.add(configuration.esbuildConfig);
+      }
+    }
+  }
+  const mentionedBasenames = /* @__PURE__ */ new Set();
+  for (const configPath of esbuildConfigPaths) {
+    const text = await readFile11(join10(workspaceRoot, configPath), "utf8").catch(() => void 0);
+    if (text === void 0) {
+      continue;
+    }
+    for (const match of text.matchAll(ENVIRONMENT_MENTION_PATTERN)) {
+      mentionedBasenames.add(match[0]);
+    }
+  }
+  for (const environmentFile of environmentFiles) {
+    if (mentionedBasenames.has(basename5(environmentFile))) {
+      referenced.add(environmentFile);
+    }
+  }
+  return Array.from(referenced).sort((a, b) => a.localeCompare(b));
+}
+async function inspectProject(config) {
+  const { workspaceRoot, configFile } = config;
+  const parsed = await readJsonFile(join10(workspaceRoot, configFile));
+  if (parsed === void 0) {
+    return void 0;
+  }
+  const projectRoot = dirname2(configFile) === "." ? "" : dirname2(configFile);
+  const nameValue = parsed["name"];
+  const fallbackNameDir = projectRoot === "" ? workspaceRoot : projectRoot;
+  const name = typeof nameValue === "string" && nameValue.length > 0 ? nameValue : basename5(fallbackNameDir);
+  const targets = await resolveTargets({ workspaceRoot, raw: parsed["targets"] });
+  const environmentFiles = await collectEnvironmentFiles({ workspaceRoot, projectRoot });
+  return {
+    name,
+    root: projectRoot,
+    configFile,
+    targets,
+    environmentFiles,
+    referencedEnvironmentFiles: await collectReferencedEnvironmentFiles({ workspaceRoot, targets, environmentFiles })
+  };
+}
+async function inspectNxConfig(workspaceRoot) {
+  const parsed = await readJsonFile(join10(workspaceRoot, "nx.json"));
+  const targetDefaultNames = [];
+  const plugins = [];
+  const targetDefaults = parsed?.["targetDefaults"];
+  if (targetDefaults !== null && typeof targetDefaults === "object") {
+    for (const key of Object.keys(targetDefaults)) {
+      if (!key.includes(":")) {
+        targetDefaultNames.push(key);
+      }
+    }
+  }
+  const pluginsValue = parsed?.["plugins"];
+  if (Array.isArray(pluginsValue)) {
+    for (const entry of pluginsValue) {
+      if (typeof entry === "string") {
+        plugins.push(entry);
+      } else if (entry !== null && typeof entry === "object") {
+        const plugin = entry["plugin"];
+        if (typeof plugin === "string") {
+          plugins.push(plugin);
+        }
+      }
+    }
+  }
+  return { targetDefaultNames, plugins };
+}
+async function inspectFirebaseConfig(workspaceRoot) {
+  const parsed = await readJsonFile(join10(workspaceRoot, "firebase.json"));
+  if (parsed === void 0) {
+    return { present: false, hostingTargets: [] };
+  }
+  const hostingValue = parsed["hosting"];
+  const singleHostingEntry = hostingValue !== null && typeof hostingValue === "object" ? [hostingValue] : [];
+  const entries = Array.isArray(hostingValue) ? hostingValue : singleHostingEntry;
+  const hostingTargets = [];
+  for (const entry of entries) {
+    if (entry === null || typeof entry !== "object") {
+      continue;
+    }
+    const record = entry;
+    const target = record["target"];
+    const site = record["site"];
+    if (typeof target === "string") {
+      hostingTargets.push(target);
+    } else if (typeof site === "string") {
+      hostingTargets.push(site);
+    }
+  }
+  return { present: true, hostingTargets };
+}
+async function collectExtraReferenceSources(workspaceRoot) {
+  const collected = [];
+  for (const candidate of EXTRA_REFERENCE_SOURCES) {
+    const absolute = join10(workspaceRoot, candidate);
+    let stats;
+    try {
+      stats = await stat10(absolute);
+    } catch {
+      continue;
+    }
+    if (stats.isFile()) {
+      collected.push(candidate);
+    } else if (stats.isDirectory()) {
+      const entries = await readdir8(absolute, { withFileTypes: true });
+      for (const entry of entries) {
+        if (entry.isFile() && /\.ya?ml$/.test(entry.name)) {
+          collected.push(join10(candidate, entry.name));
+        }
+      }
+    }
+  }
+  const rootEntries = await readdir8(workspaceRoot, { withFileTypes: true }).catch(() => []);
+  for (const entry of rootEntries) {
+    if (entry.isFile() && entry.name.endsWith(".sh")) {
+      collected.push(entry.name);
+    }
+  }
+  return collected.sort((a, b) => a.localeCompare(b));
+}
+async function collectPackageScriptReferences(workspaceRoot) {
+  const parsed = await readJsonFile(join10(workspaceRoot, "package.json"));
+  const scripts = parsed?.["scripts"];
+  const collected = [];
+  if (scripts !== null && typeof scripts === "object") {
+    for (const [scriptName, value] of Object.entries(scripts)) {
+      if (typeof value === "string") {
+        for (const reference of scanTargetReferences({ text: value, sourceFile: "package.json", sourceTarget: scriptName })) {
+          collected.push(reference);
+        }
+      }
+    }
+  }
+  return collected;
+}
+async function inspectWorkspace(input) {
+  const workspaceRoot = resolve3(input.workspaceRoot);
+  const configPaths = await collectProjectConfigPaths({ workspaceRoot, relativeDir: "", depth: 0 });
+  const projects = [];
+  const references = [];
+  for (const configFile of [...configPaths].sort((a, b) => a.localeCompare(b))) {
+    const project = await inspectProject({ workspaceRoot, configFile });
+    if (project === void 0) {
+      continue;
+    }
+    projects.push(project);
+    for (const target of project.targets) {
+      for (const command of target.commands) {
+        for (const reference of scanTargetReferences({ text: command, sourceFile: configFile, sourceTarget: target.name })) {
+          references.push(reference);
+        }
+      }
+    }
+  }
+  for (const sourceFile of await collectExtraReferenceSources(workspaceRoot)) {
+    const text = await readFile11(join10(workspaceRoot, sourceFile), "utf8").catch(() => void 0);
+    if (text !== void 0) {
+      for (const reference of scanDocumentTargetReferences({ text, sourceFile })) {
+        references.push(reference);
+      }
+    }
+  }
+  for (const reference of await collectPackageScriptReferences(workspaceRoot)) {
+    references.push(reference);
+  }
+  return {
+    workspaceRoot,
+    projects,
+    references,
+    firebase: await inspectFirebaseConfig(workspaceRoot),
+    nx: await inspectNxConfig(workspaceRoot)
+  };
+}
+function pathEscapesWorkspaceRoot(config) {
+  const { workspaceRoot, candidate } = config;
+  const resolved = resolve3(workspaceRoot, candidate);
+  const rel = relative6(workspaceRoot, resolved);
+  return rel.startsWith("..");
+}
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/types.ts
+var WORKSPACE_RULE_GROUPS = ["targets", "deploy"];
+var DEPLOY_TARGET_PREFIX = "ci-deploy-";
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/rules.ts
+var FILE_REPLACEMENT_EXECUTORS = /* @__PURE__ */ new Set(["@nx/angular:application", "@nx/angular:browser-esbuild", "@angular/build:application", "@angular-devkit/build-angular:application", "@angular-devkit/build-angular:browser"]);
+var ESBUILD_CONFIG_EXECUTORS = /* @__PURE__ */ new Set(["@nx/esbuild:esbuild"]);
+var PLUGIN_INFERRED_TARGETS = [
+  { plugin: "@nx/eslint/plugin", targets: ["lint"] },
+  { plugin: "@nx/vitest", targets: ["test", "test-ci"] },
+  { plugin: "@nx/vite", targets: ["build", "serve", "preview", "test"] },
+  { plugin: "@nx/jest", targets: ["test"] },
+  { plugin: "@nx/webpack/plugin", targets: ["build", "serve", "preview"] },
+  { plugin: "@nx/rollup/plugin", targets: ["build"] },
+  { plugin: "@nx/js/typescript", targets: ["typecheck", "build"] },
+  { plugin: "@nx/playwright/plugin", targets: ["e2e", "e2e-ci"] },
+  { plugin: "@nx/cypress/plugin", targets: ["e2e", "component-test"] },
+  { plugin: "@nx/next/plugin", targets: ["build", "dev", "start", "serve-static"] }
+];
+var FILE_EXTENSION_PATTERN = /\.(?:ts|tsx|js|mjs|cjs|json|sh|ya?ml|md|html|scss|css)$/;
+var DEPLOY_LANE_PATTERN = new RegExp(`^${DEPLOY_TARGET_PREFIX}([a-z0-9]+)$`);
+function pushViolation11(buffer, violation) {
+  const severity = violation.severity ?? "error";
+  const filled = {
+    code: violation.code,
+    severity,
+    message: violation.message,
+    group: violation.group,
+    project: violation.project,
+    file: violation.file,
+    line: violation.line,
+    remediation: attachRemediation(violation.code)
+  };
+  buffer.push(filled);
+}
+function looksLikeProjectName(token) {
+  return !token.includes("/") && !token.includes("\\") && !FILE_EXTENSION_PATTERN.test(token);
+}
+function isExemptTargetName(config) {
+  const { targetName, nx } = config;
+  let result = nx.targetDefaultNames.includes(targetName);
+  if (!result) {
+    const plugins = new Set(nx.plugins);
+    result = PLUGIN_INFERRED_TARGETS.some((entry) => plugins.has(entry.plugin) && entry.targets.includes(targetName));
+  }
+  return result;
+}
+function substituteOutputTokens(config) {
+  const { entry, options, projectRoot } = config;
+  let unresolved = false;
+  const withOptions = entry.replaceAll(/\{options\.(\w+)\}/g, (_match, key) => {
+    const value = options[key];
+    let replacement;
+    if (typeof value === "string") {
+      replacement = value;
+    } else if (typeof value === "number" || typeof value === "boolean") {
+      replacement = String(value);
+    } else {
+      unresolved = true;
+      replacement = "";
+    }
+    return replacement;
+  });
+  const projectRootValue = projectRoot === "" ? "." : projectRoot;
+  return unresolved ? void 0 : withOptions.replaceAll("{workspaceRoot}", ".").replaceAll("{projectRoot}", projectRootValue);
+}
+function environmentSelectionState(config) {
+  const { executor, configuration } = config;
+  let result;
+  if (executor !== void 0 && FILE_REPLACEMENT_EXECUTORS.has(executor)) {
+    result = configuration.fileReplacements.length > 0 ? "ok" : "missing";
+  } else if (executor !== void 0 && ESBUILD_CONFIG_EXECUTORS.has(executor)) {
+    result = configuration.esbuildConfig === void 0 ? "missing" : "ok";
+  } else {
+    result = "unknown";
+  }
+  return result;
+}
+function environmentSelectionOptionName(executor) {
+  return executor !== void 0 && ESBUILD_CONFIG_EXECUTORS.has(executor) ? "esbuildConfig" : "fileReplacements";
+}
+function indexTargets(project) {
+  const map = /* @__PURE__ */ new Map();
+  for (const target of project.targets) {
+    map.set(target.name, target);
+  }
+  return map;
+}
+function checkTargetReferences(config) {
+  const { inspection, targetsByProject, violations } = config;
+  const group = "targets";
+  for (const reference of inspection.references) {
+    const targets = targetsByProject.get(reference.project);
+    if (targets === void 0) {
+      if (looksLikeProjectName(reference.project)) {
+        pushViolation11(violations, {
+          code: "WORKSPACE_TARGET_REF_PROJECT_MISSING",
+          message: `\`${reference.raw}\` references project \`${reference.project}\`, which the workspace does not declare.`,
+          group,
+          project: reference.project,
+          file: reference.sourceFile,
+          line: reference.line
+        });
+      }
+      continue;
+    }
+    const target = targets.get(reference.target);
+    if (target === void 0) {
+      if (!isExemptTargetName({ targetName: reference.target, nx: inspection.nx })) {
+        pushViolation11(violations, {
+          code: "WORKSPACE_TARGET_REF_TARGET_MISSING",
+          message: `\`${reference.raw}\` references target \`${reference.target}\` on project \`${reference.project}\`, which declares no such target.`,
+          group,
+          project: reference.project,
+          file: reference.sourceFile,
+          line: reference.line
+        });
+      }
+      continue;
+    }
+    if (reference.configuration !== void 0 && target.configurations.length > 0 && !target.configurations.some((configuration) => configuration.name === reference.configuration)) {
+      const declared = target.configurations.map((configuration) => configuration.name).join(", ");
+      const fallback = target.defaultConfiguration === void 0 ? "no configuration at all \u2014 the target runs with its base options, so every configuration-only option is silently dropped" : `\`${target.defaultConfiguration}\` (this target's \`defaultConfiguration\`)`;
+      pushViolation11(violations, {
+        code: "WORKSPACE_TARGET_REF_CONFIGURATION_MISSING",
+        message: `\`${reference.raw}\` requests configuration \`${reference.configuration}\` of \`${reference.project}:${reference.target}\`, which declares only [${declared}]. Nx does not error here \u2014 it silently builds ${fallback}.`,
+        group,
+        project: reference.project,
+        file: reference.sourceFile,
+        line: reference.line
+      });
+    }
+  }
+}
+function checkTargetOutputs(config) {
+  const { inspection, violations } = config;
+  const group = "targets";
+  for (const project of inspection.projects) {
+    for (const target of project.targets) {
+      for (const entry of target.outputs) {
+        const substituted = substituteOutputTokens({ entry, options: target.options, projectRoot: project.root });
+        if (substituted === void 0) {
+          continue;
+        }
+        if (pathEscapesWorkspaceRoot({ workspaceRoot: inspection.workspaceRoot, candidate: substituted })) {
+          pushViolation11(violations, {
+            code: "WORKSPACE_TARGET_OUTPUT_ESCAPES_ROOT",
+            message: `Target \`${project.name}:${target.name}\` declares output \`${entry}\`, which resolves to \`${substituted}\` \u2014 outside the workspace root. Nx cannot cache it and reports the task as flaky instead of failing.`,
+            group,
+            project: project.name,
+            file: project.configFile,
+            line: void 0
+          });
+        }
+      }
+    }
+  }
+}
+function checkDeployLaneEnvironmentSelection(config) {
+  const { inspection, targetsByProject, violations } = config;
+  const group = "deploy";
+  for (const project of inspection.projects) {
+    const targets = targetsByProject.get(project.name);
+    if (targets === void 0) {
+      continue;
+    }
+    const deployTargetNames = new Set(project.targets.filter((target) => target.name.startsWith(DEPLOY_TARGET_PREFIX)).map((target) => target.name));
+    for (const reference of inspection.references) {
+      if (reference.sourceFile !== project.configFile || reference.sourceTarget === void 0 || !deployTargetNames.has(reference.sourceTarget) || reference.project !== project.name || reference.configuration === void 0) {
+        continue;
+      }
+      const buildTarget = targets.get(reference.target);
+      const configuration = buildTarget?.configurations.find((entry) => entry.name === reference.configuration);
+      if (buildTarget === void 0 || configuration === void 0) {
+        continue;
+      }
+      if (environmentSelectionState({ executor: buildTarget.executor, configuration }) === "missing") {
+        pushViolation11(violations, {
+          code: "WORKSPACE_DEPLOY_LANE_NO_ENVIRONMENT_SELECTION",
+          message: `\`${project.name}:${reference.sourceTarget}\` builds \`${reference.target}:${configuration.name}\`, but that configuration declares no \`${environmentSelectionOptionName(buildTarget.executor)}\` \u2014 the lane deploys the unreplaced \`environment.ts\`.`,
+          group,
+          project: project.name,
+          file: project.configFile,
+          line: void 0
+        });
+      }
+    }
+  }
+}
+function checkConfigurationPaths(config) {
+  const { inspection, violations } = config;
+  const group = "deploy";
+  for (const project of inspection.projects) {
+    for (const target of project.targets) {
+      for (const configuration of target.configurations) {
+        for (const replacement of configuration.fileReplacements) {
+          if (!replacement.replaceExists) {
+            pushViolation11(violations, {
+              code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_MISSING",
+              message: `\`${project.name}:${target.name}:${configuration.name}\` replaces \`${replacement.replace}\`, which does not exist.`,
+              group,
+              project: project.name,
+              file: project.configFile,
+              line: void 0
+            });
+          }
+          if (!replacement.withExists) {
+            pushViolation11(violations, {
+              code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_MISSING",
+              message: `\`${project.name}:${target.name}:${configuration.name}\` replaces with \`${replacement.with}\`, which does not exist.`,
+              group,
+              project: project.name,
+              file: project.configFile,
+              line: void 0
+            });
+          }
+        }
+        if (configuration.esbuildConfig !== void 0 && !configuration.esbuildConfigExists) {
+          pushViolation11(violations, {
+            code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_MISSING",
+            message: `\`${project.name}:${target.name}:${configuration.name}\` sets \`esbuildConfig\` to \`${configuration.esbuildConfig}\`, which does not exist.`,
+            group,
+            project: project.name,
+            file: project.configFile,
+            line: void 0
+          });
+        }
+      }
+    }
+  }
+}
+function checkUnreferencedEnvironmentFiles(config) {
+  const { inspection, violations } = config;
+  const group = "deploy";
+  for (const project of inspection.projects) {
+    const referenced = new Set(project.referencedEnvironmentFiles);
+    for (const environmentFile of project.environmentFiles) {
+      if (!referenced.has(environmentFile)) {
+        pushViolation11(violations, {
+          code: "WORKSPACE_DEPLOY_ENVIRONMENT_FILE_UNREFERENCED",
+          message: `\`${environmentFile}\` is not selected by any build configuration of \`${project.name}\` \u2014 it is edited and reviewed but never compiled.`,
+          severity: "warning",
+          group,
+          project: project.name,
+          file: project.configFile,
+          line: void 0
+        });
+      }
+    }
+  }
+}
+function checkHostingTargets(config) {
+  const { inspection, violations } = config;
+  const group = "deploy";
+  if (!inspection.firebase.present) {
+    return;
+  }
+  const declared = new Set(inspection.firebase.hostingTargets);
+  for (const project of inspection.projects) {
+    for (const target of project.targets) {
+      for (const command of target.commands) {
+        for (const hostingTarget of scanHostingTargets(command)) {
+          if (!declared.has(hostingTarget)) {
+            pushViolation11(violations, {
+              code: "WORKSPACE_DEPLOY_HOSTING_TARGET_MISSING",
+              message: `\`${project.name}:${target.name}\` deploys \`hosting:${hostingTarget}\`, which \`firebase.json\` does not declare (declared: [${Array.from(declared).join(", ") || "none"}]).`,
+              group,
+              project: project.name,
+              file: project.configFile,
+              line: void 0
+            });
+          }
+        }
+      }
+    }
+  }
+}
+function checkDeployLaneSymmetry(config) {
+  const { inspection, violations } = config;
+  const group = "deploy";
+  const lanesByProject = /* @__PURE__ */ new Map();
+  const allLanes = /* @__PURE__ */ new Set();
+  for (const project of inspection.projects) {
+    const lanes = /* @__PURE__ */ new Set();
+    for (const target of project.targets) {
+      const match = DEPLOY_LANE_PATTERN.exec(target.name);
+      if (match !== null) {
+        lanes.add(match[1]);
+        allLanes.add(match[1]);
+      }
+    }
+    if (lanes.size > 0) {
+      lanesByProject.set(project.name, lanes);
+    }
+  }
+  if (lanesByProject.size < 2) {
+    return;
+  }
+  for (const project of inspection.projects) {
+    const lanes = lanesByProject.get(project.name);
+    if (lanes === void 0) {
+      continue;
+    }
+    for (const lane of Array.from(allLanes).sort((a, b) => a.localeCompare(b))) {
+      if (!lanes.has(lane)) {
+        pushViolation11(violations, {
+          code: "WORKSPACE_DEPLOY_LANE_ASYMMETRIC",
+          message: `\`${project.name}\` deploys [${Array.from(lanes).sort((a, b) => a.localeCompare(b)).join(", ")}] but has no \`${DEPLOY_TARGET_PREFIX}${lane}\`, while a sibling project deploys \`${lane}\`.`,
+          severity: "warning",
+          group,
+          project: project.name,
+          file: project.configFile,
+          line: void 0
+        });
+      }
+    }
+  }
+}
+function runRules9(input) {
+  const { inspection, groups } = input;
+  const violations = [];
+  const targetsByProject = /* @__PURE__ */ new Map();
+  for (const project of inspection.projects) {
+    targetsByProject.set(project.name, indexTargets(project));
+  }
+  if (groups.includes("targets")) {
+    checkTargetReferences({ inspection, targetsByProject, violations });
+    checkTargetOutputs({ inspection, violations });
+  }
+  if (groups.includes("deploy")) {
+    checkDeployLaneEnvironmentSelection({ inspection, targetsByProject, violations });
+    checkConfigurationPaths({ inspection, violations });
+    checkUnreferencedEnvironmentFiles({ inspection, violations });
+    checkHostingTargets({ inspection, violations });
+    checkDeployLaneSymmetry({ inspection, violations });
+  }
+  return violations;
+}
+
+// packages/dbx-cli/validate/src/lib/workspace-validate/validate.ts
+function validateWorkspace(input) {
+  const { inspection } = input;
+  const groups = input.groups === void 0 || input.groups.length === 0 ? WORKSPACE_RULE_GROUPS : input.groups;
+  const violations = runRules9({ inspection, groups });
+  let errorCount = 0;
+  let warningCount = 0;
+  for (const violation of violations) {
+    if (violation.severity === "error") {
+      errorCount += 1;
+    } else {
+      warningCount += 1;
+    }
+  }
+  return {
+    violations,
+    errorCount,
+    warningCount,
+    projectsChecked: inspection.projects.length,
+    referencesChecked: inspection.references.length,
+    groups
+  };
+}
+
 // packages/dbx-cli/validate/src/lib/model-list-component/index.ts
 var model_list_component_exports = {};
 __export(model_list_component_exports, {
@@ -12744,8 +13734,8 @@ __export(model_list_component_exports, {
 });
 
 // packages/dbx-cli/model-test/src/lib/fixture/inspect.ts
-import { readFile as readFile11 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 
 // packages/dbx-cli/model-test/src/lib/fixture/extract.ts
 import { Node as Node16, Project as Project9, SyntaxKind as SyntaxKind7 } from "ts-morph";
@@ -13242,21 +14232,21 @@ function collectIdentityImports(sourceFile) {
 // packages/dbx-cli/model-test/src/lib/fixture/inspect.ts
 var FIXTURE_RELATIVE_PATH = "src/test/fixture.ts";
 async function inspectAppFixtures(apiAbs, apiRel) {
-  const absolutePath = join10(apiAbs, FIXTURE_RELATIVE_PATH);
+  const absolutePath = join11(apiAbs, FIXTURE_RELATIVE_PATH);
   const relativePath = `${apiRel}/${FIXTURE_RELATIVE_PATH}`;
-  const text = await readFile11(absolutePath, "utf8");
+  const text = await readFile12(absolutePath, "utf8");
   return extractAppFixturesFromText({ text, fixturePath: relativePath });
 }
 
 // packages/dbx-cli/validate/src/lib/model-list-component/extract.ts
-import { readdir as readdir8, readFile as readFile12, stat as stat10 } from "node:fs/promises";
-import { basename as basename5, join as join11, relative as relative6, sep as sep7 } from "node:path";
+import { readdir as readdir9, readFile as readFile13, stat as stat11 } from "node:fs/promises";
+import { basename as basename6, join as join12, relative as relative7, sep as sep7 } from "node:path";
 import { Node as Node17, Project as Project10 } from "ts-morph";
 var MODEL_SUBPATH = "src/lib/model";
 var MODEL_SUBPATH_PREFIX = `${MODEL_SUBPATH}/`;
 var RESERVED_NAMES = RESERVED_MODEL_FOLDERS.map((r) => r.name);
 async function extractComponentModels(componentAbs) {
-  const modelRoot = join11(componentAbs, MODEL_SUBPATH);
+  const modelRoot = join12(componentAbs, MODEL_SUBPATH);
   const folders = await listFolders(modelRoot);
   if (folders === void 0) {
     const result2 = { modelRoot, models: [], skipped: [], unidentifiedFolders: [] };
@@ -13346,13 +14336,13 @@ function projectRich(model, folder) {
 }
 async function fallbackForFolder(input) {
   const { modelRoot, componentAbs, folder, project } = input;
-  const folderAbs = join11(modelRoot, folder);
+  const folderAbs = join12(modelRoot, folder);
   const mainFile = await readMainFile(folderAbs, folder);
   if (mainFile === void 0) return void 0;
   const sourceFile = project.createSourceFile(mainFile.fileName, mainFile.text, { overwrite: true });
   const identity = findIdentityIn(sourceFile);
   if (!identity) return void 0;
-  const sourceFileRel = relative6(componentAbs, mainFile.absPath).split(sep7).join("/");
+  const sourceFileRel = relative7(componentAbs, mainFile.absPath).split(sep7).join("/");
   return {
     folder,
     modelName: deriveModelName(identity.constName, folder),
@@ -13368,13 +14358,13 @@ async function listFolders(modelRoot) {
   let result;
   let isDir = false;
   try {
-    const stats = await stat10(modelRoot);
+    const stats = await stat11(modelRoot);
     isDir = stats.isDirectory();
   } catch {
     isDir = false;
   }
   if (isDir) {
-    const entries = await readdir8(modelRoot, { withFileTypes: true });
+    const entries = await readdir9(modelRoot, { withFileTypes: true });
     const out = [];
     for (const entry of entries) {
       if (entry.isDirectory()) out.push(entry.name);
@@ -13385,11 +14375,11 @@ async function listFolders(modelRoot) {
   return result;
 }
 async function readMainFile(folderAbs, folder) {
-  const candidate = join11(folderAbs, `${folder}.ts`);
+  const candidate = join12(folderAbs, `${folder}.ts`);
   let result;
   try {
-    const text = await readFile12(candidate, "utf8");
-    result = { absPath: candidate, fileName: basename5(candidate), text };
+    const text = await readFile13(candidate, "utf8");
+    result = { absPath: candidate, fileName: basename6(candidate), text };
   } catch {
     result = void 0;
   }
@@ -13534,21 +14524,21 @@ __export(model_api_list_app_exports, {
 });
 
 // packages/dbx-cli/validate/src/lib/model-api-list-app/extract.ts
-import { readFile as readFile13 } from "node:fs/promises";
-import { join as join12, relative as relative7, sep as sep8 } from "node:path";
+import { readFile as readFile14 } from "node:fs/promises";
+import { join as join13, relative as relative8, sep as sep8 } from "node:path";
 var API_SUFFIX2 = ".api.ts";
 var MODEL_SUBPATH2 = "src/lib";
 async function extractApiList(input) {
-  const modelRoot = join12(input.componentAbs, MODEL_SUBPATH2);
+  const modelRoot = join13(input.componentAbs, MODEL_SUBPATH2);
   const apiFiles = await collectFilesWithSuffix(modelRoot, API_SUFFIX2);
   const entries = [];
   const files = [];
   for (const filePath of apiFiles) {
-    const text = await readFile13(filePath, "utf8");
+    const text = await readFile14(filePath, "utf8");
     if (!text.includes("callModelFirebaseFunctionMapFactory")) {
       continue;
     }
-    const sourceFileRel = relative7(input.componentAbs, filePath).split(sep8).join("/");
+    const sourceFileRel = relative8(input.componentAbs, filePath).split(sep8).join("/");
     const extraction = extractCrudEntries({ name: sourceFileRel, text });
     const fileEntries = extraction.entries.map((entry) => ({ ...entry, sourceFile: sourceFileRel }));
     const counts = countVerbs(fileEntries);
@@ -13679,17 +14669,17 @@ __export(model_api_lookup_exports, {
 });
 
 // packages/dbx-cli/validate/src/lib/model-api-lookup/extract.ts
-import { readFile as readFile15 } from "node:fs/promises";
-import { join as join14, relative as relative9, sep as sep10 } from "node:path";
+import { readFile as readFile16 } from "node:fs/promises";
+import { join as join15, relative as relative10, sep as sep10 } from "node:path";
 
 // packages/dbx-cli/validate/src/lib/model-api-lookup/extract-actions.ts
-import { readFile as readFile14 } from "node:fs/promises";
-import { join as join13, relative as relative8, sep as sep9 } from "node:path";
+import { readFile as readFile15 } from "node:fs/promises";
+import { join as join14, relative as relative9, sep as sep9 } from "node:path";
 import { Project as Project11, SyntaxKind as SyntaxKind8 } from "ts-morph";
 var ACTION_SERVER_SUFFIX = ".action.server.ts";
 var COMMON_MODEL_SUBPATH = "src/app/common/model";
 async function buildActionLookup(apiAbs) {
-  const modelRoot = join13(apiAbs, COMMON_MODEL_SUBPATH);
+  const modelRoot = join14(apiAbs, COMMON_MODEL_SUBPATH);
   const files = await collectFilesWithSuffix(modelRoot, ACTION_SERVER_SUFFIX);
   const methodsByParams = /* @__PURE__ */ new Map();
   const factoriesByParams = /* @__PURE__ */ new Map();
@@ -13698,9 +14688,9 @@ async function buildActionLookup(apiAbs) {
   }
   const project = new Project11({ useInMemoryFileSystem: true, skipAddingFilesFromTsConfig: true });
   for (const filePath of files) {
-    const text = await readFile14(filePath, "utf8");
+    const text = await readFile15(filePath, "utf8");
     const sourceFile = project.createSourceFile(filePath, text, { overwrite: true });
-    const sourceFileRel = relative8(apiAbs, filePath).split(sep9).join("/");
+    const sourceFileRel = relative9(apiAbs, filePath).split(sep9).join("/");
     collectAbstractMethods({ sourceFile, sourceFileRel, methodsByParams });
     collectFactoryFunctions({ sourceFile, sourceFileRel, factoriesByParams });
   }
@@ -13860,13 +14850,13 @@ function mapDocFields(fields) {
   return result;
 }
 async function collectApiSources(componentAbs) {
-  const root = join14(componentAbs, COMPONENT_LIB_SUBPATH2);
+  const root = join15(componentAbs, COMPONENT_LIB_SUBPATH2);
   const files = await collectFilesWithSuffix(root, API_SUFFIX3);
   const sources = [];
   for (const fileAbs of files) {
-    const text = await readFile15(fileAbs, "utf8");
+    const text = await readFile16(fileAbs, "utf8");
     if (!text.includes("callModelFirebaseFunctionMapFactory")) continue;
-    const fileRel = relative9(componentAbs, fileAbs).split(sep10).join("/");
+    const fileRel = relative10(componentAbs, fileAbs).split(sep10).join("/");
     sources.push({ fileAbs, fileRel, text });
   }
   return sources;
@@ -14014,14 +15004,14 @@ __export(server_actions_list_app_exports, {
 });
 
 // packages/dbx-cli/validate/src/lib/server-actions-list-app/extract.ts
-import { readdir as readdir9, readFile as readFile16 } from "node:fs/promises";
-import { dirname as dirname2, join as join15, relative as relative10, sep as sep11 } from "node:path";
+import { readdir as readdir10, readFile as readFile17 } from "node:fs/promises";
+import { dirname as dirname3, join as join16, relative as relative11, sep as sep11 } from "node:path";
 import { Node as Node18, Project as Project12 } from "ts-morph";
 var ACTION_SERVER_SUFFIX2 = ".action.server.ts";
 var COMMON_MODEL_SUBPATH2 = "src/app/common/model";
 var COMMON_BARREL_REL = "src/app/common/index.ts";
 async function extractServerActions(apiAbs, apiRel) {
-  const modelRoot = join15(apiAbs, COMMON_MODEL_SUBPATH2);
+  const modelRoot = join16(apiAbs, COMMON_MODEL_SUBPATH2);
   const actionFiles = await collectFilesWithSuffix(modelRoot, ACTION_SERVER_SUFFIX2);
   if (actionFiles.length === 0) {
     return { modelRoot, entries: [], fixtureStatus: "ok" };
@@ -14041,14 +15031,14 @@ async function extractServerActions(apiAbs, apiRel) {
   }
   const entries = [];
   for (const filePath of actionFiles) {
-    const text = await readFile16(filePath, "utf8");
+    const text = await readFile17(filePath, "utf8");
     const sourceFile = project.createSourceFile(filePath, text, { overwrite: true });
     const classes = findServerActionClasses(sourceFile);
     for (const className of classes) {
       const wiring = await inspectSiblingModule(filePath, className);
       const expectedGetterName = camelize(className);
       const fixtureCoverage = fixtureStatus === "ok" ? fixtureCoverageMap.get(expectedGetterName) ?? unmatchedFixtureCoverage(expectedGetterName) : void 0;
-      const sourceFileRel = relative10(apiAbs, filePath).split(sep11).join("/");
+      const sourceFileRel = relative11(apiAbs, filePath).split(sep11).join("/");
       entries.push({
         className,
         sourceFile: sourceFileRel,
@@ -14090,14 +15080,14 @@ async function inspectSiblingModule(actionFilePath, className) {
   return { modulePath: moduleCandidates[0], providedByModule: false, exportedByModule: false };
 }
 async function findModuleCandidates(actionFilePath) {
-  const dir = dirname2(actionFilePath);
+  const dir = dirname3(actionFilePath);
   const out = [];
   try {
-    const entries = await readdir9(dir, { withFileTypes: true });
+    const entries = await readdir10(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (!entry.name.endsWith(".module.ts")) continue;
-      out.push(join15(dir, entry.name));
+      out.push(join16(dir, entry.name));
     }
   } catch {
   }
@@ -14107,7 +15097,7 @@ async function findModuleCandidates(actionFilePath) {
 async function safeRead(path) {
   let result;
   try {
-    result = await readFile16(path, "utf8");
+    result = await readFile17(path, "utf8");
   } catch {
     result = void 0;
   }
@@ -14154,7 +15144,7 @@ function moduleArrayContains(decoratorArg, propertyName, className) {
   return false;
 }
 async function readCommonBarrelExports(apiAbs) {
-  const path = join15(apiAbs, COMMON_BARREL_REL);
+  const path = join16(apiAbs, COMMON_BARREL_REL);
   const text = await safeRead(path);
   if (text === void 0) return /* @__PURE__ */ new Set();
   const project = new Project12({ useInMemoryFileSystem: true });
@@ -14333,8 +15323,8 @@ function formatReportAsJson4(report) {
 
 // packages/dbx-cli/validate/src/lib/dbx-asset-list-app/format.markdown.ts
 function formatReportAsMarkdown4(report) {
-  const basename6 = report.componentDir.split("/").pop() ?? report.componentDir;
-  const lines = [`# App assets \u2014 ${basename6}`, "", `Component: \`${report.componentDir}\``, `App: \`${report.apiDir}\``, "", `\`src/lib/assets.ts\`: ${formatBool(report.assetsFileExists)}`, `Barrel re-exports \`./assets\`: ${formatBool(report.barrelReExportsAssets)}`, `\`provideDbxAssetLoader()\` called in \`src/root.app.config.ts\`: ${formatBool(report.providerWiredInApp)}`, "", `## Assets (${report.assets.length})`];
+  const basename7 = report.componentDir.split("/").pop() ?? report.componentDir;
+  const lines = [`# App assets \u2014 ${basename7}`, "", `Component: \`${report.componentDir}\``, `App: \`${report.apiDir}\``, "", `\`src/lib/assets.ts\`: ${formatBool(report.assetsFileExists)}`, `Barrel re-exports \`./assets\`: ${formatBool(report.barrelReExportsAssets)}`, `\`provideDbxAssetLoader()\` called in \`src/root.app.config.ts\`: ${formatBool(report.providerWiredInApp)}`, "", `## Assets (${report.assets.length})`];
   if (report.assets.length === 0) {
     lines.push("", "_None found._");
   } else {
@@ -14522,11 +15512,11 @@ function formatReportAsJson5(report) {
 
 // packages/dbx-cli/validate/src/lib/notification-m-list-app/format.markdown.ts
 function formatReportAsMarkdown5(report) {
-  const basename6 = report.componentDir.split("/").pop() ?? report.componentDir;
+  const basename7 = report.componentDir.split("/").pop() ?? report.componentDir;
   const aggregatorRecordText = report.aggregatorRecordName ? code(report.aggregatorRecordName) : "_Not defined._";
   const templateConfigsFactoryText = report.templateConfigsArrayFactoryName ? code(report.templateConfigsArrayFactoryName) : "_Not defined._";
   const lines = [
-    `# App notifications \u2014 ${basename6}`,
+    `# App notifications \u2014 ${basename7}`,
     "",
     `Component: \`${report.componentDir}\``,
     `API: \`${report.apiDir}\``,
@@ -14723,9 +15713,9 @@ function formatReportAsJson6(report) {
 
 // packages/dbx-cli/validate/src/lib/storagefile-m-list-app/format.markdown.ts
 function formatReportAsMarkdown6(report) {
-  const basename6 = report.componentDir.split("/").pop() ?? report.componentDir;
+  const basename7 = report.componentDir.split("/").pop() ?? report.componentDir;
   const uploadServiceFactoryText = report.uploadServiceFactoryName ? code2(report.uploadServiceFactoryName) : "_Not defined._";
-  const lines = [`# App storagefiles \u2014 ${basename6}`, "", `Component: \`${report.componentDir}\``, `API: \`${report.apiDir}\``, "", `Upload service factory: ${uploadServiceFactoryText}`, `Wired via \`StorageFileInitializeFromUploadService\` provider: ${formatBool3(report.uploadServiceWiredInApi)}`, `Processing handler call present: ${formatBool3(report.processingHandlerWiredInApi)}`, "", `## Purposes (${report.purposes.length})`];
+  const lines = [`# App storagefiles \u2014 ${basename7}`, "", `Component: \`${report.componentDir}\``, `API: \`${report.apiDir}\``, "", `Upload service factory: ${uploadServiceFactoryText}`, `Wired via \`StorageFileInitializeFromUploadService\` provider: ${formatBool3(report.uploadServiceWiredInApi)}`, `Processing handler call present: ${formatBool3(report.processingHandlerWiredInApi)}`, "", `## Purposes (${report.purposes.length})`];
   if (report.purposes.length === 0) {
     lines.push("", "_None found._");
   } else {
@@ -14909,8 +15899,8 @@ __export(dbx_color_template_list_app_exports, {
 });
 
 // packages/dbx-cli/validate/src/lib/dbx-color-template-list-app/inspect.ts
-import { readFile as readFile17 } from "node:fs/promises";
-import { join as join16, relative as relative11, sep as sep12 } from "node:path";
+import { readFile as readFile18 } from "node:fs/promises";
+import { join as join17, relative as relative12, sep as sep12 } from "node:path";
 var CANDIDATE_RELPATHS = ["src/root.app.config.ts", "src/app.config.ts", "src/app.module.ts", "src/app/app.config.ts", "src/app/app.module.ts"];
 async function inspectColorTemplates(apiAbs, apiRel) {
   const present = [];
@@ -14920,7 +15910,7 @@ async function inspectColorTemplates(apiAbs, apiRel) {
     for (const candidate of candidates) {
       const text = await readFileIfExists2(candidate);
       if (text === void 0) continue;
-      const rel = relative11(apiAbs, candidate).split(sep12).join("/");
+      const rel = relative12(apiAbs, candidate).split(sep12).join("/");
       present.push({ relPath: rel, text });
     }
   } catch (err) {
@@ -14937,25 +15927,25 @@ async function inspectColorTemplates(apiAbs, apiRel) {
 async function collectCandidatePaths(apiAbs) {
   const explicit = [];
   for (const rel of CANDIDATE_RELPATHS) {
-    explicit.push(join16(apiAbs, rel));
+    explicit.push(join17(apiAbs, rel));
   }
-  const scanned = await scanProviderFiles(join16(apiAbs, "src"));
+  const scanned = await scanProviderFiles(join17(apiAbs, "src"));
   return [...explicit, ...scanned];
 }
 async function scanProviderFiles(srcAbs) {
-  const { readdir: readdir10 } = await import("node:fs/promises");
+  const { readdir: readdir11 } = await import("node:fs/promises");
   const out = [];
   const stack = [srcAbs];
   while (stack.length > 0) {
     const current = stack.pop();
     let entries;
     try {
-      entries = await readdir10(current, { withFileTypes: true });
+      entries = await readdir11(current, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const full = join16(current, entry.name);
+      const full = join17(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
@@ -14970,7 +15960,7 @@ async function scanProviderFiles(srcAbs) {
 async function readFileIfExists2(absPath) {
   let result;
   try {
-    result = await readFile17(absPath, "utf8");
+    result = await readFile18(absPath, "utf8");
   } catch (err) {
     const code3 = err.code;
     if (code3 !== "ENOENT" && code3 !== "ENOTDIR" && code3 !== "EISDIR") {
@@ -15674,11 +16664,12 @@ function matchKindForRadius(exact, raw) {
   if (exact.defaults.light === raw || exact.defaults.dark === raw) return "(exact-match design-system corner token).";
   return "(idiomatic full / pill radius \u2014 design system token).";
 }
-function findExactRoleToken(registry, raw, role) {
+function findExactRoleToken(params) {
+  const { registry, raw, role, isAllowed } = params;
   const candidates = registry.byRole.get(role) ?? [];
   let result;
   for (const entry of candidates) {
-    if (entry.defaults.light === raw || entry.defaults.dark === raw) {
+    if ((entry.defaults.light === raw || entry.defaults.dark === raw) && (isAllowed === void 0 || isAllowed(entry))) {
       result = entry;
       break;
     }
@@ -15823,7 +16814,7 @@ var hardcodedRadius = (input) => {
     const colonIndex = input.scss.indexOf(":", match.index);
     if (colonIndex !== -1 && isInsideScssVarDeclaration(input.scss, colonIndex)) continue;
     const raw = match[1];
-    let exact = findExactRoleToken(input.tokenRegistry, raw, "radius");
+    let exact = findExactRoleToken({ registry: input.tokenRegistry, raw, role: "radius" });
     if (exact === void 0 && FULL_RADIUS_SYNONYMS.has(raw)) {
       exact = input.tokenRegistry.findByCssVariable("--mat-sys-corner-full");
     }
@@ -15854,7 +16845,7 @@ var hardcodedShadow = (input) => {
     if (match.index === void 0) continue;
     const raw = match[1].trim();
     if (raw.startsWith("var(") || raw === "none") continue;
-    const exact = findExactRoleToken(input.tokenRegistry, raw, "elevation");
+    const exact = findExactRoleToken({ registry: input.tokenRegistry, raw, role: "elevation" });
     const fix = exact === void 0 ? 'Hardcoded `box-shadow:` declarations should map to one of the `--mat-sys-level0..5` elevation tokens, or wrap the surface in `<dbx-content-box [elevate]="true">` so the shadow comes from the design system.' : `Replace this hardcoded shadow with \`box-shadow: var(${exact.cssVariable})\` or use \`<dbx-content-box [elevate]="true">\` to apply the elevation through the wrapper component.`;
     matches.push({
       id: "hardcoded-shadow",
@@ -15899,12 +16890,13 @@ var hardcodedHintColor = (input) => {
   return matches;
 };
 var HARDCODED_PADDING_RE = /(?:padding|margin)\s*(?:-(?:top|right|bottom|left))?\s*:\s*(\d+(?:\.\d+)?px)(?!\s*\))/gi;
+var DBX_PADDING_SCALE_RE = /^--dbx-padding-\d+$/;
 var hardcodedPadding = (input) => {
   const matches = [];
   for (const match of input.scss.matchAll(HARDCODED_PADDING_RE)) {
     if (match.index === void 0) continue;
     const raw = match[1];
-    const exact = findExactRoleToken(input.tokenRegistry, raw, "spacing");
+    const exact = findExactRoleToken({ registry: input.tokenRegistry, raw, role: "spacing", isAllowed: (entry) => DBX_PADDING_SCALE_RE.test(entry.cssVariable) });
     if (exact !== void 0) {
       const utility = exact.utilityClasses?.[0];
       const fix = ["Replace `" + match[0].trim() + "` with `var(" + exact.cssVariable + ")`" + (utility === void 0 ? "" : ` (or use the \`${utility}\` utility class on the host element)`) + "."].join("\n");
@@ -16642,5 +17634,6 @@ export {
   storagefile_m_validate_folder_exports as storagefileValidateFolder,
   system_m_list_app_exports as systemListApp,
   system_m_validate_folder_exports as systemValidateFolder,
-  ui_smell_check_exports as uiSmellCheck
+  ui_smell_check_exports as uiSmellCheck,
+  workspace_validate_exports as workspaceValidate
 };