@smoothbricks/cli 0.1.0

package/README.md

@@ -0,0 +1,289 @@
+# @smoothbricks/cli
+
+`@smoothbricks/cli` provides `smoo`, the SmoothBricks monorepo automation CLI. It is the control plane for shared CI,
+release, Git hook, package metadata, and publish validation conventions across SmoothBricks-style repositories.
+
+The tool is intentionally convention-over-configuration. SmoothBricks repos use Nx, Bun, Nix, devenv, and direnv, so
+`smoo` assumes those pieces exist instead of adding another local config file. Repos should be made correct by running
+the mutating initialization path, then kept correct by the read-only validation path.
+
+## Install
+
+Add the CLI to the root workspace:
+
+```bash
+bun add -d @smoothbricks/cli
+```
+
+The package exposes a Bun-native executable:
+
+```bash
+smoo --help
+```
+
+SmoothBricks itself self-hosts before `dist` exists by using `tooling/smoo`, which imports `packages/cli/src/cli.ts`
+directly. Published installs use the package binary in `bin/smoo`, which imports built JavaScript from `dist`.
+
+## Core Commands
+
+```bash
+smoo monorepo init [--runtime-only] [--sync-runtime]
+smoo monorepo validate
+smoo monorepo update
+smoo monorepo check
+smoo monorepo diff
+smoo monorepo validate-commit-msg <commit-msg-file>
+smoo monorepo sync-bun-lockfile-versions
+smoo monorepo list-public-projects
+smoo monorepo validate-public-tags
+smoo monorepo release-state
+
+smoo release version --bump <auto|patch|minor|major|prerelease> [--dry-run]
+smoo release publish --bump <auto|patch|minor|major|prerelease> [--tag <tag>] [--npm-tag <tag>] [--dry-run]
+smoo release github-release --tags <tags> --bump <auto|patch|minor|major|prerelease> [--tag <tag>] [--npm-tag <tag>] [--dry-run]
+smoo release trust-publisher [--dry-run] [--otp <code>] [--skip-login]
+
+smoo github-ci cleanup-cache
+smoo github-ci nx-smart --target <target> --name <check-name> --step <number>
+smoo github-ci nx-run-many --targets <targets> [--projects <projects>]
+```
+
+## Initialization
+
+`smoo monorepo init` is the fix-first command. It mutates the repository toward the SmoothBricks convention instead of
+only reporting drift.
+
+It currently:
+
+- Updates managed CI, release, hook, and formatting files.
+- Ensures the local `tooling/smoo` source shim is executable when present.
+- Synchronizes root runtime versions inside devenv, or when `--sync-runtime` is passed.
+- Applies publish metadata defaults to `npm:public` packages.
+- Normalizes internal workspace dependency ranges to `workspace:*`.
+- Runs `sherif --fix --select highest` for broad monorepo package hygiene.
+- Normalizes conditional export ordering so `types` comes first and `default` comes last.
+- Adds `src` to package `files` when development-only exports intentionally point at source files.
+
+The workspace dependency rule is generic. `smoo` does not know about individual package names such as `eslint-stdout`.
+For every root or workspace `package.json`, if a dependency name matches an actual package in the same workspace, `smoo`
+rewrites that range to `workspace:*`.
+
+`smoo monorepo init --runtime-only` only synchronizes root runtime versions. It is used from direnv setup so
+`packageManager`, `engines.node`, and `@types/node` stay aligned with the active devenv shell without duplicating that
+policy in the direnv script.
+
+Bun types are also a root runtime policy. The root `@types/bun` version follows the exact `packageManager` Bun version,
+while package manifests are not forced to depend on Bun just because a test tsconfig opts into Bun globals. If a package
+does explicitly declare `@types/bun`, `sherif` can keep duplicate declarations consistent, but `smoo` owns the semantic
+root `bun@x.y.z` to `@types/bun x.y.z` relationship.
+
+## Validation
+
+`smoo monorepo validate` is the read-only gate. It should pass in local shells and CI after packages have been built.
+
+It checks:
+
+- Managed file drift.
+- Root package policy.
+- Root Bun type version matches the Bun package manager version.
+- Nx release policy.
+- Public package tag policy.
+- Public package metadata.
+- Workspace dependency ranges.
+- `sherif` package hygiene.
+- Packed public package artifacts with `publint`.
+- Packed public package type resolution with the `attw` CLI.
+
+The packed-package checks validate what npm users will install, not only the source tree. `smoo` packs each `npm:public`
+package with Bun, runs `publint` on the tarball, then runs `attw` on the same tarball.
+
+The `attw` check uses the `node16` profile and ignores the CJS-to-ESM warning. SmoothBricks packages are ESM-first, so
+CommonJS consumers can use dynamic import. Node 10-only subpath failures are intentionally ignored because Node 10 is
+not part of the supported package contract.
+
+## Publishable Packages
+
+Publishability is declared with an Nx tag:
+
+```json
+{
+  "nx": {
+    "tags": ["npm:public"]
+  }
+}
+```
+
+This tag is the source of truth for release selection, metadata validation, and publish artifact validation. `smoo`
+never relies on a second hardcoded package list.
+
+Rules:
+
+- Publishable packages must not be private.
+- Private packages must not have `npm:public`.
+- Every non-private workspace package must have `npm:public`.
+- Public packages must define license metadata.
+- Public packages must publish with `publishConfig.access = "public"`.
+- Public package repositories must point at the root repo and include `repository.directory`.
+- Public packages must define `files`.
+- Public library packages must define `types`.
+- Public packages must define either `exports` or `bin`.
+
+`smoo monorepo init` fixes the metadata that can be derived from the root package. For example, it copies the root
+license and repository URL, then sets each package's `repository.directory` from its workspace path.
+
+## Managed Files
+
+`smoo monorepo update` writes the managed files into a repository.
+
+Managed files include:
+
+- `.git-format-staged.yml`
+- Git hook scripts under `tooling/git-hooks`
+- direnv/GitHub Actions bootstrap scripts under `tooling/direnv`
+- GitHub Actions workflows under `.github/workflows`
+- Local composite GitHub Actions under `.github/actions`
+
+When a managed target is a symlink, `smoo` leaves it alone. SmoothBricks uses symlinks back to `packages/cli/managed` so
+changes to the CLI package are tested immediately. Downstream repos receive ordinary committed copies.
+
+Use:
+
+```bash
+smoo monorepo update
+smoo monorepo check
+smoo monorepo diff
+```
+
+`check` fails when a managed file is missing or stale. `diff` reports drift without writing files.
+
+## Git Hooks
+
+The generated pre-commit hook runs `git-format-staged` from the repository root with `tooling`, `node_modules/.bin`, and
+the devenv profile on `PATH`.
+
+The generated commit-msg hook delegates conventional commit validation to:
+
+```bash
+smoo monorepo validate-commit-msg <commit-msg-file>
+```
+
+This keeps hook behavior consistent with CI and avoids duplicating commit message parsing in shell.
+
+## GitHub Actions
+
+The generated workflows keep readable YAML and named top-level steps, while larger logic lives in `smoo` commands,
+post-checkout composite actions, or the small pre-smoo bootstrap script. Checkout stays inline in each workflow because
+repository-local composite actions do not exist until `actions/checkout` has populated the working tree.
+
+CI uses explicit lint, test, and build phases. The publish workflow does the same before running release commands so
+GitHub output remains readable even though Nx release also has its own `preVersionCommand` safety net.
+
+CI status deeplinks depend on GitHub's top-level job step anchors. The generated CI workflow keeps `# Step N` comments
+next to each top-level step, and the `smoo github-ci nx-smart --step <number>` values for lint, test, and build must
+stay synchronized with those comments. Composite action internals do not change the top-level step numbers.
+
+Managed CI setup is split across local composite actions:
+
+- `setup-devenv` installs Nix, restores the Nix cache segment, imports the store NAR, restores `.devenv`/`.direnv` only
+  after an exact Nix cache hit, enables Cachix, installs devenv, restores `node_modules`, and builds the shell.
+- `save-nix-devenv` runs under `always()`, calls `smoo github-ci cleanup-cache`, and explicitly saves cache segments
+  only when cleanup reports `cache-ready=true`.
+- `cache-nix-devenv` is the shared restore/save primitive for the separate `nix` and `devenv` cache segments.
+
+The cache split is intentional. The Nix segment contains the profile, Nix state, and exported store NAR. It is large and
+keyed by the expensive shell closure inputs. The `.devenv`/`.direnv` segment is small, but it contains absolute
+`/nix/store` pointers, so restoring it without the exact matching Nix store can leave metadata pointing at missing store
+paths.
+
+`smoo github-ci cleanup-cache` prepares the Nix segment for saving. It verifies and repairs the store, scans `.devenv`,
+`.direnv`, and `~/.nix-profile` for embedded `/nix/store/...` references, protects the live paths with temporary GC
+roots, runs garbage collection, and exports the resulting closure to `NIX_STORE_NAR`. The command writes
+`cache-ready=true` or `cache-ready=false` to `GITHUB_OUTPUT` so the save action can avoid uploading incomplete caches.
+
+The bootstrap script is intentionally small. It only handles work required before `smoo` can run in GitHub Actions:
+
+- Restore Nix store cache state, clearing `.devenv` and `.direnv` if the matching NAR is missing or fails to import.
+- Install `devenv`.
+- Build the devenv shell and add repo-local tooling to `GITHUB_PATH`.
+
+## Releases
+
+Release commands wrap Nx release but keep SmoothBricks policy in one place.
+
+Versioning:
+
+- `--bump auto` uses Nx conventional-commit versioning.
+- `--bump patch|minor|major|prerelease` forces the release specifier.
+- Release projects are discovered from `npm:public` packages.
+- Nx release config must use `currentVersionResolver: "git-tag"` with `fallbackCurrentVersionResolver: "disk"`.
+  Conventional-commit versioning requires git tags as the primary source, while the disk fallback supports initial
+  releases before package tags exist.
+- `smoo release version` lets Nx own local package versioning, `bun.lock` updates, the release commit, and annotated
+  tags. smoo records `HEAD` before and after Nx runs, then pushes with `git push --follow-tags --atomic` only if Nx
+  created a new release commit. This keeps the release commit and tags atomic without pushing an older checkout on
+  retries where Nx has nothing new to commit.
+- Reruns call Nx versioning again rather than repairing tags in `smoo`. Nx's git-tag current-version resolver plus disk
+  fallback handles already-tagged releases and first releases before package tags exist; smoo skips the remote push when
+  Nx leaves `HEAD` unchanged.
+
+Publishing:
+
+- `prerelease` publishes with npm dist-tag `next`.
+- Stable bumps publish with npm dist-tag `latest`.
+- Conflicting explicit dist-tags are rejected.
+- `smoo release publish` checks every current `name@version` for `npm:public` packages before publishing. Already
+  published versions are skipped, so reruns after auth or network failures retry only the package versions npm does not
+  have yet.
+- Publish uses `bun pm pack` to create package tarballs, then publishes those tarballs with latest npm CLI and
+  `--provenance`. Bun pack resolves internal `workspace:*` dependency ranges to real versions in the tarball manifest;
+  smoo fails before publish if a packed manifest still contains `workspace:`.
+- npm CLI owns publish authentication. When trusted publishing is configured, npm uses GitHub Actions OIDC from the
+  workflow's `id-token: write` permission. Before trusted publishing exists, the managed workflow passes
+  `secrets.NPM_TOKEN` as `NODE_AUTH_TOKEN` and smoo writes a temporary npm user config for bootstrap publishing.
+- `smoo release trust-publisher` configures npm trusted publishing for every `npm:public` package. It uses the root
+  `package.json` `repository.url` as the GitHub `owner/repo`, uses `publish.yml` as the trusted workflow, and runs
+  `npm trust` through `nix shell nixpkgs#nodejs_latest` because the Lambda-pinned Node 24/npm toolchain may lag the npm
+  CLI feature. By default it runs `npm login --auth-type=web` first so npm can open a browser login; pass `--skip-login`
+  when the current npm session is already authenticated. Packages must already exist on npm before trust can be
+  configured. npm may still require operation-level 2FA for `npm trust`; smoo prompts for a hidden OTP per package, or
+  you can pass `--otp <code>` for non-interactive use.
+
+GitHub Releases:
+
+- `smoo release github-release` creates or updates releases for the selected tags.
+- `latest` status follows the derived npm dist-tag.
+
+The release flow is designed to be rerun after partial failure. Nx owns local version/tag behavior, `smoo` owns the
+guarded atomic git push, and npm registry state makes publishing idempotent across retries.
+
+## Why This Shape
+
+The important design goal is one source of truth per convention:
+
+- Nx `npm:public` tags decide what is publishable.
+- Managed files decide what generated CI and hooks should look like.
+- Root package metadata provides defaults for public packages.
+- Actual workspace package names decide which dependency ranges become `workspace:*`.
+- `sherif` handles broad package hygiene.
+- `publint` and `attw` validate real packed artifacts.
+
+This keeps `smoo` small where external tools already do the job, but keeps SmoothBricks-specific policy native where
+generic tools do not know the repo contract. In particular, `sherif` is useful for package hygiene, but it does not know
+SmoothBricks publish metadata, release tags, generated workflow files, or Nx release policy. Those remain `smoo`
+conventions.
+
+## Local Verification
+
+Typical verification after changing `smoo`:
+
+```bash
+nx typecheck @smoothbricks/cli
+nx lint @smoothbricks/cli
+smoo monorepo validate
+```
+
+If validating packages with Zig build steps from outside the devenv shell, add Zig explicitly:
+
+```bash
+nix shell nixpkgs#zig -c nx run-many -t build --projects=<public-projects>
+```

package/bin/smoo

@@ -0,0 +1,4 @@
+#!/usr/bin/env bun
+import { runCli } from '../dist/cli.js';
+
+await runCli();

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+export declare function runCli(argv?: string[]): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE"}

package/dist/cli.js

@@ -0,0 +1,141 @@
+import { Command, CommanderError } from 'commander';
+import { findRepoRoot } from './lib/run.js';
+export async function runCli(argv = process.argv.slice(2)) {
+    const program = buildProgram();
+    try {
+        await program.parseAsync(argv, { from: 'user' });
+    }
+    catch (error) {
+        if (error instanceof CommanderError) {
+            if (error.code !== 'commander.helpDisplayed') {
+                process.exitCode = error.exitCode;
+            }
+            return;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(message);
+        process.exitCode = 1;
+    }
+}
+function buildProgram() {
+    const program = new Command();
+    program.name('smoo').description('SmoothBricks monorepo tooling').exitOverride().showHelpAfterError();
+    const monorepo = program.command('monorepo').description('Manage SmoothBricks-style monorepos');
+    monorepo
+        .command('init')
+        .option('--runtime-only', 'only sync root Bun/Node runtime metadata')
+        .option('--sync-runtime', 'sync root Bun/Node runtime metadata outside devenv')
+        .action(async (options) => {
+        const { initMonorepo } = await import('./monorepo/index.js');
+        await initMonorepo(await findRepoRoot(), options);
+    });
+    monorepo
+        .command('validate')
+        .option('--fail-fast', 'stop after the first failing validation pack')
+        .action(async (options) => {
+        const { validateMonorepo } = await import('./monorepo/index.js');
+        await validateMonorepo(await findRepoRoot(), options);
+    });
+    monorepo.command('update').action(async () => {
+        const { updateManagedFiles } = await import('./monorepo/index.js');
+        updateManagedFiles(await findRepoRoot());
+    });
+    monorepo.command('check').action(async () => {
+        const { checkManagedFiles } = await import('./monorepo/index.js');
+        checkManagedFiles(await findRepoRoot());
+    });
+    monorepo.command('diff').action(async () => {
+        const { diffManagedFiles } = await import('./monorepo/index.js');
+        diffManagedFiles(await findRepoRoot());
+    });
+    monorepo.command('validate-commit-msg <commitMsgFile>').action(async (commitMsgFile) => {
+        const { validateCommitMessageFile } = await import('./monorepo/index.js');
+        validateCommitMessageFile(commitMsgFile);
+    });
+    monorepo.command('sync-bun-lockfile-versions').action(async () => {
+        const { syncBunLockfileVersions } = await import('./monorepo/index.js');
+        syncBunLockfileVersions(await findRepoRoot());
+    });
+    monorepo.command('list-public-projects').action(async () => {
+        const { listPublicProjects } = await import('./monorepo/index.js');
+        console.log(listPublicProjects(await findRepoRoot()));
+    });
+    monorepo.command('validate-public-tags').action(async () => {
+        const { validatePublicPackageTags } = await import('./monorepo/index.js');
+        validatePublicPackageTags(await findRepoRoot());
+    });
+    monorepo.command('release-state').action(async () => {
+        const { printReleaseState } = await import('./release/index.js');
+        await printReleaseState(await findRepoRoot());
+    });
+    const release = program.command('release').description('Version, publish, and create GitHub Releases');
+    release
+        .command('version')
+        .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
+        .option('--dry-run [dryRun]', 'run without writing versions, tags, or pushes')
+        .action(async (options) => {
+        const { releaseVersion } = await import('./release/index.js');
+        await releaseVersion(await findRepoRoot(), { bump: options.bump, dryRun: booleanOption(options.dryRun) });
+    });
+    release
+        .command('publish')
+        .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
+        .option('--tag <tag>', 'explicit npm dist-tag; must match bump-derived tag')
+        .option('--npm-tag <npmTag>', 'explicit npm dist-tag; must match bump-derived tag')
+        .option('--dry-run [dryRun]', 'run without publishing')
+        .action(async (options) => {
+        const { releasePublish } = await import('./release/index.js');
+        await releasePublish(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
+    });
+    release
+        .command('github-release')
+        .option('--tags <tags>', 'space-separated release tags')
+        .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
+        .option('--tag <tag>', 'explicit npm dist-tag; must match bump-derived tag')
+        .option('--npm-tag <npmTag>', 'explicit npm dist-tag; must match bump-derived tag')
+        .option('--dry-run [dryRun]', 'skip GitHub Release writes')
+        .action(async (options) => {
+        const { releaseGithubRelease } = await import('./release/index.js');
+        await releaseGithubRelease(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
+    });
+    release
+        .command('trust-publisher')
+        .description('Configure npm trusted publishing for public packages')
+        .option('--dry-run [dryRun]', 'show npm trust changes without saving them')
+        .option('--otp <otp>', 'npm one-time password for trust operations')
+        .option('--skip-login', 'skip npm browser login before configuring trust')
+        .action(async (options) => {
+        const { releaseTrustPublisher } = await import('./release/index.js');
+        await releaseTrustPublisher(await findRepoRoot(), {
+            dryRun: booleanOption(options.dryRun),
+            otp: options.otp,
+            skipLogin: options.skipLogin === true,
+        });
+    });
+    const githubCi = program.command('github-ci').description('GitHub Actions helpers');
+    githubCi.command('cleanup-cache').action(async () => {
+        const { cleanupGithubCiCache } = await import('./github-ci/index.js');
+        await cleanupGithubCiCache(await findRepoRoot());
+    });
+    githubCi
+        .command('nx-smart')
+        .requiredOption('--target <target>')
+        .option('--name <name>')
+        .option('--step <step>')
+        .action(async (options) => {
+        const { githubCiNxSmart } = await import('./github-ci/index.js');
+        await githubCiNxSmart(await findRepoRoot(), options);
+    });
+    githubCi
+        .command('nx-run-many')
+        .requiredOption('--targets <targets>')
+        .option('--projects <projects>')
+        .action(async (options) => {
+        const { githubCiNxRunMany } = await import('./github-ci/index.js');
+        await githubCiNxRunMany(await findRepoRoot(), options);
+    });
+    return program;
+}
+function booleanOption(value) {
+    return value === true || value === 'true';
+}

package/dist/github-ci/index.d.ts

@@ -0,0 +1,11 @@
+export declare function cleanupGithubCiCache(root: string): Promise<void>;
+export declare function githubCiNxSmart(root: string, options: {
+    target: string;
+    name?: string;
+    step?: string;
+}): Promise<void>;
+export declare function githubCiNxRunMany(root: string, options: {
+    targets: string;
+    projects?: string;
+}): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/github-ci/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAMA,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtE;AAmFD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpH"}

package/dist/github-ci/index.js

@@ -0,0 +1,174 @@
+import { existsSync } from 'node:fs';
+import { appendFile, mkdtemp, realpath, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { $ } from 'bun';
+import { decode, run, runStatus } from '../lib/run.js';
+export async function cleanupGithubCiCache(root) {
+    const githubOutput = process.env.GITHUB_OUTPUT;
+    const markCacheReady = async (ready) => {
+        if (githubOutput) {
+            await appendFile(githubOutput, `cache-ready=${ready ? 'true' : 'false'}\n`);
+        }
+    };
+    const nar = process.env.NIX_STORE_NAR;
+    if (!nar) {
+        console.warn('NIX_STORE_NAR is not set; skipping Nix cache save.');
+        await markCacheReady(false);
+        return;
+    }
+    const nixStore = '/nix/var/nix/profiles/default/bin/nix-store';
+    const devenvProfile = `${root}/tooling/direnv/.devenv/profile`;
+    if (!existsSync(devenvProfile)) {
+        console.warn(`${devenvProfile} is missing; skipping Nix cache save.`);
+        await markCacheReady(false);
+        return;
+    }
+    await runStatus(nixStore, ['--verify', '--check-contents', '--repair'], root);
+    await exportNixStoreCache(root, nar, nixStore, devenvProfile);
+    await markCacheReady(true);
+}
+async function exportNixStoreCache(root, nar, nixStore, devenvProfile) {
+    const gcRootDir = '/nix/var/nix/gcroots/smoothbricks-cache-roots';
+    const tmpDir = await mkdtemp(join(dirname(nar), '.smoo-nix-cache-'));
+    const tmpNar = join(tmpDir, 'nix-store.nar');
+    const roots = new Set();
+    try {
+        await $ `rm -f ${nar}`.cwd(root);
+        await $ `sudo rm -rf ${gcRootDir}`.cwd(root);
+        await $ `sudo mkdir -p ${gcRootDir}`.cwd(root);
+        // The Nix cache must include every live store path referenced by the
+        // restored shell state, not just the devenv profile. .direnv stores paths to
+        // derivations like devenv-shell.drv; omitting those makes a cache hit restore
+        // metadata that points at missing store paths.
+        await addRoot(roots, devenvProfile);
+        const home = process.env.HOME;
+        if (home) {
+            const nixProfile = join(home, '.nix-profile');
+            await addRoot(roots, nixProfile);
+            await addReferencesFrom(roots, nixProfile, root);
+        }
+        await addReferencesFrom(roots, join(root, 'tooling/direnv/.devenv'), root);
+        await addReferencesFrom(roots, join(root, 'tooling/direnv/.direnv'), root);
+        const rootLinks = [];
+        let index = 0;
+        for (const target of roots) {
+            const link = `${gcRootDir}/root-${index}`;
+            await $ `sudo ln -s ${target} ${link}`.cwd(root);
+            rootLinks.push(link);
+            index += 1;
+        }
+        if (rootLinks.length === 0) {
+            throw new Error('No live Nix store roots found; skipping Nix cache save.');
+        }
+        await $ `nix-collect-garbage --quiet`.cwd(root);
+        const closureOutput = await $ `sudo ${nixStore} -qR ${rootLinks}`.cwd(root).quiet();
+        const closure = decode(closureOutput.stdout)
+            .split('\n')
+            .map((line) => line.trim())
+            .filter(Boolean);
+        if (closure.length === 0) {
+            throw new Error('No Nix store closure paths found; skipping Nix cache save.');
+        }
+        await $ `sudo ${nixStore} --export --quiet ${closure} > ${tmpNar}`.cwd(root);
+        await $ `test -s ${tmpNar}`.cwd(root);
+        await rename(tmpNar, nar);
+    }
+    finally {
+        await $ `sudo rm -rf ${gcRootDir}`.cwd(root).nothrow();
+        await rm(tmpDir, { recursive: true, force: true });
+    }
+}
+async function addRoot(roots, candidate) {
+    if (!existsSync(candidate)) {
+        return;
+    }
+    const target = await realpath(candidate);
+    if (existsSync(target)) {
+        roots.add(target);
+    }
+}
+async function addReferencesFrom(roots, path, cwd) {
+    if (!existsSync(path)) {
+        return;
+    }
+    const storePathPattern = '/nix/store/[a-z0-9]{32}-[A-Za-z0-9+._?=-]+';
+    const result = await $ `grep -rahoE ${storePathPattern} ${path}`.cwd(cwd).quiet().nothrow();
+    for (const line of decode(result.stdout).split('\n')) {
+        const candidate = line.trim();
+        if (candidate && existsSync(candidate)) {
+            roots.add(candidate);
+        }
+    }
+}
+export async function githubCiNxSmart(root, options) {
+    const name = options.name ?? options.target;
+    const step = options.step ?? '';
+    await createGithubStatus(name, step);
+    const mode = process.env.GITHUB_EVENT_NAME === 'push' && process.env.GITHUB_REF_NAME === 'main' ? 'run-many' : 'affected';
+    const nxArgs = mode === 'run-many'
+        ? ['run-many', '-t', options.target, '--parallel=5']
+        : ['affected', '-t', options.target, '--parallel=5'];
+    const status = await runStatus('nx', nxArgs, root);
+    await updateGithubStatus(name, status === 0 ? 'success' : 'failure', step);
+    if (status !== 0) {
+        throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
+    }
+}
+export async function githubCiNxRunMany(root, options) {
+    const nxArgs = ['run-many', '-t', options.targets, '--parallel=5'];
+    if (options.projects) {
+        nxArgs.push(`--projects=${options.projects}`);
+    }
+    await run('nx', nxArgs, root);
+}
+async function createGithubStatus(name, step) {
+    await postGithubStatus(name, 'pending', `Running ${name}...`, step);
+}
+async function updateGithubStatus(name, state, step) {
+    const suffix = state === 'success' ? 'passed' : state === 'failure' ? 'failed' : 'errored';
+    await postGithubStatus(name, state, `${name} ${suffix}`, step);
+}
+async function postGithubStatus(name, state, description, step) {
+    const repository = process.env.GITHUB_REPOSITORY;
+    const sha = process.env.GITHUB_SHA;
+    if (!repository || !sha) {
+        return;
+    }
+    const targetUrl = await getGithubStepUrl(step);
+    const args = [
+        'api',
+        '--method',
+        'POST',
+        '-H',
+        'Accept: application/vnd.github+json',
+        `/repos/${repository}/statuses/${sha}`,
+        '-f',
+        `state=${state}`,
+        '-f',
+        `context=${name}`,
+        '-f',
+        `description=${description}`,
+    ];
+    if (targetUrl) {
+        args.push('-f', `target_url=${targetUrl}`);
+    }
+    await run('gh', args, process.cwd());
+}
+async function getGithubStepUrl(step) {
+    const repository = process.env.GITHUB_REPOSITORY;
+    const runId = process.env.GITHUB_RUN_ID;
+    const job = process.env.GITHUB_JOB;
+    if (!repository || !runId || !job) {
+        return null;
+    }
+    const result = await $ `gh api -H ${'Accept: application/vnd.github+json'} ${`/repos/${repository}/actions/runs/${runId}/jobs`} --jq ${`.jobs[] | select(.name == "${job}") | .id`}`
+        .quiet()
+        .nothrow();
+    const jobId = decode(result.stdout).trim();
+    if (!jobId) {
+        return `https://github.com/${repository}/actions/runs/${runId}`;
+    }
+    return step
+        ? `https://github.com/${repository}/actions/runs/${runId}/job/${jobId}#step:${step}:1`
+        : `https://github.com/${repository}/actions/runs/${runId}/job/${jobId}`;
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { runCli } from './cli.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1 @@
+export { runCli } from './cli.js';

package/dist/lib/json.d.ts

@@ -0,0 +1,13 @@
+import { hasOwn, hasOwnString, isRecord } from '@smoothbricks/validation';
+export { hasOwn, hasOwnString, isRecord };
+export declare function stringProperty(record: Record<string, unknown>, key: string): string | null;
+export declare function recordProperty(record: Record<string, unknown>, key: string): Record<string, unknown> | null;
+export declare function getOrCreateRecord(record: Record<string, unknown>, key: string): Record<string, unknown>;
+export declare function setStringProperty(record: Record<string, unknown>, key: string, value: string): boolean;
+export declare function setMissingStringProperty(record: Record<string, unknown>, key: string, value: string): boolean;
+export declare function requiredJsonObject(path: string): Record<string, unknown>;
+export declare function readJsonObject(path: string): Record<string, unknown> | null;
+export declare function writeJsonObject(path: string, value: Record<string, unknown>): void;
+export declare function jsonObjectText(value: Record<string, unknown>): string;
+export declare function readJson(path: string): unknown;
+//# sourceMappingURL=json.d.ts.map

package/dist/lib/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/lib/json.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAE1C,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1F;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAG3G;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQvG;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMtG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM7G;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMxE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAG3E;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAElF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9C"}