@smoothbricks/cli 0.1.0 → 0.1.1

package/dist/release/npm-auth.d.ts

@@ -0,0 +1,17 @@
+import type { ReleasePackageInfo } from './core.js';
+export interface NpmPublishAuthFailureOptions {
+    useBootstrapToken: boolean;
+    tokenPresent: boolean;
+    repository?: string;
+}
+export interface NpmPublishDiagnosticShell {
+    publish(): Promise<void>;
+    versionExists(): Promise<boolean>;
+    log(message: string): void;
+    error(message: string): void;
+    appendSummary(markdown: string): Promise<void>;
+}
+export declare function publishWithAuthDiagnostics(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>, shell: NpmPublishDiagnosticShell, options: NpmPublishAuthFailureOptions): Promise<void>;
+export declare function npmPublishAuthFailureMessage(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>, options: NpmPublishAuthFailureOptions): string;
+export declare function npmPublishAuthFailureMarkdown(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>, options: NpmPublishAuthFailureOptions): string;
+//# sourceMappingURL=npm-auth.d.ts.map

package/dist/release/npm-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-auth.d.ts","sourceRoot":"","sources":["../../src/release/npm-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAuCR;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAgCR"}

package/dist/release/npm-auth.js

@@ -0,0 +1,51 @@
+export async function publishWithAuthDiagnostics(pkg, shell, options) {
+    try {
+        await shell.publish();
+    }
+    catch (error) {
+        const packageVersion = `${pkg.name}@${pkg.version}`;
+        if (await shell.versionExists()) {
+            shell.log(`${packageVersion}: publish result already visible on npm; continuing.`);
+            return;
+        }
+        shell.error(npmPublishAuthFailureMessage(pkg, options));
+        await shell.appendSummary(npmPublishAuthFailureMarkdown(pkg, options));
+        throw new Error(`${packageVersion}: npm publish authentication failed. Run smoo release trust-publisher after the package exists on npm; see the warning banner above for details.`, { cause: error });
+    }
+}
+export function npmPublishAuthFailureMessage(pkg, options) {
+    const packageVersion = `${pkg.name}@${pkg.version}`;
+    const lines = [
+        `::error title=npm publish authentication failed::${packageVersion} could not be published. This usually means npm trusted publishing is not configured for this package/workflow/repo, or the bootstrap NPM_TOKEN is missing/invalid.`,
+        '',
+        `🚨 npm publish authentication failed for ${packageVersion}`,
+        '',
+    ];
+    if (options.useBootstrapToken) {
+        lines.push('smoo expected a temporary npm automation token because this package does not exist on npm yet.', options.tokenPresent
+            ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
+            : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set. Add a temporary NPM_TOKEN repository secret and rerun the Publish workflow.', '', 'After the first successful publish, run:', '  smoo release trust-publisher', '', 'Then remove the temporary bootstrap token path for future releases.');
+        return lines.join('\n');
+    }
+    lines.push('smoo expected npm trusted publishing/OIDC because this package already exists on npm.', options.tokenPresent
+        ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
+        : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '1. Run locally: smoo release trust-publisher', '2. Ensure the npm trusted publisher uses:', `   repository: ${trustedPublisherRepository(options)}`, '   workflow: publish.yml', '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, add a temporary NPM_TOKEN repository secret, publish once, then run smoo release trust-publisher.');
+    return lines.join('\n');
+}
+export function npmPublishAuthFailureMarkdown(pkg, options) {
+    const packageVersion = `${pkg.name}@${pkg.version}`;
+    const lines = ['## 🚨 npm Publish Authentication Failed', '', `Package: \`${packageVersion}\``, ''];
+    if (options.useBootstrapToken) {
+        lines.push('smoo expected a temporary npm automation token because this package does not exist on npm yet.', '', options.tokenPresent
+            ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
+            : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set. Add a temporary `NPM_TOKEN` repository secret and rerun the Publish workflow.', '', 'After the first successful publish, run `smoo release trust-publisher`, then remove the temporary bootstrap token path for future releases.');
+        return lines.join('\n');
+    }
+    lines.push('smoo expected npm trusted publishing/OIDC because this package already exists on npm.', '', options.tokenPresent
+        ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
+        : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '', '1. Run locally: `smoo release trust-publisher`', `2. Ensure the npm trusted publisher uses repository \`${trustedPublisherRepository(options)}\` and workflow \`publish.yml\``, '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, add a temporary `NPM_TOKEN` repository secret, publish once, then run `smoo release trust-publisher`.');
+    return lines.join('\n');
+}
+function trustedPublisherRepository(options) {
+    return options.repository ?? 'the current GitHub repository';
+}

package/dist/release/orchestration.d.ts

@@ -0,0 +1,48 @@
+import type { ReleasePackageInfo, ReleaseTarget } from './core.js';
+export type ReleaseVersionMode = 'new' | 'none';
+export interface ReleaseSummary<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    sha: string;
+    dryRun: boolean;
+    packages: Package[];
+    pushed: boolean;
+    published: Package[];
+    alreadyPublished: Package[];
+    githubReleases: Package[];
+    rerunRequired: boolean;
+    noRelease: boolean;
+}
+export interface ReleaseCompletionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    gitHead(): Promise<string>;
+    pushReleaseRefs(packages: Package[]): Promise<boolean>;
+    listNpmMissingPackages(packages: Package[]): Promise<Package[]>;
+    buildReleaseCandidate(packages: Package[]): Promise<void>;
+    publishPackage(pkg: Package, distTag: string, dryRun: boolean): Promise<void>;
+    listGithubMissingPackages(packages: Package[]): Promise<Package[]>;
+    createGithubRelease(pkg: Package, dryRun: boolean): Promise<void>;
+}
+export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo> extends ReleaseCompletionShell<Package> {
+    checkout(ref: string): Promise<void>;
+    withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
+    beforeRepairTarget?(target: ReleaseTarget<Package>): void;
+    afterRepairTarget?(target: ReleaseTarget<Package>): void;
+}
+export interface ReleaseVersionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    releasePackagesAtHead(): Promise<Package[]>;
+    ensureLocalReleaseTags(packages: Package[]): Promise<void>;
+    gitHead(): Promise<string>;
+    runNxReleaseVersion(bump: string, dryRun: boolean): Promise<void>;
+    assertCleanGitTree(): Promise<void>;
+}
+export interface ReleaseVersionResult<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    mode: ReleaseVersionMode;
+    packages: Package[];
+    status: 'already-release-target' | 'dry-run' | 'new-release' | 'no-release-needed';
+}
+export declare function runReleaseVersion<Package extends ReleasePackageInfo>(shell: ReleaseVersionShell<Package>, options: {
+    bump: string;
+    dryRun: boolean;
+}): Promise<ReleaseVersionResult<Package>>;
+export declare function completeReleaseAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, packages: Package[], dryRun: boolean, rerunRequired: boolean): Promise<ReleaseSummary<Package>>;
+export declare function repairPendingTargets<Package extends ReleasePackageInfo>(shell: ReleaseRepairShell<Package>, targets: Array<ReleaseTarget<Package>>, restoreRef: string, dryRun: boolean): Promise<Array<ReleaseSummary<Package>>>;
+export declare function completeRepairTargetAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, target: ReleaseTarget<Package>, dryRun: boolean): Promise<ReleaseSummary<Package>>;
+//# sourceMappingURL=orchestration.d.ts.map

package/dist/release/orchestration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAgCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAmBzC;AAED,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}

package/dist/release/orchestration.js

@@ -0,0 +1,105 @@
+import { planPublishActions } from './publish-plan.js';
+export async function runReleaseVersion(shell, options) {
+    if (!options.dryRun) {
+        const localRelease = await shell.releasePackagesAtHead();
+        if (localRelease.length > 0) {
+            await shell.ensureLocalReleaseTags(localRelease);
+            return { mode: 'none', packages: localRelease, status: 'already-release-target' };
+        }
+    }
+    const headBeforeVersioning = await shell.gitHead();
+    await shell.runNxReleaseVersion(options.bump, options.dryRun);
+    if (options.dryRun) {
+        return { mode: 'none', packages: [], status: 'dry-run' };
+    }
+    await shell.assertCleanGitTree();
+    const headAfterVersioning = await shell.gitHead();
+    const releasedPackages = await shell.releasePackagesAtHead();
+    await shell.ensureLocalReleaseTags(releasedPackages);
+    if (headAfterVersioning === headBeforeVersioning) {
+        if (releasedPackages.length > 0) {
+            return { mode: 'none', packages: releasedPackages, status: 'already-release-target' };
+        }
+        if (options.bump !== 'auto') {
+            throw new Error(`Nx did not create a release commit for forced --bump ${options.bump}.`);
+        }
+        return { mode: 'none', packages: [], status: 'no-release-needed' };
+    }
+    if (releasedPackages.length === 0) {
+        throw new Error('Nx created a release commit without current package release tags at HEAD.');
+    }
+    return { mode: 'new', packages: releasedPackages, status: 'new-release' };
+}
+export async function completeReleaseAtHead(shell, packages, dryRun, rerunRequired) {
+    const npmMissingPackages = await shell.listNpmMissingPackages(packages);
+    const githubMissingPackages = dryRun ? packages : await shell.listGithubMissingPackages(packages);
+    return completePlannedRelease(shell, {
+        sha: await shell.gitHead(),
+        dryRun,
+        packages,
+        pushed: dryRun ? false : await shell.pushReleaseRefs(packages),
+        npmMissingPackages,
+        githubMissingPackages,
+        rerunRequired,
+    });
+}
+export async function repairPendingTargets(shell, targets, restoreRef, dryRun) {
+    const summaries = [];
+    try {
+        for (const target of targets) {
+            await shell.checkout(target.sha);
+            if (target.packages.length === 0) {
+                throw new Error(`Release commit ${target.sha} has no release packages after checkout.`);
+            }
+            shell.beforeRepairTarget?.(target);
+            try {
+                summaries.push(await shell.withDevenvEnv(() => completeRepairTargetAtHead(shell, target, dryRun)));
+            }
+            finally {
+                shell.afterRepairTarget?.(target);
+            }
+        }
+    }
+    finally {
+        await shell.checkout(restoreRef);
+    }
+    return summaries;
+}
+export async function completeRepairTargetAtHead(shell, target, dryRun) {
+    return completePlannedRelease(shell, {
+        sha: await shell.gitHead(),
+        dryRun,
+        packages: target.packages,
+        pushed: dryRun ? false : await shell.pushReleaseRefs(target.packages),
+        npmMissingPackages: target.npmPackages,
+        githubMissingPackages: target.githubPackages,
+        rerunRequired: false,
+    });
+}
+async function completePlannedRelease(shell, input) {
+    const plan = planPublishActions({
+        releasePackages: input.packages,
+        npmMissingPackages: input.npmMissingPackages,
+        githubMissingPackages: input.githubMissingPackages,
+    });
+    if (plan.buildProjects.length > 0) {
+        await shell.buildReleaseCandidate(plan.publishPackages.map((action) => action.pkg));
+    }
+    for (const { pkg, distTag } of plan.publishPackages) {
+        await shell.publishPackage(pkg, distTag, input.dryRun);
+    }
+    for (const pkg of plan.githubReleasePackages) {
+        await shell.createGithubRelease(pkg, input.dryRun);
+    }
+    return {
+        sha: input.sha,
+        dryRun: input.dryRun,
+        packages: input.packages,
+        pushed: input.pushed,
+        published: input.dryRun ? [] : plan.publishPackages.map((action) => action.pkg),
+        alreadyPublished: input.packages.filter((pkg) => !input.npmMissingPackages.includes(pkg)),
+        githubReleases: input.dryRun ? [] : plan.githubReleasePackages,
+        rerunRequired: input.rerunRequired,
+        noRelease: false,
+    };
+}

package/dist/release/publish-plan.d.ts

@@ -0,0 +1,17 @@
+import { type ReleasePackageInfo } from './core.js';
+export interface PublishPackageAction<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    pkg: Package;
+    distTag: string;
+}
+export interface PublishPlan<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    buildProjects: string[];
+    publishPackages: Array<PublishPackageAction<Package>>;
+    githubReleasePackages: Package[];
+}
+export interface PublishPlanInput<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    releasePackages: Package[];
+    npmMissingPackages: Package[];
+    githubMissingPackages: Package[];
+}
+export declare function planPublishActions<Package extends ReleasePackageInfo>(input: PublishPlanInput<Package>): PublishPlan<Package>;
+//# sourceMappingURL=publish-plan.d.ts.map

package/dist/release/publish-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-plan.d.ts","sourceRoot":"","sources":["../../src/release/publish-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE1E,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAClF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,qBAAqB,EAAE,OAAO,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACvF,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3B,kBAAkB,EAAE,OAAO,EAAE,CAAC;IAC9B,qBAAqB,EAAE,OAAO,EAAE,CAAC;CAClC;AAED,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,EACnE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAC/B,WAAW,CAAC,OAAO,CAAC,CAWtB"}

package/dist/release/publish-plan.js

@@ -0,0 +1,15 @@
+import { npmDistTagForVersion } from './core.js';
+export function planPublishActions(input) {
+    const npmMissingNames = packageNameSet(input.npmMissingPackages);
+    const githubMissingNames = packageNameSet(input.githubMissingPackages);
+    const npmPackages = input.releasePackages.filter((pkg) => npmMissingNames.has(pkg.name));
+    const githubReleasePackages = input.releasePackages.filter((pkg) => githubMissingNames.has(pkg.name));
+    return {
+        buildProjects: npmPackages.map((pkg) => pkg.name),
+        publishPackages: npmPackages.map((pkg) => ({ pkg, distTag: npmDistTagForVersion(pkg.version) })),
+        githubReleasePackages,
+    };
+}
+function packageNameSet(packages) {
+    return new Set(packages.map((pkg) => pkg.name));
+}

package/dist/release/retag-unpublished.d.ts

@@ -0,0 +1,34 @@
+import { type ReleasePackageInfo } from './core.js';
+export interface RetagUnpublishedOptions {
+    tags: string[];
+    toRef: string;
+    push: boolean;
+    dispatch: boolean;
+    dryRun: boolean;
+    branch: string;
+    workflow: string;
+}
+export interface RetagUnpublishedTagUpdate<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    tag: string;
+    pkg: Package;
+    expectedRemoteObject: string | null;
+}
+export interface RetagUnpublishedShell<Package extends Omit<ReleasePackageInfo, 'version'> = ReleasePackageInfo> {
+    listReleasePackages(): Package[];
+    resolveRef(ref: string): Promise<string>;
+    resolveDispatchRef(branch: string): Promise<string | null>;
+    packageVersionAtRef(packagePath: string, ref: string): Promise<string | null>;
+    npmVersionExists(name: string, version: string): Promise<boolean>;
+    githubReleaseExists(tag: string): Promise<boolean>;
+    remoteTagObject(tag: string): Promise<string | null>;
+    createOrMoveTag(tag: string, ref: string): Promise<void>;
+    pushTags(updates: Array<RetagUnpublishedTagUpdate<Package & {
+        version: string;
+    }>>): Promise<void>;
+    dispatchPublishWorkflow(workflow: string, branch: string): Promise<void>;
+    log(message: string): void;
+}
+export declare function retagUnpublished<Package extends Omit<ReleasePackageInfo, 'version'>>(shell: RetagUnpublishedShell<Package>, options: RetagUnpublishedOptions): Promise<Array<RetagUnpublishedTagUpdate<Package & {
+    version: string;
+}>>>;
+//# sourceMappingURL=retag-unpublished.d.ts.map

package/dist/release/retag-unpublished.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retag-unpublished.d.ts","sourceRoot":"","sources":["../../src/release/retag-unpublished.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,kBAAkB,EAAwB,MAAM,WAAW,CAAC;AAE1E,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAChG,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,CAAC;IACb,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB,CAAC,OAAO,SAAS,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,kBAAkB;IAC7G,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,yBAAyB,CAAC,OAAO,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CAAC,OAAO,SAAS,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,EACxF,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,EACrC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC,CA4E1E"}

package/dist/release/retag-unpublished.js

@@ -0,0 +1,77 @@
+import { releasePackageForTag } from './core.js';
+export async function retagUnpublished(shell, options) {
+    if (options.tags.length === 0) {
+        throw new Error('retag-unpublished requires at least one release tag.');
+    }
+    assertUniqueTags(options.tags);
+    const targetSha = await shell.resolveRef(options.toRef);
+    if (options.dispatch) {
+        const dispatchSha = await shell.resolveDispatchRef(options.branch);
+        if (!dispatchSha) {
+            throw new Error(`Cannot dispatch ${options.workflow}: remote branch ${options.branch} was not found.`);
+        }
+        if (dispatchSha !== targetSha) {
+            throw new Error(`Cannot dispatch ${options.workflow}: ${options.toRef} resolves to ${targetSha.slice(0, 12)}, but ${options.branch} resolves to ${dispatchSha.slice(0, 12)}. Push the branch first or choose a ref already at the remote branch HEAD.`);
+        }
+    }
+    const packages = shell.listReleasePackages();
+    const updates = [];
+    for (const tag of options.tags) {
+        const match = releasePackageForTag(packages, tag);
+        if (!match) {
+            throw new Error(`Release tag ${tag} does not match an owned release package.`);
+        }
+        const versionAtRef = await shell.packageVersionAtRef(match.pkg.path, options.toRef);
+        if (versionAtRef !== match.version) {
+            throw new Error(`Release tag ${tag} cannot move to ${options.toRef}: ${match.pkg.path}/package.json has version ${versionAtRef ?? 'missing'}, expected ${match.version}.`);
+        }
+        if (await shell.npmVersionExists(match.pkg.name, match.version)) {
+            throw new Error(`Cannot retag ${tag}: ${match.pkg.name}@${match.version} already exists on npm.`);
+        }
+        if (await shell.githubReleaseExists(tag)) {
+            throw new Error(`Cannot retag ${tag}: GitHub Release ${tag} already exists.`);
+        }
+        updates.push({
+            tag,
+            pkg: { ...match.pkg, version: match.version },
+            expectedRemoteObject: options.push ? await shell.remoteTagObject(tag) : null,
+        });
+    }
+    for (const update of updates) {
+        if (options.dryRun) {
+            shell.log(`Would move ${update.tag} to ${options.toRef} (${targetSha.slice(0, 12)}).`);
+        }
+        else {
+            await shell.createOrMoveTag(update.tag, options.toRef);
+            shell.log(`Moved ${update.tag} to ${options.toRef} (${targetSha.slice(0, 12)}).`);
+        }
+    }
+    if (options.push) {
+        if (options.dryRun) {
+            shell.log(`Would push ${updates.length} retagged release tag${updates.length === 1 ? '' : 's'}.`);
+        }
+        else {
+            await shell.pushTags(updates);
+            shell.log(`Pushed ${updates.length} retagged release tag${updates.length === 1 ? '' : 's'}.`);
+        }
+    }
+    if (options.dispatch) {
+        if (options.dryRun) {
+            shell.log(`Would dispatch ${options.workflow} on ${options.branch} with bump=auto.`);
+        }
+        else {
+            await shell.dispatchPublishWorkflow(options.workflow, options.branch);
+            shell.log(`Dispatched ${options.workflow} on ${options.branch} with bump=auto.`);
+        }
+    }
+    return updates;
+}
+function assertUniqueTags(tags) {
+    const seen = new Set();
+    for (const tag of tags) {
+        if (seen.has(tag)) {
+            throw new Error(`Release tag ${tag} was provided more than once.`);
+        }
+        seen.add(tag);
+    }
+}

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -10,10 +10,5 @@ set -e -o pipefail
 git-format-staged
 
 # Adding a workspace package is rare and easy to leave half-wired. Run the
-# full monorepo validator only for newly staged package manifests; --fail-fast
-# keeps pre-commit output focused on the first blocking setup issue.
-if ! git diff --cached --quiet --diff-filter=A -- \
-  'packages/*/package.json' \
-  'targets/*/package.json'; then
-  smoo monorepo validate --fail-fast
-fi
+# full monorepo validator only for newly staged package manifests.
+smoo monorepo validate --fail-fast --only-if-new-workspace-package

package/managed/templates/github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   push:
+    branches:
+      - '**'
   pull_request:
 
 permissions:

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
     "smoo": "./bin/smoo"
   },
+  "scripts": {
+    "test": "bun test"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -30,6 +33,11 @@
       "development": "./src/monorepo/git-config.ts",
       "import": "./dist/monorepo/git-config.js",
       "default": "./dist/monorepo/git-config.js"
+    },
+    "./nx-version-actions": {
+      "types": "./dist/nx-version-actions.d.cts",
+      "require": "./dist/nx-version-actions.cjs",
+      "default": "./dist/nx-version-actions.cjs"
     }
   },
   "files": [
@@ -42,15 +50,28 @@
   ],
   "dependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
-    "@smoothbricks/validation": "0.0.1",
+    "@smoothbricks/validation": "0.1.1",
     "commander": "^14.0.3",
     "publint": "^0.3.18",
     "sherif": "^1.11.1",
     "tslib": "^2.8.1"
   },
+  "devDependencies": {
+    "fast-check": "^4.4.0"
+  },
   "nx": {
     "targets": {
-      "lint": {}
+      "lint": {},
+      "typecheck-tests": {
+        "executor": "nx:run-commands",
+        "options": {
+          "command": "tsc --noEmit -p tsconfig.test.json",
+          "cwd": "packages/cli"
+        },
+        "dependsOn": [
+          "build"
+        ]
+      }
     },
     "tags": [
       "npm:public"

package/src/cli.ts

@@ -34,7 +34,8 @@ function buildProgram(): Command {
   monorepo
     .command('validate')
     .option('--fail-fast', 'stop after the first failing validation pack')
-    .action(async (options: { failFast?: boolean }) => {
+    .option('--only-if-new-workspace-package', 'skip validation unless a new workspace package manifest is staged')
+    .action(async (options: { failFast?: boolean; onlyIfNewWorkspacePackage?: boolean }) => {
       const { validateMonorepo } = await import('./monorepo/index.js');
       await validateMonorepo(await findRepoRoot(), options);
     });
@@ -58,54 +59,92 @@ function buildProgram(): Command {
     const { syncBunLockfileVersions } = await import('./monorepo/index.js');
     syncBunLockfileVersions(await findRepoRoot());
   });
-  monorepo.command('list-public-projects').action(async () => {
-    const { listPublicProjects } = await import('./monorepo/index.js');
-    console.log(listPublicProjects(await findRepoRoot()));
-  });
+  monorepo
+    .command('list-release-packages')
+    .option('--fail-empty', 'fail when no owned release packages are found')
+    .option('--github-output <path>', 'append projects=<packages> to a GitHub Actions output file')
+    .action(async (options: { failEmpty?: boolean; githubOutput?: string }) => {
+      const { listReleasePackagesForNx } = await import('./monorepo/index.js');
+      const packages = listReleasePackagesForNx(await findRepoRoot(), options);
+      if (!options.githubOutput) {
+        console.log(packages);
+      }
+    });
   monorepo.command('validate-public-tags').action(async () => {
     const { validatePublicPackageTags } = await import('./monorepo/index.js');
     validatePublicPackageTags(await findRepoRoot());
   });
-  monorepo.command('release-state').action(async () => {
+  const release = program.command('release').description('Version, publish, and create GitHub Releases');
+  release.command('npm-status').action(async () => {
     const { printReleaseState } = await import('./release/index.js');
     await printReleaseState(await findRepoRoot());
   });
-
-  const release = program.command('release').description('Version, publish, and create GitHub Releases');
+  release
+    .command('repair-pending')
+    .description('Repair incomplete older release commits before releasing the current HEAD')
+    .option('--dry-run [dryRun]', 'run without pushing, publishing, or writing GitHub Releases')
+    .action(async (options: { dryRun?: string | boolean }) => {
+      const { releaseRepairPending } = await import('./release/index.js');
+      await releaseRepairPending(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
+    });
   release
     .command('version')
     .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
-    .option('--dry-run [dryRun]', 'run without writing versions, tags, or pushes')
-    .action(async (options: { bump: string; dryRun?: string | boolean }) => {
+    .option('--dry-run [dryRun]', 'run without writing versions or tags')
+    .option('--github-output <path>', 'append mode=<mode> and projects=<packages> to a GitHub Actions output file')
+    .action(async (options: { bump: string; dryRun?: string | boolean; githubOutput?: string }) => {
       const { releaseVersion } = await import('./release/index.js');
-      await releaseVersion(await findRepoRoot(), { bump: options.bump, dryRun: booleanOption(options.dryRun) });
+      await releaseVersion(await findRepoRoot(), {
+        bump: options.bump,
+        dryRun: booleanOption(options.dryRun),
+        githubOutput: options.githubOutput,
+      });
     });
   release
     .command('publish')
     .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
-    .option('--tag <tag>', 'explicit npm dist-tag; must match bump-derived tag')
-    .option('--npm-tag <npmTag>', 'explicit npm dist-tag; must match bump-derived tag')
-    .option('--dry-run [dryRun]', 'run without publishing')
-    .action(async (options: { bump: string; tag?: string; npmTag?: string; dryRun?: string | boolean }) => {
+    .option('--dry-run [dryRun]', 'run without pushing, publishing, or writing GitHub Releases')
+    .action(async (options: { bump: string; dryRun?: string | boolean }) => {
       const { releasePublish } = await import('./release/index.js');
       await releasePublish(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
     });
   release
-    .command('github-release')
-    .option('--tags <tags>', 'space-separated release tags')
-    .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
-    .option('--tag <tag>', 'explicit npm dist-tag; must match bump-derived tag')
-    .option('--npm-tag <npmTag>', 'explicit npm dist-tag; must match bump-derived tag')
-    .option('--dry-run [dryRun]', 'skip GitHub Release writes')
+    .command('retag-unpublished')
+    .description('Move unpublished owned release tags to a later commit without bumping versions')
+    .argument('<tag...>', 'owned release tags to move, for example @scope/pkg@1.2.3')
+    .option('--to <ref>', 'commit or ref to move tags to', 'HEAD')
+    .option('--push', 'push moved tags with force-with-lease')
+    .option('--dispatch', 'push moved tags and start publish.yml with bump=auto')
+    .option('--remote <remote>', 'git remote used for pushed tags')
+    .option('--branch <branch>', 'branch used for publish workflow dispatch')
+    .option('--dry-run [dryRun]', 'validate and print the retag operation without mutating refs')
     .action(
-      async (options: { tags?: string; bump: string; tag?: string; npmTag?: string; dryRun?: string | boolean }) => {
-        const { releaseGithubRelease } = await import('./release/index.js');
-        await releaseGithubRelease(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
+      async (
+        tags: string[],
+        options: {
+          to?: string;
+          push?: boolean;
+          dispatch?: boolean;
+          remote?: string;
+          branch?: string;
+          dryRun?: string | boolean;
+        },
+      ) => {
+        const { releaseRetagUnpublished } = await import('./release/index.js');
+        await releaseRetagUnpublished(await findRepoRoot(), {
+          tags,
+          to: options.to,
+          push: options.push === true,
+          dispatch: options.dispatch === true,
+          remote: options.remote,
+          branch: options.branch,
+          dryRun: booleanOption(options.dryRun),
+        });
       },
     );
   release
     .command('trust-publisher')
-    .description('Configure npm trusted publishing for public packages')
+    .description('Configure npm trusted publishing for owned release packages')
     .option('--dry-run [dryRun]', 'show npm trust changes without saving them')
     .option('--otp <otp>', 'npm one-time password for trust operations')
     .option('--skip-login', 'skip npm browser login before configuring trust')

package/src/lib/devenv.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'bun:test';
+import { mergeDevenvEnv, parseNulEnv } from './devenv.js';
+
+describe('devenv environment loader', () => {
+  it('parses NUL-separated env output without splitting values on newlines or equals signs', () => {
+    const bytes = new TextEncoder().encode('SIMPLE=value\0MULTILINE=line 1\nline 2\0TOKEN=a=b=c\0');
+
+    expect(parseNulEnv(bytes)).toEqual({
+      SIMPLE: 'value',
+      MULTILINE: 'line 1\nline 2',
+      TOKEN: 'a=b=c',
+    });
+  });
+
+  it('merges devenv output over the existing environment instead of replacing it', () => {
+    expect(
+      mergeDevenvEnv(
+        { GH_TOKEN: 'existing-token', NODE_AUTH_TOKEN: 'npm-token', PATH: '/usr/bin' },
+        { DEVENV_ROOT: '/repo/tooling/direnv', PATH: '/nix/bin' },
+      ),
+    ).toEqual({
+      DEVENV_ROOT: '/repo/tooling/direnv',
+      GH_TOKEN: 'existing-token',
+      NODE_AUTH_TOKEN: 'npm-token',
+      PATH: '/nix/bin',
+    });
+  });
+});