@smoothbricks/cli 0.1.0 → 0.2.0

package/dist/release/npm-auth.d.ts

@@ -0,0 +1,16 @@
+import type { ReleasePackageInfo } from './core.js';
+export interface NpmPublishAuthFailureOptions {
+    tokenPresent: boolean;
+    repository?: string;
+}
+export interface NpmPublishDiagnosticShell {
+    publish(): Promise<void>;
+    versionExists(): Promise<boolean>;
+    log(message: string): void;
+    error(message: string): void;
+    appendSummary(markdown: string): Promise<void>;
+}
+export declare function publishWithAuthDiagnostics(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>, shell: NpmPublishDiagnosticShell, options: NpmPublishAuthFailureOptions): Promise<void>;
+export declare function npmPublishAuthFailureMessage(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>, options: NpmPublishAuthFailureOptions): string;
+export declare function npmPublishAuthFailureMarkdown(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>, options: NpmPublishAuthFailureOptions): string;
+//# sourceMappingURL=npm-auth.d.ts.map

package/dist/release/npm-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-auth.d.ts","sourceRoot":"","sources":["../../src/release/npm-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAwBR;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAmBR"}

package/dist/release/npm-auth.js

@@ -0,0 +1,39 @@
+export async function publishWithAuthDiagnostics(pkg, shell, options) {
+    try {
+        await shell.publish();
+    }
+    catch (error) {
+        const packageVersion = `${pkg.name}@${pkg.version}`;
+        if (await shell.versionExists()) {
+            shell.log(`${packageVersion}: publish result already visible on npm; continuing.`);
+            return;
+        }
+        shell.error(npmPublishAuthFailureMessage(pkg, options));
+        await shell.appendSummary(npmPublishAuthFailureMarkdown(pkg, options));
+        throw new Error(`${packageVersion}: npm publish authentication failed. Run smoo release trust-publisher; see the warning banner above for details.`, { cause: error });
+    }
+}
+export function npmPublishAuthFailureMessage(pkg, options) {
+    const packageVersion = `${pkg.name}@${pkg.version}`;
+    const lines = [
+        `::error title=npm publish authentication failed::${packageVersion} could not be published. This usually means npm trusted publishing is not configured for this package/workflow/repo.`,
+        '',
+        `🚨 npm publish authentication failed for ${packageVersion}`,
+        '',
+    ];
+    lines.push('smoo expected npm trusted publishing/OIDC because this package already exists on npm.', options.tokenPresent
+        ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
+        : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '1. Run locally: smoo release trust-publisher', '2. Ensure the npm trusted publisher uses:', `   repository: ${trustedPublisherRepository(options)}`, '   workflow: publish.yml', '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, run locally: smoo release trust-publisher --bootstrap.');
+    return lines.join('\n');
+}
+export function npmPublishAuthFailureMarkdown(pkg, options) {
+    const packageVersion = `${pkg.name}@${pkg.version}`;
+    const lines = ['## 🚨 npm Publish Authentication Failed', '', `Package: \`${packageVersion}\``, ''];
+    lines.push('smoo expected npm trusted publishing/OIDC because this package already exists on npm.', '', options.tokenPresent
+        ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
+        : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '', '1. Run locally: `smoo release trust-publisher`', `2. Ensure the npm trusted publisher uses repository \`${trustedPublisherRepository(options)}\` and workflow \`publish.yml\``, '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, run `smoo release trust-publisher --bootstrap` locally.');
+    return lines.join('\n');
+}
+function trustedPublisherRepository(options) {
+    return options.repository ?? 'the current GitHub repository';
+}

package/dist/release/orchestration.d.ts

@@ -0,0 +1,49 @@
+import type { ReleasePackageInfo, ReleaseTarget } from './core.js';
+export type ReleaseVersionMode = 'new' | 'none';
+export interface ReleaseSummary<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    sha: string;
+    dryRun: boolean;
+    packages: Package[];
+    pushed: boolean;
+    published: Package[];
+    alreadyPublished: Package[];
+    githubReleases: Package[];
+    rerunRequired: boolean;
+    noRelease: boolean;
+}
+export interface ReleaseCompletionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    gitHead(): Promise<string>;
+    pushReleaseRefs(packages: Package[]): Promise<boolean>;
+    listNpmMissingPackages(packages: Package[]): Promise<Package[]>;
+    buildReleaseCandidate(packages: Package[]): Promise<void>;
+    publishPackage(pkg: Package, distTag: string, dryRun: boolean): Promise<void>;
+    listGithubMissingPackages(packages: Package[]): Promise<Package[]>;
+    createGithubRelease(pkg: Package, dryRun: boolean): Promise<void>;
+}
+export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo> extends ReleaseCompletionShell<Package> {
+    checkout(ref: string): Promise<void>;
+    withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
+    beforeRepairTarget?(target: ReleaseTarget<Package>): void;
+    afterRepairTarget?(target: ReleaseTarget<Package>): void;
+}
+export interface ReleaseVersionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    releasePackagesAtHead(): Promise<Package[]>;
+    releaseVersionPackages(bump: string): Promise<Package[]>;
+    ensureLocalReleaseTags(packages: Package[]): Promise<void>;
+    gitHead(): Promise<string>;
+    runNxReleaseVersion(packages: Package[], bump: string, dryRun: boolean): Promise<void>;
+    assertCleanGitTree(): Promise<void>;
+}
+export interface ReleaseVersionResult<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    mode: ReleaseVersionMode;
+    packages: Package[];
+    status: 'already-release-target' | 'dry-run' | 'new-release' | 'no-release-needed';
+}
+export declare function runReleaseVersion<Package extends ReleasePackageInfo>(shell: ReleaseVersionShell<Package>, options: {
+    bump: string;
+    dryRun: boolean;
+}): Promise<ReleaseVersionResult<Package>>;
+export declare function completeReleaseAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, packages: Package[], dryRun: boolean, rerunRequired: boolean): Promise<ReleaseSummary<Package>>;
+export declare function repairPendingTargets<Package extends ReleasePackageInfo>(shell: ReleaseRepairShell<Package>, targets: Array<ReleaseTarget<Package>>, restoreRef: string, dryRun: boolean): Promise<Array<ReleaseSummary<Package>>>;
+export declare function completeRepairTargetAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, target: ReleaseTarget<Package>, dryRun: boolean): Promise<ReleaseSummary<Package>>;
+//# sourceMappingURL=orchestration.d.ts.map

package/dist/release/orchestration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAyCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAmBzC;AAED,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}

package/dist/release/orchestration.js

@@ -0,0 +1,113 @@
+import { planPublishActions } from './publish-plan.js';
+export async function runReleaseVersion(shell, options) {
+    if (!options.dryRun) {
+        const localRelease = await shell.releasePackagesAtHead();
+        if (localRelease.length > 0) {
+            await shell.ensureLocalReleaseTags(localRelease);
+            return { mode: 'none', packages: localRelease, status: 'already-release-target' };
+        }
+    }
+    const versionPackages = await shell.releaseVersionPackages(options.bump);
+    if (versionPackages.length === 0) {
+        if (options.bump !== 'auto') {
+            // invariant throw: the CLI resolves forced bumps from the full owned release package set.
+            throw new Error(`No release packages were selected for forced --bump ${options.bump}.`);
+        }
+        return { mode: 'none', packages: [], status: 'no-release-needed' };
+    }
+    const headBeforeVersioning = await shell.gitHead();
+    await shell.runNxReleaseVersion(versionPackages, options.bump, options.dryRun);
+    if (options.dryRun) {
+        return { mode: 'none', packages: [], status: 'dry-run' };
+    }
+    await shell.assertCleanGitTree();
+    const headAfterVersioning = await shell.gitHead();
+    const releasedPackages = await shell.releasePackagesAtHead();
+    await shell.ensureLocalReleaseTags(releasedPackages);
+    if (headAfterVersioning === headBeforeVersioning) {
+        if (releasedPackages.length > 0) {
+            return { mode: 'none', packages: releasedPackages, status: 'already-release-target' };
+        }
+        if (options.bump !== 'auto') {
+            throw new Error(`Nx did not create a release commit for forced --bump ${options.bump}.`);
+        }
+        return { mode: 'none', packages: [], status: 'no-release-needed' };
+    }
+    if (releasedPackages.length === 0) {
+        throw new Error('Nx created a release commit without current package release tags at HEAD.');
+    }
+    return { mode: 'new', packages: releasedPackages, status: 'new-release' };
+}
+export async function completeReleaseAtHead(shell, packages, dryRun, rerunRequired) {
+    const npmMissingPackages = await shell.listNpmMissingPackages(packages);
+    const githubMissingPackages = dryRun ? packages : await shell.listGithubMissingPackages(packages);
+    return completePlannedRelease(shell, {
+        sha: await shell.gitHead(),
+        dryRun,
+        packages,
+        pushed: dryRun ? false : await shell.pushReleaseRefs(packages),
+        npmMissingPackages,
+        githubMissingPackages,
+        rerunRequired,
+    });
+}
+export async function repairPendingTargets(shell, targets, restoreRef, dryRun) {
+    const summaries = [];
+    try {
+        for (const target of targets) {
+            await shell.checkout(target.sha);
+            if (target.packages.length === 0) {
+                throw new Error(`Release commit ${target.sha} has no release packages after checkout.`);
+            }
+            shell.beforeRepairTarget?.(target);
+            try {
+                summaries.push(await shell.withDevenvEnv(() => completeRepairTargetAtHead(shell, target, dryRun)));
+            }
+            finally {
+                shell.afterRepairTarget?.(target);
+            }
+        }
+    }
+    finally {
+        await shell.checkout(restoreRef);
+    }
+    return summaries;
+}
+export async function completeRepairTargetAtHead(shell, target, dryRun) {
+    return completePlannedRelease(shell, {
+        sha: await shell.gitHead(),
+        dryRun,
+        packages: target.packages,
+        pushed: dryRun ? false : await shell.pushReleaseRefs(target.packages),
+        npmMissingPackages: target.npmPackages,
+        githubMissingPackages: target.githubPackages,
+        rerunRequired: false,
+    });
+}
+async function completePlannedRelease(shell, input) {
+    const plan = planPublishActions({
+        releasePackages: input.packages,
+        npmMissingPackages: input.npmMissingPackages,
+        githubMissingPackages: input.githubMissingPackages,
+    });
+    if (plan.buildProjects.length > 0) {
+        await shell.buildReleaseCandidate(plan.publishPackages.map((action) => action.pkg));
+    }
+    for (const { pkg, distTag } of plan.publishPackages) {
+        await shell.publishPackage(pkg, distTag, input.dryRun);
+    }
+    for (const pkg of plan.githubReleasePackages) {
+        await shell.createGithubRelease(pkg, input.dryRun);
+    }
+    return {
+        sha: input.sha,
+        dryRun: input.dryRun,
+        packages: input.packages,
+        pushed: input.pushed,
+        published: input.dryRun ? [] : plan.publishPackages.map((action) => action.pkg),
+        alreadyPublished: input.packages.filter((pkg) => !input.npmMissingPackages.includes(pkg)),
+        githubReleases: input.dryRun ? [] : plan.githubReleasePackages,
+        rerunRequired: input.rerunRequired,
+        noRelease: false,
+    };
+}

package/dist/release/publish-plan.d.ts

@@ -0,0 +1,17 @@
+import { type ReleasePackageInfo } from './core.js';
+export interface PublishPackageAction<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    pkg: Package;
+    distTag: string;
+}
+export interface PublishPlan<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    buildProjects: string[];
+    publishPackages: Array<PublishPackageAction<Package>>;
+    githubReleasePackages: Package[];
+}
+export interface PublishPlanInput<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    releasePackages: Package[];
+    npmMissingPackages: Package[];
+    githubMissingPackages: Package[];
+}
+export declare function planPublishActions<Package extends ReleasePackageInfo>(input: PublishPlanInput<Package>): PublishPlan<Package>;
+//# sourceMappingURL=publish-plan.d.ts.map

package/dist/release/publish-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-plan.d.ts","sourceRoot":"","sources":["../../src/release/publish-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE1E,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAClF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,qBAAqB,EAAE,OAAO,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACvF,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3B,kBAAkB,EAAE,OAAO,EAAE,CAAC;IAC9B,qBAAqB,EAAE,OAAO,EAAE,CAAC;CAClC;AAED,wBAAgB,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,EACnE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAC/B,WAAW,CAAC,OAAO,CAAC,CAWtB"}

package/dist/release/publish-plan.js

@@ -0,0 +1,15 @@
+import { npmDistTagForVersion } from './core.js';
+export function planPublishActions(input) {
+    const npmMissingNames = packageNameSet(input.npmMissingPackages);
+    const githubMissingNames = packageNameSet(input.githubMissingPackages);
+    const npmPackages = input.releasePackages.filter((pkg) => npmMissingNames.has(pkg.name));
+    const githubReleasePackages = input.releasePackages.filter((pkg) => githubMissingNames.has(pkg.name));
+    return {
+        buildProjects: npmPackages.map((pkg) => pkg.projectName),
+        publishPackages: npmPackages.map((pkg) => ({ pkg, distTag: npmDistTagForVersion(pkg.version) })),
+        githubReleasePackages,
+    };
+}
+function packageNameSet(packages) {
+    return new Set(packages.map((pkg) => pkg.name));
+}

package/dist/release/retag-unpublished.d.ts

@@ -0,0 +1,34 @@
+import { type ReleasePackageInfo } from './core.js';
+export interface RetagUnpublishedOptions {
+    tags: string[];
+    toRef: string;
+    push: boolean;
+    dispatch: boolean;
+    dryRun: boolean;
+    branch: string;
+    workflow: string;
+}
+export interface RetagUnpublishedTagUpdate<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    tag: string;
+    pkg: Package;
+    expectedRemoteObject: string | null;
+}
+export interface RetagUnpublishedShell<Package extends Omit<ReleasePackageInfo, 'version'> = ReleasePackageInfo> {
+    listReleasePackages(): Package[];
+    resolveRef(ref: string): Promise<string>;
+    resolveDispatchRef(branch: string): Promise<string | null>;
+    packageVersionAtRef(packagePath: string, ref: string): Promise<string | null>;
+    npmVersionExists(name: string, version: string): Promise<boolean>;
+    githubReleaseExists(tag: string): Promise<boolean>;
+    remoteTagObject(tag: string): Promise<string | null>;
+    createOrMoveTag(tag: string, ref: string): Promise<void>;
+    pushTags(updates: Array<RetagUnpublishedTagUpdate<Package & {
+        version: string;
+    }>>): Promise<void>;
+    dispatchPublishWorkflow(workflow: string, branch: string): Promise<void>;
+    log(message: string): void;
+}
+export declare function retagUnpublished<Package extends Omit<ReleasePackageInfo, 'version'>>(shell: RetagUnpublishedShell<Package>, options: RetagUnpublishedOptions): Promise<Array<RetagUnpublishedTagUpdate<Package & {
+    version: string;
+}>>>;
+//# sourceMappingURL=retag-unpublished.d.ts.map

package/dist/release/retag-unpublished.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retag-unpublished.d.ts","sourceRoot":"","sources":["../../src/release/retag-unpublished.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,kBAAkB,EAAwB,MAAM,WAAW,CAAC;AAE1E,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAChG,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,CAAC;IACb,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB,CAAC,OAAO,SAAS,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,kBAAkB;IAC7G,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,yBAAyB,CAAC,OAAO,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CAAC,OAAO,SAAS,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,EACxF,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,EACrC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC,CA4E1E"}

package/dist/release/retag-unpublished.js

@@ -0,0 +1,77 @@
+import { releasePackageForTag } from './core.js';
+export async function retagUnpublished(shell, options) {
+    if (options.tags.length === 0) {
+        throw new Error('retag-unpublished requires at least one release tag.');
+    }
+    assertUniqueTags(options.tags);
+    const targetSha = await shell.resolveRef(options.toRef);
+    if (options.dispatch) {
+        const dispatchSha = await shell.resolveDispatchRef(options.branch);
+        if (!dispatchSha) {
+            throw new Error(`Cannot dispatch ${options.workflow}: remote branch ${options.branch} was not found.`);
+        }
+        if (dispatchSha !== targetSha) {
+            throw new Error(`Cannot dispatch ${options.workflow}: ${options.toRef} resolves to ${targetSha.slice(0, 12)}, but ${options.branch} resolves to ${dispatchSha.slice(0, 12)}. Push the branch first or choose a ref already at the remote branch HEAD.`);
+        }
+    }
+    const packages = shell.listReleasePackages();
+    const updates = [];
+    for (const tag of options.tags) {
+        const match = releasePackageForTag(packages, tag);
+        if (!match) {
+            throw new Error(`Release tag ${tag} does not match an owned release package.`);
+        }
+        const versionAtRef = await shell.packageVersionAtRef(match.pkg.path, options.toRef);
+        if (versionAtRef !== match.version) {
+            throw new Error(`Release tag ${tag} cannot move to ${options.toRef}: ${match.pkg.path}/package.json has version ${versionAtRef ?? 'missing'}, expected ${match.version}.`);
+        }
+        if (await shell.npmVersionExists(match.pkg.name, match.version)) {
+            throw new Error(`Cannot retag ${tag}: ${match.pkg.name}@${match.version} already exists on npm.`);
+        }
+        if (await shell.githubReleaseExists(tag)) {
+            throw new Error(`Cannot retag ${tag}: GitHub Release ${tag} already exists.`);
+        }
+        updates.push({
+            tag,
+            pkg: { ...match.pkg, version: match.version },
+            expectedRemoteObject: options.push ? await shell.remoteTagObject(tag) : null,
+        });
+    }
+    for (const update of updates) {
+        if (options.dryRun) {
+            shell.log(`Would move ${update.tag} to ${options.toRef} (${targetSha.slice(0, 12)}).`);
+        }
+        else {
+            await shell.createOrMoveTag(update.tag, options.toRef);
+            shell.log(`Moved ${update.tag} to ${options.toRef} (${targetSha.slice(0, 12)}).`);
+        }
+    }
+    if (options.push) {
+        if (options.dryRun) {
+            shell.log(`Would push ${updates.length} retagged release tag${updates.length === 1 ? '' : 's'}.`);
+        }
+        else {
+            await shell.pushTags(updates);
+            shell.log(`Pushed ${updates.length} retagged release tag${updates.length === 1 ? '' : 's'}.`);
+        }
+    }
+    if (options.dispatch) {
+        if (options.dryRun) {
+            shell.log(`Would dispatch ${options.workflow} on ${options.branch} with bump=auto.`);
+        }
+        else {
+            await shell.dispatchPublishWorkflow(options.workflow, options.branch);
+            shell.log(`Dispatched ${options.workflow} on ${options.branch} with bump=auto.`);
+        }
+    }
+    return updates;
+}
+function assertUniqueTags(tags) {
+    const seen = new Set();
+    for (const tag of tags) {
+        if (seen.has(tag)) {
+            throw new Error(`Release tag ${tag} was provided more than once.`);
+        }
+        seen.add(tag);
+    }
+}

package/managed/raw/git-format-staged.yml

@@ -0,0 +1,54 @@
+# git-format-staged configuration for SmoothBricks-style monorepos
+
+formatters:
+  # ESLint for Astro files (run first as it only handles .astro files)
+  eslint:
+    command: "eslint-stdout '{}'"
+    patterns:
+      - '*.astro'
+      - '!.*' # Exclude hidden files
+
+  # Biome for JS/TS/JSX/TSX/JSON/HTML/CSS/GraphQL files
+  biome:
+    command: "biome check --files-ignore-unknown=true --use-editorconfig=true '--stdin-file-path={}' --fix"
+    patterns:
+      - '*.js'
+      - '*.ts'
+      - '*.jsx'
+      - '*.tsx'
+      - '*.json'
+      - '*.jsonc'
+      - '*.html'
+      - '*.css'
+      - '*.graphql'
+
+  # Prettier for all other files (mainly Markdown)
+  prettier:
+    command: "prettier --ignore-unknown --stdin-filepath '{}'"
+    patterns:
+      # Match all files
+      - '*'
+      # Exclude files handled by Biome
+      - '!*.js'
+      - '!*.ts'
+      - '!*.jsx'
+      - '!*.tsx'
+      - '!*.json'
+      - '!*.jsonc'
+      - '!*.html'
+      - '!*.css'
+      - '!*.graphql'
+      # Exclude files handled by Alejandra
+      - '!*.nix'
+      # Bun lockfiles are generated and should not be rewritten by Prettier
+      - '!bun.lock'
+
+  # Alejandra for Nix files
+  alejandra:
+    command: 'alejandra'
+    patterns:
+      - '*.nix'
+
+settings:
+  update_working_tree: true
+  show_commands: true # Verbose output

package/managed/raw/tooling/git-hooks/commit-msg.sh

@@ -6,4 +6,4 @@ export PATH="$TOOLING/git-hooks:$TOOLING:$PWD/node_modules/.bin:$TOOLING/direnv/
 
 set -e -o pipefail
 
-smoo monorepo validate-commit-msg "$1"
+smoo monorepo validate-commit-msg --fix "$1"

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -10,10 +10,5 @@ set -e -o pipefail
 git-format-staged
 
 # Adding a workspace package is rare and easy to leave half-wired. Run the
-# full monorepo validator only for newly staged package manifests; --fail-fast
-# keeps pre-commit output focused on the first blocking setup issue.
-if ! git diff --cached --quiet --diff-filter=A -- \
-  'packages/*/package.json' \
-  'targets/*/package.json'; then
-  smoo monorepo validate --fail-fast
-fi
+# full monorepo validator only for newly staged package manifests.
+smoo monorepo validate --fail-fast --only-if-new-workspace-package

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -15,13 +15,7 @@ runs:
     # This action is intentionally post-checkout only. Repo-local actions do not
     # exist before actions/checkout has populated the working tree.
     - name: ❄️ Install Nix
-      uses: DeterminateSystems/nix-installer-action@v22
-      with:
-        extra-conf: |
-          keep-outputs = true
-          keep-derivations = true
-          gc-keep-derivations = true
-          gc-keep-outputs = true
+      uses: DeterminateSystems/determinate-nix-action@v3
 
     - name: 🧊 Cache Nix profiles and store NAR
       id: nix-cache

package/managed/templates/github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   push:
+    branches:
+      - '**'
   pull_request:
 
 permissions:
@@ -16,6 +18,7 @@ defaults:
 jobs:
   main:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     env:
       NIX_STORE_NAR: ${{ github.workspace }}/nix-store.nar
       GH_TOKEN: ${{ github.token }}

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
     "smoo": "./bin/smoo"
   },
+  "scripts": {
+    "test": "nx run cli:test"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -30,6 +33,11 @@
       "development": "./src/monorepo/git-config.ts",
       "import": "./dist/monorepo/git-config.js",
       "default": "./dist/monorepo/git-config.js"
+    },
+    "./nx-version-actions": {
+      "types": "./dist/nx-version-actions.d.cts",
+      "require": "./dist/nx-version-actions.cjs",
+      "default": "./dist/nx-version-actions.cjs"
     }
   },
   "files": [
@@ -42,19 +50,44 @@
   ],
   "dependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
-    "@smoothbricks/validation": "0.0.1",
+    "@smoothbricks/validation": "0.1.1",
     "commander": "^14.0.3",
     "publint": "^0.3.18",
+    "semver": "^7.7.4",
     "sherif": "^1.11.1",
     "tslib": "^2.8.1"
   },
+  "devDependencies": {
+    "fast-check": "^4.4.0"
+  },
   "nx": {
     "targets": {
-      "lint": {}
+      "lint": {},
+      "typecheck-tests": {
+        "executor": "nx:run-commands",
+        "options": {
+          "command": "tsc --noEmit -p tsconfig.test.json",
+          "cwd": "packages/cli"
+        },
+        "dependsOn": [
+          "build"
+        ]
+      },
+      "test": {
+        "executor": "nx:run-commands",
+        "dependsOn": [
+          "^build"
+        ],
+        "options": {
+          "command": "bun test",
+          "cwd": "{projectRoot}"
+        }
+      }
     },
     "tags": [
       "npm:public"
-    ]
+    ],
+    "name": "cli"
   },
   "license": "MIT",
   "publishConfig": {