@smoothbricks/cli 0.10.1 → 0.10.3

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -1,6 +1,14 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: Assertions cover literal GitHub Actions expressions. */
+
 import { describe, expect, it } from 'bun:test';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import {
+  LINUX_PLATFORM_TARGET_GLOBS,
+  MACOS_PLATFORM_TARGET_GLOBS,
+  PLATFORM_TARGET_GLOBS,
+} from '@smoothbricks/nx-plugin/workspace-config-policy';
+import { format } from 'prettier';
 import {
   definePublishWorkflow,
   type PublishWorkflowBump,
@@ -13,13 +21,208 @@ import {
 
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
-    const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const rendered = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
       rendered,
     );
   });
 
+  it('renders workflow bytes that are stable under the repository Prettier config', async () => {
+    const rendered = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+
+    await expect(
+      format(rendered, {
+        parser: 'yaml',
+        printWidth: 120,
+        proseWrap: 'always',
+      }),
+    ).resolves.toBe(rendered);
+  });
+
+  it('preserves the single Ubuntu job and renders no artifact transfer when no Apple targets exist', () => {
+    const current = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const explicitlyEmpty = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: [],
+    });
+    const linuxOnly = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: LINUX_PLATFORM_TARGET_GLOBS,
+    });
+
+    expect(explicitlyEmpty).toBe(current);
+    for (const rendered of [current, linuxOnly]) {
+      const jobsYaml = rendered.slice(rendered.indexOf('jobs:\n') + 'jobs:\n'.length);
+      expect(jobsYaml).toContain('  publish:\n    runs-on: ubuntu-latest');
+      expect(jobsYaml.match(/^ {2}[a-z][a-z-]+:\n/gm)).toHaveLength(1);
+      expect(rendered).not.toContain('linux-release-candidate:');
+      expect(rendered).not.toContain('macos-platform:');
+      expect(rendered).not.toContain('publish-on-linux:');
+      expect(rendered).not.toContain('--collect-outputs');
+      expect(rendered).not.toContain('Upload validated release state');
+      expect(rendered).not.toContain('Upload validated build outputs');
+      expect(rendered).not.toContain('Upload supplemental Linux outputs');
+      expect(rendered).not.toContain('Upload macOS platform outputs');
+      expect(rendered).not.toContain('actions/download-artifact');
+      expect(rendered).not.toContain('apply-outputs');
+      expect(rendered).not.toContain('git bundle');
+    }
+  });
+
+  it('keeps job-local deeplink step anchors exact for single-job and parallel platform workflows', () => {
+    const singleJob = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const platform = renderPublishWorkflowYaml({
+      deploy: true,
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = platform.slice(
+      platform.indexOf('  linux-release-candidate:'),
+      platform.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = platform.slice(
+      platform.indexOf('  macos-platform:'),
+      platform.indexOf('  publish-on-linux:'),
+    );
+    const finalJob = platform.slice(platform.indexOf('  publish-on-linux:'));
+
+    expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 15 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 19 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 7 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
+    expect(singleJob).toContain('# Step 14\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
+    expect(singleJob).toContain('# Step 15\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(linuxCandidate).toContain('# Step 7\n      - name: 🔒 Capture candidate release SHA');
+    expect(linuxCandidate).toContain(
+      '# Step 8\n      - name: ✅ Check managed monorepo files (${{ steps.version.outputs.mode }})',
+    );
+    expect(linuxCandidate).toContain('# Step 19\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(macosPlatform).toContain('# Step 5\n      - name: 🍎 Build selected macOS and iOS release outputs');
+    expect(macosPlatform).toContain('# Step 7\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(finalJob).toContain('# Step 7\n      - name: 🧯 Repair pending releases');
+    expect(finalJob).toContain('# Step 8\n      - name: ♻️ Restore validated release state');
+    expect(finalJob).toContain('# Step 9\n      - name: 📦 Apply verified Linux outputs');
+    expect(finalJob).toContain('# Step 10\n      - name: 🍎 Apply verified macOS outputs');
+    expect(finalJob).toContain(
+      '# Step 12\n      - name: 📦 Publish release (${{ needs.linux-release-candidate.outputs.mode }})',
+    );
+    expect(finalJob).toContain('# Step 13\n      - name: 🚀 Deploy production');
+    expect(finalJob).toContain('# Step 14\n      - name: 🧹 Cleanup and cache Nix/devenv');
+  });
+
+  it('renders parallel native producers and a dependent publish-only final job', () => {
+    const linuxOnly = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: LINUX_PLATFORM_TARGET_GLOBS,
+    });
+    const native = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = native.slice(
+      native.indexOf('  linux-release-candidate:'),
+      native.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = native.slice(native.indexOf('  macos-platform:'), native.indexOf('  publish-on-linux:'));
+    const finalJob = native.slice(native.indexOf('  publish-on-linux:'));
+
+    expect(linuxOnly).not.toContain('macos-platform:');
+    expect(linuxOnly).toContain(
+      `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
+    );
+    expect(native).toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+    expect(native).toContain('  macos-platform:\n    runs-on: macos-latest');
+    expect(native).toContain('  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]');
+    expect(linuxCandidate).not.toContain('needs:');
+    expect(macosPlatform).not.toContain('needs:');
+    expect(linuxCandidate).not.toContain('smoo release repair-pending');
+    expect(linuxCandidate).toContain('smoo release version');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets build --projects');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets lint --projects');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets test --projects');
+    expect(linuxCandidate).toContain(
+      `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
+    );
+    expect(macosPlatform).not.toContain('smoo github-ci nx-run-many');
+    expect(foldedRunCommand(macosPlatform, '🍎 Build selected macOS and iOS release outputs')).toBe(
+      `smoo release build-platform-outputs --bump "\${{ inputs.bump }}" --ref "\${{ github.sha }}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(
+        ',',
+      )}" --output "\${{ runner.temp }}/macos-platform-outputs"`,
+    );
+    expect(finalJob).not.toContain('smoo release version');
+    expect(finalJob).not.toContain('nx-run-many');
+    expect(foldedRunCommand(finalJob, '🧯 Repair pending releases')).toBe(
+      'smoo release repair-pending --ref "${{ github.sha }}" --platform-outputs ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-macos-outputs-${{ github.run_id }}/repairs" ' +
+        '--dry-run "${{ inputs.dry_run }}"',
+    );
+    expect(native).toContain('uses: actions/upload-artifact@v7.0.1');
+    expect(native).toContain('uses: actions/download-artifact@v8.0.1');
+    expect(native).toContain('name: publish-release-state-${{ github.run_id }}');
+    expect(native).toContain('name: publish-release-outputs-${{ github.run_id }}');
+    expect(native).toContain('name: publish-linux-outputs-${{ github.run_id }}');
+    expect(native.match(/include-hidden-files: true/g)).toHaveLength(4);
+    expect(native).toContain('name: publish-macos-outputs-${{ github.run_id }}');
+    expect(native).toContain('git bundle create');
+    expect(native).toContain('git fetch "${{ runner.temp }}/publish-artifacts/publish-release-state-');
+    expect(finalJob).toContain(
+      'smoo github-ci apply-outputs --source-sha "${{ needs.linux-release-candidate.outputs.release-sha }}"',
+    );
+    expect(finalJob).toContain('smoo github-ci apply-outputs --source-sha "${{ github.sha }}"');
+    expect(foldedRunCommand(finalJob, '📦 Apply verified Linux outputs')).toBe(
+      'smoo github-ci apply-outputs --source-sha "${{ needs.linux-release-candidate.outputs.release-sha }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-release-outputs-${{ github.run_id }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-linux-outputs-${{ github.run_id }}"',
+    );
+    expect(foldedRunCommand(finalJob, '🍎 Apply verified macOS outputs')).toBe(
+      'smoo github-ci apply-outputs --source-sha "${{ github.sha }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-macos-outputs-${{ github.run_id }}/current"',
+    );
+  });
+
+  it('limits trusted publishing permission to final publish and preserves mode, deploy, and dry-run gates', () => {
+    const rendered = renderPublishWorkflowYaml({
+      deploy: true,
+      deployProvider: 'cloudflare',
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = rendered.slice(
+      rendered.indexOf('  linux-release-candidate:'),
+      rendered.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = rendered.slice(
+      rendered.indexOf('  macos-platform:'),
+      rendered.indexOf('  publish-on-linux:'),
+    );
+    const finalJob = rendered.slice(rendered.indexOf('  publish-on-linux:'));
+
+    expect(linuxCandidate).toContain('id-token: none');
+    expect(macosPlatform).toContain('id-token: none');
+    expect(finalJob).toContain('id-token: write');
+    expect(rendered.match(/id-token: write/g)).toHaveLength(1);
+    expect(finalJob.indexOf('🧯 Repair pending releases')).toBeLessThan(
+      finalJob.indexOf('♻️ Restore validated release state'),
+    );
+    expect(finalJob.indexOf('♻️ Restore validated release state')).toBeGreaterThan(
+      finalJob.indexOf('🧱 Setup Nix/devenv'),
+    );
+    expect(rendered).not.toContain('GITHUB_SHA:');
+    expect(finalJob).toContain("needs.linux-release-candidate.outputs.mode != 'none'");
+    expect(finalJob).toContain("inputs.deploy_environment == 'production'");
+    expect(finalJob).toContain("inputs.dry_run != 'true'");
+    expect(finalJob).toContain('smoo release publish --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"');
+    expect(finalJob).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+    expect(finalJob).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+  });
+
   it('does not wire npm token secrets into repair or publish steps', () => {
     const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
 
@@ -250,11 +453,17 @@ class WorkflowScenarioState {
   private readonly repairBuilds = new Set<string>();
   private readonly publishedCurrent = new Set<string>();
   private readonly durableGaps = new Set<string>();
-  private readonly validationState = {
+  private readonly validationState: {
+    checks: number;
+    builds: string[];
+    lints: string[];
+    tests: string[];
+    validates: number;
+  } = {
     checks: 0,
-    builds: [] as string[],
-    lints: [] as string[],
-    tests: [] as string[],
+    builds: [],
+    lints: [],
+    tests: [],
     validates: 0,
   };
 
@@ -376,6 +585,26 @@ class WorkflowScenarioState {
   }
 }
 
+function stepAnchorNumbers(yaml: string): number[] {
+  return [...yaml.matchAll(/^\s*# Step (\d+)/gm)].map((match) => Number(match[1]));
+}
+
+function foldedRunCommand(yaml: string, stepName: string): string {
+  const stepStart = yaml.indexOf(`- name: ${stepName}`);
+  expect(stepStart).toBeGreaterThanOrEqual(0);
+  const runMarker = '        run:\n';
+  const runStart = yaml.indexOf(runMarker, stepStart);
+  expect(runStart).toBeGreaterThan(stepStart);
+  const commandLines: string[] = [];
+  for (const line of yaml.slice(runStart + runMarker.length).split('\n')) {
+    if (!line.startsWith('          ')) {
+      break;
+    }
+    commandLines.push(line.trim());
+  }
+  return commandLines.join(' ');
+}
+
 function packageNameFromTag(tag: string): string {
   const versionSeparator = tag.lastIndexOf('@');
   if (versionSeparator <= 0) {

package/src/monorepo/ci-workflow.ts

@@ -1,3 +1,5 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
+
 export enum CiWorkflowStepKind {
   Checkout = 'checkout',
   SetupDevenv = 'setup-devenv',
@@ -179,7 +181,7 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
         '          path: |',
         '            .nx/cache',
         '            .nx/workspace-data/*.db*',
-        '          key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}',
+        '          key: ${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}',
       ];
     case CiWorkflowStepKind.UploadTraceDbs:
       return [

package/src/monorepo/managed-files.test.ts

@@ -1,16 +1,30 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are asserted literally. */
 import { describe, expect, it } from 'bun:test';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { LINUX_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import fc from 'fast-check';
 import {
   extractInlineLocalBlocksForTest,
   INLINE_LOCAL_BEGIN,
   INLINE_LOCAL_END,
   LOCAL_SECTION_MARKER,
+  platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
   splitLocalSectionForTest,
 } from './managed-files.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
 
+const REPO_ROOT = join(import.meta.dir, '..', '..', '..', '..');
+const ARCHITECTURE_SCOPED_PREFIX = '${{ runner.os }}-${{ runner.arch }}-';
+const NODE_MODULES_CACHE_KEY = "${{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}";
+const CACHE_ACTIONS = [
+  { name: 'cache-nix-devenv', osKeyLines: 6 },
+  { name: 'cache-node-modules', osKeyLines: 2 },
+  { name: 'cache-nx', osKeyLines: 2 },
+] as const;
+
 describe('managed-file local sections', () => {
   it('content without a marker is entirely managed', () => {
     const { managed, localTail } = splitLocalSectionForTest(MANAGED);
@@ -93,6 +107,19 @@ describe('managed-file inline local blocks', () => {
     );
   });
 
+  it('preserves marker indentation when refreshing nested configuration', () => {
+    const markerIndent = '      ';
+    const current = [
+      'patterns:',
+      "      - '*.html'",
+      `${markerIndent}${INLINE_LOCAL_BEGIN}`,
+      "      - '!**/templates/*.html'",
+      `${markerIndent}${INLINE_LOCAL_END}`,
+    ].join('\n');
+    const { withoutInline, blocks } = extractInlineLocalBlocksForTest(current);
+    expect(reinsertInlineLocalBlocksForTest(withoutInline, blocks)).toBe(current);
+  });
+
   it("reinserting refuses when the anchor no longer appears — never silently drops the repo's customization", () => {
     const fresh = ['a:', '  - one', 'b:'].join('\n'); // '  - two' is gone
     expect(() => reinsertInlineLocalBlocksForTest(fresh, [{ anchor: '  - two', lines: '  - repo-owned' }])).toThrow(
@@ -126,3 +153,51 @@ describe('managed-file inline local blocks', () => {
     );
   });
 });
+
+describe('managed publish platform discovery', () => {
+  it('returns canonical target families from resolved target names without leaking project names', () => {
+    const discovered = platformTargetGlobsForTest(['build', 'bundle-linux', 'package-macos', 'simulator-ios', 'test']);
+
+    expect(discovered).toEqual([...PLATFORM_TARGET_GLOBS]);
+    expect(discovered).not.toContain('native-app');
+  });
+
+  it('selects only supplemental Linux when resolved metadata has no Apple targets', () => {
+    expect(platformTargetGlobsForTest(['build', 'bundle-linux', 'test'])).toEqual([...LINUX_PLATFORM_TARGET_GLOBS]);
+  });
+
+  it('returns no platform families for ordinary Nx targets', () => {
+    expect(platformTargetGlobsForTest(['build', 'lint', 'test', 'typecheck'])).toEqual([]);
+  });
+});
+
+describe('managed cache actions', () => {
+  it('renders the checked-in action copies from their managed templates', async () => {
+    for (const action of CACHE_ACTIONS) {
+      const [template, generated] = await Promise.all([
+        readFile(
+          join(REPO_ROOT, 'packages', 'cli', 'managed', 'templates', 'github', 'actions', action.name, 'action.yml'),
+          'utf8',
+        ),
+        readFile(join(REPO_ROOT, '.github', 'actions', action.name, 'action.yml'), 'utf8'),
+      ]);
+
+      expect(generated).toBe(template.replace('{{NODE_MODULES_CACHE_KEY}}', NODE_MODULES_CACHE_KEY));
+    }
+  });
+
+  it('scopes every primary, restore, and save key to the runner OS and architecture', async () => {
+    for (const action of CACHE_ACTIONS) {
+      for (const actionRoot of [
+        join(REPO_ROOT, 'packages', 'cli', 'managed', 'templates', 'github', 'actions'),
+        join(REPO_ROOT, '.github', 'actions'),
+      ]) {
+        const content = await readFile(join(actionRoot, action.name, 'action.yml'), 'utf8');
+        const osKeyLines = content.split('\n').filter((line) => line.includes('${{ runner.os }}'));
+
+        expect(osKeyLines).toHaveLength(action.osKeyLines);
+        expect(osKeyLines.every((line) => line.includes(ARCHITECTURE_SCOPED_PREFIX))).toBe(true);
+      }
+    }
+  });
+});

package/src/monorepo/managed-files.ts

@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -50,6 +51,7 @@ export const INLINE_LOCAL_END = '# smoo-local-end';
 interface InlineLocalBlock {
   anchor: string;
   lines: string;
+  markerIndent?: string;
 }
 
 /** Pull inline local blocks out of a managed section, returning the section
@@ -76,7 +78,12 @@ function extractInlineLocalBlocks(managed: string): { withoutInline: string; blo
       if (i >= lines.length) {
         throw new Error(`${INLINE_LOCAL_BEGIN} anchored on "${anchor}" has no matching ${INLINE_LOCAL_END}`);
       }
-      blocks.push({ anchor, lines: blockLines.join('\n') });
+      const markerIndent = line.slice(0, line.length - line.trimStart().length);
+      blocks.push({
+        anchor,
+        lines: blockLines.join('\n'),
+        ...(markerIndent === '' ? {} : { markerIndent }),
+      });
       i += 1; // skip the END marker line itself
       continue;
     }
@@ -102,7 +109,14 @@ function reinsertInlineLocalBlocks(content: string, blocks: InlineLocalBlock[]):
           'template — reconcile the repo-owned block manually',
       );
     }
-    lines.splice(index + 1, 0, INLINE_LOCAL_BEGIN, ...block.lines.split('\n'), INLINE_LOCAL_END);
+    const markerIndent = block.markerIndent ?? '';
+    lines.splice(
+      index + 1,
+      0,
+      `${markerIndent}${INLINE_LOCAL_BEGIN}`,
+      ...block.lines.split('\n'),
+      `${markerIndent}${INLINE_LOCAL_END}`,
+    );
   }
   return lines.join('\n');
 }
@@ -124,6 +138,7 @@ interface ManagedFileContext {
   ciPushBranches: string[];
   nodeModulesCacheKey: string;
   repoName: string;
+  platformTargetGlobs: string[];
 }
 
 interface DeployTargetInfo {
@@ -282,6 +297,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deploy: context.hasProductionDeployTargets,
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
+        platformTargetGlobs: context.platformTargetGlobs,
       });
     }
     throw new Error(`Unknown generated managed file source ${file.source}`);
@@ -301,6 +317,7 @@ function getManagedFileContext(root: string): ManagedFileContext {
   const ciPushBranches = getCiPushBranches(packageJson?.json);
   const stagingDeploy = getDeployTargetInfo(root, 'staging');
   const productionDeploy = getDeployTargetInfo(root, 'production');
+  const platformTargetGlobs = platformTargetGlobsForTest(readResolvedNxTargetNames(root));
   const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
     ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
     : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
@@ -313,9 +330,46 @@ function getManagedFileContext(root: string): ManagedFileContext {
     ciPushBranches,
     nodeModulesCacheKey,
     repoName,
+    platformTargetGlobs,
   };
 }
 
+export function platformTargetGlobsForTest(targetNames: Iterable<string>): string[] {
+  const names = [...targetNames];
+  return PLATFORM_TARGET_GLOBS.filter((glob) => {
+    const suffix = glob.startsWith('*') ? glob.slice(1) : glob;
+    return names.some((name) => name.endsWith(suffix));
+  });
+}
+
+function readResolvedNxTargetNames(root: string): string[] {
+  const output = execFileSync('nx', ['show', 'projects', '--json'], {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const projects: unknown = JSON.parse(output);
+  if (!Array.isArray(projects) || !projects.every((project) => typeof project === 'string')) {
+    return [];
+  }
+  const targetNames = new Set<string>();
+  for (const project of projects) {
+    const projectOutput = execFileSync('nx', ['show', 'project', project, '--json'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    const projectJson: unknown = JSON.parse(projectOutput);
+    const targets = recordValue(recordValue(projectJson)?.targets);
+    if (targets) {
+      for (const targetName of Object.keys(targets)) {
+        targetNames.add(targetName);
+      }
+    }
+  }
+  return [...targetNames];
+}
+
 function renderTemplate(context: ManagedFileContext, template: string): string {
   return template
     .replaceAll('{{REPO_NAME}}', context.repoName)
@@ -388,9 +442,11 @@ function readCiPushBranches(packageJson: unknown): string[] {
 }
 
 function recordValue(value: unknown): Record<string, unknown> | undefined {
-  return value !== null && typeof value === 'object' && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : undefined;
+  return isRecord(value) ? value : undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
 
 function renderYamlFlowList(values: string[]): string {

package/src/monorepo/package-policy.test.ts

@@ -29,7 +29,6 @@ const buildOutputDependencies = [
   '*-web',
   '*-html',
   '*-css',
-  '*-ios',
   '*-android',
   '*-native',
   '*-napi',
@@ -70,21 +69,7 @@ describe('root smoo monorepo policy', () => {
       expect(rootPackage).toMatchObject({ nx: { includedScripts: [] } });
       expect(nxJson.namedInputs).toEqual(validNamedInputs());
       expect(nxJson.targetDefaults).toEqual(validTargetDefaults());
-      expect(nxJson.plugins).toEqual([
-        {
-          plugin: '@nx/js/typescript',
-          options: {
-            typecheck: { targetName: 'typecheck' },
-            build: {
-              targetName: 'tsc-js',
-              configName: 'tsconfig.lib.json',
-              buildDepsName: 'build-deps',
-              watchDepsName: 'watch-deps',
-            },
-          },
-        },
-        '@smoothbricks/nx-plugin',
-      ]);
+      expect(nxJson.plugins).toEqual(['@smoothbricks/nx-plugin']);
       expect(validateRootPackagePolicy(root)).toBe(0);
       expect(validateNxReleaseConfig(root)).toBe(0);
     } finally {
@@ -167,7 +152,7 @@ describe('root smoo monorepo policy', () => {
     }
   });
 
-  it('explains Nx plugin conventions when nx.json is not configured', async () => {
+  it('explains SmoothBricks Nx plugin conventions when nx.json is not configured', async () => {
     const root = await mkdtemp(join(tmpdir(), 'smoo-package-policy-'));
     try {
       await writeJson(join(root, 'package.json'), validRootPackage());
@@ -177,10 +162,8 @@ describe('root smoo monorepo policy', () => {
       });
       const errors = captureConsoleErrors();
 
-      expect(validateNxReleaseConfig(root)).toBe(2);
+      expect(validateNxReleaseConfig(root)).toBe(1);
 
-      expect(errors.join('\n')).toContain('Official Nx owns TypeScript library inference');
-      expect(errors.join('\n')).toContain('tsconfig.lib.json produces tsc-js');
       expect(errors.join('\n')).toContain('Smoo relies on this plugin to infer convention targets');
       expect(errors.join('\n')).not.toContain('Fix:');
     } finally {
@@ -188,7 +171,7 @@ describe('root smoo monorepo policy', () => {
     }
   });
 
-  it('explains why TypeScript build targetName is tsc-js', async () => {
+  it('rejects the official Nx TypeScript plugin because it bypasses ttsc transforms', async () => {
     const root = await mkdtemp(join(tmpdir(), 'smoo-package-policy-'));
     try {
       await writeJson(join(root, 'package.json'), validRootPackage());
@@ -206,8 +189,8 @@ describe('root smoo monorepo policy', () => {
 
       expect(validateNxReleaseConfig(root)).toBe(1);
 
-      expect(errors.join('\n')).toContain('build.targetName must be tsc-js');
-      expect(errors.join('\n')).toContain('build is reserved for aggregate targets');
+      expect(errors.join('\n')).toContain('plugins must not configure @nx/js/typescript');
+      expect(errors.join('\n')).toContain('Smoo owns transformer-aware TypeScript targets');
       expect(errors.join('\n')).not.toContain('Fix:');
     } finally {
       await rm(root, { recursive: true, force: true });
@@ -990,6 +973,56 @@ describe('workspace package script policy', () => {
       await rm(root, { recursive: true, force: true });
     }
   });
+  it('validates generic CI skip tags against resolved project targets', async () => {
+    const root = await createWorkspace({
+      rootName: '@fixture/root',
+      packages: [
+        {
+          dir: 'worker',
+          name: '@fixture/worker',
+          nx: { name: 'worker', tags: ['ci:skip:test', 'ci:skip:test.integration'], targets: {} },
+        },
+      ],
+    });
+    try {
+      const resolvedTargetsByProject = new Map([['worker', new Set(['build', 'test', 'test.integration'])]]);
+      expect(validateWorkspaceDependencies(root, { resolvedTargetsByProject })).toBe(0);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects malformed and missing-target CI skip tags', async () => {
+    const root = await createWorkspace({
+      rootName: '@fixture/root',
+      packages: [
+        {
+          dir: 'malformed',
+          name: '@fixture/malformed',
+          nx: { name: 'malformed', tags: ['ci:skip:'], targets: {} },
+        },
+        {
+          dir: 'missing',
+          name: '@fixture/missing',
+          nx: { name: 'missing', tags: ['ci:skip:test'], targets: {} },
+        },
+      ],
+    });
+    const errors = captureConsoleErrors();
+    try {
+      const resolvedTargetsByProject = new Map([
+        ['malformed', new Set(['test'])],
+        ['missing', new Set(['build'])],
+      ]);
+      expect(validateWorkspaceDependencies(root, { resolvedTargetsByProject })).toBe(2);
+      expect(errors).toContain(
+        'packages/malformed: nx tag ci:skip: must use ci:skip:<target> with one exact Nx target name',
+      );
+      expect(errors).toContain('packages/missing: nx tag ci:skip:test names missing Nx target test');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
 });
 
 async function createWorkspace(input: {
@@ -1100,21 +1133,7 @@ function validConfiguredNxJson(): Record<string, unknown> {
     ...validNxJson(),
     namedInputs: validNamedInputs(),
     targetDefaults: validTargetDefaults(),
-    plugins: [
-      {
-        plugin: '@nx/js/typescript',
-        options: {
-          typecheck: { targetName: 'typecheck' },
-          build: {
-            targetName: 'tsc-js',
-            configName: 'tsconfig.lib.json',
-            buildDepsName: 'build-deps',
-            watchDepsName: 'watch-deps',
-          },
-        },
-      },
-      '@smoothbricks/nx-plugin',
-    ],
+    plugins: ['@smoothbricks/nx-plugin'],
   };
 }