@smoothbricks/cli 0.10.2 → 0.10.4

package/README.md

@@ -228,35 +228,43 @@ candidates to downstream dependents because that would duplicate Nx's dependency
 
 `smoo` keeps Nx target names predictable and separates tool work from aggregate workflows.
 
-Official Nx plugins own targets they already know how to infer. For example, `@nx/js/typescript` owns TypeScript library
-builds, so a package `tsconfig.lib.json` produces the concrete target `tsc-js`.
-
-`@smoothbricks/nx-plugin` only fills SmoothBricks convention gaps that official plugins do not provide. Today that means
-Bun test typechecking, non-TypeScript build-tool steps, and aggregate targets.
+`@smoothbricks/nx-plugin` owns transformer-aware TypeScript targets because this workspace compiles through `ttsc`.
+Configuring `@nx/js/typescript` would run `tsc`/`tsgo` directly and bypass the Typia and LMAO transformers. A package
+`tsconfig.lib.json` therefore produces the concrete `tsc-js` target from the SmoothBricks plugin. The same plugin also
+infers Bun test typechecking, Cargo workspace targets, and aggregate targets.
 
 Concrete targets use `{tool}-{output}` names and describe the tool that runs and the artifact or purpose it produces:
 
-- `tsc-js` comes from the official TypeScript plugin and runs `tsc` for package JavaScript/declaration output.
+- `tsc-js` comes from `@smoothbricks/nx-plugin` and runs `ttsc` for package JavaScript/declaration output.
 - Packages that run `bun test` must have `tsconfig.test.json`. Bun executes tests without typechecking, so smoo creates
   a no-emit `typecheck-tests` target from that config and wires it into validation. Other test runners may own their own
   typecheck path.
 - Test tsconfigs are validation configs, not TypeScript build-mode projects. They must use `noEmit`, must not set
   `composite: true`, and package root `tsconfig.json` must not reference `./tsconfig.test.json`. The inferred
-  `typecheck-tests` target runs `tsc --noEmit -p tsconfig.test.json` after `build` instead.
-- Non-TypeScript build steps come from explicit tool configuration. For example, a package `build.zig` must expose named
-  `b.step("name", ...)` entries; each non-reserved step becomes a `zig-name` target such as `zig-wasm`.
+  `typecheck-tests` target runs `ttsc --noEmit -p tsconfig.test.json` after `build` instead.
+- A neighboring workspace-root `Cargo.toml` provides Cargo test, lint, mutation, and benchmark targets. Workspaces with
+  `cdylib` member crates also receive the cacheable `cargo-wasm` output target.
 - `build` is an aggregate. It exists only when there is at least one concrete build target such as `tsc-js`,
   `tsdown-js`, or another tool-output target, and it depends on output-family wildcards such as `*-js`, `*-web`,
   `*-html`, `*-css`, `*-ios`, `*-android`, `*-native`, `*-napi`, `*-bun`, and `*-wasm` instead of duplicating commands.
 - `lint` is an aggregate validation target. It is not a formatting target.
 
+The root `@typescript/native` dependency follows TypeScript's documented side-by-side pattern: it aliases TypeScript 7
+and supplies the native compiler used by `ttsc`. Because `ttsc` resolves only the unscoped package by default, the
+managed devenv shell sets `TTSC_TSGO_BINARY` to `node_modules/@typescript/native/bin/tsc`; the GitHub setup action
+persists that absolute path through `GITHUB_ENV`. Nx and other JavaScript tooling still require the full TypeScript
+compiler API, so workspace `typescript` stays on TypeScript 6. After install, setup-environment forces Bun's shared
+`.bun/node_modules/typescript` hoist onto that API package so Nx does not load `@typescript/native` (TS7) via the store
+([oven-sh/bun#33834](https://github.com/oven-sh/bun/issues/33834)). Both dependencies and the environment binding are
+required: TypeScript 7 under the unscoped name breaks Nx API calls such as `readConfigFile`.
+
 Explicit Nx target names must not contain `:`. Nx already uses colon syntax at the CLI boundary:
 `project:target:configuration`. Allowing target names like `build:wasm` makes command parsing and package-script aliases
 look like configurations, and it prevents a clean split between concrete tool-output targets and aggregate targets.
 
-Use tool-output names for concrete targets, such as `tsc-js`, `tsdown-js`, and `zig-wasm`. Use `build` and `lint` only
+Use tool-output names for concrete targets, such as `tsc-js`, `tsdown-js`, and `cargo-wasm`. Use `build` and `lint` only
 as aggregate targets. Package scripts may still use developer-friendly colon names, for example `build:wasm`, but those
-scripts should delegate to unambiguous Nx targets such as `nx run pkg:zig-wasm`.
+scripts should delegate to unambiguous Nx targets such as `nx run pkg:cargo-wasm`.
 
 ## Managed Files
 
@@ -286,6 +294,9 @@ smoo monorepo diff
 
 `check` fails when a managed file is missing or stale. `diff` reports drift without writing files.
 
+The generated publish workflow is canonical Prettier YAML. Running the repository formatter over
+`.github/workflows/publish.yml` is byte-stable and does not create managed-file drift.
+
 ## Formatting And Git Hooks
 
 The root `lint:fix` script runs [`git-format-staged`][git-format-staged] with
@@ -467,12 +478,15 @@ Publishing:
   for targeted bootstraps.
 - `smoo release trust-publisher` configures [npm trusted publishing][npm-trusted-publishing] for every owned release
   package. It uses the root `package.json` `repository.url` as the GitHub `owner/repo`, uses `publish.yml` as the
-  trusted workflow, and runs `npm trust` through `nix shell nixpkgs#nodejs_latest` because the Lambda-pinned Node 24/npm
-  toolchain may lag the npm CLI feature. It does not run a separate `npm login` before trust setup; `npm trust list` and
-  `npm trust github` own authentication so npm can offer the 5-minute trust/publish challenge bypass. Pass
-  `--package <name...>` to target specific owned packages. Pass `--bootstrap` to create missing npm package names first,
-  then configure trusted publishing in the same command. With `--bootstrap`, `--skip-login` only skips the placeholder
-  publish login. Existing matching trusted publishers are skipped via `npm trust list <package> --json`.
+  trusted workflow, grants that workflow npm's `--allow-publish` permission, and runs `npm trust` through
+  `nix shell nixpkgs#nodejs_latest` because the Lambda-pinned Node 24/npm toolchain may lag the npm CLI feature. It does
+  not pre-login: `npm trust list` and `npm trust github` own normal authentication so npm can offer the 5-minute
+  trust/publish challenge bypass. If `npm trust list` denies access, smoo reports the active npm identity and package
+  owners, opens `npm login --auth-type=web` once so the operator can switch accounts, then retries the lookup. A second
+  denial fails instead of looping. Pass `--package <name...>` to target specific owned packages. Pass `--bootstrap` to
+  create missing npm package names first, then configure trusted publishing in the same command. With `--bootstrap`,
+  `--skip-login` only skips the placeholder publish login. Existing matching trusted publishers are skipped via
+  `npm trust list <package> --json`.
 
 GitHub Releases:
 
@@ -514,12 +528,6 @@ nx lint @smoothbricks/cli
 smoo monorepo validate
 ```
 
-If validating packages with Zig build steps from outside the devenv shell, add Zig explicitly:
-
-```bash
-nix shell nixpkgs#zig -c nx run-many -t build --projects=<public-projects>
-```
-
 ## Links
 
 [are-the-types-wrong]: https://github.com/arethetypeswrong/arethetypeswrong.github.io/tree/main/packages/cli

package/dist/bun/preload.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Bun runtime preload for consumers of `@smoothbricks/cli`.
+ *
+ * Re-exports the Typia/ttsc transform preload from `@smoothbricks/validation`.
+ * External repos depend on the CLI package only — they must not need a direct
+ * `@smoothbricks/validation` dependency just to run `smoo` against source.
+ *
+ * Usage:
+ *   import '@smoothbricks/cli/bun/preload';
+ *   // or bunfig.toml: preload = ["@smoothbricks/cli/bun/preload"]
+ */
+import '@smoothbricks/validation/bun/preload';
+//# sourceMappingURL=preload.d.ts.map

package/dist/bun/preload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preload.d.ts","sourceRoot":"","sources":["../../src/bun/preload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,sCAAsC,CAAC"}

package/dist/bun/preload.js

@@ -0,0 +1,12 @@
+/**
+ * Bun runtime preload for consumers of `@smoothbricks/cli`.
+ *
+ * Re-exports the Typia/ttsc transform preload from `@smoothbricks/validation`.
+ * External repos depend on the CLI package only — they must not need a direct
+ * `@smoothbricks/validation` dependency just to run `smoo` against source.
+ *
+ * Usage:
+ *   import '@smoothbricks/cli/bun/preload';
+ *   // or bunfig.toml: preload = ["@smoothbricks/cli/bun/preload"]
+ */
+import '@smoothbricks/validation/bun/preload';

package/dist/cli.js

@@ -52,9 +52,12 @@ function buildProgram() {
         const { updateManagedFiles } = await import('./monorepo/index.js');
         updateManagedFiles(await findRepoRoot());
     });
-    monorepo.command('check').action(async () => {
+    monorepo
+        .command('check')
+        .option('--warn', 'report drift as warnings (GitHub annotations) instead of failing')
+        .action(async (options) => {
         const { checkManagedFiles } = await import('./monorepo/index.js');
-        checkManagedFiles(await findRepoRoot());
+        checkManagedFiles(await findRepoRoot(), { warn: options.warn });
     });
     monorepo.command('diff').action(async () => {
         const { diffManagedFiles } = await import('./monorepo/index.js');
@@ -69,10 +72,15 @@ function buildProgram() {
     });
     monorepo
         .command('sync-bun-lockfile-versions')
-        .option('--stage', 'stage bun.lock when versions were resynced (pre-commit self-heal); quiet when clean')
+        .option('--stage', 'stage bun.lock when versions were resynced; quiet when clean')
+        .option('--mode <mode>', 'install: match package.json (CI); publish: map unpublished -next to last stable tag (pre-pack)', 'publish')
         .action(async (options) => {
         const { syncBunLockfileVersions } = await import('./monorepo/index.js');
-        syncBunLockfileVersions(await findRepoRoot(), options.stage ? { log: false, stage: true } : {});
+        const mode = options.mode === 'install' ? 'install' : 'publish';
+        syncBunLockfileVersions(await findRepoRoot(), {
+            mode,
+            ...(options.stage ? { log: false, stage: true } : {}),
+        });
     });
     monorepo
         .command('list-release-packages')
@@ -125,10 +133,25 @@ function buildProgram() {
         .command('repair-pending')
         .description('Repair incomplete older release commits before releasing the current HEAD')
         .option('--dry-run [dryRun]', 'run without pushing, publishing, or writing GitHub Releases')
+        .option('--ref <ref>', 'fixed release graph ref to inspect')
+        .option('--platform-outputs <path>', 'cross-platform repair outputs grouped by release SHA')
         .action(async (options) => {
+        // The source self-hosting shim has no Typia transform; release commands import transformed output validators.
         const { releaseRepairPending } = await import('./release/index.js');
         await releaseRepairPending(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
     });
+    release
+        .command('build-platform-outputs')
+        .description('Build selected current and pending-release platform outputs')
+        .requiredOption('--bump <bump>', 'auto, patch, minor, major, or prerelease')
+        .requiredOption('--targets <targets>', 'comma-separated Nx platform target names or globs')
+        .requiredOption('--output <path>', 'output directory for current and repair artifacts')
+        .option('--ref <ref>', 'fixed release graph ref to inspect')
+        .action(async (options) => {
+        // The source self-hosting shim has no Typia transform; release commands import transformed output validators.
+        const { releaseCollectPlatformOutputs } = await import('./release/index.js');
+        await releaseCollectPlatformOutputs(await findRepoRoot(), options);
+    });
     release
         .command('version')
         .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
@@ -268,10 +291,19 @@ function buildProgram() {
         .requiredOption('--targets <targets>')
         .option('--projects <projects>')
         .option('--configuration <configuration>')
+        .option('--collect-outputs <directory>')
         .action(async (options) => {
         const { githubCiNxRunMany } = await import('./github-ci/index.js');
         await githubCiNxRunMany(await findRepoRoot(), options);
     });
+    githubCi
+        .command('apply-outputs <directories...>')
+        .requiredOption('--source-sha <sha>', 'expected source commit SHA')
+        .action(async (directories, options) => {
+        // GitHub CI commands stay lazy so source self-hosting can initialize Typia only at manifest boundaries.
+        const { githubCiApplyOutputs } = await import('./github-ci/index.js');
+        await githubCiApplyOutputs(await findRepoRoot(), directories, options.sourceSha);
+    });
     githubCi
         .command('nx-deploy')
         .requiredOption('--configuration <configuration>')

package/dist/generate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generate/index.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACpC;AAED,UAAU,aAAa;IACrB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAkBpD,CAAC;AAMF,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyBf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generate/index.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACpC;AAED,UAAU,aAAa;IACrB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAYpD,CAAC;AAMF,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/generate/index.js

@@ -7,12 +7,6 @@ export const variants = {
         args: (name) => ['--name', name, '--variant', 'ts-lib'],
         options: [{ flag: '--public', description: 'configure for npm publication' }],
     },
-    'ts-zig': {
-        generator: 'create-package',
-        description: 'Create a TypeScript + Zig/WASM hybrid package',
-        args: (name) => ['--name', name, '--variant', 'ts-zig'],
-        options: [{ flag: '--public', description: 'configure for npm publication' }],
-    },
     'make-public': {
         generator: 'make-public',
         description: 'Promote a private package to npm publication',

package/dist/github-ci/index.d.ts

@@ -1,5 +1,8 @@
+import { type ProjectTargets } from '../nx/index.js';
+import type { NxTargetRun } from './outputs.js';
 type NxSmartMode = 'auto' | 'affected' | 'run-many';
 export declare function cleanupGithubCiCache(root: string): Promise<void>;
+export declare function nxSmartArgs(target: string, mode: 'affected' | 'run-many', configuration?: string): string[];
 export declare function githubCiNxSmart(root: string, options: {
     target: string;
     name?: string;
@@ -7,11 +10,23 @@ export declare function githubCiNxSmart(root: string, options: {
     mode?: NxSmartMode;
     configuration?: string;
 }): Promise<void>;
-export declare function githubCiNxRunMany(root: string, options: {
+export interface NxRunManyOptions {
     targets: string;
     projects?: string;
     configuration?: string;
-}): Promise<void>;
+    collectOutputs?: string;
+    allowEmptyProjects?: boolean;
+}
+export interface ExpandedNxTargetRuns {
+    runs: NxTargetRun[];
+    unmatchedGlobs: string[];
+}
+export declare function expandNxTargetRuns(projects: ProjectTargets[], options: NxRunManyOptions): ExpandedNxTargetRuns;
+export declare function expandNxTargetDependencyRuns(runs: NxTargetRun[]): NxTargetRun[];
+export declare function nxRunManyArgs(run: NxTargetRun, configuration?: string): string[];
+export declare function readGitHeadSha(root: string): Promise<string>;
+export declare function githubCiNxRunMany(root: string, options: NxRunManyOptions): Promise<void>;
+export declare function githubCiApplyOutputs(root: string, directories: string[], expectedSourceSha: string): Promise<void>;
 export declare function githubCiNxDeploy(root: string, options: {
     configuration: string;
     mode?: NxSmartMode;

package/dist/github-ci/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAMA,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAEpD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtE;AAmFD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACpG,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACrG,OAAO,CAAC,IAAI,CAAC,CA0Bf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAmBhD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAEpD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtE;AAmFD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAO3G;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACpG,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAiC9G;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAwC/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAehF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9F;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AAgCD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACrG,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/github-ci/index.js

@@ -1,8 +1,30 @@
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { appendFile, mkdtemp, realpath, rename, rm } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { $ } from 'bun';
+import typia from 'typia';
+import { parseStringArrayText } from '../lib/json.js';
 import { decode, run, runStatus } from '../lib/run.js';
+import { readProjectTargets } from '../nx/index.js';
+const parseGithubActionsEvent = (() => {
+    const _io0 = input => undefined === input.repository || "object" === typeof input.repository && null !== input.repository && false === Array.isArray(input.repository) && _io1(input.repository);
+    const _io1 = input => undefined === input.default_branch || "string" === typeof input.default_branch;
+    const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+    return input => { input = JSON.parse(input); return __is(input) ? input : null; };
+})();
+const parseNxProjectDeployConfigurations = (() => {
+    const _io0 = input => undefined === input.targets || "object" === typeof input.targets && null !== input.targets && false === Array.isArray(input.targets) && _io1(input.targets);
+    const _io1 = input => undefined === input.deploy || "object" === typeof input.deploy && null !== input.deploy && false === Array.isArray(input.deploy) && _io2(input.deploy);
+    const _io2 = input => undefined === input.configurations || "object" === typeof input.configurations && null !== input.configurations && false === Array.isArray(input.configurations) && _io3(input.configurations);
+    const _io3 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+    return input => { input = JSON.parse(input); return __is(input) ? input : null; };
+})();
 export async function cleanupGithubCiCache(root) {
     const githubOutput = process.env.GITHUB_OUTPUT;
     const markCacheReady = async (ready) => {
@@ -100,31 +122,160 @@ async function addReferencesFrom(roots, path, cwd) {
         }
     }
 }
+export function nxSmartArgs(target, mode, configuration) {
+    const args = [mode, '-t', target];
+    if (configuration) {
+        args.push(`--configuration=${configuration}`);
+    }
+    args.push(`--exclude=tag:ci:skip:${target}`, '--parallel=5');
+    return args;
+}
 export async function githubCiNxSmart(root, options) {
     const name = options.name ?? options.target;
     const step = options.step ?? '';
     await createGithubStatus(name, step);
     const mode = resolveNxSmartMode(options.mode ?? 'auto');
-    const nxArgs = mode === 'run-many' ? ['run-many', '-t', options.target] : ['affected', '-t', options.target];
-    if (options.configuration) {
-        nxArgs.push(`--configuration=${options.configuration}`);
-    }
-    nxArgs.push('--parallel=5');
+    const nxArgs = nxSmartArgs(options.target, mode, options.configuration);
     const status = await runStatus('nx', nxArgs, root);
     await updateGithubStatus(name, status === 0 ? 'success' : 'failure', step);
     if (status !== 0) {
         throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
     }
 }
+export function expandNxTargetRuns(projects, options) {
+    const selectedProjects = selectProjects(projects, options.projects);
+    if (options.projects !== undefined && selectedProjects.length === 0 && options.allowEmptyProjects !== true) {
+        throw new Error(`No Nx projects matched --projects ${options.projects}.`);
+    }
+    const selectedTargetNames = [...new Set(selectedProjects.flatMap((project) => project.targets))].sort((a, b) => a.localeCompare(b));
+    const runs = [];
+    const unmatchedGlobs = [];
+    const addedTargets = new Set();
+    for (const targetPattern of commaSeparatedValues(options.targets)) {
+        const isGlob = isGlobPattern(targetPattern);
+        const targets = isGlob
+            ? selectedTargetNames.filter((target) => new Bun.Glob(targetPattern).match(target))
+            : [targetPattern];
+        if (isGlob && targets.length === 0) {
+            unmatchedGlobs.push(targetPattern);
+        }
+        for (const target of targets) {
+            if (addedTargets.has(target)) {
+                continue;
+            }
+            const owners = selectedProjects.filter((project) => project.targets.includes(target));
+            const runProjects = owners.length > 0 ? owners : selectedProjects;
+            if (runProjects.length === 0) {
+                continue;
+            }
+            addedTargets.add(target);
+            runs.push({ target, projects: runProjects });
+        }
+    }
+    return { runs, unmatchedGlobs };
+}
+export function expandNxTargetDependencyRuns(runs) {
+    const expanded = [];
+    const added = new Set();
+    const visiting = new Set();
+    const visit = (project, target) => {
+        const key = `${project.project}:${target}`;
+        if (added.has(key)) {
+            return;
+        }
+        if (visiting.has(key)) {
+            throw new Error(`Nx target dependency cycle detected at ${key}.`);
+        }
+        visiting.add(key);
+        for (const dependency of project.targetDependencies?.get(target) ?? []) {
+            if (dependency.startsWith('^')) {
+                continue;
+            }
+            const dependencyTargets = isGlobPattern(dependency)
+                ? project.targets.filter((candidate) => new Bun.Glob(dependency).match(candidate))
+                : project.targets.includes(dependency)
+                    ? [dependency]
+                    : [];
+            for (const dependencyTarget of dependencyTargets.sort((left, right) => left.localeCompare(right))) {
+                visit(project, dependencyTarget);
+            }
+        }
+        visiting.delete(key);
+        added.add(key);
+        if ((project.targetOutputs?.get(target)?.length ?? 0) > 0) {
+            expanded.push({ target, projects: [project] });
+        }
+    };
+    for (const run of runs) {
+        for (const project of run.projects) {
+            visit(project, run.target);
+        }
+    }
+    return expanded;
+}
+export function nxRunManyArgs(run, configuration) {
+    if (run.projects.length === 0) {
+        throw new Error(`Nx target ${run.target} has no selected projects.`);
+    }
+    const nxArgs = [
+        'run-many',
+        '-t',
+        run.target,
+        `--projects=${run.projects.map((project) => project.project).join(',')}`,
+    ];
+    if (configuration) {
+        nxArgs.push(`--configuration=${configuration}`);
+    }
+    nxArgs.push('--parallel=5');
+    return nxArgs;
+}
+export async function readGitHeadSha(root) {
+    // invariant throw: GitHub CI commands require a valid repository root.
+    return decode((await $ `git rev-parse HEAD`.cwd(root).quiet()).stdout).trim();
+}
 export async function githubCiNxRunMany(root, options) {
-    const nxArgs = ['run-many', '-t', options.targets, '--parallel=5'];
-    if (options.projects) {
-        nxArgs.push(`--projects=${options.projects}`);
+    const expanded = expandNxTargetRuns(await readProjectTargets(root), options);
+    if (expanded.unmatchedGlobs.length > 0) {
+        console.log(`No Nx targets matched target glob(s): ${expanded.unmatchedGlobs.join(', ')}; skipping.`);
+    }
+    for (const targetRun of expanded.runs) {
+        await run('nx', nxRunManyArgs(targetRun, options.configuration), root);
+    }
+    if (options.collectOutputs) {
+        const { collectNxOutputs } = await loadOutputBoundary();
+        const sourceSha = await readGitHeadSha(root);
+        await collectNxOutputs(root, options.collectOutputs, expandNxTargetDependencyRuns(expanded.runs), sourceSha);
     }
-    if (options.configuration) {
-        nxArgs.push(`--configuration=${options.configuration}`);
+}
+export async function githubCiApplyOutputs(root, directories, expectedSourceSha) {
+    const { applyCollectedOutputs } = await loadOutputBoundary();
+    await applyCollectedOutputs(root, directories, expectedSourceSha);
+}
+async function loadOutputBoundary() {
+    if (import.meta.url.endsWith('/src/github-ci/index.ts')) {
+        // The source self-hosting shim has no Typia transform; register it before loading manifest validators.
+        await import('@smoothbricks/cli/bun/preload');
+    }
+    // This boundary must stay lazy because the transformed dist and source self-hosting paths initialize Typia differently.
+    return import('./outputs.js');
+}
+function isGlobPattern(value) {
+    return /[*?{[]/.test(value);
+}
+function selectProjects(projects, selectors) {
+    if (selectors === undefined) {
+        return projects.slice().sort((left, right) => left.project.localeCompare(right.project));
     }
-    await run('nx', nxArgs, root);
+    const patterns = commaSeparatedValues(selectors);
+    return projects
+        .filter((project) => patterns.some((pattern) => new Bun.Glob(pattern).match(project.project)))
+        .sort((left, right) => left.project.localeCompare(right.project));
+}
+function commaSeparatedValues(value) {
+    return value
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
 }
 export async function githubCiNxDeploy(root, options) {
     const name = options.name ?? `Deploy ${options.configuration}`;
@@ -156,7 +307,32 @@ function resolveNxSmartMode(mode) {
     if (mode === 'affected' || mode === 'run-many') {
         return mode;
     }
-    return process.env.GITHUB_EVENT_NAME === 'push' && process.env.GITHUB_REF_NAME === 'main' ? 'run-many' : 'affected';
+    const defaultBranch = eventDefaultBranch() ?? 'main';
+    if (process.env.GITHUB_EVENT_NAME === 'push') {
+        return process.env.GITHUB_REF_NAME === defaultBranch ? 'run-many' : 'affected';
+    }
+    // A PR into a NON-default branch is an integration surface (e.g. a mirror-sync
+    // review branch): its base moves outside the default-branch workflow that
+    // affected scoping is calibrated against, so under-selection can pass PR CI
+    // and only fail after merge. Validate those PRs in full.
+    if (process.env.GITHUB_EVENT_NAME === 'pull_request') {
+        const base = process.env.GITHUB_BASE_REF;
+        return base && base !== defaultBranch ? 'run-many' : 'affected';
+    }
+    return 'affected';
+}
+/** The repository default branch from the Actions event payload. */
+function eventDefaultBranch() {
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (!eventPath)
+        return undefined;
+    try {
+        const payload = parseGithubActionsEvent(readFileSync(eventPath, 'utf8'));
+        return payload?.repository?.default_branch || undefined;
+    }
+    catch {
+        return undefined;
+    }
 }
 async function deployProjectsWithConfiguration(root, configuration, mode) {
     const listArgs = mode === 'affected'
@@ -174,21 +350,11 @@ async function deployProjectsWithConfiguration(root, configuration, mode) {
 }
 async function deployTargetHasConfiguration(root, project, configuration) {
     const result = await $ `nx show project ${project} --json`.cwd(root).quiet();
-    const parsed = JSON.parse(decode(result.stdout));
-    const targets = recordValue(parsed)?.targets;
-    const deploy = recordValue(targets)?.deploy;
-    const configurations = recordValue(deploy)?.configurations;
-    return recordValue(configurations)?.[configuration] !== undefined;
+    const parsed = parseNxProjectDeployConfigurations(decode(result.stdout));
+    return parsed?.targets?.deploy?.configurations?.[configuration] !== undefined;
 }
 function nxProjectList(output) {
-    const parsed = JSON.parse(output);
-    return Array.isArray(parsed) ? parsed.filter((project) => typeof project === 'string') : [];
-}
-function recordValue(value) {
-    return isRecord(value) ? value : undefined;
-}
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
+    return parseStringArrayText(output) ?? [];
 }
 async function createGithubStatus(name, step) {
     await postGithubStatus(name, 'pending', `Running ${name}...`, step);

package/dist/github-ci/outputs.d.ts

@@ -0,0 +1,22 @@
+import { type ProjectTargets } from '../nx/index.js';
+export interface CollectedOutputFile {
+    project: string;
+    target: string;
+    output: string;
+    path: string;
+    size: number;
+    sha256: string;
+}
+export interface CollectedOutputsManifest {
+    version: 1;
+    sourceSha: string;
+    files: CollectedOutputFile[];
+}
+export interface NxTargetRun {
+    target: string;
+    projects: ProjectTargets[];
+}
+export declare function collectNxOutputs(root: string, destination: string, runs: NxTargetRun[], sourceSha: string): Promise<CollectedOutputsManifest>;
+export declare function applyCollectedOutputs(root: string, directories: string[], expectedSourceSha: string, projects?: ProjectTargets[]): Promise<void>;
+export declare function resolveDeclaredOutput(declaredOutput: string, project: ProjectTargets): string;
+//# sourceMappingURL=outputs.d.ts.map

package/dist/github-ci/outputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outputs.d.ts","sourceRoot":"","sources":["../../src/github-ci/outputs.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAWD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,WAAW,EAAE,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,wBAAwB,CAAC,CAgEnC;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,EACzB,QAAQ,CAAC,EAAE,cAAc,EAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CAqGf;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAa7F"}