@smoothbricks/cli 0.10.2 → 0.10.4

package/dist/wrangler/prepare-env.js

@@ -20,10 +20,78 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { $ } from 'bun';
 import { getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
-// ── runtime narrowing (wrangler JSON is external data — no casts) ─────────────
-export function isRecord(v) {
-    return typeof v === 'object' && v !== null && !Array.isArray(v);
-}
+import typia from 'typia';
+const isWranglerTomlRoot = (() => {
+    const _ip0 = input => undefined === input["binding"] || "string" === typeof input["binding"];
+    const _io0 = input => undefined === input.env || "object" === typeof input.env && null !== input.env && false === Array.isArray(input.env) && _io1(input.env);
+    const _io1 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return undefined === value || "object" === typeof value && null !== value && false === Array.isArray(value) && _io2(value);
+    });
+    const _io2 = input => (undefined === input.vars || "object" === typeof input.vars && null !== input.vars && false === Array.isArray(input.vars) && _io3(input.vars)) && (undefined === input.kv_namespaces || Array.isArray(input.kv_namespaces) && input.kv_namespaces.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io4(elem))) && (undefined === input.d1_databases || Array.isArray(input.d1_databases) && input.d1_databases.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io5(elem))) && Object.keys(input).every(key => {
+        if (["vars", "kv_namespaces", "d1_databases"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    const _io3 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    const _io4 = input => _ip0(input) && (undefined === input.id || "string" === typeof input.id);
+    const _io5 = input => _ip0(input) && (undefined === input.database_id || "string" === typeof input.database_id) && (undefined === input.database_name || "string" === typeof input.database_name);
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isWranglerEnvBlock = (() => {
+    const _ip0 = input => undefined === input["binding"] || "string" === typeof input["binding"];
+    const _io0 = input => (undefined === input.vars || "object" === typeof input.vars && null !== input.vars && false === Array.isArray(input.vars) && _io1(input.vars)) && (undefined === input.kv_namespaces || Array.isArray(input.kv_namespaces) && input.kv_namespaces.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io2(elem))) && (undefined === input.d1_databases || Array.isArray(input.d1_databases) && input.d1_databases.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io3(elem))) && Object.keys(input).every(key => {
+        if (["vars", "kv_namespaces", "d1_databases"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    const _io1 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    const _io2 = input => _ip0(input) && (undefined === input.id || "string" === typeof input.id);
+    const _io3 = input => _ip0(input) && (undefined === input.database_id || "string" === typeof input.database_id) && (undefined === input.database_name || "string" === typeof input.database_name);
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isWranglerKvRow = (() => {
+    const _io0 = input => (undefined === input.binding || "string" === typeof input.binding) && (undefined === input.id || "string" === typeof input.id);
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isWranglerD1Row = (() => {
+    const _io0 = input => (undefined === input.binding || "string" === typeof input.binding) && (undefined === input.database_id || "string" === typeof input.database_id) && (undefined === input.database_name || "string" === typeof input.database_name);
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isWranglerSecretRow = (() => {
+    const _io0 = input => undefined === input.name || "string" === typeof input.name;
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isKvNamespaceRow = (() => {
+    const _io0 = input => "string" === typeof input.id && "string" === typeof input.title;
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+const isD1DatabaseRow = (() => {
+    const _io0 = input => "string" === typeof input.uuid && "string" === typeof input.name;
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+const isShellErrorShape = (() => {
+    const _io0 = input => true && true;
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
 // ── wrangler.toml editors (CST: read via getStaticTOMLValue, write via
 // node-range splice — comment/format-preserving by construction, no regex) ─────
 /** All top-level tables (`[env.x]`, `[env.x.vars]`, `[[env.x.d1_databases]]`, …) — each carries `resolvedKey` (incl. array index). */
@@ -33,12 +101,11 @@ function tables(toml) {
 /** Whole doc as a JS object (comments/format dropped — reads only). */
 function tomlValue(toml) {
     const value = getStaticTOMLValue(parseTOML(toml));
-    return isRecord(value) ? value : {};
+    return isWranglerTomlRoot(value) ? value : {};
 }
 function envRecord(toml, env) {
-    const envs = tomlValue(toml).env;
-    const block = isRecord(envs) ? envs[env] : undefined;
-    return isRecord(block) ? block : null;
+    const block = tomlValue(toml).env?.[env];
+    return isWranglerEnvBlock(block) ? block : null;
 }
 function sameKey(a, b) {
     return a.length === b.length && a.every((x, i) => x === b[i]);
@@ -54,8 +121,13 @@ function kvIn(toml, table, key) {
 /** The `<field>` KV of the `[[env.<env>.<arrayKey>]]` table whose `binding` matches, or null. */
 function arrayTableKv(toml, env, arrayKey, binding, field) {
     const block = envRecord(toml, env);
-    const rows = isRecord(block) && Array.isArray(block[arrayKey]) ? block[arrayKey] : [];
-    const index = rows.findIndex((r) => isRecord(r) && r.binding === binding);
+    const rows = Array.isArray(block?.[arrayKey]) ? block[arrayKey] : [];
+    const index = rows.findIndex((row) => {
+        if (arrayKey === 'd1_databases') {
+            return isWranglerD1Row(row) && row.binding === binding;
+        }
+        return isWranglerKvRow(row) && row.binding === binding;
+    });
     if (index < 0)
         return null;
     const table = tables(toml).find((t) => t.kind === 'array' && sameKey(t.resolvedKey, ['env', env, arrayKey, index]));
@@ -72,7 +144,7 @@ function endOfLine(toml, offset) {
 /** First `[env.<name>]` (source order; also derived from a nested `[env.<name>.*]`), or null when no env declared. */
 export function firstWranglerEnv(toml) {
     const envs = tomlValue(toml).env;
-    if (!isRecord(envs))
+    if (!envs)
         return null;
     const [first] = Object.keys(envs);
     return first ?? null;
@@ -80,13 +152,11 @@ export function firstWranglerEnv(toml) {
 /** True if the toml declares `[env.<env>]` (or any `[env.<env>.*]` sub-table). */
 export function hasEnvBlock(toml, env) {
     const envs = tomlValue(toml).env;
-    return isRecord(envs) && env in envs;
+    return !!envs && env in envs;
 }
 /** A `[env.<env>.vars]` value, or null if unset/empty. Reads committed public config. */
 export function getVar(toml, env, name) {
-    const block = envRecord(toml, env);
-    const vars = isRecord(block?.vars) ? block.vars : {};
-    const value = vars[name];
+    const value = envRecord(toml, env)?.vars?.[name];
     return typeof value === 'string' && value ? value : null;
 }
 /** Set a `[env.<env>.vars]` value (JSON-encoded), preserving any trailing comment. Throws if the key is absent (scaffold first). */
@@ -99,10 +169,8 @@ export function setVar(toml, env, name, value) {
 }
 /** The id written for `[[env.<env>.kv_namespaces]]` binding, or null if absent/empty. */
 export function getKvId(toml, env, binding) {
-    const block = envRecord(toml, env);
-    const rows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
-    for (const row of rows) {
-        if (isRecord(row) && row.binding === binding && typeof row.id === 'string')
+    for (const row of envRecord(toml, env)?.kv_namespaces ?? []) {
+        if (row.binding === binding && typeof row.id === 'string')
             return row.id || null;
     }
     return null;
@@ -148,20 +216,16 @@ export function blankKvIds(toml, env) {
 }
 /** The database_id written for `[[env.<env>.d1_databases]]` binding, or null if absent/empty. */
 export function getD1Id(toml, env, binding) {
-    const block = envRecord(toml, env);
-    const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
-    for (const row of rows) {
-        if (isRecord(row) && row.binding === binding && typeof row.database_id === 'string')
+    for (const row of envRecord(toml, env)?.d1_databases ?? []) {
+        if (row.binding === binding && typeof row.database_id === 'string')
             return row.database_id || null;
     }
     return null;
 }
 /** The `database_name` for `[[env.<env>.d1_databases]]` binding, or null. Source of truth for which DB to create/reuse. */
 export function getD1Name(toml, env, binding) {
-    const block = envRecord(toml, env);
-    const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
-    for (const row of rows) {
-        if (isRecord(row) && row.binding === binding && typeof row.database_name === 'string')
+    for (const row of envRecord(toml, env)?.d1_databases ?? []) {
+        if (row.binding === binding && typeof row.database_name === 'string')
             return row.database_name || null;
     }
     return null;
@@ -222,12 +286,9 @@ export function parseDevVarsExample(text) {
 export function readManifest(root, env) {
     const toml = readFileSync(join(root, 'wrangler.toml'), 'utf8');
     const block = envRecord(toml, env);
-    const varsRec = isRecord(block?.vars) ? block.vars : {};
-    const vars = Object.keys(varsRec);
-    const kvRows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
-    const kvBindings = kvRows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
-    const d1Rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
-    const d1Bindings = d1Rows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
+    const vars = Object.keys(block?.vars ?? {});
+    const kvBindings = (block?.kv_namespaces ?? []).flatMap((row) => typeof row.binding === 'string' ? [row.binding] : []);
+    const d1Bindings = (block?.d1_databases ?? []).flatMap((row) => typeof row.binding === 'string' ? [row.binding] : []);
     const examplePath = join(root, '.dev.vars.example');
     const secrets = existsSync(examplePath) ? parseDevVarsExample(readFileSync(examplePath, 'utf8')) : [];
     return { kvBindings, d1Bindings, vars, secrets };
@@ -252,25 +313,19 @@ export function looksLikeFileSecret(name) {
 function asKvNamespaces(json) {
     if (!Array.isArray(json))
         return [];
-    const out = [];
-    for (const row of json) {
-        if (isRecord(row) && typeof row.id === 'string' && typeof row.title === 'string') {
-            out.push({ id: row.id, title: row.title });
-        }
-    }
-    return out;
+    return json.filter(isKvNamespaceRow);
 }
 function asSecretNames(json) {
     if (!Array.isArray(json))
         return [];
-    return json.flatMap((row) => (isRecord(row) && typeof row.name === 'string' ? [row.name] : []));
+    return json.flatMap((row) => (isWranglerSecretRow(row) && typeof row.name === 'string' ? [row.name] : []));
 }
 /** Best-effort ERROR line from a Bun ShellError (thrown on non-zero exit). */
 export function errText(err) {
-    if (!isRecord(err))
+    if (!isShellErrorShape(err))
         return 'unknown error';
-    const stderr = 'stderr' in err && err.stderr != null ? String(err.stderr) : '';
-    const exit = 'exitCode' in err ? String(err.exitCode) : '?';
+    const stderr = err.stderr != null ? String(err.stderr) : '';
+    const exit = err.exitCode != null ? String(err.exitCode) : '?';
     return stderr.split('\n').find((l) => l.includes('ERROR')) ?? `exit ${exit}`;
 }
 /** Live KV namespaces on the account (`kv namespace list` emits a pure JSON array); `[]` when offline/unauthenticated. */
@@ -305,13 +360,7 @@ async function reList(logical, cwd) {
 function asD1Databases(json) {
     if (!Array.isArray(json))
         return [];
-    const out = [];
-    for (const row of json) {
-        if (isRecord(row) && typeof row.uuid === 'string' && typeof row.name === 'string') {
-            out.push({ uuid: row.uuid, name: row.name });
-        }
-    }
-    return out;
+    return json.filter(isD1DatabaseRow);
 }
 /** Live D1 databases on the account (`d1 list --json`); `[]` when offline/unauthenticated. */
 export async function listD1Databases(cwd) {

package/dist/wrangler/scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/wrangler/scaffold.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAsMD,4FAA4F;AAC5F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CA6B7F"}
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/wrangler/scaffold.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAqMD,4FAA4F;AAC5F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CA8B7F"}

package/dist/wrangler/scaffold.js

@@ -6,26 +6,25 @@
  * .dev.vars.example), so it never drifts from what the worker declares.
  */
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join, relative } from 'node:path';
-import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { join } from 'node:path';
+import { ensureNx, ensureNxTargets, writeJsonObject } from '../lib/json.js';
 import { getWorkspacePackageManifests } from '../lib/workspace.js';
 /** Locate a workspace package by nx name, package name, or relative path; must have a wrangler.toml. */
 function resolveProject(root, project) {
     const manifests = getWorkspacePackageManifests(root);
     const match = manifests.find((m) => {
-        const nx = recordProperty(m.json, 'nx');
-        const nxName = nx && typeof nx.name === 'string' ? nx.name : null;
-        return nxName === project || m.name === project || relative(root, m.path) === project;
+        const nxName = m.json.nx?.name;
+        return nxName === project || m.name === project || m.path === project;
     });
     if (!match) {
-        const known = manifests.map((m) => recordProperty(m.json, 'nx')?.name ?? m.name).join(', ');
+        const known = manifests.map((m) => m.json.nx?.name ?? m.name).join(', ');
         throw new Error(`project "${project}" not found. Known: ${known}`);
     }
-    const dir = match.path; // WorkspacePackageManifest.path is absolute
+    const dir = join(root, match.path);
     if (!existsSync(join(dir, 'wrangler.toml'))) {
         throw new Error(`"${project}" has no wrangler.toml — not a wrangler project`);
     }
-    return { dir, label: relative(root, dir), packageJsonPath: match.packageJsonPath, json: match.json };
+    return { dir, label: match.path, packageJsonPath: match.packageJsonPath, json: match.json };
 }
 /** The generated starter script — generic, manifest-driven, prompt-batteries included. */
 function renderScript(projectName) {
@@ -213,13 +212,14 @@ export function scaffold(root, project, options = {}) {
     writeFileSync(scriptPath, renderScript(project));
     console.log(`${existed ? 'overwrote' : 'created'}      ${label}/scripts/prepare-env.ts`);
     // Wire the nx target (idempotent).
-    const nx = getOrCreateRecord(json, 'nx');
-    const targets = getOrCreateRecord(nx, 'targets');
-    if (!recordProperty(targets, 'prepare-env')) {
-        targets['prepare-env'] = {
+    const nx = ensureNx(json);
+    const targets = ensureNxTargets(nx);
+    if (!targets['prepare-env']) {
+        const prepareEnvTarget = {
             executor: 'nx:run-commands',
             options: { command: 'bun scripts/prepare-env.ts', cwd: '{projectRoot}' },
         };
+        targets['prepare-env'] = prepareEnvTarget;
         writeJsonObject(packageJsonPath, json);
         console.log(`updated       ${label}/package.json prepare-env target`);
     }

package/managed/raw/git-format-staged.yml

@@ -8,12 +8,16 @@ formatters:
       - '*.astro'
       - '!.*' # Exclude hidden files
 
-  # Biome for JS/TS/JSX/TSX/JSON/HTML/CSS/GraphQL files
+  # Biome for JS/TS family (including CommonJS/CTS and ESM .mjs/.mts)
   biome:
     command: "biome check --files-ignore-unknown=true --use-editorconfig=true '--stdin-file-path={}' --fix"
     patterns:
       - '*.js'
+      - '*.cjs'
+      - '*.mjs'
       - '*.ts'
+      - '*.cts'
+      - '*.mts'
       - '*.jsx'
       - '*.tsx'
       - '*.json'
@@ -30,7 +34,11 @@ formatters:
       - '*'
       # Exclude files handled by Biome
       - '!*.js'
+      - '!*.cjs'
+      - '!*.mjs'
       - '!*.ts'
+      - '!*.cts'
+      - '!*.mts'
       - '!*.jsx'
       - '!*.tsx'
       - '!*.json'
@@ -38,15 +46,25 @@ formatters:
       - '!*.html'
       - '!*.css'
       - '!*.graphql'
+      # Exclude files handled by rustfmt
+      - '!*.rs'
       # Exclude files handled by Alejandra
       - '!*.nix'
       # Bun lockfiles are generated and should not be rewritten by Prettier
       - '!bun.lock'
+      # Cargo lockfiles are generated and should not be rewritten by Prettier
+      - '!Cargo.lock'
       # Binary artifacts: Prettier reads them as UTF-8 and can corrupt them
       # by replacing invalid byte sequences.
       - '!*.wasm'
       - '!*.wasm.sha256'
 
+  # rustfmt for Rust files
+  rustfmt:
+    command: 'rustfmt --edition 2024'
+    patterns:
+      - '*.rs'
+
   # Alejandra for Nix files
   alejandra:
     command: 'alejandra'

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -46,6 +46,12 @@ install_devenv() {
 
 build_devenv_shell() {
   devenv shell --verbose -- date
+  # enterShell exports these for the bootstrap itself; persist them for the
+  # independent workflow step shells that run after this composite action.
+  if [ -n "${GITHUB_ENV:-}" ]; then
+    echo "TTSC_TSGO_BINARY=$repo_root/node_modules/@typescript/native/bin/tsc" >> "$GITHUB_ENV"
+    echo "TTSC_CACHE_DIR=$repo_root/.cache/ttsc" >> "$GITHUB_ENV"
+  fi
   # Add repo-local tools only after the shell exists; cleanup steps use an
   # explicit PATH because failures before this point must still refresh caches.
   add_repo_paths

package/managed/raw/tooling/direnv/merge-newer-pins.sh

@@ -4,9 +4,9 @@
 # Runtime version pins (nvfetcher overlay _sources/generated.{json,nix}) and the
 # devenv/flake lock (devenv.lock) frequently differ across branches or across a
 # mirror sync's `git am --3way`. Instead of stalling on a conflict, keep the
-# higher pin wholesale so the tree always converges to the newest runtime; the
-# next `devenv shell` then regenerates package.json engine/packageManager from
-# it (see monorepo/runtime.ts syncRootRuntimeVersions).
+# higher pin wholesale so the tree always converges to the newest runtime.
+# Repair package.json engine/packageManager pins explicitly with
+# `smoo monorepo init --runtime-only` when needed.
 #
 # Wired by `smoo` (managed .gitattributes -> merge=smoo-newer-pins, and
 # `git config merge.smoo-newer-pins.driver` installed by applyWorkspaceGitConfig).

package/managed/raw/tooling/direnv/setup-environment.ts

@@ -1,12 +1,26 @@
 #!/usr/bin/env bun
-import { existsSync } from 'node:fs';
-import { mkdir, rmdir } from 'node:fs/promises';
+import { existsSync, mkdirSync, readdirSync, readlinkSync, rmSync, symlinkSync } from 'node:fs';
+import { mkdir, rmdir, stat } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import path from 'node:path';
 import { $ } from 'bun';
 
 const devenvRoot = process.env.DEVENV_ROOT;
 const projectRoot = path.resolve(`${devenvRoot}/../..`);
-const startedWithoutNodeModules = !existsSync(path.join(projectRoot, 'node_modules'));
+
+// A legitimate concurrent setup finishes well within this; anything older is a
+// leftover from an interrupted run (CTRL-C/kill before the finally-cleanup) and
+// would otherwise wedge every future shell load behind the 120s spin + EEXIST.
+// NOTE: must be declared ABOVE the top-level setup block below — module consts
+// are not hoisted, and the lock loop runs during that block.
+const STALE_LOCK_MS = 10 * 60_000;
+// Unscoped require("typescript") must expose the TS6 compiler API for Nx.
+// @typescript/native installs another package also named "typescript" (TS7). Bun's
+// isolated linker often points node_modules/.bun/node_modules/typescript at TS7,
+// so packages resolved from the .bun store (nx) get version.cjs without readConfigFile.
+// After every install, force both unscoped typescript slots onto typescript@6.0.3.
+// Keep @typescript/native for ttsc via TTSC_TSGO_BINARY. See https://github.com/oven-sh/bun/issues/33834.
+const TYPESCRIPT_API_VERSION = '6.0.3';
 
 class CapturedCommandError extends Error {
   constructor(
@@ -23,7 +37,9 @@ class CapturedCommandError extends Error {
 process.chdir(projectRoot);
 
 try {
-  // Install dependencies first so node_modules/.bin tools are available
+  // Bootstrap only: install deps + wire local git hooks/config.
+  // Do not import workspace packages here — this script is what installs them,
+  // and package resolution/Typia transforms are not available yet.
   if (process.env.CI) {
     try {
       await runSetupCommand('bun install --frozen-lockfile', $`bun install --frozen-lockfile`, { quiet: false });
@@ -39,20 +55,9 @@ try {
     await installLocalDependencies();
   }
 
-  // Bun selects its resolver mode at process startup. If this process started
-  // before node_modules existed, imports below can stay in auto-install mode
-  // even after bun install succeeds, so restart once into the real workspace.
-  if (startedWithoutNodeModules) {
-    await runSetupCommand('restart setup-environment.ts', $`bun --no-install ${import.meta.path}`, { quiet: false });
-    process.exit(0);
-  }
-
-  if (!process.env.CI) {
-    const { syncRootRuntimeVersions } = await import('@smoothbricks/cli/monorepo/runtime');
-    await syncRootRuntimeVersions(projectRoot);
-  }
+  // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
+  ensureTypeScriptApiPackage(projectRoot);
 
-  const { applyWorkspaceGitConfig } = await import('@smoothbricks/cli/monorepo/git-config');
   await applyWorkspaceGitConfig(projectRoot);
 } catch (error) {
   if (error instanceof CapturedCommandError) {
@@ -67,12 +72,147 @@ try {
 }
 
 async function installLocalDependencies(): Promise<void> {
-  // Serialize concurrent direnv activations installing into the same node_modules.
+  // bun install runs the root prepare script. Multiple concurrent direnv
+  // activations can otherwise race while mutating the same files under
+  // node_modules.
   await withSetupLock(async () => {
     await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
   });
 }
 
+function ensureTypeScriptApiPackage(root: string): void {
+  const apiPackageRoot = findInstalledTypeScriptApiPackage(root);
+  if (!apiPackageRoot) {
+    throw new Error(
+      `typescript@${TYPESCRIPT_API_VERSION} was not installed under node_modules/.bun. ` +
+        `Keep root devDependency typescript@^${TYPESCRIPT_API_VERSION} (compiler API for Nx).`,
+    );
+  }
+
+  // Root bare require("typescript") and Bun store-local requires (nx lives under
+  // node_modules/.bun/...) must both see the API package — not @typescript/native's TS7.
+  forceSymlink(path.join(root, 'node_modules', 'typescript'), apiPackageRoot);
+  forceSymlink(path.join(root, 'node_modules', '.bun', 'node_modules', 'typescript'), apiPackageRoot);
+
+  assertTypescriptApiAt(path.join(root, 'node_modules', 'typescript'), apiPackageRoot);
+  assertTypescriptApiAt(path.join(root, 'node_modules', '.bun', 'node_modules', 'typescript'), apiPackageRoot);
+
+  const nativeBin = path.join(root, 'node_modules', '@typescript', 'native', 'bin', 'tsc');
+  if (!existsSync(nativeBin)) {
+    throw new Error(`Missing ${nativeBin}. @typescript/native must remain the TypeScript 7 native compiler for ttsc.`);
+  }
+}
+
+function findInstalledTypeScriptApiPackage(root: string): string | null {
+  const bunStore = path.join(root, 'node_modules', '.bun');
+  if (!existsSync(bunStore)) {
+    return null;
+  }
+  const exact = `typescript@${TYPESCRIPT_API_VERSION}`;
+  const names = readdirSync(bunStore)
+    .filter((name) => name === exact || name.startsWith(`${exact}+`) || name.startsWith('typescript@6.'))
+    .sort((a, b) => {
+      const aExact = a === exact || a.startsWith(`${exact}+`) ? 0 : 1;
+      const bExact = b === exact || b.startsWith(`${exact}+`) ? 0 : 1;
+      return aExact - bExact || a.localeCompare(b);
+    });
+  for (const name of names) {
+    const candidate = path.join(bunStore, name, 'node_modules', 'typescript');
+    if (existsSync(path.join(candidate, 'package.json'))) {
+      return candidate;
+    }
+  }
+  return null;
+}
+
+function forceSymlink(linkPath: string, targetPath: string): void {
+  mkdirSync(path.dirname(linkPath), { recursive: true });
+  const relativeTarget = path.relative(path.dirname(linkPath), targetPath);
+  let current: string | null = null;
+  try {
+    current = readlinkSync(linkPath);
+  } catch {
+    current = null;
+  }
+  if (
+    current === relativeTarget ||
+    (current !== null && path.resolve(path.dirname(linkPath), current) === targetPath)
+  ) {
+    return;
+  }
+  rmSync(linkPath, { recursive: true, force: true });
+  symlinkSync(relativeTarget, linkPath);
+}
+
+function assertTypescriptApiAt(typescriptRoot: string, expectedTarget: string): void {
+  if (!existsSync(typescriptRoot)) {
+    throw new Error(`Missing ${typescriptRoot} after linking TypeScript ${TYPESCRIPT_API_VERSION} API package`);
+  }
+  const requireFromInstall = createRequire(path.join(typescriptRoot, 'package.json'));
+  const typed = requireFromInstall(typescriptRoot) as { version?: string; readConfigFile?: unknown };
+  if (typeof typed.readConfigFile !== 'function' || typed.version !== TYPESCRIPT_API_VERSION) {
+    throw new Error(
+      `${typescriptRoot} must export TypeScript ${TYPESCRIPT_API_VERSION} compiler API (readConfigFile). ` +
+        `Resolved version ${typed.version ?? 'unknown'} (expected link target ${expectedTarget}). ` +
+        'Bun isolated linking often points .bun/node_modules/typescript at @typescript/native (TS7). ' +
+        'See https://github.com/oven-sh/bun/issues/33834.',
+    );
+  }
+}
+
+/**
+ * Keep git hook wiring local to bootstrap. Runtime pin sync
+ * (`syncRootRuntimeVersions`) belongs to explicit monorepo tooling after the
+ * package graph exists — not the installer.
+ */
+async function applyWorkspaceGitConfig(root: string): Promise<void> {
+  const gitDirResult = await $`git rev-parse --git-dir`.cwd(root).quiet().nothrow();
+  if (gitDirResult.exitCode !== 0) {
+    throw new Error('Not in a git repository');
+  }
+
+  const gitDir = path.resolve(root, new TextDecoder().decode(gitDirResult.stdout).trim());
+  const tooling = path.join(root, 'tooling');
+
+  await $`git config --local include.path ${path.join(tooling, 'workspace.gitconfig')}`.cwd(root);
+
+  // Keep the newer runtime version pins on any merge (nvfetcher overlay +
+  // devenv.lock) so a mirror sync's `git am --3way` never stalls on a version
+  // conflict. Mapped by the managed .gitattributes (merge=smoo-newer-pins);
+  // implemented in tooling/direnv/merge-newer-pins.sh.
+  await $`git config --local merge.smoo-newer-pins.name ${'keep the newer devenv/nvfetcher runtime pins'}`.cwd(root);
+  await $`git config --local merge.smoo-newer-pins.driver ${'bash tooling/direnv/merge-newer-pins.sh %O %A %B %P'}`.cwd(
+    root,
+  );
+  linkHook(gitDir, tooling, 'pre-commit');
+  linkHook(gitDir, tooling, 'commit-msg');
+}
+
+function linkHook(gitDir: string, tooling: string, name: string): void {
+  const source = path.join(tooling, 'git-hooks', `${name}.sh`);
+  if (!existsSync(source)) {
+    throw new Error(`Missing ${name} hook source: ${source}`);
+  }
+
+  const target = path.join(gitDir, 'hooks', name);
+  if (readLinkOrNull(target) === source) {
+    return;
+  }
+
+  console.log(`[!] Linking ${name} hook in ${gitDir}`);
+  mkdirSync(path.dirname(target), { recursive: true });
+  rmSync(target, { force: true });
+  symlinkSync(source, target);
+}
+
+function readLinkOrNull(hookPath: string): string | null {
+  try {
+    return readlinkSync(hookPath);
+  } catch {
+    return null;
+  }
+}
+
 async function runSetupCommand(
   command: string,
   shell: ReturnType<typeof $>,
@@ -104,14 +244,42 @@ async function acquireLock(lockDir: string): Promise<void> {
       await mkdir(lockDir, { recursive: false });
       return;
     } catch (error) {
-      if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST') || Date.now() > deadline) {
+      if (!isFileExistsError(error) || Date.now() > deadline) {
         throw error;
       }
+      if (await isStaleLock(lockDir)) {
+        // Surface the self-heal so an interrupted-run leftover is visible in
+        // the direnv log rather than silently absorbed.
+        console.error(`! Breaking stale setup lock (${lockDir}) left by an interrupted run`);
+        // Best-effort: if a concurrent process breaks it first, the rmdir
+        // fails silently and the next mkdir attempt settles the race.
+        await rmdir(lockDir).catch(() => undefined);
+        continue;
+      }
       await Bun.sleep(100);
     }
   }
 }
 
+async function isStaleLock(lockDir: string): Promise<boolean> {
+  try {
+    const info = await stat(lockDir);
+    return Date.now() - info.mtimeMs > STALE_LOCK_MS;
+  } catch (error) {
+    // Only "lock vanished" is expected here (a concurrent process released
+    // it); anything else must surface — a swallowed ReferenceError in this
+    // exact spot once disabled stale detection entirely.
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return false; // gone — let the mkdir retry acquire it
+    }
+    throw error;
+  }
+}
+
+function isFileExistsError(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'EEXIST';
+}
+
 function replayCapturedOutput(error: unknown): void {
   if (!(error instanceof CapturedCommandError)) {
     return;

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -9,12 +9,6 @@ set -e -o pipefail
 # Format exactly what is staged so the commit includes the formatter output.
 git-format-staged
 
-# Any `bun install` rewrites bun.lock workspace versions from package.json,
-# reverting the stable-tag versions the release flow syncs (see
-# packages/cli/src/monorepo/lockfile.ts). Self-heal here instead of failing a
-# later commit on drift it didn't cause.
-smoo monorepo sync-bun-lockfile-versions --stage
-
 # Adding a workspace package is rare and easy to leave half-wired. Run the
 # full monorepo validator only for newly staged package manifests.
 smoo monorepo validate --fail-fast --only-if-new-workspace-package