@smoothbricks/cli 0.10.2 → 0.10.4

package/src/monorepo/ci-workflow.ts

@@ -8,6 +8,8 @@ export enum CiWorkflowStepKind {
   Build = 'build',
   Lint = 'lint',
   UnitTests = 'unit-tests',
+  ManagedFilesCheck = 'managed-files-check',
+  ManagedFilesDispatch = 'managed-files-dispatch',
   Deploy = 'deploy',
   SaveNxCache = 'save-nx-cache',
   UploadTraceDbs = 'upload-trace-dbs',
@@ -37,6 +39,8 @@ export function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkfl
     { kind: CiWorkflowStepKind.Build, name: '🔨 Build' },
     { kind: CiWorkflowStepKind.Lint, name: '🔍 Lint' },
     { kind: CiWorkflowStepKind.UnitTests, name: '🧪 Unit Tests' },
+    { kind: CiWorkflowStepKind.ManagedFilesCheck, name: '🩺 Check managed-file drift' },
+    { kind: CiWorkflowStepKind.ManagedFilesDispatch, name: '🔁 Dispatch managed-file drift healing' },
   ];
   if (options.deploy) {
     steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Staging' });
@@ -64,7 +68,8 @@ ${renderYamlList(options.pushBranches, 6)}
   pull_request:
 
 permissions:
-  actions: read
+  # actions:write lets the drift step dispatch the managed-files workflow.
+  actions: write
   contents: read
   statuses: write
 
@@ -161,6 +166,27 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
       return nxSmartStep(step, 'lint', 'Lint');
     case CiWorkflowStepKind.UnitTests:
       return nxSmartStep(step, 'test', 'Unit Tests');
+    case CiWorkflowStepKind.ManagedFilesCheck:
+      // The authoritative drift check is nearly free here (devenv is already
+      // up). --warn never fails the job and publishes the step output
+      // `drifted=<count>` for the dispatch step below.
+      return [
+        `      - name: ${step.name}`,
+        '        id: managed-drift',
+        '        if:',
+        "          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',",
+        '          github.event.repository.default_branch) }}',
+        '        run: smoo monorepo check --warn',
+      ];
+    case CiWorkflowStepKind.ManagedFilesDispatch:
+      // Dispatches the managed-files workflow, which maintains the persistent
+      // review PR. workflow_dispatch is exempt from GitHub's GITHUB_TOKEN
+      // recursion guard, so the default token suffices.
+      return [
+        `      - name: ${step.name}`,
+        "        if: ${{ steps.managed-drift.outputs.drifted != '' && steps.managed-drift.outputs.drifted != '0' }}",
+        '        run: gh workflow run managed-files.yml --ref "$GITHUB_REF_NAME"',
+      ];
     case CiWorkflowStepKind.Deploy:
       return [
         `      - name: ${step.name}`,
@@ -181,7 +207,7 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
         '          path: |',
         '            .nx/cache',
         '            .nx/workspace-data/*.db*',
-        '          key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}',
+        '          key: ${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}',
       ];
     case CiWorkflowStepKind.UploadTraceDbs:
       return [

package/src/monorepo/git-config.ts

@@ -17,8 +17,8 @@ export async function applyWorkspaceGitConfig(root: string): Promise<void> {
   // Keep the newer runtime version pins on any merge (nvfetcher overlay +
   // devenv.lock) so a mirror sync's `git am --3way` never stalls on a version
   // conflict. Mapped by the managed .gitattributes (merge=smoo-newer-pins);
-  // implemented in tooling/direnv/merge-newer-pins.sh. The next `devenv shell`
-  // regenerates package.json fields from the resulting runtime.
+  // implemented in tooling/direnv/merge-newer-pins.sh. Runtime package.json
+  // pin repair is explicit via `smoo monorepo init --runtime-only`.
   await $`git config --local merge.smoo-newer-pins.name ${'keep the newer devenv/nvfetcher runtime pins'}`.cwd(root);
   await $`git config --local merge.smoo-newer-pins.driver ${'bash tooling/direnv/merge-newer-pins.sh %O %A %B %P'}`.cwd(
     root,

package/src/monorepo/index.ts

@@ -5,7 +5,7 @@ import { escapeRegex, getWorkspacePackages, getWorkspacePatterns, listReleasePac
 import { formatCommitMessage, validateCommitMessage } from './commit-msg.js';
 import { applyWorkspaceGitConfig } from './git-config.js';
 import { syncBunLockfileVersions } from './lockfile.js';
-import { applyManagedFiles, printResults } from './managed-files.js';
+import { applyManagedFiles, printResults, warnOnManagedFileDrift } from './managed-files.js';
 import { listValidCommitScopes, validatePublicTags } from './package-policy.js';
 import { runInitPacks, runValidatePacks } from './packs/index.js';
 import { syncRootRuntimeVersions } from './runtime.js';
@@ -78,7 +78,11 @@ export function updateManagedFiles(root: string): void {
   printResults(applyManagedFiles(root, 'update'));
 }
 
-export function checkManagedFiles(root: string): void {
+export function checkManagedFiles(root: string, options: { warn?: boolean } = {}): void {
+  if (options.warn === true) {
+    warnOnManagedFileDrift(root);
+    return;
+  }
   const results = applyManagedFiles(root, 'check');
   printResults(results);
   if (results.some((result) => result.action === 'drifted')) {

package/src/monorepo/lockfile.test.ts

@@ -17,15 +17,6 @@ function git(root: string, args: string): string {
   return execSync(`git ${args}`, {
     cwd: root,
     encoding: 'utf8',
-    env: {
-      ...process.env,
-      GIT_CONFIG_GLOBAL: '/dev/null',
-      GIT_CONFIG_SYSTEM: '/dev/null',
-      GIT_AUTHOR_NAME: 'fixture',
-      GIT_AUTHOR_EMAIL: 'fixture@invalid',
-      GIT_COMMITTER_NAME: 'fixture',
-      GIT_COMMITTER_EMAIL: 'fixture@invalid',
-    },
     stdio: ['pipe', 'pipe', 'pipe'],
   });
 }
@@ -40,6 +31,9 @@ function makeFixtureRepo(options: FixtureOptions): string {
   const root = mkdtempSync(join(tmpdir(), 'smoo-lockfile-'));
   cleanupRoots.push(root);
   git(root, 'init -q');
+  // Local identity only — CI runners have no global git user.
+  git(root, 'config user.name Test');
+  git(root, 'config user.email test@example.com');
   git(root, 'commit -q --allow-empty -m init');
   writeFileSync(
     join(root, 'package.json'),
@@ -56,8 +50,8 @@ function makeFixtureRepo(options: FixtureOptions): string {
 
 function writeFixturePackage(root: string, version: string): void {
   writeFileSync(
-    join(root, 'packages', 'foo', 'package.json'),
-    JSON.stringify({ name: '@fixture/foo', version, nx: { name: 'foo' } }),
+    join(root, 'packages/foo/package.json'),
+    `${JSON.stringify({ name: '@fixture/foo', version, private: false, nx: { name: 'foo' } }, null, 2)}\n`,
   );
 }
 
@@ -71,9 +65,9 @@ function writeFixtureLock(root: string, version: string): void {
       '    "": { "name": "fixture-root" },',
       '    "packages/foo": {',
       '      "name": "@fixture/foo",',
-      `      "version": "${version}",`,
-      '    },',
-      '  },',
+      `      "version": "${version}"`,
+      '    }',
+      '  }',
       '}',
       '',
     ].join('\n'),
@@ -87,59 +81,64 @@ function lockVersionIn(root: string): string {
 }
 
 describe('bun.lock workspace version sync', () => {
-  it('a bun-install revert of the release-synced version fails validation', () => {
-    // The b3298fc4c shape: package.json holds the next prerelease, a stable tag
-    // exists, and `bun install` rewrote the lockfile back to the prerelease.
+  it('install validate requires lockfile ≡ package.json including -next', () => {
     const root = makeFixtureRepo({
       packageVersion: '0.1.3-next.0',
-      lockVersion: '0.1.3-next.0',
+      lockVersion: '0.1.2',
       stableTag: 'foo@0.1.2',
     });
     expect(validateBunLockfileVersions(root)).toBe(1);
   });
 
-  it('sync restores the latest stable tag version and validation passes', () => {
+  it('install mode sync restores package.json -next for frozen CI', () => {
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.2',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(syncBunLockfileVersions(root, { log: false, mode: 'install' })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.3-next.0');
+    expect(validateBunLockfileVersions(root)).toBe(0);
+  });
+
+  it('publish mode rewrites unpublished -next to last stable tag for pack', () => {
     const root = makeFixtureRepo({
       packageVersion: '0.1.3-next.0',
       lockVersion: '0.1.3-next.0',
       stableTag: 'foo@0.1.2',
     });
-    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
-    expect(lockVersionIn(root)).toBe('0.1.2');
+    // Install/CI is happy with -next matching package.json.
     expect(validateBunLockfileVersions(root)).toBe(0);
+    // Pre-publish rewrite embeds last stable for bun pm pack.
+    expect(syncBunLockfileVersions(root, { log: false, mode: 'publish' })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.2');
   });
 
-  it('a never-published prerelease package falls back to its manifest version', () => {
-    // The new-workspace-package shape (e.g. cowshed): no stable tag exists yet.
+  it('never-published prerelease keeps package.json version in both modes', () => {
     const root = makeFixtureRepo({ packageVersion: '0.2.0-next.0', lockVersion: '0.2.0-next.0' });
     expect(validateBunLockfileVersions(root)).toBe(0);
-    expect(syncBunLockfileVersions(root, { log: false })).toBe(0);
+    expect(syncBunLockfileVersions(root, { log: false, mode: 'install' })).toBe(0);
+    expect(syncBunLockfileVersions(root, { log: false, mode: 'publish' })).toBe(0);
   });
 
-  it('a stable manifest version is required verbatim in the lockfile', () => {
+  it('stable manifest version is required verbatim', () => {
     const root = makeFixtureRepo({ packageVersion: '0.1.0', lockVersion: '0.0.9' });
     expect(validateBunLockfileVersions(root)).toBe(1);
-    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
+    expect(syncBunLockfileVersions(root, { log: false, mode: 'install' })).toBe(1);
     expect(lockVersionIn(root)).toBe('0.1.0');
   });
 
   it('stage: true stages the healed bun.lock', () => {
     const root = makeFixtureRepo({
       packageVersion: '0.1.3-next.0',
-      lockVersion: '0.1.3-next.0',
+      lockVersion: '0.1.2',
       stableTag: 'foo@0.1.2',
     });
-    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(1);
+    expect(syncBunLockfileVersions(root, { log: false, mode: 'install', stage: true })).toBe(1);
     expect(git(root, 'diff --cached --name-only')).toContain('bun.lock');
   });
 
-  it('stage: true leaves a clean lockfile unstaged', () => {
-    const root = makeFixtureRepo({ packageVersion: '0.1.2', lockVersion: '0.1.2', stableTag: 'foo@0.1.2' });
-    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(0);
-    expect(git(root, 'diff --cached --name-only').trim()).toBe('');
-  });
-
-  it('property: after sync, validation always passes', () => {
+  it('property: after install-mode sync, validation always passes', () => {
     const version = fc
       .tuple(fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.option(fc.nat({ max: 5 })))
       .map(([major, minor, patch, next]) => `${major}.${minor}.${patch}${next === null ? '' : `-next.${next}`}`);
@@ -148,7 +147,7 @@ describe('bun.lock workspace version sync', () => {
       fc.property(version, version, (packageVersion, lockVersion) => {
         writeFixturePackage(root, packageVersion);
         writeFixtureLock(root, lockVersion);
-        syncBunLockfileVersions(root, { log: false });
+        syncBunLockfileVersions(root, { log: false, mode: 'install' });
         return validateBunLockfileVersions(root) === 0;
       }),
       { numRuns: 25 },

package/src/monorepo/lockfile.ts

@@ -5,27 +5,36 @@ import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
 
 export interface SyncBunLockfileVersionsOptions {
   log?: boolean;
-  /** `git add` bun.lock after rewriting it, for the pre-commit self-heal path. */
+  /** `git add` bun.lock when versions were resynced. */
   stage?: boolean;
+  /**
+   * `install` (default for validation): lockfile must match package.json.
+   * `publish`: rewrite unpublished prerelease package.json versions to the last
+   * stable git tag so `bun pm pack` embeds installable dependency versions.
+   */
+  mode?: 'install' | 'publish';
 }
 
-// Temporary Bun workaround. Delete this sync function, validateBunLockfileVersions,
-// the `smoo monorepo sync-bun-lockfile-versions` command, and the matching Nx
-// versionActions hook once supported Bun versions stop leaving workspace package
-// versions stale in bun.lock after manifest bumps. Until then, `bun pm pack`
-// rewrites `workspace:*` dependencies using those stale lockfile versions instead
-// of the current package.json versions. Track removal against:
+// Temporary Bun workaround. Delete once supported Bun versions stop leaving
+// workspace package versions stale in bun.lock after manifest bumps, and stop
+// resolving `workspace:*` from the lockfile during `bun pm pack`:
 // - https://github.com/oven-sh/bun/issues/18906
 // - https://github.com/oven-sh/bun/issues/20477
 // - https://github.com/oven-sh/bun/issues/20829
 //
-// Any `bun install` rewrites the workspace versions from package.json, reverting
-// this sync between releases. The pre-commit hook therefore runs
-// `smoo monorepo sync-bun-lockfile-versions --stage` on every commit so drift is
-// healed at the commit that would otherwise carry it — validation must never
-// fail a committer for drift a routine `bun install` introduced.
+// Two modes, because one lockfile serves two jobs:
+//
+// 1) install / frozen CI  → lockfile ≡ package.json (including -next)
+// 2) pre-publish pack    → for package.json prereleases that were never published
+//                          (post-release "prepare next"), lockfile entry := last
+//                          stable tag so a releasing package does not embed an
+//                          unpublished -next dependency version.
+//
+// Do not run publish-mode rewrite in day-to-day validate or pre-commit: bun install
+// rewrites lockfile back to package.json and frozen CI then fails.
 export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVersionsOptions = {}): number {
   const log = options.log ?? true;
+  const mode = options.mode ?? 'publish';
   const lockfilePath = join(root, 'bun.lock');
   if (!existsSync(lockfilePath)) {
     throw new Error('bun.lock not found');
@@ -34,13 +43,7 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   let lockfile = readFileSync(lockfilePath, 'utf8');
   let updated = 0;
   for (const pkg of packages) {
-    // If the package.json version is a prerelease (e.g. 0.2.2-next.0) it may
-    // never have been published.  Use the latest stable git tag version so
-    // that `bun pm pack` writes an installable dependency range for consumers.
-    const targetVersion = pkg.version.includes('-')
-      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
-      : pkg.version;
-
+    const targetVersion = lockfileTargetVersion(root, pkg.projectName, pkg.version, mode);
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -60,7 +63,10 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
     }
     lockfile = lockfile.replace(pattern, `$1${targetVersion}$3`);
     if (log) {
-      const suffix = targetVersion !== pkg.version ? ` (latest stable tag; package.json has ${pkg.version})` : '';
+      const suffix =
+        mode === 'publish' && targetVersion !== pkg.version
+          ? ` (latest stable tag; package.json has ${pkg.version})`
+          : '';
       console.log(`fix:  ${relativePath}: ${lockVersion} -> ${targetVersion}${suffix}`);
     }
     updated++;
@@ -81,6 +87,7 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   return updated;
 }
 
+/** Install/CI invariant: bun.lock workspace versions match package.json. */
 export function validateBunLockfileVersions(root: string): number {
   const lockfilePath = join(root, 'bun.lock');
   if (!existsSync(lockfilePath)) {
@@ -91,10 +98,7 @@ export function validateBunLockfileVersions(root: string): number {
   const lockfile = readFileSync(lockfilePath, 'utf8');
   let failures = 0;
   for (const pkg of packages) {
-    const targetVersion = pkg.version.includes('-')
-      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
-      : pkg.version;
-
+    const targetVersion = pkg.version;
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -116,6 +120,26 @@ export function validateBunLockfileVersions(root: string): number {
   return failures;
 }
 
+/**
+ * Version Bun should embed for a workspace dependency when packing for publish.
+ * Unpublished package.json prereleases (prepare-next) map to the last stable tag.
+ */
+export function publishPackDependencyVersion(root: string, projectName: string, packageVersion: string): string {
+  return lockfileTargetVersion(root, projectName, packageVersion, 'publish');
+}
+
+function lockfileTargetVersion(
+  root: string,
+  projectName: string,
+  packageVersion: string,
+  mode: 'install' | 'publish',
+): string {
+  if (mode === 'install' || !packageVersion.includes('-')) {
+    return packageVersion;
+  }
+  return latestStableTagVersion(root, projectName) ?? packageVersion;
+}
+
 function latestStableTagVersion(root: string, projectName: string): string | null {
   try {
     const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {

package/src/monorepo/managed-files.test.ts

@@ -1,16 +1,31 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are asserted literally. */
 import { describe, expect, it } from 'bun:test';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { LINUX_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import fc from 'fast-check';
 import {
   extractInlineLocalBlocksForTest,
   INLINE_LOCAL_BEGIN,
   INLINE_LOCAL_END,
   LOCAL_SECTION_MARKER,
+  platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
   splitLocalSectionForTest,
 } from './managed-files.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
 
+const REPO_ROOT = join(import.meta.dir, '..', '..', '..', '..');
+const ARCHITECTURE_SCOPED_PREFIX = '${{ runner.os }}-${{ runner.arch }}-';
+const NODE_MODULES_CACHE_KEY = "${{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}";
+const CACHE_ACTIONS = [
+  { name: 'cache-nix-devenv', osKeyLines: 6 },
+  { name: 'cache-node-modules', osKeyLines: 2 },
+  { name: 'cache-ttsc-plugins', osKeyLines: 2 },
+  { name: 'cache-nx', osKeyLines: 2 },
+] as const;
+
 describe('managed-file local sections', () => {
   it('content without a marker is entirely managed', () => {
     const { managed, localTail } = splitLocalSectionForTest(MANAGED);
@@ -139,3 +154,51 @@ describe('managed-file inline local blocks', () => {
     );
   });
 });
+
+describe('managed publish platform discovery', () => {
+  it('returns canonical target families from resolved target names without leaking project names', () => {
+    const discovered = platformTargetGlobsForTest(['build', 'bundle-linux', 'package-macos', 'simulator-ios', 'test']);
+
+    expect(discovered).toEqual([...PLATFORM_TARGET_GLOBS]);
+    expect(discovered).not.toContain('native-app');
+  });
+
+  it('selects only supplemental Linux when resolved metadata has no Apple targets', () => {
+    expect(platformTargetGlobsForTest(['build', 'bundle-linux', 'test'])).toEqual([...LINUX_PLATFORM_TARGET_GLOBS]);
+  });
+
+  it('returns no platform families for ordinary Nx targets', () => {
+    expect(platformTargetGlobsForTest(['build', 'lint', 'test', 'typecheck'])).toEqual([]);
+  });
+});
+
+describe('managed cache actions', () => {
+  it('renders the checked-in action copies from their managed templates', async () => {
+    for (const action of CACHE_ACTIONS) {
+      const [template, generated] = await Promise.all([
+        readFile(
+          join(REPO_ROOT, 'packages', 'cli', 'managed', 'templates', 'github', 'actions', action.name, 'action.yml'),
+          'utf8',
+        ),
+        readFile(join(REPO_ROOT, '.github', 'actions', action.name, 'action.yml'), 'utf8'),
+      ]);
+
+      expect(generated).toBe(template.replace('{{NODE_MODULES_CACHE_KEY}}', NODE_MODULES_CACHE_KEY));
+    }
+  });
+
+  it('scopes every primary, restore, and save key to the runner OS and architecture', async () => {
+    for (const action of CACHE_ACTIONS) {
+      for (const actionRoot of [
+        join(REPO_ROOT, 'packages', 'cli', 'managed', 'templates', 'github', 'actions'),
+        join(REPO_ROOT, '.github', 'actions'),
+      ]) {
+        const content = await readFile(join(actionRoot, action.name, 'action.yml'), 'utf8');
+        const osKeyLines = content.split('\n').filter((line) => line.includes('${{ runner.os }}'));
+
+        expect(osKeyLines).toHaveLength(action.osKeyLines);
+        expect(osKeyLines.every((line) => line.includes(ARCHITECTURE_SCOPED_PREFIX))).toBe(true);
+      }
+    }
+  });
+});

package/src/monorepo/managed-files.ts

@@ -1,7 +1,9 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
+import { type PackageJson, parseNxProjectJsonText, parseStringArrayText } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -137,6 +139,7 @@ interface ManagedFileContext {
   ciPushBranches: string[];
   nodeModulesCacheKey: string;
   repoName: string;
+  platformTargetGlobs: string[];
 }
 
 interface DeployTargetInfo {
@@ -207,6 +210,11 @@ const managedFiles: ManagedFile[] = [
     target: '.github/workflows/publish.yml',
     releasePackagesOnly: true,
   },
+  {
+    kind: 'template',
+    source: 'github/workflows/managed-files.yml',
+    target: '.github/workflows/managed-files.yml',
+  },
   {
     kind: 'template',
     source: 'github/actions/cache-nix-devenv/action.yml',
@@ -227,6 +235,11 @@ const managedFiles: ManagedFile[] = [
     source: 'github/actions/cache-node-modules/action.yml',
     target: '.github/actions/cache-node-modules/action.yml',
   },
+  {
+    kind: 'template',
+    source: 'github/actions/cache-ttsc-plugins/action.yml',
+    target: '.github/actions/cache-ttsc-plugins/action.yml',
+  },
   {
     kind: 'template',
     source: 'github/actions/cache-nx/action.yml',
@@ -295,6 +308,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deploy: context.hasProductionDeployTargets,
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
+        platformTargetGlobs: context.platformTargetGlobs,
       });
     }
     throw new Error(`Unknown generated managed file source ${file.source}`);
@@ -314,6 +328,7 @@ function getManagedFileContext(root: string): ManagedFileContext {
   const ciPushBranches = getCiPushBranches(packageJson?.json);
   const stagingDeploy = getDeployTargetInfo(root, 'staging');
   const productionDeploy = getDeployTargetInfo(root, 'production');
+  const platformTargetGlobs = platformTargetGlobsForTest(readResolvedNxTargetNames(root));
   const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
     ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
     : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
@@ -326,9 +341,46 @@ function getManagedFileContext(root: string): ManagedFileContext {
     ciPushBranches,
     nodeModulesCacheKey,
     repoName,
+    platformTargetGlobs,
   };
 }
 
+export function platformTargetGlobsForTest(targetNames: Iterable<string>): string[] {
+  const names = [...targetNames];
+  return PLATFORM_TARGET_GLOBS.filter((glob) => {
+    const suffix = glob.startsWith('*') ? glob.slice(1) : glob;
+    return names.some((name) => name.endsWith(suffix));
+  });
+}
+
+function readResolvedNxTargetNames(root: string): string[] {
+  const output = execFileSync('nx', ['show', 'projects', '--json'], {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const projects = parseStringArrayText(output);
+  if (!projects) {
+    return [];
+  }
+  const targetNames = new Set<string>();
+  for (const project of projects) {
+    const projectOutput = execFileSync('nx', ['show', 'project', project, '--json'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    const projectJson = parseNxProjectJsonText(projectOutput);
+    const targets = projectJson?.targets;
+    if (targets) {
+      for (const targetName of Object.keys(targets)) {
+        targetNames.add(targetName);
+      }
+    }
+  }
+  return [...targetNames];
+}
+
 function renderTemplate(context: ManagedFileContext, template: string): string {
   return template
     .replaceAll('{{REPO_NAME}}', context.repoName)
@@ -342,8 +394,8 @@ function getDeployTargetInfo(root: string, configuration: string): DeployTargetI
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'inherit'],
   });
-  const projects: unknown = JSON.parse(output);
-  if (!Array.isArray(projects) || !projects.every((project) => typeof project === 'string')) {
+  const projects = parseStringArrayText(output);
+  if (!projects) {
     return { exists: false };
   }
   let exists = false;
@@ -365,47 +417,25 @@ function nxDeployTarget(root: string, project: string, configuration: string): D
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'inherit'],
   });
-  const parsed: unknown = JSON.parse(output);
-  const projectJson = recordValue(parsed);
-  const targets = recordValue(projectJson?.targets);
-  const deploy = recordValue(targets?.deploy);
-  const configurations = recordValue(deploy?.configurations);
-  const config = recordValue(configurations?.[configuration]);
+  const projectJson = parseNxProjectJsonText(output);
+  const deploy = projectJson?.targets?.deploy;
+  const config = deploy?.configurations?.[configuration];
   if (!config) {
     return { exists: false };
   }
-  const command = deployCommand(deploy, config);
+  const commandValue = config.command ?? config.options?.command ?? deploy?.options?.command;
+  const command = typeof commandValue === 'string' ? commandValue : '';
   return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }
 
-function deployCommand(deploy: Record<string, unknown> | undefined, config: Record<string, unknown>): string {
-  const command = stringValue(config.command) ?? stringValue(recordValue(config.options)?.command);
-  return command ?? stringValue(recordValue(deploy?.options)?.command) ?? '';
-}
-
-function stringValue(value: unknown): string | undefined {
-  return typeof value === 'string' ? value : undefined;
-}
-
-function getCiPushBranches(packageJson: unknown): string[] {
+function getCiPushBranches(packageJson: PackageJson | null | undefined): string[] {
   const configured = readCiPushBranches(packageJson);
   return configured.length > 0 ? configured : ['main'];
 }
 
-function readCiPushBranches(packageJson: unknown): string[] {
-  const rootPackage = recordValue(packageJson);
-  const smoo = recordValue(rootPackage?.smoo);
-  const github = recordValue(smoo?.github);
-  const branches = Array.isArray(github?.pushBranches) ? github.pushBranches : [];
-  return branches.filter((branch): branch is string => typeof branch === 'string' && branch.length > 0);
-}
-
-function recordValue(value: unknown): Record<string, unknown> | undefined {
-  return isRecord(value) ? value : undefined;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === 'object' && !Array.isArray(value);
+function readCiPushBranches(packageJson: PackageJson | null | undefined): string[] {
+  const branches = packageJson?.smoo?.github?.pushBranches ?? [];
+  return branches.filter((branch) => branch.length > 0);
 }
 
 function renderYamlFlowList(values: string[]): string {
@@ -432,3 +462,33 @@ export function validateManagedFiles(root: string): number {
   }
   return failures;
 }
+
+/**
+ * Non-blocking drift report: prints the per-file table and surfaces drift as
+ * GitHub Actions warning annotations (plain stderr elsewhere) without failing
+ * the run. Managed-file drift is derived state with its own remediation flow
+ * (the persistent managed-files PR); only `monorepo check` without --warn and
+ * PR-scoped gates treat it as an error.
+ *
+ * Under GitHub Actions the drifted-file count is published as the step output
+ * `drifted`, so downstream steps gate declaratively instead of parsing logs.
+ */
+export function warnOnManagedFileDrift(root: string): void {
+  const results = applyManagedFiles(root, 'check');
+  printResults(results);
+  const drifted = results.filter((result) => result.action === 'drifted');
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `drifted=${drifted.length}\n`);
+  }
+  if (drifted.length === 0) {
+    return;
+  }
+  if (process.env.GITHUB_ACTIONS === 'true') {
+    for (const result of drifted) {
+      console.log(
+        `::warning title=Managed file drift::${result.target} drifted from the @smoothbricks/cli template; run 'smoo monorepo update'`,
+      );
+    }
+  }
+  console.error(`${drifted.length} managed monorepo file(s) drifted (non-blocking). Run: smoo monorepo update`);
+}