@smoothbricks/cli 0.10.2 → 0.10.4

package/dist/monorepo/managed-files.js

@@ -1,7 +1,9 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
+import { parseNxProjectJsonText, parseStringArrayText } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -155,6 +157,11 @@ const managedFiles = [
         target: '.github/workflows/publish.yml',
         releasePackagesOnly: true,
     },
+    {
+        kind: 'template',
+        source: 'github/workflows/managed-files.yml',
+        target: '.github/workflows/managed-files.yml',
+    },
     {
         kind: 'template',
         source: 'github/actions/cache-nix-devenv/action.yml',
@@ -175,6 +182,11 @@ const managedFiles = [
         source: 'github/actions/cache-node-modules/action.yml',
         target: '.github/actions/cache-node-modules/action.yml',
     },
+    {
+        kind: 'template',
+        source: 'github/actions/cache-ttsc-plugins/action.yml',
+        target: '.github/actions/cache-ttsc-plugins/action.yml',
+    },
     {
         kind: 'template',
         source: 'github/actions/cache-nx/action.yml',
@@ -234,6 +246,7 @@ function getManagedContent(file, context) {
                 deploy: context.hasProductionDeployTargets,
                 deployProvider: context.productionDeployProvider,
                 repoName: context.repoName,
+                platformTargetGlobs: context.platformTargetGlobs,
             });
         }
         throw new Error(`Unknown generated managed file source ${file.source}`);
@@ -252,6 +265,7 @@ function getManagedFileContext(root) {
     const ciPushBranches = getCiPushBranches(packageJson?.json);
     const stagingDeploy = getDeployTargetInfo(root, 'staging');
     const productionDeploy = getDeployTargetInfo(root, 'production');
+    const platformTargetGlobs = platformTargetGlobsForTest(readResolvedNxTargetNames(root));
     const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
         ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
         : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
@@ -264,8 +278,43 @@ function getManagedFileContext(root) {
         ciPushBranches,
         nodeModulesCacheKey,
         repoName,
+        platformTargetGlobs,
     };
 }
+export function platformTargetGlobsForTest(targetNames) {
+    const names = [...targetNames];
+    return PLATFORM_TARGET_GLOBS.filter((glob) => {
+        const suffix = glob.startsWith('*') ? glob.slice(1) : glob;
+        return names.some((name) => name.endsWith(suffix));
+    });
+}
+function readResolvedNxTargetNames(root) {
+    const output = execFileSync('nx', ['show', 'projects', '--json'], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    const projects = parseStringArrayText(output);
+    if (!projects) {
+        return [];
+    }
+    const targetNames = new Set();
+    for (const project of projects) {
+        const projectOutput = execFileSync('nx', ['show', 'project', project, '--json'], {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'inherit'],
+        });
+        const projectJson = parseNxProjectJsonText(projectOutput);
+        const targets = projectJson?.targets;
+        if (targets) {
+            for (const targetName of Object.keys(targets)) {
+                targetNames.add(targetName);
+            }
+        }
+    }
+    return [...targetNames];
+}
 function renderTemplate(context, template) {
     return template
         .replaceAll('{{REPO_NAME}}', context.repoName)
@@ -278,8 +327,8 @@ function getDeployTargetInfo(root, configuration) {
         encoding: 'utf8',
         stdio: ['ignore', 'pipe', 'inherit'],
     });
-    const projects = JSON.parse(output);
-    if (!Array.isArray(projects) || !projects.every((project) => typeof project === 'string')) {
+    const projects = parseStringArrayText(output);
+    if (!projects) {
         return { exists: false };
     }
     let exists = false;
@@ -300,41 +349,23 @@ function nxDeployTarget(root, project, configuration) {
         encoding: 'utf8',
         stdio: ['ignore', 'pipe', 'inherit'],
     });
-    const parsed = JSON.parse(output);
-    const projectJson = recordValue(parsed);
-    const targets = recordValue(projectJson?.targets);
-    const deploy = recordValue(targets?.deploy);
-    const configurations = recordValue(deploy?.configurations);
-    const config = recordValue(configurations?.[configuration]);
+    const projectJson = parseNxProjectJsonText(output);
+    const deploy = projectJson?.targets?.deploy;
+    const config = deploy?.configurations?.[configuration];
     if (!config) {
         return { exists: false };
     }
-    const command = deployCommand(deploy, config);
+    const commandValue = config.command ?? config.options?.command ?? deploy?.options?.command;
+    const command = typeof commandValue === 'string' ? commandValue : '';
     return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }
-function deployCommand(deploy, config) {
-    const command = stringValue(config.command) ?? stringValue(recordValue(config.options)?.command);
-    return command ?? stringValue(recordValue(deploy?.options)?.command) ?? '';
-}
-function stringValue(value) {
-    return typeof value === 'string' ? value : undefined;
-}
 function getCiPushBranches(packageJson) {
     const configured = readCiPushBranches(packageJson);
     return configured.length > 0 ? configured : ['main'];
 }
 function readCiPushBranches(packageJson) {
-    const rootPackage = recordValue(packageJson);
-    const smoo = recordValue(rootPackage?.smoo);
-    const github = recordValue(smoo?.github);
-    const branches = Array.isArray(github?.pushBranches) ? github.pushBranches : [];
-    return branches.filter((branch) => typeof branch === 'string' && branch.length > 0);
-}
-function recordValue(value) {
-    return isRecord(value) ? value : undefined;
-}
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
+    const branches = packageJson?.smoo?.github?.pushBranches ?? [];
+    return branches.filter((branch) => branch.length > 0);
 }
 function renderYamlFlowList(values) {
     return JSON.stringify(values);
@@ -357,3 +388,30 @@ export function validateManagedFiles(root) {
     }
     return failures;
 }
+/**
+ * Non-blocking drift report: prints the per-file table and surfaces drift as
+ * GitHub Actions warning annotations (plain stderr elsewhere) without failing
+ * the run. Managed-file drift is derived state with its own remediation flow
+ * (the persistent managed-files PR); only `monorepo check` without --warn and
+ * PR-scoped gates treat it as an error.
+ *
+ * Under GitHub Actions the drifted-file count is published as the step output
+ * `drifted`, so downstream steps gate declaratively instead of parsing logs.
+ */
+export function warnOnManagedFileDrift(root) {
+    const results = applyManagedFiles(root, 'check');
+    printResults(results);
+    const drifted = results.filter((result) => result.action === 'drifted');
+    if (process.env.GITHUB_OUTPUT) {
+        appendFileSync(process.env.GITHUB_OUTPUT, `drifted=${drifted.length}\n`);
+    }
+    if (drifted.length === 0) {
+        return;
+    }
+    if (process.env.GITHUB_ACTIONS === 'true') {
+        for (const result of drifted) {
+            console.log(`::warning title=Managed file drift::${result.target} drifted from the @smoothbricks/cli template; run 'smoo monorepo update'`);
+        }
+    }
+    console.error(`${drifted.length} managed monorepo file(s) drifted (non-blocking). Run: smoo monorepo update`);
+}

package/dist/monorepo/package-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-policy.d.ts","sourceRoot":"","sources":["../../src/monorepo/package-policy.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAGL,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+CAA+C,CAAC;AA6BvD,YAAY,EAAE,0BAA0B,IAAI,iCAAiC,EAAE,sBAAsB,EAAE,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,CAAC;AAYhE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAI/D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAuB1D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMxD;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAuC7D;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,IAAI,CAwB7G;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzD;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAoB7D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAEvE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAezD;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsC9D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW5D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyB3D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcvD;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0DlE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAiC5G"}
+{"version":3,"file":"package-policy.d.ts","sourceRoot":"","sources":["../../src/monorepo/package-policy.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAGL,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,+CAA+C,CAAC;AAoCvD,YAAY,EAAE,0BAA0B,IAAI,iCAAiC,EAAE,sBAAsB,EAAE,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,CAAC;AAYhE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAI/D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAuB1D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMxD;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA0C7D;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,IAAI,CAwB7G;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzD;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAoB7D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAEvE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAczD;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsC9D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW5D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwB3D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcvD;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgElE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAkC5G"}

package/dist/monorepo/package-policy.js

@@ -4,7 +4,7 @@ import { applyPackageTargetPolicy, checkPackageTargetPolicy, } from '@smoothbric
 import { applyReleaseConfigPolicy, checkReleaseConfigPolicy, SMOO_NX_RELEASE_TAG_PATTERN, SMOO_NX_VERSION_ACTIONS, } from '@smoothbricks/nx-plugin/release-config-policy';
 import { applyTypecheckTestPolicy, checkTypecheckTestPolicy } from '@smoothbricks/nx-plugin/typecheck-test-policy';
 import { applyWorkspaceConfigPolicy, checkWorkspaceConfigPolicy, } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { getOrCreateRecord, hasOwnString, isRecord, readJsonObject, recordProperty, requiredJsonObject, setMissingStringProperty, setStringProperty, stringProperty, writeJsonObject, } from '../lib/json.js';
+import { ensureNx, ensurePublishConfig, ensureRepositoryObject, ensureScripts, readJsonObject, requiredJsonObject, setMissingPackageStringField, setMissingRepositoryField, setNxName, setPublishAccess, setRepositoryField, setStringProperty, writeJsonObject, } from '../lib/json.js';
 import { getWorkspacePackageManifests, getWorkspacePackages, listPackageJsonRecords, listPublicPackages, packageRepositoryInfo, repositoryInfo, sameRepositoryAfterNormalization, workspaceDependencyFields, } from '../lib/workspace.js';
 export { SMOO_NX_RELEASE_TAG_PATTERN, SMOO_NX_VERSION_ACTIONS };
 const extraCommitScopes = ['release'];
@@ -27,12 +27,12 @@ export function applyRootScriptDefaults(root) {
     if (!rootPackage) {
         return;
     }
-    const scripts = getOrCreateRecord(rootPackage, 'scripts');
+    const scripts = ensureScripts(rootPackage);
     let changed = false;
     for (const [name, command] of Object.entries(rootScriptPolicy)) {
         changed = setStringProperty(scripts, name, command) || changed;
     }
-    const nx = getOrCreateRecord(rootPackage, 'nx');
+    const nx = ensureNx(rootPackage);
     if (!Array.isArray(nx.includedScripts) || nx.includedScripts.length !== 0) {
         nx.includedScripts = [];
         changed = true;
@@ -56,7 +56,7 @@ export function applyNxPluginDefaults(root) {
 }
 export function applyPublicPackageDefaults(root) {
     const rootPackage = requiredJsonObject(join(root, 'package.json'));
-    const rootLicense = stringProperty(rootPackage, 'license');
+    const rootLicense = rootPackage.license;
     const rootRepository = repositoryInfo(rootPackage);
     for (const pkg of listPublicPackages(root)) {
         let changed = false;
@@ -66,17 +66,19 @@ export function applyPublicPackageDefaults(root) {
             existingRepository.url === rootRepository.url &&
             rootLicense &&
             rootLicense !== 'UNLICENSED') {
-            changed = setMissingStringProperty(pkg.json, 'license', rootLicense) || changed;
+            changed = setMissingPackageStringField(pkg.json, 'license', rootLicense) || changed;
         }
-        const publishConfig = getOrCreateRecord(pkg.json, 'publishConfig');
-        changed = setStringProperty(publishConfig, 'access', 'public') || changed;
-        const repository = getOrCreateRecord(pkg.json, 'repository');
-        changed =
-            setStringProperty(repository, 'type', existingRepository?.type ?? rootRepository?.type ?? 'git') || changed;
-        if (existingRepository && !stringProperty(repository, 'url')) {
-            changed = setStringProperty(repository, 'url', existingRepository.url) || changed;
+        const publishConfig = ensurePublishConfig(pkg.json);
+        changed = setPublishAccess(publishConfig, 'public') || changed;
+        if (typeof pkg.json.repository !== 'string') {
+            const repository = ensureRepositoryObject(pkg.json);
+            changed =
+                setRepositoryField(repository, 'type', existingRepository?.type ?? rootRepository?.type ?? 'git') || changed;
+            if (existingRepository) {
+                changed = setMissingRepositoryField(repository, 'url', existingRepository.url) || changed;
+            }
+            changed = setRepositoryField(repository, 'directory', pkg.path.replaceAll('\\', '/')) || changed;
         }
-        changed = setStringProperty(repository, 'directory', pkg.path.replaceAll('\\', '/')) || changed;
         changed = normalizeExportConditionOrder(pkg.json.exports) || changed;
         if (hasDevelopmentSourceExport(pkg.json.exports)) {
             changed = addFileEntry(pkg.json, 'src') || changed;
@@ -128,7 +130,7 @@ export function applyNxReleaseDefaults(root) {
 }
 export function applyNxProjectNameDefaults(root) {
     const rootPackage = requiredJsonObject(join(root, 'package.json'));
-    const rootName = stringProperty(rootPackage, 'name');
+    const rootName = rootPackage.name;
     if (!rootName) {
         return;
     }
@@ -137,8 +139,8 @@ export function applyNxProjectNameDefaults(root) {
         if (!suggestedName) {
             continue;
         }
-        const nx = getOrCreateRecord(pkg.json, 'nx');
-        const changed = setStringProperty(nx, 'name', suggestedName);
+        const nx = ensureNx(pkg.json);
+        const changed = setNxName(nx, suggestedName);
         if (changed) {
             writeJsonObject(pkg.packageJsonPath, pkg.json);
             console.log(`updated        ${pkg.path}/package.json nx.name`);
@@ -153,11 +155,10 @@ export function listValidCommitScopes(root) {
 }
 export function listNxProjectNames(root) {
     const rootPackage = readJsonObject(join(root, 'package.json'));
-    const rootName = rootPackage ? stringProperty(rootPackage, 'name') : null;
+    const rootName = rootPackage?.name ?? null;
     const names = [];
     for (const pkg of getWorkspacePackageManifests(root)) {
-        const nx = recordProperty(pkg.json, 'nx');
-        const configuredName = nx ? stringProperty(nx, 'name') : null;
+        const configuredName = pkg.json.nx?.name;
         const suggestedName = rootName ? suggestNxProjectName(rootName, pkg.name) : null;
         if (configuredName) {
             names.push(configuredName);
@@ -175,11 +176,11 @@ export function validateRootPackagePolicy(root) {
         return 1;
     }
     let failures = 0;
-    if (!stringProperty(rootPackage, 'name')) {
+    if (!rootPackage.name) {
         console.error('package.json must define name');
         failures++;
     }
-    if (!stringProperty(rootPackage, 'license')) {
+    if (!rootPackage.license) {
         console.error('package.json must define repo-wide license');
         failures++;
     }
@@ -189,19 +190,19 @@ export function validateRootPackagePolicy(root) {
     }
     failures += validateRootScripts(rootPackage);
     failures += validateRootNxScriptInference(rootPackage);
-    const packageManager = stringProperty(rootPackage, 'packageManager');
+    const packageManager = rootPackage.packageManager;
     if (!packageManager?.startsWith('bun@')) {
         console.error('package.json packageManager must use bun@<version>');
         failures++;
     }
     const bunVersion = packageManager?.startsWith('bun@') ? packageManager.slice('bun@'.length) : null;
-    const devDependencies = recordProperty(rootPackage, 'devDependencies');
+    const devDependencies = rootPackage.devDependencies;
     if (!bunVersion || !devDependencies || devDependencies['@types/bun'] !== bunVersion) {
         console.error('package.json devDependencies.@types/bun must match packageManager bun version');
         failures++;
     }
-    const engines = recordProperty(rootPackage, 'engines');
-    if (!engines || !stringProperty(engines, 'node')) {
+    const engines = rootPackage.engines;
+    if (!engines?.node) {
         console.error('package.json engines.node must be defined');
         failures++;
     }
@@ -221,7 +222,7 @@ export function validateNxReleaseConfig(root) {
 }
 export function validateNxProjectNames(root) {
     const rootPackage = readJsonObject(join(root, 'package.json'));
-    const rootName = rootPackage ? stringProperty(rootPackage, 'name') : null;
+    const rootName = rootPackage?.name ?? null;
     if (!rootName) {
         return 0;
     }
@@ -231,8 +232,7 @@ export function validateNxProjectNames(root) {
         if (!suggestedName) {
             continue;
         }
-        const nx = recordProperty(pkg.json, 'nx');
-        const configuredName = nx ? stringProperty(nx, 'name') : null;
+        const configuredName = pkg.json.nx?.name ?? null;
         if (configuredName !== suggestedName) {
             console.error(`${pkg.path}: package.json nx.name must be "${suggestedName}" so fix(${suggestedName}): maps to this project`);
             failures++;
@@ -267,16 +267,18 @@ export function validatePublicPackageMetadata(root) {
             console.error(`${pkg.path}: npm:public package must not be private`);
             failures++;
         }
-        if (!stringProperty(pkg.json, 'license')) {
+        if (!pkg.json.license) {
             console.error(`${pkg.path}: public package must define license`);
             failures++;
         }
-        const publishConfig = recordProperty(pkg.json, 'publishConfig');
-        if (!publishConfig || stringProperty(publishConfig, 'access') !== 'public') {
+        const publishConfig = pkg.json.publishConfig;
+        if (publishConfig?.access !== 'public') {
             console.error(`${pkg.path}: public package must define publishConfig.access = public`);
             failures++;
         }
-        const repository = recordProperty(pkg.json, 'repository');
+        const repository = pkg.json.repository !== null && pkg.json.repository !== undefined && typeof pkg.json.repository !== 'string'
+            ? pkg.json.repository
+            : null;
         const packageRepository = packageRepositoryInfo(pkg);
         if (!packageRepository) {
             console.error(`${pkg.path}: public package must define repository.url`);
@@ -290,11 +292,11 @@ export function validatePublicPackageMetadata(root) {
                 `Use ${rootRepository.url}`);
             failures++;
         }
-        if (!repository || !stringProperty(repository, 'type')) {
+        if (!repository?.type) {
             console.error(`${pkg.path}: public package must define repository.type`);
             failures++;
         }
-        if (!repository || stringProperty(repository, 'directory') !== pkg.path.replaceAll('\\', '/')) {
+        if (!repository || repository.directory !== pkg.path.replaceAll('\\', '/')) {
             console.error(`${pkg.path}: public package repository.directory must be ${pkg.path.replaceAll('\\', '/')}`);
             failures++;
         }
@@ -302,11 +304,13 @@ export function validatePublicPackageMetadata(root) {
             console.error(`${pkg.path}: public package must define files`);
             failures++;
         }
-        if (!isRecord(pkg.json.exports) && !isRecord(pkg.json.bin)) {
+        const hasBin = typeof pkg.json.bin === 'string' ||
+            (pkg.json.bin !== null && pkg.json.bin !== undefined && typeof pkg.json.bin === 'object');
+        if (!isPackageExportMap(pkg.json.exports) && !hasBin) {
             console.error(`${pkg.path}: public package must define exports or bin`);
             failures++;
         }
-        if (!hasOwnString(pkg.json, 'types') && !isRecord(pkg.json.bin)) {
+        if (typeof pkg.json.types !== 'string' && !hasBin) {
             console.error(`${pkg.path}: public library package must define types`);
             failures++;
         }
@@ -315,10 +319,11 @@ export function validatePublicPackageMetadata(root) {
 }
 export function validateWorkspaceDependencies(root, options = {}) {
     let failures = 0;
+    failures += validateCiSkipTags(root, options);
     const workspaceNames = new Set(getWorkspacePackages(root).map((pkg) => pkg.name));
     for (const pkg of listPackageJsonRecords(root)) {
         for (const field of workspaceDependencyFields) {
-            const dependencies = recordProperty(pkg.json, field);
+            const dependencies = pkg.json[field];
             if (!dependencies) {
                 continue;
             }
@@ -347,13 +352,38 @@ export function validateWorkspaceDependencies(root, options = {}) {
     }
     return failures;
 }
+const ciSkipTagPrefix = 'ci:skip:';
+const invalidCiSkipTargetSyntax = /[,*?[\]{}]/;
+function validateCiSkipTags(root, options) {
+    let failures = 0;
+    for (const pkg of getWorkspacePackages(root)) {
+        const resolved = options.resolvedTargetsByProject?.get(pkg.projectName);
+        const resolvedTargets = resolved && 'targets' in resolved ? resolved.targets : resolved;
+        for (const tag of pkg.tags) {
+            if (tag !== 'ci:skip' && !tag.startsWith(ciSkipTagPrefix)) {
+                continue;
+            }
+            const target = tag.startsWith(ciSkipTagPrefix) ? tag.slice(ciSkipTagPrefix.length) : '';
+            if (!target || invalidCiSkipTargetSyntax.test(target)) {
+                console.error(`${pkg.path}: nx tag ${tag} must use ci:skip:<target> with one exact Nx target name`);
+                failures++;
+                continue;
+            }
+            if (resolvedTargets && !resolvedTargets.has(target)) {
+                console.error(`${pkg.path}: nx tag ${tag} names missing Nx target ${target}`);
+                failures++;
+            }
+        }
+    }
+    return failures;
+}
 // ---------------------------------------------------------------------------
 // Helpers kept in CLI (not Nx-specific)
 // ---------------------------------------------------------------------------
 function fixWorkspaceDependencyRanges(pkg, workspaceNames) {
     let changed = false;
     for (const field of workspaceDependencyFields) {
-        const dependencies = recordProperty(pkg, field);
+        const dependencies = pkg[field];
         if (!dependencies) {
             continue;
         }
@@ -367,7 +397,7 @@ function fixWorkspaceDependencyRanges(pkg, workspaceNames) {
     return changed;
 }
 function validateRootScripts(rootPackage) {
-    const scripts = recordProperty(rootPackage, 'scripts');
+    const scripts = rootPackage.scripts;
     let failures = 0;
     for (const [name, command] of Object.entries(rootScriptPolicy)) {
         if (scripts?.[name] !== command) {
@@ -382,8 +412,8 @@ function validateRootScripts(rootPackage) {
     return failures;
 }
 function validateRootNxScriptInference(rootPackage) {
-    const nx = recordProperty(rootPackage, 'nx');
-    if (nx && Array.isArray(nx.includedScripts) && nx.includedScripts.length === 0) {
+    const includedScripts = rootPackage.nx?.includedScripts;
+    if (Array.isArray(includedScripts) && includedScripts.length === 0) {
         return 0;
     }
     console.error('package.json nx.includedScripts must be [] so root scripts do not become recursive Nx targets.');
@@ -405,7 +435,7 @@ function unscopedPackageName(packageName) {
 }
 function recordKeysAreSorted(record) {
     const keys = Object.keys(record);
-    return keys.every((key, index) => index === 0 || keys[index - 1] <= key);
+    return keys.every((key, index) => index === 0 || (keys[index - 1] ?? '') <= key);
 }
 function sortRecordInPlace(record) {
     if (recordKeysAreSorted(record)) {
@@ -420,8 +450,11 @@ function sortRecordInPlace(record) {
     }
     return true;
 }
+function isPackageExportMap(value) {
+    return value !== null && value !== undefined && typeof value === 'object';
+}
 function normalizeExportConditionOrder(value) {
-    if (!isRecord(value)) {
+    if (!isPackageExportMap(value)) {
         return false;
     }
     let changed = false;
@@ -450,7 +483,7 @@ function normalizeExportConditionOrder(value) {
     return true;
 }
 function hasDevelopmentSourceExport(value) {
-    if (!isRecord(value)) {
+    if (!isPackageExportMap(value)) {
         return false;
     }
     for (const [key, child] of Object.entries(value)) {
@@ -468,7 +501,7 @@ function addFileEntry(pkg, entry) {
     if (!Array.isArray(files) || files.includes(entry)) {
         return false;
     }
-    const firstNegated = files.findIndex((file) => typeof file === 'string' && file.startsWith('!'));
+    const firstNegated = files.findIndex((file) => file.startsWith('!'));
     if (firstNegated === -1) {
         files.push(entry);
     }

package/dist/monorepo/packed-manifest.d.ts

@@ -1,4 +1,7 @@
+import { type PackageJson } from '../lib/json.js';
 import type { PackageInfo } from '../lib/workspace.js';
-export declare function readPackedPackageJson(root: string, tarball: string, packageName: string): Promise<Record<string, unknown>>;
-export declare function validatePackedWorkspaceDependencies(root: string, sourcePackage: PackageInfo, packedPackage: Record<string, unknown>): string[];
+export declare function readPackedPackageJson(root: string, tarball: string, packageName: string): Promise<PackageJson>;
+export declare function validatePackedWorkspaceDependencies(root: string, sourcePackage: PackageInfo, packedPackage: PackageJson, options?: {
+    mode?: 'install' | 'publish';
+}): string[];
 //# sourceMappingURL=packed-manifest.d.ts.map

package/dist/monorepo/packed-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packed-manifest.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAUlC;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,WAAW,EAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,MAAM,EAAE,CA8CV"}
+{"version":3,"file":"packed-manifest.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,WAAW,EAAwB,MAAM,gBAAgB,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAUpH;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,WAAW,EAC1B,aAAa,EAAE,WAAW,EAC1B,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAAO,GAC7C,MAAM,EAAE,CAyCV"}

package/dist/monorepo/packed-manifest.js

@@ -1,32 +1,31 @@
-import { execSync } from 'node:child_process';
 import { $ } from 'bun';
-import { isRecord, recordProperty } from '../lib/json.js';
+import { parsePackageJsonText } from '../lib/json.js';
 import { decode } from '../lib/run.js';
 import { getWorkspacePackages, workspaceDependencyFields } from '../lib/workspace.js';
+import { publishPackDependencyVersion } from './lockfile.js';
 export async function readPackedPackageJson(root, tarball, packageName) {
     const result = await $ `tar -xOf ${tarball} package/package.json`.cwd(root).quiet().nothrow();
     if (result.exitCode !== 0) {
         throw new Error(`${packageName}: unable to inspect packed package.json.`);
     }
-    const parsed = JSON.parse(decode(result.stdout));
-    if (!isRecord(parsed)) {
-        throw new Error(`${packageName}: packed package.json is not an object.`);
+    const parsed = parsePackageJsonText(decode(result.stdout));
+    if (!parsed) {
+        throw new Error(`${packageName}: packed package.json is invalid.`);
     }
     return parsed;
 }
-export function validatePackedWorkspaceDependencies(root, sourcePackage, packedPackage) {
+export function validatePackedWorkspaceDependencies(root, sourcePackage, packedPackage, options = {}) {
+    const mode = options.mode ?? 'publish';
     const workspacePackages = getWorkspacePackages(root);
-    const workspaceVersions = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.version]));
-    const projectNameByPackage = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.projectName]));
     const failures = [];
     for (const field of workspaceDependencyFields) {
-        const sourceDependencies = recordProperty(sourcePackage.json, field);
-        const packedDependencies = recordProperty(packedPackage, field);
+        const sourceDependencies = sourcePackage.json[field];
+        const packedDependencies = packedPackage[field];
         if (!sourceDependencies && !packedDependencies) {
             continue;
         }
         for (const [name, range] of Object.entries(packedDependencies ?? {})) {
-            if (typeof range === 'string' && range.startsWith('workspace:')) {
+            if (range.startsWith('workspace:')) {
                 failures.push(`${sourcePackage.path}: packed ${field}.${name} must not contain ${range}`);
             }
         }
@@ -34,51 +33,21 @@ export function validatePackedWorkspaceDependencies(root, sourcePackage, packedP
             continue;
         }
         for (const [name, sourceRange] of Object.entries(sourceDependencies)) {
-            const workspaceVersion = workspaceVersions.get(name);
-            if (!workspaceVersion) {
+            const dep = workspacePackages.find((pkg) => pkg.name === name);
+            if (!dep) {
                 continue;
             }
             const packedRange = packedDependencies?.[name];
             if (sourceRange !== 'workspace:*') {
                 failures.push(`${sourcePackage.path}: source ${field}.${name} must use workspace:*`);
             }
-            // When the workspace dep is at a prerelease version that was never
-            // published, the lockfile sync rewrites it to the latest stable tag
-            // version.  Accept that version as valid.
-            const projectName = projectNameByPackage.get(name);
-            const expectedVersion = workspaceVersion.includes('-') && projectName
-                ? (latestStableTagVersion(root, projectName) ?? workspaceVersion)
-                : workspaceVersion;
+            // install: what day-to-day pack embeds (package.json / lockfile aligned)
+            // publish: what pre-publish sync embeds (unpublished -next → last stable tag)
+            const expectedVersion = mode === 'publish' ? publishPackDependencyVersion(root, dep.projectName, dep.version) : dep.version;
             if (packedRange !== expectedVersion) {
-                failures.push(`${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${formatRange(packedRange)}`);
+                failures.push(`${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${packedRange ?? '<missing>'}`);
             }
         }
     }
     return failures;
 }
-function formatRange(value) {
-    return typeof value === 'string' ? value : '<missing>';
-}
-function latestStableTagVersion(root, projectName) {
-    try {
-        const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
-            cwd: root,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        const prefix = `${projectName}@`;
-        for (const line of output.split('\n')) {
-            const tag = line.trim();
-            if (!tag.startsWith(prefix))
-                continue;
-            const version = tag.slice(prefix.length);
-            if (version && !version.includes('-')) {
-                return version;
-            }
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}

package/dist/monorepo/packed-package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packed-package.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-package.ts"],"names":[],"mappings":"AAYA,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhF;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtF;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvF;AAED,wBAAsB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpF"}
+{"version":3,"file":"packed-package.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-package.ts"],"names":[],"mappings":"AAcA,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhF;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtF;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvF;AAED,wBAAsB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpF"}