@smoothbricks/cli 0.10.3 → 0.10.4

package/src/monorepo/lockfile.ts

@@ -5,27 +5,36 @@ import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
 
 export interface SyncBunLockfileVersionsOptions {
   log?: boolean;
-  /** `git add` bun.lock after rewriting it, for the pre-commit self-heal path. */
+  /** `git add` bun.lock when versions were resynced. */
   stage?: boolean;
+  /**
+   * `install` (default for validation): lockfile must match package.json.
+   * `publish`: rewrite unpublished prerelease package.json versions to the last
+   * stable git tag so `bun pm pack` embeds installable dependency versions.
+   */
+  mode?: 'install' | 'publish';
 }
 
-// Temporary Bun workaround. Delete this sync function, validateBunLockfileVersions,
-// the `smoo monorepo sync-bun-lockfile-versions` command, and the matching Nx
-// versionActions hook once supported Bun versions stop leaving workspace package
-// versions stale in bun.lock after manifest bumps. Until then, `bun pm pack`
-// rewrites `workspace:*` dependencies using those stale lockfile versions instead
-// of the current package.json versions. Track removal against:
+// Temporary Bun workaround. Delete once supported Bun versions stop leaving
+// workspace package versions stale in bun.lock after manifest bumps, and stop
+// resolving `workspace:*` from the lockfile during `bun pm pack`:
 // - https://github.com/oven-sh/bun/issues/18906
 // - https://github.com/oven-sh/bun/issues/20477
 // - https://github.com/oven-sh/bun/issues/20829
 //
-// Any `bun install` rewrites the workspace versions from package.json, reverting
-// this sync between releases. The pre-commit hook therefore runs
-// `smoo monorepo sync-bun-lockfile-versions --stage` on every commit so drift is
-// healed at the commit that would otherwise carry it — validation must never
-// fail a committer for drift a routine `bun install` introduced.
+// Two modes, because one lockfile serves two jobs:
+//
+// 1) install / frozen CI  → lockfile ≡ package.json (including -next)
+// 2) pre-publish pack    → for package.json prereleases that were never published
+//                          (post-release "prepare next"), lockfile entry := last
+//                          stable tag so a releasing package does not embed an
+//                          unpublished -next dependency version.
+//
+// Do not run publish-mode rewrite in day-to-day validate or pre-commit: bun install
+// rewrites lockfile back to package.json and frozen CI then fails.
 export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVersionsOptions = {}): number {
   const log = options.log ?? true;
+  const mode = options.mode ?? 'publish';
   const lockfilePath = join(root, 'bun.lock');
   if (!existsSync(lockfilePath)) {
     throw new Error('bun.lock not found');
@@ -34,13 +43,7 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   let lockfile = readFileSync(lockfilePath, 'utf8');
   let updated = 0;
   for (const pkg of packages) {
-    // If the package.json version is a prerelease (e.g. 0.2.2-next.0) it may
-    // never have been published.  Use the latest stable git tag version so
-    // that `bun pm pack` writes an installable dependency range for consumers.
-    const targetVersion = pkg.version.includes('-')
-      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
-      : pkg.version;
-
+    const targetVersion = lockfileTargetVersion(root, pkg.projectName, pkg.version, mode);
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -60,7 +63,10 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
     }
     lockfile = lockfile.replace(pattern, `$1${targetVersion}$3`);
     if (log) {
-      const suffix = targetVersion !== pkg.version ? ` (latest stable tag; package.json has ${pkg.version})` : '';
+      const suffix =
+        mode === 'publish' && targetVersion !== pkg.version
+          ? ` (latest stable tag; package.json has ${pkg.version})`
+          : '';
       console.log(`fix:  ${relativePath}: ${lockVersion} -> ${targetVersion}${suffix}`);
     }
     updated++;
@@ -81,6 +87,7 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   return updated;
 }
 
+/** Install/CI invariant: bun.lock workspace versions match package.json. */
 export function validateBunLockfileVersions(root: string): number {
   const lockfilePath = join(root, 'bun.lock');
   if (!existsSync(lockfilePath)) {
@@ -91,10 +98,7 @@ export function validateBunLockfileVersions(root: string): number {
   const lockfile = readFileSync(lockfilePath, 'utf8');
   let failures = 0;
   for (const pkg of packages) {
-    const targetVersion = pkg.version.includes('-')
-      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
-      : pkg.version;
-
+    const targetVersion = pkg.version;
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -116,6 +120,26 @@ export function validateBunLockfileVersions(root: string): number {
   return failures;
 }
 
+/**
+ * Version Bun should embed for a workspace dependency when packing for publish.
+ * Unpublished package.json prereleases (prepare-next) map to the last stable tag.
+ */
+export function publishPackDependencyVersion(root: string, projectName: string, packageVersion: string): string {
+  return lockfileTargetVersion(root, projectName, packageVersion, 'publish');
+}
+
+function lockfileTargetVersion(
+  root: string,
+  projectName: string,
+  packageVersion: string,
+  mode: 'install' | 'publish',
+): string {
+  if (mode === 'install' || !packageVersion.includes('-')) {
+    return packageVersion;
+  }
+  return latestStableTagVersion(root, projectName) ?? packageVersion;
+}
+
 function latestStableTagVersion(root: string, projectName: string): string | null {
   try {
     const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {

package/src/monorepo/managed-files.test.ts

@@ -22,6 +22,7 @@ const NODE_MODULES_CACHE_KEY = "${{ hashFiles('bun.lock', 'package.json', 'packa
 const CACHE_ACTIONS = [
   { name: 'cache-nix-devenv', osKeyLines: 6 },
   { name: 'cache-node-modules', osKeyLines: 2 },
+  { name: 'cache-ttsc-plugins', osKeyLines: 2 },
   { name: 'cache-nx', osKeyLines: 2 },
 ] as const;
 

package/src/monorepo/managed-files.ts

@@ -1,8 +1,9 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
+import { type PackageJson, parseNxProjectJsonText, parseStringArrayText } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -209,6 +210,11 @@ const managedFiles: ManagedFile[] = [
     target: '.github/workflows/publish.yml',
     releasePackagesOnly: true,
   },
+  {
+    kind: 'template',
+    source: 'github/workflows/managed-files.yml',
+    target: '.github/workflows/managed-files.yml',
+  },
   {
     kind: 'template',
     source: 'github/actions/cache-nix-devenv/action.yml',
@@ -229,6 +235,11 @@ const managedFiles: ManagedFile[] = [
     source: 'github/actions/cache-node-modules/action.yml',
     target: '.github/actions/cache-node-modules/action.yml',
   },
+  {
+    kind: 'template',
+    source: 'github/actions/cache-ttsc-plugins/action.yml',
+    target: '.github/actions/cache-ttsc-plugins/action.yml',
+  },
   {
     kind: 'template',
     source: 'github/actions/cache-nx/action.yml',
@@ -348,8 +359,8 @@ function readResolvedNxTargetNames(root: string): string[] {
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'inherit'],
   });
-  const projects: unknown = JSON.parse(output);
-  if (!Array.isArray(projects) || !projects.every((project) => typeof project === 'string')) {
+  const projects = parseStringArrayText(output);
+  if (!projects) {
     return [];
   }
   const targetNames = new Set<string>();
@@ -359,8 +370,8 @@ function readResolvedNxTargetNames(root: string): string[] {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'inherit'],
     });
-    const projectJson: unknown = JSON.parse(projectOutput);
-    const targets = recordValue(recordValue(projectJson)?.targets);
+    const projectJson = parseNxProjectJsonText(projectOutput);
+    const targets = projectJson?.targets;
     if (targets) {
       for (const targetName of Object.keys(targets)) {
         targetNames.add(targetName);
@@ -383,8 +394,8 @@ function getDeployTargetInfo(root: string, configuration: string): DeployTargetI
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'inherit'],
   });
-  const projects: unknown = JSON.parse(output);
-  if (!Array.isArray(projects) || !projects.every((project) => typeof project === 'string')) {
+  const projects = parseStringArrayText(output);
+  if (!projects) {
     return { exists: false };
   }
   let exists = false;
@@ -406,47 +417,25 @@ function nxDeployTarget(root: string, project: string, configuration: string): D
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'inherit'],
   });
-  const parsed: unknown = JSON.parse(output);
-  const projectJson = recordValue(parsed);
-  const targets = recordValue(projectJson?.targets);
-  const deploy = recordValue(targets?.deploy);
-  const configurations = recordValue(deploy?.configurations);
-  const config = recordValue(configurations?.[configuration]);
+  const projectJson = parseNxProjectJsonText(output);
+  const deploy = projectJson?.targets?.deploy;
+  const config = deploy?.configurations?.[configuration];
   if (!config) {
     return { exists: false };
   }
-  const command = deployCommand(deploy, config);
+  const commandValue = config.command ?? config.options?.command ?? deploy?.options?.command;
+  const command = typeof commandValue === 'string' ? commandValue : '';
   return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }
 
-function deployCommand(deploy: Record<string, unknown> | undefined, config: Record<string, unknown>): string {
-  const command = stringValue(config.command) ?? stringValue(recordValue(config.options)?.command);
-  return command ?? stringValue(recordValue(deploy?.options)?.command) ?? '';
-}
-
-function stringValue(value: unknown): string | undefined {
-  return typeof value === 'string' ? value : undefined;
-}
-
-function getCiPushBranches(packageJson: unknown): string[] {
+function getCiPushBranches(packageJson: PackageJson | null | undefined): string[] {
   const configured = readCiPushBranches(packageJson);
   return configured.length > 0 ? configured : ['main'];
 }
 
-function readCiPushBranches(packageJson: unknown): string[] {
-  const rootPackage = recordValue(packageJson);
-  const smoo = recordValue(rootPackage?.smoo);
-  const github = recordValue(smoo?.github);
-  const branches = Array.isArray(github?.pushBranches) ? github.pushBranches : [];
-  return branches.filter((branch): branch is string => typeof branch === 'string' && branch.length > 0);
-}
-
-function recordValue(value: unknown): Record<string, unknown> | undefined {
-  return isRecord(value) ? value : undefined;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === 'object' && !Array.isArray(value);
+function readCiPushBranches(packageJson: PackageJson | null | undefined): string[] {
+  const branches = packageJson?.smoo?.github?.pushBranches ?? [];
+  return branches.filter((branch) => branch.length > 0);
 }
 
 function renderYamlFlowList(values: string[]): string {
@@ -473,3 +462,33 @@ export function validateManagedFiles(root: string): number {
   }
   return failures;
 }
+
+/**
+ * Non-blocking drift report: prints the per-file table and surfaces drift as
+ * GitHub Actions warning annotations (plain stderr elsewhere) without failing
+ * the run. Managed-file drift is derived state with its own remediation flow
+ * (the persistent managed-files PR); only `monorepo check` without --warn and
+ * PR-scoped gates treat it as an error.
+ *
+ * Under GitHub Actions the drifted-file count is published as the step output
+ * `drifted`, so downstream steps gate declaratively instead of parsing logs.
+ */
+export function warnOnManagedFileDrift(root: string): void {
+  const results = applyManagedFiles(root, 'check');
+  printResults(results);
+  const drifted = results.filter((result) => result.action === 'drifted');
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `drifted=${drifted.length}\n`);
+  }
+  if (drifted.length === 0) {
+    return;
+  }
+  if (process.env.GITHUB_ACTIONS === 'true') {
+    for (const result of drifted) {
+      console.log(
+        `::warning title=Managed file drift::${result.target} drifted from the @smoothbricks/cli template; run 'smoo monorepo update'`,
+      );
+    }
+  }
+  console.error(`${drifted.length} managed monorepo file(s) drifted (non-blocking). Run: smoo monorepo update`);
+}

package/src/monorepo/package-policy.test.ts

@@ -262,7 +262,7 @@ describe('workspace package script policy', () => {
     try {
       expect(validateWorkspaceDependencies(root)).toBe(2);
 
-      const resolvedTargetsByProject = new Map([['native', new Set(['build', 'tsc-js', 'zig-wasm'])]]);
+      const resolvedTargetsByProject = new Map([['native', new Set(['build', 'tsc-js', 'tsdown-js'])]]);
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
 
       const native = await readJson(join(root, 'packages/native/package.json'));
@@ -284,17 +284,17 @@ describe('workspace package script policy', () => {
           dependencies: { '@smoothbricks/lib': 'workspace:*' },
           scripts: {
             'build:custom': 'nx run native:build:custom',
-            'build:zig': 'nx run native:build:zig',
+            'build:bundle': 'nx run native:build:bundle',
             'build:ts': 'nx run native:build:ts',
           },
           nx: {
             name: 'native',
             targets: {
-              build: { dependsOn: ['^build', 'build:ts', 'build:zig', 'build:custom'] },
+              build: { dependsOn: ['^build', 'build:ts', 'build:bundle', 'build:custom'] },
               'build:custom': {},
-              'build:zig': {
+              'build:bundle': {
                 executor: 'nx:run-commands',
-                options: { command: 'zig build wasm', cwd: '{projectRoot}' },
+                options: { command: 'tsdown', cwd: '{projectRoot}' },
               },
               'build:ts': {
                 executor: 'nx:run-commands',
@@ -307,25 +307,21 @@ describe('workspace package script policy', () => {
     });
     try {
       await writeJson(join(root, 'packages/native/tsconfig.lib.json'), {});
-      await writeFile(
-        join(root, 'packages/native/build.zig'),
-        'pub fn build(b: *std.Build) void { _ = b.step("wasm", "Build wasm"); }\n',
-      );
       expect(validateWorkspaceDependencies(root)).toBe(6);
 
-      const resolvedTargetsByProject = new Map([['native', new Set(['build', 'custom', 'tsc-js', 'zig-wasm'])]]);
+      const resolvedTargetsByProject = new Map([['native', new Set(['build', 'custom', 'tsc-js', 'tsdown-js'])]]);
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
 
       const native = await readJson(join(root, 'packages/native/package.json'));
       expect(native.scripts).toEqual({
         'build:custom': 'nx run native:custom',
-        'build:zig': 'nx run native:zig-wasm',
+        'build:bundle': 'nx run native:tsdown-js',
         'build:ts': 'nx run native:tsc-js',
       });
       expect(native.nx).toEqual({
         name: 'native',
         targets: {
-          build: { dependsOn: ['^build', 'tsc-js', 'zig-wasm', 'custom'] },
+          build: { dependsOn: ['^build', 'tsc-js', 'tsdown-js', 'custom'] },
         },
       });
       expect(validateWorkspaceDependencies(root, { resolvedTargetsByProject })).toBe(0);
@@ -344,7 +340,7 @@ describe('workspace package script policy', () => {
           nx: {
             name: 'native',
             targets: {
-              build: { executor: 'nx:noop', dependsOn: ['^build', 'tsc-js', 'zig-wasm', 'custom'] },
+              build: { executor: 'nx:noop', dependsOn: ['^build', 'tsc-js', 'tsdown-js', 'custom'] },
             },
           },
         },
@@ -352,14 +348,10 @@ describe('workspace package script policy', () => {
     });
     try {
       await writeJson(join(root, 'packages/native/tsconfig.lib.json'), {});
-      await writeFile(
-        join(root, 'packages/native/build.zig'),
-        'pub fn build(b: *std.Build) void { _ = b.step("wasm", "Build wasm"); }\n',
-      );
       const resolvedTargetsByProject = new Map([
         [
           'native',
-          { targets: new Set(['build', 'tsc-js', 'zig-wasm']), buildDependsOn: ['^build', 'tsc-js', 'zig-wasm'] },
+          { targets: new Set(['build', 'tsc-js', 'tsdown-js']), buildDependsOn: ['^build', 'tsc-js', 'tsdown-js'] },
         ],
       ]);
 
@@ -369,7 +361,7 @@ describe('workspace package script policy', () => {
       expect(native.nx).toEqual({
         name: 'native',
         targets: {
-          build: { executor: 'nx:noop', dependsOn: ['^build', 'tsc-js', 'zig-wasm', 'custom'] },
+          build: { executor: 'nx:noop', dependsOn: ['^build', 'tsc-js', 'tsdown-js', 'custom'] },
         },
       });
     } finally {
@@ -389,8 +381,8 @@ describe('workspace package script policy', () => {
             targets: {
               build: {
                 executor: 'nx:run-commands',
-                options: { command: 'zig build wasm', cwd: '{projectRoot}' },
-                dependsOn: ['^build', 'zig-wasm'],
+                options: { command: 'tsdown', cwd: '{projectRoot}' },
+                dependsOn: ['^build', 'tsdown-js'],
               },
             },
           },
@@ -398,12 +390,8 @@ describe('workspace package script policy', () => {
       ],
     });
     try {
-      await writeFile(
-        join(root, 'packages/native/build.zig'),
-        'pub fn build(b: *std.Build) void { _ = b.step("wasm", "Build wasm"); }\n',
-      );
       const resolvedTargetsByProject = new Map([
-        ['native', { targets: new Set(['build', 'zig-wasm']), buildDependsOn: ['^build', 'zig-wasm'] }],
+        ['native', { targets: new Set(['build', 'tsdown-js']), buildDependsOn: ['^build', 'tsdown-js'] }],
       ]);
 
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
@@ -414,8 +402,8 @@ describe('workspace package script policy', () => {
         targets: {
           build: {
             executor: 'nx:run-commands',
-            options: { command: 'zig build wasm', cwd: '{projectRoot}' },
-            dependsOn: ['^build', 'zig-wasm'],
+            options: { command: 'tsdown', cwd: '{projectRoot}' },
+            dependsOn: ['^build', 'tsdown-js'],
           },
         },
       });
@@ -434,7 +422,7 @@ describe('workspace package script policy', () => {
           nx: {
             name: 'native',
             targets: {
-              build: { executor: 'nx:noop', dependsOn: ['^build', 'tsc-js', 'zig-wasm'] },
+              build: { executor: 'nx:noop', dependsOn: ['^build', 'tsc-js', 'tsdown-js'] },
             },
           },
         },
@@ -444,7 +432,7 @@ describe('workspace package script policy', () => {
       const resolvedTargetsByProject = new Map([
         [
           'native',
-          { targets: new Set(['build', 'tsc-js', 'zig-wasm']), buildDependsOn: ['^build', 'tsc-js', 'zig-wasm'] },
+          { targets: new Set(['build', 'tsc-js', 'tsdown-js']), buildDependsOn: ['^build', 'tsc-js', 'tsdown-js'] },
         ],
       ]);
 
@@ -498,7 +486,7 @@ describe('workspace package script policy', () => {
     });
     try {
       const resolvedTargetsByProject = new Map([
-        ['native', { targets: new Set(['build', 'tsc-js', 'zig-wasm']), buildDependsOn: buildOutputDependencies }],
+        ['native', { targets: new Set(['build', 'tsc-js', 'tsdown-js']), buildDependsOn: buildOutputDependencies }],
       ]);
 
       applyWorkspaceDependencyDefaults(root, { resolvedTargetsByProject });
@@ -558,20 +546,6 @@ describe('workspace package script policy', () => {
     }
   });
 
-  it('rejects build.zig without steps', async () => {
-    const root = await createWorkspace({
-      rootName: '@smoothbricks/codebase',
-      packages: [{ dir: 'native', name: '@smoothbricks/native', nx: { name: 'native' } }],
-    });
-    try {
-      await writeFile(join(root, 'packages/native/build.zig'), 'pub fn build(b: *std.Build) void { _ = b; }\n');
-
-      expect(validateWorkspaceDependencies(root)).toBe(1);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
-
   it('rejects old test tsconfig output for packages with test runners', async () => {
     const root = await createWorkspace({
       rootName: '@smoothbricks/codebase',
@@ -728,17 +702,13 @@ describe('workspace package script policy', () => {
     }
   });
 
-  it('accepts noEmit test tsconfig and build.zig with an explicit step', async () => {
+  it('accepts a noEmit test tsconfig', async () => {
     const root = await createWorkspace({
       rootName: '@smoothbricks/codebase',
       packages: [{ dir: 'native', name: '@smoothbricks/native', nx: { name: 'native', targets: { lint: {} } } }],
     });
     try {
       await writeJson(join(root, 'packages/native/tsconfig.test.json'), { compilerOptions: { noEmit: true } });
-      await writeFile(
-        join(root, 'packages/native/build.zig'),
-        'pub fn build(b: *std.Build) void { _ = b.step("build", "Build native artifact"); }\n',
-      );
 
       expect(validateWorkspaceDependencies(root)).toBe(0);
     } finally {