@smoothbricks/cli 0.10.3 → 0.10.4

package/src/monorepo/package-policy.ts

@@ -21,15 +21,22 @@ import {
   checkWorkspaceConfigPolicy,
 } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import {
-  getOrCreateRecord,
-  hasOwnString,
-  isRecord,
+  ensureNx,
+  ensurePublishConfig,
+  ensureRepositoryObject,
+  ensureScripts,
+  type PackageExportMap,
+  type PackageExports,
+  type PackageJson,
   readJsonObject,
-  recordProperty,
   requiredJsonObject,
-  setMissingStringProperty,
+  type StringMap,
+  setMissingPackageStringField,
+  setMissingRepositoryField,
+  setNxName,
+  setPublishAccess,
+  setRepositoryField,
   setStringProperty,
-  stringProperty,
   writeJsonObject,
 } from '../lib/json.js';
 import {
@@ -68,12 +75,12 @@ export function applyRootScriptDefaults(root: string): void {
   if (!rootPackage) {
     return;
   }
-  const scripts = getOrCreateRecord(rootPackage, 'scripts');
+  const scripts = ensureScripts(rootPackage);
   let changed = false;
   for (const [name, command] of Object.entries(rootScriptPolicy)) {
     changed = setStringProperty(scripts, name, command) || changed;
   }
-  const nx = getOrCreateRecord(rootPackage, 'nx');
+  const nx = ensureNx(rootPackage);
   if (!Array.isArray(nx.includedScripts) || nx.includedScripts.length !== 0) {
     nx.includedScripts = [];
     changed = true;
@@ -97,7 +104,7 @@ export function applyNxPluginDefaults(root: string): void {
 
 export function applyPublicPackageDefaults(root: string): void {
   const rootPackage = requiredJsonObject(join(root, 'package.json'));
-  const rootLicense = stringProperty(rootPackage, 'license');
+  const rootLicense = rootPackage.license;
   const rootRepository = repositoryInfo(rootPackage);
 
   for (const pkg of listPublicPackages(root)) {
@@ -110,18 +117,21 @@ export function applyPublicPackageDefaults(root: string): void {
       rootLicense &&
       rootLicense !== 'UNLICENSED'
     ) {
-      changed = setMissingStringProperty(pkg.json, 'license', rootLicense) || changed;
+      changed = setMissingPackageStringField(pkg.json, 'license', rootLicense) || changed;
     }
-    const publishConfig = getOrCreateRecord(pkg.json, 'publishConfig');
-    changed = setStringProperty(publishConfig, 'access', 'public') || changed;
-
-    const repository = getOrCreateRecord(pkg.json, 'repository');
-    changed =
-      setStringProperty(repository, 'type', existingRepository?.type ?? rootRepository?.type ?? 'git') || changed;
-    if (existingRepository && !stringProperty(repository, 'url')) {
-      changed = setStringProperty(repository, 'url', existingRepository.url) || changed;
+    const publishConfig = ensurePublishConfig(pkg.json);
+    changed = setPublishAccess(publishConfig, 'public') || changed;
+
+    if (typeof pkg.json.repository !== 'string') {
+      const repository = ensureRepositoryObject(pkg.json);
+      changed =
+        setRepositoryField(repository, 'type', existingRepository?.type ?? rootRepository?.type ?? 'git') || changed;
+      if (existingRepository) {
+        changed = setMissingRepositoryField(repository, 'url', existingRepository.url) || changed;
+      }
+      changed = setRepositoryField(repository, 'directory', pkg.path.replaceAll('\\', '/')) || changed;
     }
-    changed = setStringProperty(repository, 'directory', pkg.path.replaceAll('\\', '/')) || changed;
+
     changed = normalizeExportConditionOrder(pkg.json.exports) || changed;
     if (hasDevelopmentSourceExport(pkg.json.exports)) {
       changed = addFileEntry(pkg.json, 'src') || changed;
@@ -172,7 +182,7 @@ export function applyNxReleaseDefaults(root: string): void {
 
 export function applyNxProjectNameDefaults(root: string): void {
   const rootPackage = requiredJsonObject(join(root, 'package.json'));
-  const rootName = stringProperty(rootPackage, 'name');
+  const rootName = rootPackage.name;
   if (!rootName) {
     return;
   }
@@ -181,8 +191,8 @@ export function applyNxProjectNameDefaults(root: string): void {
     if (!suggestedName) {
       continue;
     }
-    const nx = getOrCreateRecord(pkg.json, 'nx');
-    const changed = setStringProperty(nx, 'name', suggestedName);
+    const nx = ensureNx(pkg.json);
+    const changed = setNxName(nx, suggestedName);
     if (changed) {
       writeJsonObject(pkg.packageJsonPath, pkg.json);
       console.log(`updated        ${pkg.path}/package.json nx.name`);
@@ -198,11 +208,10 @@ export function listValidCommitScopes(root: string): ReadonlySet<string> {
 
 export function listNxProjectNames(root: string): string[] {
   const rootPackage = readJsonObject(join(root, 'package.json'));
-  const rootName = rootPackage ? stringProperty(rootPackage, 'name') : null;
+  const rootName = rootPackage?.name ?? null;
   const names: string[] = [];
   for (const pkg of getWorkspacePackageManifests(root)) {
-    const nx = recordProperty(pkg.json, 'nx');
-    const configuredName = nx ? stringProperty(nx, 'name') : null;
+    const configuredName = pkg.json.nx?.name;
     const suggestedName = rootName ? suggestNxProjectName(rootName, pkg.name) : null;
     if (configuredName) {
       names.push(configuredName);
@@ -220,11 +229,11 @@ export function validateRootPackagePolicy(root: string): number {
     return 1;
   }
   let failures = 0;
-  if (!stringProperty(rootPackage, 'name')) {
+  if (!rootPackage.name) {
     console.error('package.json must define name');
     failures++;
   }
-  if (!stringProperty(rootPackage, 'license')) {
+  if (!rootPackage.license) {
     console.error('package.json must define repo-wide license');
     failures++;
   }
@@ -234,19 +243,19 @@ export function validateRootPackagePolicy(root: string): number {
   }
   failures += validateRootScripts(rootPackage);
   failures += validateRootNxScriptInference(rootPackage);
-  const packageManager = stringProperty(rootPackage, 'packageManager');
+  const packageManager = rootPackage.packageManager;
   if (!packageManager?.startsWith('bun@')) {
     console.error('package.json packageManager must use bun@<version>');
     failures++;
   }
   const bunVersion = packageManager?.startsWith('bun@') ? packageManager.slice('bun@'.length) : null;
-  const devDependencies = recordProperty(rootPackage, 'devDependencies');
+  const devDependencies = rootPackage.devDependencies;
   if (!bunVersion || !devDependencies || devDependencies['@types/bun'] !== bunVersion) {
     console.error('package.json devDependencies.@types/bun must match packageManager bun version');
     failures++;
   }
-  const engines = recordProperty(rootPackage, 'engines');
-  if (!engines || !stringProperty(engines, 'node')) {
+  const engines = rootPackage.engines;
+  if (!engines?.node) {
     console.error('package.json engines.node must be defined');
     failures++;
   }
@@ -268,7 +277,7 @@ export function validateNxReleaseConfig(root: string): number {
 
 export function validateNxProjectNames(root: string): number {
   const rootPackage = readJsonObject(join(root, 'package.json'));
-  const rootName = rootPackage ? stringProperty(rootPackage, 'name') : null;
+  const rootName = rootPackage?.name ?? null;
   if (!rootName) {
     return 0;
   }
@@ -278,8 +287,7 @@ export function validateNxProjectNames(root: string): number {
     if (!suggestedName) {
       continue;
     }
-    const nx = recordProperty(pkg.json, 'nx');
-    const configuredName = nx ? stringProperty(nx, 'name') : null;
+    const configuredName = pkg.json.nx?.name ?? null;
     if (configuredName !== suggestedName) {
       console.error(
         `${pkg.path}: package.json nx.name must be "${suggestedName}" so fix(${suggestedName}): maps to this project`,
@@ -318,16 +326,19 @@ export function validatePublicPackageMetadata(root: string): number {
       console.error(`${pkg.path}: npm:public package must not be private`);
       failures++;
     }
-    if (!stringProperty(pkg.json, 'license')) {
+    if (!pkg.json.license) {
       console.error(`${pkg.path}: public package must define license`);
       failures++;
     }
-    const publishConfig = recordProperty(pkg.json, 'publishConfig');
-    if (!publishConfig || stringProperty(publishConfig, 'access') !== 'public') {
+    const publishConfig = pkg.json.publishConfig;
+    if (publishConfig?.access !== 'public') {
       console.error(`${pkg.path}: public package must define publishConfig.access = public`);
       failures++;
     }
-    const repository = recordProperty(pkg.json, 'repository');
+    const repository =
+      pkg.json.repository !== null && pkg.json.repository !== undefined && typeof pkg.json.repository !== 'string'
+        ? pkg.json.repository
+        : null;
     const packageRepository = packageRepositoryInfo(pkg);
     if (!packageRepository) {
       console.error(`${pkg.path}: public package must define repository.url`);
@@ -345,11 +356,11 @@ export function validatePublicPackageMetadata(root: string): number {
       );
       failures++;
     }
-    if (!repository || !stringProperty(repository, 'type')) {
+    if (!repository?.type) {
       console.error(`${pkg.path}: public package must define repository.type`);
       failures++;
     }
-    if (!repository || stringProperty(repository, 'directory') !== pkg.path.replaceAll('\\', '/')) {
+    if (!repository || repository.directory !== pkg.path.replaceAll('\\', '/')) {
       console.error(`${pkg.path}: public package repository.directory must be ${pkg.path.replaceAll('\\', '/')}`);
       failures++;
     }
@@ -357,11 +368,14 @@ export function validatePublicPackageMetadata(root: string): number {
       console.error(`${pkg.path}: public package must define files`);
       failures++;
     }
-    if (!isRecord(pkg.json.exports) && !isRecord(pkg.json.bin)) {
+    const hasBin =
+      typeof pkg.json.bin === 'string' ||
+      (pkg.json.bin !== null && pkg.json.bin !== undefined && typeof pkg.json.bin === 'object');
+    if (!isPackageExportMap(pkg.json.exports) && !hasBin) {
       console.error(`${pkg.path}: public package must define exports or bin`);
       failures++;
     }
-    if (!hasOwnString(pkg.json, 'types') && !isRecord(pkg.json.bin)) {
+    if (typeof pkg.json.types !== 'string' && !hasBin) {
       console.error(`${pkg.path}: public library package must define types`);
       failures++;
     }
@@ -375,7 +389,7 @@ export function validateWorkspaceDependencies(root: string, options: PackageTarg
   const workspaceNames = new Set(getWorkspacePackages(root).map((pkg) => pkg.name));
   for (const pkg of listPackageJsonRecords(root)) {
     for (const field of workspaceDependencyFields) {
-      const dependencies = recordProperty(pkg.json, field);
+      const dependencies = pkg.json[field];
       if (!dependencies) {
         continue;
       }
@@ -436,10 +450,10 @@ function validateCiSkipTags(root: string, options: PackageTargetPolicyOptions):
 // Helpers kept in CLI (not Nx-specific)
 // ---------------------------------------------------------------------------
 
-function fixWorkspaceDependencyRanges(pkg: Record<string, unknown>, workspaceNames: Set<string>): boolean {
+function fixWorkspaceDependencyRanges(pkg: PackageJson, workspaceNames: Set<string>): boolean {
   let changed = false;
   for (const field of workspaceDependencyFields) {
-    const dependencies = recordProperty(pkg, field);
+    const dependencies = pkg[field];
     if (!dependencies) {
       continue;
     }
@@ -453,8 +467,8 @@ function fixWorkspaceDependencyRanges(pkg: Record<string, unknown>, workspaceNam
   return changed;
 }
 
-function validateRootScripts(rootPackage: Record<string, unknown>): number {
-  const scripts = recordProperty(rootPackage, 'scripts');
+function validateRootScripts(rootPackage: PackageJson): number {
+  const scripts = rootPackage.scripts;
   let failures = 0;
   for (const [name, command] of Object.entries(rootScriptPolicy)) {
     if (scripts?.[name] !== command) {
@@ -471,9 +485,9 @@ function validateRootScripts(rootPackage: Record<string, unknown>): number {
   return failures;
 }
 
-function validateRootNxScriptInference(rootPackage: Record<string, unknown>): number {
-  const nx = recordProperty(rootPackage, 'nx');
-  if (nx && Array.isArray(nx.includedScripts) && nx.includedScripts.length === 0) {
+function validateRootNxScriptInference(rootPackage: PackageJson): number {
+  const includedScripts = rootPackage.nx?.includedScripts;
+  if (Array.isArray(includedScripts) && includedScripts.length === 0) {
     return 0;
   }
   console.error('package.json nx.includedScripts must be [] so root scripts do not become recursive Nx targets.');
@@ -497,12 +511,12 @@ function unscopedPackageName(packageName: string): string {
   return packageName.startsWith('@') ? packageName.slice(packageName.indexOf('/') + 1) : packageName;
 }
 
-function recordKeysAreSorted(record: Record<string, unknown>): boolean {
+function recordKeysAreSorted(record: StringMap): boolean {
   const keys = Object.keys(record);
-  return keys.every((key, index) => index === 0 || keys[index - 1] <= key);
+  return keys.every((key, index) => index === 0 || (keys[index - 1] ?? '') <= key);
 }
 
-function sortRecordInPlace(record: Record<string, unknown>): boolean {
+function sortRecordInPlace(record: StringMap): boolean {
   if (recordKeysAreSorted(record)) {
     return false;
   }
@@ -516,8 +530,11 @@ function sortRecordInPlace(record: Record<string, unknown>): boolean {
   return true;
 }
 
-function normalizeExportConditionOrder(value: unknown): boolean {
-  if (!isRecord(value)) {
+function isPackageExportMap(value: PackageExports): value is PackageExportMap {
+  return value !== null && value !== undefined && typeof value === 'object';
+}
+function normalizeExportConditionOrder(value: PackageExports): boolean {
+  if (!isPackageExportMap(value)) {
     return false;
   }
   let changed = false;
@@ -546,8 +563,8 @@ function normalizeExportConditionOrder(value: unknown): boolean {
   return true;
 }
 
-function hasDevelopmentSourceExport(value: unknown): boolean {
-  if (!isRecord(value)) {
+function hasDevelopmentSourceExport(value: PackageExports): boolean {
+  if (!isPackageExportMap(value)) {
     return false;
   }
   for (const [key, child] of Object.entries(value)) {
@@ -561,12 +578,12 @@ function hasDevelopmentSourceExport(value: unknown): boolean {
   return false;
 }
 
-function addFileEntry(pkg: Record<string, unknown>, entry: string): boolean {
+function addFileEntry(pkg: PackageJson, entry: string): boolean {
   const files = pkg.files;
   if (!Array.isArray(files) || files.includes(entry)) {
     return false;
   }
-  const firstNegated = files.findIndex((file) => typeof file === 'string' && file.startsWith('!'));
+  const firstNegated = files.findIndex((file) => file.startsWith('!'));
   if (firstNegated === -1) {
     files.push(entry);
   } else {

package/src/monorepo/packed-manifest.ts

@@ -1,22 +1,18 @@
-import { execSync } from 'node:child_process';
 import { $ } from 'bun';
-import { isRecord, recordProperty } from '../lib/json.js';
+import { type PackageJson, parsePackageJsonText } from '../lib/json.js';
 import { decode } from '../lib/run.js';
 import type { PackageInfo } from '../lib/workspace.js';
 import { getWorkspacePackages, workspaceDependencyFields } from '../lib/workspace.js';
+import { publishPackDependencyVersion } from './lockfile.js';
 
-export async function readPackedPackageJson(
-  root: string,
-  tarball: string,
-  packageName: string,
-): Promise<Record<string, unknown>> {
+export async function readPackedPackageJson(root: string, tarball: string, packageName: string): Promise<PackageJson> {
   const result = await $`tar -xOf ${tarball} package/package.json`.cwd(root).quiet().nothrow();
   if (result.exitCode !== 0) {
     throw new Error(`${packageName}: unable to inspect packed package.json.`);
   }
-  const parsed = JSON.parse(decode(result.stdout));
-  if (!isRecord(parsed)) {
-    throw new Error(`${packageName}: packed package.json is not an object.`);
+  const parsed = parsePackageJsonText(decode(result.stdout));
+  if (!parsed) {
+    throw new Error(`${packageName}: packed package.json is invalid.`);
   }
   return parsed;
 }
@@ -24,21 +20,21 @@ export async function readPackedPackageJson(
 export function validatePackedWorkspaceDependencies(
   root: string,
   sourcePackage: PackageInfo,
-  packedPackage: Record<string, unknown>,
+  packedPackage: PackageJson,
+  options: { mode?: 'install' | 'publish' } = {},
 ): string[] {
+  const mode = options.mode ?? 'publish';
   const workspacePackages = getWorkspacePackages(root);
-  const workspaceVersions = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.version]));
-  const projectNameByPackage = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.projectName]));
   const failures: string[] = [];
   for (const field of workspaceDependencyFields) {
-    const sourceDependencies = recordProperty(sourcePackage.json, field);
-    const packedDependencies = recordProperty(packedPackage, field);
+    const sourceDependencies = sourcePackage.json[field];
+    const packedDependencies = packedPackage[field];
     if (!sourceDependencies && !packedDependencies) {
       continue;
     }
 
     for (const [name, range] of Object.entries(packedDependencies ?? {})) {
-      if (typeof range === 'string' && range.startsWith('workspace:')) {
+      if (range.startsWith('workspace:')) {
         failures.push(`${sourcePackage.path}: packed ${field}.${name} must not contain ${range}`);
       }
     }
@@ -47,54 +43,24 @@ export function validatePackedWorkspaceDependencies(
       continue;
     }
     for (const [name, sourceRange] of Object.entries(sourceDependencies)) {
-      const workspaceVersion = workspaceVersions.get(name);
-      if (!workspaceVersion) {
+      const dep = workspacePackages.find((pkg) => pkg.name === name);
+      if (!dep) {
         continue;
       }
       const packedRange = packedDependencies?.[name];
       if (sourceRange !== 'workspace:*') {
         failures.push(`${sourcePackage.path}: source ${field}.${name} must use workspace:*`);
       }
-      // When the workspace dep is at a prerelease version that was never
-      // published, the lockfile sync rewrites it to the latest stable tag
-      // version.  Accept that version as valid.
-      const projectName = projectNameByPackage.get(name);
+      // install: what day-to-day pack embeds (package.json / lockfile aligned)
+      // publish: what pre-publish sync embeds (unpublished -next → last stable tag)
       const expectedVersion =
-        workspaceVersion.includes('-') && projectName
-          ? (latestStableTagVersion(root, projectName) ?? workspaceVersion)
-          : workspaceVersion;
+        mode === 'publish' ? publishPackDependencyVersion(root, dep.projectName, dep.version) : dep.version;
       if (packedRange !== expectedVersion) {
         failures.push(
-          `${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${formatRange(packedRange)}`,
+          `${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${packedRange ?? '<missing>'}`,
         );
       }
     }
   }
   return failures;
 }
-
-function formatRange(value: unknown): string {
-  return typeof value === 'string' ? value : '<missing>';
-}
-
-function latestStableTagVersion(root: string, projectName: string): string | null {
-  try {
-    const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
-      cwd: root,
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    const prefix = `${projectName}@`;
-    for (const line of output.split('\n')) {
-      const tag = line.trim();
-      if (!tag.startsWith(prefix)) continue;
-      const version = tag.slice(prefix.length);
-      if (version && !version.includes('-')) {
-        return version;
-      }
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}

package/src/monorepo/packed-package.ts

@@ -4,7 +4,9 @@ import { dirname, join, relative } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { publint } from 'publint';
 import { formatMessage } from 'publint/utils';
-import { isRecord } from '../lib/json.js';
+import typia from 'typia';
+import type { PackageExports, PackageJson } from '../lib/json.js';
+import { parsePackageJsonText } from '../lib/json.js';
 import { printCommandOutput, runResult } from '../lib/run.js';
 import type { PackageInfo } from '../lib/workspace.js';
 import { listPublicPackages } from '../lib/workspace.js';
@@ -80,7 +82,7 @@ async function validatePackedManifest(
 ): Promise<number> {
   let failures = 0;
   const packedPackage = await readPackedPackageJson(root, packed.path, pkg.name);
-  for (const message of validatePackedWorkspaceDependencies(root, pkg, packedPackage)) {
+  for (const message of validatePackedWorkspaceDependencies(root, pkg, packedPackage, { mode: 'install' })) {
     console.error(message);
     failures++;
   }
@@ -92,11 +94,10 @@ async function validateAttw(root: string, pkg: PackageInfo, packed: { path: stri
   const analysis = await attw.checkPackage(await createAttwPackageFromTarball(attw, root, packed.path), {
     excludeEntrypoints: nonJsExportEntrypoints(pkg.json.exports),
   });
-  if (!isRecord(analysis) || analysis.types === false) {
+  if (!isAttwAnalysis(analysis) || analysis.types === false) {
     return 0;
   }
-  const rawProblems = Array.isArray(analysis.problems) ? analysis.problems : [];
-  const problems = rawProblems.filter(isReportedAttwProblem);
+  const problems = (analysis.problems ?? []).filter(isReportedAttwProblem);
   if (problems.length === 0) {
     return 0;
   }
@@ -112,10 +113,30 @@ interface AttwCore {
   checkPackage: (pkg: unknown, options: { excludeEntrypoints: string[] }) => Promise<unknown>;
 }
 
+interface AttwAnalysis {
+  types?: unknown;
+  problems?: unknown[];
+}
+
+interface AttwProblem {
+  kind: string;
+  resolutionKind?: string;
+  entrypoint?: string;
+}
+
+interface AttwCoreExport {
+  Package?: unknown;
+  checkPackage?: unknown;
+}
+
+const isAttwAnalysis = typia.createIs<AttwAnalysis>();
+const isAttwProblem = typia.createIs<AttwProblem>();
+const isAttwCoreExport = typia.createIs<AttwCoreExport>();
+
 async function loadAttwCore(): Promise<AttwCore> {
   const packageJson = fileURLToPath(import.meta.resolve('@arethetypeswrong/core/package.json'));
-  const core = await import(pathToFileURL(join(dirname(packageJson), 'dist', 'index.js')).href);
-  if (!isRecord(core)) {
+  const core: unknown = await import(pathToFileURL(join(dirname(packageJson), 'dist', 'index.js')).href);
+  if (!isAttwCoreExport(core)) {
     throw new Error('@arethetypeswrong/core does not expose the expected API');
   }
   const PackageConstructor = core.Package;
@@ -146,8 +167,8 @@ async function createAttwPackageFromTarball(attw: AttwCore, root: string, tarbal
 
 function createAttwPackageFromDirectory(attw: AttwCore, packageDir: string): unknown {
   const packageJson = readJsonFile(join(packageDir, 'package.json'));
-  const packageName = typeof packageJson.name === 'string' ? packageJson.name : null;
-  const packageVersion = typeof packageJson.version === 'string' ? packageJson.version : null;
+  const packageName = packageJson.name;
+  const packageVersion = packageJson.version;
   if (!packageName || !packageVersion) {
     throw new Error('packed package.json must contain name and version');
   }
@@ -172,16 +193,16 @@ function collectAttwFiles(root: string, current: string, packageName: string, fi
   }
 }
 
-function readJsonFile(path: string): Record<string, unknown> {
-  const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'));
-  if (!isRecord(parsed)) {
+function readJsonFile(path: string): PackageJson {
+  const parsed = parsePackageJsonText(readFileSync(path, 'utf8'));
+  if (!parsed) {
     throw new Error(`${path} is not a JSON object`);
   }
   return parsed;
 }
 
-function isReportedAttwProblem(problem: unknown): boolean {
-  if (!isRecord(problem) || typeof problem.kind !== 'string') {
+function isReportedAttwProblem(problem: unknown): problem is AttwProblem {
+  if (!isAttwProblem(problem)) {
     return false;
   }
   const flag = attwProblemFlag(problem.kind);
@@ -222,10 +243,7 @@ function attwProblemFlag(kind: string): string | null {
   }
 }
 
-function formatProblemLocation(problem: unknown): string {
-  if (!isRecord(problem)) {
-    return '';
-  }
+function formatProblemLocation(problem: AttwProblem): string {
   const entrypoint = typeof problem.entrypoint === 'string' ? ` ${problem.entrypoint}` : '';
   const resolution =
     typeof problem.resolutionKind === 'string' ? ` ${formatResolutionKind(problem.resolutionKind)}` : '';
@@ -242,8 +260,8 @@ function formatResolutionKind(kind: string): string {
   return kind;
 }
 
-function nonJsExportEntrypoints(exports: unknown): string[] {
-  if (!isRecord(exports)) {
+function nonJsExportEntrypoints(exports: PackageExports): string[] {
+  if (exports === null || exports === undefined || typeof exports === 'string') {
     return [];
   }
   return Object.entries(exports)
@@ -251,13 +269,16 @@ function nonJsExportEntrypoints(exports: unknown): string[] {
     .map(([key]) => key);
 }
 
-function exportPointsToNonJs(value: unknown): boolean {
+function exportPointsToNonJs(value: PackageExports): boolean {
   if (typeof value === 'string') {
     // attw resolves every entrypoint as a module; assets can never have types.
     // Existence of the target files is still validated by publint.
     return value.endsWith('.wasm') || value.endsWith('.css');
   }
-  return isRecord(value) && Object.values(value).some(exportPointsToNonJs);
+  if (value === null || value === undefined) {
+    return false;
+  }
+  return Object.values(value).some(exportPointsToNonJs);
 }
 
 async function packPackage(root: string, pkg: PackageInfo): Promise<{ path: string; arrayBuffer: ArrayBuffer }> {

package/src/monorepo/packs/index.ts

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../../nx/index.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
-import { validateManagedFiles } from '../managed-files.js';
+import { warnOnManagedFileDrift } from '../managed-files.js';
 import { fixNxSync, validateNxSync } from '../nx-sync.js';
 import { fixPackageHygiene, validatePackageHygiene } from '../package-hygiene.js';
 import {
@@ -24,7 +24,7 @@ import {
   validatePackedPublicPackagePublint,
   validatePackedPublicPackageTypes,
 } from '../packed-package.js';
-import { syncRootRuntimeVersions } from '../runtime.js';
+import { syncRootRuntimeVersions, validateRootRuntimeVersions } from '../runtime.js';
 import { applyToolConfigDefaults, validateToolConfig } from '../tool-validation.js';
 import { applyWranglerDefaults, validateWrangler } from '../wrangler.js';
 
@@ -79,13 +79,22 @@ const packs: MonorepoPack[] = [
     async fixPreBuild(ctx) {
       applyFixableMonorepoDefaults(ctx.root);
       await applyToolConfigDefaults(ctx.root);
-      syncBunLockfileVersions(ctx.root);
+      // Install/CI alignment only — do not rewrite -next to stable tags here.
+      syncBunLockfileVersions(ctx.root, { mode: 'install' });
       await fixNxSync(ctx.root, ctx.verbose === true);
       applyWorkspaceDependencyDefaults(ctx.root, { resolvedTargetsByProject: await readResolvedTargetsByProject(ctx) });
     },
     async validatePreBuild(ctx) {
+      // Runtime pins validate against the live PATH runtimes (devenv shell),
+      // never a stored template — outside devenv the PATH is not authoritative,
+      // mirroring the init-time syncRuntime gate above.
+      const runtimeFailures = ctx.syncRuntime ? await validateRootRuntimeVersions(ctx.root) : 0;
+      // Managed-file drift is derived state (CLI template x pinned version) with
+      // its own remediation flow; it warns instead of failing so validation only
+      // blocks on actual package issues. See warnOnManagedFileDrift.
+      warnOnManagedFileDrift(ctx.root);
       return (
-        validateManagedFiles(ctx.root) +
+        runtimeFailures +
         validateRootPackagePolicy(ctx.root) +
         validateToolConfig(ctx.root) +
         validateNxProjectNames(ctx.root) +

package/src/monorepo/publish-workflow.ts

@@ -420,7 +420,9 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
         '          "$GITHUB_OUTPUT"',
       ];
     case PublishWorkflowStepKind.CheckManagedMonorepoFiles:
-      return conditionalRunStep(step, 'smoo monorepo check');
+      // Drift is derived state with its own remediation PR; publishing only
+      // blocks on actual package issues (smoo monorepo validate).
+      return conditionalRunStep(step, 'smoo monorepo check --warn');
     case PublishWorkflowStepKind.Build:
       return conditionalRunStep(
         step,