@smoothbricks/cli 0.10.3 → 0.10.5

package/managed/raw/tooling/direnv/setup-environment.ts

@@ -1,12 +1,12 @@
 #!/usr/bin/env bun
-import { existsSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, readlinkSync, rmSync, symlinkSync } from 'node:fs';
 import { mkdir, rmdir, stat } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import path from 'node:path';
 import { $ } from 'bun';
 
 const devenvRoot = process.env.DEVENV_ROOT;
 const projectRoot = path.resolve(`${devenvRoot}/../..`);
-const startedWithoutNodeModules = !existsSync(path.join(projectRoot, 'node_modules'));
 
 // A legitimate concurrent setup finishes well within this; anything older is a
 // leftover from an interrupted run (CTRL-C/kill before the finally-cleanup) and
@@ -14,6 +14,13 @@ const startedWithoutNodeModules = !existsSync(path.join(projectRoot, 'node_modul
 // NOTE: must be declared ABOVE the top-level setup block below — module consts
 // are not hoisted, and the lock loop runs during that block.
 const STALE_LOCK_MS = 10 * 60_000;
+// Unscoped require("typescript") must expose the TS6 compiler API for Nx.
+// @typescript/native installs another package also named "typescript" (TS7). Bun's
+// isolated linker often points node_modules/.bun/node_modules/typescript at TS7,
+// so packages resolved from the .bun store (nx) get version.cjs without readConfigFile.
+// After every install, force both unscoped typescript slots onto typescript@6.0.3.
+// Keep @typescript/native for ttsc via TTSC_TSGO_BINARY. See https://github.com/oven-sh/bun/issues/33834.
+const TYPESCRIPT_API_VERSION = '6.0.3';
 
 class CapturedCommandError extends Error {
   constructor(
@@ -30,7 +37,9 @@ class CapturedCommandError extends Error {
 process.chdir(projectRoot);
 
 try {
-  // Install dependencies first so node_modules/.bin tools are available
+  // Bootstrap only: install deps + wire local git hooks/config.
+  // Do not import workspace packages here — this script is what installs them,
+  // and package resolution/Typia transforms are not available yet.
   if (process.env.CI) {
     try {
       await runSetupCommand('bun install --frozen-lockfile', $`bun install --frozen-lockfile`, { quiet: false });
@@ -46,20 +55,9 @@ try {
     await installLocalDependencies();
   }
 
-  // Bun selects its resolver mode at process startup. If this process started
-  // before node_modules existed, imports below can stay in auto-install mode
-  // even after bun install succeeds, so restart once into the real workspace.
-  if (startedWithoutNodeModules) {
-    await runSetupCommand('restart setup-environment.ts', $`bun --no-install ${import.meta.path}`, { quiet: false });
-    process.exit(0);
-  }
-
-  if (!process.env.CI) {
-    const { syncRootRuntimeVersions } = await import('@smoothbricks/cli/monorepo/runtime');
-    await syncRootRuntimeVersions(projectRoot);
-  }
+  // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
+  ensureTypeScriptApiPackage(projectRoot);
 
-  const { applyWorkspaceGitConfig } = await import('@smoothbricks/cli/monorepo/git-config');
   await applyWorkspaceGitConfig(projectRoot);
 } catch (error) {
   if (error instanceof CapturedCommandError) {
@@ -74,14 +72,167 @@ try {
 }
 
 async function installLocalDependencies(): Promise<void> {
-  // bun install runs the root prepare script, which patches TypeScript with
-  // ts-patch. Multiple concurrent direnv activations can otherwise race while
-  // mutating the same files under node_modules.
+  // bun install runs the root prepare script. Multiple concurrent direnv
+  // activations can otherwise race while mutating the same files under
+  // node_modules.
   await withSetupLock(async () => {
     await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
   });
 }
 
+function ensureTypeScriptApiPackage(root: string): void {
+  const apiPackageRoot = findInstalledTypeScriptApiPackage(root);
+  if (!apiPackageRoot) {
+    throw new Error(
+      `typescript@${TYPESCRIPT_API_VERSION} was not installed under node_modules/.bun. ` +
+        `Keep root devDependency typescript@^${TYPESCRIPT_API_VERSION} (compiler API for Nx).`,
+    );
+  }
+
+  // Root bare require("typescript") and Bun store-local requires (nx lives under
+  // node_modules/.bun/...) must both see the API package — not @typescript/native's TS7.
+  forceSymlink(path.join(root, 'node_modules', 'typescript'), apiPackageRoot);
+  forceSymlink(path.join(root, 'node_modules', '.bun', 'node_modules', 'typescript'), apiPackageRoot);
+
+  assertTypescriptApiAt(path.join(root, 'node_modules', 'typescript'), apiPackageRoot);
+  assertTypescriptApiAt(path.join(root, 'node_modules', '.bun', 'node_modules', 'typescript'), apiPackageRoot);
+
+  const nativeBin = path.join(root, 'node_modules', '@typescript', 'native', 'bin', 'tsc');
+  const rootPackageJson = path.join(root, 'package.json');
+  const declaresNative =
+    existsSync(rootPackageJson) &&
+    (() => {
+      try {
+        const pkg = JSON.parse(readFileSync(rootPackageJson, 'utf8')) as {
+          devDependencies?: Record<string, string>;
+          dependencies?: Record<string, string>;
+        };
+        return (
+          typeof pkg.devDependencies?.['@typescript/native'] === 'string' ||
+          typeof pkg.dependencies?.['@typescript/native'] === 'string'
+        );
+      } catch {
+        return false;
+      }
+    })();
+  if (declaresNative && !existsSync(nativeBin)) {
+    throw new Error(
+      `Missing ${nativeBin}. package.json declares @typescript/native but it is not installed. ` +
+        'Run bun install (or direnv reload). @typescript/native is the TypeScript 7 native compiler for ttsc.',
+    );
+  }
+}
+
+function findInstalledTypeScriptApiPackage(root: string): string | null {
+  const bunStore = path.join(root, 'node_modules', '.bun');
+  if (!existsSync(bunStore)) {
+    return null;
+  }
+  const exact = `typescript@${TYPESCRIPT_API_VERSION}`;
+  const names = readdirSync(bunStore)
+    .filter((name) => name === exact || name.startsWith(`${exact}+`) || name.startsWith('typescript@6.'))
+    .sort((a, b) => {
+      const aExact = a === exact || a.startsWith(`${exact}+`) ? 0 : 1;
+      const bExact = b === exact || b.startsWith(`${exact}+`) ? 0 : 1;
+      return aExact - bExact || a.localeCompare(b);
+    });
+  for (const name of names) {
+    const candidate = path.join(bunStore, name, 'node_modules', 'typescript');
+    if (existsSync(path.join(candidate, 'package.json'))) {
+      return candidate;
+    }
+  }
+  return null;
+}
+
+function forceSymlink(linkPath: string, targetPath: string): void {
+  mkdirSync(path.dirname(linkPath), { recursive: true });
+  const relativeTarget = path.relative(path.dirname(linkPath), targetPath);
+  let current: string | null = null;
+  try {
+    current = readlinkSync(linkPath);
+  } catch {
+    current = null;
+  }
+  if (
+    current === relativeTarget ||
+    (current !== null && path.resolve(path.dirname(linkPath), current) === targetPath)
+  ) {
+    return;
+  }
+  rmSync(linkPath, { recursive: true, force: true });
+  symlinkSync(relativeTarget, linkPath);
+}
+
+function assertTypescriptApiAt(typescriptRoot: string, expectedTarget: string): void {
+  if (!existsSync(typescriptRoot)) {
+    throw new Error(`Missing ${typescriptRoot} after linking TypeScript ${TYPESCRIPT_API_VERSION} API package`);
+  }
+  const requireFromInstall = createRequire(path.join(typescriptRoot, 'package.json'));
+  const typed = requireFromInstall(typescriptRoot) as { version?: string; readConfigFile?: unknown };
+  if (typeof typed.readConfigFile !== 'function' || typed.version !== TYPESCRIPT_API_VERSION) {
+    throw new Error(
+      `${typescriptRoot} must export TypeScript ${TYPESCRIPT_API_VERSION} compiler API (readConfigFile). ` +
+        `Resolved version ${typed.version ?? 'unknown'} (expected link target ${expectedTarget}). ` +
+        'Bun isolated linking often points .bun/node_modules/typescript at @typescript/native (TS7). ' +
+        'See https://github.com/oven-sh/bun/issues/33834.',
+    );
+  }
+}
+
+/**
+ * Keep git hook wiring local to bootstrap. Runtime pin sync
+ * (`syncRootRuntimeVersions`) belongs to explicit monorepo tooling after the
+ * package graph exists — not the installer.
+ */
+async function applyWorkspaceGitConfig(root: string): Promise<void> {
+  const gitDirResult = await $`git rev-parse --git-dir`.cwd(root).quiet().nothrow();
+  if (gitDirResult.exitCode !== 0) {
+    throw new Error('Not in a git repository');
+  }
+
+  const gitDir = path.resolve(root, new TextDecoder().decode(gitDirResult.stdout).trim());
+  const tooling = path.join(root, 'tooling');
+
+  await $`git config --local include.path ${path.join(tooling, 'workspace.gitconfig')}`.cwd(root);
+
+  // Keep the newer runtime version pins on any merge (nvfetcher overlay +
+  // devenv.lock) so a mirror sync's `git am --3way` never stalls on a version
+  // conflict. Mapped by the managed .gitattributes (merge=smoo-newer-pins);
+  // implemented in tooling/direnv/merge-newer-pins.sh.
+  await $`git config --local merge.smoo-newer-pins.name ${'keep the newer devenv/nvfetcher runtime pins'}`.cwd(root);
+  await $`git config --local merge.smoo-newer-pins.driver ${'bash tooling/direnv/merge-newer-pins.sh %O %A %B %P'}`.cwd(
+    root,
+  );
+  linkHook(gitDir, tooling, 'pre-commit');
+  linkHook(gitDir, tooling, 'commit-msg');
+}
+
+function linkHook(gitDir: string, tooling: string, name: string): void {
+  const source = path.join(tooling, 'git-hooks', `${name}.sh`);
+  if (!existsSync(source)) {
+    throw new Error(`Missing ${name} hook source: ${source}`);
+  }
+
+  const target = path.join(gitDir, 'hooks', name);
+  if (readLinkOrNull(target) === source) {
+    return;
+  }
+
+  console.log(`[!] Linking ${name} hook in ${gitDir}`);
+  mkdirSync(path.dirname(target), { recursive: true });
+  rmSync(target, { force: true });
+  symlinkSync(source, target);
+}
+
+function readLinkOrNull(hookPath: string): string | null {
+  try {
+    return readlinkSync(hookPath);
+  } catch {
+    return null;
+  }
+}
+
 async function runSetupCommand(
   command: string,
   shell: ReturnType<typeof $>,

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -9,12 +9,6 @@ set -e -o pipefail
 # Format exactly what is staged so the commit includes the formatter output.
 git-format-staged
 
-# Any `bun install` rewrites bun.lock workspace versions from package.json,
-# reverting the stable-tag versions the release flow syncs (see
-# packages/cli/src/monorepo/lockfile.ts). Self-heal here instead of failing a
-# later commit on drift it didn't cause.
-smoo monorepo sync-bun-lockfile-versions --stage
-
 # Adding a workspace package is rare and easy to leave half-wired. Run the
 # full monorepo validator only for newly staged package manifests.
 smoo monorepo validate --fail-fast --only-if-new-workspace-package

package/managed/templates/github/actions/cache-node-modules/action.yml

@@ -7,8 +7,11 @@ runs:
     - name: Cache node_modules
       uses: actions/cache@v5.0.5
       with:
+        # Dependencies only. ttsc plugin/GOCACHE live under $TTSC_CACHE_DIR
+        # (.cache/ttsc), not inside node_modules.
+        # v2 isolates restore-keys from older Darwin caches with a broken TS dual-package hoist.
         path: node_modules
         # prettier-ignore
-        key: ${{ runner.os }}-${{ runner.arch }}-node-{{NODE_MODULES_CACHE_KEY}}
+        key: ${{ runner.os }}-${{ runner.arch }}-node-v2-{{NODE_MODULES_CACHE_KEY}}
         restore-keys: |
-          ${{ runner.os }}-${{ runner.arch }}-node-
+          ${{ runner.os }}-${{ runner.arch }}-node-v2-

package/managed/templates/github/actions/cache-ttsc-plugins/action.yml

@@ -0,0 +1,19 @@
+name: Cache ttsc plugins
+description: >
+  Restore/save compiled ttsc native plugin binaries (typia, etc.). These are content-keyed under TTSC_CACHE_DIR/plugins
+  and skip the multi-minute `go build` when the cache key matches. The Go object cache (go-build/) is NOT cached — it is
+  multi-GB and only helps when the plugin key misses.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache ttsc plugin binaries
+      uses: actions/cache@v5.0.5
+      with:
+        # Only the compiled plugin binaries (~30MB each). Path is relative to the
+        # workspace; devenv sets TTSC_CACHE_DIR to <repo>/.cache/ttsc.
+        path: .cache/ttsc/plugins
+        # prettier-ignore
+        key: ${{ runner.os }}-${{ runner.arch }}-ttsc-plugins-v1-${{ hashFiles('bun.lock', 'package.json', 'patches/ttsc@*.patch', 'tooling/direnv/devenv.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-${{ runner.arch }}-ttsc-plugins-v1-

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -51,6 +51,11 @@ runs:
     - name: 📦 Cache node_modules
       uses: ./.github/actions/cache-node-modules
 
+    # Restores compiled ttsc native plugins into .cache/ttsc/plugins. TTSC_CACHE_DIR
+    # is set by devenv enterShell (+ bootstrap GITHUB_ENV for later steps).
+    - name: 🧊 Cache ttsc plugins
+      uses: ./.github/actions/cache-ttsc-plugins
+
     - name: 🐚 Build devenv shell
       shell: bash
       working-directory: tooling/direnv

package/managed/templates/github/workflows/managed-files.yml

@@ -0,0 +1,80 @@
+# Managed by @smoothbricks/cli (smoo monorepo update) - do not edit by hand.
+#
+# Self-healing loop for smoo-managed files: ci.yml runs the authoritative
+# `smoo monorepo check` on every default-branch push (devenv is already up
+# there, so the check is ~free) and dispatches THIS workflow only when real
+# drift exists - typically after a @smoothbricks/cli pin bump. It runs
+# `smoo monorepo update` and pushes the result to ONE persistent review branch
+# (chore/managed-files) with ONE PR. The PR is NEVER auto-merged: a template
+# change is upstream code that deserves a human look before it lands. Re-runs
+# refresh the same branch in place.
+#
+# NOTE: managed files include .github/workflows/*, and the default GITHUB_TOKEN
+# is server-side forbidden to push workflow-file changes. Configure a GitHub App
+# or PAT token with contents:write + workflows:write as MANAGED_FILES_TOKEN;
+# without it, runs that touch workflow files fail at push with a clear error.
+name: Managed files
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: managed-files
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: tooling/direnv
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: 📥 Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          filter: blob:none
+          fetch-depth: 0
+          persist-credentials: true
+          token: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
+
+      - name: 🧱 Setup Nix/devenv
+        id: setup
+        uses: ./.github/actions/setup-devenv
+
+      - name: 🔄 Regenerate managed files
+        run: smoo monorepo update
+
+      - name: 📤 Push review branch and open PR
+        env:
+          GH_TOKEN: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
+        run: |
+          cd "$(git rev-parse --show-toplevel)"
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "Managed files are in sync; nothing to do."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -C chore/managed-files
+          git add -A
+          git commit -m "chore: regenerate smoo-managed files"
+          git push --force origin chore/managed-files
+          gh pr create \
+            --head chore/managed-files \
+            --base "${GITHUB_REF_NAME}" \
+            --title "chore: regenerate smoo-managed files" \
+            --body "Automated refresh of smoo-managed files after drift (usually a @smoothbricks/cli pin bump). One persistent PR; re-runs force-push this branch in place. Review the template changes - do NOT enable auto-merge." \
+            2>/dev/null || echo "PR already open; branch refreshed in place."
+
+      - name: 🧹 Cleanup and cache Nix/devenv
+        if: ${{ always() }}
+        uses: ./.github/actions/save-nix-devenv
+        with:
+          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}
+          devenv-cache-hit: ${{ steps.setup.outputs.devenv-cache-hit }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.10.3",
+  "version": "0.10.5",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -20,6 +20,13 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./bun/preload": {
+      "types": "./dist/bun/preload.d.ts",
+      "bun": "./src/bun/preload.ts",
+      "development": "./src/bun/preload.ts",
+      "import": "./dist/bun/preload.js",
+      "default": "./dist/bun/preload.js"
+    },
     "./monorepo/runtime": {
       "types": "./dist/monorepo/runtime.d.ts",
       "bun": "./src/monorepo/runtime.ts",
@@ -42,6 +49,10 @@
       "default": "./dist/wrangler/prepare-env.js"
     }
   },
+  "sideEffects": [
+    "./dist/bun/preload.js",
+    "./src/bun/preload.ts"
+  ],
   "files": [
     "README.md",
     "bin",
@@ -53,8 +64,8 @@
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
     "@prettier/sync": "^0.6.1",
-    "@smoothbricks/nx-plugin": "0.3.2",
-    "@smoothbricks/validation": "0.1.3",
+    "@smoothbricks/nx-plugin": "0.3.4",
+    "@smoothbricks/validation": "0.1.4",
     "commander": "^14.0.3",
     "prettier": "^3.6.1",
     "publint": "^0.3.18",
@@ -62,7 +73,7 @@
     "sherif": "^1.11.1",
     "toml-eslint-parser": "^1.0.3",
     "tslib": "^2.8.1",
-    "typia": "13.1.1"
+    "typia": "13.1.19"
   },
   "devDependencies": {
     "fast-check": "^4.4.0"

package/src/bun/preload.ts

@@ -0,0 +1,12 @@
+/**
+ * Bun runtime preload for consumers of `@smoothbricks/cli`.
+ *
+ * Re-exports the Typia/ttsc transform preload from `@smoothbricks/validation`.
+ * External repos depend on the CLI package only — they must not need a direct
+ * `@smoothbricks/validation` dependency just to run `smoo` against source.
+ *
+ * Usage:
+ *   import '@smoothbricks/cli/bun/preload';
+ *   // or bunfig.toml: preload = ["@smoothbricks/cli/bun/preload"]
+ */
+import '@smoothbricks/validation/bun/preload';

package/src/cli.ts

@@ -59,12 +59,15 @@ function buildProgram(): Command {
     );
   monorepo.command('update').action(async () => {
     const { updateManagedFiles } = await import('./monorepo/index.js');
-    updateManagedFiles(await findRepoRoot());
-  });
-  monorepo.command('check').action(async () => {
-    const { checkManagedFiles } = await import('./monorepo/index.js');
-    checkManagedFiles(await findRepoRoot());
+    await updateManagedFiles(await findRepoRoot());
   });
+  monorepo
+    .command('check')
+    .option('--warn', 'report drift as warnings (GitHub annotations) instead of failing')
+    .action(async (options: { warn?: boolean }) => {
+      const { checkManagedFiles } = await import('./monorepo/index.js');
+      checkManagedFiles(await findRepoRoot(), { warn: options.warn });
+    });
   monorepo.command('diff').action(async () => {
     const { diffManagedFiles } = await import('./monorepo/index.js');
     diffManagedFiles(await findRepoRoot());
@@ -78,10 +81,19 @@ function buildProgram(): Command {
     });
   monorepo
     .command('sync-bun-lockfile-versions')
-    .option('--stage', 'stage bun.lock when versions were resynced (pre-commit self-heal); quiet when clean')
-    .action(async (options: { stage?: boolean }) => {
+    .option('--stage', 'stage bun.lock when versions were resynced; quiet when clean')
+    .option(
+      '--mode <mode>',
+      'install: match package.json (default, CI); publish: map unpublished -next to last stable tag (pre-pack only)',
+      'install',
+    )
+    .action(async (options: { stage?: boolean; mode?: 'install' | 'publish' }) => {
       const { syncBunLockfileVersions } = await import('./monorepo/index.js');
-      syncBunLockfileVersions(await findRepoRoot(), options.stage ? { log: false, stage: true } : {});
+      const mode = options.mode === 'publish' ? 'publish' : 'install';
+      syncBunLockfileVersions(await findRepoRoot(), {
+        mode,
+        ...(options.stage ? { log: false, stage: true } : {}),
+      });
     });
   monorepo
     .command('list-release-packages')

package/src/generate/index.ts

@@ -42,12 +42,6 @@ export const variants: Record<string, GenerateVariant> = {
     args: (name) => ['--name', name, '--variant', 'ts-lib'],
     options: [{ flag: '--public', description: 'configure for npm publication' }],
   },
-  'ts-zig': {
-    generator: 'create-package',
-    description: 'Create a TypeScript + Zig/WASM hybrid package',
-    args: (name) => ['--name', name, '--variant', 'ts-zig'],
-    options: [{ flag: '--public', description: 'configure for npm publication' }],
-  },
   'make-public': {
     generator: 'make-public',
     description: 'Promote a private package to npm publication',

package/src/github-ci/index.ts

@@ -1,11 +1,30 @@
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { appendFile, mkdtemp, realpath, rename, rm } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { $ } from 'bun';
+import typia from 'typia';
+import { parseStringArrayText } from '../lib/json.js';
 import { decode, run, runStatus } from '../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../nx/index.js';
 import type { NxTargetRun } from './outputs.js';
 
+interface GithubActionsEventPayload {
+  repository?: {
+    default_branch?: string;
+  };
+}
+
+interface NxProjectDeployConfigurations {
+  targets?: {
+    deploy?: {
+      configurations?: Record<string, unknown>;
+    };
+  };
+}
+
+const parseGithubActionsEvent = typia.json.createIsParse<GithubActionsEventPayload>();
+const parseNxProjectDeployConfigurations = typia.json.createIsParse<NxProjectDeployConfigurations>();
+
 type NxSmartMode = 'auto' | 'affected' | 'run-many';
 
 export async function cleanupGithubCiCache(root: string): Promise<void> {
@@ -279,7 +298,7 @@ export async function githubCiApplyOutputs(
 async function loadOutputBoundary() {
   if (import.meta.url.endsWith('/src/github-ci/index.ts')) {
     // The source self-hosting shim has no Typia transform; register it before loading manifest validators.
-    await import('@smoothbricks/validation/bun/preload');
+    await import('@smoothbricks/cli/bun/preload');
   }
   // This boundary must stay lazy because the transformed dist and source self-hosting paths initialize Typia differently.
   return import('./outputs.js');
@@ -341,7 +360,31 @@ function resolveNxSmartMode(mode: NxSmartMode): 'affected' | 'run-many' {
   if (mode === 'affected' || mode === 'run-many') {
     return mode;
   }
-  return process.env.GITHUB_EVENT_NAME === 'push' && process.env.GITHUB_REF_NAME === 'main' ? 'run-many' : 'affected';
+  const defaultBranch = eventDefaultBranch() ?? 'main';
+  if (process.env.GITHUB_EVENT_NAME === 'push') {
+    return process.env.GITHUB_REF_NAME === defaultBranch ? 'run-many' : 'affected';
+  }
+  // A PR into a NON-default branch is an integration surface (e.g. a mirror-sync
+  // review branch): its base moves outside the default-branch workflow that
+  // affected scoping is calibrated against, so under-selection can pass PR CI
+  // and only fail after merge. Validate those PRs in full.
+  if (process.env.GITHUB_EVENT_NAME === 'pull_request') {
+    const base = process.env.GITHUB_BASE_REF;
+    return base && base !== defaultBranch ? 'run-many' : 'affected';
+  }
+  return 'affected';
+}
+
+/** The repository default branch from the Actions event payload. */
+function eventDefaultBranch(): string | undefined {
+  const eventPath = process.env.GITHUB_EVENT_PATH;
+  if (!eventPath) return undefined;
+  try {
+    const payload = parseGithubActionsEvent(readFileSync(eventPath, 'utf8'));
+    return payload?.repository?.default_branch || undefined;
+  } catch {
+    return undefined;
+  }
 }
 
 async function deployProjectsWithConfiguration(
@@ -366,24 +409,12 @@ async function deployProjectsWithConfiguration(
 
 async function deployTargetHasConfiguration(root: string, project: string, configuration: string): Promise<boolean> {
   const result = await $`nx show project ${project} --json`.cwd(root).quiet();
-  const parsed: unknown = JSON.parse(decode(result.stdout));
-  const targets = recordValue(parsed)?.targets;
-  const deploy = recordValue(targets)?.deploy;
-  const configurations = recordValue(deploy)?.configurations;
-  return recordValue(configurations)?.[configuration] !== undefined;
+  const parsed = parseNxProjectDeployConfigurations(decode(result.stdout));
+  return parsed?.targets?.deploy?.configurations?.[configuration] !== undefined;
 }
 
 function nxProjectList(output: string): string[] {
-  const parsed: unknown = JSON.parse(output);
-  return Array.isArray(parsed) ? parsed.filter((project): project is string => typeof project === 'string') : [];
-}
-
-function recordValue(value: unknown): Record<string, unknown> | undefined {
-  return isRecord(value) ? value : undefined;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === 'object' && !Array.isArray(value);
+  return parseStringArrayText(output) ?? [];
 }
 
 async function createGithubStatus(name: string, step: string): Promise<void> {

package/src/github-ci/outputs.ts

@@ -2,7 +2,6 @@ import { createHash } from 'node:crypto';
 import { createReadStream, type Dirent, type Stats } from 'node:fs';
 import { copyFile, lstat, mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
 import { isAbsolute, relative, resolve, sep } from 'node:path';
-import { isRecord } from '@smoothbricks/validation';
 import typia from 'typia';
 import { type ProjectTargets, readProjectTargets } from '../nx/index.js';
 
@@ -492,7 +491,7 @@ function assertGitSha(value: string, description: string): void {
 }
 
 function isMissingPathError(error: unknown): boolean {
-  return isRecord(error) && error.code === 'ENOENT';
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT';
 }
 
 function sha256File(path: string): Promise<string> {

package/src/lib/cli-package.ts

@@ -1,12 +1,12 @@
 import { fileURLToPath } from 'node:url';
-import { readJsonObject, stringProperty } from './json.js';
+import { readJsonObject } from './json.js';
 
 export const smoothBricksCodebasePackageName = '@smoothbricks/codebase';
 export const cliPackageVersion = readCliPackageVersion();
 
 function readCliPackageVersion(): string {
   const pkg = readJsonObject(fileURLToPath(new URL('../../package.json', import.meta.url)));
-  const version = pkg ? stringProperty(pkg, 'version') : null;
+  const version = pkg?.version;
   if (!version) {
     throw new Error('Unable to read @smoothbricks/cli package version.');
   }