@smoothbricks/cli 0.10.4 → 0.10.6

package/dist/monorepo/tool-validation.js

@@ -5,13 +5,19 @@ import { cliPackageVersion, isSmoothBricksCodebasePackageName } from '../lib/cli
 import { ensureDependencyMap, readJsonObject, setPackageStringField, setStringProperty, writeJsonObject, } from '../lib/json.js';
 import { readPackageJsonObject } from '../lib/workspace.js';
 const isRegistryPackument = (() => {
-    const _io0 = input => "object" === typeof input.versions && null !== input.versions && false === Array.isArray(input.versions) && _io1(input.versions);
+    const _io0 = input => "object" === typeof input.versions && null !== input.versions && false === Array.isArray(input.versions) && _io1(input.versions) && (undefined === input["dist-tags"] || "object" === typeof input["dist-tags"] && null !== input["dist-tags"] && false === Array.isArray(input["dist-tags"]) && _io2(input["dist-tags"]));
     const _io1 = input => Object.keys(input).every(key => {
         const value = input[key];
         if (undefined === value)
             return true;
         return true;
     });
+    const _io2 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return "string" === typeof value;
+    });
     return input => "object" === typeof input && null !== input && _io0(input);
 })();
 const rootDevDependencies = [
@@ -34,10 +40,14 @@ const rootDevDependencies = [
     },
     { name: 'nx', fallbackVersion: '23.1.0', minimumVersion: '23.1.0' },
     { name: 'prettier', fallbackVersion: '^3.6.1', minimumVersion: '3.6.0', prefix: '^' },
-    { name: 'ttsc', fallbackVersion: '^0.18.4', minimumVersion: '0.18.4', prefix: '^' },
+    // Exact pin: Bun patchedDependencies keys are version-locked (see patches/ttsc@0.19.3.patch).
+    { name: 'ttsc', fallbackVersion: '0.19.3' },
     // Nx and typescript-eslint still load the TypeScript JS API (6.x).
     // Compilation is exclusively delegated to ttsc by the Nx plugin targets.
-    { name: 'typescript', fallbackVersion: '^5.9.3', minimumVersion: '5.9.0', prefix: '^' },
+    { name: 'typescript', fallbackVersion: '^6.0.3', minimumVersion: '6.0.0', prefix: '^' },
+    // TS7 native compiler for ttsc (TTSC_TSGO_BINARY). Not the unscoped API package.
+    // npm alias form required — Bun cannot install @typescript/typescript6 cleanly (bun#33834).
+    { name: '@typescript/native', fallbackVersion: 'npm:typescript@^7.0.2' },
 ];
 const cliPackageName = '@smoothbricks/cli';
 const requiredDevenvPackages = ['bun', 'git', 'git-format-staged', 'jq', 'alejandra', 'coreutils', 'gnutar'];
@@ -46,15 +56,18 @@ const requiredDevenvPackages = ['bun', 'git', 'git-format-staged', 'jq', 'alejan
 // with the runtime is validated against the live PATH (validateRootRuntimeVersions),
 // never against a version template here.
 const nodePackagePattern = /(^|\s)nodejs(_\d+|_latest)?(\s|#|$)/m;
+const TTSC_PATCHED_DEPENDENCY_KEY = 'ttsc@0.19.3';
+const TTSC_PATCH_PATH = 'patches/ttsc@0.19.3.patch';
 export async function applyToolConfigDefaults(root) {
-    const context = readToolContext(root);
+    const context = await readToolContext(root);
     await applyRootPackageToolDefaults(root, context);
     applyToolingPackageDefaults(root, context.policy);
     applyDevenvPackageDefaults(root);
 }
-export function validateToolConfig(root) {
-    const context = readToolContext(root);
+export async function validateToolConfig(root) {
+    const context = await readToolContext(root);
     return (validateRootDevDependencies(context.policy, context.rootPackage) +
+        validateTtscPatchedDependency(context.rootPackage) +
         validateToolingPackage(root, context.policy) +
         validateToolingWorkspace(context.rootPackage) +
         validateDevenvPackages(root));
@@ -76,6 +89,7 @@ export async function applyRootDevDependencyDefaults(root, context) {
     if (delete devDependencies['@smoothbricks/cli']) {
         changed = true;
     }
+    changed = ensureTtscPatchedDependency(pkg) || changed;
     if (changed) {
         writeJsonObject(join(root, 'package.json'), pkg);
         console.log('updated        package.json workspace tool dependencies');
@@ -91,6 +105,7 @@ async function applyRootPackageToolDefaults(root, context) {
     }
     let dependencyChanged = false;
     let workspaceChanged = false;
+    let patchChanged = false;
     const devDependencies = ensureDependencyMap(pkg, 'devDependencies');
     for (const dependency of rootDevDependencies) {
         const current = devDependencies[dependency.name];
@@ -103,7 +118,8 @@ async function applyRootPackageToolDefaults(root, context) {
         dependencyChanged = true;
     }
     workspaceChanged = addWorkspacePattern(pkg, 'tooling');
-    if (dependencyChanged || workspaceChanged) {
+    patchChanged = ensureTtscPatchedDependency(pkg);
+    if (dependencyChanged || workspaceChanged || patchChanged) {
         writeJsonObject(join(root, 'package.json'), pkg);
     }
     console.log(dependencyChanged
@@ -112,6 +128,9 @@ async function applyRootPackageToolDefaults(root, context) {
     console.log(workspaceChanged
         ? 'updated        package.json tooling workspace'
         : 'unchanged      package.json tooling workspace');
+    console.log(patchChanged
+        ? 'updated        package.json patchedDependencies for ttsc'
+        : 'unchanged      package.json patchedDependencies for ttsc');
 }
 export function applyToolingPackageDefaults(root, policy) {
     const path = join(root, 'tooling', 'package.json');
@@ -200,6 +219,22 @@ export function validateRootDevDependencies(policy, rootPackage) {
     }
     return failures;
 }
+function ensureTtscPatchedDependency(pkg) {
+    const patched = ensureDependencyMap(pkg, 'patchedDependencies');
+    return setStringProperty(patched, TTSC_PATCHED_DEPENDENCY_KEY, TTSC_PATCH_PATH);
+}
+function validateTtscPatchedDependency(rootPackage) {
+    if (!rootPackage) {
+        return 0;
+    }
+    const actual = rootPackage.patchedDependencies?.[TTSC_PATCHED_DEPENDENCY_KEY];
+    if (actual === TTSC_PATCH_PATH) {
+        return 0;
+    }
+    console.error(`package.json patchedDependencies.${TTSC_PATCHED_DEPENDENCY_KEY} must be ${TTSC_PATCH_PATH}` +
+        (typeof actual === 'string' ? `; found ${actual}` : ' (required for declaration-emit fix)'));
+    return 1;
+}
 export function validateToolingPackage(root, policy) {
     const path = join(root, 'tooling', 'package.json');
     const pkg = readJsonObject(path);
@@ -287,6 +322,10 @@ function satisfiesDependencyPolicy(policy, version, dependency) {
     if (workspaceDependencyExpected(policy, dependency)) {
         return version === 'workspace:*';
     }
+    // Dual-package native compiler: must stay an npm:typescript@7 alias, never unscoped "typescript".
+    if (dependency.name === '@typescript/native') {
+        return isTypeScriptNativeAlias(version);
+    }
     if (dependency.minimumVersion === undefined) {
         return version === dependency.fallbackVersion;
     }
@@ -297,34 +336,38 @@ function satisfiesDependencyPolicy(policy, version, dependency) {
     }
     return compareVersions(parsed, minimum) >= 0;
 }
+function isTypeScriptNativeAlias(version) {
+    // Accept npm:typescript@7, npm:typescript@^7.0.2, npm:typescript@~7.0.2, etc.
+    return /^npm:typescript@(?:\^|~)?7(?:\.|$)/.test(version.trim());
+}
 function formatExpectedDependency(policy, dependency) {
     if (workspaceDependencyExpected(policy, dependency)) {
         return 'workspace:*';
     }
+    if (dependency.name === '@typescript/native') {
+        return 'npm:typescript@^7 (TypeScript 7 native compiler alias for ttsc)';
+    }
     return dependency.minimumVersion ? `>= ${dependency.minimumVersion}` : dependency.fallbackVersion;
 }
-export function readToolContext(root) {
+export async function readToolContext(root) {
     const rootPackage = readPackageJsonObject(join(root, 'package.json'));
     const toolingPackage = readJsonObject(join(root, 'tooling', 'package.json'));
     const configuredCliRange = toolingPackage?.dependencies?.[cliPackageName];
     return {
         rootPackage,
-        policy: toolPolicy(rootPackage, typeof configuredCliRange === 'string' ? configuredCliRange : null),
+        policy: await toolPolicy(rootPackage, typeof configuredCliRange === 'string' ? configuredCliRange : null),
     };
 }
-function toolPolicy(rootPackage, configuredCliRange) {
+async function toolPolicy(rootPackage, configuredCliRange) {
     const name = rootPackage?.name ?? null;
     const isCodebase = isSmoothBricksCodebasePackageName(name ?? undefined);
     const toolingName = toolingPackageName(name);
-    // A locally linked prerelease can be newer than every published CLI. Keep an existing
-    // installable range instead of rewriting the consumer manifest to an unpublished version.
-    const publishedCliRange = cliPackageVersion.includes('-') && configuredCliRange && parseVersion(configuredCliRange)
-        ? configuredCliRange
-        : `^${cliPackageVersion}`;
     return {
         isSmoothBricksCodebase: isCodebase,
         toolingPackageName: toolingName,
-        cliDependencyRange: isCodebase ? 'workspace:*' : publishedCliRange,
+        // Consumers pin the latest *published* CLI. Running a linked prerelease must not
+        // freeze tooling/package.json on an older range or rewrite it to an unpublished -next.
+        cliDependencyRange: isCodebase ? 'workspace:*' : await resolvePublishedCliDependencyRange(configuredCliRange),
     };
 }
 function toolingPackageName(rootName) {
@@ -345,6 +388,57 @@ async function resolveDependencyVersion(policy, dependency) {
     const latest = await fetchLatestPatchVersion(dependency.name, dependency.minimumVersion);
     return `${dependency.prefix ?? ''}${latest ?? stripRangePrefix(dependency.fallbackVersion)}`;
 }
+/**
+ * Consumer monorepos pin `@smoothbricks/cli` to the latest stable release.
+ * Prefer npm `dist-tags.latest`. Never write a running `-next` package version into
+ * consumer manifests; never leave an older pin just because the running CLI is prerelease.
+ */
+async function resolvePublishedCliDependencyRange(configuredCliRange) {
+    const latest = await fetchLatestStableVersion(cliPackageName);
+    if (latest) {
+        return `^${latest}`;
+    }
+    // Registry unavailable: if the running CLI is a stable publish, use it.
+    if (!cliPackageVersion.includes('-')) {
+        return `^${cliPackageVersion}`;
+    }
+    // Linked prerelease + offline down: keep an existing installable stable pin.
+    if (configuredCliRange && parseVersion(configuredCliRange)) {
+        return configuredCliRange;
+    }
+    // Last resort: caret of the prerelease base (0.10.5-next.0 → ^0.10.5) so manifests stay valid.
+    const base = parseVersion(cliPackageVersion);
+    return base ? `^${base.major}.${base.minor}.${base.patch}` : `^${cliPackageVersion}`;
+}
+async function fetchLatestStableVersion(packageName) {
+    const url = `https://registry.npmjs.org/${encodeURIComponent(packageName).replace('%40', '@')}`;
+    const response = await fetch(url, { headers: { accept: 'application/vnd.npm.install-v1+json' } });
+    if (!response.ok) {
+        return null;
+    }
+    const body = await response.json();
+    if (!isRegistryPackument(body)) {
+        return null;
+    }
+    const tagged = body['dist-tags']?.latest;
+    if (typeof tagged === 'string' && parseVersion(tagged) && !tagged.includes('-')) {
+        return tagged;
+    }
+    let latest = null;
+    for (const raw of Object.keys(body.versions)) {
+        if (raw.includes('-')) {
+            continue;
+        }
+        const version = parseVersion(raw);
+        if (!version) {
+            continue;
+        }
+        if (!latest || compareVersions(version, latest) > 0) {
+            latest = version;
+        }
+    }
+    return latest ? `${latest.major}.${latest.minor}.${latest.patch}` : null;
+}
 async function fetchLatestPatchVersion(packageName, minimumVersion) {
     const minorRange = sameMajorMinorRange(minimumVersion);
     const url = `https://registry.npmjs.org/${encodeURIComponent(packageName).replace('%40', '@')}`;

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAML,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAsBnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhG;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AA6nCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAML,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAsBnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhG;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAkoCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}

package/dist/release/index.js

@@ -12,6 +12,7 @@ import { withDevenvEnv } from '../lib/devenv.js';
 import { parseNxJsonText, parseNxProjectJsonText, parsePackageJsonText, } from '../lib/json.js';
 import { decode, run, runInteractiveStatus, runResult } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
+import { syncBunLockfileVersions } from '../monorepo/lockfile.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
 import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
 import { autoReleaseCandidatePackages } from './candidates.js';
@@ -301,6 +302,10 @@ async function listUnpublishedPackages(root, packages) {
 async function publishPackedPackage(root, pkg, tag, dryRun) {
     const tempDir = await mkdtemp(join(tmpdir(), 'smoo-publish-'));
     const tarball = join(tempDir, `${safeTarballPrefix(pkg.name)}-${pkg.version}.tgz`);
+    // bun pm pack resolves workspace:* from bun.lock. Day-to-day lock keeps -next
+    // (install/CI). For publish, temporarily rewrite unpublished -next entries to
+    // the last stable tag so the tarball embeds installable versions, then restore.
+    syncBunLockfileVersions(root, { mode: 'publish', log: true });
     try {
         console.log(`${pkg.name}@${pkg.version}: packing with bun pm pack`);
         await run('bun', ['pm', 'pack', '--filename', tarball, '--ignore-scripts', '--quiet'], join(root, pkg.path));
@@ -329,6 +334,7 @@ async function publishPackedPackage(root, pkg, tag, dryRun) {
         });
     }
     finally {
+        syncBunLockfileVersions(root, { mode: 'install', log: true });
         await rm(tempDir, { recursive: true, force: true });
     }
 }

package/managed/raw/envrc

@@ -11,8 +11,10 @@ esac
 
 watch_file tooling/direnv/envrc.sh
 
+# Load local extensions and overrides from the project root (the gitignored
+# .envrc-local); capture it before we cd into tooling/direnv, since envrc.sh
+# leaves us there and a bare relative path would resolve under tooling/direnv.
+local_override="$PWD/.envrc-local"
 cd tooling/direnv
 . envrc.sh
-
-# Load local extensions and overrides
-source_env_if_exists .envrc-local
+source_env_if_exists "$local_override"

package/managed/raw/patches/ttsc@0.19.3.patch

@@ -0,0 +1,67 @@
+--- a/driver/emit_plugin.go
++++ b/driver/emit_plugin.go
+@@ -163,6 +163,32 @@
+   }
+   host := &pluginEmitHost{program: p.TSProgram, emitResolver: p.Checker.GetEmitResolver()}
+   options := p.TSProgram.Options()
++  // Declaration emit must observe the original program before plugin transforms
++  // can mutate source-file nodes while assembling JavaScript output.
++  if options.GetEmitDeclarations() {
++    var wfMu sync.Mutex
++    result := p.TSProgram.Emit(context.Background(), shimcompiler.EmitOptions{
++      EmitOnly: shimcompiler.EmitOnlyDts,
++      WriteFile: func(fileName string, text string, data *shimcompiler.WriteFileData) error {
++        wfMu.Lock()
++        defer wfMu.Unlock()
++        if p.outputEscapesOutDir(fileName) {
++          if data != nil {
++            data.SkippedDtsWrite = true
++          }
++          return nil
++        }
++        if writeFile != nil {
++          return writeFile(fileName, text, data)
++        }
++        return DefaultWriteFile(fileName, text)
++      },
++    })
++    if result != nil && len(result.Diagnostics) != 0 {
++      return convertDiagnostics(result.Diagnostics), nil
++    }
++  }
++
+   for _, sf := range shimcompiler.GetSourceFilesToEmit(host, nil, false) {
+     paths := shimcompiler.GetOutputPathsFor(sf, options, host, false)
+     if paths.JsFilePath() != "" && !p.outputEscapesOutDir(paths.JsFilePath()) {
+@@ -212,31 +238,6 @@
+       }
+     }
+   }
+-  if !options.GetEmitDeclarations() {
+-    return nil, nil
+-  }
+-
+-  var wfMu sync.Mutex
+-  result := p.TSProgram.Emit(context.Background(), shimcompiler.EmitOptions{
+-    EmitOnly: shimcompiler.EmitOnlyDts,
+-    WriteFile: func(fileName string, text string, data *shimcompiler.WriteFileData) error {
+-      wfMu.Lock()
+-      defer wfMu.Unlock()
+-      if p.outputEscapesOutDir(fileName) {
+-        if data != nil {
+-          data.SkippedDtsWrite = true
+-        }
+-        return nil
+-      }
+-      if writeFile != nil {
+-        return writeFile(fileName, text, data)
+-      }
+-      return DefaultWriteFile(fileName, text)
+-    },
+-  })
+-  if result != nil && len(result.Diagnostics) != 0 {
+-    return convertDiagnostics(result.Diagnostics), nil
+-  }
+   return nil, nil
+ }
+ 

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -1,8 +1,13 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 NIX_STORE_NAR="${NIX_STORE_NAR:-/tmp/nix-store.nar}"
 nix_store_cmd="/nix/var/nix/profiles/default/bin/nix-store"
+DEVENV_FLAKE="${DEVENV_FLAKE:-github:cachix/devenv}"
+# Host CI cache (GARM bind-mount). Prefer env from runner profile.
+# Path comes from the runner (GARM profile). Ephemeral runners leave unset;
+# devenv enterShell defaults to $PWD/.cache/ttsc.
+TTSC_CACHE_DIR="${TTSC_CACHE_DIR:-}"
 # Resolve from this script's location, not the caller's cwd. GitHub Actions
 # runs this from tooling/direnv today, but direct cwd-changing helpers are easy
 # to misuse and break on repeated calls.
@@ -36,12 +41,21 @@ restore_nix_store() {
 }
 
 install_devenv() {
-  sudo mkdir -p /nix/var/nix/gcroots/ci
-  if ! command -v devenv >/dev/null 2>&1; then
-    nix profile add --accept-flake-config nixpkgs#devenv
+  # Shared host /nix/store is the package cache. Image may already provide
+  # devenv from github:cachix/devenv; otherwise profile-add the same flake
+  # (links store paths; re-fetch only when missing).
+  if command -v devenv >/dev/null 2>&1; then
+    echo "using existing devenv: $(command -v devenv) ($(devenv version 2>/dev/null || true))"
+  else
+    echo "nix profile add ${DEVENV_FLAKE}"
+    nix profile add --accept-flake-config "$DEVENV_FLAKE"
+  fi
+  if [ -d "$HOME/.nix-profile/bin" ]; then
+    echo "$HOME/.nix-profile/bin" >> "${GITHUB_PATH:-/dev/null}"
+  fi
+  if [ -n "$TTSC_CACHE_DIR" ]; then
+    mkdir -p "$TTSC_CACHE_DIR"
   fi
-  echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
-  sudo ln -sf "$HOME/.nix-profile" /nix/var/nix/gcroots/ci/profile
 }
 
 build_devenv_shell() {
@@ -50,7 +64,10 @@ build_devenv_shell() {
   # independent workflow step shells that run after this composite action.
   if [ -n "${GITHUB_ENV:-}" ]; then
     echo "TTSC_TSGO_BINARY=$repo_root/node_modules/@typescript/native/bin/tsc" >> "$GITHUB_ENV"
-    echo "TTSC_CACHE_DIR=$repo_root/.cache/ttsc" >> "$GITHUB_ENV"
+    # Only re-export when the runner (or a prior step) already set the path.
+    if [ -n "$TTSC_CACHE_DIR" ]; then
+      echo "TTSC_CACHE_DIR=$TTSC_CACHE_DIR" >> "$GITHUB_ENV"
+    fi
   fi
   # Add repo-local tools only after the shell exists; cleanup steps use an
   # explicit PATH because failures before this point must still refresh caches.

package/managed/raw/tooling/direnv/setup-environment.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { existsSync, mkdirSync, readdirSync, readlinkSync, rmSync, symlinkSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, readlinkSync, rmSync, symlinkSync } from 'node:fs';
 import { mkdir, rmdir, stat } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
@@ -98,8 +98,28 @@ function ensureTypeScriptApiPackage(root: string): void {
   assertTypescriptApiAt(path.join(root, 'node_modules', '.bun', 'node_modules', 'typescript'), apiPackageRoot);
 
   const nativeBin = path.join(root, 'node_modules', '@typescript', 'native', 'bin', 'tsc');
-  if (!existsSync(nativeBin)) {
-    throw new Error(`Missing ${nativeBin}. @typescript/native must remain the TypeScript 7 native compiler for ttsc.`);
+  const rootPackageJson = path.join(root, 'package.json');
+  const declaresNative =
+    existsSync(rootPackageJson) &&
+    (() => {
+      try {
+        const pkg = JSON.parse(readFileSync(rootPackageJson, 'utf8')) as {
+          devDependencies?: Record<string, string>;
+          dependencies?: Record<string, string>;
+        };
+        return (
+          typeof pkg.devDependencies?.['@typescript/native'] === 'string' ||
+          typeof pkg.dependencies?.['@typescript/native'] === 'string'
+        );
+      } catch {
+        return false;
+      }
+    })();
+  if (declaresNative && !existsSync(nativeBin)) {
+    throw new Error(
+      `Missing ${nativeBin}. package.json declares @typescript/native but it is not installed. ` +
+        'Run bun install (or direnv reload). @typescript/native is the TypeScript 7 native compiler for ttsc.',
+    );
   }
 }
 

package/managed/templates/github/actions/cache-nix-devenv/action.yml

@@ -1,5 +1,7 @@
 name: Cache Nix profiles, devenv and direnv
-description: Restore cached Nix/devenv state for SmoothBricks GitHub Actions jobs.
+description: >
+  Two independent segments: large nix (NAR/profiles, ephemeral runners only) and small devenv (.devenv/.direnv — eval
+  SQLite, shell scripts, profile; all runners).
 
 inputs:
   segment:
@@ -19,12 +21,11 @@ outputs:
 runs:
   using: composite
   steps:
-    # The large cache is the Nix profile plus exported store NAR. Its key tracks
-    # the expensive shell closure inputs only; tiny direnv/setup script changes
-    # should not invalidate a 1GB+ store cache.
-    - name: Restore Nix profiles, devenv and direnv
+    # Large segment: Nix profile + exported store NAR. Ephemeral runners only.
+    # Key = shell closure inputs; direnv/setup script edits must not bust a multi-GB NAR.
+    - name: Restore Nix profiles and store NAR
       id: restore-nix
-      if: ${{ inputs.segment == 'nix' && inputs.mode == 'restore' }}
+      if: inputs.segment == 'nix' && inputs.mode == 'restore'
       uses: actions/cache/restore@v5.0.5
       with:
         path: |
@@ -39,7 +40,7 @@ runs:
           ${{ runner.os }}-${{ runner.arch }}-nix-v3-
 
     - name: Save Nix profiles and store NAR
-      if: ${{ inputs.segment == 'nix' && inputs.mode == 'save' }}
+      if: inputs.segment == 'nix' && inputs.mode == 'save'
       uses: actions/cache/save@v5.0.5
       with:
         path: |
@@ -51,11 +52,12 @@ runs:
           ${{ runner.os }}-${{ runner.arch }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml',
           'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
 
-    # .devenv/.direnv are small, but they contain absolute /nix/store pointers.
-    # Workflows restore this segment only after an exact Nix cache hit.
+    # Small segment: devenv eval cache (nix-eval-cache.db), shell-*.sh, profile, .direnv.
+    # Own key. Setup restores on every runner; not gated on nix NAR hit. Devenv drops a
+    # shell cache row when drv/out are missing (GC) and re-evals/realizes.
     - name: Restore devenv and direnv state
       id: restore-devenv
-      if: ${{ inputs.segment == 'devenv' && inputs.mode == 'restore' }}
+      if: inputs.segment == 'devenv' && inputs.mode == 'restore'
       uses: actions/cache/restore@v5.0.5
       with:
         path: |
@@ -69,7 +71,7 @@ runs:
           ${{ runner.os }}-${{ runner.arch }}-devenv-v3-
 
     - name: Save devenv and direnv state
-      if: ${{ inputs.segment == 'devenv' && inputs.mode == 'save' }}
+      if: inputs.segment == 'devenv' && inputs.mode == 'save'
       uses: actions/cache/save@v5.0.5
       with:
         path: |

package/managed/templates/github/actions/save-nix-devenv/action.yml

@@ -1,5 +1,7 @@
 name: Save Nix/devenv caches
-description: Cleanup the Nix store and explicitly save Nix/devenv cache segments.
+description: >
+  Save cache segments after the job. Nix store NAR stays ephemeral-only (host uses shared /nix/store). Devenv/direnv
+  eval-cache segment saves on every runner when setup missed and build-shell produced nix-eval-cache.db.
 
 inputs:
   nix-cache-hit:
@@ -14,8 +16,19 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: 🔎 Runner kind
+      id: runner-kind
+      shell: bash
+      run: |
+        if [ "${NIX_REMOTE:-}" = daemon ] && [ -d /var/cache/ci ]; then
+          echo "host=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "host=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: 🧹 Prepare Nix/devenv cache save
       id: cleanup-cache
+      if: steps.runner-kind.outputs.host != 'true'
       shell: bash
       working-directory: tooling/direnv
       env:
@@ -33,14 +46,32 @@ runs:
         smoo github-ci cleanup-cache
 
     - name: 🧊 Save Nix profiles and store NAR
-      if: ${{ steps.cleanup-cache.outputs.cache-ready == 'true' && inputs.nix-cache-hit != 'true' }}
+      if:
+        ${{ steps.runner-kind.outputs.host != 'true' && steps.cleanup-cache.outputs.cache-ready == 'true' &&
+        inputs.nix-cache-hit != 'true' }}
       uses: ./.github/actions/cache-nix-devenv
       with:
         segment: nix
         mode: save
 
+    # Devenv segment is independent of nix NAR readiness and host vs ephemeral.
+    # Skip when setup never finished (no eval DB) so if: always() cannot poison
+    # the next restore with an empty/partial key.
+    - name: 🔎 Devenv save ready
+      id: devenv-save
+      if: inputs.devenv-cache-hit != 'true'
+      shell: bash
+      run: |
+        db="${GITHUB_WORKSPACE}/tooling/direnv/.devenv/nix-eval-cache.db"
+        if [[ -f "$db" ]]; then
+          echo "ready=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "ready=false" >> "$GITHUB_OUTPUT"
+          echo "skip devenv save: no nix-eval-cache.db"
+        fi
+
     - name: 🧊 Save devenv and direnv
-      if: ${{ steps.cleanup-cache.outputs.cache-ready == 'true' && inputs.devenv-cache-hit != 'true' }}
+      if: ${{ inputs.devenv-cache-hit != 'true' && steps.devenv-save.outputs.ready == 'true' }}
       uses: ./.github/actions/cache-nix-devenv
       with:
         segment: devenv