@smoothbricks/cli 0.10.5 → 0.10.7

package/dist/monorepo/managed-files.js

@@ -1,10 +1,9 @@
-import { execFileSync } from 'node:child_process';
 import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { parseNxProjectJsonText, parseStringArrayText } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
+import { loadNxProjects, targetNamesFromProjects } from '../nx/index.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
 /**
@@ -100,6 +99,12 @@ const managedFiles = [
         source: 'envrc',
         target: '.envrc',
     },
+    {
+        kind: 'raw',
+        source: 'tooling/devenv',
+        target: 'tooling/devenv',
+        executable: true,
+    },
     {
         kind: 'raw',
         source: 'tooling/direnv/repo-path',
@@ -146,11 +151,6 @@ const managedFiles = [
         target: 'tooling/direnv/merge-newer-pins.sh',
         executable: true,
     },
-    {
-        kind: 'raw',
-        source: 'patches/ttsc@0.19.3.patch',
-        target: 'patches/ttsc@0.19.3.patch',
-    },
     {
         kind: 'generated',
         source: 'ci-workflow',
@@ -198,9 +198,10 @@ const managedFiles = [
         target: '.github/actions/cache-nx/action.yml',
     },
 ];
+export const managedFileTargetsForTest = managedFiles.map(({ target, executable }) => ({ target, executable }));
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
-export function applyManagedFiles(root, mode) {
-    const context = getManagedFileContext(root);
+export async function applyManagedFiles(root, mode) {
+    const context = await getManagedFileContext(root);
     return managedFiles.map((file) => applyManagedFile(root, file, mode, context));
 }
 function applyManagedFile(root, file, mode, context) {
@@ -244,6 +245,7 @@ function getManagedContent(file, context) {
                 deploy: context.hasStagingDeployTargets,
                 deployProvider: context.stagingDeployProvider,
                 pushBranches: context.ciPushBranches,
+                runsOn: context.ciRunsOn,
             });
         }
         if (file.source === 'publish-workflow') {
@@ -252,6 +254,7 @@ function getManagedContent(file, context) {
                 deployProvider: context.productionDeployProvider,
                 repoName: context.repoName,
                 platformTargetGlobs: context.platformTargetGlobs,
+                runsOn: context.ciRunsOn,
             });
         }
         throw new Error(`Unknown generated managed file source ${file.source}`);
@@ -264,13 +267,16 @@ function getManagedContent(file, context) {
     }
     return renderTemplate(context, content);
 }
-function getManagedFileContext(root) {
+async function getManagedFileContext(root) {
     const packageJson = readPackageJson(join(root, 'package.json'));
     const repoName = packageJson?.name ?? 'monorepo';
     const ciPushBranches = getCiPushBranches(packageJson?.json);
-    const stagingDeploy = getDeployTargetInfo(root, 'staging');
-    const productionDeploy = getDeployTargetInfo(root, 'production');
-    const platformTargetGlobs = platformTargetGlobsForTest(readResolvedNxTargetNames(root));
+    const ciRunsOn = getCiRunsOn(packageJson?.json);
+    // In-process Nx API → daemon socket (no second Node/`nx` CLI process).
+    const nxProjects = await loadNxProjects(root);
+    const stagingDeploy = deployTargetInfoFromProjects(nxProjects, 'staging');
+    const productionDeploy = deployTargetInfoFromProjects(nxProjects, 'production');
+    const platformTargetGlobs = platformTargetGlobsForTest(targetNamesFromProjects(nxProjects));
     const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
         ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
         : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
@@ -281,6 +287,7 @@ function getManagedFileContext(root) {
         stagingDeployProvider: stagingDeploy.provider,
         productionDeployProvider: productionDeploy.provider,
         ciPushBranches,
+        ciRunsOn,
         nodeModulesCacheKey,
         repoName,
         platformTargetGlobs,
@@ -293,77 +300,50 @@ export function platformTargetGlobsForTest(targetNames) {
         return names.some((name) => name.endsWith(suffix));
     });
 }
-function readResolvedNxTargetNames(root) {
-    const output = execFileSync('nx', ['show', 'projects', '--json'], {
-        cwd: root,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'inherit'],
-    });
-    const projects = parseStringArrayText(output);
-    if (!projects) {
-        return [];
-    }
-    const targetNames = new Set();
-    for (const project of projects) {
-        const projectOutput = execFileSync('nx', ['show', 'project', project, '--json'], {
-            cwd: root,
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'inherit'],
-        });
-        const projectJson = parseNxProjectJsonText(projectOutput);
-        const targets = projectJson?.targets;
-        if (targets) {
-            for (const targetName of Object.keys(targets)) {
-                targetNames.add(targetName);
-            }
-        }
-    }
-    return [...targetNames];
-}
-function renderTemplate(context, template) {
-    return template
-        .replaceAll('{{REPO_NAME}}', context.repoName)
-        .replaceAll('__SMOO_CI_PUSH_BRANCHES__', renderYamlFlowList(context.ciPushBranches))
-        .replaceAll('{{NODE_MODULES_CACHE_KEY}}', context.nodeModulesCacheKey);
-}
-function getDeployTargetInfo(root, configuration) {
-    const output = execFileSync('nx', ['show', 'projects', '--withTarget', 'deploy', '--json'], {
-        cwd: root,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'inherit'],
-    });
-    const projects = parseStringArrayText(output);
-    if (!projects) {
-        return { exists: false };
-    }
+/** Test seam: deploy configuration presence/provider from graph nodes. */
+export function deployTargetInfoFromProjects(projects, configuration) {
     let exists = false;
     let provider;
-    for (const project of projects) {
-        const target = nxDeployTarget(root, project, configuration);
-        if (!target.exists) {
+    for (const project of Object.values(projects)) {
+        const info = deployTargetInfoFromTargets(project.targets ?? {}, configuration);
+        if (!info.exists) {
             continue;
         }
         exists = true;
-        provider ??= target.provider;
+        provider ??= info.provider;
     }
     return { exists, provider };
 }
-function nxDeployTarget(root, project, configuration) {
-    const output = execFileSync('nx', ['show', 'project', project, '--json'], {
-        cwd: root,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'inherit'],
-    });
-    const projectJson = parseNxProjectJsonText(output);
-    const deploy = projectJson?.targets?.deploy;
-    const config = deploy?.configurations?.[configuration];
+function deployTargetInfoFromTargets(targets, configuration) {
+    const deploy = targets.deploy;
+    if (!deploy) {
+        return { exists: false };
+    }
+    const config = deploy.configurations?.[configuration];
     if (!config) {
         return { exists: false };
     }
-    const commandValue = config.command ?? config.options?.command ?? deploy?.options?.command;
+    const commandValue = config.command ?? config.options?.command ?? deploy.options?.command ?? deploy.command;
     const command = typeof commandValue === 'string' ? commandValue : '';
     return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }
+function renderTemplate(context, template) {
+    return template
+        .replaceAll('{{REPO_NAME}}', context.repoName)
+        .replaceAll('__SMOO_CI_PUSH_BRANCHES__', renderYamlFlowList(context.ciPushBranches))
+        .replaceAll('{{NODE_MODULES_CACHE_KEY}}', context.nodeModulesCacheKey);
+}
+function getCiRunsOn(packageJson) {
+    const configured = packageJson?.smoo?.github?.runsOn;
+    if (configured === undefined) {
+        return 'ubuntu-latest';
+    }
+    if (typeof configured === 'string') {
+        return configured.length > 0 ? configured : 'ubuntu-latest';
+    }
+    const labels = configured.filter((label) => label.length > 0);
+    return labels.length > 0 ? labels : 'ubuntu-latest';
+}
 function getCiPushBranches(packageJson) {
     const configured = readCiPushBranches(packageJson);
     return configured.length > 0 ? configured : ['main'];
@@ -384,8 +364,8 @@ export function printResults(results) {
         console.log(`${result.action.padEnd(15)} ${result.target}`);
     }
 }
-export function validateManagedFiles(root) {
-    const results = applyManagedFiles(root, 'check');
+export async function validateManagedFiles(root) {
+    const results = await applyManagedFiles(root, 'check');
     printResults(results);
     const failures = results.filter((result) => result.action === 'drifted').length;
     if (failures > 0) {
@@ -403,8 +383,8 @@ export function validateManagedFiles(root) {
  * Under GitHub Actions the drifted-file count is published as the step output
  * `drifted`, so downstream steps gate declaratively instead of parsing logs.
  */
-export function warnOnManagedFileDrift(root) {
-    const results = applyManagedFiles(root, 'check');
+export async function warnOnManagedFileDrift(root) {
+    const results = await applyManagedFiles(root, 'check');
     printResults(results);
     const drifted = results.filter((result) => result.action === 'drifted');
     if (process.env.GITHUB_OUTPUT) {

package/dist/monorepo/package-policy.js

@@ -113,7 +113,7 @@ export function applyWorkspaceDependencyDefaults(root, options = {}) {
     else {
         console.log('unchanged      tsconfig.test.json policy');
     }
-    if (applyWorkspaceBoundedTestTargetPolicy(root)) {
+    if (applyWorkspaceBoundedTestTargetPolicy(root, options)) {
         console.log('updated        package test targets bounded execution policy');
     }
     else {
@@ -343,7 +343,7 @@ export function validateWorkspaceDependencies(root, options = {}) {
         console.error(`${issue.path}: ${issue.message}`);
         failures++;
     }
-    for (const issue of checkWorkspaceBoundedTestTargetPolicy(root)) {
+    for (const issue of checkWorkspaceBoundedTestTargetPolicy(root, options)) {
         console.error(`${issue.path}: ${issue.message}`);
         failures++;
     }

package/dist/monorepo/packs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAK5E,OAAO,EAKL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAqHD,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAuMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAaxG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAK5E,OAAO,EAKL,KAAK,sBAAsB,EAO5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAqHD,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAuMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAexG"}

package/dist/monorepo/packs/index.js

@@ -40,7 +40,7 @@ const packs = [
             // Managed-file drift is derived state (CLI template x pinned version) with
             // its own remediation flow; it warns instead of failing so validation only
             // blocks on actual package issues. See warnOnManagedFileDrift.
-            warnOnManagedFileDrift(ctx.root);
+            await warnOnManagedFileDrift(ctx.root);
             return (runtimeFailures +
                 validateRootPackagePolicy(ctx.root) +
                 (await validateToolConfig(ctx.root)) +
@@ -315,10 +315,12 @@ export function resolvedTargetsByProject(projects) {
     return new Map(projects.map((project) => [
         project.project,
         {
+            ...(project.root ? { root: project.root } : {}),
             targets: new Set(project.targets),
             ...(project.buildDependsOn ? { buildDependsOn: project.buildDependsOn } : {}),
             ...(project.targetDependencies ? { targetDependencies: project.targetDependencies } : {}),
             ...(project.targetExecutors ? { targetExecutors: project.targetExecutors } : {}),
+            ...(project.targetOptions ? { targetOptions: project.targetOptions } : {}),
             ...(project.targetScripts ? { targetScripts: project.targetScripts } : {}),
         },
     ]));

package/dist/monorepo/publish-workflow.d.ts

@@ -1,3 +1,4 @@
+import { type WorkflowRunsOn } from './github-runs-on.js';
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
 export type PublishWorkflowCondition = 'version-mode-not-none' | 'deploy-production' | 'failure' | 'always';
 export type PublishWorkflowNxTarget = 'build' | 'lint' | 'test';
@@ -35,6 +36,8 @@ export interface PublishWorkflowDefinitionOptions {
     deployProvider?: 'cloudflare';
     repoName?: string;
     platformTargetGlobs?: readonly string[];
+    /** Linux jobs only. Default ubuntu-latest. Same smoo.github.runsOn as CI. */
+    runsOn?: WorkflowRunsOn;
 }
 export interface PublishWorkflowInputs {
     bump: PublishWorkflowBump;

package/dist/monorepo/publish-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5G,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,YAAY,CAAC;AAErE,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,kBAAkB,0BAA0B;IAC5C,qBAAqB,4BAA4B;IACjD,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,iBAAiB,EAAE,gCAAgC,CAAC;IACpD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CAoE/G;AAMD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAsEnC;AAoBD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CAchG"}
+{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AASA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAQ5E,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5G,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,YAAY,CAAC;AAErE,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,kBAAkB,0BAA0B;IAC5C,qBAAqB,4BAA4B;IACjD,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,iBAAiB,EAAE,gCAAgC,CAAC;IACpD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CAoE/G;AAMD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAsEnC;AAoBD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CAchG"}

package/dist/monorepo/publish-workflow.js

@@ -2,6 +2,7 @@
 import synchronizedPrettier from '@prettier/sync';
 import { LINUX_PLATFORM_TARGET_GLOBS, MACOS_PLATFORM_TARGET_GLOBS, } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
+import { renderRunsOnLine } from './github-runs-on.js';
 const PUBLISH_WORKFLOW_FORMAT_OPTIONS = Object.freeze({
     parser: 'yaml',
     printWidth: 120,
@@ -338,7 +339,8 @@ function yamlLinesForStep(step, options) {
         case PublishWorkflowStepKind.UploadTraceDbs:
             return [
                 `      - name: ${step.name}`,
-                `        if: ${githubExpression('failure()')}`,
+                '        # Default is success(); failure() uploads traces only when the job already failed.',
+                '        if: failure()',
                 '        uses: actions/upload-artifact@v7.0.1',
                 '        with:',
                 `          name: trace-results-${githubExpression('github.run_id')}`,
@@ -362,7 +364,8 @@ function yamlLinesForStep(step, options) {
         case PublishWorkflowStepKind.SaveNixDevenv:
             return [
                 `      - name: ${step.name}`,
-                `        if: ${githubExpression('always()')}`,
+                '        # success() is default; always() still saves GH Nix cache after a red job.',
+                '        if: always()',
                 '        uses: ./.github/actions/save-nix-devenv',
                 '        with:',
                 `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
@@ -392,7 +395,7 @@ function deployEnvLines(options) {
 }
 function conditionalRunStep(step, run) {
     const condition = "steps.version.outputs.mode != 'none'";
-    return [`      - name: ${step.name}`, `        if: ${githubExpression(condition)}`, `        run: ${run}`];
+    return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
 }
 function renderSingleJobPublishWorkflowSteps(steps, options) {
     const lines = [];
@@ -402,7 +405,7 @@ function renderSingleJobPublishWorkflowSteps(steps, options) {
         lines.push(...yamlLinesForStep(step, options));
         lines.push('');
         if (step.kind === PublishWorkflowStepKind.Build) {
-            lines.push('      - name: 🐧 Build supplemental Linux targets', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, `        run: smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}"`, '');
+            lines.push('      - name: 🐧 Build supplemental Linux targets', "        if: steps.version.outputs.mode != 'none'", `        run: smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}"`, '');
         }
     }
     return `${lines.join('\n').trimEnd()}\n`;
@@ -447,7 +450,7 @@ defaults:
 
 jobs:
   linux-release-candidate:
-    runs-on: ubuntu-latest
+${renderRunsOnLine(options.runsOn)}
     permissions:
       contents: write
       id-token: none
@@ -508,7 +511,7 @@ function renderLinuxReleaseCandidateSteps(steps, options) {
             lines.push(`      - name: ${step.name}`, '        uses: actions/checkout@v6.0.2', '        with:', `          ref: ${githubExpression('github.sha')}`, '          filter: blob:none', '          fetch-depth: 0');
         }
         else if (step.kind === PublishWorkflowStepKind.Build) {
-            lines.push(`      - name: ${step.name}`, `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        run:', `          smoo github-ci nx-run-many --targets build --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/release-build-outputs"`);
+            lines.push(`      - name: ${step.name}`, "        if: steps.version.outputs.mode != 'none'", '        run:', `          smoo github-ci nx-run-many --targets build --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/release-build-outputs"`);
         }
         else {
             lines.push(...yamlLinesForStep(step, options));
@@ -519,16 +522,16 @@ function renderLinuxReleaseCandidateSteps(steps, options) {
             stepNumber += 1;
         }
         if (step.kind === PublishWorkflowStepKind.Build && hasLinuxPlatformTargets(options)) {
-            lines.push('', `      # Step ${stepNumber}`, '      - name: 🐧 Build supplemental Linux targets', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        run:', `          smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/linux-platform-outputs"`);
+            lines.push('', `      # Step ${stepNumber}`, '      - name: 🐧 Build supplemental Linux targets', "        if: steps.version.outputs.mode != 'none'", '        run:', `          smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/linux-platform-outputs"`);
             stepNumber += 1;
         }
         lines.push('');
     }
-    lines.push('      # --- Candidate transfer --------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Bundle validated release state', '        run:', `          mkdir -p "${githubExpression('runner.temp')}/publish-release-state" && git bundle create`, `          "${githubExpression('runner.temp')}/publish-release-state/release-state.bundle" HEAD --tags && git rev-parse HEAD >`, `          "${githubExpression('runner.temp')}/publish-release-state/release-head"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated release state', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-state-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/publish-release-state`, '          if-no-files-found: error', '          retention-days: 1', '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated build outputs', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/release-build-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
+    lines.push('      # --- Candidate transfer --------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Bundle validated release state', '        run:', `          mkdir -p "${githubExpression('runner.temp')}/publish-release-state" && git bundle create`, `          "${githubExpression('runner.temp')}/publish-release-state/release-state.bundle" HEAD --tags && git rev-parse HEAD >`, `          "${githubExpression('runner.temp')}/publish-release-state/release-head"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated release state', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-state-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/publish-release-state`, '          if-no-files-found: error', '          retention-days: 1', '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated build outputs', "        if: steps.version.outputs.mode != 'none'", '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/release-build-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
     if (hasLinuxPlatformTargets(options)) {
-        lines.push('', `      # Step ${stepNumber++}`, '      - name: 📤 Upload supplemental Linux outputs', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-linux-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/linux-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
+        lines.push('', `      # Step ${stepNumber++}`, '      - name: 📤 Upload supplemental Linux outputs', "        if: steps.version.outputs.mode != 'none'", '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-linux-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/linux-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
     }
-    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', `        if: ${githubExpression('always()')}`, '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
+    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', '        # success() is default; always() still saves GH Nix cache after a red job.', '        if: always()', '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
     return lines.join('\n').trimEnd();
 }
 function renderMacosPlatformSteps(options) {
@@ -554,7 +557,7 @@ function renderMacosPlatformSteps(options) {
     if (isSmoothBricksCodebasePackageName(options.repoName)) {
         lines.push('', `      # Step ${stepNumber++}`, '      - name: 🏗️ Build self-hosted smoo', '        # SmoothBricks self-hosts smoo from source for release commands.', '        run: nx build cli');
     }
-    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Build selected macOS and iOS release outputs', '        run:', `          smoo release build-platform-outputs --bump "${githubExpression('inputs.bump')}" --ref "${githubExpression('github.sha')}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}" --output`, `          "${githubExpression('runner.temp')}/macos-platform-outputs"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload macOS platform outputs', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-macos-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/macos-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true', '', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', `        if: ${githubExpression('always()')}`, '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
+    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Build selected macOS and iOS release outputs', '        run:', `          smoo release build-platform-outputs --bump "${githubExpression('inputs.bump')}" --ref "${githubExpression('github.sha')}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}" --output`, `          "${githubExpression('runner.temp')}/macos-platform-outputs"`, '', `      # Step ${stepNumber++}`, '      - name: 🧪 Unit test macOS and iOS packages', '        run:', `          smoo github-ci nx-run-many --targets test --projects-with-targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload macOS platform outputs', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-macos-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/macos-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true', '', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', '        # success() is default; always() still saves GH Nix cache after a red job.', '        if: always()', '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
     return lines.join('\n').trimEnd();
 }
 function renderFinalLinuxPublishSteps(options) {
@@ -597,15 +600,15 @@ function renderFinalLinuxPublishSteps(options) {
         lines.push('', `      # Step ${stepNumber++}`, '      - name: 🏗️ Build self-hosted smoo', '        # SmoothBricks self-hosts smoo from source for release commands.', '        run: nx build cli');
     }
     lines.push('', '      # --- Repair -------------------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 🧯 Repair pending releases', '        run:', `          smoo release repair-pending --ref "${githubExpression('github.sha')}" --platform-outputs "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression('github.run_id')}/repairs" --dry-run`, `          "${githubExpression('inputs.dry_run')}"`, '', `      # Step ${stepNumber++}`, '      - name: ♻️ Restore validated release state', '        run:', `          git fetch "${githubExpression('runner.temp')}/publish-artifacts/publish-release-state-${githubExpression('github.run_id')}/release-state.bundle" HEAD --tags && git reset`, `          --hard "$(cat "${githubExpression('runner.temp')}/publish-artifacts/publish-release-state-${githubExpression('github.run_id')}/release-head")"`);
-    lines.push('', '      # --- Validation ---------------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Apply verified Linux outputs', `        if: ${githubExpression(`${mode} != 'none'`)}`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('needs.linux-release-candidate.outputs.release-sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-release-outputs-${githubExpression('github.run_id')}"`);
+    lines.push('', '      # --- Validation ---------------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Apply verified Linux outputs', `        if: ${mode} != 'none'`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('needs.linux-release-candidate.outputs.release-sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-release-outputs-${githubExpression('github.run_id')}"`);
     if (hasLinuxPlatformTargets(options)) {
         lines.push(`          "${githubExpression('runner.temp')}/publish-artifacts/publish-linux-outputs-${githubExpression('github.run_id')}"`);
     }
-    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Apply verified macOS outputs', `        if: ${githubExpression(`${mode} != 'none'`)}`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('github.sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression('github.run_id')}/current"`, '', `      # Step ${stepNumber++}`, `      - name: ✅ Validate restored release (${githubExpression(mode)})`, `        if: ${githubExpression(`${mode} != 'none'`)}`, '        run: smoo monorepo validate', '', '      # --- Release ------------------------------------------------------------', '', `      # Step ${stepNumber++}`, `      - name: 📦 Publish release (${githubExpression(mode)})`, '        # smoo packs with Bun, then publishes tarballs with npm. Existing', '        # packages must already exist on npm and use trusted publishing/OIDC.', '        # Missing package names are bootstrapped locally before trust setup.', `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression('inputs.dry_run')}"`);
+    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Apply verified macOS outputs', `        if: ${mode} != 'none'`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('github.sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression('github.run_id')}/current"`, '', `      # Step ${stepNumber++}`, `      - name: ✅ Validate restored release (${githubExpression(mode)})`, `        if: ${mode} != 'none'`, '        run: smoo monorepo validate', '', '      # --- Release ------------------------------------------------------------', '', `      # Step ${stepNumber++}`, `      - name: 📦 Publish release (${githubExpression(mode)})`, '        # smoo packs with Bun, then publishes tarballs with npm. Existing', '        # packages must already exist on npm and use trusted publishing/OIDC.', '        # Missing package names are bootstrapped locally before trust setup.', `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression('inputs.dry_run')}"`);
     if (options.deploy === true) {
         lines.push('', `      # Step ${stepNumber++}`, '      - name: 🚀 Deploy production', '        if:', "          ${{ needs.linux-release-candidate.outputs.mode != 'none' && inputs.deploy_environment == 'production' &&", "          inputs.dry_run != 'true' }}", ...deployEnvLines(options), '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"');
     }
-    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', `        if: ${githubExpression('always()')}`, '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
+    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', '        # success() is default; always() still saves GH Nix cache after a red job.', '        if: always()', '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
     return lines.join('\n').trimEnd();
 }
 function hasMacosPlatformTargets(options) {

package/dist/monorepo/runtime.d.ts

@@ -9,8 +9,8 @@ export declare function syncRootRuntimeVersions(root: string): Promise<void>;
 /**
  * Validate that package.json runtime pins agree with the LIVE PATH runtimes,
  * never a stored template. Offline by design: structural alignment only
- * (majors, exact bun pin, no `~major.0.0` floor) — the registry is not
- * consulted. Repair: `smoo monorepo init --runtime-only` inside the devenv shell.
+ * (Node types float within the runtime major; Bun types stay exact) — the registry
+ * is not consulted. Repair: `smoo monorepo init --runtime-only` inside the devenv shell.
  */
 export declare function validateRootRuntimeVersions(root: string): Promise<number>;
 export declare function validateRuntimePins(packageJson: PackageJson, runtime: RuntimeVersions): number;

package/dist/monorepo/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/monorepo/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,WAAW,EAMjB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mGAAmG;AACnG,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAOpF;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCzE;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CAmC9F;AAED,KAAK,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC;AAgB7C,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CA2BR"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/monorepo/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,WAAW,EAMjB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mGAAmG;AACnG,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAOpF;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCzE;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CA8B9F;AAED,KAAK,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC;AAgB7C,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CA2BR"}

package/dist/monorepo/runtime.js

@@ -39,8 +39,8 @@ export async function syncRootRuntimeVersions(root) {
 /**
  * Validate that package.json runtime pins agree with the LIVE PATH runtimes,
  * never a stored template. Offline by design: structural alignment only
- * (majors, exact bun pin, no `~major.0.0` floor) — the registry is not
- * consulted. Repair: `smoo monorepo init --runtime-only` inside the devenv shell.
+ * (Node types float within the runtime major; Bun types stay exact) — the registry
+ * is not consulted. Repair: `smoo monorepo init --runtime-only` inside the devenv shell.
  */
 export async function validateRootRuntimeVersions(root) {
     const packageJson = readJsonObject(join(root, 'package.json'));
@@ -68,13 +68,9 @@ export function validateRuntimePins(packageJson, runtime) {
         failures++;
     }
     const typesNode = packageJson.devDependencies?.['@types/node'] ?? null;
-    const typesNodeParts = typesNode ? /^~(\d+)\.(\d+)\.(\d+)$/.exec(typesNode) : null;
+    const typesNodeParts = typesNode ? /^\^(\d+)\.(\d+)\.(\d+)$/.exec(typesNode) : null;
     if (!typesNodeParts || typesNodeParts[1] !== nodeMajor) {
-        console.error(`package.json @types/node is ${typesNode ?? 'missing'} but the PATH node is v${runtime.node} — types track the runtime major (~${nodeMajor}.x.y, newest published minor); ${repair}`);
-        failures++;
-    }
-    else if (typesNodeParts[2] === '0' && typesNodeParts[3] === '0') {
-        console.error(`package.json @types/node is pinned to the ~${nodeMajor}.0.0 floor — tilde locks the first patch line and strands the repo on early broken releases; ${repair} to repin to the newest published ${nodeMajor}.x`);
+        console.error(`package.json @types/node is ${typesNode ?? 'missing'} but the PATH node is v${runtime.node} — expected a caret range within the runtime major (^${nodeMajor}.x.y); ${repair}`);
         failures++;
     }
     return failures;
@@ -94,16 +90,15 @@ export function runtimeTypesRangeForPublishedVersions(packageName, runtimeVersio
     }
     if (pinMode === 'major') {
         const runtimeMajor = parsedRuntimeVersion[0].toString();
-        // Newest published types WITHIN the runtime major — never the `~major.0.0`
-        // floor: tilde locks the patch line, so the floor can strand consumers on a
-        // broken early release (e.g. @types/node 24.0.x's URLPattern/DOM TS2403
-        // conflict, fixed in 24.13) with no path to the repaired minors.
+        // Anchor the range at the newest published types in the runtime major. The caret
+        // admits later patches and minors without crossing into a different Node major.
         const latestInMajor = latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor));
-        if (latestInMajor) {
-            return `~${latestInMajor}`;
+        if (!latestInMajor) {
+            throw new Error(`Unable to find published ${packageName} versions for runtime major ${runtimeMajor}`);
         }
+        return `^${latestInMajor}`;
     }
-    else if (versions.includes(runtimeVersion)) {
+    if (versions.includes(runtimeVersion)) {
         return runtimeVersion;
     }
     const latest = latestVersion(versions);
@@ -111,7 +106,7 @@ export function runtimeTypesRangeForPublishedVersions(packageName, runtimeVersio
         throw new Error(`Unable to find any published ${packageName} versions`);
     }
     console.warn(`${packageName} has no published types for runtime ${runtimeVersion}; using ${latest}`);
-    return pinMode === 'major' ? `~${latest}` : latest;
+    return latest;
 }
 function latestVersion(versions) {
     let latest = null;

package/dist/monorepo/tool-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-validation.d.ts","sourceRoot":"","sources":["../../src/monorepo/tool-validation.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,KAAK,WAAW,EAAyB,MAAM,qBAAqB,CAAC;AAU9E,MAAM,WAAW,UAAU;IACzB,sBAAsB,EAAE,OAAO,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,UAAU,CAAC;CACpB;AAkDD,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzE;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAStE;AAED,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtG;AA2CD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBlF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAY/D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA0B7D;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,MAAM,CAyBvG;AAsBD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAoB/E;AAED,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,MAAM,CAWhF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB3D;AAsED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAQxE"}
+{"version":3,"file":"tool-validation.d.ts","sourceRoot":"","sources":["../../src/monorepo/tool-validation.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,KAAK,WAAW,EAAyB,MAAM,qBAAqB,CAAC;AAU9E,MAAM,WAAW,UAAU;IACzB,sBAAsB,EAAE,OAAO,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,UAAU,CAAC;CACpB;AAgDD,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzE;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAStE;AAED,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtG;AAqCD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAkBlF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAY/D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA0B7D;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,MAAM,CAyBvG;AAyBD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAoB/E;AAED,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,MAAM,CAWhF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB3D;AAsED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAQxE"}