@smoothbricks/cli 0.10.6 → 0.10.8

package/src/lib/json.ts

@@ -80,7 +80,7 @@ export type NxDependsOn = string | NxDependsOnObject;
 /** Nx target options are executor-specific open bags. */
 export type NxTargetOptions = Record<string, unknown>;
 
-export type NxInput = string | Record<string, unknown>;
+export type NxInput = string | object;
 
 export interface NxTargetConfig {
   executor?: string;

package/src/lib/workspace.ts

@@ -129,6 +129,7 @@ function listWorkspacePackageJsonPaths(root: string, workspacePatterns: string[]
   const paths: string[] = [];
   for (const pattern of workspacePatterns) {
     if (!pattern.endsWith('/*')) {
+      paths.push(join(root, pattern, 'package.json'));
       continue;
     }
     const parent = join(root, pattern.slice(0, -2));

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -24,12 +24,12 @@ describe('CI workflow definition', () => {
     const rendered = renderCiWorkflowYaml({ deploy: true, pushBranches: ['main'] });
 
     expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 11]);
-    expect(rendered).toContain('- name: 🚀 Deploy Staging');
+    expect(rendered.match(/- name: 🚀 Deploy Environment/g)).toHaveLength(1);
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
-    expect(rendered).toContain(
-      'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 11',
-    );
+    expect(rendered).toContain('smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step 11');
+    expect(rendered).toContain('github.event.pull_request.head.repo.full_name == github.repository');
+    expect(rendered).toContain("github.ref == 'refs/heads/private'");
     expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
     expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
     expect(rendered).toContain('id: setup');
@@ -45,6 +45,12 @@ describe('CI workflow definition', () => {
 
     expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
     expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+    expect(rendered).toContain('GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}');
+    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}');
+    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}');
+    expect(rendered).toContain('OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}');
+    expect(rendered).toContain('MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}');
+    expect(rendered).toContain('TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}');
   });
 
   it('uses the same architecture-scoped key to restore and save the Nx cache', async () => {

package/src/monorepo/__tests__/pr-preview-cleanup-workflow.test.ts

@@ -0,0 +1,23 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: Assertions verify emitted GitHub Actions expressions literally. */
+import { describe, expect, it } from 'bun:test';
+import { managedFileTargetsForTest } from '../managed-files.js';
+import { renderPrPreviewCleanupWorkflowYaml } from '../pr-preview-cleanup-workflow.js';
+
+describe('PR preview cleanup workflow', () => {
+  it('renders one close-only same-repository cleanup job from the PR number', () => {
+    const rendered = renderPrPreviewCleanupWorkflowYaml({ runsOn: ['nixos-latest-x64', 'self-hosted'] });
+    expect(managedFileTargetsForTest).toContainEqual({
+      target: '.github/workflows/pr-preview-cleanup.yml',
+      executable: undefined,
+    });
+
+    expect(rendered).toContain('pull_request:\n    types: [closed]');
+    expect(rendered).not.toContain('opened');
+    expect(rendered).not.toContain('synchronize');
+    expect(rendered).toContain('if: github.event.pull_request.head.repo.full_name == github.repository');
+    expect(rendered.match(/smoo wrangler cleanup-pr --pr/g)).toHaveLength(1);
+    expect(rendered).toContain('smoo wrangler cleanup-pr --pr ${{ github.event.pull_request.number }}');
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+  });
+});

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -99,7 +99,7 @@ describe('publish workflow definition', () => {
 
     expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 15 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 19 }, (_, index) => index + 1));
-    expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 7 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 8 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
     expect(singleJob).toContain('# Step 14\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
     expect(singleJob).toContain('# Step 15\n      - name: 🧹 Cleanup and cache Nix/devenv');
@@ -109,7 +109,7 @@ describe('publish workflow definition', () => {
     );
     expect(linuxCandidate).toContain('# Step 19\n      - name: 🧹 Cleanup and cache Nix/devenv');
     expect(macosPlatform).toContain('# Step 5\n      - name: 🍎 Build selected macOS and iOS release outputs');
-    expect(macosPlatform).toContain('# Step 7\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(macosPlatform).toContain('# Step 8\n      - name: 🧹 Cleanup and cache Nix/devenv');
     expect(finalJob).toContain('# Step 7\n      - name: 🧯 Repair pending releases');
     expect(finalJob).toContain('# Step 8\n      - name: ♻️ Restore validated release state');
     expect(finalJob).toContain('# Step 9\n      - name: 📦 Apply verified Linux outputs');
@@ -156,12 +156,20 @@ describe('publish workflow definition', () => {
     expect(linuxCandidate).toContain(
       `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
     );
-    expect(macosPlatform).not.toContain('smoo github-ci nx-run-many');
     expect(foldedRunCommand(macosPlatform, '🍎 Build selected macOS and iOS release outputs')).toBe(
       `smoo release build-platform-outputs --bump "\${{ inputs.bump }}" --ref "\${{ github.sha }}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(
         ',',
       )}" --output "\${{ runner.temp }}/macos-platform-outputs"`,
     );
+    expect(macosPlatform).toContain(
+      `run: smoo github-ci nx-run-many --targets test --projects-with-targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}"`,
+    );
+    expect(macosPlatform.indexOf('- name: 🍎 Build selected macOS and iOS release outputs')).toBeLessThan(
+      macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages'),
+    );
+    expect(macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages')).toBeLessThan(
+      macosPlatform.indexOf('- name: 📤 Upload macOS platform outputs'),
+    );
     expect(finalJob).not.toContain('smoo release version');
     expect(finalJob).not.toContain('nx-run-many');
     expect(foldedRunCommand(finalJob, '🧯 Repair pending releases')).toBe(
@@ -253,7 +261,7 @@ describe('publish workflow definition', () => {
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
     expect(rendered).toContain(
-      'smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+      'smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
     );
   });
 

package/src/monorepo/ci-workflow.ts

@@ -47,7 +47,7 @@ export function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkfl
     { kind: CiWorkflowStepKind.ManagedFilesDispatch, name: '🔁 Dispatch managed-file drift healing' },
   ];
   if (options.deploy) {
-    steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Staging' });
+    steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Environment' });
   }
   steps.push(
     { kind: CiWorkflowStepKind.SaveNxCache, name: '💾 Save Nx cache' },
@@ -75,7 +75,7 @@ permissions:
   # actions:write lets the drift step dispatch the managed-files workflow.
   actions: write
   contents: read
-  statuses: write
+${options.deploy ? '  deployments: write\n' : ''}  statuses: write
 
 defaults:
   run:
@@ -197,11 +197,15 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
     case CiWorkflowStepKind.Deploy:
       return [
         `      - name: ${step.name}`,
-        '        if:',
-        "          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',",
-        '          github.event.repository.default_branch) }}',
+        '        if: >-',
+        '          ${{',
+        "            (github.event_name == 'pull_request' &&",
+        '              contains(fromJSON(\'["opened","reopened","synchronize"]\'), github.event.action) &&',
+        '              github.event.pull_request.head.repo.full_name == github.repository) ||',
+        "            (github.event_name == 'push' && github.ref == 'refs/heads/private')",
+        '          }}',
         ...deployEnvLines(options),
-        `        run: smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step ${step.number}`,
+        `        run: smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step ${step.number}`,
       ];
     case CiWorkflowStepKind.SaveNxCache:
       return [
@@ -251,6 +255,12 @@ function deployEnvLines(options: CiWorkflowDefinitionOptions): string[] {
     '        env:',
     '          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}',
     '          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}',
+    '          GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}',
+    '          GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}',
+    '          GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}',
+    '          OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}',
+    '          MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}',
+    '          TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}',
   ];
 }
 

package/src/monorepo/managed-files.test.ts

@@ -1,20 +1,21 @@
 /* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are asserted literally. */
 import { describe, expect, it } from 'bun:test';
-import { readFile } from 'node:fs/promises';
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { LINUX_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import fc from 'fast-check';
+import { type NxProjects, targetNamesFromProjects } from '../nx/index.js';
 import {
   deployTargetInfoFromProjects,
   extractInlineLocalBlocksForTest,
   INLINE_LOCAL_BEGIN,
   INLINE_LOCAL_END,
   LOCAL_SECTION_MARKER,
-  type NxGraphProjectNode,
+  managedFileTargetsForTest,
   platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
   splitLocalSectionForTest,
-  targetNamesFromProjects,
 } from './managed-files.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
@@ -176,48 +177,111 @@ describe('managed publish platform discovery', () => {
 });
 
 describe('nx graph project helpers', () => {
-  const sampleNodes: Record<string, NxGraphProjectNode> = {
+  const sampleProjects: NxProjects = {
     lib: {
-      data: {
-        targets: {
-          build: {},
-          'bundle-linux': {},
-          lint: {},
-        },
+      targets: {
+        build: {},
+        'bundle-linux': {},
+        lint: {},
       },
     },
     app: {
-      data: {
-        targets: {
-          deploy: {
-            options: { command: 'echo no' },
-            configurations: {
-              staging: { command: 'wrangler deploy --env staging' },
-              production: { options: { command: 'wrangler deploy --env production' } },
-            },
+      targets: {
+        deploy: {
+          options: { command: 'echo no' },
+          configurations: {
+            staging: { command: 'wrangler deploy --env staging' },
+            production: { options: { command: 'wrangler deploy --env production' } },
           },
-          'package-macos': {},
         },
+        'package-macos': {},
       },
     },
   };
 
   it('collects target names from graph nodes without project names', () => {
-    expect(targetNamesFromProjects(sampleNodes).sort()).toEqual(
+    expect(targetNamesFromProjects(sampleProjects).sort()).toEqual(
       ['build', 'bundle-linux', 'deploy', 'lint', 'package-macos'].sort(),
     );
   });
 
   it('detects deploy configurations and cloudflare provider from graph nodes', () => {
-    expect(deployTargetInfoFromProjects(sampleNodes, 'staging')).toEqual({
+    expect(deployTargetInfoFromProjects(sampleProjects, 'staging')).toEqual({
       exists: true,
       provider: 'cloudflare',
     });
-    expect(deployTargetInfoFromProjects(sampleNodes, 'production')).toEqual({
+    expect(deployTargetInfoFromProjects(sampleProjects, 'production')).toEqual({
       exists: true,
       provider: 'cloudflare',
     });
-    expect(deployTargetInfoFromProjects(sampleNodes, 'preview')).toEqual({ exists: false });
+    expect(deployTargetInfoFromProjects(sampleProjects, 'preview')).toEqual({ exists: false });
+  });
+
+  it('recognizes convention-driven deploy-environment targets without per-environment configurations', () => {
+    const projects: NxProjects = {
+      app: {
+        targets: {
+          deploy: {
+            options: { command: 'smoo wrangler deploy-environment --environment {args.environment}' },
+          },
+        },
+      },
+    };
+
+    expect(deployTargetInfoFromProjects(projects, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(deployTargetInfoFromProjects(projects, 'production')).toEqual({ exists: true, provider: 'cloudflare' });
+  });
+});
+
+describe('managed raw files', () => {
+  it('manages the devenv wrapper as an executable byte-exact copy', async () => {
+    expect(managedFileTargetsForTest).toContainEqual({ target: 'tooling/devenv', executable: true });
+
+    const [source, generated] = await Promise.all([
+      readFile(join(REPO_ROOT, 'packages', 'cli', 'managed', 'raw', 'tooling', 'devenv'), 'utf8'),
+      readFile(join(REPO_ROOT, 'tooling', 'devenv'), 'utf8'),
+    ]);
+
+    expect(generated).toBe(source);
+  });
+
+  it('exports the restored ttsc cache path while preserving host cache overrides', async () => {
+    const temp = await mkdtemp(join(tmpdir(), 'smoo-github-bootstrap-'));
+    const bin = join(temp, 'bin');
+    await mkdir(bin);
+    const devenv = join(bin, 'devenv');
+    await writeFile(devenv, '#!/bin/sh\nexit 0\n');
+    await chmod(devenv, 0o755);
+
+    try {
+      const cases = [
+        { input: '', expected: join(REPO_ROOT, '.cache', 'ttsc') },
+        { input: join(temp, 'host-ttsc'), expected: join(temp, 'host-ttsc') },
+      ];
+      for (const [index, cache] of cases.entries()) {
+        const githubEnv = join(temp, `github-env-${index}`);
+        const githubPath = join(temp, `github-path-${index}`);
+        const process = Bun.spawn(
+          [join(REPO_ROOT, 'tooling', 'direnv', 'github-actions-bootstrap.sh'), 'build-shell'],
+          {
+            cwd: join(REPO_ROOT, 'tooling', 'direnv'),
+            env: {
+              ...Bun.env,
+              GITHUB_ENV: githubEnv,
+              GITHUB_PATH: githubPath,
+              PATH: `${bin}:${Bun.env.PATH ?? ''}`,
+              TTSC_CACHE_DIR: cache.input,
+            },
+            stderr: 'pipe',
+            stdout: 'pipe',
+          },
+        );
+        expect(await process.exited).toBe(0);
+        expect(await readFile(githubEnv, 'utf8')).toContain(`TTSC_CACHE_DIR=${cache.expected}\n`);
+      }
+    } finally {
+      await rm(temp, { recursive: true, force: true });
+    }
   });
 });
 

package/src/monorepo/managed-files.ts

@@ -2,11 +2,11 @@ import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFi
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-// Nx package exports are CLI-oriented; this is the module the CLI uses for graph + daemon IPC.
-import { createProjectGraphAsync } from 'nx/src/project-graph/project-graph.js';
-import type { PackageJson } from '../lib/json.js';
+import type { NxTargetConfig, PackageJson } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
+import { loadNxProjects, type NxProjects, targetNamesFromProjects } from '../nx/index.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
+import { renderPrPreviewCleanupWorkflowYaml } from './pr-preview-cleanup-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
 
 type ManagedKind = 'raw' | 'template' | 'generated';
@@ -25,6 +25,7 @@ interface ManagedFile {
   target: string;
   executable?: boolean;
   releasePackagesOnly?: boolean;
+  cloudflareDeployOnly?: boolean;
 }
 
 /** Split a managed target's content into the managed part and the repo-owned tail. */
@@ -155,6 +156,12 @@ const managedFiles: ManagedFile[] = [
     source: 'envrc',
     target: '.envrc',
   },
+  {
+    kind: 'raw',
+    source: 'tooling/devenv',
+    target: 'tooling/devenv',
+    executable: true,
+  },
   {
     kind: 'raw',
     source: 'tooling/direnv/repo-path',
@@ -201,16 +208,17 @@ const managedFiles: ManagedFile[] = [
     target: 'tooling/direnv/merge-newer-pins.sh',
     executable: true,
   },
-  {
-    kind: 'raw',
-    source: 'patches/ttsc@0.19.3.patch',
-    target: 'patches/ttsc@0.19.3.patch',
-  },
   {
     kind: 'generated',
     source: 'ci-workflow',
     target: '.github/workflows/ci.yml',
   },
+  {
+    kind: 'generated',
+    source: 'pr-preview-cleanup-workflow',
+    target: '.github/workflows/pr-preview-cleanup.yml',
+    cloudflareDeployOnly: true,
+  },
   {
     kind: 'generated',
     source: 'publish-workflow',
@@ -254,6 +262,8 @@ const managedFiles: ManagedFile[] = [
   },
 ];
 
+export const managedFileTargetsForTest = managedFiles.map(({ target, executable }) => ({ target, executable }));
+
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
 export async function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): Promise<FileResult[]> {
@@ -270,6 +280,9 @@ function applyManagedFile(
   if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
     return { target: file.target, action: 'skipped' };
   }
+  if (file.cloudflareDeployOnly === true && context.stagingDeployProvider !== 'cloudflare') {
+    return { target: file.target, action: 'skipped' };
+  }
   const target = resolve(root, file.target);
   const content = getManagedContent(file, context);
   if (existsSync(target)) {
@@ -320,6 +333,9 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         runsOn: context.ciRunsOn,
       });
     }
+    if (file.source === 'pr-preview-cleanup-workflow') {
+      return renderPrPreviewCleanupWorkflowYaml({ runsOn: context.ciRunsOn });
+    }
     throw new Error(`Unknown generated managed file source ${file.source}`);
   }
   const sourceRoot = file.kind === 'raw' ? 'managed/raw' : 'managed/templates';
@@ -337,7 +353,7 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
   const ciPushBranches = getCiPushBranches(packageJson?.json);
   const ciRunsOn = getCiRunsOn(packageJson?.json);
   // In-process Nx API → daemon socket (no second Node/`nx` CLI process).
-  const nxProjects = await loadNxGraphProjects(root);
+  const nxProjects = await loadNxProjects(root);
   const stagingDeploy = deployTargetInfoFromProjects(nxProjects, 'staging');
   const productionDeploy = deployTargetInfoFromProjects(nxProjects, 'production');
   const platformTargetGlobs = platformTargetGlobsForTest(targetNamesFromProjects(nxProjects));
@@ -366,67 +382,12 @@ export function platformTargetGlobsForTest(targetNames: Iterable<string>): strin
   });
 }
 
-/** Resolved Nx project node as returned under `graph.nodes` / project-graph.json. */
-export type NxGraphProjectNode = {
-  data?: { targets?: Record<string, NxGraphTarget> };
-  targets?: Record<string, NxGraphTarget>;
-};
-
-type NxGraphTarget = {
-  command?: string;
-  options?: { command?: string };
-  configurations?: Record<string, { command?: string; options?: { command?: string } }>;
-};
-
-/**
- * Load resolved project nodes via Nx's programmatic API.
- *
- * `createProjectGraphAsync` is what the CLI uses: with the daemon up it speaks the
- * daemon unix socket instead of rebuilding the graph in a fresh Node process.
- * Spawning `nx graph` / `nx show` only added CLI boot + plugin-worker overhead on
- * top of that. smoo runs under Bun; Bun can import this CJS module directly.
- */
-async function loadNxGraphProjects(root: string): Promise<Record<string, NxGraphProjectNode>> {
-  const prevCwd = process.cwd();
-  process.chdir(root);
-  try {
-    const graph = (await createProjectGraphAsync()) as {
-      nodes: Record<string, { data?: { targets?: Record<string, NxGraphTarget> } }>;
-    };
-    const out: Record<string, NxGraphProjectNode> = {};
-    for (const [name, node] of Object.entries(graph.nodes)) {
-      out[name] = { data: { targets: node.data?.targets ?? {} } };
-    }
-    return out;
-  } finally {
-    process.chdir(prevCwd);
-  }
-}
-
-function targetsOfProject(node: NxGraphProjectNode): Record<string, NxGraphTarget> {
-  return node.data?.targets ?? node.targets ?? {};
-}
-
-/** Test seam: collect target names from a graph.nodes map. */
-export function targetNamesFromProjects(nodes: Record<string, NxGraphProjectNode>): string[] {
-  const targetNames = new Set<string>();
-  for (const node of Object.values(nodes)) {
-    for (const name of Object.keys(targetsOfProject(node))) {
-      targetNames.add(name);
-    }
-  }
-  return [...targetNames];
-}
-
 /** Test seam: deploy configuration presence/provider from graph nodes. */
-export function deployTargetInfoFromProjects(
-  nodes: Record<string, NxGraphProjectNode>,
-  configuration: string,
-): DeployTargetInfo {
+export function deployTargetInfoFromProjects(projects: NxProjects, configuration: string): DeployTargetInfo {
   let exists = false;
   let provider: DeployTargetInfo['provider'];
-  for (const node of Object.values(nodes)) {
-    const info = deployTargetInfoFromTargets(targetsOfProject(node), configuration);
+  for (const project of Object.values(projects)) {
+    const info = deployTargetInfoFromTargets(project.targets ?? {}, configuration);
     if (!info.exists) {
       continue;
     }
@@ -436,16 +397,21 @@ export function deployTargetInfoFromProjects(
   return { exists, provider };
 }
 
-function deployTargetInfoFromTargets(targets: Record<string, NxGraphTarget>, configuration: string): DeployTargetInfo {
+function deployTargetInfoFromTargets(targets: Record<string, NxTargetConfig>, configuration: string): DeployTargetInfo {
   const deploy = targets.deploy;
   if (!deploy) {
     return { exists: false };
   }
+  const baseCommandValue = deploy.options?.command ?? deploy.command;
+  const baseCommand = typeof baseCommandValue === 'string' ? baseCommandValue : '';
+  if (baseCommand.includes('smoo wrangler deploy-environment')) {
+    return { exists: true, provider: 'cloudflare' };
+  }
   const config = deploy.configurations?.[configuration];
   if (!config) {
     return { exists: false };
   }
-  const commandValue = config.command ?? config.options?.command ?? deploy.options?.command ?? deploy.command;
+  const commandValue = config.command ?? config.options?.command ?? baseCommand;
   const command = typeof commandValue === 'string' ? commandValue : '';
   return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }

package/src/monorepo/package-policy.test.ts

@@ -11,6 +11,8 @@ import {
 
 const TIMEOUT_FLAG = `--timeout=${BOUNDED_TEST_PER_TEST_TIMEOUT_MS}`;
 
+import { validateCommitMessage } from './commit-msg.js';
+
 import {
   applyFixableMonorepoDefaults,
   applyNxPluginDefaults,
@@ -245,6 +247,35 @@ describe('Nx project name policy', () => {
       await rm(root, { recursive: true, force: true });
     }
   });
+
+  it('uses nx.name from an exact workspace package as the commit scope', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-package-policy-'));
+    try {
+      await writeJson(join(root, 'package.json'), {
+        name: '@smoothbricks/codebase',
+        version: '0.0.0',
+        private: true,
+        workspaces: ['tooling'],
+      });
+      await writeJson(join(root, 'tooling/package.json'), {
+        name: '@smoothbricks/internal-tooling',
+        private: true,
+        nx: { name: 'tooling' },
+      });
+
+      const validScopes = listValidCommitScopes(root);
+      expect(validScopes).toEqual(new Set(['release', 'tooling']));
+      expect(validateCommitMessage('fix(tooling): repair tooling\n', { validScopes })).toBeNull();
+      expect(validateCommitMessage('fix(internal-tooling): repair tooling\n', { validScopes })).toContain(
+        'Invalid conventional commit scope',
+      );
+      expect(validateCommitMessage('fix(arbitrary): repair tooling\n', { validScopes })).toContain(
+        'Invalid conventional commit scope',
+      );
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
 });
 
 describe('workspace package script policy', () => {

package/src/monorepo/package-policy.ts

@@ -165,7 +165,7 @@ export function applyWorkspaceDependencyDefaults(root: string, options: PackageT
   } else {
     console.log('unchanged      tsconfig.test.json policy');
   }
-  if (applyWorkspaceBoundedTestTargetPolicy(root)) {
+  if (applyWorkspaceBoundedTestTargetPolicy(root, options)) {
     console.log('updated        package test targets bounded execution policy');
   } else {
     console.log('unchanged      package test targets bounded execution policy');
@@ -409,7 +409,7 @@ export function validateWorkspaceDependencies(root: string, options: PackageTarg
     console.error(`${issue.path}: ${issue.message}`);
     failures++;
   }
-  for (const issue of checkWorkspaceBoundedTestTargetPolicy(root)) {
+  for (const issue of checkWorkspaceBoundedTestTargetPolicy(root, options)) {
     console.error(`${issue.path}: ${issue.message}`);
     failures++;
   }

package/src/monorepo/packs/index.ts

@@ -414,10 +414,12 @@ export function resolvedTargetsByProject(projects: ProjectTargets[]): Map<string
     projects.map((project) => [
       project.project,
       {
+        ...(project.root ? { root: project.root } : {}),
         targets: new Set(project.targets),
         ...(project.buildDependsOn ? { buildDependsOn: project.buildDependsOn } : {}),
         ...(project.targetDependencies ? { targetDependencies: project.targetDependencies } : {}),
         ...(project.targetExecutors ? { targetExecutors: project.targetExecutors } : {}),
+        ...(project.targetOptions ? { targetOptions: project.targetOptions } : {}),
         ...(project.targetScripts ? { targetScripts: project.targetScripts } : {}),
       },
     ]),

package/src/monorepo/pr-preview-cleanup-workflow.ts

@@ -0,0 +1,44 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
+
+import { renderRunsOnLine } from './github-runs-on.js';
+
+export interface PrPreviewCleanupWorkflowOptions {
+  runsOn?: string | string[];
+}
+
+export function renderPrPreviewCleanupWorkflowYaml(options: PrPreviewCleanupWorkflowOptions = {}): string {
+  return `name: PR Preview Cleanup
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: read
+
+jobs:
+  cleanup:
+    name: Cleanup PR environment
+    if: github.event.pull_request.head.repo.full_name == github.repository
+${renderRunsOnLine(options.runsOn)}
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: tooling/direnv
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          filter: blob:none
+          fetch-depth: 1
+
+      - name: Setup Nix/devenv
+        uses: ./.github/actions/setup-devenv
+
+      - name: Cleanup PR environment
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: smoo wrangler cleanup-pr --pr \${{ github.event.pull_request.number }}
+`;
+}