@smoothbricks/cli 0.10.6 → 0.10.8

package/src/monorepo/publish-workflow.ts

@@ -486,7 +486,7 @@ function deployProductionStep(step: PublishWorkflowStep, options: PublishWorkflo
     "          ${{ steps.version.outputs.mode != 'none' && inputs.deploy_environment == 'production' && inputs.dry_run !=",
     "          'true' }}",
     ...deployEnvLines(options),
-    '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+    '        run: smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
   ];
 }
 
@@ -785,6 +785,11 @@ function renderMacosPlatformSteps(options: PublishWorkflowDefinitionOptions): st
     `          "${githubExpression('runner.temp')}/macos-platform-outputs"`,
     '',
     `      # Step ${stepNumber++}`,
+    '      - name: 🧪 Unit test macOS and iOS packages',
+    '        run:',
+    `          smoo github-ci nx-run-many --targets test --projects-with-targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}"`,
+    '',
+    `      # Step ${stepNumber++}`,
     '      - name: 📤 Upload macOS platform outputs',
     '        uses: actions/upload-artifact@v7.0.1',
     '        with:',
@@ -935,7 +940,7 @@ function renderFinalLinuxPublishSteps(options: PublishWorkflowDefinitionOptions)
       "          ${{ needs.linux-release-candidate.outputs.mode != 'none' && inputs.deploy_environment == 'production' &&",
       "          inputs.dry_run != 'true' }}",
       ...deployEnvLines(options),
-      '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+      '        run: smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
     );
   }
   lines.push(

package/src/monorepo/runtime.test.ts

@@ -3,16 +3,16 @@ import type { PackageJson } from '../lib/json.js';
 import { runtimeTypesRangeForPublishedVersions, validateRuntimePins } from './runtime.js';
 
 describe('runtimeTypesRangeForPublishedVersions', () => {
-  test('uses the newest published minor within the installed Node major, never the ~major.0.0 floor', () => {
+  test('anchors a caret range at the newest published version in the installed Node major', () => {
     expect(
       runtimeTypesRangeForPublishedVersions('@types/node', '24.12.0', 'major', ['24.0.0', '24.12.4', '25.9.1']),
-    ).toBe('~24.12.4');
+    ).toBe('^24.12.4');
   });
 
-  test('falls back to latest published @types/node when the Node major is unpublished', () => {
-    expect(
+  test('rejects fallback types from a different Node major', () => {
+    expect(() =>
       runtimeTypesRangeForPublishedVersions('@types/node', '26.0.0', 'major', ['24.12.4', '25.9.0', '25.9.1']),
-    ).toBe('~25.9.1');
+    ).toThrow('runtime major 26');
   });
 
   test('uses the installed Bun version when @types/bun has published it', () => {
@@ -23,10 +23,10 @@ describe('runtimeTypesRangeForPublishedVersions', () => {
     expect(runtimeTypesRangeForPublishedVersions('@types/bun', '1.3.15', 'exact', ['1.3.13', '1.3.14'])).toBe('1.3.14');
   });
 
-  test('ignores non-stable version strings when choosing the fallback', () => {
-    expect(runtimeTypesRangeForPublishedVersions('@types/node', '26.0.0', 'major', ['25.9.1', '26.0.0-beta.1'])).toBe(
-      '~25.9.1',
-    );
+  test('ignores non-stable version strings when choosing the same-major anchor', () => {
+    expect(
+      runtimeTypesRangeForPublishedVersions('@types/node', '26.0.0', 'major', ['25.9.1', '26.0.2', '26.1.0-beta.1']),
+    ).toBe('^26.0.2');
   });
 });
 
@@ -35,23 +35,29 @@ describe('validateRuntimePins', () => {
   const aligned = () => ({
     engines: { node: '>=24.0.0' },
     packageManager: 'bun@1.3.14',
-    devDependencies: { '@types/node': '~24.13.0' },
+    devDependencies: { '@types/node': '^24.13.0' },
   });
 
-  test('passes when every pin agrees with the PATH runtimes', () => {
-    expect(validateRuntimePins(aligned(), runtime)).toBe(0);
+  test('accepts caret ranges anchored at any patch or minor in the PATH Node major', () => {
+    for (const version of ['^24.0.3', '^24.13.0']) {
+      const pkg = aligned();
+      pkg.devDependencies['@types/node'] = version;
+      expect(validateRuntimePins(pkg, runtime)).toBe(0);
+    }
   });
 
   test('fails when @types/node tracks a different major than the PATH node', () => {
     const pkg = aligned();
-    pkg.devDependencies['@types/node'] = '~26.1.1';
+    pkg.devDependencies['@types/node'] = '^26.1.1';
     expect(validateRuntimePins(pkg, runtime)).toBe(1);
   });
 
-  test('fails the ~major.0.0 floor pin even when the major matches', () => {
-    const pkg = aligned();
-    pkg.devDependencies['@types/node'] = '~24.0.0';
-    expect(validateRuntimePins(pkg, runtime)).toBe(1);
+  test('rejects exact and tilde @types/node pins even when the major matches', () => {
+    for (const version of ['24.13.0', '~24.13.0']) {
+      const pkg = aligned();
+      pkg.devDependencies['@types/node'] = version;
+      expect(validateRuntimePins(pkg, runtime)).toBe(1);
+    }
   });
 
   test('fails engines.node and packageManager drift against the PATH runtimes', () => {

package/src/monorepo/runtime.ts

@@ -66,8 +66,8 @@ export async function syncRootRuntimeVersions(root: string): Promise<void> {
 /**
  * Validate that package.json runtime pins agree with the LIVE PATH runtimes,
  * never a stored template. Offline by design: structural alignment only
- * (majors, exact bun pin, no `~major.0.0` floor) — the registry is not
- * consulted. Repair: `smoo monorepo init --runtime-only` inside the devenv shell.
+ * (Node types float within the runtime major; Bun types stay exact) — the registry
+ * is not consulted. Repair: `smoo monorepo init --runtime-only` inside the devenv shell.
  */
 export async function validateRootRuntimeVersions(root: string): Promise<number> {
   const packageJson = readJsonObject(join(root, 'package.json'));
@@ -100,15 +100,10 @@ export function validateRuntimePins(packageJson: PackageJson, runtime: RuntimeVe
     failures++;
   }
   const typesNode = packageJson.devDependencies?.['@types/node'] ?? null;
-  const typesNodeParts = typesNode ? /^~(\d+)\.(\d+)\.(\d+)$/.exec(typesNode) : null;
+  const typesNodeParts = typesNode ? /^\^(\d+)\.(\d+)\.(\d+)$/.exec(typesNode) : null;
   if (!typesNodeParts || typesNodeParts[1] !== nodeMajor) {
     console.error(
-      `package.json @types/node is ${typesNode ?? 'missing'} but the PATH node is v${runtime.node} — types track the runtime major (~${nodeMajor}.x.y, newest published minor); ${repair}`,
-    );
-    failures++;
-  } else if (typesNodeParts[2] === '0' && typesNodeParts[3] === '0') {
-    console.error(
-      `package.json @types/node is pinned to the ~${nodeMajor}.0.0 floor — tilde locks the first patch line and strands the repo on early broken releases; ${repair} to repin to the newest published ${nodeMajor}.x`,
+      `package.json @types/node is ${typesNode ?? 'missing'} but the PATH node is v${runtime.node} — expected a caret range within the runtime major (^${nodeMajor}.x.y); ${repair}`,
     );
     failures++;
   }
@@ -144,15 +139,15 @@ export function runtimeTypesRangeForPublishedVersions(
 
   if (pinMode === 'major') {
     const runtimeMajor = parsedRuntimeVersion[0].toString();
-    // Newest published types WITHIN the runtime major — never the `~major.0.0`
-    // floor: tilde locks the patch line, so the floor can strand consumers on a
-    // broken early release (e.g. @types/node 24.0.x's URLPattern/DOM TS2403
-    // conflict, fixed in 24.13) with no path to the repaired minors.
+    // Anchor the range at the newest published types in the runtime major. The caret
+    // admits later patches and minors without crossing into a different Node major.
     const latestInMajor = latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor));
-    if (latestInMajor) {
-      return `~${latestInMajor}`;
+    if (!latestInMajor) {
+      throw new Error(`Unable to find published ${packageName} versions for runtime major ${runtimeMajor}`);
     }
-  } else if (versions.includes(runtimeVersion)) {
+    return `^${latestInMajor}`;
+  }
+  if (versions.includes(runtimeVersion)) {
     return runtimeVersion;
   }
 
@@ -162,7 +157,7 @@ export function runtimeTypesRangeForPublishedVersions(
   }
 
   console.warn(`${packageName} has no published types for runtime ${runtimeVersion}; using ${latest}`);
-  return pinMode === 'major' ? `~${latest}` : latest;
+  return latest;
 }
 
 function latestVersion(versions: readonly string[]): string | null {

package/src/monorepo/tool-validation.test.ts

@@ -3,10 +3,12 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import {
+  applyDevenvPackageDefaults,
   applyRootDevDependencyDefaults,
   applyToolConfigDefaults,
   applyToolingPackageDefaults,
   readToolContext,
+  validateDevenvPackages,
   validateToolConfig,
 } from './tool-validation.js';
 
@@ -19,7 +21,7 @@ const registryVersions: Record<string, string[]> = {
   'eslint-stdout': ['1.1.1', '1.1.2'],
   nx: ['23.1.0'],
   prettier: ['3.6.1'],
-  ttsc: ['0.19.3'],
+  ttsc: ['0.25.0'],
   typescript: ['6.0.3'],
   // alias package is not fetched from registry under this name when using fallback
   '@typescript/native': ['7.0.2'],
@@ -50,6 +52,9 @@ describe('tool configuration validation', () => {
         devDependencies: {
           '@smoothbricks/cli': 'workspace:*',
         },
+        patchedDependencies: {
+          'ttsc@0.19.3': 'patches/ttsc@0.19.3.patch',
+        },
       });
       const devenvPath = join(root, 'tooling/direnv/devenv.nix');
       await mkdir(dirname(devenvPath), { recursive: true });
@@ -76,22 +81,104 @@ describe('tool configuration validation', () => {
       expect(rootPackage.devDependencies['@smoothbricks/nx-plugin']).toBe('workspace:*');
       expect(rootPackage.devDependencies['eslint-stdout']).toBe('workspace:*');
       expect(rootPackage.devDependencies.nx).toBe('23.1.0');
-      expect(rootPackage.devDependencies.ttsc).toBe('0.19.3');
+      expect(rootPackage.devDependencies.ttsc).toBe('0.25.0');
       expect(rootPackage.devDependencies.typescript).toBe('^6.0.3');
       expect(rootPackage.devDependencies['@typescript/native']).toBe('npm:typescript@^7.0.2');
-      expect(rootPackage.patchedDependencies['ttsc@0.19.3']).toBe('patches/ttsc@0.19.3.patch');
+      expect(rootPackage.patchedDependencies?.['ttsc@0.19.3']).toBeUndefined();
       expect(rootPackage.workspaces).toContain('tooling');
       expect(toolingPackage.name).toBe('@smoothbricks/tooling');
       expect(toolingPackage.dependencies['@smoothbricks/cli']).toBe('workspace:*');
       expect(devenv).toContain('nodejs_latest');
       expect(devenv).toContain('coreutils');
       expect(devenv).toContain('git-format-staged');
+      expect(devenv).toContain('go # Builds ttsc source plugins');
+      expect(devenv).not.toContain('sccache');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('requires Go for managed TypeScript source-plugin builds without forcing Rust tools', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
+    try {
+      const devenvPath = join(root, 'tooling/direnv/devenv.nix');
+      await mkdir(dirname(devenvPath), { recursive: true });
+      await writeFile(
+        devenvPath,
+        `{
+  pkgs,
+  ...
+}: {
+  packages = with pkgs; [
+    nodejs_latest
+    bun
+    git
+    git-format-staged
+    jq
+    alejandra
+    coreutils
+    gnutar
+  ];
+}
+`,
+      );
+
+      expect(validateDevenvPackages(root)).toBe(1);
+      applyDevenvPackageDefaults(root);
+      expect(validateDevenvPackages(root)).toBe(0);
+      const devenv = await readFile(devenvPath, 'utf8');
+      expect(devenv).toContain('go # Builds ttsc source plugins');
+      expect(devenv).not.toContain('sccache');
     } finally {
       await rm(root, { recursive: true, force: true });
     }
   });
 
-  it('accepts newer dependency versions above the policy floor', async () => {
+  it('requires Rust compiler helpers only when the workspace contains Cargo manifests', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
+    try {
+      const crateRoot = join(root, 'packages/native');
+      await mkdir(crateRoot, { recursive: true });
+      await writeFile(join(crateRoot, 'Cargo.toml'), '[package]\nname = "native"\nversion = "0.0.0"\n');
+      const devenvPath = join(root, 'tooling/direnv/devenv.nix');
+      await mkdir(dirname(devenvPath), { recursive: true });
+      await writeFile(
+        devenvPath,
+        `{
+  pkgs,
+  lib,
+  ...
+}: {
+  packages = with pkgs; [
+    nodejs_latest
+    bun
+    git
+    git-format-staged
+    jq
+    alejandra
+    coreutils
+    gnutar
+    go
+    stdenv.cc.cc.lib
+  ];
+}
+`,
+      );
+
+      expect(validateDevenvPackages(root)).toBe(2);
+      applyDevenvPackageDefaults(root);
+      expect(validateDevenvPackages(root)).toBe(0);
+      const devenv = await readFile(devenvPath, 'utf8');
+      expect(devenv).toContain('sccache # Rust compiler wrapper and cache');
+      expect(devenv).toContain('++ lib.optionals pkgs.stdenv.isLinux [');
+      expect(devenv).toContain('pkgs.stdenv.cc');
+      expect(devenv).toContain('stdenv.cc.cc.lib');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('accepts newer dependencies after removing even an empty obsolete ttsc patch key', async () => {
     const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
     try {
       await writeJson(join(root, 'package.json'), {
@@ -108,12 +195,12 @@ describe('tool configuration validation', () => {
           'eslint-stdout': await currentEslintStdoutRange(),
           nx: '24.0.0',
           prettier: '^3.7.0',
-          ttsc: '0.19.3',
+          ttsc: '0.25.0',
           typescript: '^6.0.0',
           '@typescript/native': 'npm:typescript@^7.0.2',
         },
         patchedDependencies: {
-          'ttsc@0.19.3': 'patches/ttsc@0.19.3.patch',
+          'ttsc@0.19.3': '',
         },
       });
       await writeJson(join(root, 'tooling/package.json'), {
@@ -138,12 +225,17 @@ describe('tool configuration validation', () => {
     alejandra
     coreutils
     gnutar
+    go
   ];
 }
 `,
       );
 
+      expect(await validateToolConfig(root)).toBe(1);
+      await applyToolConfigDefaults(root);
       expect(await validateToolConfig(root)).toBe(0);
+      const rootPackage = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+      expect(rootPackage.patchedDependencies?.['ttsc@0.19.3']).toBeUndefined();
     } finally {
       await rm(root, { recursive: true, force: true });
     }
@@ -210,7 +302,7 @@ describe('tool configuration validation', () => {
           eslint: '^10.0.0',
           nx: '24.0.0',
           prettier: '^3.7.0',
-          ttsc: '0.19.3',
+          ttsc: '0.25.0',
           typescript: '^6.0.0',
         },
       });
@@ -224,7 +316,7 @@ describe('tool configuration validation', () => {
       expect(rootPackage.devDependencies['eslint-stdout']).toBe(await currentEslintStdoutRange());
       expect(rootPackage.devDependencies['@smoothbricks/nx-plugin']).toBe(await currentNxPluginRange());
       expect(rootPackage.devDependencies['@typescript/native']).toBe('npm:typescript@^7.0.2');
-      expect(rootPackage.patchedDependencies?.['ttsc@0.19.3']).toBe('patches/ttsc@0.19.3.patch');
+      expect(rootPackage.patchedDependencies?.['ttsc@0.19.3']).toBeUndefined();
       expect(toolingPackage.name).toBe('@fixture/tooling');
       expect(toolingPackage.dependencies['@smoothbricks/cli']).toBe(await currentCliRange());
     } finally {

package/src/monorepo/tool-validation.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import typia from 'typia';
 import { cliPackageVersion, isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
@@ -56,8 +56,7 @@ const rootDevDependencies: RequiredDependency[] = [
   },
   { name: 'nx', fallbackVersion: '23.1.0', minimumVersion: '23.1.0' },
   { name: 'prettier', fallbackVersion: '^3.6.1', minimumVersion: '3.6.0', prefix: '^' },
-  // Exact pin: Bun patchedDependencies keys are version-locked (see patches/ttsc@0.19.3.patch).
-  { name: 'ttsc', fallbackVersion: '0.19.3' },
+  { name: 'ttsc', fallbackVersion: '0.25.0' },
   // Nx and typescript-eslint still load the TypeScript JS API (6.x).
   // Compilation is exclusively delegated to ttsc by the Nx plugin targets.
   { name: 'typescript', fallbackVersion: '^6.0.3', minimumVersion: '6.0.0', prefix: '^' },
@@ -68,15 +67,26 @@ const rootDevDependencies: RequiredDependency[] = [
 
 const cliPackageName = '@smoothbricks/cli';
 
-const requiredDevenvPackages = ['bun', 'git', 'git-format-staged', 'jq', 'alejandra', 'coreutils', 'gnutar'];
+const requiredDevenvPackages = ['bun', 'git', 'git-format-staged', 'jq', 'alejandra', 'coreutils', 'gnutar', 'go'];
 // Any explicit nodejs provider is fine — the pinned major is the repo's choice
 // (Lambda parity, org convergence, …). Whether the pins in package.json agree
 // with the runtime is validated against the live PATH (validateRootRuntimeVersions),
 // never against a version template here.
 const nodePackagePattern = /(^|\s)nodejs(_\d+|_latest)?(\s|#|$)/m;
-
-const TTSC_PATCHED_DEPENDENCY_KEY = 'ttsc@0.19.3';
-const TTSC_PATCH_PATH = 'patches/ttsc@0.19.3.patch';
+const requiredRustDevenvPackages = ['sccache'];
+const linuxCompilerPackage = 'pkgs.stdenv.cc';
+const ignoredNativeManifestDirectories = new Set([
+  '.devenv',
+  '.direnv',
+  '.git',
+  '.nx',
+  'dist',
+  'node_modules',
+  'target',
+  'vendor',
+]);
+
+const obsoleteTtscPatchedDependencyKey = 'ttsc@0.19.3';
 
 export async function applyToolConfigDefaults(root: string): Promise<void> {
   const context = await readToolContext(root);
@@ -89,7 +99,7 @@ export async function validateToolConfig(root: string): Promise<number> {
   const context = await readToolContext(root);
   return (
     validateRootDevDependencies(context.policy, context.rootPackage) +
-    validateTtscPatchedDependency(context.rootPackage) +
+    validateObsoleteTtscPatchRemoved(context.rootPackage) +
     validateToolingPackage(root, context.policy) +
     validateToolingWorkspace(context.rootPackage) +
     validateDevenvPackages(root)
@@ -113,7 +123,7 @@ export async function applyRootDevDependencyDefaults(root: string, context: Tool
   if (delete devDependencies['@smoothbricks/cli']) {
     changed = true;
   }
-  changed = ensureTtscPatchedDependency(pkg) || changed;
+  changed = removeObsoleteTtscPatch(pkg) || changed;
   if (changed) {
     writeJsonObject(join(root, 'package.json'), pkg);
     console.log('updated        package.json workspace tool dependencies');
@@ -129,7 +139,6 @@ async function applyRootPackageToolDefaults(root: string, context: ToolContext):
   }
   let dependencyChanged = false;
   let workspaceChanged = false;
-  let patchChanged = false;
   const devDependencies = ensureDependencyMap(pkg, 'devDependencies');
   for (const dependency of rootDevDependencies) {
     const current = devDependencies[dependency.name];
@@ -142,8 +151,8 @@ async function applyRootPackageToolDefaults(root: string, context: ToolContext):
     dependencyChanged = true;
   }
   workspaceChanged = addWorkspacePattern(pkg, 'tooling');
-  patchChanged = ensureTtscPatchedDependency(pkg);
-  if (dependencyChanged || workspaceChanged || patchChanged) {
+  dependencyChanged = removeObsoleteTtscPatch(pkg) || dependencyChanged;
+  if (dependencyChanged || workspaceChanged) {
     writeJsonObject(join(root, 'package.json'), pkg);
   }
   console.log(
@@ -156,11 +165,6 @@ async function applyRootPackageToolDefaults(root: string, context: ToolContext):
       ? 'updated        package.json tooling workspace'
       : 'unchanged      package.json tooling workspace',
   );
-  console.log(
-    patchChanged
-      ? 'updated        package.json patchedDependencies for ttsc'
-      : 'unchanged      package.json patchedDependencies for ttsc',
-  );
 }
 
 export function applyToolingPackageDefaults(root: string, policy: ToolPolicy): void {
@@ -209,7 +213,9 @@ export function applyDevenvPackageDefaults(root: string): void {
     changed = next !== content || changed;
     content = next;
   }
-  for (const name of requiredDevenvPackages) {
+  const compilesRust = workspaceCompilesRust(root);
+  const requiredPackages = [...requiredDevenvPackages, ...(compilesRust ? requiredRustDevenvPackages : [])];
+  for (const name of requiredPackages) {
     if (hasNixPackage(content, name)) {
       continue;
     }
@@ -217,6 +223,11 @@ export function applyDevenvPackageDefaults(root: string): void {
     changed = next !== content || changed;
     content = next;
   }
+  if (compilesRust && !hasLinuxCompilerPackage(content)) {
+    const next = addLinuxCompilerPackage(content);
+    changed = next !== content || changed;
+    content = next;
+  }
   if (changed) {
     writeFileSync(path, content);
     console.log('updated        tooling/direnv/devenv.nix packages');
@@ -252,22 +263,25 @@ export function validateRootDevDependencies(policy: ToolPolicy, rootPackage: Pac
   return failures;
 }
 
-function ensureTtscPatchedDependency(pkg: PackageJson): boolean {
-  const patched = ensureDependencyMap(pkg, 'patchedDependencies');
-  return setStringProperty(patched, TTSC_PATCHED_DEPENDENCY_KEY, TTSC_PATCH_PATH);
+function removeObsoleteTtscPatch(pkg: PackageJson): boolean {
+  const patchedDependencies = pkg.patchedDependencies;
+  if (!patchedDependencies || !(obsoleteTtscPatchedDependencyKey in patchedDependencies)) {
+    return false;
+  }
+  delete patchedDependencies[obsoleteTtscPatchedDependencyKey];
+  if (Object.keys(patchedDependencies).length === 0) {
+    delete pkg.patchedDependencies;
+  }
+  return true;
 }
 
-function validateTtscPatchedDependency(rootPackage: PackageJson | null): number {
-  if (!rootPackage) {
-    return 0;
-  }
-  const actual = rootPackage.patchedDependencies?.[TTSC_PATCHED_DEPENDENCY_KEY];
-  if (actual === TTSC_PATCH_PATH) {
+function validateObsoleteTtscPatchRemoved(rootPackage: PackageJson | null): number {
+  const patchedDependencies = rootPackage?.patchedDependencies;
+  if (!patchedDependencies || !(obsoleteTtscPatchedDependencyKey in patchedDependencies)) {
     return 0;
   }
   console.error(
-    `package.json patchedDependencies.${TTSC_PATCHED_DEPENDENCY_KEY} must be ${TTSC_PATCH_PATH}` +
-      (typeof actual === 'string' ? `; found ${actual}` : ' (required for declaration-emit fix)'),
+    `package.json patchedDependencies.${obsoleteTtscPatchedDependencyKey} must be removed; ttsc 0.25.0 emits typia declarations without the obsolete patch`,
   );
   return 1;
 }
@@ -321,12 +335,20 @@ export function validateDevenvPackages(root: string): number {
     );
     failures++;
   }
-  for (const name of requiredDevenvPackages) {
+  const compilesRust = workspaceCompilesRust(root);
+  const requiredPackages = [...requiredDevenvPackages, ...(compilesRust ? requiredRustDevenvPackages : [])];
+  for (const name of requiredPackages) {
     if (!hasNixPackage(content, name)) {
       console.error(`tooling/direnv/devenv.nix packages must include ${name}`);
       failures++;
     }
   }
+  if (compilesRust && !hasLinuxCompilerPackage(content)) {
+    console.error(
+      'tooling/direnv/devenv.nix packages must include pkgs.stdenv.cc in a Linux-only package block for Rust builds',
+    );
+    failures++;
+  }
   return failures;
 }
 
@@ -335,7 +357,9 @@ function addNixPackage(content: string, name: string, comment: string): string {
   if (hasNixPackage(content, name)) {
     return content;
   }
-  const packagesStart = content.indexOf('  packages = with pkgs; [');
+  const directPackagesStart = content.indexOf('  packages = with pkgs; [');
+  const groupedPackagesStart = content.indexOf('    (with pkgs; [');
+  const packagesStart = directPackagesStart === -1 ? groupedPackagesStart : directPackagesStart;
   if (packagesStart === -1) {
     return content;
   }
@@ -347,6 +371,60 @@ function hasNixPackage(content: string, name: string): boolean {
   return new RegExp(`(^|\\s)${escapeRegex(name)}(\\s|#|$)`, 'm').test(content);
 }
 
+function workspaceCompilesRust(root: string): boolean {
+  return containsCargoManifest(root);
+}
+
+function containsCargoManifest(directory: string): boolean {
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    if (entry.isFile() && entry.name === 'Cargo.toml') {
+      return true;
+    }
+    if (
+      entry.isDirectory() &&
+      entry.name.startsWith('.') === false &&
+      ignoredNativeManifestDirectories.has(entry.name) === false &&
+      containsCargoManifest(join(directory, entry.name))
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function hasLinuxCompilerPackage(content: string): boolean {
+  const linuxPackages = /\+\+\s+lib\.optionals\s+pkgs\.stdenv\.isLinux\s+\[([\s\S]*?)\]/g;
+  return [...content.matchAll(linuxPackages)].some((match) => hasNixPackage(match[1] ?? '', linuxCompilerPackage));
+}
+
+function addLinuxCompilerPackage(content: string): string {
+  if (hasLinuxCompilerPackage(content)) {
+    return content;
+  }
+  const directStart = content.indexOf('  packages = with pkgs; [');
+  if (directStart !== -1) {
+    const listEnd = content.indexOf('\n  ];', directStart);
+    if (listEnd === -1) {
+      return content;
+    }
+    const listBody = content.slice(directStart + '  packages = with pkgs; ['.length, listEnd);
+    const replacement = `  packages =\n    (with pkgs; [${listBody}\n    ])\n    ++ lib.optionals pkgs.stdenv.isLinux [\n      ${linuxCompilerPackage}\n    ];`;
+    return `${content.slice(0, directStart)}${replacement}${content.slice(listEnd + '\n  ];'.length)}`;
+  }
+
+  const packagesStart = content.indexOf('  packages =');
+  const nextOption = content.indexOf('\n\n  ', packagesStart);
+  if (packagesStart === -1 || nextOption === -1) {
+    return content;
+  }
+  const terminator = content.lastIndexOf(';', nextOption);
+  if (terminator < packagesStart) {
+    return content;
+  }
+  const linuxPackages = `\n    ++ lib.optionals pkgs.stdenv.isLinux [\n      ${linuxCompilerPackage}\n    ]`;
+  return `${content.slice(0, terminator)}${linuxPackages}${content.slice(terminator)}`;
+}
+
 function nixPackageComment(name: string): string {
   if (name === 'coreutils') {
     return '# Provides fmt for commit message wrapping';
@@ -357,6 +435,12 @@ function nixPackageComment(name: string): string {
   if (name === 'git') {
     return '# Git hooks and repository inspection';
   }
+  if (name === 'go') {
+    return '# Builds ttsc source plugins';
+  }
+  if (name === 'sccache') {
+    return '# Rust compiler wrapper and cache';
+  }
   return '';
 }