@smoothbricks/cli 0.11.11 → 0.11.13

package/dist/monorepo/cargo-policy.js

@@ -2,12 +2,13 @@ import * as _accessExpressionAsString_1 from "typia/lib/internal/_accessExpressi
 const __typia_transform__accessExpressionAsString = _accessExpressionAsString_1._accessExpressionAsString;
 import * as _validateReport_1 from "typia/lib/internal/_validateReport";
 import * as _createStandardSchema_1 from "typia/lib/internal/_createStandardSchema";
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import typia from 'typia';
 import { parsePackageJsonText } from '../lib/json.js';
 const validateCargoManifest = (() => {
-    const _io0 = input => (undefined === input.workspace || "object" === typeof input.workspace && null !== input.workspace && false === Array.isArray(input.workspace) && _io1(input.workspace)) && (undefined === input["package"] || "object" === typeof input["package"] && null !== input["package"] && false === Array.isArray(input["package"]) && _io2(input["package"])) && (undefined === input.profile || "object" === typeof input.profile && null !== input.profile && false === Array.isArray(input.profile) && _io3(input.profile));
+    const _io0 = input => (undefined === input.workspace || "object" === typeof input.workspace && null !== input.workspace && false === Array.isArray(input.workspace) && _io1(input.workspace)) && (undefined === input["package"] || "object" === typeof input["package"] && null !== input["package"] && false === Array.isArray(input["package"]) && _io2(input["package"])) && (undefined === input.profile || "object" === typeof input.profile && null !== input.profile && false === Array.isArray(input.profile) && _io3(input.profile)) && (undefined === input.dependencies || "object" === typeof input.dependencies && null !== input.dependencies && false === Array.isArray(input.dependencies) && _io5(input.dependencies)) && (undefined === input["dev-dependencies"] || "object" === typeof input["dev-dependencies"] && null !== input["dev-dependencies"] && false === Array.isArray(input["dev-dependencies"]) && _io5(input["dev-dependencies"])) && (undefined === input["build-dependencies"] || "object" === typeof input["build-dependencies"] && null !== input["build-dependencies"] && false === Array.isArray(input["build-dependencies"]) && _io5(input["build-dependencies"]));
     const _io1 = input => (undefined === input.members || Array.isArray(input.members) && input.members.every(elem => "string" === typeof elem)) && (undefined === input.exclude || Array.isArray(input.exclude) && input.exclude.every(elem => "string" === typeof elem));
     const _io2 = input => (undefined === input.name || "string" === typeof input.name) && (undefined === input.workspace || "string" === typeof input.workspace || "boolean" === typeof input.workspace);
     const _io3 = input => Object.keys(input).every(key => {
@@ -17,6 +18,12 @@ const validateCargoManifest = (() => {
         return "object" === typeof value && null !== value && false === Array.isArray(value) && _io4(value);
     });
     const _io4 = input => (undefined === input.inherits || "string" === typeof input.inherits) && (undefined === input.incremental || "boolean" === typeof input.incremental) && (undefined === input.debug || "string" === typeof input.debug || "number" === typeof input.debug || "boolean" === typeof input.debug) && (undefined === input["split-debuginfo"] || "string" === typeof input["split-debuginfo"]) && (null !== input["trim-paths"] && (undefined === input["trim-paths"] || "string" === typeof input["trim-paths"] || "boolean" === typeof input["trim-paths"] || Array.isArray(input["trim-paths"]) && input["trim-paths"].every(elem => "string" === typeof elem)));
+    const _io5 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
     const _vo0 = (input, _path, _exceptionable = true) => [undefined === input.workspace || ("object" === typeof input.workspace && null !== input.workspace && false === Array.isArray(input.workspace) || _report(_exceptionable, {
             path: _path + ".workspace",
             expected: "(undefined | { members?: string[] | undefined; exclude?: string[] | undefined; })",
@@ -41,6 +48,30 @@ const validateCargoManifest = (() => {
             path: _path + ".profile",
             expected: "(Record<string, CargoProfile> | undefined)",
             value: input.profile
+        }), undefined === input.dependencies || ("object" === typeof input.dependencies && null !== input.dependencies && false === Array.isArray(input.dependencies) || _report(_exceptionable, {
+            path: _path + ".dependencies",
+            expected: "(Record<string, unknown> | undefined)",
+            value: input.dependencies
+        })) && _vo5(input.dependencies, _path + ".dependencies", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".dependencies",
+            expected: "(Record<string, unknown> | undefined)",
+            value: input.dependencies
+        }), undefined === input["dev-dependencies"] || ("object" === typeof input["dev-dependencies"] && null !== input["dev-dependencies"] && false === Array.isArray(input["dev-dependencies"]) || _report(_exceptionable, {
+            path: _path + "[\"dev-dependencies\"]",
+            expected: "(Record<string, unknown> | undefined)",
+            value: input["dev-dependencies"]
+        })) && _vo5(input["dev-dependencies"], _path + "[\"dev-dependencies\"]", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + "[\"dev-dependencies\"]",
+            expected: "(Record<string, unknown> | undefined)",
+            value: input["dev-dependencies"]
+        }), undefined === input["build-dependencies"] || ("object" === typeof input["build-dependencies"] && null !== input["build-dependencies"] && false === Array.isArray(input["build-dependencies"]) || _report(_exceptionable, {
+            path: _path + "[\"build-dependencies\"]",
+            expected: "(Record<string, unknown> | undefined)",
+            value: input["build-dependencies"]
+        })) && _vo5(input["build-dependencies"], _path + "[\"build-dependencies\"]", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + "[\"build-dependencies\"]",
+            expected: "(Record<string, unknown> | undefined)",
+            value: input["build-dependencies"]
         })].every(flag => flag);
     const _vo1 = (input, _path, _exceptionable = true) => [undefined === input.members || (Array.isArray(input.members) || _report(_exceptionable, {
             path: _path + ".members",
@@ -123,6 +154,12 @@ const validateCargoManifest = (() => {
             expected: "(Array<string> | boolean | string | undefined)",
             value: input["trim-paths"]
         }))].every(flag => flag);
+    const _vo5 = (input, _path, _exceptionable = true) => [false === _exceptionable || Object.keys(input).map(key => {
+            const value = input[key];
+            if (undefined === value)
+                return true;
+            return true;
+        }).every(flag => flag)].every(flag => flag);
     const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
     let errors;
     let _report;
@@ -175,7 +212,7 @@ const validateCargoConfig = (() => {
         expected: "(Array<string> | string | undefined)",
         value: input["rustflags"]
     }));
-    const _io0 = input => (undefined === input.build || "object" === typeof input.build && null !== input.build && false === Array.isArray(input.build) && _io1(input.build)) && (undefined === input.target || "object" === typeof input.target && null !== input.target && false === Array.isArray(input.target) && _io2(input.target)) && (undefined === input.env || "object" === typeof input.env && null !== input.env && false === Array.isArray(input.env) && _io4(input.env));
+    const _io0 = input => (undefined === input.build || "object" === typeof input.build && null !== input.build && false === Array.isArray(input.build) && _io1(input.build)) && (undefined === input.target || "object" === typeof input.target && null !== input.target && false === Array.isArray(input.target) && _io2(input.target)) && (undefined === input.env || "object" === typeof input.env && null !== input.env && false === Array.isArray(input.env) && _io4(input.env)) && (undefined === input.resolver || "object" === typeof input.resolver && null !== input.resolver && false === Array.isArray(input.resolver) && _io6(input.resolver)) && (undefined === input.unstable || "object" === typeof input.unstable && null !== input.unstable && false === Array.isArray(input.unstable) && _io7(input.unstable));
     const _io1 = input => (undefined === input["target-dir"] || "string" === typeof input["target-dir"]) && _ip0(input) && (undefined === input.incremental || "boolean" === typeof input.incremental);
     const _io2 = input => Object.keys(input).every(key => {
         const value = input[key];
@@ -191,6 +228,8 @@ const validateCargoConfig = (() => {
         return null !== value && undefined !== value && ("string" === typeof value || "object" === typeof value && null !== value && false === Array.isArray(value) && _io5(value));
     });
     const _io5 = input => (undefined === input.value || "string" === typeof input.value) && (undefined === input.relative || "boolean" === typeof input.relative) && (undefined === input.force || "boolean" === typeof input.force);
+    const _io6 = input => undefined === input["feature-unification"] || "string" === typeof input["feature-unification"];
+    const _io7 = input => undefined === input["feature-unification"] || "boolean" === typeof input["feature-unification"];
     const _vo0 = (input, _path, _exceptionable = true) => [undefined === input.build || ("object" === typeof input.build && null !== input.build && false === Array.isArray(input.build) || _report(_exceptionable, {
             path: _path + ".build",
             expected: _ve0,
@@ -215,6 +254,22 @@ const validateCargoConfig = (() => {
             path: _path + ".env",
             expected: "(Record<string, string | CargoConfigEnvObject> | undefined)",
             value: input.env
+        }), undefined === input.resolver || ("object" === typeof input.resolver && null !== input.resolver && false === Array.isArray(input.resolver) || _report(_exceptionable, {
+            path: _path + ".resolver",
+            expected: "(undefined | { 'feature-unification'?: string | undefined; })",
+            value: input.resolver
+        })) && _vo6(input.resolver, _path + ".resolver", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".resolver",
+            expected: "(undefined | { 'feature-unification'?: string | undefined; })",
+            value: input.resolver
+        }), undefined === input.unstable || ("object" === typeof input.unstable && null !== input.unstable && false === Array.isArray(input.unstable) || _report(_exceptionable, {
+            path: _path + ".unstable",
+            expected: "(undefined | { 'feature-unification'?: boolean | undefined; })",
+            value: input.unstable
+        })) && _vo7(input.unstable, _path + ".unstable", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".unstable",
+            expected: "(undefined | { 'feature-unification'?: boolean | undefined; })",
+            value: input.unstable
         })].every(flag => flag);
     const _vo1 = (input, _path, _exceptionable = true) => [undefined === input["target-dir"] || "string" === typeof input["target-dir"] || _report(_exceptionable, {
             path: _path + "[\"target-dir\"]",
@@ -279,6 +334,16 @@ const validateCargoConfig = (() => {
             expected: "(boolean | undefined)",
             value: input.force
         })].every(flag => flag);
+    const _vo6 = (input, _path, _exceptionable = true) => [undefined === input["feature-unification"] || "string" === typeof input["feature-unification"] || _report(_exceptionable, {
+            path: _path + "[\"feature-unification\"]",
+            expected: "(string | undefined)",
+            value: input["feature-unification"]
+        })].every(flag => flag);
+    const _vo7 = (input, _path, _exceptionable = true) => [undefined === input["feature-unification"] || "boolean" === typeof input["feature-unification"] || _report(_exceptionable, {
+            path: _path + "[\"feature-unification\"]",
+            expected: "(boolean | undefined)",
+            value: input["feature-unification"]
+        })].every(flag => flag);
     const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
     let errors;
     let _report;
@@ -311,6 +376,118 @@ const validateCargoConfig = (() => {
         };
     });
 })();
+const validateRustToolchainFile = (() => {
+    const _io0 = input => undefined === input.toolchain || "object" === typeof input.toolchain && null !== input.toolchain && false === Array.isArray(input.toolchain) && _io1(input.toolchain);
+    const _io1 = input => undefined === input.channel || "string" === typeof input.channel;
+    const _vo0 = (input, _path, _exceptionable = true) => [undefined === input.toolchain || ("object" === typeof input.toolchain && null !== input.toolchain && false === Array.isArray(input.toolchain) || _report(_exceptionable, {
+            path: _path + ".toolchain",
+            expected: "(undefined | { channel?: string | undefined; })",
+            value: input.toolchain
+        })) && _vo1(input.toolchain, _path + ".toolchain", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".toolchain",
+            expected: "(undefined | { channel?: string | undefined; })",
+            value: input.toolchain
+        })].every(flag => flag);
+    const _vo1 = (input, _path, _exceptionable = true) => [undefined === input.channel || "string" === typeof input.channel || _report(_exceptionable, {
+            path: _path + ".channel",
+            expected: "(string | undefined)",
+            value: input.channel
+        })].every(flag => flag);
+    const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+    let errors;
+    let _report;
+    return _createStandardSchema_1._createStandardSchema(input => {
+        if (false === __is(input)) {
+            errors = [];
+            _report = _validateReport_1._validateReport(errors);
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input && false === Array.isArray(input) || _report(true, {
+                path: _path + "",
+                expected: "RustToolchainFile",
+                value: input
+            })) && _vo0(input, _path + "", true) || _report(true, {
+                path: _path + "",
+                expected: "RustToolchainFile",
+                value: input
+            }))(input, "$input", true);
+            const success = 0 === errors.length;
+            return success ? {
+                success,
+                data: input
+            } : {
+                success,
+                errors,
+                data: input
+            };
+        }
+        return {
+            success: true,
+            data: input
+        };
+    });
+})();
+const validateHakariConfig = (() => {
+    const _io0 = input => undefined === input["hakari-package"] || "string" === typeof input["hakari-package"];
+    const _vo0 = (input, _path, _exceptionable = true) => [undefined === input["hakari-package"] || "string" === typeof input["hakari-package"] || _report(_exceptionable, {
+            path: _path + "[\"hakari-package\"]",
+            expected: "(string | undefined)",
+            value: input["hakari-package"]
+        })].every(flag => flag);
+    const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+    let errors;
+    let _report;
+    return _createStandardSchema_1._createStandardSchema(input => {
+        if (false === __is(input)) {
+            errors = [];
+            _report = _validateReport_1._validateReport(errors);
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input && false === Array.isArray(input) || _report(true, {
+                path: _path + "",
+                expected: "HakariConfig",
+                value: input
+            })) && _vo0(input, _path + "", true) || _report(true, {
+                path: _path + "",
+                expected: "HakariConfig",
+                value: input
+            }))(input, "$input", true);
+            const success = 0 === errors.length;
+            return success ? {
+                success,
+                data: input
+            } : {
+                success,
+                errors,
+                data: input
+            };
+        }
+        return {
+            success: true,
+            data: input
+        };
+    });
+})();
+const defaultHakariShell = {
+    run(directory, args) {
+        const result = spawnSync('cargo', ['hakari', ...args], { cwd: directory, encoding: 'utf8' });
+        const output = `${result.stdout ?? ''}${result.stderr ?? ''}`.trim();
+        // cargo itself exists; a missing subcommand is cargo's own error, not ENOENT.
+        const missing = result.error?.code === 'ENOENT' || output.includes('no such command');
+        return { code: result.status ?? 1, output, missing };
+    },
+};
+/** Cargo's nightly-only workspace feature unification, and the config that turns it on. */
+const RESOLVER_UNIFICATION_BLOCK = [
+    '# One feature resolution for the whole workspace. Without it every per-crate',
+    '# cargo invocation resolves features for its own selection, so one shared',
+    '# dependency is compiled once per selection and no warm target directory is',
+    '# reused across crates. Requires the nightly channel the managed devenv',
+    '# module pins; on a stable toolchain a cargo-hakari workspace-hack does the',
+    '# same job. Both keys are needed: cargo ignores [resolver] without the',
+    '# [unstable] opt-in.',
+    '[unstable]',
+    'feature-unification = true',
+    '',
+    '[resolver]',
+    'feature-unification = "workspace"',
+].join('\n');
 const SKIPPED_DIRECTORY_NAMES = new Set([
     'node_modules',
     'target',
@@ -488,6 +665,143 @@ function hasAncestorWorkspace(manifest, workspaceRoots) {
             return path !== '' && path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path);
         })());
 }
+/**
+ * The channel that will actually compile this repository.
+ *
+ * The managed devenv module wins when it exists: devenv resolves the toolchain
+ * through rust-overlay and ignores `rust-toolchain.toml` unless
+ * `languages.rust.toolchainFile` names it, so a rust-toolchain file beside that
+ * module is decoration. Without the module, rustup's file is the answer. With
+ * neither, stable is the safe verdict: it is the channel on which the nightly
+ * resolver keys silently do nothing.
+ */
+function isNightlyToolchain(repositoryRoot, workspaceDirectory) {
+    const devenvModule = join(repositoryRoot, 'tooling/direnv/devenv.smoo.nix');
+    if (existsSync(devenvModule)) {
+        const text = readFileSync(devenvModule, 'utf8');
+        const rustIndex = text.indexOf('languages.rust');
+        const channel = rustIndex === -1 ? null : /channel\s*=\s*"([^"]+)"/.exec(text.slice(rustIndex))?.[1];
+        return channel?.startsWith('nightly') === true;
+    }
+    for (const directory of [workspaceDirectory, repositoryRoot]) {
+        const path = join(directory, 'rust-toolchain.toml');
+        if (!existsSync(path)) {
+            continue;
+        }
+        try {
+            const validation = validateRustToolchainFile(Bun.TOML.parse(readFileSync(path, 'utf8')));
+            return validation.success && validation.data.toolchain?.channel?.startsWith('nightly') === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+/**
+ * Cargo merges `.cargo/config.toml` from the invocation directory upward, with
+ * the deepest file winning. Only the configs at or above the workspace root can
+ * govern a command run there, so the effective value is the deepest of those.
+ */
+function effectiveConfigValue(configs, workspaceDirectory, read) {
+    let deepest = null;
+    for (const loaded of configs) {
+        const directory = dirname(dirname(loaded.path));
+        if (!pathWithin(directory, workspaceDirectory)) {
+            continue;
+        }
+        const value = read(loaded.config);
+        if (value === undefined) {
+            continue;
+        }
+        if (deepest === null || directory.length > deepest.directory.length) {
+            deepest = { directory, value };
+        }
+    }
+    return deepest?.value;
+}
+function workspaceCrates(root, manifests) {
+    const members = manifests.filter((manifest) => workspaceContains(root, manifest));
+    return root.manifest.package === undefined ? members : [root, ...members];
+}
+const FEATURE_UNIFICATION_FIX = 'Run: smoo monorepo update';
+/**
+ * A workspace of two or more crates must resolve features ONCE for all of them.
+ *
+ * Without that, every per-crate cargo invocation resolves features for its own
+ * selection, and one shared dependency is compiled once per selection: the same
+ * `nx run cargo-test-<crate>` that should reuse a warm target directory rebuilds
+ * its half of the graph instead. Cargo's own mechanism is nightly-only, so a
+ * stable toolchain reaches the identical result through a cargo-hakari
+ * workspace-hack — a generated crate that depends on the union of features, which
+ * every member then depends on.
+ *
+ * One crate needs neither: there is only one selection to unify.
+ */
+function featureUnificationPolicy(repositoryRoot, workspaceRoots, manifests, configs, shell) {
+    let failures = 0;
+    for (const root of workspaceRoots) {
+        const crates = workspaceCrates(root, manifests);
+        if (crates.length < 2) {
+            continue;
+        }
+        const nightly = isNightlyToolchain(repositoryRoot, root.directory);
+        const resolver = effectiveConfigValue(configs, root.directory, (config) => config.resolver?.['feature-unification']);
+        const unstable = effectiveConfigValue(configs, root.directory, (config) => config.unstable?.['feature-unification']);
+        if (nightly && resolver === 'workspace') {
+            if (unstable !== true) {
+                failures += report(join(root.directory, '.cargo/config.toml'), 'sets [resolver] feature-unification = "workspace" without [unstable] feature-unification = true, ' +
+                    `so cargo ignores it and every crate still resolves features on its own. ${FEATURE_UNIFICATION_FIX}`);
+            }
+            continue;
+        }
+        if (existsSync(join(root.directory, '.config/hakari.toml'))) {
+            failures += hakariWorkspaceHackPolicy(root, crates, shell);
+            continue;
+        }
+        failures += report(root.path, `workspace of ${crates.length} crates has no workspace-wide feature unification: ` +
+            (nightly
+                ? 'add [unstable] feature-unification = true and [resolver] feature-unification = "workspace" to .cargo/config.toml'
+                : 'the [resolver] feature-unification key needs the nightly channel, so this stable toolchain needs a ' +
+                    'cargo-hakari workspace-hack (.config/hakari.toml)') +
+            `. Every per-crate cargo invocation otherwise recompiles the shared graph for its own feature selection. ${FEATURE_UNIFICATION_FIX}`);
+    }
+    return failures;
+}
+function hakariWorkspaceHackPolicy(root, crates, shell) {
+    const configPath = join(root.directory, '.config/hakari.toml');
+    let hackName;
+    try {
+        const validation = validateHakariConfig(Bun.TOML.parse(readFileSync(configPath, 'utf8')));
+        hackName = validation.success ? validation.data['hakari-package'] : undefined;
+    }
+    catch {
+        hackName = undefined;
+    }
+    if (hackName === undefined || hackName.length === 0) {
+        return report(configPath, `must declare hakari-package = "<crate>". ${FEATURE_UNIFICATION_FIX}`);
+    }
+    const hack = crates.find((crate) => crate.manifest.package?.name === hackName);
+    if (hack === undefined) {
+        return report(configPath, `names hakari-package "${hackName}", which is not a member of this workspace. ${FEATURE_UNIFICATION_FIX}`);
+    }
+    const unwired = crates
+        .filter((crate) => crate !== hack)
+        .filter((crate) => ![crate.manifest.dependencies, crate.manifest['dev-dependencies'], crate.manifest['build-dependencies']].some((table) => table !== undefined && hackName in table))
+        .map((crate) => crate.manifest.package?.name ?? crate.path);
+    if (unwired.length > 0) {
+        return report(root.path, `these crates do not depend on "${hackName}", so cargo-hakari cannot unify their features: ` +
+            `${unwired.join(', ')}. ${FEATURE_UNIFICATION_FIX}`);
+    }
+    const verify = shell.run(root.directory, ['verify']);
+    if (verify.missing) {
+        return report(configPath, 'needs cargo-hakari, which is not installed; the managed devenv module provides it — reload the shell (direnv reload).');
+    }
+    if (verify.code !== 0) {
+        return report(root.path, `cargo hakari verify rejected the workspace-hack: ${verify.output || 'no output'}. ${FEATURE_UNIFICATION_FIX}`);
+    }
+    return 0;
+}
 function isWorkspaceMember(manifest, workspaceRoots) {
     if (manifest.manifest.package?.workspace !== undefined) {
         return true;
@@ -738,7 +1052,7 @@ function reportManifestDirectoryAdvisories(repositoryRoot, ignoredDirectories) {
         console.error(`${advisory.path}:${advisory.line}: env!("CARGO_MANIFEST_DIR") is not path-stable; the patched sccache never normalises env-dep values, so this crate and everything downstream misses on every workspace at a new mount path. Fix it by removing the macro from production code or replacing it with a path-stable value.`);
     }
 }
-export function validateCargoCachePolicy(root) {
+export function validateCargoCachePolicy(root, options = {}) {
     const repositoryRoot = resolve(root);
     const discoveredManifestPaths = discoverFiles(repositoryRoot, (name) => name === 'Cargo.toml');
     const ignoredDirectories = discoverIgnoredSubtrees(discoveredManifestPaths);
@@ -767,6 +1081,7 @@ export function validateCargoCachePolicy(root) {
     }
     const workspaceRoots = manifests.filter((loaded) => loaded.manifest.workspace !== undefined);
     failures += reportManifestPolicy(manifests, workspaceRoots);
+    failures += featureUnificationPolicy(repositoryRoot, workspaceRoots, manifests, configs, options.shell ?? defaultHakariShell);
     failures += cargoIncrementalPolicy(repositoryRoot, configs, packageJsonPaths, justfilePaths, ignoredDirectories);
     for (const config of configs) {
         failures += configPolicy(config, repositoryRoot);
@@ -774,3 +1089,80 @@ export function validateCargoCachePolicy(root) {
     reportManifestDirectoryAdvisories(repositoryRoot, ignoredDirectories);
     return failures;
 }
+/**
+ * The fix `smoo monorepo update` applies for the policy above: write the
+ * nightly resolver configuration, or generate and wire the workspace-hack a
+ * stable toolchain needs. Both are idempotent — the second run of either does
+ * nothing — because update runs on every repository, not only broken ones.
+ */
+export function applyCargoFeatureUnification(root, options = {}) {
+    const repositoryRoot = resolve(root);
+    const shell = options.shell ?? defaultHakariShell;
+    const discoveredManifestPaths = discoverFiles(repositoryRoot, (name) => name === 'Cargo.toml');
+    const manifestPaths = filterIgnoredPaths(discoveredManifestPaths, discoverIgnoredSubtrees(discoveredManifestPaths));
+    const manifests = [];
+    for (const path of manifestPaths) {
+        const manifest = loadManifest(path);
+        if (manifest !== null) {
+            manifests.push({ path, directory: dirname(path), manifest });
+        }
+    }
+    for (const root of manifests.filter((loaded) => loaded.manifest.workspace !== undefined)) {
+        if (workspaceCrates(root, manifests).length < 2) {
+            continue;
+        }
+        if (isNightlyToolchain(repositoryRoot, root.directory)) {
+            writeResolverUnification(root.directory);
+            continue;
+        }
+        const hakariConfig = join(root.directory, '.config/hakari.toml');
+        const relativeRoot = relative(repositoryRoot, root.directory) || '.';
+        if (!existsSync(hakariConfig)) {
+            console.log(`generating     cargo workspace-hack in ${relativeRoot} (cargo hakari init workspace-hack)`);
+            runHakari(shell, root.directory, ['init', 'workspace-hack']);
+        }
+        console.log(`unifying       cargo features in ${relativeRoot} (cargo hakari generate, manage-deps)`);
+        runHakari(shell, root.directory, ['generate']);
+        runHakari(shell, root.directory, ['manage-deps', '--yes']);
+    }
+}
+function runHakari(shell, directory, args) {
+    const result = shell.run(directory, args);
+    if (result.missing) {
+        console.error(`cargo hakari is not installed, so the workspace-hack in ${directory} was not updated; the managed devenv module provides it — reload the shell (direnv reload).`);
+        return;
+    }
+    if (result.code !== 0) {
+        console.error(`cargo hakari ${args.join(' ')} failed in ${directory}: ${result.output || 'no output'}`);
+    }
+}
+/**
+ * Append the two keys, never rewrite the file. A `.cargo/config.toml` carries
+ * linkers, env and target settings whose ORDER and comments are load-bearing;
+ * re-emitting parsed TOML would lose both. If either table already exists with
+ * some other content, appending a second one is invalid TOML — so that case is
+ * reported for a human instead of being guessed at.
+ */
+function writeResolverUnification(workspaceDirectory) {
+    const path = join(workspaceDirectory, '.cargo/config.toml');
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : null;
+    if (existing === null) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${RESOLVER_UNIFICATION_BLOCK}\n`);
+        console.log(`writing        ${path}`);
+        return;
+    }
+    const parsed = loadConfig(path);
+    if (parsed === null) {
+        return;
+    }
+    if (parsed.resolver?.['feature-unification'] === 'workspace' && parsed.unstable?.['feature-unification'] === true) {
+        return;
+    }
+    if (parsed.resolver !== undefined || parsed.unstable !== undefined) {
+        console.error(`${path}: already declares [resolver] or [unstable]; add feature-unification to the existing tables by hand:\n${RESOLVER_UNIFICATION_BLOCK}`);
+        return;
+    }
+    writeFileSync(path, `${existing.replace(/\n*$/, '\n')}\n${RESOLVER_UNIFICATION_BLOCK}\n`);
+    console.log(`updating       ${path}`);
+}

package/dist/monorepo/ci-workflow.d.ts

@@ -1,4 +1,4 @@
-import type { NonEmptyArray, PackageCargoCredentialsConfig, PackagePrivateNpmConfig, PackageSmooGithub, PackageSmooGithubEnvironments, PackageSourceCheckoutConfig } from '../lib/json.js';
+import type { NonEmptyArray, PackageCargoCredentialsConfig, PackagePrivateNpmConfig, PackageRemoteCacheConfig, PackageSmooGithub, PackageSmooGithubEnvironments, PackageSourceCheckoutConfig } from '../lib/json.js';
 export declare enum CiWorkflowStepKind {
     Checkout = "checkout",
     SourceCheckouts = "source-checkouts",
@@ -63,6 +63,12 @@ export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
      * before SetupDevenv. Absent means no private Cargo fetch.
      */
     cargoCredentials?: PackageCargoCredentialsConfig;
+    /**
+     * Declared self-hosted Nx remote cache (package.json `smoo.remoteCache`).
+     * Every job that runs Nx carries the server and the access token, so one
+     * cache serves the whole fleet. Absent means each runner caches locally.
+     */
+    remoteCache?: PackageRemoteCacheConfig;
     /** GitHub Environments: staging for the validate/e2e jobs, production for the production-on-push job. */
     environments?: PackageSmooGithubEnvironments;
     /** Secrets for the e2e-deployment step, env var name → repository secret name. */
@@ -87,6 +93,22 @@ export declare function privateNpmReadTokenJobEnv(options: Pick<CiWorkflowDefini
 export declare function sourceCheckoutsStepLines(step: CiWorkflowStep, checkouts: readonly PackageSourceCheckoutConfig[]): string[];
 /** Mechanism errors surface at managed-file render time, never inside CI. */
 export declare function normalizeSourceCheckout(config: PackageSourceCheckoutConfig): PackageSourceCheckoutConfig;
+/**
+ * Job env lines carrying the declared Nx remote cache. The pair rides the job
+ * env rather than a step because every Nx invocation in the job — build, lint,
+ * tests, deploy — reads it, and Nx enables the cache on a nonempty server
+ * alone: an empty or absent token would make it authenticate with nothing and
+ * fail every task on 401, which is why the job carries the same fork-PR gate
+ * as a private dependency install (see `renderCiWorkflowHeader`).
+ *
+ * A declared `internalServer` is the address managed runners use, exactly as a
+ * git origin's `internalMirror` is: both say this repository's runners sit
+ * inside that network, and shells outside it keep the public origin.
+ * Mechanism errors surface at managed-file render time, never inside CI.
+ */
+export declare function remoteCacheJobEnvLines(config: PackageRemoteCacheConfig | undefined): string;
+/** Mechanism errors surface at managed-file render time, never inside CI. */
+export declare function normalizeRemoteCache(config: PackageRemoteCacheConfig): PackageRemoteCacheConfig;
 /**
  * Job env lines carrying the declared Cargo credential secrets. Both registry
  * tokens and git-origin tokens ride the job env so the credential helper is
@@ -106,7 +128,10 @@ export declare function cargoCredentialJobEnvLines(config: PackageCargoCredentia
  * `internalMirror` are rewritten to the mirror with `url.<mirror>.insteadOf`
  * and the helper answers the same credential for the mirror's host, since git
  * passes helpers the rewritten URL. The helper reads the environment at call
- * time and answers only for declared origins.
+ * time and answers only for declared origins. Declared `sshOrigins` rewrite
+ * onto the same mirror and stay credential-free: the rewrite happens before
+ * transport, so git only ever asks for the mirror, and an SSH pin the runner
+ * has no key for fails loudly instead of collecting a token.
  * Mechanism errors surface at managed-file render time, never inside CI.
  */
 export declare function cargoCredentialStepLines(step: CiWorkflowStep, config: PackageCargoCredentialsConfig): string[];

package/dist/monorepo/ci-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CAgCvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CAQjF;AAwDD,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAoG9G;AAaD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAsB9G;AAwDD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AA8HD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CAgCvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CAQjF;AAyDD,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAS3F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAgB/F;AA+BD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAyG9G;AAqCD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAkC9G;AAqGD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AA8HD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}