@smoothbricks/cli 0.11.13 → 0.11.14

package/dist/cli.js

@@ -84,9 +84,14 @@ function buildProgram() {
         .option('--fail-fast', 'stop after the first failing validation pack')
         .option('--only-if-new-workspace-package', 'skip validation unless a new workspace package manifest is staged')
         .option('--verbose', 'print validation progress and successful checks')
+        .option('--projects <names>', 'comma-separated Nx project names to build and pack-validate (a release selection); default: every project')
         .action(async (options) => {
         const { validateMonorepo } = await import('./monorepo/index.js');
-        await validateMonorepo(await findRepoRoot(), options);
+        const projects = options.projects
+            ?.split(',')
+            .map((name) => name.trim())
+            .filter((name) => name.length > 0);
+        await validateMonorepo(await findRepoRoot(), { ...options, projects });
     });
     monorepo.command('update').action(async () => {
         const { updateManagedFiles } = await import('./monorepo/index.js');

package/dist/monorepo/index.d.ts

@@ -9,6 +9,8 @@ export interface ValidateOptions {
     onlyIfNewWorkspacePackage?: boolean;
     fix?: boolean;
     verbose?: boolean;
+    /** Nx project names to build and pack-validate; see MonorepoContext.projects. */
+    projects?: readonly string[];
 }
 export interface ValidateCommitMessageOptions {
     fix?: boolean;

package/dist/monorepo/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/monorepo/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AA2BxD,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBjG;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBpE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBrG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,GAAE,4BAAiC,EAC1C,IAAI,SAAgB,GACnB,IAAI,CAoBN;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAW3G;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAI5D;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,KAAK,GAAE,qBAAoD,GAC1D,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/monorepo/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AA2BxD,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjG;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBpE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBrG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,GAAE,4BAAiC,EAC1C,IAAI,SAAgB,GACnB,IAAI,CAoBN;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAW3G;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAI5D;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,KAAK,GAAE,qBAAoD,GAC1D,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/monorepo/index.js

@@ -24,7 +24,7 @@ export async function validateMonorepo(root, options = {}) {
     if (options.onlyIfNewWorkspacePackage && !(await hasNewWorkspacePackage(root))) {
         return;
     }
-    const result = await runValidatePacks({ root, syncRuntime: false, verbose: options.verbose === true }, options);
+    const result = await runValidatePacks({ root, syncRuntime: false, verbose: options.verbose === true, projects: options.projects }, options);
     if (result.failures > 0) {
         const checkNoun = result.failedChecks === 1 ? 'check' : 'checks';
         const problemNoun = result.failures === 1 ? 'problem' : 'problems';

package/dist/monorepo/packed-package.d.ts

@@ -1,5 +1,5 @@
 export declare function validatePackedPublishablePackages(root: string): Promise<number>;
-export declare function validatePackedPublishablePackagePublint(root: string): Promise<number>;
-export declare function validatePackedPublishablePackageManifest(root: string): Promise<number>;
-export declare function validatePackedPublishablePackageTypes(root: string): Promise<number>;
+export declare function validatePackedPublishablePackagePublint(root: string, projects?: readonly string[]): Promise<number>;
+export declare function validatePackedPublishablePackageManifest(root: string, projects?: readonly string[]): Promise<number>;
+export declare function validatePackedPublishablePackageTypes(root: string, projects?: readonly string[]): Promise<number>;
 //# sourceMappingURL=packed-package.d.ts.map

package/dist/monorepo/packed-package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packed-package.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-package.ts"],"names":[],"mappings":"AAeA,wBAAsB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrF;AAED,wBAAsB,uCAAuC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM3F;AAED,wBAAsB,wCAAwC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5F;AAED,wBAAsB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzF"}
+{"version":3,"file":"packed-package.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-package.ts"],"names":[],"mappings":"AAeA,wBAAsB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrF;AAQD,wBAAsB,uCAAuC,CAC3D,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,wCAAwC,CAC5D,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,qCAAqC,CACzD,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAMjB"}

package/dist/monorepo/packed-package.js

@@ -15,23 +15,28 @@ export async function validatePackedPublishablePackages(root) {
         (await validatePackedPublishablePackageManifest(root)) +
         (await validatePackedPublishablePackageTypes(root)));
 }
-export async function validatePackedPublishablePackagePublint(root) {
+/** The publishable packages, narrowed to `projects` (Nx names) when given. */
+function selectedPublishablePackages(root, projects) {
+    const all = listPublishablePackages(root);
+    return projects?.length ? all.filter((pkg) => projects.includes(pkg.projectName)) : all;
+}
+export async function validatePackedPublishablePackagePublint(root, projects) {
     let failures = 0;
-    for (const pkg of listPublishablePackages(root)) {
+    for (const pkg of selectedPublishablePackages(root, projects)) {
         failures += await validatePackedPublishablePackageTool(root, pkg, validatePublint);
     }
     return failures;
 }
-export async function validatePackedPublishablePackageManifest(root) {
+export async function validatePackedPublishablePackageManifest(root, projects) {
     let failures = 0;
-    for (const pkg of listPublishablePackages(root)) {
+    for (const pkg of selectedPublishablePackages(root, projects)) {
         failures += await validatePackedPublishablePackageTool(root, pkg, validatePackedManifest);
     }
     return failures;
 }
-export async function validatePackedPublishablePackageTypes(root) {
+export async function validatePackedPublishablePackageTypes(root, projects) {
     let failures = 0;
-    for (const pkg of listPublishablePackages(root)) {
+    for (const pkg of selectedPublishablePackages(root, projects)) {
         failures += await validatePackedPublishablePackageTool(root, pkg, validateAttw);
     }
     return failures;

package/dist/monorepo/packs/index.d.ts

@@ -4,6 +4,14 @@ export interface MonorepoContext {
     root: string;
     syncRuntime: boolean;
     verbose?: boolean;
+    /**
+     * Nx project names the validation is about, when a caller knows: the
+     * release's candidates. The build phase and the packed-package packs scope
+     * to them; manifest-level packs still see the whole repository, because a
+     * package's hygiene does not depend on which packages ship today. Absent,
+     * everything is validated and everything is built.
+     */
+    projects?: readonly string[];
 }
 export interface ValidatePackOptions {
     failFast?: boolean;

package/dist/monorepo/packs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAO5E,OAAO,EAKL,KAAK,sBAAsB,EAS5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AA8ID,0DAA0D;AAC1D,eAAO,MAAM,YAAY,gBAAQ,CAAC;AAElC,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAuMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAexG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAO5E,OAAO,EAKL,KAAK,sBAAsB,EAS5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AA8ID,0DAA0D;AAC1D,eAAO,MAAM,YAAY,gBAAQ,CAAC;AAElC,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAwMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAexG"}

package/dist/monorepo/packs/index.js

@@ -118,19 +118,19 @@ const packs = [
     {
         name: 'packed-package-publint',
         validatePostBuild(ctx) {
-            return validatePackedPublishablePackagePublint(ctx.root);
+            return validatePackedPublishablePackagePublint(ctx.root, ctx.projects);
         },
     },
     {
         name: 'packed-package-manifest',
         validatePostBuild(ctx) {
-            return validatePackedPublishablePackageManifest(ctx.root);
+            return validatePackedPublishablePackageManifest(ctx.root, ctx.projects);
         },
     },
     {
         name: 'packed-package-types',
         validatePostBuild(ctx) {
-            return validatePackedPublishablePackageTypes(ctx.root);
+            return validatePackedPublishablePackageTypes(ctx.root, ctx.projects);
         },
     },
     {
@@ -272,9 +272,10 @@ async function runBuild(ctx, options = {}) {
     if (options.verbose) {
         printCheckHeading('build', true);
     }
+    const args = ['run-many', '-t', 'build', ...(ctx.projects?.length ? ['-p', ctx.projects.join(',')] : [])];
     const result = options.verbose
-        ? { exitCode: await runStatus('nx', ['run-many', '-t', 'build'], ctx.root, false), stdout: '', stderr: '' }
-        : await runResult('nx', ['run-many', '-t', 'build'], ctx.root);
+        ? { exitCode: await runStatus('nx', args, ctx.root, false), stdout: '', stderr: '' }
+        : await runResult('nx', args, ctx.root);
     const status = result.exitCode;
     if (status !== 0) {
         if (!options.verbose) {

package/dist/monorepo/publish-workflow.js

@@ -441,7 +441,11 @@ function yamlLinesForStep(step, options) {
                 'include-hidden-files: true',
             ], 'failure()');
         case PublishWorkflowStepKind.ValidateMonorepoConfig:
-            return conditionalRunStep(step, 'smoo monorepo validate');
+            // Scoped to the release's candidates: the build phase and the packed-package
+            // checks cover what ships. Unscoped, validate compiled every project - on a
+            // release touching no Rust that was 3m30 of the cowshed CLI on the critical
+            // path, for a binary the release did not contain.
+            return conditionalRunStep(step, `smoo monorepo validate --projects "${githubExpression('steps.version.outputs.projects')}"`);
         case PublishWorkflowStepKind.TagRelease:
             return tagReleaseStepLines(step.name);
         case PublishWorkflowStepKind.PublishRelease:

package/managed/raw/tooling/direnv/devenv.smoo.nix

@@ -274,16 +274,16 @@
     # 5. The shared setup-environment.ts bootstraps repository dependencies; a
     #    failure aborts shell entry instead of yielding a half-working shell.
     #    Repo-owned enterShell bodies merge after this prologue.
-    # 6. The declared Nx remote cache (`smoo.remoteCache`), if the repository
-    #    has one. secret-references.ts prints the two variables Nx reads — the
-    #    server and the access token — and prints nothing at all unless the
-    #    declared token has a value, because Nx accepts only 200 or 404 from a
-    #    cache server: an unauthenticated one fails every task on 401 instead
-    #    of missing quietly. It is eval-ed into THIS shell because that is
-    #    where Nx runs; the export covers those two variables only, so the rule
-    #    that keeps `smoo.secrets` inside the setup child still holds. An
-    #    inherited server wins, so a CI job env is never overwritten, and a
-    #    missing token costs a stderr line rather than shell entry.
+    # 6. The declared Nx remote cache (`smoo.remoteCache`) is NOT resolved
+    #    here. Shell entry happens on every direnv reload and every
+    #    `devenv shell -- <command>`, and a provider command that runs then is a
+    #    credential prompt on every one of them (1Password authorises per
+    #    requesting process lineage, and this one is new each time). Nx reads
+    #    NX_SELF_HOSTED_REMOTE_CACHE_SERVER and _ACCESS_TOKEN from the
+    #    environment when it runs: CI injects them into the job, a developer
+    #    exports the token once in the terminal that wants the cache (for
+    #    example `op signin`, then the declared command), and every nested
+    #    shell inherits it. Absent, Nx runs with the local cache only.
     # 7. GOROOT is unset rather than set. With devenv's Go pinned to the patch
     #    release ttsc vendors, a GOROOT crossing cannot misfire on version at all,
     #    so this is belt-and-braces rather than the fix — it keeps the isolation
@@ -322,7 +322,12 @@
     #    swaps the SDK a build was compiled against.
     # Nx's fallback includes HOME or TMPDIR, either of which can exceed the
     # Unix socket limit in a checkout. Reuse devenv's short runtime directory,
-    # while preserving an explicit directory supplied by Cowshed or the caller.
+    # which is keyed on this checkout's devenv root and so is one per
+    # workspace. Unconditionally: an inherited value is another workspace's
+    # shell (a shed entered from the host, a second repository from the first,
+    # a subprocess of either), and one socket dir for two workspaces makes the
+    # daemon refuse whichever came second ("received a message from a
+    # different workspace"). Nobody supplies this deliberately.
     (lib.mkBefore ''
       cd "$DEVENV_ROOT/../.."
       export PATH="$("$PWD/tooling/direnv/repo-path")"
@@ -349,8 +354,7 @@
       export GOFLAGS="''${GOFLAGS:--trimpath}"
       unset GOROOT
       bun "$DEVENV_ROOT/setup-environment.ts" || exit $?
-      eval "$(bun "$DEVENV_ROOT/secret-references.ts" "$PWD")"
-      export NX_SOCKET_DIR="''${NX_SOCKET_DIR:-$DEVENV_RUNTIME/nx}"
+      export NX_SOCKET_DIR="$DEVENV_RUNTIME/nx"
       mkdir -p "$NX_SOCKET_DIR"
       ${lib.optionalString pkgs.stdenv.isDarwin ''
         unset CC CXX

package/managed/raw/tooling/direnv/secret-references.ts

@@ -1,16 +1,14 @@
 /**
- * Provider-neutral local secret resolution for smoo-managed repositories, and
- * the developer-shell half of the declared Nx remote cache.
+ * Provider-neutral local secret resolution for smoo-managed repositories.
  *
  * Reads the root package.json `smoo.secrets` map and `smoo.remoteCache` block
  * — the bootstrap twins of `PackageSecretCommand`, `PackageSmooConfig.secrets`
  * and `PackageRemoteCacheConfig` in packages/cli/src/lib/json.ts. This file is
  * a managed raw script: it runs from `tooling/direnv/setup-environment.ts`
- * BEFORE `bun install`, and from the managed devenv `enterShell` before that,
- * when no workspace package and no Typia transform exist yet, so both shapes
- * are hand-validated here against exactly what json.ts declares. Keep them
- * aligned; smoo's Typia validation fails the manifest at generation time for
- * anything this file would reject at runtime.
+ * BEFORE `bun install`, when no workspace package and no Typia transform exist
+ * yet, so both shapes are hand-validated here against exactly what json.ts
+ * declares. Keep them aligned; smoo's Typia validation fails the manifest at
+ * generation time for anything this file would reject at runtime.
  *
  * Routing per declared variable, in first-match order:
  *
@@ -29,22 +27,14 @@
  * Error text names variables and exit codes only: secret values, provider
  * stdout/stderr, and command arguments are never echoed.
  *
- * One declared variable is exempt from blocking an install: the one
- * `smoo.remoteCache.tokenSecret` names. A remote cache is an optimization, so
- * an unreachable secret provider must not keep dependencies from installing or
- * a shell from opening; that variable is resolved by the cache export below,
- * where failure costs a stderr line.
- *
- * Run as a program (`bun secret-references.ts [root]`), the script prints the
- * remote cache's `export` lines for the shell to `eval` and nothing else: Nx
- * runs in the developer's shell, not in the setup child, and the export is
- * limited to those two variables so `smoo.secrets` stays process-local. It
- * prints nothing when the repository declares no cache, when the shell already
- * carries a server (a CI job env is never overwritten), or when the declared
- * token has no value — Nx accepts only 200 or 404 from a cache server, so a
- * server it cannot authenticate to fails every task instead of missing. Why
- * the cache is off is said on stderr; the exit status stays 0, because a
- * missing cache credential must never keep a shell from opening.
+ * The variable `smoo.remoteCache.tokenSecret` names is never resolved here,
+ * nor anywhere at shell entry. A remote cache is an optimization, and shell
+ * entry happens on every direnv reload and every `devenv shell -- <command>`:
+ * a provider command run there is a credential prompt on each of them. Nx
+ * reads NX_SELF_HOSTED_REMOTE_CACHE_SERVER and _ACCESS_TOKEN from the
+ * environment it runs in — CI injects them, a developer exports the token
+ * once in the terminal that wants the cache — and every nested shell inherits
+ * them. Absent, Nx keeps to its local cache.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -135,10 +125,6 @@ function parseSecretSpec(name: string, spec: unknown): SecretSpec {
   return { command: [first, ...rest] };
 }
 
-/** The two variables Nx reads for its self-hosted HTTP cache. */
-const REMOTE_CACHE_SERVER = 'NX_SELF_HOSTED_REMOTE_CACHE_SERVER';
-const REMOTE_CACHE_ACCESS_TOKEN = 'NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN';
-
 /**
  * The declared remote cache as a local shell needs it. `internalServer` is
  * deliberately absent: it is the address a managed runner reaches inside its
@@ -353,85 +339,6 @@ export async function resolveSecretEnvironment(
   });
 }
 
-/**
- * What the shell should do about the declared remote cache. Each case is a
- * value, not an exception: three of the four are ordinary, and only one is
- * worth saying out loud.
- */
-export type RemoteCacheOutcome =
-  | { readonly kind: 'undeclared' }
-  | { readonly kind: 'inherited' }
-  | { readonly kind: 'unavailable'; readonly reason: string }
-  | { readonly kind: 'exported'; readonly env: Readonly<Record<string, string>> };
-
-/**
- * The remote cache variables this shell should export, or why it exports none.
- * An inherited server always wins, so a CI job env — which carries the address
- * its own runners reach — is never overwritten by the public one. The token is
- * taken from the environment when it is there, and otherwise from the one
- * `smoo.secrets` entry that declares it — resolving that single variable, so
- * no other declared secret ever reaches the shell. A repository that declares
- * the cache token as a provider secret therefore pays that one command twice
- * per shell entry, once here and once in the setup child's own aggregate
- * resolution; an ambient token pays nothing.
- */
-export async function resolveRemoteCacheOutcome(options: SecretResolutionOptions): Promise<RemoteCacheOutcome> {
-  const env = options.env ?? process.env;
-  const packageJson = readPackageJson(options.root);
-  const spec = parseSmooRemoteCache(packageJson);
-  if (spec === null) {
-    return { kind: 'undeclared' };
-  }
-  if (isNonemptyEnvValue(env[REMOTE_CACHE_SERVER])) {
-    return { kind: 'inherited' };
-  }
-  const ambient = env[spec.tokenSecret];
-  if (isNonemptyEnvValue(ambient)) {
-    return {
-      kind: 'exported',
-      env: { [REMOTE_CACHE_SERVER]: spec.server, [REMOTE_CACHE_ACCESS_TOKEN]: ambient },
-    };
-  }
-  const declared = parseSmooSecrets(packageJson)[spec.tokenSecret];
-  if (declared === undefined) {
-    return {
-      kind: 'unavailable',
-      reason: `${spec.tokenSecret} is unset and no smoo.secrets entry declares it, so ${spec.server} would be asked for cache entries with no credential`,
-    };
-  }
-  // A cache token is not registry routing, so the cowshed `.npmrc` exclusion
-  // cannot apply to it; every other rule in the header does.
-  const outcome = await routeSecret(spec.tokenSecret, declared, {
-    env,
-    registryIntentEnvs: new Set(),
-    run: options.runCommand ?? runSecretCommand,
-  });
-  switch (outcome.kind) {
-    case 'resolved':
-      return {
-        kind: 'exported',
-        env: { [REMOTE_CACHE_SERVER]: spec.server, [REMOTE_CACHE_ACCESS_TOKEN]: outcome.value },
-      };
-    case 'failed':
-      return { kind: 'unavailable', reason: `${spec.tokenSecret}: ${outcome.guidance}` };
-    case 'env-wins':
-      // Only reachable if an ambient value appeared between the check above
-      // and this call; the export happens on the next shell entry.
-      return { kind: 'unavailable', reason: `${spec.tokenSecret} was set after it was read` };
-  }
-}
-
-/**
- * POSIX `export` lines for a shell to `eval`. Single quotes are the only
- * quoting a value cannot escape from, so each value is single-quoted with its
- * own quotes spliced out — a token is opaque bytes, never assumed shell-safe.
- */
-export function shellExportLines(env: Readonly<Record<string, string>>): string {
-  return Object.entries(env)
-    .map(([name, value]) => `export ${name}='${value.replaceAll("'", "'\\''")}'\n`)
-    .join('');
-}
-
 function readPackageJson(root: string): unknown {
   const packageJsonPath = join(root, 'package.json');
   let text: string;
@@ -452,27 +359,8 @@ function readPackageJson(root: string): unknown {
   }
   return parsed;
 }
-
 function readNpmrcText(root: string): string | null {
   const npmrcPath = join(root, '.npmrc');
   if (!existsSync(npmrcPath)) return null;
   return readFileSync(npmrcPath, 'utf8');
 }
-
-// Program mode, run by the managed devenv shell as
-// `eval "$(bun "$DEVENV_ROOT/secret-references.ts" "$PWD")"`. stdout is
-// therefore shell text and carries nothing else; everything a human should
-// read goes to stderr, and the status stays 0 so a shell always opens.
-if (import.meta.main) {
-  const root = Bun.argv[2] ?? process.cwd();
-  try {
-    const outcome = await resolveRemoteCacheOutcome({ root });
-    if (outcome.kind === 'exported') {
-      process.stdout.write(shellExportLines(outcome.env));
-    } else if (outcome.kind === 'unavailable') {
-      console.error(`smoo: Nx remote cache off — ${outcome.reason}`);
-    }
-  } catch (error) {
-    console.error(`smoo: Nx remote cache off — ${error instanceof Error ? error.message : String(error)}`);
-  }
-}

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -109,6 +109,11 @@ runs:
     # stable path (a symlink would not do: Nix canonicalises) and devenv is
     # evaluated from there; every later step still runs in the checkout, which
     # is the same tree. DEVENV_WORKDIR names the path the devenv steps use.
+    # The mount target is the instance's own /work, not the shared bind: only
+    # the path's spelling must be stable, and a bind onto the idmapped cache
+    # dataset failed inside the job (move_mount: ENOENT) where a container-fs
+    # target does not. If the mount is refused the job goes on from the
+    # checkout and pays the evaluation: this is an optimisation, never a gate.
     - name: 📂 Locate devenv state on the shared bind
       if: steps.runner-kind.outputs.host == 'true'
       shell: bash
@@ -119,13 +124,19 @@ runs:
       run: |
         lane=$(printf '%s' "$DEVENV_STATE_LANE" | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z0-9._-' '-')
         root="/var/cache/ci/devenv/$DEVENV_STATE_REPO/${lane:-default}/$DEVENV_STATE_JOB"
-        mkdir -p "$root/.devenv" "$root/.direnv" "$root/workspace"
-        sudo mount --bind "$GITHUB_WORKSPACE" "$root/workspace"
+        mkdir -p "$root/.devenv" "$root/.direnv"
         rm -rf tooling/direnv/.devenv tooling/direnv/.direnv
         ln -s "$root/.devenv" tooling/direnv/.devenv
         ln -s "$root/.direnv" tooling/direnv/.direnv
-        echo "DEVENV_WORKDIR=$root/workspace" >> "$GITHUB_ENV"
-        echo "devenv state: $root (workspace bind-mounted at $root/workspace)"
+        stable="/work/$DEVENV_STATE_REPO/${lane:-default}/$DEVENV_STATE_JOB"
+        if mkdir -p "$stable" && sudo mount --bind "$GITHUB_WORKSPACE" "$stable"; then
+          echo "DEVENV_WORKDIR=$stable" >> "$GITHUB_ENV"
+          echo "devenv state: $root (workspace bind-mounted at $stable)"
+        else
+          echo "DEVENV_WORKDIR=$GITHUB_WORKSPACE" >> "$GITHUB_ENV"
+          echo "::warning::stable devenv path unavailable (bind mount refused); evaluating from the checkout"
+          echo "devenv state: $root (workspace at $GITHUB_WORKSPACE)"
+        fi
 
     - name: 📂 Devenv runs in the checkout
       if: steps.runner-kind.outputs.host != 'true'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.13",
+  "version": "0.11.14",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.7",
+    "@smoothbricks/nx-plugin": "0.4.8",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/cli.ts

@@ -89,15 +89,24 @@ function buildProgram(): Command {
     .option('--fail-fast', 'stop after the first failing validation pack')
     .option('--only-if-new-workspace-package', 'skip validation unless a new workspace package manifest is staged')
     .option('--verbose', 'print validation progress and successful checks')
+    .option(
+      '--projects <names>',
+      'comma-separated Nx project names to build and pack-validate (a release selection); default: every project',
+    )
     .action(
       async (options: {
         fix?: boolean;
         failFast?: boolean;
         onlyIfNewWorkspacePackage?: boolean;
         verbose?: boolean;
+        projects?: string;
       }) => {
         const { validateMonorepo } = await import('./monorepo/index.js');
-        await validateMonorepo(await findRepoRoot(), options);
+        const projects = options.projects
+          ?.split(',')
+          .map((name) => name.trim())
+          .filter((name) => name.length > 0);
+        await validateMonorepo(await findRepoRoot(), { ...options, projects });
       },
     );
   monorepo.command('update').action(async () => {

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -38,6 +38,9 @@ const codebaseWorkflowOptions: PublishWorkflowDefinitionOptions = {
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
     const rendered = renderPublishWorkflowYaml(codebaseWorkflowOptions);
+    // validate builds and pack-checks the release's candidates, not every project:
+    // unscoped it compiled binaries the release did not contain.
+    expect(rendered).toContain('smoo monorepo validate --projects "${{ steps.version.outputs.projects }}"');
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
       rendered,

package/src/monorepo/index.ts

@@ -47,6 +47,8 @@ export interface ValidateOptions {
   onlyIfNewWorkspacePackage?: boolean;
   fix?: boolean;
   verbose?: boolean;
+  /** Nx project names to build and pack-validate; see MonorepoContext.projects. */
+  projects?: readonly string[];
 }
 
 export interface ValidateCommitMessageOptions {
@@ -85,7 +87,10 @@ export async function validateMonorepo(root: string, options: ValidateOptions =
   if (options.onlyIfNewWorkspacePackage && !(await hasNewWorkspacePackage(root))) {
     return;
   }
-  const result = await runValidatePacks({ root, syncRuntime: false, verbose: options.verbose === true }, options);
+  const result = await runValidatePacks(
+    { root, syncRuntime: false, verbose: options.verbose === true, projects: options.projects },
+    options,
+  );
   if (result.failures > 0) {
     const checkNoun = result.failedChecks === 1 ? 'check' : 'checks';
     const problemNoun = result.failures === 1 ? 'problem' : 'problems';

package/src/monorepo/packed-package.ts

@@ -21,25 +21,40 @@ export async function validatePackedPublishablePackages(root: string): Promise<n
   );
 }
 
-export async function validatePackedPublishablePackagePublint(root: string): Promise<number> {
+/** The publishable packages, narrowed to `projects` (Nx names) when given. */
+function selectedPublishablePackages(root: string, projects?: readonly string[]): PackageInfo[] {
+  const all = listPublishablePackages(root);
+  return projects?.length ? all.filter((pkg) => projects.includes(pkg.projectName)) : all;
+}
+
+export async function validatePackedPublishablePackagePublint(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validatePublint);
   }
   return failures;
 }
 
-export async function validatePackedPublishablePackageManifest(root: string): Promise<number> {
+export async function validatePackedPublishablePackageManifest(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validatePackedManifest);
   }
   return failures;
 }
 
-export async function validatePackedPublishablePackageTypes(root: string): Promise<number> {
+export async function validatePackedPublishablePackageTypes(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validateAttw);
   }
   return failures;

package/src/monorepo/packs/index.ts

@@ -36,6 +36,14 @@ export interface MonorepoContext {
   root: string;
   syncRuntime: boolean;
   verbose?: boolean;
+  /**
+   * Nx project names the validation is about, when a caller knows: the
+   * release's candidates. The build phase and the packed-package packs scope
+   * to them; manifest-level packs still see the whole repository, because a
+   * package's hygiene does not depend on which packages ship today. Absent,
+   * everything is validated and everything is built.
+   */
+  projects?: readonly string[];
 }
 
 export interface ValidatePackOptions {
@@ -174,19 +182,19 @@ const packs: MonorepoPack[] = [
   {
     name: 'packed-package-publint',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackagePublint(ctx.root);
+      return validatePackedPublishablePackagePublint(ctx.root, ctx.projects);
     },
   },
   {
     name: 'packed-package-manifest',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackageManifest(ctx.root);
+      return validatePackedPublishablePackageManifest(ctx.root, ctx.projects);
     },
   },
   {
     name: 'packed-package-types',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackageTypes(ctx.root);
+      return validatePackedPublishablePackageTypes(ctx.root, ctx.projects);
     },
   },
   {
@@ -369,9 +377,10 @@ async function runBuild(ctx: MonorepoContext, options: ValidatePackOptions = {})
   if (options.verbose) {
     printCheckHeading('build', true);
   }
+  const args = ['run-many', '-t', 'build', ...(ctx.projects?.length ? ['-p', ctx.projects.join(',')] : [])];
   const result = options.verbose
-    ? { exitCode: await runStatus('nx', ['run-many', '-t', 'build'], ctx.root, false), stdout: '', stderr: '' }
-    : await runResult('nx', ['run-many', '-t', 'build'], ctx.root);
+    ? { exitCode: await runStatus('nx', args, ctx.root, false), stdout: '', stderr: '' }
+    : await runResult('nx', args, ctx.root);
   const status = result.exitCode;
   if (status !== 0) {
     if (!options.verbose) {

package/src/monorepo/publish-workflow.ts

@@ -614,7 +614,14 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
         'failure()',
       );
     case PublishWorkflowStepKind.ValidateMonorepoConfig:
-      return conditionalRunStep(step, 'smoo monorepo validate');
+      // Scoped to the release's candidates: the build phase and the packed-package
+      // checks cover what ships. Unscoped, validate compiled every project - on a
+      // release touching no Rust that was 3m30 of the cowshed CLI on the critical
+      // path, for a binary the release did not contain.
+      return conditionalRunStep(
+        step,
+        `smoo monorepo validate --projects "${githubExpression('steps.version.outputs.projects')}"`,
+      );
     case PublishWorkflowStepKind.TagRelease:
       return tagReleaseStepLines(step.name);
     case PublishWorkflowStepKind.PublishRelease:

package/src/monorepo/secret-references.test.ts

@@ -387,150 +387,3 @@ describe('resolveSecretEnvironment', () => {
     }
   });
 });
-
-/**
- * The remote cache half is exercised the way the managed shell runs it — the
- * raw script as a program, its stdout `eval`-ed — because that round trip is
- * the contract: shell text on stdout, guidance on stderr, and a status that
- * never keeps a shell from opening.
- */
-describe('remote cache shell export', () => {
-  const SERVER = 'https://nx-cache.example.net';
-
-  async function exportFor(root: string, env: Record<string, string>): Promise<{ stdout: string; stderr: string }> {
-    const proc = Bun.spawn({
-      cmd: ['bun', RAW_RESOLVER, root],
-      env: { PATH: process.env['PATH'], HOME: process.env['HOME'], ...env },
-      stdin: 'ignore',
-      stdout: 'pipe',
-      stderr: 'pipe',
-    });
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited,
-    ]);
-    // A cache is an optimization: nothing it does may fail shell entry.
-    expect(exitCode).toBe(0);
-    return { stdout, stderr };
-  }
-
-  /** The value a shell ends up with after eval-ing the script's output. */
-  async function evaluated(root: string, env: Record<string, string>, name: string): Promise<string> {
-    const { stdout } = await exportFor(root, env);
-    const shell = Bun.spawnSync({
-      cmd: ['sh', '-c', `${stdout}printf %s "\${${name}:-}"`],
-      env: { PATH: process.env['PATH'] ?? '/usr/bin:/bin' },
-    });
-    expect(shell.exitCode).toBe(0);
-    return shell.stdout.toString();
-  }
-
-  it('exports the pair from an ambient token and nothing from an absent declaration', async () => {
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        expect((await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' })).stdout).toBe(
-          `export NX_SELF_HOSTED_REMOTE_CACHE_SERVER='${SERVER}'\nexport NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN='ambient-token'\n`,
-        );
-      },
-    );
-    await withFixture({ secrets: {} }, async (root) => {
-      expect(await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' })).toEqual({ stdout: '', stderr: '' });
-    });
-  });
-
-  it('exports nothing and names the variable when the token has no value', async () => {
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        const { stdout, stderr } = await exportFor(root, {});
-        // Half a pair is worse than none: Nx enables its cache on the server
-        // alone and then fails every task on 401.
-        expect(stdout).toBe('');
-        expect(stderr).toContain('NX_REMOTE_CACHE_TOKEN');
-        expect(stderr).toContain(SERVER);
-      },
-    );
-  });
-
-  it('reports a broken provider as a lost cache, never as a failed install', async () => {
-    await withFixture(
-      {
-        secrets: { NX_REMOTE_CACHE_TOKEN: { command: ['definitely-not-a-real-smoo-binary-xyz'] } },
-        remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      },
-      async (root) => {
-        const { stdout, stderr } = await exportFor(root, {});
-        expect(stdout).toBe('');
-        expect(stderr).toContain('NX_REMOTE_CACHE_TOKEN');
-        expect(stderr).toContain('remote cache off');
-        // Nothing here stopped an install, and the message may not say it did.
-        expect(stderr).not.toContain('dependencies were not installed');
-      },
-    );
-  });
-
-  it('leaves a server the environment already carries alone', async () => {
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        // A CI job env names the address its own runners reach; the public
-        // origin must not replace it.
-        expect(
-          await exportFor(root, {
-            NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'http://10.89.0.1:8765',
-            NX_REMOTE_CACHE_TOKEN: 'ambient-token',
-          }),
-        ).toEqual({ stdout: '', stderr: '' });
-      },
-    );
-  });
-
-  it('resolves a provider-declared token, and only that one secret', async () => {
-    await withFixture(
-      {
-        secrets: {
-          NX_REMOTE_CACHE_TOKEN: { command: emit('provider-token') },
-          SMOO_OTHER: { command: ['definitely-not-a-real-smoo-binary-xyz'] },
-        },
-        remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      },
-      async (root) => {
-        // The unrunnable sibling proves no other declared secret is resolved
-        // here, and that none of them reaches the shell.
-        const { stdout } = await exportFor(root, {});
-        expect(stdout).toContain("export NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN='provider-token'");
-        expect(stdout).not.toContain('SMOO_OTHER');
-      },
-    );
-  });
-
-  it('survives eval with a token full of shell metacharacters', async () => {
-    const hostile = `it's $(touch /tmp/smoo-cache-pwned) \`x\` "q" \\`;
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        expect(
-          await evaluated(root, { NX_REMOTE_CACHE_TOKEN: hostile }, 'NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN'),
-        ).toBe(hostile);
-      },
-    );
-  });
-
-  it('refuses a declaration Nx could not use, naming the field', async () => {
-    for (const remoteCache of [
-      { server: `${SERVER}/`, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      { server: '', tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      { server: SERVER, tokenSecret: 'has-dash' },
-      { server: SERVER },
-      'https://nx-cache.example.net',
-    ]) {
-      await withFixture({ secrets: {}, remoteCache }, async (root) => {
-        const { stdout, stderr } = await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' });
-        expect(stdout).toBe('');
-        expect(stderr).toContain('smoo.remoteCache');
-      });
-    }
-  });
-});