@smoothbricks/cli 0.11.14 → 0.11.15

package/dist/release/github-release.d.ts

@@ -45,6 +45,22 @@ export declare function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previous
 export declare function projectChangelogContents(result: ProjectChangelogLookupResult, projectName: string): string;
 export declare function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean;
 export declare function githubReleaseCommandArgs(tag: string, notesFile: string, releaseExists: boolean, version: string): string[];
+/**
+ * A module of the WORKSPACE's Nx, not of smoo's own dependency. smoo installs
+ * with its own `nx` in the global virtual store, where the workspace's
+ * node_modules is invisible: that Nx cannot resolve the workspace's
+ * `versionActions` plugin (`Unable to resolve the "versionActions"
+ * implementation ... "@smoothbricks/nx-plugin/version-actions"`), and it is
+ * a second Nx version driving one release. Every in-process Nx call for a
+ * workspace resolves from that workspace's root, exactly as `nx` on its PATH
+ * would.
+ */
+interface WorkspaceNxModules {
+    'src/utils/workspace-root.js': typeof import('nx/src/utils/workspace-root.js');
+    'src/command-line/release/version.js': typeof import('nx/src/command-line/release/version.js');
+    'src/command-line/release/changelog.js': typeof import('nx/src/command-line/release/changelog.js');
+}
+export declare function importWorkspaceNx<Subpath extends keyof WorkspaceNxModules>(root: string, subpath: Subpath): Promise<WorkspaceNxModules[Subpath]>;
 export declare function withNxWorkspaceRoot<T>(root: string, run: () => Promise<T>): Promise<T>;
 export {};
 //# sourceMappingURL=github-release.d.ts.map

package/dist/release/github-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-release.d.ts","sourceRoot":"","sources":["../../src/release/github-release.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,WAAW,CAAC;AAYhE,UAAU,4BAA4B;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5G;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAc1G;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAM1G;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShH;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAgBV;AAMD,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAmB5F"}
+{"version":3,"file":"github-release.d.ts","sourceRoot":"","sources":["../../src/release/github-release.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,WAAW,CAAC;AAYhE,UAAU,4BAA4B;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5G;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAc1G;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAM1G;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShH;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAgBV;AAMD;;;;;;;;;GASG;AACH,UAAU,kBAAkB;IAC1B,6BAA6B,EAAE,cAAc,gCAAgC,CAAC,CAAC;IAC/E,qCAAqC,EAAE,cAAc,wCAAwC,CAAC,CAAC;IAC/F,uCAAuC,EAAE,cAAc,0CAA0C,CAAC,CAAC;CACpG;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,MAAM,kBAAkB,EAC9E,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAMtC;AAED,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAmB5F"}

package/dist/release/github-release.js

@@ -1,6 +1,8 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { releaseTag } from './core.js';
 const nxRenderOnlyReleaseConfig = {
     changelog: {
@@ -13,7 +15,7 @@ const nxRenderOnlyReleaseConfig = {
 };
 export async function renderNxProjectChangelogContents(input) {
     return withNxWorkspaceRoot(input.root, async () => {
-        const { createAPI } = await import('nx/src/command-line/release/changelog.js');
+        const { createAPI } = await importWorkspaceNx(input.root, 'src/command-line/release/changelog.js');
         const result = await createAPI(nxRenderOnlyReleaseConfig, false)(nxProjectChangelogArgs(input.pkg, input.previousTag, input.dryRun));
         return projectChangelogContents(result, input.pkg.projectName);
     });
@@ -84,8 +86,15 @@ export function githubReleaseCommandArgs(tag, notesFile, releaseExists, version)
 function isPrereleaseVersion(version) {
     return version.includes('-');
 }
+export async function importWorkspaceNx(root, subpath) {
+    const resolved = createRequire(join(root, 'package.json')).resolve(`nx/${subpath}`);
+    // A dynamic specifier types as `any`; the map above is the declared shape of
+    // the module the workspace's Nx serves at that subpath.
+    const module = await import(pathToFileURL(resolved).href);
+    return module;
+}
 export async function withNxWorkspaceRoot(root, run) {
-    const workspaceRootModule = await import('nx/src/utils/workspace-root.js');
+    const workspaceRootModule = await importWorkspaceNx(root, 'src/utils/workspace-root.js');
     const previousWorkspaceRoot = workspaceRootModule.workspaceRoot;
     const previousEnvWorkspaceRoot = process.env.NX_WORKSPACE_ROOT_PATH;
     const previousCwd = process.cwd();

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AA+CnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAuUD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAmgCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAgDnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAuUD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAmgCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}

package/dist/release/index.js

@@ -22,7 +22,7 @@ import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, }
 import { resolveBuildInputPatterns } from './build-inputs.js';
 import { parseReleaseProjectSelection, releaseCandidatePackages, } from './candidates.js';
 import { classifyReleaseBranchPush, collectOwnedReleaseTagRecords, divergedReleaseBranchMessage, pendingReleaseTargets, releaseTag, releaseTagAliases, } from './core.js';
-import { createOrUpdateGithubRelease, githubReleaseLookupExists, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
+import { createOrUpdateGithubRelease, githubReleaseLookupExists, importWorkspaceNx, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import { bumpStableReleaseToNext, collectRepairPlatformOutputs, completeReleaseAtHead as completeReleaseAtHeadWithShell, prepareReleaseCandidate, repairPendingTargets, runReleaseTag, runReleaseVersion, } from './orchestration.js';
 import { packReleaseTarball } from './pack.js';
@@ -520,8 +520,8 @@ async function runNxReleaseVersion(root, projects, bump, dryRun) {
 }
 async function runNxReleaseVersionPreview(root, projects, bump) {
     return withNxWorkspaceRoot(root, async () => {
-        const { createAPI } = await import('nx/src/command-line/release/version.js');
-        const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+        const { createAPI } = await importWorkspaceNx(root, 'src/command-line/release/version.js');
+        const { createAPI: createChangelogAPI } = await importWorkspaceNx(root, 'src/command-line/release/changelog.js');
         const projectNames = projects.split(',').filter(Boolean);
         const result = await createAPI({}, false)({
             specifier: bump === 'auto' ? undefined : bump,

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -140,14 +140,49 @@ devenv_path_and_caches() {
 }
 
 build_devenv_shell() {
+  local since
+  since="$(date +%s)"
   # One evaluation: the shell that captures the environment is the shell
   # build. A separate `devenv shell -- date` evaluated everything twice.
   persist_devenv_environment
+  if [ "${SMOO_HOST_RUNNER:-false}" != true ]; then
+    root_build_inputs "$since"
+  fi
   # Add repo-local tools only after the shell exists; cleanup steps use an
   # explicit PATH because failures before this point must still refresh caches.
   add_repo_paths
 }
 
+# The store cache's post phase collects garbage down to the live roots before
+# it saves, and the shell's own root (.devenv/gc/shell) covers only the build
+# closure. What evaluation fetched and built - flake input sources, the
+# import-from-derivation outputs devenv-nixpkgs-patched and cabal2nix-* - has
+# no root, so it was collected on the miss run and every hit run rebuilt it
+# (measured at ~80s of a 150s setup on hosted macOS, run 34427309827). devenv
+# records no store paths in its eval cache, so the exact set is the paths this
+# build registered: root them under .devenv/gc, which the devenv cache carries
+# and /nix/var/nix/gcroots/auto (inside the store cache) points at.
+root_build_inputs() {
+  local since="$1" gcdir="$PWD/.devenv/gc/build-inputs" paths
+  rm -rf "$gcdir"
+  mkdir -p "$gcdir"
+  # `nix path-info --all --json` is an object keyed by path on Nix >= 2.19 and
+  # an array of {path} objects before that.
+  paths="$(nix path-info --all --json 2>/dev/null | jq -r --argjson since "$since" '
+    (if type == "array" then map({key: .path, value: .}) | from_entries else . end)
+    | to_entries[] | select(.value.registrationTime >= $since) | select(.key | endswith(".drv") | not) | .key')"
+  if [ -z "$paths" ]; then
+    echo "no store paths registered since $since; nothing to root"
+    return 0
+  fi
+  # Store paths are installables; --out-link names the first link and numbers
+  # the rest, each an indirect gc root. Derivations are excluded: keep-derivations
+  # retains the ones whose outputs are rooted, and realising a .drv would build it.
+  # shellcheck disable=SC2086
+  nix build --out-link "$gcdir/path" $paths
+  echo "rooted $(printf '%s\n' "$paths" | wc -l | tr -d ' ') store paths registered during the shell build under $gcdir"
+}
+
 # Workflow steps run their commands directly — never through `devenv shell` —
 # so nothing the shell hooks export survives this composite action on its own.
 # Persisting a hand-picked list here proved to be whack-a-mole: the TTSC

package/managed/raw/tooling/direnv/secret-references.ts

@@ -26,6 +26,9 @@
  * Failures aggregate so a single direnv reload surfaces every problem.
  * Error text names variables and exit codes only: secret values, provider
  * stdout/stderr, and command arguments are never echoed.
+ * A resolved value still reaches the environment of the install its caller
+ * runs next, so `maskSecretValues` redacts those values out of any captured
+ * child output that caller replays.
  *
  * The variable `smoo.remoteCache.tokenSecret` names is never resolved here,
  * nor anywhere at shell entry. A remote cache is an optimization, and shell
@@ -311,6 +314,69 @@ const runSecretCommand: SecretCommandRunner = async (argv) => {
   return stdout;
 };
 
+/** '*', the byte a redacted secret leaves behind. */
+const MASK_BYTE = 0x2a;
+
+/**
+ * A copy of captured child output with every resolved secret value replaced
+ * by the same number of `*` bytes.
+ *
+ * setup-environment.ts puts the values this file resolves into the
+ * environment of the install it then runs, and replays that child's captured
+ * stdout/stderr verbatim when it fails. Whatever the child echoes — a prepare
+ * script printing its environment, a registry URL carrying an inline
+ * credential — would otherwise walk straight past the suppression the rest of
+ * this file maintains. Redaction is byte-exact and same-length, so the
+ * failure being reported stays legible and every offset in it still lines up.
+ * Output with nothing to redact is returned as it came in, so the path that
+ * has no secrets to hide copies nothing.
+ */
+export function maskSecretValues(output: Uint8Array, values: Iterable<string>): Uint8Array {
+  const encoder = new TextEncoder();
+  let masked: Uint8Array | undefined;
+  for (const value of values) {
+    const needle = encoder.encode(value);
+    if (needle.length === 0 || needle.length > output.length) {
+      continue;
+    }
+    for (let from = 0; from + needle.length <= output.length; ) {
+      const at = indexOfBytes(masked ?? output, needle, from);
+      if (at < 0) {
+        break;
+      }
+      // `new Uint8Array`, not `.slice()`: a captured child's output arrives as
+      // a node Buffer, whose `slice` is `subarray` — a view. Masking through
+      // one would rewrite the caller's own captured bytes.
+      masked ??= new Uint8Array(output);
+      masked.fill(MASK_BYTE, at, at + needle.length);
+      from = at + needle.length;
+    }
+  }
+  return masked ?? output;
+}
+
+/** First occurrence of `needle` in `haystack` at or after `from`, or -1. */
+function indexOfBytes(haystack: Uint8Array, needle: Uint8Array, from: number): number {
+  const first = needle[0];
+  if (first === undefined) {
+    return -1;
+  }
+  const last = haystack.length - needle.length;
+  for (let at = haystack.indexOf(first, from); at >= 0 && at <= last; at = haystack.indexOf(first, at + 1)) {
+    let matches = true;
+    for (let offset = 1; offset < needle.length; offset += 1) {
+      if (haystack[at + offset] !== needle[offset]) {
+        matches = false;
+        break;
+      }
+    }
+    if (matches) {
+      return at;
+    }
+  }
+  return -1;
+}
+
 /**
  * The declared secrets an install needs, resolved before it runs. The cache
  * token is deliberately not among them: a remote cache is an optimization, so

package/managed/raw/tooling/direnv/setup-environment.ts

@@ -4,7 +4,7 @@ import { mkdir, rmdir, stat } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { $ } from 'bun';
-import { resolveSecretEnvironment } from './secret-references.ts';
+import { maskSecretValues, resolveSecretEnvironment } from './secret-references.ts';
 
 // DEVENV_ROOT is set by the devenv shell, which is how this script normally
 // runs. CI jobs that install dependencies without building that shell (the
@@ -24,6 +24,14 @@ class CapturedCommandError extends Error {
   }
 }
 
+// Every value resolved out of smoo.secrets below. The install inherits them,
+// so whatever a failing child echoed is redacted before its captured output
+// is replayed. Declared above the first replay site (resolveProjectRoot's own
+// failure) because module consts are not hoisted: a reference from there to a
+// const declared further down would report a temporal-dead-zone error instead
+// of the failure it was called to report.
+const resolvedSecretValues: string[] = [];
+
 async function resolveProjectRoot(): Promise<string> {
   if (devenvRoot) {
     return path.resolve(`${devenvRoot}/../..`);
@@ -66,19 +74,11 @@ const TYPESCRIPT_API_VERSION = '6.0.3';
 process.chdir(projectRoot);
 
 try {
-  // Provider-declared secrets (smoo.secrets) resolve before any install. The
-  // values land in THIS process environment only — bun install, the prepare
-  // scripts it runs, and every later child of this script inherit them (for
-  // example .npmrc `${VAR}` auth); the direnv shell itself does not, which is
-  // the point: this script must never act as a global shell export.
-  for (const [name, value] of Object.entries(await resolveSecretEnvironment({ root: projectRoot }))) {
-    process.env[name] = value;
-  }
-
   // Bootstrap only: install deps + wire local git hooks/config.
   // Do not import workspace packages here — this script is what installs them,
   // and package resolution/Typia transforms are not available yet.
   if (process.env.CI) {
+    await resolveSecrets();
     // Concurrent devenv activations share one node_modules, so the CI
     // installs race exactly like local ones (EEXIST link failures under
     // parallel shells). Serialize them under the same setup lock. Nothing
@@ -118,24 +118,60 @@ try {
       process.exit(1);
     }
   } else {
-    await installLocalDependencies();
+    // A local secret-resolution or install failure (a provider that is not
+    // signed in, an unpublished private package, a missing registry
+    // credential, a lockfile that needs `devenv update`) must not take the
+    // shell down with it: direnv drops the whole environment on a non-zero
+    // exit, and then bun, nx, op and every other tool needed to repair the
+    // install are gone too. Report it, finish what does not depend on the
+    // install, and load the shell. CI above stays strict.
+    const installError = await installLocalDependencies();
+    if (installError === undefined) {
+      // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
+      ensureTypeScriptApiPackage(projectRoot);
+    }
+    await applyWorkspaceGitConfig(projectRoot);
+    if (installError !== undefined) {
+      reportDegradedSetup(installError);
+    }
   }
-
-  // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
-  ensureTypeScriptApiPackage(projectRoot);
-
-  await applyWorkspaceGitConfig(projectRoot);
 } catch (error) {
   reportSetupFailure(error);
 }
 
-async function installLocalDependencies(): Promise<void> {
+/**
+ * Provider-declared secrets (smoo.secrets) resolve before any install. The
+ * values land in THIS process environment only — bun install, the prepare
+ * scripts it runs, and every later child of this script inherit them (for
+ * example .npmrc `${VAR}` auth); the direnv shell itself does not, which is
+ * the point: this script must never act as a global shell export.
+ */
+async function resolveSecrets(): Promise<void> {
+  for (const [name, value] of Object.entries(await resolveSecretEnvironment({ root: projectRoot }))) {
+    process.env[name] = value;
+    resolvedSecretValues.push(value);
+  }
+}
+
+async function installLocalDependencies(): Promise<unknown> {
+  try {
+    await resolveSecrets();
+  } catch (error) {
+    return error;
+  }
   // bun install runs the root prepare script. Multiple concurrent direnv
   // activations can otherwise race while mutating the same files under
-  // node_modules.
+  // node_modules. Nothing that exits the process may run inside the callback
+  // (see the CI branch), so the failure is returned, not thrown.
+  let installError: unknown;
   await withSetupLock(async () => {
-    await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
+    try {
+      await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
+    } catch (error) {
+      installError = error;
+    }
   });
+  return installError;
 }
 
 function ensureTypeScriptApiPackage(root: string): void {
@@ -374,25 +410,44 @@ function isFileExistsError(error: unknown): boolean {
 }
 
 function reportSetupFailure(error: unknown): never {
+  describeFailure('ERROR', error);
+  process.exit(1);
+}
+
+function reportDegradedSetup(error: unknown): void {
+  describeFailure('WARNING', error);
+  console.error(
+    'The shell is loaded WITHOUT installed dependencies so the tools to repair this stay available.\n' +
+      'Fix the cause above (missing registry credential, unpublished package, stale lockfile → `devenv update`),\n' +
+      'then run `bun install` or `direnv reload`.',
+  );
+  console.error('---');
+}
+
+function describeFailure(level: 'ERROR' | 'WARNING', error: unknown): void {
   if (error instanceof CapturedCommandError) {
-    console.error(`--- ERROR: setup-environment.ts failed while running: ${error.command}`);
+    console.error(`--- ${level}: setup-environment.ts failed while running: ${error.command}`);
     console.error(`exit code: ${error.exitCode}`);
   } else {
-    console.error(`--- ERROR: setup-environment.ts failed: ${error}`);
+    console.error(`--- ${level}: setup-environment.ts failed: ${error}`);
   }
   replayCapturedOutput(error);
   console.error('\n---');
-  process.exit(1);
 }
 
 function replayCapturedOutput(error: unknown): void {
   if (!(error instanceof CapturedCommandError)) {
     return;
   }
-  if (error.stdout.length > 0) {
-    process.stdout.write(error.stdout);
+  // The install ran with every resolved secret in its environment, so its
+  // output is redacted before replay. Masking is same-length, which keeps the
+  // failure this replay exists to show intact.
+  const stdout = maskSecretValues(error.stdout, resolvedSecretValues);
+  const stderr = maskSecretValues(error.stderr, resolvedSecretValues);
+  if (stdout.length > 0) {
+    process.stdout.write(stdout);
   }
-  if (error.stderr.length > 0) {
-    process.stderr.write(error.stderr);
+  if (stderr.length > 0) {
+    process.stderr.write(stderr);
   }
 }

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -200,8 +200,8 @@ runs:
           /nix
           ~/.cache/nix
         # prettier-ignore
-        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v5-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
-        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v5-
+        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v6-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
+        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v6-
         gc-max-store-size: 1G
 
     - name: ⚡ Enable Cachix
@@ -236,4 +236,6 @@ runs:
     - name: 🐚 Build devenv shell
       shell: bash
       working-directory: ${{ env.DEVENV_WORKDIR }}/tooling/direnv
+      env:
+        SMOO_HOST_RUNNER: ${{ steps.runner-kind.outputs.host }}
       run: ./github-actions-bootstrap.sh build-shell

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.14",
+  "version": "0.11.15",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.8",
+    "@smoothbricks/nx-plugin": "0.4.9",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/monorepo/secret-references.test.ts

@@ -387,3 +387,71 @@ describe('resolveSecretEnvironment', () => {
     }
   });
 });
+
+/**
+ * Redaction is a byte operation on output the caller already captured, so the
+ * harness carries both directions as base64: a text-only round trip would
+ * hide exactly the invalid-UTF-8 bytes a failing install can emit.
+ */
+const MASK_SCRIPT = `
+const resolver = await import(Bun.argv[1]);
+const { output, values } = JSON.parse(Bun.argv[2]);
+const captured = Buffer.from(output, 'base64');
+const masked = resolver.maskSecretValues(captured, values);
+process.stdout.write(JSON.stringify({
+  masked: Buffer.from(masked).toString('base64'),
+  captured: captured.toString('base64'),
+}));
+`;
+
+describe('maskSecretValues', () => {
+  const mask = async (output: Uint8Array, values: readonly string[]): Promise<{ masked: Buffer; captured: Buffer }> => {
+    const { stdout, stderr, exitCode } = await runInBootstrap(
+      MASK_SCRIPT,
+      JSON.stringify({ output: Buffer.from(output).toString('base64'), values }),
+    );
+    expect(stderr).toBe('');
+    expect(exitCode).toBe(0);
+    const value: unknown = JSON.parse(stdout);
+    if (
+      typeof value !== 'object' ||
+      value === null ||
+      !('masked' in value) ||
+      typeof value.masked !== 'string' ||
+      !('captured' in value) ||
+      typeof value.captured !== 'string'
+    ) {
+      throw new Error(`bootstrap harness returned a malformed envelope: ${stdout}`);
+    }
+    return { masked: Buffer.from(value.masked, 'base64'), captured: Buffer.from(value.captured, 'base64') };
+  };
+
+  it('replaces every occurrence and leaves the surrounding failure legible', async () => {
+    const output = Buffer.from('error: 401 for https://x:hunter2@registry/pkg\nretrying with hunter2\n');
+    const { masked, captured } = await mask(output, ['hunter2']);
+    expect(masked.toString()).toBe('error: 401 for https://x:*******@registry/pkg\nretrying with *******\n');
+    expect(masked.length).toBe(output.length);
+    // The caller keeps its captured bytes: redaction returns a copy, and a
+    // node Buffer's `slice` would have handed back a view of these.
+    expect(captured.toString()).toBe(output.toString());
+  });
+
+  it('redacts each declared value even when one is a prefix of another', async () => {
+    expect((await mask(Buffer.from('AB ABCD AB'), ['ABCD', 'AB'])).masked.toString()).toBe('** **** **');
+  });
+
+  it('survives a false start on the first byte', async () => {
+    expect((await mask(Buffer.from('aab aaab'), ['aab'])).masked.toString()).toBe('*** a***');
+  });
+
+  it('masks whole bytes and carries invalid UTF-8 through untouched', async () => {
+    const output = Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from('kå'), Buffer.from([0x00])]);
+    const { masked } = await mask(output, ['kå']);
+    expect([...masked]).toEqual([0xff, 0xfe, 0x2a, 0x2a, 0x2a, 0x00]);
+  });
+
+  it('leaves output alone when nothing is declared or a value is empty', async () => {
+    expect((await mask(Buffer.from('nothing to hide'), [])).masked.toString()).toBe('nothing to hide');
+    expect((await mask(Buffer.from('nothing to hide'), [''])).masked.toString()).toBe('nothing to hide');
+  });
+});

package/src/release/github-release.ts

@@ -1,6 +1,8 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import type { ChangelogOptions } from 'nx/src/command-line/release/command-object.js';
 import type { NxReleaseConfiguration } from 'nx/src/config/nx-json.js';
 import { type ReleasePackageInfo, releaseTag } from './core.js';
@@ -34,7 +36,7 @@ export interface GithubReleaseWriteShell {
 
 export async function renderNxProjectChangelogContents(input: RenderNxProjectChangelogInput): Promise<string> {
   return withNxWorkspaceRoot(input.root, async () => {
-    const { createAPI } = await import('nx/src/command-line/release/changelog.js');
+    const { createAPI } = await importWorkspaceNx(input.root, 'src/command-line/release/changelog.js');
     const result = await createAPI(
       nxRenderOnlyReleaseConfig,
       false,
@@ -124,8 +126,35 @@ function isPrereleaseVersion(version: string): boolean {
   return version.includes('-');
 }
 
+/**
+ * A module of the WORKSPACE's Nx, not of smoo's own dependency. smoo installs
+ * with its own `nx` in the global virtual store, where the workspace's
+ * node_modules is invisible: that Nx cannot resolve the workspace's
+ * `versionActions` plugin (`Unable to resolve the "versionActions"
+ * implementation ... "@smoothbricks/nx-plugin/version-actions"`), and it is
+ * a second Nx version driving one release. Every in-process Nx call for a
+ * workspace resolves from that workspace's root, exactly as `nx` on its PATH
+ * would.
+ */
+interface WorkspaceNxModules {
+  'src/utils/workspace-root.js': typeof import('nx/src/utils/workspace-root.js');
+  'src/command-line/release/version.js': typeof import('nx/src/command-line/release/version.js');
+  'src/command-line/release/changelog.js': typeof import('nx/src/command-line/release/changelog.js');
+}
+
+export async function importWorkspaceNx<Subpath extends keyof WorkspaceNxModules>(
+  root: string,
+  subpath: Subpath,
+): Promise<WorkspaceNxModules[Subpath]> {
+  const resolved = createRequire(join(root, 'package.json')).resolve(`nx/${subpath}`);
+  // A dynamic specifier types as `any`; the map above is the declared shape of
+  // the module the workspace's Nx serves at that subpath.
+  const module: WorkspaceNxModules[Subpath] = await import(pathToFileURL(resolved).href);
+  return module;
+}
+
 export async function withNxWorkspaceRoot<T>(root: string, run: () => Promise<T>): Promise<T> {
-  const workspaceRootModule = await import('nx/src/utils/workspace-root.js');
+  const workspaceRootModule = await importWorkspaceNx(root, 'src/utils/workspace-root.js');
   const previousWorkspaceRoot = workspaceRootModule.workspaceRoot;
   const previousEnvWorkspaceRoot = process.env.NX_WORKSPACE_ROOT_PATH;
   const previousCwd = process.cwd();

package/src/release/index.ts

@@ -88,6 +88,7 @@ import {
 import {
   createOrUpdateGithubRelease,
   githubReleaseLookupExists,
+  importWorkspaceNx,
   renderNxProjectChangelogContents,
   withNxWorkspaceRoot,
 } from './github-release.js';
@@ -881,8 +882,8 @@ async function runNxReleaseVersion(
 
 async function runNxReleaseVersionPreview(root: string, projects: string, bump: string): Promise<ReleasePackage[]> {
   return withNxWorkspaceRoot(root, async () => {
-    const { createAPI } = await import('nx/src/command-line/release/version.js');
-    const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+    const { createAPI } = await importWorkspaceNx(root, 'src/command-line/release/version.js');
+    const { createAPI: createChangelogAPI } = await importWorkspaceNx(root, 'src/command-line/release/changelog.js');
     const projectNames = projects.split(',').filter(Boolean);
     const result = await createAPI(
       {},