@smoothbricks/cli 0.11.14 → 0.11.16

package/dist/release/github-release.d.ts

@@ -45,6 +45,22 @@ export declare function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previous
 export declare function projectChangelogContents(result: ProjectChangelogLookupResult, projectName: string): string;
 export declare function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean;
 export declare function githubReleaseCommandArgs(tag: string, notesFile: string, releaseExists: boolean, version: string): string[];
+/**
+ * A module of the WORKSPACE's Nx, not of smoo's own dependency. smoo installs
+ * with its own `nx` in the global virtual store, where the workspace's
+ * node_modules is invisible: that Nx cannot resolve the workspace's
+ * `versionActions` plugin (`Unable to resolve the "versionActions"
+ * implementation ... "@smoothbricks/nx-plugin/version-actions"`), and it is
+ * a second Nx version driving one release. Every in-process Nx call for a
+ * workspace resolves from that workspace's root, exactly as `nx` on its PATH
+ * would.
+ */
+interface WorkspaceNxModules {
+    'src/utils/workspace-root.js': typeof import('nx/src/utils/workspace-root.js');
+    'src/command-line/release/version.js': typeof import('nx/src/command-line/release/version.js');
+    'src/command-line/release/changelog.js': typeof import('nx/src/command-line/release/changelog.js');
+}
+export declare function importWorkspaceNx<Subpath extends keyof WorkspaceNxModules>(root: string, subpath: Subpath): Promise<WorkspaceNxModules[Subpath]>;
 export declare function withNxWorkspaceRoot<T>(root: string, run: () => Promise<T>): Promise<T>;
 export {};
 //# sourceMappingURL=github-release.d.ts.map

package/dist/release/github-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-release.d.ts","sourceRoot":"","sources":["../../src/release/github-release.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,WAAW,CAAC;AAYhE,UAAU,4BAA4B;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5G;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAc1G;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAM1G;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShH;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAgBV;AAMD,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAmB5F"}
+{"version":3,"file":"github-release.d.ts","sourceRoot":"","sources":["../../src/release/github-release.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,WAAW,CAAC;AAYhE,UAAU,4BAA4B;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5G;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAc1G;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAM1G;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShH;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAgBV;AAMD;;;;;;;;;GASG;AACH,UAAU,kBAAkB;IAC1B,6BAA6B,EAAE,cAAc,gCAAgC,CAAC,CAAC;IAC/E,qCAAqC,EAAE,cAAc,wCAAwC,CAAC,CAAC;IAC/F,uCAAuC,EAAE,cAAc,0CAA0C,CAAC,CAAC;CACpG;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,MAAM,kBAAkB,EAC9E,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAMtC;AAED,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAmB5F"}

package/dist/release/github-release.js

@@ -1,6 +1,8 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { releaseTag } from './core.js';
 const nxRenderOnlyReleaseConfig = {
     changelog: {
@@ -13,7 +15,7 @@ const nxRenderOnlyReleaseConfig = {
 };
 export async function renderNxProjectChangelogContents(input) {
     return withNxWorkspaceRoot(input.root, async () => {
-        const { createAPI } = await import('nx/src/command-line/release/changelog.js');
+        const { createAPI } = await importWorkspaceNx(input.root, 'src/command-line/release/changelog.js');
         const result = await createAPI(nxRenderOnlyReleaseConfig, false)(nxProjectChangelogArgs(input.pkg, input.previousTag, input.dryRun));
         return projectChangelogContents(result, input.pkg.projectName);
     });
@@ -84,8 +86,15 @@ export function githubReleaseCommandArgs(tag, notesFile, releaseExists, version)
 function isPrereleaseVersion(version) {
     return version.includes('-');
 }
+export async function importWorkspaceNx(root, subpath) {
+    const resolved = createRequire(join(root, 'package.json')).resolve(`nx/${subpath}`);
+    // A dynamic specifier types as `any`; the map above is the declared shape of
+    // the module the workspace's Nx serves at that subpath.
+    const module = await import(pathToFileURL(resolved).href);
+    return module;
+}
 export async function withNxWorkspaceRoot(root, run) {
-    const workspaceRootModule = await import('nx/src/utils/workspace-root.js');
+    const workspaceRootModule = await importWorkspaceNx(root, 'src/utils/workspace-root.js');
     const previousWorkspaceRoot = workspaceRootModule.workspaceRoot;
     const previousEnvWorkspaceRoot = process.env.NX_WORKSPACE_ROOT_PATH;
     const previousCwd = process.cwd();

package/dist/release/index.d.ts

@@ -1,5 +1,5 @@
 export { assertPackedArtifact, type ReleasePackManifest, type ReleasePackOptions, type ReleasePackPackageEntry, releasePack, resolvePackClosure, } from './pack.js';
-export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, type NpmStatusOptions, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, type PrivateNpmRegistry, type PrivateNpmRegistryConfigError, type PrivateNpmRegistryConfigErrorKind, type PublishDestination, privateNpmPublishArgs, privateNpmUserconfigContent, publishPrivateWithDiagnostics, type Result as PrivateNpmResult, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, type NpmStatusOptions, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, type PrivateNpmRegistry, type PrivateNpmRegistryConfigError, type PrivateNpmRegistryConfigErrorKind, type PublishDestination, privateNpmPublishArgs, privateNpmTokenEnvForMode, privateNpmUserconfigContent, publishPrivateWithDiagnostics, type Result as PrivateNpmResult, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
 import { type BootstrapNpmPackagesOptions } from './bootstrap-npm-packages.js';
 import { type ReleasePackageInfo } from './core.js';
 export interface ReleaseVersionOptions {

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AA+CnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAuUD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAmgCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAiDnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AA8UD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAkhCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}

package/dist/release/index.js

@@ -15,18 +15,19 @@ import { parseNxJsonText, parseNxProjectJsonText, parsePackageJsonText, } from '
 import { decode, run, runInteractiveStatus, runResult, runText } from '../lib/run.js';
 import { getWorkspacePackages, listPublicReleasePackages, listReleasePackages, readPackageJson, repositoryInfo, } from '../lib/workspace.js';
 export { assertPackedArtifact, releasePack, resolvePackClosure, } from './pack.js';
-export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmUserconfigContent, publishPrivateWithDiagnostics, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmTokenEnvForMode, privateNpmUserconfigContent, publishPrivateWithDiagnostics, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { ciApiContext } from '../github-ci/api.js';
 import { readProjectTargets } from '../nx/index.js';
 import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
 import { resolveBuildInputPatterns } from './build-inputs.js';
 import { parseReleaseProjectSelection, releaseCandidatePackages, } from './candidates.js';
 import { classifyReleaseBranchPush, collectOwnedReleaseTagRecords, divergedReleaseBranchMessage, pendingReleaseTargets, releaseTag, releaseTagAliases, } from './core.js';
-import { createOrUpdateGithubRelease, githubReleaseLookupExists, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
+import { createOrUpdateGithubRelease, githubReleaseLookupExists, importWorkspaceNx, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import { bumpStableReleaseToNext, collectRepairPlatformOutputs, completeReleaseAtHead as completeReleaseAtHeadWithShell, prepareReleaseCandidate, repairPendingTargets, runReleaseTag, runReleaseVersion, } from './orchestration.js';
 import { packReleaseTarball } from './pack.js';
-import { assertPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, publishPrivateWithDiagnostics, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+import { assertPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmTokenEnvForMode, publishPrivateWithDiagnostics, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
 import { retagUnpublished } from './retag-unpublished.js';
 import { forgejoAuthHeaders, forgejoReleaseLookupExists, resolveSourceReleaseEndpoint, resolveSourceRepository, sourceReleaseTokenEnvNames, sourceReleaseUrl, } from './source-release.js';
 export async function releaseVersion(root, options) {
@@ -426,7 +427,12 @@ async function publishPrivatePackedPackage(root, pkg, tag, dryRun, registry) {
         }
         await withPrivateNpmUserconfig(registry, 'publish', async (userconfig) => {
             await publishPrivateWithDiagnostics(pkg, {
-                publish: () => runNpm(root, args, { NPM_CONFIG_USERCONFIG: userconfig }),
+                publish: () => runNpm(root, args, {
+                    NPM_CONFIG_USERCONFIG: userconfig,
+                    // Env config outranks a committed project `.npmrc` auth line; see
+                    // npmStatusEnv in private-npm.ts for why that matters here.
+                    [`npm_config_${registry.authKey}`]: process.env[privateNpmTokenEnvForMode(registry, 'publish')] ?? '',
+                }),
                 // The open publish userconfig already authenticates this registry,
                 // so the failure probe reuses it. Opening a second read-mode
                 // userconfig here demanded a read credential the publishing job need
@@ -435,6 +441,7 @@ async function publishPrivatePackedPackage(root, pkg, tag, dryRun, registry) {
                 versionExists: () => npmPublishedVersionExistsOnRegistry(root, pkg.name, pkg.version, {
                     registry: registry.registry,
                     userconfig,
+                    credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'publish') },
                 }),
                 log: (message) => console.log(message),
                 error: (message) => console.error(message),
@@ -520,8 +527,8 @@ async function runNxReleaseVersion(root, projects, bump, dryRun) {
 }
 async function runNxReleaseVersionPreview(root, projects, bump) {
     return withNxWorkspaceRoot(root, async () => {
-        const { createAPI } = await import('nx/src/command-line/release/version.js');
-        const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+        const { createAPI } = await importWorkspaceNx(root, 'src/command-line/release/version.js');
+        const { createAPI: createChangelogAPI } = await importWorkspaceNx(root, 'src/command-line/release/changelog.js');
         const projectNames = projects.split(',').filter(Boolean);
         const result = await createAPI({}, false)({
             specifier: bump === 'auto' ? undefined : bump,
@@ -782,6 +789,17 @@ function releaseRepairShell(root, platformOutputs) {
             const sourceSha = await gitHead(root);
             const outputs = platformOutputs.map((base) => join(base, sourceSha));
             if (outputs.length === 0) {
+                // No producer job handed outputs over, so this runner is the producer:
+                // build the platform legs at the checked-out ref. `build` alone gives a
+                // package only the legs its own graph depends on — the host one and
+                // whatever it declares — and the release gate demands the whole declared
+                // native closure, so a foreign leg it never asked for was simply absent.
+                console.log('Repair pending releases: building cross-platform outputs on this runner.');
+                await githubCiNxRunMany(root, {
+                    targets: PLATFORM_TARGET_GLOBS.join(','),
+                    projects: releasePackageProjects(packages),
+                    allowEmptyProjects: true,
+                });
                 return;
             }
             console.log(`Repair pending releases: applying cross-platform outputs from ${outputs.join(', ')}.`);
@@ -1366,7 +1384,11 @@ async function npmVersionExists(root, name, version) {
         assertPublicStatusAllowed(root, name);
         return npmPublishedVersionExistsOnRegistry(root, name, version);
     }
-    return withPrivateNpmUserconfig(registry, 'read', (userconfig) => npmPublishedVersionExistsOnRegistry(root, name, version, { registry: registry.registry, userconfig }));
+    return withPrivateNpmUserconfig(registry, 'read', (userconfig) => npmPublishedVersionExistsOnRegistry(root, name, version, {
+        registry: registry.registry,
+        userconfig,
+        credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'read') },
+    }));
 }
 async function npmPackageExists(root, name) {
     const registry = selectRegistryForPackage(root, name);

package/dist/release/private-npm.d.ts

@@ -103,6 +103,11 @@ export declare function withPrivateNpmUserconfig<T>(resolved: PrivateNpmRegistry
 export interface NpmStatusOptions {
     registry?: string;
     userconfig?: string;
+    /** Path-scoped auth key and token env, so the credential can ride env config. */
+    credential?: {
+        authKey: string;
+        tokenEnv: string;
+    };
 }
 /**
  * Failure-aware registry status: only a genuine not-found result means absent.

package/dist/release/private-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-npm.d.ts","sourceRoot":"","sources":["../../src/release/private-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAGL,KAAK,WAAW,EAIjB,MAAM,qBAAqB,CAAC;AAE7B,uEAAuE;AACvE,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,iCAAiC,GACzC,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,CAAC;AAEpB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,iCAAiC,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAMhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAwFtE;AAoFD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAqBjG;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAO9F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,6BAA6B,GAAG,IAAI,CAiBtC;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKhH;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,GAAG,MAAM,CAAC,GAC3D,kBAAkB,CAapB;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACpC,MAAM,CAMR;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUxG;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAWD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAanH;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAE1G;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,GAAG,SAAS,CAAC,EAChE,KAAK,EAAE,gCAAgC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAuCf"}
+{"version":3,"file":"private-npm.d.ts","sourceRoot":"","sources":["../../src/release/private-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAGL,KAAK,WAAW,EAIjB,MAAM,qBAAqB,CAAC;AAE7B,uEAAuE;AACvE,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,iCAAiC,GACzC,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,CAAC;AAEpB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,iCAAiC,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAMhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAwFtE;AAoFD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CA0BjG;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAO9F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,6BAA6B,GAAG,IAAI,CAiBtC;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKhH;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,GAAG,MAAM,CAAC,GAC3D,kBAAkB,CAapB;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACpC,MAAM,CAMR;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUxG;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AA6BD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAanH;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAE1G;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,GAAG,SAAS,CAAC,EAChE,KAAK,EAAE,gCAAgC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAuCf"}

package/dist/release/private-npm.js

@@ -179,7 +179,12 @@ export function resolvePrivateNpmWorkflowConfig(root) {
         return undefined;
     }
     const npmrcEnv = npmrcAuthTokenEnv(root, declared.scope);
-    const readTokenEnv = consumes ? (declared.readTokenEnv ?? npmrcEnv) : undefined;
+    // A publishing workspace reads the registry too: every release after the
+    // first checks the previous tag's durable state, and that check runs in the
+    // producer jobs that never see the publish credential. A declared read token
+    // therefore always renders; only the .npmrc fallback stays consumer-only, so
+    // a publish token is never promoted into a read role by inference.
+    const readTokenEnv = declared.readTokenEnv ?? (consumes ? npmrcEnv : undefined);
     const publishTokenEnv = publishes ? (declared.publishTokenEnv ?? npmrcEnv) : undefined;
     if (!readTokenEnv && !publishTokenEnv) {
         return undefined;
@@ -312,8 +317,24 @@ export async function withPrivateNpmUserconfig(resolved, mode, fn) {
         await rm(dir, { recursive: true, force: true });
     }
 }
-function npmStatusEnv(userconfig) {
-    return userconfig ? { NPM_CONFIG_USERCONFIG: userconfig } : undefined;
+/**
+ * npm config precedence is cli > env > project `.npmrc` > userconfig. A
+ * repository that commits its own `//host/path:_authToken=${SOME_ENV}` line
+ * therefore OVERRIDES the userconfig this module writes, and when that env is
+ * unset npm sends the unexpanded value: the registry answers 401 on reads with
+ * a perfectly good read credential, naming nothing. So the credential also
+ * rides as env config, which the project file cannot outrank, and the token
+ * value stays out of every file on disk.
+ */
+function npmStatusEnv(userconfig, credential) {
+    if (!userconfig)
+        return undefined;
+    const env = { NPM_CONFIG_USERCONFIG: userconfig };
+    const token = credential ? process.env[credential.tokenEnv] : undefined;
+    if (credential && token) {
+        env[`npm_config_${credential.authKey}`] = token;
+    }
+    return env;
 }
 function npmCommandFailedMessage(npmArgs, exitCode, stdout = '', stderr = '') {
     const detail = `${stdout}\n${stderr}`.trim();
@@ -330,7 +351,7 @@ export async function npmPublishedVersionExists(root, name, version, options = {
     if (options.registry) {
         args.push('--registry', options.registry);
     }
-    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
     if (result.exitCode === 0) {
         return true;
     }
@@ -345,7 +366,7 @@ export async function npmPackageExists(root, name, options = {}) {
     if (options.registry) {
         args.push('--registry', options.registry);
     }
-    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
     if (result.exitCode === 0) {
         return true;
     }

package/managed/raw/tooling/direnv/devenv.smoo.nix

@@ -372,9 +372,11 @@
         esac
       ''}
     '')
-    # Epilogue: the wrapper runs devenv from tooling/direnv, so return the shell
-    # to wherever the caller invoked it. Last, after every project step.
+    # Epilogue, after every project step (a project's own enterShell may resolve
+    # SDKROOT/compilers; the toolchain identity must see the final values). The
+    # stamp logic lives in toolchain-stamp.ts; see its header for why.
     (lib.mkAfter ''
+      bun "$DEVENV_ROOT/toolchain-stamp.ts" || exit $?
       if [ -n "$DEVENV_SHELL_PWD" ]; then
         cd "$DEVENV_SHELL_PWD"
       fi

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -140,14 +140,52 @@ devenv_path_and_caches() {
 }
 
 build_devenv_shell() {
+  local since
+  since="$(date +%s)"
   # One evaluation: the shell that captures the environment is the shell
   # build. A separate `devenv shell -- date` evaluated everything twice.
   persist_devenv_environment
+  # Only the ephemeral-runner path of setup-devenv opts in: the scan walks the
+  # whole store, which on a developer host or a host runner is large and not
+  # ours to root.
+  if [ "${SMOO_ROOT_BUILD_INPUTS:-false}" = true ]; then
+    root_build_inputs "$since"
+  fi
   # Add repo-local tools only after the shell exists; cleanup steps use an
   # explicit PATH because failures before this point must still refresh caches.
   add_repo_paths
 }
 
+# The store cache's post phase collects garbage down to the live roots before
+# it saves, and the shell's own root (.devenv/gc/shell) covers only the build
+# closure. What evaluation fetched and built - flake input sources, the
+# import-from-derivation outputs devenv-nixpkgs-patched and cabal2nix-* - has
+# no root, so it was collected on the miss run and every hit run rebuilt it
+# (measured at ~80s of a 150s setup on hosted macOS, run 34427309827). devenv
+# records no store paths in its eval cache, so the exact set is the paths this
+# build registered: root them under .devenv/gc, which the devenv cache carries
+# and /nix/var/nix/gcroots/auto (inside the store cache) points at.
+root_build_inputs() {
+  local since="$1" gcdir="$PWD/.devenv/gc/build-inputs" paths
+  rm -rf "$gcdir"
+  mkdir -p "$gcdir"
+  # `nix path-info --all --json` is an object keyed by path on Nix >= 2.19 and
+  # an array of {path} objects before that.
+  paths="$(nix path-info --all --json 2>/dev/null | jq -r --argjson since "$since" '
+    (if type == "array" then map({key: .path, value: .}) | from_entries else . end)
+    | to_entries[] | select(.value.registrationTime >= $since) | select(.key | endswith(".drv") | not) | .key')"
+  if [ -z "$paths" ]; then
+    echo "no store paths registered since $since; nothing to root"
+    return 0
+  fi
+  # Store paths are installables; --out-link names the first link and numbers
+  # the rest, each an indirect gc root. Derivations are excluded: keep-derivations
+  # retains the ones whose outputs are rooted, and realising a .drv would build it.
+  # shellcheck disable=SC2086
+  nix build --out-link "$gcdir/path" $paths
+  echo "rooted $(printf '%s\n' "$paths" | wc -l | tr -d ' ') store paths registered during the shell build under $gcdir"
+}
+
 # Workflow steps run their commands directly — never through `devenv shell` —
 # so nothing the shell hooks export survives this composite action on its own.
 # Persisting a hand-picked list here proved to be whack-a-mole: the TTSC

package/managed/raw/tooling/direnv/secret-references.ts

@@ -26,6 +26,9 @@
  * Failures aggregate so a single direnv reload surfaces every problem.
  * Error text names variables and exit codes only: secret values, provider
  * stdout/stderr, and command arguments are never echoed.
+ * A resolved value still reaches the environment of the install its caller
+ * runs next, so `maskSecretValues` redacts those values out of any captured
+ * child output that caller replays.
  *
  * The variable `smoo.remoteCache.tokenSecret` names is never resolved here,
  * nor anywhere at shell entry. A remote cache is an optimization, and shell
@@ -311,6 +314,69 @@ const runSecretCommand: SecretCommandRunner = async (argv) => {
   return stdout;
 };
 
+/** '*', the byte a redacted secret leaves behind. */
+const MASK_BYTE = 0x2a;
+
+/**
+ * A copy of captured child output with every resolved secret value replaced
+ * by the same number of `*` bytes.
+ *
+ * setup-environment.ts puts the values this file resolves into the
+ * environment of the install it then runs, and replays that child's captured
+ * stdout/stderr verbatim when it fails. Whatever the child echoes — a prepare
+ * script printing its environment, a registry URL carrying an inline
+ * credential — would otherwise walk straight past the suppression the rest of
+ * this file maintains. Redaction is byte-exact and same-length, so the
+ * failure being reported stays legible and every offset in it still lines up.
+ * Output with nothing to redact is returned as it came in, so the path that
+ * has no secrets to hide copies nothing.
+ */
+export function maskSecretValues(output: Uint8Array, values: Iterable<string>): Uint8Array {
+  const encoder = new TextEncoder();
+  let masked: Uint8Array | undefined;
+  for (const value of values) {
+    const needle = encoder.encode(value);
+    if (needle.length === 0 || needle.length > output.length) {
+      continue;
+    }
+    for (let from = 0; from + needle.length <= output.length; ) {
+      const at = indexOfBytes(masked ?? output, needle, from);
+      if (at < 0) {
+        break;
+      }
+      // `new Uint8Array`, not `.slice()`: a captured child's output arrives as
+      // a node Buffer, whose `slice` is `subarray` — a view. Masking through
+      // one would rewrite the caller's own captured bytes.
+      masked ??= new Uint8Array(output);
+      masked.fill(MASK_BYTE, at, at + needle.length);
+      from = at + needle.length;
+    }
+  }
+  return masked ?? output;
+}
+
+/** First occurrence of `needle` in `haystack` at or after `from`, or -1. */
+function indexOfBytes(haystack: Uint8Array, needle: Uint8Array, from: number): number {
+  const first = needle[0];
+  if (first === undefined) {
+    return -1;
+  }
+  const last = haystack.length - needle.length;
+  for (let at = haystack.indexOf(first, from); at >= 0 && at <= last; at = haystack.indexOf(first, at + 1)) {
+    let matches = true;
+    for (let offset = 1; offset < needle.length; offset += 1) {
+      if (haystack[at + offset] !== needle[offset]) {
+        matches = false;
+        break;
+      }
+    }
+    if (matches) {
+      return at;
+    }
+  }
+  return -1;
+}
+
 /**
  * The declared secrets an install needs, resolved before it runs. The cache
  * token is deliberately not among them: a remote cache is an optimization, so

package/managed/raw/tooling/direnv/setup-environment.ts

@@ -4,7 +4,7 @@ import { mkdir, rmdir, stat } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { $ } from 'bun';
-import { resolveSecretEnvironment } from './secret-references.ts';
+import { maskSecretValues, resolveSecretEnvironment } from './secret-references.ts';
 
 // DEVENV_ROOT is set by the devenv shell, which is how this script normally
 // runs. CI jobs that install dependencies without building that shell (the
@@ -24,6 +24,14 @@ class CapturedCommandError extends Error {
   }
 }
 
+// Every value resolved out of smoo.secrets below. The install inherits them,
+// so whatever a failing child echoed is redacted before its captured output
+// is replayed. Declared above the first replay site (resolveProjectRoot's own
+// failure) because module consts are not hoisted: a reference from there to a
+// const declared further down would report a temporal-dead-zone error instead
+// of the failure it was called to report.
+const resolvedSecretValues: string[] = [];
+
 async function resolveProjectRoot(): Promise<string> {
   if (devenvRoot) {
     return path.resolve(`${devenvRoot}/../..`);
@@ -66,19 +74,11 @@ const TYPESCRIPT_API_VERSION = '6.0.3';
 process.chdir(projectRoot);
 
 try {
-  // Provider-declared secrets (smoo.secrets) resolve before any install. The
-  // values land in THIS process environment only — bun install, the prepare
-  // scripts it runs, and every later child of this script inherit them (for
-  // example .npmrc `${VAR}` auth); the direnv shell itself does not, which is
-  // the point: this script must never act as a global shell export.
-  for (const [name, value] of Object.entries(await resolveSecretEnvironment({ root: projectRoot }))) {
-    process.env[name] = value;
-  }
-
   // Bootstrap only: install deps + wire local git hooks/config.
   // Do not import workspace packages here — this script is what installs them,
   // and package resolution/Typia transforms are not available yet.
   if (process.env.CI) {
+    await resolveSecrets();
     // Concurrent devenv activations share one node_modules, so the CI
     // installs race exactly like local ones (EEXIST link failures under
     // parallel shells). Serialize them under the same setup lock. Nothing
@@ -118,24 +118,60 @@ try {
       process.exit(1);
     }
   } else {
-    await installLocalDependencies();
+    // A local secret-resolution or install failure (a provider that is not
+    // signed in, an unpublished private package, a missing registry
+    // credential, a lockfile that needs `devenv update`) must not take the
+    // shell down with it: direnv drops the whole environment on a non-zero
+    // exit, and then bun, nx, op and every other tool needed to repair the
+    // install are gone too. Report it, finish what does not depend on the
+    // install, and load the shell. CI above stays strict.
+    const installError = await installLocalDependencies();
+    if (installError === undefined) {
+      // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
+      ensureTypeScriptApiPackage(projectRoot);
+    }
+    await applyWorkspaceGitConfig(projectRoot);
+    if (installError !== undefined) {
+      reportDegradedSetup(installError);
+    }
   }
-
-  // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
-  ensureTypeScriptApiPackage(projectRoot);
-
-  await applyWorkspaceGitConfig(projectRoot);
 } catch (error) {
   reportSetupFailure(error);
 }
 
-async function installLocalDependencies(): Promise<void> {
+/**
+ * Provider-declared secrets (smoo.secrets) resolve before any install. The
+ * values land in THIS process environment only — bun install, the prepare
+ * scripts it runs, and every later child of this script inherit them (for
+ * example .npmrc `${VAR}` auth); the direnv shell itself does not, which is
+ * the point: this script must never act as a global shell export.
+ */
+async function resolveSecrets(): Promise<void> {
+  for (const [name, value] of Object.entries(await resolveSecretEnvironment({ root: projectRoot }))) {
+    process.env[name] = value;
+    resolvedSecretValues.push(value);
+  }
+}
+
+async function installLocalDependencies(): Promise<unknown> {
+  try {
+    await resolveSecrets();
+  } catch (error) {
+    return error;
+  }
   // bun install runs the root prepare script. Multiple concurrent direnv
   // activations can otherwise race while mutating the same files under
-  // node_modules.
+  // node_modules. Nothing that exits the process may run inside the callback
+  // (see the CI branch), so the failure is returned, not thrown.
+  let installError: unknown;
   await withSetupLock(async () => {
-    await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
+    try {
+      await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
+    } catch (error) {
+      installError = error;
+    }
   });
+  return installError;
 }
 
 function ensureTypeScriptApiPackage(root: string): void {
@@ -374,25 +410,44 @@ function isFileExistsError(error: unknown): boolean {
 }
 
 function reportSetupFailure(error: unknown): never {
+  describeFailure('ERROR', error);
+  process.exit(1);
+}
+
+function reportDegradedSetup(error: unknown): void {
+  describeFailure('WARNING', error);
+  console.error(
+    'The shell is loaded WITHOUT installed dependencies so the tools to repair this stay available.\n' +
+      'Fix the cause above (missing registry credential, unpublished package, stale lockfile → `devenv update`),\n' +
+      'then run `bun install` or `direnv reload`.',
+  );
+  console.error('---');
+}
+
+function describeFailure(level: 'ERROR' | 'WARNING', error: unknown): void {
   if (error instanceof CapturedCommandError) {
-    console.error(`--- ERROR: setup-environment.ts failed while running: ${error.command}`);
+    console.error(`--- ${level}: setup-environment.ts failed while running: ${error.command}`);
     console.error(`exit code: ${error.exitCode}`);
   } else {
-    console.error(`--- ERROR: setup-environment.ts failed: ${error}`);
+    console.error(`--- ${level}: setup-environment.ts failed: ${error}`);
   }
   replayCapturedOutput(error);
   console.error('\n---');
-  process.exit(1);
 }
 
 function replayCapturedOutput(error: unknown): void {
   if (!(error instanceof CapturedCommandError)) {
     return;
   }
-  if (error.stdout.length > 0) {
-    process.stdout.write(error.stdout);
+  // The install ran with every resolved secret in its environment, so its
+  // output is redacted before replay. Masking is same-length, which keeps the
+  // failure this replay exists to show intact.
+  const stdout = maskSecretValues(error.stdout, resolvedSecretValues);
+  const stderr = maskSecretValues(error.stderr, resolvedSecretValues);
+  if (stdout.length > 0) {
+    process.stdout.write(stdout);
   }
-  if (error.stderr.length > 0) {
-    process.stderr.write(error.stderr);
+  if (stderr.length > 0) {
+    process.stderr.write(stderr);
   }
 }