@smoothbricks/cli 0.11.14 → 0.11.16

package/managed/raw/tooling/direnv/toolchain-stamp.ts

@@ -0,0 +1,88 @@
+#!/usr/bin/env bun
+/**
+ * Invalidate cmake build-script caches when the toolchain changes.
+ *
+ * cmake-rs keeps CMAKE_OSX_SYSROOT and the compilers in CMakeCache.txt from
+ * the FIRST configure and only clears a build directory when the source path
+ * moves. Every C/C++ build script's cache under target/ therefore encodes
+ * whichever toolchain the shell had when it was first configured, and it
+ * outlives every later fix to that shell: a nix-store sysroot cached on one
+ * day kept failing `ld: library 'c++' not found` after the shell stopped
+ * exporting it. Nx does not see this state either — it hashes inputs, not
+ * what a cache under target/ remembers.
+ *
+ * Runs at the end of shell entry, after the project's own enterShell resolved
+ * SDKROOT and the compilers. It records the toolchain identity the shell
+ * settled on and, when that identity differs from the recorded one, removes
+ * exactly the cargo build-script directories that hold a CMakeCache.txt, so
+ * cargo re-runs those scripts against the current toolchain. Nothing else
+ * under target/ is touched; a checkout without target/ has nothing to do.
+ */
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { $ } from 'bun';
+
+const root = resolve(`${process.env.DEVENV_ROOT ?? process.cwd()}/../..`);
+const target = join(root, 'target');
+if (existsSync(target)) {
+  const stamp = join(target, '.toolchain-stamp');
+  const identity = await toolchainIdentity();
+  const recorded = existsSync(stamp) ? readFileSync(stamp, 'utf8') : null;
+  if (recorded !== identity) {
+    const removed = removeCmakeBuildScriptDirs(target);
+    if (removed > 0) {
+      console.error(`devenv: toolchain identity changed; removed ${removed} cmake build-script cache(s) under target/`);
+    }
+    writeFileSync(stamp, identity);
+  }
+}
+
+async function toolchainIdentity(): Promise<string> {
+  const rustc = await $`rustc -Vv`.quiet().nothrow().text();
+  const cc = (await $`cc --version`.quiet().nothrow().text()).split('\n')[0] ?? '';
+  return [
+    rustc.trim(),
+    `SDKROOT=${process.env.SDKROOT ?? ''}`,
+    `DEVELOPER_DIR=${process.env.DEVELOPER_DIR ?? ''}`,
+    cc,
+  ].join('\n');
+}
+
+/**
+ * Removes every cargo build-script directory (`…/build/<crate>-<hash>`) whose
+ * `out/build/CMakeCache.txt` exists; returns the count. Only the `build/`
+ * directories cargo creates under a profile are scanned - never the compiled
+ * artifacts beside them - and the scan completes before anything is removed.
+ */
+function removeCmakeBuildScriptDirs(target: string): number {
+  const stale: string[] = [];
+  for (const buildDir of cargoBuildDirs(target, 0)) {
+    for (const entry of readdirSync(buildDir, { withFileTypes: true })) {
+      if (entry.isDirectory() && existsSync(join(buildDir, entry.name, 'out', 'build', 'CMakeCache.txt'))) {
+        stale.push(join(buildDir, entry.name));
+      }
+    }
+  }
+  for (const dir of stale) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  return stale.length;
+}
+
+/** `target/[<lane>/][<triple>/]<profile>/build` - at most four levels below target/. */
+function* cargoBuildDirs(dir: string, depth: number): Generator<string> {
+  if (depth > 4) {
+    return;
+  }
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const path = join(dir, entry.name);
+    if (entry.name === 'build' && depth > 0) {
+      yield path;
+    } else if (entry.name !== 'deps' && entry.name !== 'incremental' && entry.name !== '.fingerprint') {
+      yield* cargoBuildDirs(path, depth + 1);
+    }
+  }
+}

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -200,8 +200,8 @@ runs:
           /nix
           ~/.cache/nix
         # prettier-ignore
-        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v5-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
-        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v5-
+        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v6-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
+        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v6-
         gc-max-store-size: 1G
 
     - name: ⚡ Enable Cachix
@@ -236,4 +236,6 @@ runs:
     - name: 🐚 Build devenv shell
       shell: bash
       working-directory: ${{ env.DEVENV_WORKDIR }}/tooling/direnv
+      env:
+        SMOO_ROOT_BUILD_INPUTS: ${{ steps.runner-kind.outputs.host != 'true' }}
       run: ./github-actions-bootstrap.sh build-shell

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.14",
+  "version": "0.11.16",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.8",
+    "@smoothbricks/nx-plugin": "0.4.10",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/lib/json.ts

@@ -77,6 +77,15 @@ export interface PackageSmooGithub {
     /** Toolchain environment on the Linux foreign-platform producer, such as an SDK path. */
     env?: StringMap;
   };
+  /**
+   * Platform target families the RELEASE workflow must not produce, as target
+   * globs (`*-macos`, `*-ios`, `*-linux`). A repository whose Nx graph carries
+   * a family it does not release from `publish.yml` — because another workflow
+   * owns it, or because the leg is not production yet — names it here, and the
+   * publish workflow renders without that job instead of carrying a leg whose
+   * failure blocks every release.
+   */
+  releasePlatformFamiliesExcluded?: string[];
   /**
    * Sibling source checkouts a repo path-depends on (Cargo path
    * dependencies, nix path inputs). The CI workflow clones each entry beside

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -101,6 +101,60 @@ describe('publish workflow definition', () => {
     expect(rendered).toContain("default: ''");
   });
 
+  it('a private forge release with cross-built Apple targets publishes from one job', () => {
+    const rendered = renderPublishWorkflowYaml({
+      repoName: 'axe.sc/axe',
+      actionsProvider: 'forgejo',
+      runsOn: ['nixos-latest-x64', 'self-hosted'],
+      platformTargetGlobs: ['*-macos', '*-linux'],
+      macosPlatformArchitectures: ['arm64'],
+      platformProducer: { kind: 'linux-cross', preflight: 'sh scripts/prepare-macos-sdk.sh', env: { AXE_CROSS: '1' } },
+      privateNpm: { scope: '@axe.sc', readTokenEnv: 'READ_ENV', publishTokenEnv: 'PUBLISH_ENV' },
+    });
+
+    // One job: no producer job to hand outputs over from, so no transfer at all.
+    const jobsYaml = rendered.slice(rendered.indexOf('jobs:\n') + 'jobs:\n'.length);
+    expect(jobsYaml.match(/^ {2}[a-z][a-z0-9-]*:$/gm)).toEqual(['  publish:']);
+    // The hand-off steps specifically; the failure-only trace-DB upload stays.
+    expect(rendered).not.toContain('Upload validated release state');
+    expect(rendered).not.toContain('Upload validated build outputs');
+    expect(rendered).not.toContain('Upload macOS platform outputs');
+    expect(rendered).not.toContain('Download candidate artifacts');
+    expect(rendered).not.toContain('git bundle');
+    // It still builds the Apple targets, with the producer's toolchain env and
+    // its preflight ahead of setup.
+    expect(rendered).toContain('--targets "*-macos"');
+    expect(rendered).toMatch(/^ {6}AXE_CROSS: ['"]1['"]$/m);
+    expect(rendered).toContain('Check cross-platform toolchain prerequisites');
+    expect(rendered.indexOf('Check cross-platform toolchain prerequisites')).toBeLessThan(
+      rendered.indexOf('Setup Nix/devenv'),
+    );
+  });
+
+  it('keeps the publishing hand-off when provenance needs the hosted runner', () => {
+    const publicWithMac = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: ['*-macos', '*-linux'],
+      macosPlatformArchitectures: ['arm64'],
+      platformProducer: { kind: 'linux-cross', preflight: 'sh prepare.sh' },
+    });
+    const forgePublicWithMac = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      actionsProvider: 'forgejo',
+      runsOn: ['nixos-latest-x64', 'self-hosted'],
+      platformTargetGlobs: ['*-macos', '*-linux'],
+      macosPlatformArchitectures: ['arm64'],
+      platformProducer: { kind: 'linux-cross', preflight: 'sh prepare.sh' },
+    });
+
+    // No private registry declared: packages go to npmjs, which mints
+    // provenance from the publishing job and refuses a self-hosted runner.
+    for (const rendered of [publicWithMac, forgePublicWithMac]) {
+      expect(rendered).toContain('publish-on-linux:');
+      expect(rendered).toContain('Download candidate artifacts');
+    }
+  });
+
   it('preserves the single Ubuntu job and renders no artifact transfer when no Apple targets exist', () => {
     const current = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
     const explicitlyEmpty = renderPublishWorkflowYaml({

package/src/monorepo/managed-files.test.ts

@@ -20,10 +20,12 @@ import {
   managedFileTargetsForTest,
   platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
+  releasePlatformTargetGlobsFor,
   renderManagedWorkflowForTest,
   splitLocalSectionForTest,
   validateDevenvModuleImport,
 } from './managed-files.js';
+import { renderPublishWorkflowYaml } from './publish-workflow.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
 
@@ -457,6 +459,7 @@ const context = (overrides: Partial<ManagedFileContext>): ManagedFileContext =>
   nodeModulesCacheKey: 'key',
   repoName: '@scope/repo',
   platformTargetGlobs: [],
+  releasePlatformTargetGlobs: [],
   macosPlatformArchitectures: [],
   ...overrides,
 });
@@ -565,3 +568,26 @@ describe('CI workflow rendering by repo shape', () => {
     expect(rendered).toContain('GIT_CRYPT_KEY_B64: ${{ secrets.GIT_CRYPT_KEY_B64 }}');
   });
 });
+
+describe('release platform families', () => {
+  it('an excluded family is not produced by the release workflow, and the rest still are', () => {
+    expect(releasePlatformTargetGlobsFor(['*-macos', '*-ios', '*-linux'], ['*-macos', '*-ios'])).toEqual(['*-linux']);
+    expect(releasePlatformTargetGlobsFor(PLATFORM_TARGET_GLOBS, undefined)).toEqual([...PLATFORM_TARGET_GLOBS]);
+  });
+
+  it('excluding every Apple family renders the single-job Linux publish shape', () => {
+    const globs = releasePlatformTargetGlobsFor(['*-macos', '*-linux'], ['*-macos']);
+    const rendered = renderPublishWorkflowYaml({
+      repoName: 'axe.sc/axe',
+      platformTargetGlobs: globs,
+      macosPlatformArchitectures: [],
+      runsOn: ['nixos-latest-x64', 'self-hosted'],
+      actionsProvider: 'forgejo',
+    });
+    expect(rendered).not.toContain('cross-platform:');
+    expect(rendered).not.toContain('macos-platform:');
+    expect(rendered).not.toContain('SDKROOT');
+    expect(rendered).not.toContain('--targets "*-macos"');
+    expect(rendered).toContain('  publish:');
+  });
+});

package/src/monorepo/managed-files.ts

@@ -170,6 +170,8 @@ export interface ManagedFileContext {
   nodeModulesCacheKey: string;
   repoName: string;
   platformTargetGlobs: string[];
+  /** Platform families the release workflow produces; excluded families are absent. */
+  releasePlatformTargetGlobs: string[];
   macosPlatformArchitectures: string[];
   /** Declared private-npm opt-in from the root smoo config; absent means fully public. */
   privateNpm?: PackagePrivateNpmConfig;
@@ -221,6 +223,12 @@ const managedFiles: ManagedFile[] = [
     source: 'tooling/direnv/secret-references.ts',
     target: 'tooling/direnv/secret-references.ts',
   },
+  {
+    kind: 'raw',
+    source: 'tooling/direnv/toolchain-stamp.ts',
+    target: 'tooling/direnv/toolchain-stamp.ts',
+    executable: true,
+  },
   {
     kind: 'raw',
     source: 'tooling/direnv/devenv.smoo.nix',
@@ -409,7 +417,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         release: context.hasReleasePackages,
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
-        platformTargetGlobs: context.platformTargetGlobs,
+        platformTargetGlobs: context.releasePlatformTargetGlobs,
         macosPlatformArchitectures: context.macosPlatformArchitectures,
         runsOn: context.ciRunsOn,
         macosRunsOn: context.macosRunsOn,
@@ -451,6 +459,14 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
   const productionDeploy = deployTargetInfoFromProjects(nxProjects, 'production');
   const targetNames = targetNamesFromProjects(nxProjects);
   const platformTargetGlobs = platformTargetGlobsForTest(targetNames);
+  // The release workflow produces every platform family the graph carries
+  // EXCEPT the ones the repository excludes. An excluded family renders no job
+  // at all rather than a job whose failure blocks every release; the workflow
+  // that does own it says so itself.
+  const releasePlatformTargetGlobs = releasePlatformTargetGlobsFor(
+    platformTargetGlobs,
+    github?.releasePlatformFamiliesExcluded,
+  );
   const privateNpm = resolvePrivateNpmWorkflowConfig(root);
   // Cache registry identity plus the lockfile, never token values: a scope
   // URL change in the committed .npmrc must invalidate the dependency cache,
@@ -479,10 +495,13 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
     nodeModulesCacheKey,
     repoName,
     platformTargetGlobs,
+    releasePlatformTargetGlobs,
     sourceCheckouts,
     cargoCredentials,
     remoteCache: manifest?.smoo?.remoteCache,
-    macosPlatformArchitectures: macosPlatformArchitecturesForTest(targetNames),
+    macosPlatformArchitectures: MACOS_PLATFORM_TARGET_GLOBS.some((glob) => releasePlatformTargetGlobs.includes(glob))
+      ? macosPlatformArchitecturesForTest(targetNames)
+      : [],
     privateNpm,
   };
 }
@@ -491,6 +510,21 @@ export function hasExactTargetForTest(targetNames: Iterable<string>, target: str
   return [...targetNames].includes(target);
 }
 
+/**
+ * The platform families the release workflow produces: the graph's families
+ * minus the ones the repository excludes. Excluding a family the graph does not
+ * have is not an error — a repository states what it does not release, and the
+ * statement stays true when the target is added later.
+ */
+export function releasePlatformTargetGlobsFor(
+  platformTargetGlobs: readonly string[],
+  excluded: readonly string[] | undefined,
+): string[] {
+  if (!excluded || excluded.length === 0) return [...platformTargetGlobs];
+  const drop = new Set(excluded);
+  return platformTargetGlobs.filter((glob) => !drop.has(glob));
+}
+
 export function platformTargetGlobsForTest(targetNames: Iterable<string>): string[] {
   const names = [...targetNames];
   return PLATFORM_TARGET_GLOBS.filter((glob) => {

package/src/monorepo/publish-workflow.ts

@@ -404,8 +404,17 @@ export function renderPublishWorkflowYaml(options: PublishWorkflowDefinitionOpti
   if (options.release === false) {
     const steps = definePublishWorkflow(options).steps;
     workflow = `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
-  } else if (hasMacosPlatformTargets(options)) {
+  } else if (hasMacosPlatformTargets(options) && !skipsPublishHandoff(options)) {
     workflow = renderPlatformPublishWorkflowYaml(options);
+  } else if (hasMacosPlatformTargets(options)) {
+    // A linux-cross producer runs the Apple targets on the publisher's own
+    // runner. Splitting jobs then buys nothing and costs a real transfer: the
+    // outputs get tarred, uploaded, downloaded into a second checkout, and two
+    // more devenv setups pay for themselves twice. One job, no artifacts.
+    workflow = `${renderPublishWorkflowHeader(options)}${renderSingleJobPublishWorkflowSteps(
+      definePublishWorkflow(options).steps,
+      options,
+    )}`;
   } else if (hasLinuxPlatformTargets(options)) {
     workflow = `${renderPublishWorkflowHeader(options)}${renderSingleJobPublishWorkflowSteps(
       definePublishWorkflow(options).steps,
@@ -475,7 +484,7 @@ jobs:
   publish:
 ${options.release === false ? renderRunsOnLine(options.runsOn) : publishJobRunsOnLine(options)}
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}${platformProducerJobEnv(options)}
     steps:
 `;
 }
@@ -749,11 +758,25 @@ function renderSingleJobPublishWorkflowSteps(
   options: PublishWorkflowDefinitionOptions,
 ): string {
   const lines: string[] = [];
+  const producer = options.platformProducer;
+  const crossOnThisRunner = skipsPublishHandoff(options) && hasMacosPlatformTargets(options);
   for (const step of steps) {
     lines.push(...sectionLinesBefore(step));
     lines.push(...commentLinesForStep(step));
     lines.push(...yamlLinesForStep(step, options));
     lines.push('');
+    if (crossOnThisRunner && producer && step.kind === PublishWorkflowStepKind.Checkout) {
+      // Before any toolchain setup or build, exactly as the dedicated producer
+      // job ordered it: the SDK has to be on disk before devenv resolves it.
+      lines.push(
+        '      - name: Check cross-platform toolchain prerequisites',
+        '        working-directory: .',
+        '        run: |',
+        '          set -euo pipefail',
+        ...producer.preflight.split('\n').map((line) => `          ${line}`),
+        '',
+      );
+    }
     if (step.kind === PublishWorkflowStepKind.Build) {
       lines.push(
         '      - name: 🐧 Build supplemental Linux targets',
@@ -763,6 +786,16 @@ function renderSingleJobPublishWorkflowSteps(
         )}"`,
         '',
       );
+      if (crossOnThisRunner) {
+        lines.push(
+          '      - name: 🍎 Build selected macOS and iOS release outputs',
+          "        if: steps.version.outputs.mode != 'none'",
+          `        run: smoo github-ci nx-run-many --targets "${macosPlatformFamilies(options).join(',')}" --projects "${githubExpression(
+            'steps.version.outputs.projects',
+          )}"`,
+          '',
+        );
+      }
     }
   }
   return `${lines.join('\n').trimEnd()}\n`;
@@ -1423,6 +1456,41 @@ function githubExpression(expression: string): string {
   return ['$', '{{ ', expression, ' }}'].join('');
 }
 
+/**
+ * Whether the separate publishing job can be dropped, so the release runs as
+ * one job that builds every artifact and publishes them.
+ *
+ * The hand-off exists for ONE reason: npmjs mints provenance from the
+ * publishing job's OIDC token and refuses a self-hosted runner for it, so a
+ * release with public packages must publish from the GitHub-hosted runner and
+ * therefore has to receive its self-hosted artifacts through an artifact.
+ * A release that publishes only to the declared private registry has no such
+ * constraint; when its Apple targets are cross-built on the same runner (or it
+ * has none), one job holds everything.
+ */
+function skipsPublishHandoff(options: PublishWorkflowDefinitionOptions): boolean {
+  if (options.actionsProvider !== 'forgejo' || options.privateNpm === undefined) {
+    return false;
+  }
+  return !hasMacosPlatformTargets(options) || options.platformProducer?.kind === 'linux-cross';
+}
+
+/**
+ * Toolchain environment for a foreign-platform producer, rendered onto whichever
+ * job runs its builds. In the flattened single-job shape that is the publish job
+ * itself, so the SDK path and cross flags have to reach it the same way the
+ * dedicated producer job received them.
+ */
+function platformProducerJobEnv(options: PublishWorkflowDefinitionOptions): string {
+  const producer = options.platformProducer;
+  if (!producer || !skipsPublishHandoff(options)) {
+    return '';
+  }
+  return Object.entries(producer.env ?? {})
+    .map(([name, value]) => `\n      ${name}: ${JSON.stringify(value)}`)
+    .join('');
+}
+
 function privateNpmInstallJobEnv(options: PublishWorkflowDefinitionOptions): string {
   const tokenEnv = options.privateNpm?.readTokenEnv;
   if (!tokenEnv) {

package/src/monorepo/secret-references.test.ts

@@ -387,3 +387,71 @@ describe('resolveSecretEnvironment', () => {
     }
   });
 });
+
+/**
+ * Redaction is a byte operation on output the caller already captured, so the
+ * harness carries both directions as base64: a text-only round trip would
+ * hide exactly the invalid-UTF-8 bytes a failing install can emit.
+ */
+const MASK_SCRIPT = `
+const resolver = await import(Bun.argv[1]);
+const { output, values } = JSON.parse(Bun.argv[2]);
+const captured = Buffer.from(output, 'base64');
+const masked = resolver.maskSecretValues(captured, values);
+process.stdout.write(JSON.stringify({
+  masked: Buffer.from(masked).toString('base64'),
+  captured: captured.toString('base64'),
+}));
+`;
+
+describe('maskSecretValues', () => {
+  const mask = async (output: Uint8Array, values: readonly string[]): Promise<{ masked: Buffer; captured: Buffer }> => {
+    const { stdout, stderr, exitCode } = await runInBootstrap(
+      MASK_SCRIPT,
+      JSON.stringify({ output: Buffer.from(output).toString('base64'), values }),
+    );
+    expect(stderr).toBe('');
+    expect(exitCode).toBe(0);
+    const value: unknown = JSON.parse(stdout);
+    if (
+      typeof value !== 'object' ||
+      value === null ||
+      !('masked' in value) ||
+      typeof value.masked !== 'string' ||
+      !('captured' in value) ||
+      typeof value.captured !== 'string'
+    ) {
+      throw new Error(`bootstrap harness returned a malformed envelope: ${stdout}`);
+    }
+    return { masked: Buffer.from(value.masked, 'base64'), captured: Buffer.from(value.captured, 'base64') };
+  };
+
+  it('replaces every occurrence and leaves the surrounding failure legible', async () => {
+    const output = Buffer.from('error: 401 for https://x:hunter2@registry/pkg\nretrying with hunter2\n');
+    const { masked, captured } = await mask(output, ['hunter2']);
+    expect(masked.toString()).toBe('error: 401 for https://x:*******@registry/pkg\nretrying with *******\n');
+    expect(masked.length).toBe(output.length);
+    // The caller keeps its captured bytes: redaction returns a copy, and a
+    // node Buffer's `slice` would have handed back a view of these.
+    expect(captured.toString()).toBe(output.toString());
+  });
+
+  it('redacts each declared value even when one is a prefix of another', async () => {
+    expect((await mask(Buffer.from('AB ABCD AB'), ['ABCD', 'AB'])).masked.toString()).toBe('** **** **');
+  });
+
+  it('survives a false start on the first byte', async () => {
+    expect((await mask(Buffer.from('aab aaab'), ['aab'])).masked.toString()).toBe('*** a***');
+  });
+
+  it('masks whole bytes and carries invalid UTF-8 through untouched', async () => {
+    const output = Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from('kå'), Buffer.from([0x00])]);
+    const { masked } = await mask(output, ['kå']);
+    expect([...masked]).toEqual([0xff, 0xfe, 0x2a, 0x2a, 0x2a, 0x00]);
+  });
+
+  it('leaves output alone when nothing is declared or a value is empty', async () => {
+    expect((await mask(Buffer.from('nothing to hide'), [])).masked.toString()).toBe('nothing to hide');
+    expect((await mask(Buffer.from('nothing to hide'), [''])).masked.toString()).toBe('nothing to hide');
+  });
+});

package/src/release/__tests__/private-npm-status.test.ts

@@ -433,6 +433,43 @@ describe('private npm published-version status', () => {
     });
   });
 
+  it('reads through a repository .npmrc whose own auth line names an unset env', async () => {
+    // The shape that cost a day: AxE commits
+    // `//host/path:_authToken=${AXE_NPM_PUBLISH_TOKEN}` at the workspace root.
+    // npm ranks that project file ABOVE the userconfig this CLI writes, so with
+    // the publish env unset it sent the unexpanded value and the registry
+    // answered 401 — with a perfectly good read credential in hand.
+    await withStatusFixture(async ({ fixture, root, userconfig }) => {
+      await fixture.privateRegistry.publishPackage({ name: PRIVATE_PACKAGE, version: PRIVATE_VERSION });
+      const resolved = loopbackRegistry(fixture.privateRegistry);
+      await writeFile(
+        join(root, '.npmrc'),
+        `${resolved.scope}:registry=${resolved.registry}\n${resolved.authKey}=\${NOT_SET_ANYWHERE}\n`,
+      );
+
+      // Control: with the userconfig alone the project file wins, so the token
+      // npm sends is the unexpanded reference — the registry sees no usable
+      // credential. Asserted on the wire, because a fixture that answers
+      // anonymous reads would let the server's verdict hide it.
+      await npmPublishedVersionExists(root, PRIVATE_PACKAGE, PRIVATE_VERSION, {
+        registry: fixture.privateRegistry.registry,
+        userconfig,
+      });
+      const overridden = fixture.privateRegistry.requestsFor('probe').at(-1);
+      expect(overridden?.authorization ?? '').not.toContain(FIXTURE_READ_TOKEN);
+
+      await expect(
+        npmPublishedVersionExists(root, PRIVATE_PACKAGE, PRIVATE_VERSION, {
+          registry: fixture.privateRegistry.registry,
+          userconfig,
+          credential: { authKey: resolved.authKey, tokenEnv: FIXTURE_READ_TOKEN_ENV },
+        }),
+      ).resolves.toBe(true);
+      const authenticated = fixture.privateRegistry.requestsFor('probe').at(-1);
+      expect(authenticated?.authorization ?? '').toContain(FIXTURE_READ_TOKEN);
+    });
+  });
+
   it('reports a genuine not-found as absent', async () => {
     await withStatusFixture(async ({ fixture, root, userconfig }) => {
       fixture.privateRegistry.failWith(404);

package/src/release/__tests__/private-npm-workflow.test.ts

@@ -86,17 +86,37 @@ describe('private npm workflow token selection', () => {
   });
 
   it('ignores workspace and link specs so a producer install does not look like a registry consume', async () => {
+    // Without a declared read token, the .npmrc credential is a publish
+    // credential and must never be promoted into the read role by inference.
     await withRepo(
       {
         privatePackage: `${SCOPE}/sdk`,
         rootDeps: { [`${SCOPE}/sdk`]: 'workspace:*' },
         extraDeps: { [`${SCOPE}/other`]: 'link:@priv.test/other' },
         npmrcAuthEnv: PUBLISH_ENV,
+        declared: { scope: SCOPE, publishTokenEnv: PUBLISH_ENV },
+      },
+      (root) => {
+        expect(resolvePrivateNpmWorkflowConfig(root)).toEqual({
+          scope: SCOPE,
+          publishTokenEnv: PUBLISH_ENV,
+        });
+      },
+    );
+  });
+
+  it('renders a declared read token for a producer, whose later releases read the previous tag state', async () => {
+    await withRepo(
+      {
+        privatePackage: `${SCOPE}/sdk`,
+        rootDeps: { [`${SCOPE}/sdk`]: 'workspace:*' },
+        npmrcAuthEnv: PUBLISH_ENV,
         declared: { scope: SCOPE, readTokenEnv: READ_ENV, publishTokenEnv: PUBLISH_ENV },
       },
       (root) => {
         expect(resolvePrivateNpmWorkflowConfig(root)).toEqual({
           scope: SCOPE,
+          readTokenEnv: READ_ENV,
           publishTokenEnv: PUBLISH_ENV,
         });
       },

package/src/release/github-release.ts

@@ -1,6 +1,8 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import type { ChangelogOptions } from 'nx/src/command-line/release/command-object.js';
 import type { NxReleaseConfiguration } from 'nx/src/config/nx-json.js';
 import { type ReleasePackageInfo, releaseTag } from './core.js';
@@ -34,7 +36,7 @@ export interface GithubReleaseWriteShell {
 
 export async function renderNxProjectChangelogContents(input: RenderNxProjectChangelogInput): Promise<string> {
   return withNxWorkspaceRoot(input.root, async () => {
-    const { createAPI } = await import('nx/src/command-line/release/changelog.js');
+    const { createAPI } = await importWorkspaceNx(input.root, 'src/command-line/release/changelog.js');
     const result = await createAPI(
       nxRenderOnlyReleaseConfig,
       false,
@@ -124,8 +126,35 @@ function isPrereleaseVersion(version: string): boolean {
   return version.includes('-');
 }
 
+/**
+ * A module of the WORKSPACE's Nx, not of smoo's own dependency. smoo installs
+ * with its own `nx` in the global virtual store, where the workspace's
+ * node_modules is invisible: that Nx cannot resolve the workspace's
+ * `versionActions` plugin (`Unable to resolve the "versionActions"
+ * implementation ... "@smoothbricks/nx-plugin/version-actions"`), and it is
+ * a second Nx version driving one release. Every in-process Nx call for a
+ * workspace resolves from that workspace's root, exactly as `nx` on its PATH
+ * would.
+ */
+interface WorkspaceNxModules {
+  'src/utils/workspace-root.js': typeof import('nx/src/utils/workspace-root.js');
+  'src/command-line/release/version.js': typeof import('nx/src/command-line/release/version.js');
+  'src/command-line/release/changelog.js': typeof import('nx/src/command-line/release/changelog.js');
+}
+
+export async function importWorkspaceNx<Subpath extends keyof WorkspaceNxModules>(
+  root: string,
+  subpath: Subpath,
+): Promise<WorkspaceNxModules[Subpath]> {
+  const resolved = createRequire(join(root, 'package.json')).resolve(`nx/${subpath}`);
+  // A dynamic specifier types as `any`; the map above is the declared shape of
+  // the module the workspace's Nx serves at that subpath.
+  const module: WorkspaceNxModules[Subpath] = await import(pathToFileURL(resolved).href);
+  return module;
+}
+
 export async function withNxWorkspaceRoot<T>(root: string, run: () => Promise<T>): Promise<T> {
-  const workspaceRootModule = await import('nx/src/utils/workspace-root.js');
+  const workspaceRootModule = await importWorkspaceNx(root, 'src/utils/workspace-root.js');
   const previousWorkspaceRoot = workspaceRootModule.workspaceRoot;
   const previousEnvWorkspaceRoot = process.env.NX_WORKSPACE_ROOT_PATH;
   const previousCwd = process.cwd();