@smoothbricks/cli 0.11.15 → 0.11.16

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAgDnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAuUD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAmgCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAiDnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AA8UD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAkhCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}

package/dist/release/index.js

@@ -15,7 +15,8 @@ import { parseNxJsonText, parseNxProjectJsonText, parsePackageJsonText, } from '
 import { decode, run, runInteractiveStatus, runResult, runText } from '../lib/run.js';
 import { getWorkspacePackages, listPublicReleasePackages, listReleasePackages, readPackageJson, repositoryInfo, } from '../lib/workspace.js';
 export { assertPackedArtifact, releasePack, resolvePackClosure, } from './pack.js';
-export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmUserconfigContent, publishPrivateWithDiagnostics, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmTokenEnvForMode, privateNpmUserconfigContent, publishPrivateWithDiagnostics, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { ciApiContext } from '../github-ci/api.js';
 import { readProjectTargets } from '../nx/index.js';
 import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
@@ -26,7 +27,7 @@ import { createOrUpdateGithubRelease, githubReleaseLookupExists, importWorkspace
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import { bumpStableReleaseToNext, collectRepairPlatformOutputs, completeReleaseAtHead as completeReleaseAtHeadWithShell, prepareReleaseCandidate, repairPendingTargets, runReleaseTag, runReleaseVersion, } from './orchestration.js';
 import { packReleaseTarball } from './pack.js';
-import { assertPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, publishPrivateWithDiagnostics, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+import { assertPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmTokenEnvForMode, publishPrivateWithDiagnostics, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
 import { retagUnpublished } from './retag-unpublished.js';
 import { forgejoAuthHeaders, forgejoReleaseLookupExists, resolveSourceReleaseEndpoint, resolveSourceRepository, sourceReleaseTokenEnvNames, sourceReleaseUrl, } from './source-release.js';
 export async function releaseVersion(root, options) {
@@ -426,7 +427,12 @@ async function publishPrivatePackedPackage(root, pkg, tag, dryRun, registry) {
         }
         await withPrivateNpmUserconfig(registry, 'publish', async (userconfig) => {
             await publishPrivateWithDiagnostics(pkg, {
-                publish: () => runNpm(root, args, { NPM_CONFIG_USERCONFIG: userconfig }),
+                publish: () => runNpm(root, args, {
+                    NPM_CONFIG_USERCONFIG: userconfig,
+                    // Env config outranks a committed project `.npmrc` auth line; see
+                    // npmStatusEnv in private-npm.ts for why that matters here.
+                    [`npm_config_${registry.authKey}`]: process.env[privateNpmTokenEnvForMode(registry, 'publish')] ?? '',
+                }),
                 // The open publish userconfig already authenticates this registry,
                 // so the failure probe reuses it. Opening a second read-mode
                 // userconfig here demanded a read credential the publishing job need
@@ -435,6 +441,7 @@ async function publishPrivatePackedPackage(root, pkg, tag, dryRun, registry) {
                 versionExists: () => npmPublishedVersionExistsOnRegistry(root, pkg.name, pkg.version, {
                     registry: registry.registry,
                     userconfig,
+                    credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'publish') },
                 }),
                 log: (message) => console.log(message),
                 error: (message) => console.error(message),
@@ -782,6 +789,17 @@ function releaseRepairShell(root, platformOutputs) {
             const sourceSha = await gitHead(root);
             const outputs = platformOutputs.map((base) => join(base, sourceSha));
             if (outputs.length === 0) {
+                // No producer job handed outputs over, so this runner is the producer:
+                // build the platform legs at the checked-out ref. `build` alone gives a
+                // package only the legs its own graph depends on — the host one and
+                // whatever it declares — and the release gate demands the whole declared
+                // native closure, so a foreign leg it never asked for was simply absent.
+                console.log('Repair pending releases: building cross-platform outputs on this runner.');
+                await githubCiNxRunMany(root, {
+                    targets: PLATFORM_TARGET_GLOBS.join(','),
+                    projects: releasePackageProjects(packages),
+                    allowEmptyProjects: true,
+                });
                 return;
             }
             console.log(`Repair pending releases: applying cross-platform outputs from ${outputs.join(', ')}.`);
@@ -1366,7 +1384,11 @@ async function npmVersionExists(root, name, version) {
         assertPublicStatusAllowed(root, name);
         return npmPublishedVersionExistsOnRegistry(root, name, version);
     }
-    return withPrivateNpmUserconfig(registry, 'read', (userconfig) => npmPublishedVersionExistsOnRegistry(root, name, version, { registry: registry.registry, userconfig }));
+    return withPrivateNpmUserconfig(registry, 'read', (userconfig) => npmPublishedVersionExistsOnRegistry(root, name, version, {
+        registry: registry.registry,
+        userconfig,
+        credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'read') },
+    }));
 }
 async function npmPackageExists(root, name) {
     const registry = selectRegistryForPackage(root, name);

package/dist/release/private-npm.d.ts

@@ -103,6 +103,11 @@ export declare function withPrivateNpmUserconfig<T>(resolved: PrivateNpmRegistry
 export interface NpmStatusOptions {
     registry?: string;
     userconfig?: string;
+    /** Path-scoped auth key and token env, so the credential can ride env config. */
+    credential?: {
+        authKey: string;
+        tokenEnv: string;
+    };
 }
 /**
  * Failure-aware registry status: only a genuine not-found result means absent.

package/dist/release/private-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-npm.d.ts","sourceRoot":"","sources":["../../src/release/private-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAGL,KAAK,WAAW,EAIjB,MAAM,qBAAqB,CAAC;AAE7B,uEAAuE;AACvE,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,iCAAiC,GACzC,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,CAAC;AAEpB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,iCAAiC,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAMhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAwFtE;AAoFD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAqBjG;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAO9F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,6BAA6B,GAAG,IAAI,CAiBtC;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKhH;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,GAAG,MAAM,CAAC,GAC3D,kBAAkB,CAapB;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACpC,MAAM,CAMR;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUxG;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAWD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAanH;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAE1G;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,GAAG,SAAS,CAAC,EAChE,KAAK,EAAE,gCAAgC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAuCf"}
+{"version":3,"file":"private-npm.d.ts","sourceRoot":"","sources":["../../src/release/private-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAGL,KAAK,WAAW,EAIjB,MAAM,qBAAqB,CAAC;AAE7B,uEAAuE;AACvE,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,iCAAiC,GACzC,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,CAAC;AAEpB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,iCAAiC,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAMhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAwFtE;AAoFD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CA0BjG;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAO9F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,6BAA6B,GAAG,IAAI,CAiBtC;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKhH;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,GAAG,MAAM,CAAC,GAC3D,kBAAkB,CAapB;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACpC,MAAM,CAMR;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUxG;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AA6BD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAanH;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAE1G;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,GAAG,SAAS,CAAC,EAChE,KAAK,EAAE,gCAAgC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAuCf"}

package/dist/release/private-npm.js

@@ -179,7 +179,12 @@ export function resolvePrivateNpmWorkflowConfig(root) {
         return undefined;
     }
     const npmrcEnv = npmrcAuthTokenEnv(root, declared.scope);
-    const readTokenEnv = consumes ? (declared.readTokenEnv ?? npmrcEnv) : undefined;
+    // A publishing workspace reads the registry too: every release after the
+    // first checks the previous tag's durable state, and that check runs in the
+    // producer jobs that never see the publish credential. A declared read token
+    // therefore always renders; only the .npmrc fallback stays consumer-only, so
+    // a publish token is never promoted into a read role by inference.
+    const readTokenEnv = declared.readTokenEnv ?? (consumes ? npmrcEnv : undefined);
     const publishTokenEnv = publishes ? (declared.publishTokenEnv ?? npmrcEnv) : undefined;
     if (!readTokenEnv && !publishTokenEnv) {
         return undefined;
@@ -312,8 +317,24 @@ export async function withPrivateNpmUserconfig(resolved, mode, fn) {
         await rm(dir, { recursive: true, force: true });
     }
 }
-function npmStatusEnv(userconfig) {
-    return userconfig ? { NPM_CONFIG_USERCONFIG: userconfig } : undefined;
+/**
+ * npm config precedence is cli > env > project `.npmrc` > userconfig. A
+ * repository that commits its own `//host/path:_authToken=${SOME_ENV}` line
+ * therefore OVERRIDES the userconfig this module writes, and when that env is
+ * unset npm sends the unexpanded value: the registry answers 401 on reads with
+ * a perfectly good read credential, naming nothing. So the credential also
+ * rides as env config, which the project file cannot outrank, and the token
+ * value stays out of every file on disk.
+ */
+function npmStatusEnv(userconfig, credential) {
+    if (!userconfig)
+        return undefined;
+    const env = { NPM_CONFIG_USERCONFIG: userconfig };
+    const token = credential ? process.env[credential.tokenEnv] : undefined;
+    if (credential && token) {
+        env[`npm_config_${credential.authKey}`] = token;
+    }
+    return env;
 }
 function npmCommandFailedMessage(npmArgs, exitCode, stdout = '', stderr = '') {
     const detail = `${stdout}\n${stderr}`.trim();
@@ -330,7 +351,7 @@ export async function npmPublishedVersionExists(root, name, version, options = {
     if (options.registry) {
         args.push('--registry', options.registry);
     }
-    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
     if (result.exitCode === 0) {
         return true;
     }
@@ -345,7 +366,7 @@ export async function npmPackageExists(root, name, options = {}) {
     if (options.registry) {
         args.push('--registry', options.registry);
     }
-    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
     if (result.exitCode === 0) {
         return true;
     }

package/managed/raw/tooling/direnv/devenv.smoo.nix

@@ -372,9 +372,11 @@
         esac
       ''}
     '')
-    # Epilogue: the wrapper runs devenv from tooling/direnv, so return the shell
-    # to wherever the caller invoked it. Last, after every project step.
+    # Epilogue, after every project step (a project's own enterShell may resolve
+    # SDKROOT/compilers; the toolchain identity must see the final values). The
+    # stamp logic lives in toolchain-stamp.ts; see its header for why.
     (lib.mkAfter ''
+      bun "$DEVENV_ROOT/toolchain-stamp.ts" || exit $?
       if [ -n "$DEVENV_SHELL_PWD" ]; then
         cd "$DEVENV_SHELL_PWD"
       fi

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -145,7 +145,10 @@ build_devenv_shell() {
   # One evaluation: the shell that captures the environment is the shell
   # build. A separate `devenv shell -- date` evaluated everything twice.
   persist_devenv_environment
-  if [ "${SMOO_HOST_RUNNER:-false}" != true ]; then
+  # Only the ephemeral-runner path of setup-devenv opts in: the scan walks the
+  # whole store, which on a developer host or a host runner is large and not
+  # ours to root.
+  if [ "${SMOO_ROOT_BUILD_INPUTS:-false}" = true ]; then
     root_build_inputs "$since"
   fi
   # Add repo-local tools only after the shell exists; cleanup steps use an

package/managed/raw/tooling/direnv/toolchain-stamp.ts

@@ -0,0 +1,88 @@
+#!/usr/bin/env bun
+/**
+ * Invalidate cmake build-script caches when the toolchain changes.
+ *
+ * cmake-rs keeps CMAKE_OSX_SYSROOT and the compilers in CMakeCache.txt from
+ * the FIRST configure and only clears a build directory when the source path
+ * moves. Every C/C++ build script's cache under target/ therefore encodes
+ * whichever toolchain the shell had when it was first configured, and it
+ * outlives every later fix to that shell: a nix-store sysroot cached on one
+ * day kept failing `ld: library 'c++' not found` after the shell stopped
+ * exporting it. Nx does not see this state either — it hashes inputs, not
+ * what a cache under target/ remembers.
+ *
+ * Runs at the end of shell entry, after the project's own enterShell resolved
+ * SDKROOT and the compilers. It records the toolchain identity the shell
+ * settled on and, when that identity differs from the recorded one, removes
+ * exactly the cargo build-script directories that hold a CMakeCache.txt, so
+ * cargo re-runs those scripts against the current toolchain. Nothing else
+ * under target/ is touched; a checkout without target/ has nothing to do.
+ */
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { $ } from 'bun';
+
+const root = resolve(`${process.env.DEVENV_ROOT ?? process.cwd()}/../..`);
+const target = join(root, 'target');
+if (existsSync(target)) {
+  const stamp = join(target, '.toolchain-stamp');
+  const identity = await toolchainIdentity();
+  const recorded = existsSync(stamp) ? readFileSync(stamp, 'utf8') : null;
+  if (recorded !== identity) {
+    const removed = removeCmakeBuildScriptDirs(target);
+    if (removed > 0) {
+      console.error(`devenv: toolchain identity changed; removed ${removed} cmake build-script cache(s) under target/`);
+    }
+    writeFileSync(stamp, identity);
+  }
+}
+
+async function toolchainIdentity(): Promise<string> {
+  const rustc = await $`rustc -Vv`.quiet().nothrow().text();
+  const cc = (await $`cc --version`.quiet().nothrow().text()).split('\n')[0] ?? '';
+  return [
+    rustc.trim(),
+    `SDKROOT=${process.env.SDKROOT ?? ''}`,
+    `DEVELOPER_DIR=${process.env.DEVELOPER_DIR ?? ''}`,
+    cc,
+  ].join('\n');
+}
+
+/**
+ * Removes every cargo build-script directory (`…/build/<crate>-<hash>`) whose
+ * `out/build/CMakeCache.txt` exists; returns the count. Only the `build/`
+ * directories cargo creates under a profile are scanned - never the compiled
+ * artifacts beside them - and the scan completes before anything is removed.
+ */
+function removeCmakeBuildScriptDirs(target: string): number {
+  const stale: string[] = [];
+  for (const buildDir of cargoBuildDirs(target, 0)) {
+    for (const entry of readdirSync(buildDir, { withFileTypes: true })) {
+      if (entry.isDirectory() && existsSync(join(buildDir, entry.name, 'out', 'build', 'CMakeCache.txt'))) {
+        stale.push(join(buildDir, entry.name));
+      }
+    }
+  }
+  for (const dir of stale) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  return stale.length;
+}
+
+/** `target/[<lane>/][<triple>/]<profile>/build` - at most four levels below target/. */
+function* cargoBuildDirs(dir: string, depth: number): Generator<string> {
+  if (depth > 4) {
+    return;
+  }
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const path = join(dir, entry.name);
+    if (entry.name === 'build' && depth > 0) {
+      yield path;
+    } else if (entry.name !== 'deps' && entry.name !== 'incremental' && entry.name !== '.fingerprint') {
+      yield* cargoBuildDirs(path, depth + 1);
+    }
+  }
+}

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -237,5 +237,5 @@ runs:
       shell: bash
       working-directory: ${{ env.DEVENV_WORKDIR }}/tooling/direnv
       env:
-        SMOO_HOST_RUNNER: ${{ steps.runner-kind.outputs.host }}
+        SMOO_ROOT_BUILD_INPUTS: ${{ steps.runner-kind.outputs.host != 'true' }}
       run: ./github-actions-bootstrap.sh build-shell

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.15",
+  "version": "0.11.16",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.9",
+    "@smoothbricks/nx-plugin": "0.4.10",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/lib/json.ts

@@ -77,6 +77,15 @@ export interface PackageSmooGithub {
     /** Toolchain environment on the Linux foreign-platform producer, such as an SDK path. */
     env?: StringMap;
   };
+  /**
+   * Platform target families the RELEASE workflow must not produce, as target
+   * globs (`*-macos`, `*-ios`, `*-linux`). A repository whose Nx graph carries
+   * a family it does not release from `publish.yml` — because another workflow
+   * owns it, or because the leg is not production yet — names it here, and the
+   * publish workflow renders without that job instead of carrying a leg whose
+   * failure blocks every release.
+   */
+  releasePlatformFamiliesExcluded?: string[];
   /**
    * Sibling source checkouts a repo path-depends on (Cargo path
    * dependencies, nix path inputs). The CI workflow clones each entry beside

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -101,6 +101,60 @@ describe('publish workflow definition', () => {
     expect(rendered).toContain("default: ''");
   });
 
+  it('a private forge release with cross-built Apple targets publishes from one job', () => {
+    const rendered = renderPublishWorkflowYaml({
+      repoName: 'axe.sc/axe',
+      actionsProvider: 'forgejo',
+      runsOn: ['nixos-latest-x64', 'self-hosted'],
+      platformTargetGlobs: ['*-macos', '*-linux'],
+      macosPlatformArchitectures: ['arm64'],
+      platformProducer: { kind: 'linux-cross', preflight: 'sh scripts/prepare-macos-sdk.sh', env: { AXE_CROSS: '1' } },
+      privateNpm: { scope: '@axe.sc', readTokenEnv: 'READ_ENV', publishTokenEnv: 'PUBLISH_ENV' },
+    });
+
+    // One job: no producer job to hand outputs over from, so no transfer at all.
+    const jobsYaml = rendered.slice(rendered.indexOf('jobs:\n') + 'jobs:\n'.length);
+    expect(jobsYaml.match(/^ {2}[a-z][a-z0-9-]*:$/gm)).toEqual(['  publish:']);
+    // The hand-off steps specifically; the failure-only trace-DB upload stays.
+    expect(rendered).not.toContain('Upload validated release state');
+    expect(rendered).not.toContain('Upload validated build outputs');
+    expect(rendered).not.toContain('Upload macOS platform outputs');
+    expect(rendered).not.toContain('Download candidate artifacts');
+    expect(rendered).not.toContain('git bundle');
+    // It still builds the Apple targets, with the producer's toolchain env and
+    // its preflight ahead of setup.
+    expect(rendered).toContain('--targets "*-macos"');
+    expect(rendered).toMatch(/^ {6}AXE_CROSS: ['"]1['"]$/m);
+    expect(rendered).toContain('Check cross-platform toolchain prerequisites');
+    expect(rendered.indexOf('Check cross-platform toolchain prerequisites')).toBeLessThan(
+      rendered.indexOf('Setup Nix/devenv'),
+    );
+  });
+
+  it('keeps the publishing hand-off when provenance needs the hosted runner', () => {
+    const publicWithMac = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: ['*-macos', '*-linux'],
+      macosPlatformArchitectures: ['arm64'],
+      platformProducer: { kind: 'linux-cross', preflight: 'sh prepare.sh' },
+    });
+    const forgePublicWithMac = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      actionsProvider: 'forgejo',
+      runsOn: ['nixos-latest-x64', 'self-hosted'],
+      platformTargetGlobs: ['*-macos', '*-linux'],
+      macosPlatformArchitectures: ['arm64'],
+      platformProducer: { kind: 'linux-cross', preflight: 'sh prepare.sh' },
+    });
+
+    // No private registry declared: packages go to npmjs, which mints
+    // provenance from the publishing job and refuses a self-hosted runner.
+    for (const rendered of [publicWithMac, forgePublicWithMac]) {
+      expect(rendered).toContain('publish-on-linux:');
+      expect(rendered).toContain('Download candidate artifacts');
+    }
+  });
+
   it('preserves the single Ubuntu job and renders no artifact transfer when no Apple targets exist', () => {
     const current = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
     const explicitlyEmpty = renderPublishWorkflowYaml({

package/src/monorepo/managed-files.test.ts

@@ -20,10 +20,12 @@ import {
   managedFileTargetsForTest,
   platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
+  releasePlatformTargetGlobsFor,
   renderManagedWorkflowForTest,
   splitLocalSectionForTest,
   validateDevenvModuleImport,
 } from './managed-files.js';
+import { renderPublishWorkflowYaml } from './publish-workflow.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
 
@@ -457,6 +459,7 @@ const context = (overrides: Partial<ManagedFileContext>): ManagedFileContext =>
   nodeModulesCacheKey: 'key',
   repoName: '@scope/repo',
   platformTargetGlobs: [],
+  releasePlatformTargetGlobs: [],
   macosPlatformArchitectures: [],
   ...overrides,
 });
@@ -565,3 +568,26 @@ describe('CI workflow rendering by repo shape', () => {
     expect(rendered).toContain('GIT_CRYPT_KEY_B64: ${{ secrets.GIT_CRYPT_KEY_B64 }}');
   });
 });
+
+describe('release platform families', () => {
+  it('an excluded family is not produced by the release workflow, and the rest still are', () => {
+    expect(releasePlatformTargetGlobsFor(['*-macos', '*-ios', '*-linux'], ['*-macos', '*-ios'])).toEqual(['*-linux']);
+    expect(releasePlatformTargetGlobsFor(PLATFORM_TARGET_GLOBS, undefined)).toEqual([...PLATFORM_TARGET_GLOBS]);
+  });
+
+  it('excluding every Apple family renders the single-job Linux publish shape', () => {
+    const globs = releasePlatformTargetGlobsFor(['*-macos', '*-linux'], ['*-macos']);
+    const rendered = renderPublishWorkflowYaml({
+      repoName: 'axe.sc/axe',
+      platformTargetGlobs: globs,
+      macosPlatformArchitectures: [],
+      runsOn: ['nixos-latest-x64', 'self-hosted'],
+      actionsProvider: 'forgejo',
+    });
+    expect(rendered).not.toContain('cross-platform:');
+    expect(rendered).not.toContain('macos-platform:');
+    expect(rendered).not.toContain('SDKROOT');
+    expect(rendered).not.toContain('--targets "*-macos"');
+    expect(rendered).toContain('  publish:');
+  });
+});

package/src/monorepo/managed-files.ts

@@ -170,6 +170,8 @@ export interface ManagedFileContext {
   nodeModulesCacheKey: string;
   repoName: string;
   platformTargetGlobs: string[];
+  /** Platform families the release workflow produces; excluded families are absent. */
+  releasePlatformTargetGlobs: string[];
   macosPlatformArchitectures: string[];
   /** Declared private-npm opt-in from the root smoo config; absent means fully public. */
   privateNpm?: PackagePrivateNpmConfig;
@@ -221,6 +223,12 @@ const managedFiles: ManagedFile[] = [
     source: 'tooling/direnv/secret-references.ts',
     target: 'tooling/direnv/secret-references.ts',
   },
+  {
+    kind: 'raw',
+    source: 'tooling/direnv/toolchain-stamp.ts',
+    target: 'tooling/direnv/toolchain-stamp.ts',
+    executable: true,
+  },
   {
     kind: 'raw',
     source: 'tooling/direnv/devenv.smoo.nix',
@@ -409,7 +417,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         release: context.hasReleasePackages,
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
-        platformTargetGlobs: context.platformTargetGlobs,
+        platformTargetGlobs: context.releasePlatformTargetGlobs,
         macosPlatformArchitectures: context.macosPlatformArchitectures,
         runsOn: context.ciRunsOn,
         macosRunsOn: context.macosRunsOn,
@@ -451,6 +459,14 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
   const productionDeploy = deployTargetInfoFromProjects(nxProjects, 'production');
   const targetNames = targetNamesFromProjects(nxProjects);
   const platformTargetGlobs = platformTargetGlobsForTest(targetNames);
+  // The release workflow produces every platform family the graph carries
+  // EXCEPT the ones the repository excludes. An excluded family renders no job
+  // at all rather than a job whose failure blocks every release; the workflow
+  // that does own it says so itself.
+  const releasePlatformTargetGlobs = releasePlatformTargetGlobsFor(
+    platformTargetGlobs,
+    github?.releasePlatformFamiliesExcluded,
+  );
   const privateNpm = resolvePrivateNpmWorkflowConfig(root);
   // Cache registry identity plus the lockfile, never token values: a scope
   // URL change in the committed .npmrc must invalidate the dependency cache,
@@ -479,10 +495,13 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
     nodeModulesCacheKey,
     repoName,
     platformTargetGlobs,
+    releasePlatformTargetGlobs,
     sourceCheckouts,
     cargoCredentials,
     remoteCache: manifest?.smoo?.remoteCache,
-    macosPlatformArchitectures: macosPlatformArchitecturesForTest(targetNames),
+    macosPlatformArchitectures: MACOS_PLATFORM_TARGET_GLOBS.some((glob) => releasePlatformTargetGlobs.includes(glob))
+      ? macosPlatformArchitecturesForTest(targetNames)
+      : [],
     privateNpm,
   };
 }
@@ -491,6 +510,21 @@ export function hasExactTargetForTest(targetNames: Iterable<string>, target: str
   return [...targetNames].includes(target);
 }
 
+/**
+ * The platform families the release workflow produces: the graph's families
+ * minus the ones the repository excludes. Excluding a family the graph does not
+ * have is not an error — a repository states what it does not release, and the
+ * statement stays true when the target is added later.
+ */
+export function releasePlatformTargetGlobsFor(
+  platformTargetGlobs: readonly string[],
+  excluded: readonly string[] | undefined,
+): string[] {
+  if (!excluded || excluded.length === 0) return [...platformTargetGlobs];
+  const drop = new Set(excluded);
+  return platformTargetGlobs.filter((glob) => !drop.has(glob));
+}
+
 export function platformTargetGlobsForTest(targetNames: Iterable<string>): string[] {
   const names = [...targetNames];
   return PLATFORM_TARGET_GLOBS.filter((glob) => {

package/src/monorepo/publish-workflow.ts

@@ -404,8 +404,17 @@ export function renderPublishWorkflowYaml(options: PublishWorkflowDefinitionOpti
   if (options.release === false) {
     const steps = definePublishWorkflow(options).steps;
     workflow = `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
-  } else if (hasMacosPlatformTargets(options)) {
+  } else if (hasMacosPlatformTargets(options) && !skipsPublishHandoff(options)) {
     workflow = renderPlatformPublishWorkflowYaml(options);
+  } else if (hasMacosPlatformTargets(options)) {
+    // A linux-cross producer runs the Apple targets on the publisher's own
+    // runner. Splitting jobs then buys nothing and costs a real transfer: the
+    // outputs get tarred, uploaded, downloaded into a second checkout, and two
+    // more devenv setups pay for themselves twice. One job, no artifacts.
+    workflow = `${renderPublishWorkflowHeader(options)}${renderSingleJobPublishWorkflowSteps(
+      definePublishWorkflow(options).steps,
+      options,
+    )}`;
   } else if (hasLinuxPlatformTargets(options)) {
     workflow = `${renderPublishWorkflowHeader(options)}${renderSingleJobPublishWorkflowSteps(
       definePublishWorkflow(options).steps,
@@ -475,7 +484,7 @@ jobs:
   publish:
 ${options.release === false ? renderRunsOnLine(options.runsOn) : publishJobRunsOnLine(options)}
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}${platformProducerJobEnv(options)}
     steps:
 `;
 }
@@ -749,11 +758,25 @@ function renderSingleJobPublishWorkflowSteps(
   options: PublishWorkflowDefinitionOptions,
 ): string {
   const lines: string[] = [];
+  const producer = options.platformProducer;
+  const crossOnThisRunner = skipsPublishHandoff(options) && hasMacosPlatformTargets(options);
   for (const step of steps) {
     lines.push(...sectionLinesBefore(step));
     lines.push(...commentLinesForStep(step));
     lines.push(...yamlLinesForStep(step, options));
     lines.push('');
+    if (crossOnThisRunner && producer && step.kind === PublishWorkflowStepKind.Checkout) {
+      // Before any toolchain setup or build, exactly as the dedicated producer
+      // job ordered it: the SDK has to be on disk before devenv resolves it.
+      lines.push(
+        '      - name: Check cross-platform toolchain prerequisites',
+        '        working-directory: .',
+        '        run: |',
+        '          set -euo pipefail',
+        ...producer.preflight.split('\n').map((line) => `          ${line}`),
+        '',
+      );
+    }
     if (step.kind === PublishWorkflowStepKind.Build) {
       lines.push(
         '      - name: 🐧 Build supplemental Linux targets',
@@ -763,6 +786,16 @@ function renderSingleJobPublishWorkflowSteps(
         )}"`,
         '',
       );
+      if (crossOnThisRunner) {
+        lines.push(
+          '      - name: 🍎 Build selected macOS and iOS release outputs',
+          "        if: steps.version.outputs.mode != 'none'",
+          `        run: smoo github-ci nx-run-many --targets "${macosPlatformFamilies(options).join(',')}" --projects "${githubExpression(
+            'steps.version.outputs.projects',
+          )}"`,
+          '',
+        );
+      }
     }
   }
   return `${lines.join('\n').trimEnd()}\n`;
@@ -1423,6 +1456,41 @@ function githubExpression(expression: string): string {
   return ['$', '{{ ', expression, ' }}'].join('');
 }
 
+/**
+ * Whether the separate publishing job can be dropped, so the release runs as
+ * one job that builds every artifact and publishes them.
+ *
+ * The hand-off exists for ONE reason: npmjs mints provenance from the
+ * publishing job's OIDC token and refuses a self-hosted runner for it, so a
+ * release with public packages must publish from the GitHub-hosted runner and
+ * therefore has to receive its self-hosted artifacts through an artifact.
+ * A release that publishes only to the declared private registry has no such
+ * constraint; when its Apple targets are cross-built on the same runner (or it
+ * has none), one job holds everything.
+ */
+function skipsPublishHandoff(options: PublishWorkflowDefinitionOptions): boolean {
+  if (options.actionsProvider !== 'forgejo' || options.privateNpm === undefined) {
+    return false;
+  }
+  return !hasMacosPlatformTargets(options) || options.platformProducer?.kind === 'linux-cross';
+}
+
+/**
+ * Toolchain environment for a foreign-platform producer, rendered onto whichever
+ * job runs its builds. In the flattened single-job shape that is the publish job
+ * itself, so the SDK path and cross flags have to reach it the same way the
+ * dedicated producer job received them.
+ */
+function platformProducerJobEnv(options: PublishWorkflowDefinitionOptions): string {
+  const producer = options.platformProducer;
+  if (!producer || !skipsPublishHandoff(options)) {
+    return '';
+  }
+  return Object.entries(producer.env ?? {})
+    .map(([name, value]) => `\n      ${name}: ${JSON.stringify(value)}`)
+    .join('');
+}
+
 function privateNpmInstallJobEnv(options: PublishWorkflowDefinitionOptions): string {
   const tokenEnv = options.privateNpm?.readTokenEnv;
   if (!tokenEnv) {