@smoothbricks/cli 0.11.16 → 0.11.18

package/README.md

@@ -351,10 +351,18 @@ wraps prose body paragraphs through `fmt -w 72` while preserving fenced code blo
 bullets, trailers, URLs, and comment lines.
 
 The generated pre-push hook runs only on macOS. Linux `nx lint` already compiles the Linux `cfg(target_os)` arm; Darwin
-does not. The hook runs `nx run-many -t cargo-lint-cross`. Nx caches that target on the Cargo inputs, so a hit is a
-prior real Linux clippy and never enters linux-cross. A miss falls through to `bun run check:linux`, which is
-`tooling/devenv --quiet -P linux-cross shell --` around that same Nx target and writes the cache. `git push --no-verify`
-skips the hook.
+does not. The hook is a probe: it runs `env -u CC_x86_64_unknown_linux_gnu nx run-many -t cargo-lint-cross` and nothing
+else. Nx caches that target on the Cargo inputs, so a hit is a prior real Linux clippy and the push proceeds. A miss
+refuses the push and names `bun run check:linux` — the hook never enters linux-cross and never starts a compile, so what
+it costs is one Nx graph construction rather than an unbounded clippy. `bun run check:linux` is
+`tooling/devenv -P linux-cross shell --` around that same Nx target; it is the only place the gate actually runs, so it
+is deliberately not quiet. `git push --no-verify` skips the hook.
+
+The toolchain variable is unset for the probe on purpose. The target's own command reads it to decide whether the cross
+toolchain is present, so a push made from inside an already-entered linux-cross shell would otherwise fall through into
+a real multi-minute compile — the thing the probe exists to avoid. It is not a declared input of the target, so
+unsetting it cannot change the task hash: a warm entry still hits. Measured both ways, including with the variable set
+to a nonexistent compiler.
 
 Conventional commit scopes should use Nx project names. For packages in the same npm scope as the root package, smoo
 requires `package.json` `nx.name` to be the unscoped package name, such as `cli` for `@smoothbricks/cli`, so subjects
@@ -428,6 +436,49 @@ that runs after Validate and the e2e job succeed on a push to the staging push b
 stage-derived — carry `stage-deploy-target` or deploy through `smoo wrangler deploy-stage` — otherwise `--select-tag`
 finds nothing and the job logs `No run-many deploy projects; skipping production.`
 
+#### Ordering one deploy after another
+
+When a project's deploy calls into what another project deploys — a site that signs in to its stage's backend — say so
+with an ordinary Nx edge on the deploying project:
+
+```json
+{ "nx": { "targets": { "deploy": { "dependsOn": ["...", "app-backend:deploy"] } } } }
+```
+
+Nx then orders it, at any depth: `site:deploy` after `app-backend:deploy` after `db:deploy` all resolve inside the one
+`nx run-many` that `smoo github-ci nx-deploy` already issues, and `nx deploy site --stage=…` run by hand gets the same
+order. Keep the leading `"..."`: it expands the `deploy-build` edge the plugin infers (below), which a bare list would
+drop.
+
+What makes the edge safe is that a deploy is never cached and always cheap when there is nothing to do:
+
+- `@smoothbricks/nx-plugin` gives every declared `deploy` target `cache: false`. An Nx cache hit on a deploy means "we
+  once uploaded this hash", which a rollback silently falsifies — the workspace is unchanged, so the hash is unchanged,
+  so a cached deploy would report success while the previous version keeps serving.
+- `smoo wrangler deploy-stage` reads live state first. If the version tagged with this task's hash is already the one
+  serving 100% of traffic, it returns `remote-cache-hit` after two API calls: no upload, no migration, no traffic shift.
+- The expensive, purely file-derived half belongs in a sibling `deploy-build` target (build the artifact, register it,
+  refresh what the build needs). The plugin gives that one `cache: true` and makes `deploy` depend on it, so a redundant
+  deploy costs two API calls rather than a rebuild.
+- A deploy does not finish when Cloudflare accepts the traffic shift; it finishes when the new version is the one being
+  served. `deploy-stage` polls `wrangler deployments status` until the tag it activated is live, and fails with what it
+  expected and what it saw if that never happens. Pass `--version-endpoint <url>` to also require an endpoint served by
+  the worker — whose trimmed response body is the running version tag — to answer with it. Without that wait, an edge
+  onto a deploy orders nothing: the step returns while the edge still serves the old code.
+
+**The policy caveat, plainly.** A cross-project edge is part of the graph, not of the selection: a run that selects only
+the dependent project will still evaluate the dependency's `deploy`. When the dependency is already at that hash, that
+evaluation is a no-op — two API calls. But it is not inert: if the dependency is intentionally behind (its production
+deploy is being held back, say), a run that selects only the dependent project **will advance the dependency to the hash
+the current workspace produces**. If you need a project to be deployable without touching what it depends on, do not add
+the edge; sequence those two deploys as separate CI jobs instead.
+
+`smoo wrangler deployed-version --stage <stage>` prints the tag serving all traffic for the project's worker on that
+stage, so an operator can check the same fact the deploy checks. It caches its answer briefly under Nx's workspace data
+directory; that cache is a convenience for repeated queries only. Nothing that decides whether to deploy reads it, and
+it refuses — rather than answering `unknown` — without credentials, on an API error, or while traffic is split between
+two versions.
+
 Pushes to the staging push branch queue behind a running workflow instead of canceling it, so a newer push never cancels
 a production deployment mid-flight. Pull requests and other branches keep canceling superseded runs. The e2e and
 production jobs repeat the Cargo credential and sibling-source preflight before SetupDevenv, so their `--step` anchors
@@ -675,6 +726,16 @@ resource carrying the `prN` segment, D1 included.
   fall back to that variable and rename the worker after it.
 - The secrets manifest (`.dev.vars.example`) and the temporary secrets file come from the working directory, not from
   beside the `--config` file.
+- Secrets are gated per stage. `smoo.wrangler.secretStages` in the project's `package.json` maps a declared secret name
+  to the stages that require it, and the mapping cuts both ways: a listed stage REFUSES to deploy when that secret has
+  no value in the environment and none on the Worker, and an unlisted stage never RECEIVES it even when the deploying
+  shell exports one. `preview` matches any `prN`. A name absent from the map is required by every stage.
+- The refusal happens before any Cloudflare mutation and names every missing secret at once, so a first deploy reports
+  the whole list instead of one name per attempt. Values never appear in a message or in argv.
+- Both directions are load-bearing, and neither is a lint. `--secrets-file` applies additively — wrangler deletes
+  nothing it is not told about — so a secret introduced after a stage's first deploy would otherwise never arrive and
+  the Worker would keep serving without it, silently. And a token scoped to preview stages, exported by a shell that
+  also deploys production, would otherwise install a test-only capability into production.
 - Migrations run only for the D1 bindings that declare a `migrations_dir`.
 - For a `prN` stage, an R2 bucket or D1 database whose name has no exact `staging` segment is refused, before any
   Cloudflare resource is created: reusing the name verbatim would share staging's data with the pull request.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAWA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAcxE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBhD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAaA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAcxE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBhD"}

package/dist/cli.js

@@ -6,7 +6,9 @@ import { cliPackageVersion } from './lib/cli-package.js';
 import { decode, findRepoRoot, printCommandOutput } from './lib/run.js';
 import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { secretsSet, secretsStatus, secretsSync } from './secrets/commands.js';
 import { cleanupPullRequest, deployStage } from './wrangler/deploy-stage.js';
+import { deployedVersion } from './wrangler/deployed-version.js';
 import { scaffold } from './wrangler/scaffold.js';
 export async function runCli(argv = process.argv.slice(2)) {
     const program = buildProgram();
@@ -420,6 +422,33 @@ function buildProgram() {
         .action(async () => {
         await ensureChromium();
     });
+    const secrets = program
+        .command('secrets')
+        .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
+    secrets
+        .command('status')
+        .description('Show every declared secret with the scopes holding it, and refuse when a workflow passes one none has')
+        .option('-R, --repo <owner/name|remote>', "repository or remote name; defaults to the current branch's upstream remote")
+        .option('--env <environment>', "also read this GitHub Environment; its value takes precedence over the repository's for a job bound to it")
+        .action(async (options) => {
+        process.exitCode = secretsStatus(await findRepoRoot(), options);
+    });
+    secrets
+        .command('set [name]')
+        .description('Set secrets from pasted values; with no name, prompts for every secret the target scope still lacks')
+        .option('-R, --repo <owner/name|remote>', "repository or remote name; defaults to the current branch's upstream remote")
+        .option('--env <environment>', "write into this GitHub Environment; its value takes precedence over the repository's for a job bound to it")
+        .action(async (name, options) => {
+        process.exitCode = await secretsSet(await findRepoRoot(), name, options);
+    });
+    secrets
+        .command('sync')
+        .description('Push every secret smoo.secrets can fetch locally to the repository')
+        .option('-R, --repo <owner/name|remote>', "repository or remote name; defaults to the current branch's upstream remote")
+        .option('--env <environment>', "write into this GitHub Environment; its value takes precedence over the repository's for a job bound to it")
+        .action(async (options) => {
+        process.exitCode = await secretsSync(await findRepoRoot(), options);
+    });
     const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
     wrangler
         .command('scaffold <project>')
@@ -432,11 +461,29 @@ function buildProgram() {
         .command('deploy-stage')
         .requiredOption('--stage <stage>', 'staging, production, or prN')
         .option('--config <path>', 'deploy a build-generated flat wrangler.json instead of ./wrangler.toml')
+        .option('--version-endpoint <url>', 'URL served by this worker whose trimmed body is the running version tag')
         .action(async (options) => {
         await deployStage(process.cwd(), {
             stage: options.stage,
             ...(options.config ? { config: resolve(options.config) } : {}),
+            ...(options.versionEndpoint ? { versionEndpoint: options.versionEndpoint } : {}),
+        });
+    });
+    wrangler
+        .command('deployed-version')
+        .description('Print the version tag serving all traffic for this project\u2019s worker on a stage')
+        .requiredOption('--stage <stage>', 'staging, production, or prN')
+        .option('--config <path>', 'resolve the worker name from a build-generated flat wrangler.json')
+        .option('--refresh', 'ask Cloudflare even when a fresh cached answer exists')
+        .action(async (options) => {
+        const report = await deployedVersion(process.cwd(), {
+            stage: options.stage,
+            ...(options.config ? { config: resolve(options.config) } : {}),
+            ...(options.refresh ? { refresh: true } : {}),
         });
+        // The tag alone on stdout: this is read by humans and by `$(...)`, and a version deployed
+        // outside Nx genuinely has no tag, which `untagged` says without pretending to be one.
+        console.log(report.versionTag ?? 'untagged');
     });
     wrangler
         .command('cleanup-pr')

package/dist/github-ci/index.d.ts

@@ -68,7 +68,7 @@ export interface GithubCiNxDeployOptions {
     selectTag?: string;
 }
 export interface GithubCiNxDeployDependencies {
-    listProjects?: (root: string, target: string, mode: 'affected' | 'run-many', stage: DeploymentStage, selectTag?: string) => Promise<string[]>;
+    listProjects?: (root: string, mode: 'affected' | 'run-many', stage: DeploymentStage, selectTag?: string) => Promise<string[]>;
     runNx?: (args: string[], root: string) => Promise<number>;
     appendSummary?: (summaryPath: string, content: string) => Promise<void>;
     appendOutput?: (outputPath: string, content: string) => Promise<void>;

package/dist/github-ci/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAmBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAiFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA+BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAmBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAmFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA2BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}

package/dist/github-ci/index.js

@@ -260,9 +260,9 @@ export async function githubCiNxDeploy(root, options, dependencies = {}) {
     const setStatus = dependencies.setStatus ??
         ((state) => state === 'pending' ? createGithubStatus(name, step) : updateGithubStatus(name, state, step));
     const mode = resolveNxSmartMode(options.mode ?? 'run-many');
-    const listProjects = dependencies.listProjects ?? listNxProjectsWithTarget;
+    const listProjects = dependencies.listProjects ?? listNxDeployProjects;
     const runNx = dependencies.runNx ?? ((args, commandRoot) => runStatus('nx', args, commandRoot));
-    const projects = await listProjects(root, 'deploy', mode, stage, options.selectTag);
+    const projects = await listProjects(root, mode, stage, options.selectTag);
     if (projects.length === 0) {
         console.log(`No ${mode} deploy projects; skipping ${stage}.`);
         await setStatus('pending');
@@ -275,8 +275,8 @@ export async function githubCiNxDeploy(root, options, dependencies = {}) {
         ? { stage, urls: previewUrlsForStage(github?.previewUrls, stage) }
         : undefined;
     await setStatus('pending');
-    const projectList = projects.join(',');
     const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
+    const projectList = projects.join(',');
     for (const target of targets) {
         const nxArgs = [
             'run-many',
@@ -286,6 +286,8 @@ export async function githubCiNxDeploy(root, options, dependencies = {}) {
             `--exclude=${deployExclusions(stage)}`,
             `--parallel=${NX_PARALLEL}`,
         ];
+        // Deploy ordering is a `dependsOn` edge in the project graph, not a second round here: one run-many
+        // already sequences any depth of `a:deploy -> b:deploy -> c:deploy`.
         if (target === 'deploy') {
             nxArgs.push(`--stage=${stage}`);
         }
@@ -413,17 +415,12 @@ function previewUrlFromTemplate(template, stage) {
         throw new Error(`preview URL template "${template}" must contain {stage}`);
     return template.replaceAll('{stage}', stage);
 }
-async function listNxProjectsWithTarget(root, target, mode, stage, selectTag) {
+async function listNxDeployProjects(root, mode, stage, selectTag) {
     const listArgs = ['show', 'projects'];
     if (mode === 'affected')
         listArgs.push('--affected');
-    listArgs.push('--withTarget', target);
-    if (target === 'deploy')
-        listArgs.push(`--exclude=${deployExclusions(stage)}`);
-    listArgs.push('--json');
+    listArgs.push('--withTarget', 'deploy', `--exclude=${deployExclusions(stage)}`, '--json');
     const candidates = nxProjectList(await runText('nx', listArgs, root)).sort((left, right) => left.localeCompare(right));
-    if (target !== 'deploy')
-        return candidates;
     return selectStageDeployProjects(candidates, stage, selectTag, async (project) => {
         const parsed = parseNxProjectDeployTarget(await runText('nx', ['show', 'project', project, '--json'], root));
         if (!parsed)

package/dist/lib/secret-names.d.ts

@@ -0,0 +1,35 @@
+/**
+ * One rule for naming the repository secret behind an environment variable, so
+ * the workflow renderer, the reconciler and an operator all derive the same
+ * name instead of maintaining a map.
+ *
+ * GitHub refuses to create a secret whose name starts with `GITHUB_` (hence
+ * `RepositorySecretName`'s pattern), which is why a Worker's
+ * `GITHUB_CLIENT_SECRET` cannot be stored under its own name. Prefixing with
+ * the repository owner is the workaround operators already reach for by hand
+ * (`ACME_GITHUB_CLIENT_SECRET` for `acme/app`); making it the convention means
+ * nothing has to declare it.
+ */
+/** Names GitHub reserves: it rejects `gh secret set GITHUB_*` outright. */
+export declare function isReservedRepositorySecretName(envName: string): boolean;
+/**
+ * The repository secret an env name lives in. Identity for every name GitHub
+ * accepts; owner-prefixed for the reserved ones. `owner` comes from the
+ * repository URL, so a fork or a rename derives its own names rather than
+ * inheriting a hardcoded prefix.
+ */
+export declare function conventionalRepositorySecretName(envName: string, owner: string): string;
+/**
+ * Resolve the whole env -> secret mapping for a set of declared env names.
+ * Explicit entries win: an exception stays expressible, but a repository that
+ * follows the convention declares nothing.
+ */
+export declare function repositorySecretMapping(envNames: readonly string[], owner: string, declared?: Readonly<Record<string, string>>): Record<string, string>;
+/**
+ * Repository owner from a repository URL — `acme` from
+ * `https://github.com/acme/app.git`, and the same for an ssh or forge
+ * URL. The owner is derived rather than configured so a fork or a rename
+ * carries its own prefix instead of inheriting one.
+ */
+export declare function repositoryOwnerFromUrl(url: string): string | null;
+//# sourceMappingURL=secret-names.d.ts.map

package/dist/lib/secret-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-names.d.ts","sourceRoot":"","sources":["../../src/lib/secret-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,2EAA2E;AAC3E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,GAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKjE"}

package/dist/lib/secret-names.js

@@ -0,0 +1,61 @@
+/**
+ * One rule for naming the repository secret behind an environment variable, so
+ * the workflow renderer, the reconciler and an operator all derive the same
+ * name instead of maintaining a map.
+ *
+ * GitHub refuses to create a secret whose name starts with `GITHUB_` (hence
+ * `RepositorySecretName`'s pattern), which is why a Worker's
+ * `GITHUB_CLIENT_SECRET` cannot be stored under its own name. Prefixing with
+ * the repository owner is the workaround operators already reach for by hand
+ * (`ACME_GITHUB_CLIENT_SECRET` for `acme/app`); making it the convention means
+ * nothing has to declare it.
+ */
+/** Names GitHub reserves: it rejects `gh secret set GITHUB_*` outright. */
+export function isReservedRepositorySecretName(envName) {
+    return /^GITHUB_/i.test(envName);
+}
+/**
+ * The repository secret an env name lives in. Identity for every name GitHub
+ * accepts; owner-prefixed for the reserved ones. `owner` comes from the
+ * repository URL, so a fork or a rename derives its own names rather than
+ * inheriting a hardcoded prefix.
+ */
+export function conventionalRepositorySecretName(envName, owner) {
+    if (!isReservedRepositorySecretName(envName))
+        return envName;
+    const prefix = owner
+        .replace(/[^A-Za-z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '')
+        .toUpperCase();
+    if (prefix.length === 0) {
+        throw new Error(`Cannot derive a repository secret name for ${envName}: GitHub reserves the GITHUB_ prefix and the repository owner is empty.`);
+    }
+    return `${prefix}_${envName}`;
+}
+/**
+ * Resolve the whole env -> secret mapping for a set of declared env names.
+ * Explicit entries win: an exception stays expressible, but a repository that
+ * follows the convention declares nothing.
+ */
+export function repositorySecretMapping(envNames, owner, declared = {}) {
+    const mapping = {};
+    for (const envName of [...envNames].sort((left, right) => left.localeCompare(right))) {
+        mapping[envName] = declared[envName] ?? conventionalRepositorySecretName(envName, owner);
+    }
+    for (const [envName, secretName] of Object.entries(declared)) {
+        mapping[envName] = secretName;
+    }
+    return mapping;
+}
+/**
+ * Repository owner from a repository URL — `acme` from
+ * `https://github.com/acme/app.git`, and the same for an ssh or forge
+ * URL. The owner is derived rather than configured so a fork or a rename
+ * carries its own prefix instead of inheriting one.
+ */
+export function repositoryOwnerFromUrl(url) {
+    const withoutProtocol = url.replace(/^[a-z+]+:\/\//i, '').replace(/^git@/i, '');
+    const path = withoutProtocol.replace(/^[^/:]+[/:]/, '');
+    const owner = path.split('/')[0];
+    return owner && owner.length > 0 ? owner.replace(/\.git$/i, '') : null;
+}

package/dist/monorepo/ci-workflow.d.ts

@@ -10,6 +10,11 @@ export declare enum CiWorkflowStepKind {
     BrowserTests = "browser-tests",
     Lint = "lint",
     UnitTests = "unit-tests",
+    CrossToolchainPreflight = "cross-toolchain-preflight",
+    CrossTestArchives = "cross-test-archives",
+    UploadCrossTestArchives = "upload-cross-test-archives",
+    DownloadCrossTestArchives = "download-cross-test-archives",
+    CrossTests = "cross-tests",
     ManagedFilesCheck = "managed-files-check",
     ManagedFilesDispatch = "managed-files-dispatch",
     Deploy = "deploy",
@@ -34,6 +39,22 @@ export interface DeployStepSecretConfig {
     /** Extra deploy-step secrets, env var name → repository secret name. */
     deploySecrets?: Record<string, string>;
 }
+/**
+ * One foreign target triple's test archive: what the Linux job cross-builds and
+ * a native runner executes.
+ *
+ * Both fields are DERIVED, never hand-written: the triple comes from the cargo
+ * workspace's `[workspace.metadata.smoothbricks.test] cross-targets`, and the
+ * path is where the inferred `cargo-cross-test-archive-<triple>` target
+ * declares its output. That is why this is not a `smoo.github` key — a triple
+ * repeated in CI config could name an archive the graph cannot build, and the
+ * workflow would only find out on the runner.
+ */
+export interface CiCrossTestArchive {
+    triple: string;
+    /** Repository-relative path of the archive file, from the target's output. */
+    path: string;
+}
 export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
     actionsProvider?: PackageSmooGithub['actionsProvider'];
     deploy: boolean;
@@ -75,6 +96,41 @@ export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
     e2eSecrets?: Record<string, string>;
     /** Emit the production-on-push job (some project carries PRODUCTION_PUSH_DEPLOY_TAG). */
     productionOnPush?: boolean;
+    /**
+     * Cross-built test archives, one per foreign target triple the cargo
+     * workspace declares. The Linux job builds and uploads each one; a second job
+     * downloads the `*-apple-darwin` ones and EXECUTES them on `macosRunsOn`,
+     * which is how a cross compile gets proved by running rather than by linking.
+     *
+     * Empty or absent renders exactly what a repository without cross archives
+     * renders — no step, no job, no numbering shift.
+     */
+    crossTestArchives?: readonly CiCrossTestArchive[];
+    /**
+     * macOS runner labels for the darwin execution job
+     * (`smoo.github.macosRunsOn`, the same labels the publish workflow's macOS
+     * legs use). Default macos-latest.
+     *
+     * A self-hosted label here is one specific machine. That machine being asleep
+     * does not skip the job: it queues, and the run FAILS on the job's
+     * `timeout-minutes`. That is the trade this opt-in buys — a red run when the
+     * Mac is unreachable, in exchange for the darwin binaries being tested by
+     * execution at all. `continue-on-error` would buy the green back by making
+     * the job unable to report anything, which is worse than not having it.
+     */
+    macosRunsOn?: string | string[];
+    /**
+     * Declared Linux cross-platform producer (`smoo.github.platformProducer`):
+     * the toolchain preflight and the environment a foreign-target build needs on
+     * a Linux runner. The publish workflow already renders this declaration for
+     * its cross artifact job, so the cross test archive reuses it rather than
+     * carrying a second copy of one repository's SDK and linker setup.
+     *
+     * Rendered STEP-scoped here, never as job env: this environment turns the
+     * repository's native producers into cross producers, and Validate's other
+     * steps are host builds that must stay host builds.
+     */
+    platformProducer?: PackageSmooGithub['platformProducer'];
 }
 export declare function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkflowStep[];
 export declare function renderCiWorkflowYaml(options: CiWorkflowDefinitionOptions): string;

package/dist/monorepo/ci-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CAgCvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CAQjF;AAyDD,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAS3F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAgB/F;AA+BD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAyG9G;AAqCD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAkC9G;AAqGD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AA8HD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,uBAAuB,8BAA8B;IACrD,iBAAiB,wBAAwB;IACzC,uBAAuB,+BAA+B;IACtD,yBAAyB,iCAAiC;IAC1D,UAAU,gBAAgB;IAC1B,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CA4CvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CASjF;AAkED,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AAiPD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAS3F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAgB/F;AA+BD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAyG9G;AAqCD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAkC9G;AAqGD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AAiRD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}