@smoothbricks/cli 0.11.17 → 0.11.19

package/README.md

@@ -351,10 +351,18 @@ wraps prose body paragraphs through `fmt -w 72` while preserving fenced code blo
 bullets, trailers, URLs, and comment lines.
 
 The generated pre-push hook runs only on macOS. Linux `nx lint` already compiles the Linux `cfg(target_os)` arm; Darwin
-does not. The hook runs `nx run-many -t cargo-lint-cross`. Nx caches that target on the Cargo inputs, so a hit is a
-prior real Linux clippy and never enters linux-cross. A miss falls through to `bun run check:linux`, which is
-`tooling/devenv --quiet -P linux-cross shell --` around that same Nx target and writes the cache. `git push --no-verify`
-skips the hook.
+does not. The hook is a probe: it runs `env -u CC_x86_64_unknown_linux_gnu nx run-many -t cargo-lint-cross` and nothing
+else. Nx caches that target on the Cargo inputs, so a hit is a prior real Linux clippy and the push proceeds. A miss
+refuses the push and names `bun run check:linux` — the hook never enters linux-cross and never starts a compile, so what
+it costs is one Nx graph construction rather than an unbounded clippy. `bun run check:linux` is
+`tooling/devenv -P linux-cross shell --` around that same Nx target; it is the only place the gate actually runs, so it
+is deliberately not quiet. `git push --no-verify` skips the hook.
+
+The toolchain variable is unset for the probe on purpose. The target's own command reads it to decide whether the cross
+toolchain is present, so a push made from inside an already-entered linux-cross shell would otherwise fall through into
+a real multi-minute compile — the thing the probe exists to avoid. It is not a declared input of the target, so
+unsetting it cannot change the task hash: a warm entry still hits. Measured both ways, including with the variable set
+to a nonexistent compiler.
 
 Conventional commit scopes should use Nx project names. For packages in the same npm scope as the root package, smoo
 requires `package.json` `nx.name` to be the unscoped package name, such as `cli` for `@smoothbricks/cli`, so subjects
@@ -422,11 +430,28 @@ access makes cleanup refuse before it deletes anything rather than half-clean a
 A wrong value type anywhere in `smoo.github` fails `smoo monorepo update` and `smoo github-ci nx-deploy` with the
 offending path, rather than silently falling back to the defaults.
 
+#### What CI deploys: the deploy tags
+
+A `deploy` target says a project CAN be deployed. Four Nx tags say whether CI does, and they are the only thing that
+says so: the generated workflows and `smoo github-ci nx-deploy` read one rule, so a repository cannot render a deploy
+job that deploys nothing, nor deploy a project no job announced.
+
+- `stage-deploy-target`: deployed on every stage — pull-request previews, staging, and production.
+- `staging-deploy-target`: deployed on staging only, for infrastructure the pull-request stages share.
+- `permanent-deploy-target`: excluded from every stage deploy; deployed outside the stage flow.
+- `production-push-deploy-target`: also deployed by the generated production-on-push job (below).
+
+An untagged `deploy` target is deployable by hand — `nx run <project>:deploy --stage=pr42` — and invisible to CI. A
+repository where no project carries one of these tags gets no deploy step, no `deployments: write` permission, no
+Cloudflare credentials and no `pr-preview-cleanup.yml`, however many wrangler manifests its packages hold: a published
+library ships one to document a Durable Object binding for its consumers, and that manifest looks exactly like a
+deployable worker's.
+
 Tag a project `production-push-deploy-target` to have it deployed to production by a generated `deploy-production` job
 that runs after Validate and the e2e job succeed on a push to the staging push branch
-(`smoo github-ci nx-deploy --stage production --select-tag production-push-deploy-target`). The project must also be
-stage-derived — carry `stage-deploy-target` or deploy through `smoo wrangler deploy-stage` — otherwise `--select-tag`
-finds nothing and the job logs `No run-many deploy projects; skipping production.`
+(`smoo github-ci nx-deploy --stage production --select-tag production-push-deploy-target`). The project must also carry
+`stage-deploy-target`, otherwise `--select-tag` finds nothing and the job logs
+`No run-many deploy projects; skipping production.`
 
 #### Ordering one deploy after another
 
@@ -444,9 +469,9 @@ drop.
 
 What makes the edge safe is that a deploy is never cached and always cheap when there is nothing to do:
 
-- `@smoothbricks/nx-plugin` gives every declared `deploy` target `cache: false`. An Nx cache hit on a deploy means "we
-  once uploaded this hash", which a rollback silently falsifies — the workspace is unchanged, so the hash is unchanged,
-  so a cached deploy would report success while the previous version keeps serving.
+- `@smoothbricks/nx-plugin` gives the `deploy` it infers `cache: false`. An Nx cache hit on a deploy means "we once
+  uploaded this hash", which a rollback silently falsifies — the workspace is unchanged, so the hash is unchanged, so a
+  cached deploy would report success while the previous version keeps serving.
 - `smoo wrangler deploy-stage` reads live state first. If the version tagged with this task's hash is already the one
   serving 100% of traffic, it returns `remote-cache-hit` after two API calls: no upload, no migration, no traffic shift.
 - The expensive, purely file-derived half belongs in a sibling `deploy-build` target (build the artifact, register it,
@@ -718,6 +743,16 @@ resource carrying the `prN` segment, D1 included.
   fall back to that variable and rename the worker after it.
 - The secrets manifest (`.dev.vars.example`) and the temporary secrets file come from the working directory, not from
   beside the `--config` file.
+- Secrets are gated per stage. `smoo.wrangler.secretStages` in the project's `package.json` maps a declared secret name
+  to the stages that require it, and the mapping cuts both ways: a listed stage REFUSES to deploy when that secret has
+  no value in the environment and none on the Worker, and an unlisted stage never RECEIVES it even when the deploying
+  shell exports one. `preview` matches any `prN`. A name absent from the map is required by every stage.
+- The refusal happens before any Cloudflare mutation and names every missing secret at once, so a first deploy reports
+  the whole list instead of one name per attempt. Values never appear in a message or in argv.
+- Both directions are load-bearing, and neither is a lint. `--secrets-file` applies additively — wrangler deletes
+  nothing it is not told about — so a secret introduced after a stage's first deploy would otherwise never arrive and
+  the Worker would keep serving without it, silently. And a token scoped to preview stages, exported by a shell that
+  also deploys production, would otherwise install a test-only capability into production.
 - Migrations run only for the D1 bindings that declare a `migrations_dir`.
 - For a `prN` stage, an R2 bucket or D1 database whose name has no exact `staging` segment is refused, before any
   Cloudflare resource is created: reusing the name verbatim would share staging's data with the pull request.

package/dist/cli.js

@@ -427,22 +427,25 @@ function buildProgram() {
         .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
     secrets
         .command('status')
-        .description('Show every declared secret and refuse when a workflow passes one the repository lacks')
-        .option('--repo <owner/name>', 'repository to read secrets from; defaults to the current checkout')
+        .description('Show every declared secret with the scopes holding it, and refuse when a workflow passes one none has')
+        .option('-R, --repo <owner/name|remote>', "repository or remote name; defaults to the current branch's upstream remote")
+        .option('--env <environment>', "also read this GitHub Environment; its value takes precedence over the repository's for a job bound to it")
         .action(async (options) => {
         process.exitCode = secretsStatus(await findRepoRoot(), options);
     });
     secrets
-        .command('set <name>')
-        .description('Set one repository secret from a pasted value; the value is read without echo and never logged')
-        .option('--repo <owner/name>', 'repository to set the secret on')
+        .command('set [name]')
+        .description('Set secrets from pasted values; with no name, prompts for every secret the target scope still lacks')
+        .option('-R, --repo <owner/name|remote>', "repository or remote name; defaults to the current branch's upstream remote")
+        .option('--env <environment>', "write into this GitHub Environment; its value takes precedence over the repository's for a job bound to it")
         .action(async (name, options) => {
-        process.exitCode = await secretsSet(name, options);
+        process.exitCode = await secretsSet(await findRepoRoot(), name, options);
     });
     secrets
         .command('sync')
         .description('Push every secret smoo.secrets can fetch locally to the repository')
-        .option('--repo <owner/name>', 'repository to set the secrets on')
+        .option('-R, --repo <owner/name|remote>', "repository or remote name; defaults to the current branch's upstream remote")
+        .option('--env <environment>', "write into this GitHub Environment; its value takes precedence over the repository's for a job bound to it")
         .action(async (options) => {
         process.exitCode = await secretsSync(await findRepoRoot(), options);
     });

package/dist/github-ci/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAmBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAmFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA2BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAiBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAmFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA2BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}

package/dist/github-ci/index.js

@@ -4,7 +4,7 @@ import { appendFile } from 'node:fs/promises';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { $ } from 'bun';
 import typia from 'typia';
-import { isStageDerivedDeploy, PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import { ciPushBranches, isNonEmpty, parseStringArrayText, readSmooGithub, } from '../lib/json.js';
 import { decode, printCommandOutput, run, runStatus, runText } from '../lib/run.js';
 import { readProjectTargets } from '../nx/index.js';
@@ -25,19 +25,11 @@ const isGithubDeployment = (() => {
     return input => "object" === typeof input && null !== input && _io0(input);
 })();
 const isNxProjectDeployTarget = (() => {
-    const _ip0 = input => true;
-    const _io0 = input => true && (undefined === input.targets || "object" === typeof input.targets && null !== input.targets && false === Array.isArray(input.targets) && _io1(input.targets));
-    const _io1 = input => undefined === input.deploy || "object" === typeof input.deploy && null !== input.deploy && false === Array.isArray(input.deploy) && _io2(input.deploy);
-    const _io2 = input => _ip0(input) && (undefined === input.options || "object" === typeof input.options && null !== input.options && false === Array.isArray(input.options) && _io3(input.options));
-    const _io3 = input => _ip0(input);
+    const _io0 = input => undefined === input.tags || Array.isArray(input.tags) && input.tags.every(elem => "string" === typeof elem);
     return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
 })();
 const parseNxProjectDeployTarget = (() => {
-    const _ip0 = input => true;
-    const _io0 = input => true && (undefined === input.targets || "object" === typeof input.targets && null !== input.targets && false === Array.isArray(input.targets) && _io1(input.targets));
-    const _io1 = input => undefined === input.deploy || "object" === typeof input.deploy && null !== input.deploy && false === Array.isArray(input.deploy) && _io2(input.deploy);
-    const _io2 = input => _ip0(input) && (undefined === input.options || "object" === typeof input.options && null !== input.options && false === Array.isArray(input.options) && _io3(input.options));
-    const _io3 = input => _ip0(input);
+    const _io0 = input => undefined === input.tags || Array.isArray(input.tags) && input.tags.every(elem => "string" === typeof elem);
     const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
     return input => { input = JSON.parse(input); return __is(input) ? input : null; };
 })();
@@ -434,17 +426,11 @@ export async function selectStageDeployProjects(candidates, stage, requireTag, l
         const definition = await loadProject(project);
         if (!isNxProjectDeployTarget(definition))
             continue;
-        const deploy = definition.targets?.deploy;
-        const commandValue = deploy?.options?.command ?? deploy?.command;
-        const tags = Array.isArray(definition.tags)
-            ? definition.tags.filter((tag) => typeof tag === 'string')
-            : [];
-        const isStageDerived = isStageDerivedDeploy(tags, typeof commandValue === 'string' ? commandValue : undefined);
-        const isStagingOnly = tags.includes(STAGING_DEPLOY_TAG);
+        const tags = definition.tags;
         // A required tag narrows the stage rules; it never selects a project they exclude.
-        if (requireTag && !tags.includes(requireTag))
+        if (requireTag && !tags?.includes(requireTag))
             continue;
-        if (isStageDerived || (stage === 'staging' && isStagingOnly)) {
+        if (stageDeploysProject(tags, stage)) {
             selected.push(project);
         }
     }

package/dist/lib/deploy-tags.d.ts

@@ -1,3 +1,4 @@
+import type { DeploymentStage } from '../wrangler/stage.js';
 /** Deployed on staging only: infrastructure the pull-request stages share. */
 export declare const STAGING_DEPLOY_TAG = "staging-deploy-target";
 /** Excluded from every stage deploy; deployed outside the stage flow. */
@@ -5,8 +6,21 @@ export declare const PERMANENT_DEPLOY_TAG = "permanent-deploy-target";
 /** Opts a project into the generated production-on-push deploy job. */
 export declare const PRODUCTION_PUSH_DEPLOY_TAG = "production-push-deploy-target";
 /**
- * Whether a deploy target is stage-derived (the tag, or the `smoo wrangler deploy-stage` command) rather than a set of
- * per-stage configurations; CI selection and workflow generation must agree on this.
+ * Whether the stage flow deploys a project, from its TAGS alone — the one rule
+ * CI selection and workflow generation both read, so a generated deploy job and
+ * the projects that job deploys cannot disagree.
+ *
+ * Having a `deploy` target is not that answer. A deploy target says a project
+ * CAN be deployed; only a tag says CI does it. A published library ships a
+ * wrangler manifest to document a Durable Object binding for its consumers, and
+ * that manifest is structurally identical to a deployable worker's — so the
+ * plugin infers `deploy` from one, and a repository that deploys nothing from CI
+ * would otherwise generate a deploy job, with cloud credentials, for it.
+ *
+ * The three tags compose as precedence, not as a set: `permanent` excludes a
+ * project from every stage, `staging` narrows it to one, `stage` generalizes it
+ * to all. `production-push` selects WITHIN this answer (see `--select-tag`) and
+ * never widens it.
  */
-export declare function isStageDerivedDeploy(tags: string[] | undefined, command: string | undefined): boolean;
+export declare function stageDeploysProject(tags: string[] | undefined, stage: DeploymentStage): boolean;
 //# sourceMappingURL=deploy-tags.d.ts.map

package/dist/lib/deploy-tags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-tags.d.ts","sourceRoot":"","sources":["../../src/lib/deploy-tags.ts"],"names":[],"mappings":"AAMA,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErG"}
+{"version":3,"file":"deploy-tags.d.ts","sourceRoot":"","sources":["../../src/lib/deploy-tags.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAK5D,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAK/F"}

package/dist/lib/deploy-tags.js

@@ -9,9 +9,28 @@ export const PERMANENT_DEPLOY_TAG = 'permanent-deploy-target';
 /** Opts a project into the generated production-on-push deploy job. */
 export const PRODUCTION_PUSH_DEPLOY_TAG = 'production-push-deploy-target';
 /**
- * Whether a deploy target is stage-derived (the tag, or the `smoo wrangler deploy-stage` command) rather than a set of
- * per-stage configurations; CI selection and workflow generation must agree on this.
+ * Whether the stage flow deploys a project, from its TAGS alone — the one rule
+ * CI selection and workflow generation both read, so a generated deploy job and
+ * the projects that job deploys cannot disagree.
+ *
+ * Having a `deploy` target is not that answer. A deploy target says a project
+ * CAN be deployed; only a tag says CI does it. A published library ships a
+ * wrangler manifest to document a Durable Object binding for its consumers, and
+ * that manifest is structurally identical to a deployable worker's — so the
+ * plugin infers `deploy` from one, and a repository that deploys nothing from CI
+ * would otherwise generate a deploy job, with cloud credentials, for it.
+ *
+ * The three tags compose as precedence, not as a set: `permanent` excludes a
+ * project from every stage, `staging` narrows it to one, `stage` generalizes it
+ * to all. `production-push` selects WITHIN this answer (see `--select-tag`) and
+ * never widens it.
  */
-export function isStageDerivedDeploy(tags, command) {
-    return tags?.includes(STAGE_DEPLOY_TAG) === true || command?.includes('smoo wrangler deploy-stage') === true;
+export function stageDeploysProject(tags, stage) {
+    if (tags === undefined)
+        return false;
+    if (tags.includes(PERMANENT_DEPLOY_TAG))
+        return false;
+    if (tags.includes(STAGING_DEPLOY_TAG))
+        return stage === 'staging';
+    return tags.includes(STAGE_DEPLOY_TAG);
 }

package/dist/monorepo/ci-workflow.d.ts

@@ -10,6 +10,11 @@ export declare enum CiWorkflowStepKind {
     BrowserTests = "browser-tests",
     Lint = "lint",
     UnitTests = "unit-tests",
+    CrossToolchainPreflight = "cross-toolchain-preflight",
+    CrossTestArchives = "cross-test-archives",
+    UploadCrossTestArchives = "upload-cross-test-archives",
+    DownloadCrossTestArchives = "download-cross-test-archives",
+    CrossTests = "cross-tests",
     ManagedFilesCheck = "managed-files-check",
     ManagedFilesDispatch = "managed-files-dispatch",
     Deploy = "deploy",
@@ -34,6 +39,22 @@ export interface DeployStepSecretConfig {
     /** Extra deploy-step secrets, env var name → repository secret name. */
     deploySecrets?: Record<string, string>;
 }
+/**
+ * One foreign target triple's test archive: what the Linux job cross-builds and
+ * a native runner executes.
+ *
+ * Both fields are DERIVED, never hand-written: the triple comes from the cargo
+ * workspace's `[workspace.metadata.smoothbricks.test] cross-targets`, and the
+ * path is where the inferred `cargo-cross-test-archive-<triple>` target
+ * declares its output. That is why this is not a `smoo.github` key — a triple
+ * repeated in CI config could name an archive the graph cannot build, and the
+ * workflow would only find out on the runner.
+ */
+export interface CiCrossTestArchive {
+    triple: string;
+    /** Repository-relative path of the archive file, from the target's output. */
+    path: string;
+}
 export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
     actionsProvider?: PackageSmooGithub['actionsProvider'];
     deploy: boolean;
@@ -75,6 +96,41 @@ export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
     e2eSecrets?: Record<string, string>;
     /** Emit the production-on-push job (some project carries PRODUCTION_PUSH_DEPLOY_TAG). */
     productionOnPush?: boolean;
+    /**
+     * Cross-built test archives, one per foreign target triple the cargo
+     * workspace declares. The Linux job builds and uploads each one; a second job
+     * downloads the `*-apple-darwin` ones and EXECUTES them on `macosRunsOn`,
+     * which is how a cross compile gets proved by running rather than by linking.
+     *
+     * Empty or absent renders exactly what a repository without cross archives
+     * renders — no step, no job, no numbering shift.
+     */
+    crossTestArchives?: readonly CiCrossTestArchive[];
+    /**
+     * macOS runner labels for the darwin execution job
+     * (`smoo.github.macosRunsOn`, the same labels the publish workflow's macOS
+     * legs use). Default macos-latest.
+     *
+     * A self-hosted label here is one specific machine. That machine being asleep
+     * does not skip the job: it queues, and the run FAILS on the job's
+     * `timeout-minutes`. That is the trade this opt-in buys — a red run when the
+     * Mac is unreachable, in exchange for the darwin binaries being tested by
+     * execution at all. `continue-on-error` would buy the green back by making
+     * the job unable to report anything, which is worse than not having it.
+     */
+    macosRunsOn?: string | string[];
+    /**
+     * Declared Linux cross-platform producer (`smoo.github.platformProducer`):
+     * the toolchain preflight and the environment a foreign-target build needs on
+     * a Linux runner. The publish workflow already renders this declaration for
+     * its cross artifact job, so the cross test archive reuses it rather than
+     * carrying a second copy of one repository's SDK and linker setup.
+     *
+     * Rendered STEP-scoped here, never as job env: this environment turns the
+     * repository's native producers into cross producers, and Validate's other
+     * steps are host builds that must stay host builds.
+     */
+    platformProducer?: PackageSmooGithub['platformProducer'];
 }
 export declare function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkflowStep[];
 export declare function renderCiWorkflowYaml(options: CiWorkflowDefinitionOptions): string;

package/dist/monorepo/ci-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CAgCvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CAQjF;AAkED,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAS3F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAgB/F;AA+BD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAyG9G;AAqCD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAkC9G;AAqGD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AAgID,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,uBAAuB,8BAA8B;IACrD,iBAAiB,wBAAwB;IACzC,uBAAuB,+BAA+B;IACtD,yBAAyB,iCAAiC;IAC1D,UAAU,gBAAgB;IAC1B,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CA4CvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CASjF;AAkED,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AAiPD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAS3F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAgB/F;AA+BD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAyG9G;AAqCD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAkC9G;AAqGD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AAiRD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}

package/dist/monorepo/ci-workflow.js

@@ -1,4 +1,5 @@
 /* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
+import { cargoCrossTestArchiveFile, cargoCrossTestArchiveTargetName, cargoCrossTestTargetName, } from '@smoothbricks/nx-plugin/cross-check-policy';
 import { PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
 import { renderRunsOnLine } from './github-runs-on.js';
 export var CiWorkflowStepKind;
@@ -13,6 +14,11 @@ export var CiWorkflowStepKind;
     CiWorkflowStepKind["BrowserTests"] = "browser-tests";
     CiWorkflowStepKind["Lint"] = "lint";
     CiWorkflowStepKind["UnitTests"] = "unit-tests";
+    CiWorkflowStepKind["CrossToolchainPreflight"] = "cross-toolchain-preflight";
+    CiWorkflowStepKind["CrossTestArchives"] = "cross-test-archives";
+    CiWorkflowStepKind["UploadCrossTestArchives"] = "upload-cross-test-archives";
+    CiWorkflowStepKind["DownloadCrossTestArchives"] = "download-cross-test-archives";
+    CiWorkflowStepKind["CrossTests"] = "cross-tests";
     CiWorkflowStepKind["ManagedFilesCheck"] = "managed-files-check";
     CiWorkflowStepKind["ManagedFilesDispatch"] = "managed-files-dispatch";
     CiWorkflowStepKind["Deploy"] = "deploy";
@@ -33,6 +39,15 @@ export function defineCiWorkflow(options) {
         steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Stage' });
     }
     steps.push({ kind: CiWorkflowStepKind.Lint, name: '🔍 Lint' }, { kind: CiWorkflowStepKind.UnitTests, name: '🧪 Unit Tests' });
+    if (options.crossTestArchives?.length) {
+        if (options.platformProducer !== undefined) {
+            steps.push({
+                kind: CiWorkflowStepKind.CrossToolchainPreflight,
+                name: 'Check cross-platform toolchain prerequisites',
+            });
+        }
+        steps.push({ kind: CiWorkflowStepKind.CrossTestArchives, name: '🎯 Build cross-target test archives' }, { kind: CiWorkflowStepKind.UploadCrossTestArchives, name: '📤 Upload cross-target test archives' });
+    }
     if (options.browserTests) {
         steps.push({ kind: CiWorkflowStepKind.BrowserTests, name: '🌐 Browser Tests' });
     }
@@ -44,6 +59,7 @@ export function renderCiWorkflowYaml(options) {
     return [
         renderCiWorkflowHeader(options),
         renderCiWorkflowSteps(steps, options),
+        renderCrossTestExecutionJob(options),
         renderE2eDeploymentJob(options),
         renderProductionDeployJob(options),
     ].join('');
@@ -216,6 +232,61 @@ function yamlLinesForStep(step, options) {
             return nxSmartStep(step, 'lint', 'Lint');
         case CiWorkflowStepKind.UnitTests:
             return nxSmartStep(step, 'test', 'Unit Tests');
+        case CiWorkflowStepKind.CrossToolchainPreflight:
+            // The repository's own preflight, the same one the publish workflow's
+            // cross artifact job runs — an SDK to provision, a linker to check.
+            // `working-directory: .` because this workflow's steps default to the
+            // direnv shell directory while a preflight is repository-relative.
+            return [
+                `      - name: ${step.name}`,
+                '        working-directory: .',
+                ...platformProducerStepEnvLines(options),
+                '        run: |',
+                '          set -euo pipefail',
+                ...crossToolchainPreflight(options).map((line) => `          ${line}`),
+            ];
+        case CiWorkflowStepKind.CrossTestArchives:
+            // Cross-COMPILES the workspace's test binaries for each declared foreign
+            // triple and packs them; runs nothing. `nx-run-many` rather than
+            // `nx-smart`, because an affected-graph selection would skip the archive
+            // on a commit that changed nothing Rust — and the sibling job that
+            // executes it has no way to build one.
+            return [
+                `      - name: ${step.name}`,
+                ...platformProducerStepEnvLines(options),
+                `        run: smoo github-ci nx-run-many --targets "${crossArchiveTargetNames(options).join(',')}"`,
+            ];
+        case CiWorkflowStepKind.UploadCrossTestArchives:
+            // retention-days: 1 — the only consumer is the sibling job in this same
+            // run, and these archives are the whole workspace's test binaries.
+            return artifactStepLines(options.actionsProvider, step.name, 'upload', [
+                `name: ${CROSS_TEST_ARCHIVE_ARTIFACT}`,
+                'path: |',
+                ...crossTestArchives(options).map((archive) => `  ${archive.path}`),
+                // error, not ignore: a missing archive means the cross build silently
+                // produced nothing, and the execute job would then have nothing to run
+                // and no reason to say so.
+                'if-no-files-found: error',
+                'retention-days: 1',
+            ]);
+        case CiWorkflowStepKind.DownloadCrossTestArchives:
+            // Restores each archive at the path its own Nx target declares as output,
+            // which is where the runner target reads it from. upload-artifact roots
+            // the artifact at the least common ancestor of what it uploaded, so the
+            // download path is that shared directory.
+            return artifactStepLines(options.actionsProvider, step.name, 'download', [
+                `name: ${CROSS_TEST_ARCHIVE_ARTIFACT}`,
+                `path: ${crossTestArchiveDirectory(options)}`,
+            ]);
+        case CiWorkflowStepKind.CrossTests:
+            // EXECUTES, and that is all it can do: every one of these targets is
+            // `nextest run --archive-file`, which extracts prebuilt binaries into its
+            // own temporary directory. nextest never invokes cargo on this path
+            // (measured), so nothing here can compile even if a toolchain is present.
+            return [
+                `      - name: ${step.name}`,
+                `        run: smoo github-ci nx-run-many --targets "${darwinCrossTestTargetNames(options).join(',')}"`,
+            ];
         case CiWorkflowStepKind.ManagedFilesCheck:
             // The authoritative drift check is nearly free here (devenv is already
             // up). --warn never fails the job and publishes the step output
@@ -765,12 +836,13 @@ function renderYamlList(values, spaces) {
     const indent = ' '.repeat(spaces);
     return values.map((value) => `${indent}- ${value}`).join('\n');
 }
-function followUpStepNumbers(options) {
+function followUpStepNumbers(options, middleSteps = 1) {
     let number = 3;
     const cargo = options.cargoCredentials !== undefined ? number++ : undefined;
     const sources = options.sourceCheckouts?.length ? number++ : undefined;
     const setup = number++;
-    const middle = number++;
+    const middle = number;
+    number += middleSteps;
     const cleanup = number++;
     return { cargo, sources, setup, middle, cleanup };
 }
@@ -794,6 +866,131 @@ function followUpSetupSteps(options, numbers) {
 function followUpCleanupStep(numbers) {
     return [{ kind: CiWorkflowStepKind.SaveNixDevenv, name: '🧹 Cleanup and cache Nix/devenv', number: numbers.cleanup }];
 }
+/**
+ * How long the darwin execution job may take, download included. Generous
+ * because the archive is the whole workspace's test binaries, and bounded
+ * because the runner behind `macosRunsOn` may be one person's laptop: an
+ * unreachable runner queues, and this number is when the run says so.
+ */
+const CROSS_TEST_JOB_TIMEOUT_MINUTES = 30;
+/** Rust names every Apple-desktop triple this way; iOS and simulator do not. */
+const DARWIN_TRIPLE_SUFFIX = '-apple-darwin';
+/** One artifact carrying every triple's archive, scoped to the run that built it. */
+const CROSS_TEST_ARCHIVE_ARTIFACT = `cross-test-archives-${githubExpression('github.run_id')}`;
+/**
+ * Executes the cross-built test binaries on a machine where they are native.
+ *
+ * This job COMPILES NOTHING, and cannot: its only Rust input is the archive the
+ * Validate job uploaded, and `nextest run --archive-file` extracts prebuilt
+ * binaries rather than invoking cargo (measured: zero cargo invocations). It
+ * needs the checkout for the workspace `--workspace-remap .` points at and for
+ * Nx to resolve the target, and setup-devenv for `nx` and `cargo-nextest`
+ * themselves — the repository's ordinary shell, not a cross toolchain, no SDK,
+ * no `rustup target add`.
+ *
+ * `needs: main` and a success gate rather than `!cancelled()`: an archive that
+ * was never uploaded cannot be executed, and a job that starts anyway would
+ * fail on a missing artifact and report it as a test failure.
+ *
+ * Only `*-apple-darwin` archives run here, because macOS runner labels are the
+ * only native runner this declaration names. A repository declaring some other
+ * foreign triple still gets its archive BUILT — which proves that triple
+ * compiles — and no execution job, which is the honest rendering of having
+ * nowhere to run it.
+ */
+function renderCrossTestExecutionJob(options) {
+    const archives = darwinCrossTestArchives(options);
+    if (archives.length === 0)
+        return '';
+    const numbers = followUpStepNumbers(options, 2);
+    const middleSteps = [
+        {
+            kind: CiWorkflowStepKind.DownloadCrossTestArchives,
+            name: '📥 Download cross-target test archives',
+            number: numbers.middle,
+        },
+        { kind: CiWorkflowStepKind.CrossTests, name: '🧪 Cross-Target Unit Tests', number: numbers.middle + 1 },
+    ];
+    return `
+  macos-cross-tests:
+    name: Unit Tests (${archives.map((archive) => archive.triple).join(', ')})
+    needs: main
+${options.macosRunsOn === undefined ? '    runs-on: macos-latest' : renderRunsOnLine(options.macosRunsOn)}
+    timeout-minutes: ${CROSS_TEST_JOB_TIMEOUT_MINUTES}
+    if: \${{ needs.main.result == 'success' }}
+    env:
+      GH_TOKEN: \${{ github.token }}
+${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
+${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
+${renderCiWorkflowSteps(middleSteps, options)}
+${renderCiWorkflowSteps(followUpCleanupStep(numbers), options)}`;
+}
+/**
+ * The declared archives, checked against the naming the Nx graph would have
+ * produced. A path that is not `cargoCrossTestArchiveFile(triple)` under some
+ * project root cannot have come from that target, so it is refused here rather
+ * than uploaded as an artifact nothing on the other side can find.
+ */
+function crossTestArchives(options) {
+    return (options.crossTestArchives ?? []).map((archive) => {
+        const suffix = cargoCrossTestArchiveFile(archive.triple);
+        const path = archive.path.split('\\').join('/');
+        if (!/^[a-z0-9][a-z0-9._-]*$/.test(archive.triple)) {
+            throw new Error(`smoo cross test archive triple must be a target triple, got ${JSON.stringify(archive.triple)}`);
+        }
+        if (path !== suffix && !path.endsWith(`/${suffix}`)) {
+            throw new Error(`smoo cross test archive for ${archive.triple} must be a repository-relative ${suffix}, got ${archive.path}`);
+        }
+        if (path.startsWith('/') || path.split('/').includes('..')) {
+            throw new Error(`smoo cross test archive path must stay inside the repository, got ${archive.path}`);
+        }
+        return { triple: archive.triple, path };
+    });
+}
+function crossArchiveTargetNames(options) {
+    return crossTestArchives(options).map((archive) => cargoCrossTestArchiveTargetName(archive.triple));
+}
+/**
+ * The declared preflight, as lines. A declaration with nothing in it is a
+ * mechanism error, and it surfaces here at render time rather than as a step
+ * whose `run:` block is empty.
+ */
+function crossToolchainPreflight(options) {
+    const preflight = options.platformProducer?.preflight ?? '';
+    if (preflight.trim().length === 0) {
+        throw new Error('smoo.github.platformProducer requires a nonempty toolchain preflight command.');
+    }
+    return preflight.split('\n');
+}
+/** The producer environment, step-scoped, quoted exactly as the publish workflow quotes it. */
+function platformProducerStepEnvLines(options) {
+    const entries = Object.entries(options.platformProducer?.env ?? {});
+    if (entries.length === 0)
+        return [];
+    return ['        env:', ...entries.map(([name, value]) => `          ${name}: ${JSON.stringify(value)}`)];
+}
+function darwinCrossTestArchives(options) {
+    return crossTestArchives(options).filter((archive) => archive.triple.endsWith(DARWIN_TRIPLE_SUFFIX));
+}
+function darwinCrossTestTargetNames(options) {
+    return darwinCrossTestArchives(options).map((archive) => cargoCrossTestTargetName(archive.triple));
+}
+/**
+ * Where the download lands. upload-artifact roots an artifact at the least
+ * common ancestor of the files it uploaded, so every archive in one artifact
+ * has to share a parent directory for the restored layout to be the one the
+ * runner targets read — true for one cargo workspace, false the moment a
+ * second one also declares cross targets, which is refused here instead of
+ * silently restoring the archives one directory too high.
+ */
+function crossTestArchiveDirectory(options) {
+    const directories = new Set(darwinCrossTestArchives(options).map((archive) => archive.path.slice(0, archive.path.lastIndexOf('/') + 1) || './'));
+    if (directories.size > 1) {
+        throw new Error(`smoo cross test archives must share one directory to travel as one artifact, got ${[...directories].join(', ')}`);
+    }
+    const [directory] = [...directories];
+    return (directory ?? './').replace(/\/$/, '');
+}
 function renderE2eDeploymentJob(options) {
     if (!options.e2eDeployment)
         return '';