@smoothbricks/cli 0.11.18 → 0.11.19

package/README.md

@@ -430,11 +430,28 @@ access makes cleanup refuse before it deletes anything rather than half-clean a
 A wrong value type anywhere in `smoo.github` fails `smoo monorepo update` and `smoo github-ci nx-deploy` with the
 offending path, rather than silently falling back to the defaults.
 
+#### What CI deploys: the deploy tags
+
+A `deploy` target says a project CAN be deployed. Four Nx tags say whether CI does, and they are the only thing that
+says so: the generated workflows and `smoo github-ci nx-deploy` read one rule, so a repository cannot render a deploy
+job that deploys nothing, nor deploy a project no job announced.
+
+- `stage-deploy-target`: deployed on every stage — pull-request previews, staging, and production.
+- `staging-deploy-target`: deployed on staging only, for infrastructure the pull-request stages share.
+- `permanent-deploy-target`: excluded from every stage deploy; deployed outside the stage flow.
+- `production-push-deploy-target`: also deployed by the generated production-on-push job (below).
+
+An untagged `deploy` target is deployable by hand — `nx run <project>:deploy --stage=pr42` — and invisible to CI. A
+repository where no project carries one of these tags gets no deploy step, no `deployments: write` permission, no
+Cloudflare credentials and no `pr-preview-cleanup.yml`, however many wrangler manifests its packages hold: a published
+library ships one to document a Durable Object binding for its consumers, and that manifest looks exactly like a
+deployable worker's.
+
 Tag a project `production-push-deploy-target` to have it deployed to production by a generated `deploy-production` job
 that runs after Validate and the e2e job succeed on a push to the staging push branch
-(`smoo github-ci nx-deploy --stage production --select-tag production-push-deploy-target`). The project must also be
-stage-derived — carry `stage-deploy-target` or deploy through `smoo wrangler deploy-stage` — otherwise `--select-tag`
-finds nothing and the job logs `No run-many deploy projects; skipping production.`
+(`smoo github-ci nx-deploy --stage production --select-tag production-push-deploy-target`). The project must also carry
+`stage-deploy-target`, otherwise `--select-tag` finds nothing and the job logs
+`No run-many deploy projects; skipping production.`
 
 #### Ordering one deploy after another
 
@@ -452,9 +469,9 @@ drop.
 
 What makes the edge safe is that a deploy is never cached and always cheap when there is nothing to do:
 
-- `@smoothbricks/nx-plugin` gives every declared `deploy` target `cache: false`. An Nx cache hit on a deploy means "we
-  once uploaded this hash", which a rollback silently falsifies — the workspace is unchanged, so the hash is unchanged,
-  so a cached deploy would report success while the previous version keeps serving.
+- `@smoothbricks/nx-plugin` gives the `deploy` it infers `cache: false`. An Nx cache hit on a deploy means "we once
+  uploaded this hash", which a rollback silently falsifies — the workspace is unchanged, so the hash is unchanged, so a
+  cached deploy would report success while the previous version keeps serving.
 - `smoo wrangler deploy-stage` reads live state first. If the version tagged with this task's hash is already the one
   serving 100% of traffic, it returns `remote-cache-hit` after two API calls: no upload, no migration, no traffic shift.
 - The expensive, purely file-derived half belongs in a sibling `deploy-build` target (build the artifact, register it,

package/dist/github-ci/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAmBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAmFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA2BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAiBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAmFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA2BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}

package/dist/github-ci/index.js

@@ -4,7 +4,7 @@ import { appendFile } from 'node:fs/promises';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { $ } from 'bun';
 import typia from 'typia';
-import { isStageDerivedDeploy, PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import { ciPushBranches, isNonEmpty, parseStringArrayText, readSmooGithub, } from '../lib/json.js';
 import { decode, printCommandOutput, run, runStatus, runText } from '../lib/run.js';
 import { readProjectTargets } from '../nx/index.js';
@@ -25,19 +25,11 @@ const isGithubDeployment = (() => {
     return input => "object" === typeof input && null !== input && _io0(input);
 })();
 const isNxProjectDeployTarget = (() => {
-    const _ip0 = input => true;
-    const _io0 = input => true && (undefined === input.targets || "object" === typeof input.targets && null !== input.targets && false === Array.isArray(input.targets) && _io1(input.targets));
-    const _io1 = input => undefined === input.deploy || "object" === typeof input.deploy && null !== input.deploy && false === Array.isArray(input.deploy) && _io2(input.deploy);
-    const _io2 = input => _ip0(input) && (undefined === input.options || "object" === typeof input.options && null !== input.options && false === Array.isArray(input.options) && _io3(input.options));
-    const _io3 = input => _ip0(input);
+    const _io0 = input => undefined === input.tags || Array.isArray(input.tags) && input.tags.every(elem => "string" === typeof elem);
     return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
 })();
 const parseNxProjectDeployTarget = (() => {
-    const _ip0 = input => true;
-    const _io0 = input => true && (undefined === input.targets || "object" === typeof input.targets && null !== input.targets && false === Array.isArray(input.targets) && _io1(input.targets));
-    const _io1 = input => undefined === input.deploy || "object" === typeof input.deploy && null !== input.deploy && false === Array.isArray(input.deploy) && _io2(input.deploy);
-    const _io2 = input => _ip0(input) && (undefined === input.options || "object" === typeof input.options && null !== input.options && false === Array.isArray(input.options) && _io3(input.options));
-    const _io3 = input => _ip0(input);
+    const _io0 = input => undefined === input.tags || Array.isArray(input.tags) && input.tags.every(elem => "string" === typeof elem);
     const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
     return input => { input = JSON.parse(input); return __is(input) ? input : null; };
 })();
@@ -434,17 +426,11 @@ export async function selectStageDeployProjects(candidates, stage, requireTag, l
         const definition = await loadProject(project);
         if (!isNxProjectDeployTarget(definition))
             continue;
-        const deploy = definition.targets?.deploy;
-        const commandValue = deploy?.options?.command ?? deploy?.command;
-        const tags = Array.isArray(definition.tags)
-            ? definition.tags.filter((tag) => typeof tag === 'string')
-            : [];
-        const isStageDerived = isStageDerivedDeploy(tags, typeof commandValue === 'string' ? commandValue : undefined);
-        const isStagingOnly = tags.includes(STAGING_DEPLOY_TAG);
+        const tags = definition.tags;
         // A required tag narrows the stage rules; it never selects a project they exclude.
-        if (requireTag && !tags.includes(requireTag))
+        if (requireTag && !tags?.includes(requireTag))
             continue;
-        if (isStageDerived || (stage === 'staging' && isStagingOnly)) {
+        if (stageDeploysProject(tags, stage)) {
             selected.push(project);
         }
     }

package/dist/lib/deploy-tags.d.ts

@@ -1,3 +1,4 @@
+import type { DeploymentStage } from '../wrangler/stage.js';
 /** Deployed on staging only: infrastructure the pull-request stages share. */
 export declare const STAGING_DEPLOY_TAG = "staging-deploy-target";
 /** Excluded from every stage deploy; deployed outside the stage flow. */
@@ -5,8 +6,21 @@ export declare const PERMANENT_DEPLOY_TAG = "permanent-deploy-target";
 /** Opts a project into the generated production-on-push deploy job. */
 export declare const PRODUCTION_PUSH_DEPLOY_TAG = "production-push-deploy-target";
 /**
- * Whether a deploy target is stage-derived (the tag, or the `smoo wrangler deploy-stage` command) rather than a set of
- * per-stage configurations; CI selection and workflow generation must agree on this.
+ * Whether the stage flow deploys a project, from its TAGS alone — the one rule
+ * CI selection and workflow generation both read, so a generated deploy job and
+ * the projects that job deploys cannot disagree.
+ *
+ * Having a `deploy` target is not that answer. A deploy target says a project
+ * CAN be deployed; only a tag says CI does it. A published library ships a
+ * wrangler manifest to document a Durable Object binding for its consumers, and
+ * that manifest is structurally identical to a deployable worker's — so the
+ * plugin infers `deploy` from one, and a repository that deploys nothing from CI
+ * would otherwise generate a deploy job, with cloud credentials, for it.
+ *
+ * The three tags compose as precedence, not as a set: `permanent` excludes a
+ * project from every stage, `staging` narrows it to one, `stage` generalizes it
+ * to all. `production-push` selects WITHIN this answer (see `--select-tag`) and
+ * never widens it.
  */
-export declare function isStageDerivedDeploy(tags: string[] | undefined, command: string | undefined): boolean;
+export declare function stageDeploysProject(tags: string[] | undefined, stage: DeploymentStage): boolean;
 //# sourceMappingURL=deploy-tags.d.ts.map

package/dist/lib/deploy-tags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-tags.d.ts","sourceRoot":"","sources":["../../src/lib/deploy-tags.ts"],"names":[],"mappings":"AAMA,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErG"}
+{"version":3,"file":"deploy-tags.d.ts","sourceRoot":"","sources":["../../src/lib/deploy-tags.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAK5D,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAK/F"}

package/dist/lib/deploy-tags.js

@@ -9,9 +9,28 @@ export const PERMANENT_DEPLOY_TAG = 'permanent-deploy-target';
 /** Opts a project into the generated production-on-push deploy job. */
 export const PRODUCTION_PUSH_DEPLOY_TAG = 'production-push-deploy-target';
 /**
- * Whether a deploy target is stage-derived (the tag, or the `smoo wrangler deploy-stage` command) rather than a set of
- * per-stage configurations; CI selection and workflow generation must agree on this.
+ * Whether the stage flow deploys a project, from its TAGS alone — the one rule
+ * CI selection and workflow generation both read, so a generated deploy job and
+ * the projects that job deploys cannot disagree.
+ *
+ * Having a `deploy` target is not that answer. A deploy target says a project
+ * CAN be deployed; only a tag says CI does it. A published library ships a
+ * wrangler manifest to document a Durable Object binding for its consumers, and
+ * that manifest is structurally identical to a deployable worker's — so the
+ * plugin infers `deploy` from one, and a repository that deploys nothing from CI
+ * would otherwise generate a deploy job, with cloud credentials, for it.
+ *
+ * The three tags compose as precedence, not as a set: `permanent` excludes a
+ * project from every stage, `staging` narrows it to one, `stage` generalizes it
+ * to all. `production-push` selects WITHIN this answer (see `--select-tag`) and
+ * never widens it.
  */
-export function isStageDerivedDeploy(tags, command) {
-    return tags?.includes(STAGE_DEPLOY_TAG) === true || command?.includes('smoo wrangler deploy-stage') === true;
+export function stageDeploysProject(tags, stage) {
+    if (tags === undefined)
+        return false;
+    if (tags.includes(PERMANENT_DEPLOY_TAG))
+        return false;
+    if (tags.includes(STAGING_DEPLOY_TAG))
+        return stage === 'staging';
+    return tags.includes(STAGE_DEPLOY_TAG);
 }

package/dist/monorepo/managed-files.d.ts

@@ -1,5 +1,6 @@
 import { type NonEmptyArray, type PackageCargoCredentialsConfig, type PackagePrivateNpmConfig, type PackageRemoteCacheConfig, type PackageSmooGithub, type PackageSmooGithubEnvironments, type PackageSourceCheckoutConfig } from '../lib/json.js';
 import { type NxProjects } from '../nx/index.js';
+import type { DeploymentStage } from '../wrangler/stage.js';
 import { type CiCrossTestArchive } from './ci-workflow.js';
 /**
  * Repos may append their own content to a managed file below this marker —
@@ -97,6 +98,8 @@ export declare const managedFileTargetsForTest: {
     target: string;
     executable: boolean | undefined;
 }[];
+/** Test seam: the managed targets a repository of this shape gets, in file order. */
+export declare function managedFileTargetsForContext(context: ManagedFileContext): string[];
 export declare function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): Promise<FileResult[]>;
 /** Renders a generated workflow through its real managed-file descriptor, so the context wiring is covered. */
 export declare function renderManagedWorkflowForTest(source: 'ci-workflow' | 'publish-workflow', context: ManagedFileContext): string;
@@ -134,8 +137,8 @@ export declare function platformTargetGlobsForTest(targetNames: Iterable<string>
  * platform builds serialize no matter how many workers Nx is given.
  */
 export declare function macosPlatformArchitecturesForTest(targetNames: Iterable<string>): string[];
-/** Test seam: deploy configuration presence/provider from graph nodes. */
-export declare function deployTargetInfoFromProjects(projects: NxProjects, configuration: string): DeployTargetInfo;
+/** Test seam: what the stage flow deploys, and with which provider, from graph nodes. */
+export declare function deployTargetInfoFromProjects(projects: NxProjects, stage: DeploymentStage): DeployTargetInfo;
 /** Test seam: whether any project in the graph carries the Nx tag. */
 export declare function anyProjectHasTagForTest(projects: NxProjects, tag: string): boolean;
 export declare function printResults(results: FileResult[]): void;

package/dist/monorepo/managed-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,6BAA6B,EAElC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAEL,KAAK,UAAU,EAIhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,kBAAkB,EAAmD,MAAM,kBAAkB,CAAC;AAO5G;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAW3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAkCxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAuBtF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,OAAO,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uBAAuB,EAAE,OAAO,CAAC;IACjC,8BAA8B,EAAE,OAAO,CAAC;IACxC,qBAAqB,CAAC,EAAE,YAAY,CAAC;IACrC,wBAAwB,CAAC,EAAE,YAAY,CAAC;IACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,yFAAyF;IACzF,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qFAAqF;IACrF,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,wFAAwF;IACxF,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,uGAAuG;IACvG,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;;OAIG;IACH,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;CACzC;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAwID,eAAO,MAAM,yBAAyB;;;GAAyE,CAAC;AAIhH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAG9G;AA6CD,+GAA+G;AAC/G,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,GAAG,kBAAkB,EAC1C,OAAO,EAAE,kBAAkB,GAC1B,MAAM,CAMR;AA8HD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAiBnF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,MAAM,EAAE,CAIV;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAMlF;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAezF;AAED,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAY1G;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAElF;AAqED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxE;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE"}
+{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,6BAA6B,EAElC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAEL,KAAK,UAAU,EAIhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,KAAK,kBAAkB,EAAmD,MAAM,kBAAkB,CAAC;AAO5G;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAW3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAkCxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAuBtF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,OAAO,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uBAAuB,EAAE,OAAO,CAAC;IACjC,8BAA8B,EAAE,OAAO,CAAC;IACxC,qBAAqB,CAAC,EAAE,YAAY,CAAC;IACrC,wBAAwB,CAAC,EAAE,YAAY,CAAC;IACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,yFAAyF;IACzF,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qFAAqF;IACrF,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,wFAAwF;IACxF,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,uGAAuG;IACvG,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;;OAIG;IACH,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;CACzC;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAwID,eAAO,MAAM,yBAAyB;;;GAAyE,CAAC;AAgBhH,qFAAqF;AACrF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAElF;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAG9G;AA0CD,+GAA+G;AAC/G,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,GAAG,kBAAkB,EAC1C,OAAO,EAAE,kBAAkB,GAC1B,MAAM,CAMR;AA8HD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAiBnF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,MAAM,EAAE,CAIV;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAMlF;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAezF;AAED,yFAAyF;AACzF,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAY3G;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAElF;AAuED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxE;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE"}

package/dist/monorepo/managed-files.js

@@ -3,7 +3,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { cargoCrossTestArchiveFile, cargoCrossTestTripleFromArchiveTarget, } from '@smoothbricks/nx-plugin/cross-check-policy';
 import { MACOS_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { isStageDerivedDeploy, PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PRODUCTION_PUSH_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import { ciPushBranches, readValidatedPackageJson, } from '../lib/json.js';
 import { listReleasePackages, packageInfo } from '../lib/workspace.js';
 import { loadNxProjects, projectRootFromNxProjectJson, targetNamesFromNxProjectJson, targetNamesFromProjects, } from '../nx/index.js';
@@ -236,15 +236,27 @@ const managedFiles = [
 ];
 export const managedFileTargetsForTest = managedFiles.map(({ target, executable }) => ({ target, executable }));
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+/**
+ * Whether a repository of this shape has the file at all. A repository that owns
+ * no packages has nothing to publish, and one the stage flow does not deploy to
+ * Cloudflare has no preview stage to clean up.
+ */
+function managedFileApplies(file, context) {
+    if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
+        return false;
+    }
+    return file.cloudflareDeployOnly !== true || context.stagingDeployProvider === 'cloudflare';
+}
+/** Test seam: the managed targets a repository of this shape gets, in file order. */
+export function managedFileTargetsForContext(context) {
+    return managedFiles.filter((file) => managedFileApplies(file, context)).map((file) => file.target);
+}
 export async function applyManagedFiles(root, mode) {
     const context = await getManagedFileContext(root);
     return managedFiles.map((file) => applyManagedFile(root, file, mode, context));
 }
 function applyManagedFile(root, file, mode, context) {
-    if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
-        return { target: file.target, action: 'skipped' };
-    }
-    if (file.cloudflareDeployOnly === true && context.stagingDeployProvider !== 'cloudflare') {
+    if (!managedFileApplies(file, context)) {
         return { target: file.target, action: 'skipped' };
     }
     const target = resolve(root, file.target);
@@ -483,12 +495,12 @@ export function macosPlatformArchitecturesForTest(targetNames) {
     }
     return [...architectures].sort((left, right) => left.localeCompare(right));
 }
-/** Test seam: deploy configuration presence/provider from graph nodes. */
-export function deployTargetInfoFromProjects(projects, configuration) {
+/** Test seam: what the stage flow deploys, and with which provider, from graph nodes. */
+export function deployTargetInfoFromProjects(projects, stage) {
     let exists = false;
     let provider;
     for (const project of Object.values(projects)) {
-        const info = deployTargetInfoFromProject(project, configuration);
+        const info = deployTargetInfoFromProject(project, stage);
         if (!info.exists) {
             continue;
         }
@@ -501,22 +513,24 @@ export function deployTargetInfoFromProjects(projects, configuration) {
 export function anyProjectHasTagForTest(projects, tag) {
     return Object.values(projects).some((project) => project.tags?.includes(tag));
 }
-function deployTargetInfoFromProject(project, configuration) {
+/**
+ * A generated deploy job exists for the projects CI would actually deploy, which
+ * is `stageDeploysProject` and nothing else — the same rule `smoo github-ci
+ * nx-deploy` selects by, so the job and its selection cannot disagree. Reading
+ * the target's presence instead would render a deploy job, with cloud
+ * credentials, into a repository whose only wrangler manifests document a
+ * Durable Object binding for a published library's consumers.
+ *
+ * The command is read for the PROVIDER only: which cloud CLI runs says which
+ * credentials the job needs, and says nothing about whether CI runs it.
+ */
+function deployTargetInfoFromProject(project, stage) {
     const deploy = project.targets?.deploy;
-    if (!deploy) {
-        return { exists: false };
-    }
-    const baseCommandValue = deploy.options?.command ?? deploy.command;
-    const baseCommand = typeof baseCommandValue === 'string' ? baseCommandValue : '';
-    if (isStageDerivedDeploy(project.tags, baseCommand)) {
-        return { exists: true, provider: deployProvider(baseCommand) };
-    }
-    const config = deploy.configurations?.[configuration];
-    if (!config) {
+    if (!deploy || !stageDeploysProject(project.tags, stage)) {
         return { exists: false };
     }
-    const commandValue = config.command ?? config.options?.command ?? baseCommand;
-    return { exists: true, provider: deployProvider(typeof commandValue === 'string' ? commandValue : '') };
+    const command = deploy.options?.command ?? deploy.command;
+    return { exists: true, provider: deployProvider(typeof command === 'string' ? command : '') };
 }
 function deployProvider(command) {
     return command.includes('wrangler ') ? 'cloudflare' : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.18",
+  "version": "0.11.19",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.12",
+    "@smoothbricks/nx-plugin": "0.4.13",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/github-ci/index.test.ts

@@ -847,8 +847,11 @@ describe('event-aware stage deployment', () => {
     ).toThrow(/same-repository/);
   });
 
-  it('selects stage-derived deploy targets plus staging-only infrastructure on staging', async () => {
+  it('selects tagged stage projects plus staging-only infrastructure, and never an untagged one', async () => {
     const definitions: Record<string, unknown> = {
+      // A private wrangler project the plugin gave a deploy target and nobody tagged: deployable
+      // by hand, invisible to CI. Reading the command instead deployed whatever held a wrangler
+      // manifest, including a published library that ships one to document a binding.
       app: {
         targets: {
           deploy: { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } },
@@ -875,18 +878,15 @@ describe('event-aware stage deployment', () => {
     const loadProject = async (project: string) => definitions[project];
 
     await expect(selectStageDeployProjects(candidates, 'staging', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'e2e-mail-capture',
       'website',
     ]);
     await expect(selectStageDeployProjects(candidates, 'pr123', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'website',
     ]);
     await expect(selectStageDeployProjects(candidates, 'production', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'website',
     ]);
@@ -1303,15 +1303,14 @@ describe('selectStageDeployProjects with a required tag', () => {
   };
   const loadProject = async (project: string) => definitions[project];
 
-  it('keeps only projects carrying the tag, on top of the stage-derived rule', async () => {
+  it('keeps only projects carrying the tag, on top of the stage rules', async () => {
     await expect(
       selectStageDeployProjects(Object.keys(definitions), 'production', 'production-push-deploy-target', loadProject),
     ).resolves.toEqual(['website']);
   });
 
-  it('selects the website on every stage once it is stage-derived', async () => {
+  it('selects only the tagged project on every stage, required tag or not', async () => {
     await expect(selectStageDeployProjects(Object.keys(definitions), 'pr12', undefined, loadProject)).resolves.toEqual([
-      'app',
       'website',
     ]);
   });

package/src/github-ci/index.ts

@@ -4,7 +4,7 @@ import { appendFile } from 'node:fs/promises';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { $ } from 'bun';
 import typia from 'typia';
-import { isStageDerivedDeploy, PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import {
   ciPushBranches,
   isNonEmpty,
@@ -35,16 +35,14 @@ export interface GithubActionsEventPayload {
   };
 }
 
+/**
+ * What a deploy candidate is READ for: its tags. `nx show projects --withTarget
+ * deploy` already established the target, and the tags decide the rest, so a
+ * project whose `tags` is not a string array fails the parse instead of being
+ * silently untagged.
+ */
 interface NxProjectDeployTarget {
-  tags?: unknown;
-  targets?: {
-    deploy?: {
-      command?: unknown;
-      options?: {
-        command?: unknown;
-      };
-    };
-  };
+  tags?: string[];
 }
 
 const parseGithubActionsEvent = typia.json.createIsParse<GithubActionsEventPayload>();
@@ -570,16 +568,10 @@ export async function selectStageDeployProjects(
   for (const project of candidates) {
     const definition = await loadProject(project);
     if (!isNxProjectDeployTarget(definition)) continue;
-    const deploy = definition.targets?.deploy;
-    const commandValue = deploy?.options?.command ?? deploy?.command;
-    const tags = Array.isArray(definition.tags)
-      ? definition.tags.filter((tag): tag is string => typeof tag === 'string')
-      : [];
-    const isStageDerived = isStageDerivedDeploy(tags, typeof commandValue === 'string' ? commandValue : undefined);
-    const isStagingOnly = tags.includes(STAGING_DEPLOY_TAG);
+    const tags = definition.tags;
     // A required tag narrows the stage rules; it never selects a project they exclude.
-    if (requireTag && !tags.includes(requireTag)) continue;
-    if (isStageDerived || (stage === 'staging' && isStagingOnly)) {
+    if (requireTag && !tags?.includes(requireTag)) continue;
+    if (stageDeploysProject(tags, stage)) {
       selected.push(project);
     }
   }

package/src/lib/deploy-tags.ts

@@ -1,6 +1,8 @@
 // The Nx tags that drive stage deploys. CI selection (github-ci), workflow generation (monorepo)
 // and the graph readers must agree on these, so they live here rather than with any one of them.
 
+import type { DeploymentStage } from '../wrangler/stage.js';
+
 /** Deployed on every stage: one command that deploys whichever stage it is given. */
 const STAGE_DEPLOY_TAG = 'stage-deploy-target';
 
@@ -14,9 +16,25 @@ export const PERMANENT_DEPLOY_TAG = 'permanent-deploy-target';
 export const PRODUCTION_PUSH_DEPLOY_TAG = 'production-push-deploy-target';
 
 /**
- * Whether a deploy target is stage-derived (the tag, or the `smoo wrangler deploy-stage` command) rather than a set of
- * per-stage configurations; CI selection and workflow generation must agree on this.
+ * Whether the stage flow deploys a project, from its TAGS alone — the one rule
+ * CI selection and workflow generation both read, so a generated deploy job and
+ * the projects that job deploys cannot disagree.
+ *
+ * Having a `deploy` target is not that answer. A deploy target says a project
+ * CAN be deployed; only a tag says CI does it. A published library ships a
+ * wrangler manifest to document a Durable Object binding for its consumers, and
+ * that manifest is structurally identical to a deployable worker's — so the
+ * plugin infers `deploy` from one, and a repository that deploys nothing from CI
+ * would otherwise generate a deploy job, with cloud credentials, for it.
+ *
+ * The three tags compose as precedence, not as a set: `permanent` excludes a
+ * project from every stage, `staging` narrows it to one, `stage` generalizes it
+ * to all. `production-push` selects WITHIN this answer (see `--select-tag`) and
+ * never widens it.
  */
-export function isStageDerivedDeploy(tags: string[] | undefined, command: string | undefined): boolean {
-  return tags?.includes(STAGE_DEPLOY_TAG) === true || command?.includes('smoo wrangler deploy-stage') === true;
+export function stageDeploysProject(tags: string[] | undefined, stage: DeploymentStage): boolean {
+  if (tags === undefined) return false;
+  if (tags.includes(PERMANENT_DEPLOY_TAG)) return false;
+  if (tags.includes(STAGING_DEPLOY_TAG)) return stage === 'staging';
+  return tags.includes(STAGE_DEPLOY_TAG);
 }

package/src/monorepo/managed-files.test.ts

@@ -18,6 +18,7 @@ import {
   LOCAL_SECTION_MARKER,
   type ManagedFileContext,
   macosPlatformArchitecturesForTest,
+  managedFileTargetsForContext,
   managedFileTargetsForTest,
   platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
@@ -263,14 +264,10 @@ describe('nx graph project helpers', () => {
       },
     },
     app: {
+      // What the plugin infers for a private wrangler project, and what a published library
+      // holding a wrangler manifest used to get: a deploy target no tag enrols in CI.
       targets: {
-        deploy: {
-          options: { command: 'echo no' },
-          configurations: {
-            staging: { command: 'wrangler deploy --env staging' },
-            production: { options: { command: 'wrangler deploy --env production' } },
-          },
-        },
+        deploy: { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } },
         'package-macos': {},
       },
     },
@@ -296,43 +293,40 @@ describe('nx graph project helpers', () => {
     expect(hasExactTargetForTest(nearMisses, 'e2e-deployment')).toBe(false);
   });
 
-  it('detects deploy configurations and cloudflare provider from graph nodes', () => {
-    expect(deployTargetInfoFromProjects(sampleProjects, 'staging')).toEqual({
-      exists: true,
-      provider: 'cloudflare',
-    });
-    expect(deployTargetInfoFromProjects(sampleProjects, 'production')).toEqual({
-      exists: true,
-      provider: 'cloudflare',
-    });
-    expect(deployTargetInfoFromProjects(sampleProjects, 'preview')).toEqual({ exists: false });
+  it('deploys nothing for a wrangler deploy target no tag names', () => {
+    expect(deployTargetInfoFromProjects(sampleProjects, 'staging')).toEqual({ exists: false });
+    expect(deployTargetInfoFromProjects(sampleProjects, 'production')).toEqual({ exists: false });
   });
 
-  it('recognizes convention-driven deploy-stage targets without per-stage configurations', () => {
-    const projects: NxProjects = {
-      app: {
-        targets: {
-          deploy: {
-            options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' },
-          },
-        },
-      },
-    };
+  it('reads the tags as precedence: permanent excludes, staging narrows, stage generalizes', () => {
+    const deploy = { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } };
+    const stageFor = (tags: string[]) => ({
+      staging: deployTargetInfoFromProjects({ site: { tags, targets: { deploy } } }, 'staging').exists,
+      production: deployTargetInfoFromProjects({ site: { tags, targets: { deploy } } }, 'production').exists,
+    });
 
-    expect(deployTargetInfoFromProjects(projects, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
-    expect(deployTargetInfoFromProjects(projects, 'production')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(stageFor(['stage-deploy-target'])).toEqual({ staging: true, production: true });
+    expect(stageFor(['staging-deploy-target'])).toEqual({ staging: true, production: false });
+    expect(stageFor(['permanent-deploy-target'])).toEqual({ staging: false, production: false });
+    // Both spellings on one project is a contradiction; the exclusion wins, which is what
+    // `nx show projects --exclude=tag:permanent-deploy-target` does to it in CI too.
+    expect(stageFor(['permanent-deploy-target', 'stage-deploy-target'])).toEqual({
+      staging: false,
+      production: false,
+    });
+    expect(stageFor(['npm:private'])).toEqual({ staging: false, production: false });
   });
 
-  it('treats a stage-deploy-target tag as a deploy target for every stage, like the deploy-stage command', () => {
-    const projects: NxProjects = {
-      site: {
-        tags: ['stage-deploy-target'],
-        targets: { deploy: { command: 'wrangler deploy --config dist/wrangler.json' } },
-      },
+  it('reads the command for the provider only: which credentials the generated job needs', () => {
+    const cloudflare: NxProjects = {
+      site: { tags: ['stage-deploy-target'], targets: { deploy: { command: 'wrangler deploy --config dist/w.json' } } },
+    };
+    const elsewhere: NxProjects = {
+      site: { tags: ['stage-deploy-target'], targets: { deploy: { command: 'bun tooling/deploy-site.ts' } } },
     };
 
-    expect(deployTargetInfoFromProjects(projects, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
-    expect(deployTargetInfoFromProjects(projects, 'production')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(deployTargetInfoFromProjects(cloudflare, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(deployTargetInfoFromProjects(elsewhere, 'staging')).toEqual({ exists: true, provider: undefined });
   });
 
   it('finds a tag carried by any project in the graph', () => {
@@ -582,6 +576,44 @@ describe('CI workflow rendering by repo shape', () => {
     expect(rendered).toContain('  deploy-production:');
   });
 
+  it('renders no deploy job at all for a repo whose wrangler projects carry no deploy tag', () => {
+    // The regression this exists for: published libraries ship a wrangler manifest to document a
+    // Durable Object binding for their consumers, the plugin inferred a deploy target from each,
+    // and a repository that deploys nothing from CI grew a Deploy Stage step holding Cloudflare
+    // credentials, a deployments permission, and a preview-cleanup workflow.
+    const deploy = { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } };
+    const projects: NxProjects = {
+      'acme-cloudflare': { tags: ['npm:private'], targets: { deploy } },
+      'acme-documents': { tags: ['npm:public'], targets: { deploy } },
+      // A private worker, deployed by hand from a developer's shell and never by CI.
+      'acme-service': { targets: { deploy } },
+    };
+    const staging = deployTargetInfoFromProjects(projects, 'staging');
+    const production = deployTargetInfoFromProjects(projects, 'production');
+    const shape = context({
+      hasStagingDeployTargets: staging.exists,
+      stagingDeployProvider: staging.provider,
+      hasProductionDeployTargets: production.exists,
+      productionDeployProvider: production.provider,
+      hasE2eDeploymentTargets: true,
+    });
+    const ci = renderManagedWorkflowForTest('ci-workflow', shape);
+
+    expect(ci).not.toContain('Deploy Stage');
+    expect(ci).not.toContain('deployments: write');
+    expect(ci).not.toContain('CLOUDFLARE_API_TOKEN');
+    expect(ci).not.toContain('e2e-deployment');
+    expect(renderManagedWorkflowForTest('publish-workflow', shape)).not.toContain('Deploy production');
+    expect(managedFileTargetsForContext(shape)).not.toContain('.github/workflows/pr-preview-cleanup.yml');
+  });
+
+  it('adds the preview cleanup workflow only where a cloudflare stage deploy makes preview stages', () => {
+    expect(managedFileTargetsForContext(deploying)).toContain('.github/workflows/pr-preview-cleanup.yml');
+    expect(managedFileTargetsForContext({ ...deploying, stagingDeployProvider: undefined })).not.toContain(
+      '.github/workflows/pr-preview-cleanup.yml',
+    );
+  });
+
   it('threads environments and secrets from the context into the workflow', () => {
     const rendered = renderManagedWorkflowForTest('ci-workflow', {
       ...deploying,

package/src/monorepo/managed-files.ts

@@ -6,7 +6,7 @@ import {
   cargoCrossTestTripleFromArchiveTarget,
 } from '@smoothbricks/nx-plugin/cross-check-policy';
 import { MACOS_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { isStageDerivedDeploy, PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PRODUCTION_PUSH_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import {
   ciPushBranches,
   type NonEmptyArray,
@@ -29,6 +29,7 @@ import {
   targetNamesFromProjects,
 } from '../nx/index.js';
 import { resolvePrivateNpmWorkflowConfig } from '../release/private-npm.js';
+import type { DeploymentStage } from '../wrangler/stage.js';
 import { type CiCrossTestArchive, privateNpmReadTokenJobEnv, renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderRunsOnLine } from './github-runs-on.js';
 import { renderPrPreviewCleanupWorkflowYaml } from './pr-preview-cleanup-workflow.js';
@@ -342,6 +343,23 @@ export const managedFileTargetsForTest = managedFiles.map(({ target, executable
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
+/**
+ * Whether a repository of this shape has the file at all. A repository that owns
+ * no packages has nothing to publish, and one the stage flow does not deploy to
+ * Cloudflare has no preview stage to clean up.
+ */
+function managedFileApplies(file: ManagedFile, context: ManagedFileContext): boolean {
+  if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
+    return false;
+  }
+  return file.cloudflareDeployOnly !== true || context.stagingDeployProvider === 'cloudflare';
+}
+
+/** Test seam: the managed targets a repository of this shape gets, in file order. */
+export function managedFileTargetsForContext(context: ManagedFileContext): string[] {
+  return managedFiles.filter((file) => managedFileApplies(file, context)).map((file) => file.target);
+}
+
 export async function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): Promise<FileResult[]> {
   const context = await getManagedFileContext(root);
   return managedFiles.map((file) => applyManagedFile(root, file, mode, context));
@@ -353,10 +371,7 @@ function applyManagedFile(
   mode: 'update' | 'check' | 'diff',
   context: ManagedFileContext,
 ): FileResult {
-  if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
-    return { target: file.target, action: 'skipped' };
-  }
-  if (file.cloudflareDeployOnly === true && context.stagingDeployProvider !== 'cloudflare') {
+  if (!managedFileApplies(file, context)) {
     return { target: file.target, action: 'skipped' };
   }
   const target = resolve(root, file.target);
@@ -612,12 +627,12 @@ export function macosPlatformArchitecturesForTest(targetNames: Iterable<string>)
   return [...architectures].sort((left, right) => left.localeCompare(right));
 }
 
-/** Test seam: deploy configuration presence/provider from graph nodes. */
-export function deployTargetInfoFromProjects(projects: NxProjects, configuration: string): DeployTargetInfo {
+/** Test seam: what the stage flow deploys, and with which provider, from graph nodes. */
+export function deployTargetInfoFromProjects(projects: NxProjects, stage: DeploymentStage): DeployTargetInfo {
   let exists = false;
   let provider: DeployTargetInfo['provider'];
   for (const project of Object.values(projects)) {
-    const info = deployTargetInfoFromProject(project, configuration);
+    const info = deployTargetInfoFromProject(project, stage);
     if (!info.exists) {
       continue;
     }
@@ -632,22 +647,24 @@ export function anyProjectHasTagForTest(projects: NxProjects, tag: string): bool
   return Object.values(projects).some((project) => project.tags?.includes(tag));
 }
 
-function deployTargetInfoFromProject(project: NxProjectJson, configuration: string): DeployTargetInfo {
+/**
+ * A generated deploy job exists for the projects CI would actually deploy, which
+ * is `stageDeploysProject` and nothing else — the same rule `smoo github-ci
+ * nx-deploy` selects by, so the job and its selection cannot disagree. Reading
+ * the target's presence instead would render a deploy job, with cloud
+ * credentials, into a repository whose only wrangler manifests document a
+ * Durable Object binding for a published library's consumers.
+ *
+ * The command is read for the PROVIDER only: which cloud CLI runs says which
+ * credentials the job needs, and says nothing about whether CI runs it.
+ */
+function deployTargetInfoFromProject(project: NxProjectJson, stage: DeploymentStage): DeployTargetInfo {
   const deploy = project.targets?.deploy;
-  if (!deploy) {
-    return { exists: false };
-  }
-  const baseCommandValue = deploy.options?.command ?? deploy.command;
-  const baseCommand = typeof baseCommandValue === 'string' ? baseCommandValue : '';
-  if (isStageDerivedDeploy(project.tags, baseCommand)) {
-    return { exists: true, provider: deployProvider(baseCommand) };
-  }
-  const config = deploy.configurations?.[configuration];
-  if (!config) {
+  if (!deploy || !stageDeploysProject(project.tags, stage)) {
     return { exists: false };
   }
-  const commandValue = config.command ?? config.options?.command ?? baseCommand;
-  return { exists: true, provider: deployProvider(typeof commandValue === 'string' ? commandValue : '') };
+  const command = deploy.options?.command ?? deploy.command;
+  return { exists: true, provider: deployProvider(typeof command === 'string' ? command : '') };
 }
 
 function deployProvider(command: string): DeployTargetInfo['provider'] {