@smoothbricks/cli 0.11.18 → 0.11.20

package/dist/monorepo/index.js

@@ -2,7 +2,7 @@ import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { printCommandOutput, run, runResult } from '../lib/run.js';
 import { escapeRegex, getWorkspacePackages, getWorkspacePatterns, listReleasePackages } from '../lib/workspace.js';
 import { readProjectTargets } from '../nx/index.js';
-import { applyCargoFeatureUnification, validateCargoCachePolicy } from './cargo-policy.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy, validateCargoToolchainInputs, } from './cargo-policy.js';
 import { formatCommitMessage, stagedDeletedPublicPackages, validateBreakingDisclosure, validateCommitMessage, } from './commit-msg.js';
 import { applyWorkspaceGitConfig } from './git-config.js';
 import { syncBunLockfileVersions } from './lockfile.js';
@@ -64,7 +64,8 @@ export async function checkManagedFiles(root, options = {}) {
     }
     const results = await applyManagedFiles(root, 'check');
     printResults(results);
-    const resolvedTargets = resolvedTargetsByProject(await readProjectTargets(root));
+    const projectTargets = await readProjectTargets(root);
+    const resolvedTargets = resolvedTargetsByProject(projectTargets);
     const packageFailures = validateRootPackagePolicy(root) +
         validateNxProjectNames(root) +
         validateNxReleaseConfig(root) +
@@ -75,6 +76,7 @@ export async function checkManagedFiles(root, options = {}) {
         validateWorkspaceDependencies(root, { resolvedTargetsByProject: resolvedTargets }) +
         validateDevenvModuleImport(root) +
         validateCargoCachePolicy(root) +
+        validateCargoToolchainInputs(root, projectTargets) +
         validateSccachePatches(root);
     if (results.some((result) => result.action === 'drifted') || packageFailures > 0) {
         throw new Error('Managed monorepo files or package conventions are out of date. Run: smoo monorepo update');

package/dist/monorepo/managed-files.d.ts

@@ -1,5 +1,6 @@
 import { type NonEmptyArray, type PackageCargoCredentialsConfig, type PackagePrivateNpmConfig, type PackageRemoteCacheConfig, type PackageSmooGithub, type PackageSmooGithubEnvironments, type PackageSourceCheckoutConfig } from '../lib/json.js';
 import { type NxProjects } from '../nx/index.js';
+import type { DeploymentStage } from '../wrangler/stage.js';
 import { type CiCrossTestArchive } from './ci-workflow.js';
 /**
  * Repos may append their own content to a managed file below this marker —
@@ -97,6 +98,8 @@ export declare const managedFileTargetsForTest: {
     target: string;
     executable: boolean | undefined;
 }[];
+/** Test seam: the managed targets a repository of this shape gets, in file order. */
+export declare function managedFileTargetsForContext(context: ManagedFileContext): string[];
 export declare function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): Promise<FileResult[]>;
 /** Renders a generated workflow through its real managed-file descriptor, so the context wiring is covered. */
 export declare function renderManagedWorkflowForTest(source: 'ci-workflow' | 'publish-workflow', context: ManagedFileContext): string;
@@ -134,8 +137,8 @@ export declare function platformTargetGlobsForTest(targetNames: Iterable<string>
  * platform builds serialize no matter how many workers Nx is given.
  */
 export declare function macosPlatformArchitecturesForTest(targetNames: Iterable<string>): string[];
-/** Test seam: deploy configuration presence/provider from graph nodes. */
-export declare function deployTargetInfoFromProjects(projects: NxProjects, configuration: string): DeployTargetInfo;
+/** Test seam: what the stage flow deploys, and with which provider, from graph nodes. */
+export declare function deployTargetInfoFromProjects(projects: NxProjects, stage: DeploymentStage): DeployTargetInfo;
 /** Test seam: whether any project in the graph carries the Nx tag. */
 export declare function anyProjectHasTagForTest(projects: NxProjects, tag: string): boolean;
 export declare function printResults(results: FileResult[]): void;

package/dist/monorepo/managed-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,6BAA6B,EAElC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAEL,KAAK,UAAU,EAIhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,kBAAkB,EAAmD,MAAM,kBAAkB,CAAC;AAO5G;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAW3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAkCxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAuBtF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,OAAO,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uBAAuB,EAAE,OAAO,CAAC;IACjC,8BAA8B,EAAE,OAAO,CAAC;IACxC,qBAAqB,CAAC,EAAE,YAAY,CAAC;IACrC,wBAAwB,CAAC,EAAE,YAAY,CAAC;IACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,yFAAyF;IACzF,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qFAAqF;IACrF,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,wFAAwF;IACxF,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,uGAAuG;IACvG,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;;OAIG;IACH,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;CACzC;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAwID,eAAO,MAAM,yBAAyB;;;GAAyE,CAAC;AAIhH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAG9G;AA6CD,+GAA+G;AAC/G,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,GAAG,kBAAkB,EAC1C,OAAO,EAAE,kBAAkB,GAC1B,MAAM,CAMR;AA8HD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAiBnF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,MAAM,EAAE,CAIV;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAMlF;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAezF;AAED,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAY1G;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAElF;AAqED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxE;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE"}
+{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,6BAA6B,EAElC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAEL,KAAK,UAAU,EAIhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,KAAK,kBAAkB,EAAmD,MAAM,kBAAkB,CAAC;AAO5G;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAW3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAkCxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAuBtF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,OAAO,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uBAAuB,EAAE,OAAO,CAAC;IACjC,8BAA8B,EAAE,OAAO,CAAC;IACxC,qBAAqB,CAAC,EAAE,YAAY,CAAC;IACrC,wBAAwB,CAAC,EAAE,YAAY,CAAC;IACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,yFAAyF;IACzF,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qFAAqF;IACrF,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,wFAAwF;IACxF,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,uGAAuG;IACvG,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;;OAIG;IACH,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;CACzC;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAwID,eAAO,MAAM,yBAAyB;;;GAAyE,CAAC;AAgBhH,qFAAqF;AACrF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAElF;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAG9G;AA0CD,+GAA+G;AAC/G,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,GAAG,kBAAkB,EAC1C,OAAO,EAAE,kBAAkB,GAC1B,MAAM,CAMR;AA8HD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAiBnF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,MAAM,EAAE,CAIV;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAMlF;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAezF;AAED,yFAAyF;AACzF,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAY3G;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAElF;AAuED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxE;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE"}

package/dist/monorepo/managed-files.js

@@ -3,7 +3,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { cargoCrossTestArchiveFile, cargoCrossTestTripleFromArchiveTarget, } from '@smoothbricks/nx-plugin/cross-check-policy';
 import { MACOS_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { isStageDerivedDeploy, PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PRODUCTION_PUSH_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import { ciPushBranches, readValidatedPackageJson, } from '../lib/json.js';
 import { listReleasePackages, packageInfo } from '../lib/workspace.js';
 import { loadNxProjects, projectRootFromNxProjectJson, targetNamesFromNxProjectJson, targetNamesFromProjects, } from '../nx/index.js';
@@ -236,15 +236,27 @@ const managedFiles = [
 ];
 export const managedFileTargetsForTest = managedFiles.map(({ target, executable }) => ({ target, executable }));
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+/**
+ * Whether a repository of this shape has the file at all. A repository that owns
+ * no packages has nothing to publish, and one the stage flow does not deploy to
+ * Cloudflare has no preview stage to clean up.
+ */
+function managedFileApplies(file, context) {
+    if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
+        return false;
+    }
+    return file.cloudflareDeployOnly !== true || context.stagingDeployProvider === 'cloudflare';
+}
+/** Test seam: the managed targets a repository of this shape gets, in file order. */
+export function managedFileTargetsForContext(context) {
+    return managedFiles.filter((file) => managedFileApplies(file, context)).map((file) => file.target);
+}
 export async function applyManagedFiles(root, mode) {
     const context = await getManagedFileContext(root);
     return managedFiles.map((file) => applyManagedFile(root, file, mode, context));
 }
 function applyManagedFile(root, file, mode, context) {
-    if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
-        return { target: file.target, action: 'skipped' };
-    }
-    if (file.cloudflareDeployOnly === true && context.stagingDeployProvider !== 'cloudflare') {
+    if (!managedFileApplies(file, context)) {
         return { target: file.target, action: 'skipped' };
     }
     const target = resolve(root, file.target);
@@ -483,12 +495,12 @@ export function macosPlatformArchitecturesForTest(targetNames) {
     }
     return [...architectures].sort((left, right) => left.localeCompare(right));
 }
-/** Test seam: deploy configuration presence/provider from graph nodes. */
-export function deployTargetInfoFromProjects(projects, configuration) {
+/** Test seam: what the stage flow deploys, and with which provider, from graph nodes. */
+export function deployTargetInfoFromProjects(projects, stage) {
     let exists = false;
     let provider;
     for (const project of Object.values(projects)) {
-        const info = deployTargetInfoFromProject(project, configuration);
+        const info = deployTargetInfoFromProject(project, stage);
         if (!info.exists) {
             continue;
         }
@@ -501,22 +513,24 @@ export function deployTargetInfoFromProjects(projects, configuration) {
 export function anyProjectHasTagForTest(projects, tag) {
     return Object.values(projects).some((project) => project.tags?.includes(tag));
 }
-function deployTargetInfoFromProject(project, configuration) {
+/**
+ * A generated deploy job exists for the projects CI would actually deploy, which
+ * is `stageDeploysProject` and nothing else — the same rule `smoo github-ci
+ * nx-deploy` selects by, so the job and its selection cannot disagree. Reading
+ * the target's presence instead would render a deploy job, with cloud
+ * credentials, into a repository whose only wrangler manifests document a
+ * Durable Object binding for a published library's consumers.
+ *
+ * The command is read for the PROVIDER only: which cloud CLI runs says which
+ * credentials the job needs, and says nothing about whether CI runs it.
+ */
+function deployTargetInfoFromProject(project, stage) {
     const deploy = project.targets?.deploy;
-    if (!deploy) {
-        return { exists: false };
-    }
-    const baseCommandValue = deploy.options?.command ?? deploy.command;
-    const baseCommand = typeof baseCommandValue === 'string' ? baseCommandValue : '';
-    if (isStageDerivedDeploy(project.tags, baseCommand)) {
-        return { exists: true, provider: deployProvider(baseCommand) };
-    }
-    const config = deploy.configurations?.[configuration];
-    if (!config) {
+    if (!deploy || !stageDeploysProject(project.tags, stage)) {
         return { exists: false };
     }
-    const commandValue = config.command ?? config.options?.command ?? baseCommand;
-    return { exists: true, provider: deployProvider(typeof commandValue === 'string' ? commandValue : '') };
+    const command = deploy.options?.command ?? deploy.command;
+    return { exists: true, provider: deployProvider(typeof command === 'string' ? command : '') };
 }
 function deployProvider(command) {
     return command.includes('wrangler ') ? 'cloudflare' : undefined;

package/dist/monorepo/packs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAO5E,OAAO,EAKL,KAAK,sBAAsB,EAS5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AA8ID,0DAA0D;AAC1D,eAAO,MAAM,YAAY,gBAAQ,CAAC;AAElC,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAwMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAexG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAW5E,OAAO,EAKL,KAAK,sBAAsB,EAS5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAmJD,0DAA0D;AAC1D,eAAO,MAAM,YAAY,gBAAQ,CAAC;AAElC,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAwMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAexG"}

package/dist/monorepo/packs/index.js

@@ -2,7 +2,7 @@ import { chmodSync, existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
 import { readProjectTargets } from '../../nx/index.js';
-import { applyCargoFeatureUnification, validateCargoCachePolicy } from '../cargo-policy.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy, validateCargoToolchainInputs, } from '../cargo-policy.js';
 import { validateGoToolchainAgreement } from '../go-toolchain.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
 import { validateDevenvModuleImport, warnOnManagedFileDrift } from '../managed-files.js';
@@ -76,6 +76,11 @@ const packs = [
         validatePreBuild(ctx) {
             return validateCargoCachePolicy(ctx.root);
         },
+        // Post-build: the toolchain identity is read off the RESOLVED graph, which
+        // means running the inference plugin, which means its dist has to exist.
+        async validatePostBuild(ctx) {
+            return validateCargoToolchainInputs(ctx.root, await readProjectTargets(ctx.root));
+        },
     },
     {
         name: 'publishing',

package/dist/nx/index.d.ts

@@ -4,8 +4,12 @@ export interface ProjectTargets {
     root?: string;
     targets: string[];
     buildDependsOn?: string[];
+    /** Per-target `cache`, for policies that only govern what Nx can restore. */
+    targetCache?: Map<string, boolean>;
     targetDependencies?: Map<string, string[]>;
     targetExecutors?: Map<string, string>;
+    /** Per-target string inputs; object inputs (`runtime`, `json`, …) are dropped. */
+    targetInputs?: Map<string, string[]>;
     targetOptions?: Map<string, NxTargetOptions>;
     targetOutputs?: Map<string, string[]>;
     targetScripts?: Map<string, string>;
@@ -22,6 +26,8 @@ export declare function targetDependenciesFromNxProjectJson(value: NxProjectJson
 export declare function targetExecutorsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string>;
 export declare function targetOptionsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, NxTargetOptions>;
 export declare function targetOutputsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string[]>;
+export declare function targetInputsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string[]>;
+export declare function targetCacheFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, boolean>;
 export declare function targetScriptsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string>;
 export declare function formatProjectTargetLines(projects: ProjectTargets[]): string;
 export declare function projectNamesWithTarget(projects: ProjectTargets[], target: string): string[];

package/dist/nx/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nx/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGlG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAElD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEzD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAG9F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExG;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBlH;AAsBD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAYpH;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY3G;AA0BD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAK3E;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAK3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5D;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5D;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAYjE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOhE;AA2DD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,EAAE,CAQtE;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,GAAG,cAAc,EAAE,CAiBnF;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhF;AAED,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nx/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGlG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,kFAAkF;IAClF,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAElD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEzD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAG9F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExG;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBlH;AAsBD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAYpH;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE7G;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE5G;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ1G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY3G;AA0BD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAK3E;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAK3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5D;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5D;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAYjE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOhE;AA2DD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,EAAE,CAQtE;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,GAAG,cAAc,EAAE,CAmBnF;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhF;AAED,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC"}

package/dist/nx/index.js

@@ -91,6 +91,18 @@ export function targetOptionsFromNxProjectJson(value) {
 export function targetOutputsFromNxProjectJson(value) {
     return targetStringArraysFromNxProjectJson(value, 'outputs');
 }
+export function targetInputsFromNxProjectJson(value) {
+    return targetStringArraysFromNxProjectJson(value, 'inputs');
+}
+export function targetCacheFromNxProjectJson(value) {
+    const cache = new Map();
+    for (const [targetName, target] of Object.entries(value?.targets ?? {})) {
+        if (typeof target.cache === 'boolean') {
+            cache.set(targetName, target.cache);
+        }
+    }
+    return cache;
+}
 export function targetScriptsFromNxProjectJson(value) {
     const targets = value?.targets;
     const scripts = new Map();
@@ -277,7 +289,9 @@ export function projectTargetsFromNxProjects(projects) {
             root: projectRootFromNxProjectJson(metadata),
             targets: targetNamesFromNxProjectJson(metadata),
             buildDependsOn: targetDependencies.get('build'),
+            targetCache: targetCacheFromNxProjectJson(metadata),
             targetDependencies,
+            targetInputs: targetInputsFromNxProjectJson(metadata),
             targetExecutors: targetExecutorsFromNxProjectJson(metadata),
             targetOptions: targetOptionsFromNxProjectJson(metadata),
             targetOutputs: targetOutputsFromNxProjectJson(metadata),

package/dist/secrets/commands.d.ts

@@ -1,5 +1,5 @@
 /**
- * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ * `smoo secrets` — the operator side of the reconciliation in ./status.ts.
  *
  * Values are handed to `gh` over stdin, never through argv (a process list is
  * world-readable) and never printed. Reading one from the terminal disables
@@ -14,7 +14,7 @@
  * repository reports values that do exist as absent, and sends an operator
  * hunting for a secret that is already set.
  */
-import { type SecretRow } from './index.js';
+import { type SecretRow } from './status.js';
 /**
  * Every secret this checkout declares that the repository does not hold, in
  * the order an operator should fix them: the ones a workflow already promises
@@ -53,15 +53,19 @@ export declare function writeRepositorySecret(name: string, value: string, repo:
     reason: string;
 }>;
 /**
- * Print every known secret and the scopes holding it. Exit code 1 when a
+ * Print every known secret and the scopes holding it, or - with `json` - the
+ * same facts as one document on stdout and nothing else. Exit code 1 when a
  * workflow promises a value no scope a bound job reads can supply — that
  * combination is the one that fails a deploy, and it fails talking about the
- * value rather than the missing secret.
+ * value rather than the missing secret. `--json` reports that refusal in
+ * `unsatisfied` and still exits 1: a machine-readable status that always
+ * succeeded would be a status nobody could gate on.
  */
 export declare function secretsStatus(root: string, options: {
     repo?: string;
     env?: string;
-}): number;
+    json?: boolean;
+}): Promise<number>;
 /**
  * Set one secret, or - with no name - walk every secret this checkout declares
  * and the target scope does not hold, prompting once each. The walk is the

package/dist/secrets/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/secrets/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAKL,KAAK,SAAS,EAOf,MAAM,YAAY,CAAC;AAGpB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAG5E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,CAOxG;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUnD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwB/D;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAYvD;AAyCD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAkF5F;AA8BD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAuBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BzG"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/secrets/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAcH,OAAO,EAIL,KAAK,SAAS,EAKf,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAG5E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,CAOxG;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUnD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwB/D;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAYvD;AAoGD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,OAAO,CAAC,MAAM,CAAC,CAwFjB;AA8BD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,MAAM,CAAC,CA8DjB;AAuBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCzG"}

package/dist/secrets/commands.js

@@ -1,5 +1,5 @@
 /**
- * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ * `smoo secrets` — the operator side of the reconciliation in ./status.ts.
  *
  * Values are handed to `gh` over stdin, never through argv (a process list is
  * world-readable) and never printed. Reading one from the terminal disables
@@ -16,8 +16,9 @@
  */
 import { spawn, spawnSync } from 'node:child_process';
 import { getWorkspacePackages } from '../lib/workspace.js';
-import { environmentsMissing, fetchLocalSecret, localSecretCommandNames, reconcileSecrets, secretNameMapping, unsatisfiedSecrets, unwiredSecrets, workerSecretNames, workflowEnvironments, workflowSecretNames, } from './index.js';
+import { fetchLocalSecret, localSecretGroups, secretNameMapping, workerSecretNames, workerSecretStages, workflowEnvironments, workflowSecretNames, } from './index.js';
 import { resolveRepository } from './repository.js';
+import { projectSecretsStatus, reconcileSecrets, stringifySecretsStatusDocument, unwiredSecrets, } from './status.js';
 /**
  * Every secret this checkout declares that the repository does not hold, in
  * the order an operator should fix them: the ones a workflow already promises
@@ -108,19 +109,21 @@ export async function writeRepositorySecret(name, value, repo, environment) {
         ? { ok: true }
         : { ok: false, reason: `gh ${args.join(' ')} exited ${status ?? 'without status'}` };
 }
-function collectSources(root, repositorySecrets, environmentSecrets = {}) {
-    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+function collectSources(root, workspaceDirs, localSecrets, repositorySecrets, environmentSecrets = {}) {
     const workerSecrets = workerSecretNames(root, workspaceDirs);
     const workflowSecrets = workflowSecretNames(root);
-    const localCommands = localSecretCommandNames(root);
     const envNames = [
-        ...new Set([...Object.values(workerSecrets).flatMap((names) => [...names]), ...workflowSecrets, ...localCommands]),
+        ...new Set([
+            ...Object.values(workerSecrets).flatMap((names) => [...names]),
+            ...workflowSecrets,
+            ...localSecrets.map((secret) => secret.name),
+        ]),
     ];
     return {
         workerSecrets,
         workflowSecrets,
         secretNames: secretNameMapping(root, envNames),
-        localCommands,
+        localSecrets,
         repositorySecrets,
         environmentSecrets,
     };
@@ -141,47 +144,89 @@ function describe(row, scopeWidth) {
     ].join('  ');
 }
 /**
- * Print every known secret and the scopes holding it. Exit code 1 when a
- * workflow promises a value no scope a bound job reads can supply — that
- * combination is the one that fails a deploy, and it fails talking about the
- * value rather than the missing secret.
+ * Everything `status` reports, read from git, `gh` and the checkout before a
+ * single line is printed. Gathering ahead of rendering is what lets one run
+ * answer either a human or a machine from exactly the same facts: `--json`
+ * cannot drift from the table because there is nothing for it to drift from.
  */
-export function secretsStatus(root, options) {
+async function gatherSecretsStatus(root, options) {
     const resolved = resolveRepository(root, options.repo);
-    if (!resolved.ok) {
-        console.error(resolved.reason);
-        return 1;
-    }
+    if (!resolved.ok)
+        return resolved;
     const { repo, source } = resolved.choice;
     const repositorySecrets = readRepositorySecrets(repo);
-    if (!repositorySecrets.ok) {
-        console.error(repositorySecrets.reason);
-        return 1;
-    }
+    if (!repositorySecrets.ok)
+        return repositorySecrets;
     // The workflows decide which environments a job reads; an explicitly asked
     // for one is shown too, so an operator can inspect a scope before a workflow
     // binds it.
     const boundEnvironments = workflowEnvironments(root);
     const asked = options.env !== undefined && !boundEnvironments.includes(options.env) ? [options.env] : [];
     const environmentSecrets = {};
-    const unreadable = [];
-    for (const environment of [...boundEnvironments, ...asked]) {
-        const held = readRepositorySecrets(repo, environment);
-        if (held.ok)
-            environmentSecrets[environment] = held.names;
-        else
-            unreadable.push({ environment, reason: held.reason });
+    const environments = [];
+    for (const name of [...boundEnvironments, ...asked]) {
+        const bound = boundEnvironments.includes(name);
+        const held = readRepositorySecrets(repo, name);
+        // An environment that cannot be read is reported, never assumed empty:
+        // guessing produces a refusal about a value that may well be set.
+        if (!held.ok) {
+            environments.push({ name, bound, readable: false, reason: held.reason });
+            continue;
+        }
+        environmentSecrets[name] = held.names;
+        environments.push({ name, bound, readable: true, secretCount: held.names.length });
+    }
+    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+    const stageScopes = workerSecretStages(root, workspaceDirs);
+    if (!stageScopes.ok)
+        return stageScopes;
+    // A `smoo.secrets` declaration smoo cannot read is a refusal, not an empty
+    // list: reporting "nothing is fetchable locally" for a manifest that says
+    // otherwise is the confident wrong answer.
+    const localSecrets = await localSecretGroups(root);
+    if (!localSecrets.ok)
+        return localSecrets;
+    return {
+        ok: true,
+        document: projectSecretsStatus({
+            repository: { repo, source, secretCount: repositorySecrets.names.length },
+            environments,
+            rows: reconcileSecrets(collectSources(root, workspaceDirs, localSecrets.secrets, repositorySecrets.names, environmentSecrets)),
+            stageScopes: stageScopes.byWorker,
+        }),
+    };
+}
+/**
+ * Print every known secret and the scopes holding it, or - with `json` - the
+ * same facts as one document on stdout and nothing else. Exit code 1 when a
+ * workflow promises a value no scope a bound job reads can supply — that
+ * combination is the one that fails a deploy, and it fails talking about the
+ * value rather than the missing secret. `--json` reports that refusal in
+ * `unsatisfied` and still exits 1: a machine-readable status that always
+ * succeeded would be a status nobody could gate on.
+ */
+export async function secretsStatus(root, options) {
+    const gathered = await gatherSecretsStatus(root, options);
+    if (!gathered.ok) {
+        console.error(gathered.reason);
+        return 1;
+    }
+    const { document } = gathered;
+    const { repo, source } = document.repository;
+    if (options.json) {
+        console.log(stringifySecretsStatusDocument(document));
+        return document.unsatisfied.length > 0 ? 1 : 0;
     }
-    // An environment that cannot be read is reported, never assumed empty:
-    // guessing produces a refusal about a value that may well be set.
-    const readable = boundEnvironments.filter((environment) => environment in environmentSecrets);
-    const rows = reconcileSecrets(collectSources(root, repositorySecrets.names, environmentSecrets));
-    console.log(`repository ${repo} (${source}), holding ${repositorySecrets.names.length} secrets`);
-    for (const [environment, names] of Object.entries(environmentSecrets)) {
-        console.log(`environment ${environment}, holding ${names.length} secrets`);
+    const rows = document.secrets;
+    console.log(`repository ${repo} (${source}), holding ${document.repository.secretCount} secrets`);
+    for (const environment of document.environments) {
+        if (environment.readable)
+            console.log(`environment ${environment.name}, holding ${environment.secretCount} secrets`);
     }
-    for (const { environment, reason } of unreadable) {
-        console.log(`environment ${environment} could not be read, so nothing below claims what it holds: ${reason}`);
+    for (const environment of document.environments) {
+        if (environment.readable)
+            continue;
+        console.log(`environment ${environment.name} could not be read, so nothing below claims what it holds: ${environment.reason}`);
     }
     const scopeWidth = Math.max('held by'.length, ...rows.map((row) => heldBy(row).length));
     console.log(`${'held by'.padEnd(scopeWidth)}  ${'name'.padEnd(32)}  workflow  local  declared by`);
@@ -195,6 +240,22 @@ export function secretsStatus(root, options) {
                 'declare it in smoo.github.deploySecrets to have CI supply it.');
         }
     }
+    // A declared `group` that disagrees with what this repository's own
+    // declarations derive is the override working — and a silent override is
+    // how the next reader loses an hour wondering why a `.npmrc` credential
+    // resolves at shell entry. It is stated here, where a human is already
+    // looking at every declared secret.
+    const overridden = rows.filter((row) => row.localGroup !== undefined && row.localGroup.resolves !== row.localGroup.derived);
+    if (overridden.length > 0) {
+        console.log('');
+        for (const row of overridden) {
+            const local = row.localGroup;
+            if (local === undefined)
+                continue;
+            console.log(`note: ${row.name} declares group \`${local.resolves}\`, overriding the \`${local.derived}\` this ` +
+                `repository's declarations derive; \`smoo secrets run ${local.resolves} <command>\` is what resolves it.`);
+        }
+    }
     // A value an environment holds is not a value to duplicate at repository
     // scope: offering it invites two sources of truth for one credential, and
     // the table above already shows where it lives. Only a name no scope holds
@@ -209,23 +270,21 @@ export function secretsStatus(root, options) {
         console.log(`set them all, one prompt each:  smoo secrets set -R ${repo}`);
         console.log(`set one:                        smoo secrets set ${needed[0]?.repositorySecret ?? 'NAME'} -R ${repo}`);
     }
-    const unsatisfied = unsatisfiedSecrets(rows, readable);
-    if (unsatisfied.length === 0)
+    if (document.unsatisfied.length === 0)
         return 0;
     console.log('');
-    for (const row of unsatisfied) {
-        const missing = environmentsMissing(row, readable);
-        const scopes = missing.length > 0 ? missing.join(', ') : 'the repository';
-        console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and no value exists in ${scopes}.`);
-        if (missing.length === 0) {
-            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo}`);
+    for (const { name, repositorySecret, missingIn } of document.unsatisfied) {
+        const scopes = missingIn.length > 0 ? missingIn.join(', ') : 'the repository';
+        console.error(`missing: ${name} — a workflow passes secrets.${name} and no value exists in ${scopes}.`);
+        if (missingIn.length === 0) {
+            console.error(`  smoo secrets set ${repositorySecret} -R ${repo}`);
             continue;
         }
-        for (const environment of missing) {
+        for (const environment of missingIn) {
             const named = environment.includes(' ') ? `'${environment}'` : environment;
-            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo} --env ${named}`);
+            console.error(`  smoo secrets set ${repositorySecret} -R ${repo} --env ${named}`);
         }
-        console.error(`  or one value for every environment:  smoo secrets set ${row.repositorySecret} -R ${repo}`);
+        console.error(`  or one value for every environment:  smoo secrets set ${repositorySecret} -R ${repo}`);
     }
     return 1;
 }
@@ -290,7 +349,13 @@ export async function secretsSet(root, name, options) {
         }
         environmentSecrets[environment] = inEnvironment.names;
     }
-    const rows = reconcileSecrets(collectSources(root, held.names, environmentSecrets));
+    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+    const local = await localSecretGroups(root);
+    if (!local.ok) {
+        console.error(local.reason);
+        return 1;
+    }
+    const rows = reconcileSecrets(collectSources(root, workspaceDirs, local.secrets, held.names, environmentSecrets));
     const needed = environment === undefined ? secretsNeedingValues(rows) : secretsMissingInEnvironment(rows, environment);
     const target = environment === undefined ? `${repo} (${source})` : `environment ${environment} on ${repo} (${source})`;
     if (needed.length === 0) {
@@ -349,7 +414,15 @@ export async function secretsSync(root, options) {
     }
     const { repo } = resolved.choice;
     const environment = options.env;
-    const names = localSecretCommandNames(root);
+    const local = await localSecretGroups(root);
+    if (!local.ok) {
+        console.error(local.reason);
+        return 1;
+    }
+    // Every group: a repository secret store holds the credential whatever
+    // resolves it locally, and a `smoo secrets run` group is about which
+    // command pays the provider prompt, not about which values CI needs.
+    const names = local.secrets.map((secret) => secret.name);
     if (names.length === 0) {
         console.error('smoo.secrets declares no fetch commands; nothing to sync.');
         return 1;