@smoothbricks/cli 0.11.18 → 0.11.20

package/src/cli.ts

@@ -7,6 +7,7 @@ import { decode, findRepoRoot, printCommandOutput } from './lib/run.js';
 import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
 import { secretsSet, secretsStatus, secretsSync } from './secrets/commands.js';
+import { secretsRun } from './secrets/run.js';
 import { cleanupPullRequest, deployStage } from './wrangler/deploy-stage.js';
 import { deployedVersion } from './wrangler/deployed-version.js';
 import { scaffold } from './wrangler/scaffold.js';
@@ -74,6 +75,11 @@ function buildProgram(): Command {
     .description('SmoothBricks monorepo tooling')
     .version(cliPackageVersion, '-v, --version', 'print smoo version')
     .exitOverride()
+    // `smoo secrets run <group> <command...>` hands the rest of argv to a
+    // child verbatim, flags included. Commander only stops parsing after the
+    // first operand when positional options are enabled here, on the parent
+    // of the command that declares `passThroughOptions`.
+    .enablePositionalOptions()
     .showHelpAfterError();
 
   const monorepo = program.command('monorepo').description('Manage SmoothBricks-style monorepos');
@@ -529,11 +535,29 @@ function buildProgram(): Command {
 
   const secrets = program
     .command('secrets')
-    .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
+    .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds')
+    .enablePositionalOptions();
+  secrets
+    .command('run [group] [command...]')
+    .description(
+      'Run one command with one group of declared secrets in its environment. Shell entry resolves the ' +
+        '`shell` group only, so a registry credential or the Nx cache token is resolved here, by the command ' +
+        'that needs it, instead of by every direnv reload. The group is required and positional: with none, ' +
+        'this lists the groups this repository declares and the secrets in each',
+    )
+    // Everything after the group reaches the child verbatim, flags included:
+    // `smoo secrets run registry bun add -d @acme/x` must run `bun add -d
+    // @acme/x`, not lose `-d` to this command's own parser.
+    .passThroughOptions()
+    .action(async (group: string | undefined, command: string[]) => {
+      process.exitCode = await secretsRun(await findRepoRoot(), group, command);
+    });
   secrets
     .command('status')
     .description(
-      'Show every declared secret with the scopes holding it, and refuse when a workflow passes one none has',
+      'Show every declared secret with the scopes holding it. Exits 0 when every secret a managed workflow ' +
+        'passes has a value in a scope the job reads, and 1 when one does not or when the repository, its ' +
+        'secrets or a stage declaration could not be read',
     )
     .option(
       '-R, --repo <owner/name|remote>',
@@ -543,8 +567,13 @@ function buildProgram(): Command {
       '--env <environment>',
       "also read this GitHub Environment; its value takes precedence over the repository's for a job bound to it",
     )
-    .action(async (options: { repo?: string; env?: string }) => {
-      process.exitCode = secretsStatus(await findRepoRoot(), options);
+    .option(
+      '--json',
+      'write one JSON document to stdout instead of the table, for another tool to read; the exit code is ' +
+        'unchanged, so a status that refuses still refuses',
+    )
+    .action(async (options: { repo?: string; env?: string; json?: boolean }) => {
+      process.exitCode = await secretsStatus(await findRepoRoot(), options);
     });
   secrets
     .command('set [name]')
@@ -586,7 +615,7 @@ function buildProgram(): Command {
   wrangler
     .command('deploy-stage')
     .requiredOption('--stage <stage>', 'staging, production, or prN')
-    .option('--config <path>', 'deploy a build-generated flat wrangler.json instead of ./wrangler.toml')
+    .option('--config <path>', "deploy a build-generated flat wrangler.json instead of the project's own config")
     .option('--version-endpoint <url>', 'URL served by this worker whose trimmed body is the running version tag')
     .action(async (options: { stage: string; config?: string; versionEndpoint?: string }) => {
       await deployStage(process.cwd(), {

package/src/github-ci/index.test.ts

@@ -847,8 +847,11 @@ describe('event-aware stage deployment', () => {
     ).toThrow(/same-repository/);
   });
 
-  it('selects stage-derived deploy targets plus staging-only infrastructure on staging', async () => {
+  it('selects tagged stage projects plus staging-only infrastructure, and never an untagged one', async () => {
     const definitions: Record<string, unknown> = {
+      // A private wrangler project the plugin gave a deploy target and nobody tagged: deployable
+      // by hand, invisible to CI. Reading the command instead deployed whatever held a wrangler
+      // manifest, including a published library that ships one to document a binding.
       app: {
         targets: {
           deploy: { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } },
@@ -875,18 +878,15 @@ describe('event-aware stage deployment', () => {
     const loadProject = async (project: string) => definitions[project];
 
     await expect(selectStageDeployProjects(candidates, 'staging', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'e2e-mail-capture',
       'website',
     ]);
     await expect(selectStageDeployProjects(candidates, 'pr123', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'website',
     ]);
     await expect(selectStageDeployProjects(candidates, 'production', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'website',
     ]);
@@ -1303,15 +1303,14 @@ describe('selectStageDeployProjects with a required tag', () => {
   };
   const loadProject = async (project: string) => definitions[project];
 
-  it('keeps only projects carrying the tag, on top of the stage-derived rule', async () => {
+  it('keeps only projects carrying the tag, on top of the stage rules', async () => {
     await expect(
       selectStageDeployProjects(Object.keys(definitions), 'production', 'production-push-deploy-target', loadProject),
     ).resolves.toEqual(['website']);
   });
 
-  it('selects the website on every stage once it is stage-derived', async () => {
+  it('selects only the tagged project on every stage, required tag or not', async () => {
     await expect(selectStageDeployProjects(Object.keys(definitions), 'pr12', undefined, loadProject)).resolves.toEqual([
-      'app',
       'website',
     ]);
   });

package/src/github-ci/index.ts

@@ -4,7 +4,7 @@ import { appendFile } from 'node:fs/promises';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { $ } from 'bun';
 import typia from 'typia';
-import { isStageDerivedDeploy, PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import {
   ciPushBranches,
   isNonEmpty,
@@ -35,16 +35,14 @@ export interface GithubActionsEventPayload {
   };
 }
 
+/**
+ * What a deploy candidate is READ for: its tags. `nx show projects --withTarget
+ * deploy` already established the target, and the tags decide the rest, so a
+ * project whose `tags` is not a string array fails the parse instead of being
+ * silently untagged.
+ */
 interface NxProjectDeployTarget {
-  tags?: unknown;
-  targets?: {
-    deploy?: {
-      command?: unknown;
-      options?: {
-        command?: unknown;
-      };
-    };
-  };
+  tags?: string[];
 }
 
 const parseGithubActionsEvent = typia.json.createIsParse<GithubActionsEventPayload>();
@@ -570,16 +568,10 @@ export async function selectStageDeployProjects(
   for (const project of candidates) {
     const definition = await loadProject(project);
     if (!isNxProjectDeployTarget(definition)) continue;
-    const deploy = definition.targets?.deploy;
-    const commandValue = deploy?.options?.command ?? deploy?.command;
-    const tags = Array.isArray(definition.tags)
-      ? definition.tags.filter((tag): tag is string => typeof tag === 'string')
-      : [];
-    const isStageDerived = isStageDerivedDeploy(tags, typeof commandValue === 'string' ? commandValue : undefined);
-    const isStagingOnly = tags.includes(STAGING_DEPLOY_TAG);
+    const tags = definition.tags;
     // A required tag narrows the stage rules; it never selects a project they exclude.
-    if (requireTag && !tags.includes(requireTag)) continue;
-    if (isStageDerived || (stage === 'staging' && isStagingOnly)) {
+    if (requireTag && !tags?.includes(requireTag)) continue;
+    if (stageDeploysProject(tags, stage)) {
       selected.push(project);
     }
   }

package/src/lib/deploy-tags.ts

@@ -1,6 +1,8 @@
 // The Nx tags that drive stage deploys. CI selection (github-ci), workflow generation (monorepo)
 // and the graph readers must agree on these, so they live here rather than with any one of them.
 
+import type { DeploymentStage } from '../wrangler/stage.js';
+
 /** Deployed on every stage: one command that deploys whichever stage it is given. */
 const STAGE_DEPLOY_TAG = 'stage-deploy-target';
 
@@ -14,9 +16,25 @@ export const PERMANENT_DEPLOY_TAG = 'permanent-deploy-target';
 export const PRODUCTION_PUSH_DEPLOY_TAG = 'production-push-deploy-target';
 
 /**
- * Whether a deploy target is stage-derived (the tag, or the `smoo wrangler deploy-stage` command) rather than a set of
- * per-stage configurations; CI selection and workflow generation must agree on this.
+ * Whether the stage flow deploys a project, from its TAGS alone — the one rule
+ * CI selection and workflow generation both read, so a generated deploy job and
+ * the projects that job deploys cannot disagree.
+ *
+ * Having a `deploy` target is not that answer. A deploy target says a project
+ * CAN be deployed; only a tag says CI does it. A published library ships a
+ * wrangler manifest to document a Durable Object binding for its consumers, and
+ * that manifest is structurally identical to a deployable worker's — so the
+ * plugin infers `deploy` from one, and a repository that deploys nothing from CI
+ * would otherwise generate a deploy job, with cloud credentials, for it.
+ *
+ * The three tags compose as precedence, not as a set: `permanent` excludes a
+ * project from every stage, `staging` narrows it to one, `stage` generalizes it
+ * to all. `production-push` selects WITHIN this answer (see `--select-tag`) and
+ * never widens it.
  */
-export function isStageDerivedDeploy(tags: string[] | undefined, command: string | undefined): boolean {
-  return tags?.includes(STAGE_DEPLOY_TAG) === true || command?.includes('smoo wrangler deploy-stage') === true;
+export function stageDeploysProject(tags: string[] | undefined, stage: DeploymentStage): boolean {
+  if (tags === undefined) return false;
+  if (tags.includes(PERMANENT_DEPLOY_TAG)) return false;
+  if (tags.includes(STAGING_DEPLOY_TAG)) return stage === 'staging';
+  return tags.includes(STAGE_DEPLOY_TAG);
 }

package/src/lib/json.ts

@@ -212,10 +212,32 @@ export interface PackageRemoteCacheConfig {
   tokenSecret: RepositorySecretName;
 }
 
-/** Local bootstrap fallback; existing environment values always take precedence. */
+/**
+ * A `smoo.secrets` group: which operation resolves the credential. One argv
+ * word of `smoo secrets run <group> <command...>`, so whitespace would make
+ * that command unwritable. Only the shape is validated — the values are the
+ * repository's, and a new group must not need a new smoo release.
+ */
+export type SecretGroupName = string & typia.tags.MinLength<1> & typia.tags.Pattern<'^\\S+$'>;
+
+/**
+ * Local bootstrap fallback; existing environment values always take
+ * precedence, and CI injects these variables instead of running commands.
+ *
+ * Shell entry resolves the `shell` group and nothing else; every other group
+ * is resolved by `smoo secrets run <group> <command...>`, the one command
+ * that needs it. The group is DERIVED from what this manifest already
+ * declares — a variable `.npmrc` interpolates as `${VAR}` is `registry`, the
+ * variable `smoo.remoteCache.tokenSecret` names is `nx-cache`, everything
+ * else is `shell` — so `group` below is only for what those declarations
+ * cannot say. The routing lives in tooling/direnv/secret-references.ts,
+ * whose header states the rule and the derivation.
+ */
 export interface PackageSecretCommand {
   /** Executed directly, without a shell; stdout supplies the secret value. */
   command: NonEmptyArray<string>;
+  /** Overrides the derived group; absent derives one from this manifest and `.npmrc`. */
+  group?: SecretGroupName;
 }
 
 export interface PackageSmooConfig {

package/src/monorepo/cargo-policy.test.ts

@@ -3,7 +3,13 @@ import { readFileSync } from 'node:fs';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { applyCargoFeatureUnification, type CargoHakariShell, validateCargoCachePolicy } from './cargo-policy.js';
+import type { ProjectTargets } from '../nx/index.js';
+import {
+  applyCargoFeatureUnification,
+  type CargoHakariShell,
+  validateCargoCachePolicy,
+  validateCargoToolchainInputs,
+} from './cargo-policy.js';
 
 async function withFixture<T>(files: Record<string, string>, callback: (root: string) => T): Promise<T> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-cargo-policy-'));
@@ -33,6 +39,20 @@ async function check(
   });
 }
 
+async function checkToolchain(
+  files: Record<string, string>,
+  projects: ProjectTargets[],
+): Promise<{ failures: number; messages: string[] }> {
+  return withFixture(files, (root) => {
+    const captured = captureErrors();
+    try {
+      return { failures: validateCargoToolchainInputs(root, projects), messages: captured.messages };
+    } finally {
+      captured.restore();
+    }
+  });
+}
+
 /** Records what update would run, and answers `verify` however the test needs. */
 function recordingHakari(
   verify: { code: number; output?: string; missing?: boolean } = { code: 0 },
@@ -389,3 +409,73 @@ describe('Cargo feature unification update', () => {
     );
   });
 });
+
+describe('cargo toolchain identity policy', () => {
+  const cargoLint = (inputs: string[]): ProjectTargets => ({
+    project: 'codebase',
+    root: '.',
+    targets: ['cargo-lint'],
+    targetCache: new Map([['cargo-lint', true]]),
+    targetInputs: new Map([['cargo-lint', inputs]]),
+    targetOptions: new Map([['cargo-lint', { command: 'cargo --frozen clippy --workspace -- -D warnings' }]]),
+  });
+
+  // The failure this policy exists for: a hand-written input list replaces the
+  // inferred one, so the target stops hashing the pin and a toolchain bump
+  // leaves its cached verdict standing.
+  it('refuses a cached cargo target whose declared inputs drop the pin', async () => {
+    const { failures, messages } = await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['rustWorkspace'])]);
+    expect(failures).toBe(1);
+    expect(messages).toEqual([
+      'codebase:cargo-lint: cached cargo target hashes no toolchain pin, so a toolchain bump cannot invalidate it. ' +
+        'Add "cargoToolchain" to its inputs, or to the named input it uses.',
+    ]);
+  });
+
+  it('accepts the pin reached directly, through a named input, or by the name inference defines', async () => {
+    const viaNamedInput = JSON.stringify({
+      namedInputs: { rustWorkspace: ['{workspaceRoot}/Cargo.toml', '{workspaceRoot}/tooling/direnv/devenv.lock'] },
+    });
+    expect(await checkToolchain({ 'nx.json': viaNamedInput }, [cargoLint(['rustWorkspace'])])).toMatchObject({
+      failures: 0,
+    });
+    expect(
+      await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['{workspaceRoot}/tooling/direnv/devenv.lock'])]),
+    ).toMatchObject({ failures: 0 });
+    expect(await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['cargoToolchain'])])).toMatchObject({
+      failures: 0,
+    });
+  });
+
+  // A negated fileset REMOVES a path from the hash. Reading one as the pin
+  // would accept the exact declaration that guarantees the bug.
+  it('does not accept an excluded lock as the pin', async () => {
+    expect(
+      await checkToolchain({ 'nx.json': '{}\n' }, [cargoLint(['!{workspaceRoot}/tooling/direnv/devenv.lock'])]),
+    ).toMatchObject({ failures: 1 });
+  });
+
+  // Only what Nx can restore, and only what runs cargo: an uncached warm-up or
+  // a TypeScript build has no stale artifact for a toolchain bump to strand.
+  it('governs cached cargo targets only', async () => {
+    const uncached: ProjectTargets = {
+      ...cargoLint([]),
+      targetCache: new Map([['cargo-lint', false]]),
+    };
+    const notCargo: ProjectTargets = {
+      ...cargoLint([]),
+      targets: ['tsc-js'],
+      targetCache: new Map([['tsc-js', true]]),
+      targetInputs: new Map([['tsc-js', ['default']]]),
+      targetOptions: new Map([['tsc-js', { command: 'ttsc --build' }]]),
+    };
+    expect(await checkToolchain({ 'nx.json': '{}\n' }, [uncached, notCargo])).toMatchObject({ failures: 0 });
+  });
+
+  // A cyclic named input is a repository mistake, not a reason to hang the
+  // whole validation run before it can report anything at all.
+  it('terminates on a named input that references itself', async () => {
+    const cyclic = JSON.stringify({ namedInputs: { rustWorkspace: ['rustWorkspace'] } });
+    expect(await checkToolchain({ 'nx.json': cyclic }, [cargoLint(['rustWorkspace'])])).toMatchObject({ failures: 1 });
+  });
+});

package/src/monorepo/cargo-policy.ts

@@ -1,8 +1,10 @@
 import { spawnSync } from 'node:child_process';
 import { type Dirent, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { CARGO_TOOLCHAIN_NAMED_INPUT, isCargoToolchainInput } from '@smoothbricks/nx-plugin/cargo-toolchain-policy';
 import typia from 'typia';
-import { parsePackageJsonText } from '../lib/json.js';
+import { type NxJson, type NxTargetOptions, parseNxJsonText, parsePackageJsonText } from '../lib/json.js';
+import type { ProjectTargets } from '../nx/index.js';
 
 interface CargoProfile {
   inherits?: string;
@@ -869,6 +871,90 @@ export function validateCargoCachePolicy(root: string, options: CargoPolicyOptio
   return failures;
 }
 
+/** A command that compiles or checks Rust, whichever driver spells it. */
+const RUNS_CARGO = /(?:^|[\s;&|])cargo[\s-]|\bnapi build\b/;
+
+const CARGO_TOOLCHAIN_FIX = `Add "${CARGO_TOOLCHAIN_NAMED_INPUT}" to its inputs, or to the named input it uses`;
+
+function commandsOf(options: NxTargetOptions | undefined): string {
+  const command: unknown = options?.command;
+  const commands: unknown = options?.commands;
+  return [
+    typeof command === 'string' ? command : '',
+    ...(Array.isArray(commands) ? commands.filter((entry) => typeof entry === 'string') : []),
+  ].join('\n');
+}
+
+/**
+ * Every fileset one declared input list reaches, with nx.json's named inputs
+ * expanded. The plugin's own `cargoToolchain` is defined per PROJECT and wins
+ * over nx.json, so naming it counts without an entry here; a repository that
+ * redefines it workspace-wide is expanded and judged on what it resolves to.
+ */
+function resolveInputFilesets(
+  declared: readonly string[],
+  namedInputs: NonNullable<NxJson['namedInputs']>,
+  seen: Set<string> = new Set(),
+): string[] {
+  const filesets: string[] = [];
+  for (const entry of declared) {
+    const name = entry.startsWith('^') ? entry.slice(1) : entry;
+    const definition = namedInputs[name];
+    if (definition === undefined) {
+      filesets.push(entry);
+      continue;
+    }
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const expanded = typeof definition === 'string' ? [definition] : definition;
+    filesets.push(
+      ...resolveInputFilesets(
+        expanded.filter((value): value is string => typeof value === 'string'),
+        namedInputs,
+        seen,
+      ),
+    );
+  }
+  return filesets;
+}
+
+/**
+ * A cached cargo target must hash the toolchain that compiled it.
+ *
+ * Inference attaches the pin to every cargo target it infers, but a repository
+ * that DECLARES `inputs` for one replaces that list wholesale and silently
+ * drops it — the target then survives a toolchain bump with a stale verdict,
+ * and a pre-push cross-compile probe consults a cache entry that cannot
+ * express the change it is probing for. Measured before this policy existed:
+ * a one-byte bump to the declared pin left one repository's `cargo-lint-cross`
+ * hash unchanged.
+ *
+ * This is a generated safety property removed by a local override, which no
+ * amount of care at the override site will catch on its own, so it is checked
+ * against the RESOLVED graph rather than against any one file.
+ */
+export function validateCargoToolchainInputs(root: string, projects: readonly ProjectTargets[]): number {
+  const nxJsonPath = join(resolve(root), 'nx.json');
+  const namedInputs = existsSync(nxJsonPath)
+    ? (parseNxJsonText(readFileSync(nxJsonPath, 'utf8'))?.namedInputs ?? {})
+    : {};
+  let failures = 0;
+  for (const project of projects) {
+    for (const target of [...project.targets].sort()) {
+      if (project.targetCache?.get(target) !== true) continue;
+      if (!RUNS_CARGO.test(commandsOf(project.targetOptions?.get(target)))) continue;
+      const declared = project.targetInputs?.get(target) ?? [];
+      if (declared.includes(CARGO_TOOLCHAIN_NAMED_INPUT)) continue;
+      if (resolveInputFilesets(declared, namedInputs).some(isCargoToolchainInput)) continue;
+      failures += report(
+        `${project.project}:${target}`,
+        `cached cargo target hashes no toolchain pin, so a toolchain bump cannot invalidate it. ${CARGO_TOOLCHAIN_FIX}.`,
+      );
+    }
+  }
+  return failures;
+}
+
 /**
  * The fix `smoo monorepo update` applies for the policy above: write the
  * nightly resolver configuration, or generate and wire the workspace-hack a

package/src/monorepo/index.ts

@@ -2,7 +2,11 @@ import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { printCommandOutput, run, runResult } from '../lib/run.js';
 import { escapeRegex, getWorkspacePackages, getWorkspacePatterns, listReleasePackages } from '../lib/workspace.js';
 import { readProjectTargets } from '../nx/index.js';
-import { applyCargoFeatureUnification, validateCargoCachePolicy } from './cargo-policy.js';
+import {
+  applyCargoFeatureUnification,
+  validateCargoCachePolicy,
+  validateCargoToolchainInputs,
+} from './cargo-policy.js';
 import {
   formatCommitMessage,
   stagedDeletedPublicPackages,
@@ -133,7 +137,8 @@ export async function checkManagedFiles(root: string, options: { warn?: boolean
   }
   const results = await applyManagedFiles(root, 'check');
   printResults(results);
-  const resolvedTargets = resolvedTargetsByProject(await readProjectTargets(root));
+  const projectTargets = await readProjectTargets(root);
+  const resolvedTargets = resolvedTargetsByProject(projectTargets);
   const packageFailures =
     validateRootPackagePolicy(root) +
     validateNxProjectNames(root) +
@@ -145,6 +150,7 @@ export async function checkManagedFiles(root: string, options: { warn?: boolean
     validateWorkspaceDependencies(root, { resolvedTargetsByProject: resolvedTargets }) +
     validateDevenvModuleImport(root) +
     validateCargoCachePolicy(root) +
+    validateCargoToolchainInputs(root, projectTargets) +
     validateSccachePatches(root);
   if (results.some((result) => result.action === 'drifted') || packageFailures > 0) {
     throw new Error('Managed monorepo files or package conventions are out of date. Run: smoo monorepo update');

package/src/monorepo/managed-files.test.ts

@@ -18,6 +18,7 @@ import {
   LOCAL_SECTION_MARKER,
   type ManagedFileContext,
   macosPlatformArchitecturesForTest,
+  managedFileTargetsForContext,
   managedFileTargetsForTest,
   platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
@@ -263,14 +264,10 @@ describe('nx graph project helpers', () => {
       },
     },
     app: {
+      // What the plugin infers for a private wrangler project, and what a published library
+      // holding a wrangler manifest used to get: a deploy target no tag enrols in CI.
       targets: {
-        deploy: {
-          options: { command: 'echo no' },
-          configurations: {
-            staging: { command: 'wrangler deploy --env staging' },
-            production: { options: { command: 'wrangler deploy --env production' } },
-          },
-        },
+        deploy: { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } },
         'package-macos': {},
       },
     },
@@ -296,43 +293,40 @@ describe('nx graph project helpers', () => {
     expect(hasExactTargetForTest(nearMisses, 'e2e-deployment')).toBe(false);
   });
 
-  it('detects deploy configurations and cloudflare provider from graph nodes', () => {
-    expect(deployTargetInfoFromProjects(sampleProjects, 'staging')).toEqual({
-      exists: true,
-      provider: 'cloudflare',
-    });
-    expect(deployTargetInfoFromProjects(sampleProjects, 'production')).toEqual({
-      exists: true,
-      provider: 'cloudflare',
-    });
-    expect(deployTargetInfoFromProjects(sampleProjects, 'preview')).toEqual({ exists: false });
+  it('deploys nothing for a wrangler deploy target no tag names', () => {
+    expect(deployTargetInfoFromProjects(sampleProjects, 'staging')).toEqual({ exists: false });
+    expect(deployTargetInfoFromProjects(sampleProjects, 'production')).toEqual({ exists: false });
   });
 
-  it('recognizes convention-driven deploy-stage targets without per-stage configurations', () => {
-    const projects: NxProjects = {
-      app: {
-        targets: {
-          deploy: {
-            options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' },
-          },
-        },
-      },
-    };
+  it('reads the tags as precedence: permanent excludes, staging narrows, stage generalizes', () => {
+    const deploy = { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } };
+    const stageFor = (tags: string[]) => ({
+      staging: deployTargetInfoFromProjects({ site: { tags, targets: { deploy } } }, 'staging').exists,
+      production: deployTargetInfoFromProjects({ site: { tags, targets: { deploy } } }, 'production').exists,
+    });
 
-    expect(deployTargetInfoFromProjects(projects, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
-    expect(deployTargetInfoFromProjects(projects, 'production')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(stageFor(['stage-deploy-target'])).toEqual({ staging: true, production: true });
+    expect(stageFor(['staging-deploy-target'])).toEqual({ staging: true, production: false });
+    expect(stageFor(['permanent-deploy-target'])).toEqual({ staging: false, production: false });
+    // Both spellings on one project is a contradiction; the exclusion wins, which is what
+    // `nx show projects --exclude=tag:permanent-deploy-target` does to it in CI too.
+    expect(stageFor(['permanent-deploy-target', 'stage-deploy-target'])).toEqual({
+      staging: false,
+      production: false,
+    });
+    expect(stageFor(['npm:private'])).toEqual({ staging: false, production: false });
   });
 
-  it('treats a stage-deploy-target tag as a deploy target for every stage, like the deploy-stage command', () => {
-    const projects: NxProjects = {
-      site: {
-        tags: ['stage-deploy-target'],
-        targets: { deploy: { command: 'wrangler deploy --config dist/wrangler.json' } },
-      },
+  it('reads the command for the provider only: which credentials the generated job needs', () => {
+    const cloudflare: NxProjects = {
+      site: { tags: ['stage-deploy-target'], targets: { deploy: { command: 'wrangler deploy --config dist/w.json' } } },
+    };
+    const elsewhere: NxProjects = {
+      site: { tags: ['stage-deploy-target'], targets: { deploy: { command: 'bun tooling/deploy-site.ts' } } },
     };
 
-    expect(deployTargetInfoFromProjects(projects, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
-    expect(deployTargetInfoFromProjects(projects, 'production')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(deployTargetInfoFromProjects(cloudflare, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(deployTargetInfoFromProjects(elsewhere, 'staging')).toEqual({ exists: true, provider: undefined });
   });
 
   it('finds a tag carried by any project in the graph', () => {
@@ -582,6 +576,44 @@ describe('CI workflow rendering by repo shape', () => {
     expect(rendered).toContain('  deploy-production:');
   });
 
+  it('renders no deploy job at all for a repo whose wrangler projects carry no deploy tag', () => {
+    // The regression this exists for: published libraries ship a wrangler manifest to document a
+    // Durable Object binding for their consumers, the plugin inferred a deploy target from each,
+    // and a repository that deploys nothing from CI grew a Deploy Stage step holding Cloudflare
+    // credentials, a deployments permission, and a preview-cleanup workflow.
+    const deploy = { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } };
+    const projects: NxProjects = {
+      'acme-cloudflare': { tags: ['npm:private'], targets: { deploy } },
+      'acme-documents': { tags: ['npm:public'], targets: { deploy } },
+      // A private worker, deployed by hand from a developer's shell and never by CI.
+      'acme-service': { targets: { deploy } },
+    };
+    const staging = deployTargetInfoFromProjects(projects, 'staging');
+    const production = deployTargetInfoFromProjects(projects, 'production');
+    const shape = context({
+      hasStagingDeployTargets: staging.exists,
+      stagingDeployProvider: staging.provider,
+      hasProductionDeployTargets: production.exists,
+      productionDeployProvider: production.provider,
+      hasE2eDeploymentTargets: true,
+    });
+    const ci = renderManagedWorkflowForTest('ci-workflow', shape);
+
+    expect(ci).not.toContain('Deploy Stage');
+    expect(ci).not.toContain('deployments: write');
+    expect(ci).not.toContain('CLOUDFLARE_API_TOKEN');
+    expect(ci).not.toContain('e2e-deployment');
+    expect(renderManagedWorkflowForTest('publish-workflow', shape)).not.toContain('Deploy production');
+    expect(managedFileTargetsForContext(shape)).not.toContain('.github/workflows/pr-preview-cleanup.yml');
+  });
+
+  it('adds the preview cleanup workflow only where a cloudflare stage deploy makes preview stages', () => {
+    expect(managedFileTargetsForContext(deploying)).toContain('.github/workflows/pr-preview-cleanup.yml');
+    expect(managedFileTargetsForContext({ ...deploying, stagingDeployProvider: undefined })).not.toContain(
+      '.github/workflows/pr-preview-cleanup.yml',
+    );
+  });
+
   it('threads environments and secrets from the context into the workflow', () => {
     const rendered = renderManagedWorkflowForTest('ci-workflow', {
       ...deploying,