@smoothbricks/cli 0.11.19 → 0.11.20

package/README.md

@@ -47,6 +47,11 @@ smoo release retag-unpublished <tag...> [--to <ref>] [--push] [--dispatch] [--re
 smoo release bootstrap-npm-packages [--dry-run] [--skip-login] [--package <name...>]
 smoo release trust-publisher [--bootstrap] [--dry-run] [--skip-login] [--package <name...>]
 
+smoo secrets status [-R <owner/name|remote>] [--env <environment>] [--json]
+smoo secrets set [name] [-R <owner/name|remote>] [--env <environment>]
+smoo secrets sync [-R <owner/name|remote>] [--env <environment>]
+smoo secrets run <group> <command...>
+
 smoo github-ci nx-smart --target <target> [--name <check-name>] [--step <number>] [--mode <auto|affected|run-many>] [--stage <stage>]
 smoo github-ci nx-run-many --targets <targets> [--projects <projects>] [--collect-outputs <directory>]
 smoo github-ci nx-deploy [--stage <stage>] [--mode <auto|affected|run-many>] [--select-tag <tag>] [--verify]
@@ -577,10 +582,58 @@ Developer shells get the pair from the managed `tooling/direnv/secret-references
 none (with the reason on stderr), and never replaces a server the environment already carries, so a CI job keeps the
 internal address its own runners reach.
 
-`tokenSecret` may name a `smoo.secrets` entry, and then it is the one declared secret that never blocks an install: a
-cache is an optimization, so an unreachable secret provider costs a stderr line where every other declared secret would
-refuse the install outright. `op read` being unavailable in a sandboxed workspace therefore loses the cache, not the
-shell.
+`tokenSecret` may name a `smoo.secrets` entry, and then it is in group `nx-cache`: shell entry never resolves it, so an
+unreachable secret provider loses the cache rather than the install. `op read` being unavailable in a sandboxed
+workspace therefore costs the cache, not the shell. See the section below for what a group is.
+
+### Local secret commands and groups (`package.json` → `smoo.secrets`)
+
+```json
+{
+  "smoo": {
+    "secrets": {
+      "SMOO_TOKEN": { "command": ["op", "read", "op://vault/smoo/token"] },
+      "ACME_NPM_TOKEN": { "command": ["op", "read", "op://vault/registry/token"] },
+      "DEPLOY_TOKEN": { "command": ["op", "read", "op://vault/deploy/token"], "group": "deploy" }
+    }
+  }
+}
+```
+
+Each entry names a command whose stdout is the value. An existing nonempty environment value always wins, and CI never
+runs these commands at all: there, every variable comes from the job's secret store.
+
+A group says which operation resolves the credential, and shell entry — every direnv reload, every
+`devenv shell -- <command>` — resolves the `shell` group and nothing else. A provider authorises per requesting process
+lineage, so a command placed at shell entry is a credential prompt on every reload; a credential only one deliberate
+command needs belongs to that command:
+
+```bash
+smoo secrets run registry bun install
+smoo secrets run registry bun add -d @acme/sdk
+smoo secrets run nx-cache nx build app
+```
+
+The group is DERIVED from declarations the repository already carries, so almost nothing declares one:
+
+- `registry` — a variable `.npmrc` interpolates as `${VAR}`. An installed checkout contacts no registry, so shell entry
+  defers it; a request that does contact one is what resolves it.
+- `nx-cache` — the variable `smoo.remoteCache.tokenSecret` names.
+- `shell` — everything else, resolved at shell entry because that is when it is needed.
+
+`group` on an entry overrides the derivation, and any label the command line can name is a group: nothing about
+`registry` or `nx-cache` is privileged in smoo, so a repository may declare `deploy` and run it the same way. An
+override is stated in `smoo secrets status`, because a silent one is how the next reader loses an hour.
+
+`smoo secrets run` with no group refuses and lists the groups this repository declares with the secrets in each. It
+resolves exactly one group — a run for `registry` never triggers the cache token's provider command — and passes the
+values in the child's environment only: never in argv, which `ps` shows to every user on the machine, never in a file,
+and never on stdout. Everything after the group reaches the child verbatim, flags included, and the child's exit status
+is reproduced, including death by signal as 128+signum.
+
+Both contexts that cannot run a provider command refuse by name instead of promising a command that would not work
+there: CI says to inject the variable from the secret store, and a cowshed workspace says to enroll registry credentials
+through the gateway.
 
 ## Releases
 
@@ -729,7 +782,17 @@ Publish runs converge without self-spawning another workflow run.
 
 ### `smoo wrangler deploy-stage --stage <stage> [--config <path>]`
 
-Without `--config`, deploys `./wrangler.toml` with `--env <stage>`; a `prN` stage is derived from `[env.staging]`.
+Without `--config`, deploys the project's own source configuration with `--env <stage>`; a `prN` stage is derived from
+`[env.staging]`. The source configuration is discovered in wrangler's own precedence — `wrangler.jsonc`,
+`wrangler.json`, `wrangler.toml` — and the two JSON spellings are read with the JSONC parser wrangler uses for them, so
+comments and trailing commas are fine. A project carrying more than one of those files is refused by name: wrangler
+would read the first and ignore the rest without saying so, and that is how a repo ends up deploying a config nobody is
+editing.
+
+Both formats parse into one model, so a stage derives identically from either: the same plan, the same resources, the
+same refusals. The committed file is never rewritten. A `prN` stage's derived configuration is written beside it as a
+temporary `.wrangler.smoo-*.json` that the deploy deletes afterwards — JSON whichever format the source was, because
+wrangler selects its parser by extension and a file read once by a machine has no reader for comments.
 
 With `--config <path>` the target is a build-generated, env-block-free `wrangler.json` (what the Cloudflare Vite and
 Astro adapters emit). `staging` and `production` deploy it as-is, with no `--env` flag. A `prN` stage treats it as the

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAaA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAcxE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBhD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAcA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAcxE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBhD"}

package/dist/cli.js

@@ -7,6 +7,7 @@ import { decode, findRepoRoot, printCommandOutput } from './lib/run.js';
 import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
 import { secretsSet, secretsStatus, secretsSync } from './secrets/commands.js';
+import { secretsRun } from './secrets/run.js';
 import { cleanupPullRequest, deployStage } from './wrangler/deploy-stage.js';
 import { deployedVersion } from './wrangler/deployed-version.js';
 import { scaffold } from './wrangler/scaffold.js';
@@ -70,6 +71,11 @@ function buildProgram() {
         .description('SmoothBricks monorepo tooling')
         .version(cliPackageVersion, '-v, --version', 'print smoo version')
         .exitOverride()
+        // `smoo secrets run <group> <command...>` hands the rest of argv to a
+        // child verbatim, flags included. Commander only stops parsing after the
+        // first operand when positional options are enabled here, on the parent
+        // of the command that declares `passThroughOptions`.
+        .enablePositionalOptions()
         .showHelpAfterError();
     const monorepo = program.command('monorepo').description('Manage SmoothBricks-style monorepos');
     monorepo
@@ -424,14 +430,32 @@ function buildProgram() {
     });
     const secrets = program
         .command('secrets')
-        .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
+        .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds')
+        .enablePositionalOptions();
+    secrets
+        .command('run [group] [command...]')
+        .description('Run one command with one group of declared secrets in its environment. Shell entry resolves the ' +
+        '`shell` group only, so a registry credential or the Nx cache token is resolved here, by the command ' +
+        'that needs it, instead of by every direnv reload. The group is required and positional: with none, ' +
+        'this lists the groups this repository declares and the secrets in each')
+        // Everything after the group reaches the child verbatim, flags included:
+        // `smoo secrets run registry bun add -d @acme/x` must run `bun add -d
+        // @acme/x`, not lose `-d` to this command's own parser.
+        .passThroughOptions()
+        .action(async (group, command) => {
+        process.exitCode = await secretsRun(await findRepoRoot(), group, command);
+    });
     secrets
         .command('status')
-        .description('Show every declared secret with the scopes holding it, and refuse when a workflow passes one none has')
+        .description('Show every declared secret with the scopes holding it. Exits 0 when every secret a managed workflow ' +
+        'passes has a value in a scope the job reads, and 1 when one does not or when the repository, its ' +
+        'secrets or a stage declaration could not be read')
         .option('-R, --repo <owner/name|remote>', "repository or remote name; defaults to the current branch's upstream remote")
         .option('--env <environment>', "also read this GitHub Environment; its value takes precedence over the repository's for a job bound to it")
+        .option('--json', 'write one JSON document to stdout instead of the table, for another tool to read; the exit code is ' +
+        'unchanged, so a status that refuses still refuses')
         .action(async (options) => {
-        process.exitCode = secretsStatus(await findRepoRoot(), options);
+        process.exitCode = await secretsStatus(await findRepoRoot(), options);
     });
     secrets
         .command('set [name]')
@@ -460,7 +484,7 @@ function buildProgram() {
     wrangler
         .command('deploy-stage')
         .requiredOption('--stage <stage>', 'staging, production, or prN')
-        .option('--config <path>', 'deploy a build-generated flat wrangler.json instead of ./wrangler.toml')
+        .option('--config <path>', "deploy a build-generated flat wrangler.json instead of the project's own config")
         .option('--version-endpoint <url>', 'URL served by this worker whose trimmed body is the running version tag')
         .action(async (options) => {
         await deployStage(process.cwd(), {

package/dist/lib/json.d.ts

@@ -188,10 +188,31 @@ export interface PackageRemoteCacheConfig {
      */
     tokenSecret: RepositorySecretName;
 }
-/** Local bootstrap fallback; existing environment values always take precedence. */
+/**
+ * A `smoo.secrets` group: which operation resolves the credential. One argv
+ * word of `smoo secrets run <group> <command...>`, so whitespace would make
+ * that command unwritable. Only the shape is validated — the values are the
+ * repository's, and a new group must not need a new smoo release.
+ */
+export type SecretGroupName = string & typia.tags.MinLength<1> & typia.tags.Pattern<'^\\S+$'>;
+/**
+ * Local bootstrap fallback; existing environment values always take
+ * precedence, and CI injects these variables instead of running commands.
+ *
+ * Shell entry resolves the `shell` group and nothing else; every other group
+ * is resolved by `smoo secrets run <group> <command...>`, the one command
+ * that needs it. The group is DERIVED from what this manifest already
+ * declares — a variable `.npmrc` interpolates as `${VAR}` is `registry`, the
+ * variable `smoo.remoteCache.tokenSecret` names is `nx-cache`, everything
+ * else is `shell` — so `group` below is only for what those declarations
+ * cannot say. The routing lives in tooling/direnv/secret-references.ts,
+ * whose header states the rule and the derivation.
+ */
 export interface PackageSecretCommand {
     /** Executed directly, without a shell; stdout supplies the secret value. */
     command: NonEmptyArray<string>;
+    /** Overrides the derived group; absent derives one from this manifest and `.npmrc`. */
+    group?: SecretGroupName;
 }
 export interface PackageSmooConfig {
     github?: PackageSmooGithub;

package/dist/lib/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/lib/json.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,OAAO,CAAC;AAEhD,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/C,2DAA2D;AAC3D,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAE3C,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,KAAK,IAAI,aAAa,CAAC,CAAC,CAAC,CAEnE;AAED,mHAAmH;AACnH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GACvC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;AAEvD,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAEhE,qGAAqG;AACrG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IACvC,YAAY,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,uDAAuD;IACvD,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,qFAAqF;IACrF,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,aAAa,CAAC;QACpB,+FAA+F;QAC/F,SAAS,EAAE,MAAM,CAAC;QAClB,yFAAyF;QACzF,GAAG,CAAC,EAAE,SAAS,CAAC;KACjB,CAAC;IACF;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;CAClD;AAED,2DAA2D;AAC3D,MAAM,WAAW,2BAA2B;IAC1C,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,2DAA2D;IAC3D,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACrC,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,WAAW,EAAE,oBAAoB,CAAC;CACnC;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC;IAChD,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,oBAAoB,CAAC,EAAE,SAAS,CAAC;IACjC,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;IACxC,EAAE,CAAC,EAAE,eAAe,CAAC;IACrB,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,iBAAiB,CAAC;AAErD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;CAChF;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,uCAA0C,CAAC;AAE5E,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,yCAA4C,CAAC;AAEhF,yEAAyE;AACzE,eAAO,MAAM,eAAe,kCAAqC,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,oCAAuC,CAAC;AAEzE,uHAAuH;AACvH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,MAAM,CAE3E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAO9F;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAS/D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAM5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9C;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CASzE;AAED,uHAAuH;AACvH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE1E;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAE3F;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAOzD;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,cAAc,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,qBAAqB,GAC5G,SAAS,CAQX;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAOzD;AAED,qCAAqC;AACrC,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,eAAe,CAO1D;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAOnF;AAED,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB,CAO1E;AAED,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,CAO1E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMxF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM/F;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,gBAAgB,EAChE,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,gBAAgB,EAChE,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMrE;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM5F;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,iBAAiB,EAC7B,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,EACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,iBAAiB,EAC7B,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,EACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/lib/json.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,OAAO,CAAC;AAEhD,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/C,2DAA2D;AAC3D,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAE3C,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,KAAK,IAAI,aAAa,CAAC,CAAC,CAAC,CAEnE;AAED,mHAAmH;AACnH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GACvC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;AAEvD,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAEhE,qGAAqG;AACrG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IACvC,YAAY,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,uDAAuD;IACvD,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,qFAAqF;IACrF,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,aAAa,CAAC;QACpB,+FAA+F;QAC/F,SAAS,EAAE,MAAM,CAAC;QAClB,yFAAyF;QACzF,GAAG,CAAC,EAAE,SAAS,CAAC;KACjB,CAAC;IACF;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;CAClD;AAED,2DAA2D;AAC3D,MAAM,WAAW,2BAA2B;IAC1C,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,2DAA2D;IAC3D,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACrC,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,WAAW,EAAE,oBAAoB,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,uFAAuF;IACvF,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC;IAChD,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,oBAAoB,CAAC,EAAE,SAAS,CAAC;IACjC,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;IACxC,EAAE,CAAC,EAAE,eAAe,CAAC;IACrB,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,iBAAiB,CAAC;AAErD,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;CAChF;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,uCAA0C,CAAC;AAE5E,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,yCAA4C,CAAC;AAEhF,yEAAyE;AACzE,eAAO,MAAM,eAAe,kCAAqC,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,oCAAuC,CAAC;AAEzE,uHAAuH;AACvH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,MAAM,CAE3E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAO9F;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAS/D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAM5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9C;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CASzE;AAED,uHAAuH;AACvH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE1E;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAE3F;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAOzD;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,cAAc,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,qBAAqB,GAC5G,SAAS,CAQX;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAOzD;AAED,qCAAqC;AACrC,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,eAAe,CAO1D;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAOnF;AAED,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,WAAW,GAAG,oBAAoB,CAO1E;AAED,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,CAO1E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMxF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM/F;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,gBAAgB,EAChE,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,gBAAgB,EAChE,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMrE;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM5F;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,iBAAiB,EAC7B,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,EACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,iBAAiB,EAC7B,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,EACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAMT"}

package/dist/lib/json.js

@@ -73,7 +73,7 @@ export const parsePackageJsonText = (() => {
             return true;
         return "object" === typeof value && null !== value && _io23(value, _vctx);
     });
-    const _io23 = (input, _vctx = {}) => Array.isArray(input.command) && ("string" === typeof input.command[0] && (Array.isArray(input.command.slice(1)) && input.command.slice(1).every(elem => "string" === typeof elem)));
+    const _io23 = (input, _vctx = {}) => Array.isArray(input.command) && ("string" === typeof input.command[0] && (Array.isArray(input.command.slice(1)) && input.command.slice(1).every(elem => "string" === typeof elem))) && (undefined === input.group || "string" === typeof input.group && (1 <= _stringLength_1._stringLength(input.group) && RegExp("^\\S+$").test(input.group)));
     const _io3 = (input, _vctx = {}) => undefined === input.packages || Array.isArray(input.packages) && input.packages.every(elem => "string" === typeof elem);
     const _io4 = (input, _vctx = {}) => (undefined === input.access || "string" === typeof input.access) && (undefined === input.registry || "string" === typeof input.registry);
     const _io5 = (input, _vctx = {}) => (undefined === input.type || "string" === typeof input.type) && (undefined === input.url || "string" === typeof input.url) && (undefined === input.directory || "string" === typeof input.directory);
@@ -405,7 +405,7 @@ const validatePackageJsonText = (() => {
             return true;
         return "object" === typeof value && null !== value && _io23(value, _vctx);
     });
-    const _io23 = (input, _vctx = {}) => Array.isArray(input.command) && ("string" === typeof input.command[0] && (Array.isArray(input.command.slice(1)) && input.command.slice(1).every(elem => "string" === typeof elem)));
+    const _io23 = (input, _vctx = {}) => Array.isArray(input.command) && ("string" === typeof input.command[0] && (Array.isArray(input.command.slice(1)) && input.command.slice(1).every(elem => "string" === typeof elem))) && (undefined === input.group || "string" === typeof input.group && (1 <= _stringLength_1._stringLength(input.group) && RegExp("^\\S+$").test(input.group)));
     const _io3 = (input, _vctx = {}) => undefined === input.packages || Array.isArray(input.packages) && input.packages.every(elem => "string" === typeof elem);
     const _io4 = (input, _vctx = {}) => (undefined === input.access || "string" === typeof input.access) && (undefined === input.registry || "string" === typeof input.registry);
     const _io5 = (input, _vctx = {}) => (undefined === input.type || "string" === typeof input.type) && (undefined === input.url || "string" === typeof input.url) && (undefined === input.directory || "string" === typeof input.directory);
@@ -827,6 +827,18 @@ const validatePackageJsonText = (() => {
             path: _path + ".command",
             expected: "NonEmptyArray<string>",
             value: input.command
+        }), undefined === input.group || "string" === typeof input.group && (1 <= _stringLength_1._stringLength(input.group) || _report(_exceptionable, {
+            path: _path + ".group",
+            expected: "string & MinLength<1>",
+            value: input.group
+        })) && (RegExp("^\\S+$").test(input.group) || _report(_exceptionable, {
+            path: _path + ".group",
+            expected: "string & Pattern<\"^\\\\S+$\">",
+            value: input.group
+        })) || _report(_exceptionable, {
+            path: _path + ".group",
+            expected: "((string & MinLength<1> & Pattern<\"^\\\\S+$\">) | undefined)",
+            value: input.group
         })].every(flag => flag);
     const _vo3 = (input, _path, _exceptionable = true, _vctx = {}) => [undefined === input.packages || (Array.isArray(input.packages) || _report(_exceptionable, {
             path: _path + ".packages",
@@ -1121,7 +1133,7 @@ const isPackageJsonValue = (() => {
             return true;
         return "object" === typeof value && null !== value && _io23(value, _vctx);
     });
-    const _io23 = (input, _vctx = {}) => Array.isArray(input.command) && ("string" === typeof input.command[0] && (Array.isArray(input.command.slice(1)) && input.command.slice(1).every(elem => "string" === typeof elem)));
+    const _io23 = (input, _vctx = {}) => Array.isArray(input.command) && ("string" === typeof input.command[0] && (Array.isArray(input.command.slice(1)) && input.command.slice(1).every(elem => "string" === typeof elem))) && (undefined === input.group || "string" === typeof input.group && (1 <= _stringLength_1._stringLength(input.group) && RegExp("^\\S+$").test(input.group)));
     const _io3 = (input, _vctx = {}) => undefined === input.packages || Array.isArray(input.packages) && input.packages.every(elem => "string" === typeof elem);
     const _io4 = (input, _vctx = {}) => (undefined === input.access || "string" === typeof input.access) && (undefined === input.registry || "string" === typeof input.registry);
     const _io5 = (input, _vctx = {}) => (undefined === input.type || "string" === typeof input.type) && (undefined === input.url || "string" === typeof input.url) && (undefined === input.directory || "string" === typeof input.directory);

package/dist/monorepo/cargo-policy.d.ts

@@ -1,3 +1,4 @@
+import type { ProjectTargets } from '../nx/index.js';
 /**
  * The one command this policy shells out to, behind a seam. `cargo hakari
  * verify` is the only authority on whether a generated workspace-hack still
@@ -16,6 +17,22 @@ export interface CargoPolicyOptions {
     shell?: CargoHakariShell;
 }
 export declare function validateCargoCachePolicy(root: string, options?: CargoPolicyOptions): number;
+/**
+ * A cached cargo target must hash the toolchain that compiled it.
+ *
+ * Inference attaches the pin to every cargo target it infers, but a repository
+ * that DECLARES `inputs` for one replaces that list wholesale and silently
+ * drops it — the target then survives a toolchain bump with a stale verdict,
+ * and a pre-push cross-compile probe consults a cache entry that cannot
+ * express the change it is probing for. Measured before this policy existed:
+ * a one-byte bump to the declared pin left one repository's `cargo-lint-cross`
+ * hash unchanged.
+ *
+ * This is a generated safety property removed by a local override, which no
+ * amount of care at the override site will catch on its own, so it is checked
+ * against the RESOLVED graph rather than against any one file.
+ */
+export declare function validateCargoToolchainInputs(root: string, projects: readonly ProjectTargets[]): number;
 /**
  * The fix `smoo monorepo update` applies for the policy above: write the
  * nightly resolver configuration, or generate and wire the workspace-hack a

package/dist/monorepo/cargo-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cargo-policy.d.ts","sourceRoot":"","sources":["../../src/monorepo/cargo-policy.ts"],"names":[],"mappings":"AAyFA;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACrG;AAusBD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwD/F;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,IAAI,CA8BjG"}
+{"version":3,"file":"cargo-policy.d.ts","sourceRoot":"","sources":["../../src/monorepo/cargo-policy.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAqFrD;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACrG;AAusBD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwD/F;AAiDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAoBtG;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,IAAI,CA8BjG"}

package/dist/monorepo/cargo-policy.js

@@ -5,8 +5,9 @@ import * as _createStandardSchema_1 from "typia/lib/internal/_createStandardSche
 import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { CARGO_TOOLCHAIN_NAMED_INPUT, isCargoToolchainInput } from '@smoothbricks/nx-plugin/cargo-toolchain-policy';
 import typia from 'typia';
-import { parsePackageJsonText } from '../lib/json.js';
+import { parseNxJsonText, parsePackageJsonText } from '../lib/json.js';
 const validateCargoManifest = (() => {
     const _io0 = input => (undefined === input.workspace || "object" === typeof input.workspace && null !== input.workspace && false === Array.isArray(input.workspace) && _io1(input.workspace)) && (undefined === input["package"] || "object" === typeof input["package"] && null !== input["package"] && false === Array.isArray(input["package"]) && _io2(input["package"])) && (undefined === input.profile || "object" === typeof input.profile && null !== input.profile && false === Array.isArray(input.profile) && _io3(input.profile)) && (undefined === input.dependencies || "object" === typeof input.dependencies && null !== input.dependencies && false === Array.isArray(input.dependencies) && _io5(input.dependencies)) && (undefined === input["dev-dependencies"] || "object" === typeof input["dev-dependencies"] && null !== input["dev-dependencies"] && false === Array.isArray(input["dev-dependencies"]) && _io5(input["dev-dependencies"])) && (undefined === input["build-dependencies"] || "object" === typeof input["build-dependencies"] && null !== input["build-dependencies"] && false === Array.isArray(input["build-dependencies"]) && _io5(input["build-dependencies"]));
     const _io1 = input => (undefined === input.members || Array.isArray(input.members) && input.members.every(elem => "string" === typeof elem)) && (undefined === input.exclude || Array.isArray(input.exclude) && input.exclude.every(elem => "string" === typeof elem));
@@ -1089,6 +1090,77 @@ export function validateCargoCachePolicy(root, options = {}) {
     reportManifestDirectoryAdvisories(repositoryRoot, ignoredDirectories);
     return failures;
 }
+/** A command that compiles or checks Rust, whichever driver spells it. */
+const RUNS_CARGO = /(?:^|[\s;&|])cargo[\s-]|\bnapi build\b/;
+const CARGO_TOOLCHAIN_FIX = `Add "${CARGO_TOOLCHAIN_NAMED_INPUT}" to its inputs, or to the named input it uses`;
+function commandsOf(options) {
+    const command = options?.command;
+    const commands = options?.commands;
+    return [
+        typeof command === 'string' ? command : '',
+        ...(Array.isArray(commands) ? commands.filter((entry) => typeof entry === 'string') : []),
+    ].join('\n');
+}
+/**
+ * Every fileset one declared input list reaches, with nx.json's named inputs
+ * expanded. The plugin's own `cargoToolchain` is defined per PROJECT and wins
+ * over nx.json, so naming it counts without an entry here; a repository that
+ * redefines it workspace-wide is expanded and judged on what it resolves to.
+ */
+function resolveInputFilesets(declared, namedInputs, seen = new Set()) {
+    const filesets = [];
+    for (const entry of declared) {
+        const name = entry.startsWith('^') ? entry.slice(1) : entry;
+        const definition = namedInputs[name];
+        if (definition === undefined) {
+            filesets.push(entry);
+            continue;
+        }
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const expanded = typeof definition === 'string' ? [definition] : definition;
+        filesets.push(...resolveInputFilesets(expanded.filter((value) => typeof value === 'string'), namedInputs, seen));
+    }
+    return filesets;
+}
+/**
+ * A cached cargo target must hash the toolchain that compiled it.
+ *
+ * Inference attaches the pin to every cargo target it infers, but a repository
+ * that DECLARES `inputs` for one replaces that list wholesale and silently
+ * drops it — the target then survives a toolchain bump with a stale verdict,
+ * and a pre-push cross-compile probe consults a cache entry that cannot
+ * express the change it is probing for. Measured before this policy existed:
+ * a one-byte bump to the declared pin left one repository's `cargo-lint-cross`
+ * hash unchanged.
+ *
+ * This is a generated safety property removed by a local override, which no
+ * amount of care at the override site will catch on its own, so it is checked
+ * against the RESOLVED graph rather than against any one file.
+ */
+export function validateCargoToolchainInputs(root, projects) {
+    const nxJsonPath = join(resolve(root), 'nx.json');
+    const namedInputs = existsSync(nxJsonPath)
+        ? (parseNxJsonText(readFileSync(nxJsonPath, 'utf8'))?.namedInputs ?? {})
+        : {};
+    let failures = 0;
+    for (const project of projects) {
+        for (const target of [...project.targets].sort()) {
+            if (project.targetCache?.get(target) !== true)
+                continue;
+            if (!RUNS_CARGO.test(commandsOf(project.targetOptions?.get(target))))
+                continue;
+            const declared = project.targetInputs?.get(target) ?? [];
+            if (declared.includes(CARGO_TOOLCHAIN_NAMED_INPUT))
+                continue;
+            if (resolveInputFilesets(declared, namedInputs).some(isCargoToolchainInput))
+                continue;
+            failures += report(`${project.project}:${target}`, `cached cargo target hashes no toolchain pin, so a toolchain bump cannot invalidate it. ${CARGO_TOOLCHAIN_FIX}.`);
+        }
+    }
+    return failures;
+}
 /**
  * The fix `smoo monorepo update` applies for the policy above: write the
  * nightly resolver configuration, or generate and wire the workspace-hack a

package/dist/monorepo/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/monorepo/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AA2BxD,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjG;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBpE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBrG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,GAAE,4BAAiC,EAC1C,IAAI,SAAgB,GACnB,IAAI,CAoBN;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAW3G;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAI5D;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,KAAK,GAAE,qBAAoD,GAC1D,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/monorepo/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AA2BxD,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjG;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBpE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBrG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,GAAE,4BAAiC,EAC1C,IAAI,SAAgB,GACnB,IAAI,CAoBN;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAW3G;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAI5D;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,KAAK,GAAE,qBAAoD,GAC1D,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/monorepo/index.js

@@ -2,7 +2,7 @@ import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { printCommandOutput, run, runResult } from '../lib/run.js';
 import { escapeRegex, getWorkspacePackages, getWorkspacePatterns, listReleasePackages } from '../lib/workspace.js';
 import { readProjectTargets } from '../nx/index.js';
-import { applyCargoFeatureUnification, validateCargoCachePolicy } from './cargo-policy.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy, validateCargoToolchainInputs, } from './cargo-policy.js';
 import { formatCommitMessage, stagedDeletedPublicPackages, validateBreakingDisclosure, validateCommitMessage, } from './commit-msg.js';
 import { applyWorkspaceGitConfig } from './git-config.js';
 import { syncBunLockfileVersions } from './lockfile.js';
@@ -64,7 +64,8 @@ export async function checkManagedFiles(root, options = {}) {
     }
     const results = await applyManagedFiles(root, 'check');
     printResults(results);
-    const resolvedTargets = resolvedTargetsByProject(await readProjectTargets(root));
+    const projectTargets = await readProjectTargets(root);
+    const resolvedTargets = resolvedTargetsByProject(projectTargets);
     const packageFailures = validateRootPackagePolicy(root) +
         validateNxProjectNames(root) +
         validateNxReleaseConfig(root) +
@@ -75,6 +76,7 @@ export async function checkManagedFiles(root, options = {}) {
         validateWorkspaceDependencies(root, { resolvedTargetsByProject: resolvedTargets }) +
         validateDevenvModuleImport(root) +
         validateCargoCachePolicy(root) +
+        validateCargoToolchainInputs(root, projectTargets) +
         validateSccachePatches(root);
     if (results.some((result) => result.action === 'drifted') || packageFailures > 0) {
         throw new Error('Managed monorepo files or package conventions are out of date. Run: smoo monorepo update');

package/dist/monorepo/packs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAO5E,OAAO,EAKL,KAAK,sBAAsB,EAS5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AA8ID,0DAA0D;AAC1D,eAAO,MAAM,YAAY,gBAAQ,CAAC;AAElC,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAwMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAexG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAW5E,OAAO,EAKL,KAAK,sBAAsB,EAS5B,MAAM,sBAAsB,CAAC;AAU9B,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAmJD,0DAA0D;AAC1D,eAAO,MAAM,YAAY,gBAAQ,CAAC;AAElC,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAwMD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAexG"}

package/dist/monorepo/packs/index.js

@@ -2,7 +2,7 @@ import { chmodSync, existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
 import { readProjectTargets } from '../../nx/index.js';
-import { applyCargoFeatureUnification, validateCargoCachePolicy } from '../cargo-policy.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy, validateCargoToolchainInputs, } from '../cargo-policy.js';
 import { validateGoToolchainAgreement } from '../go-toolchain.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
 import { validateDevenvModuleImport, warnOnManagedFileDrift } from '../managed-files.js';
@@ -76,6 +76,11 @@ const packs = [
         validatePreBuild(ctx) {
             return validateCargoCachePolicy(ctx.root);
         },
+        // Post-build: the toolchain identity is read off the RESOLVED graph, which
+        // means running the inference plugin, which means its dist has to exist.
+        async validatePostBuild(ctx) {
+            return validateCargoToolchainInputs(ctx.root, await readProjectTargets(ctx.root));
+        },
     },
     {
         name: 'publishing',

package/dist/nx/index.d.ts

@@ -4,8 +4,12 @@ export interface ProjectTargets {
     root?: string;
     targets: string[];
     buildDependsOn?: string[];
+    /** Per-target `cache`, for policies that only govern what Nx can restore. */
+    targetCache?: Map<string, boolean>;
     targetDependencies?: Map<string, string[]>;
     targetExecutors?: Map<string, string>;
+    /** Per-target string inputs; object inputs (`runtime`, `json`, …) are dropped. */
+    targetInputs?: Map<string, string[]>;
     targetOptions?: Map<string, NxTargetOptions>;
     targetOutputs?: Map<string, string[]>;
     targetScripts?: Map<string, string>;
@@ -22,6 +26,8 @@ export declare function targetDependenciesFromNxProjectJson(value: NxProjectJson
 export declare function targetExecutorsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string>;
 export declare function targetOptionsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, NxTargetOptions>;
 export declare function targetOutputsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string[]>;
+export declare function targetInputsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string[]>;
+export declare function targetCacheFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, boolean>;
 export declare function targetScriptsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string>;
 export declare function formatProjectTargetLines(projects: ProjectTargets[]): string;
 export declare function projectNamesWithTarget(projects: ProjectTargets[], target: string): string[];

package/dist/nx/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nx/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGlG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAElD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEzD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAG9F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExG;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBlH;AAsBD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAYpH;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY3G;AA0BD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAK3E;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAK3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5D;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5D;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAYjE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOhE;AA2DD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,EAAE,CAQtE;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,GAAG,cAAc,EAAE,CAiBnF;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhF;AAED,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nx/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGlG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,kFAAkF;IAClF,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAElD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEzD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAG9F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExG;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBlH;AAsBD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAYpH;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE7G;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAE5G;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ1G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAY3G;AA0BD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAK3E;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAK3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5D;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5D;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAYjE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOhE;AA2DD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,EAAE,CAQtE;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,GAAG,cAAc,EAAE,CAmBnF;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhF;AAED,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC"}

package/dist/nx/index.js

@@ -91,6 +91,18 @@ export function targetOptionsFromNxProjectJson(value) {
 export function targetOutputsFromNxProjectJson(value) {
     return targetStringArraysFromNxProjectJson(value, 'outputs');
 }
+export function targetInputsFromNxProjectJson(value) {
+    return targetStringArraysFromNxProjectJson(value, 'inputs');
+}
+export function targetCacheFromNxProjectJson(value) {
+    const cache = new Map();
+    for (const [targetName, target] of Object.entries(value?.targets ?? {})) {
+        if (typeof target.cache === 'boolean') {
+            cache.set(targetName, target.cache);
+        }
+    }
+    return cache;
+}
 export function targetScriptsFromNxProjectJson(value) {
     const targets = value?.targets;
     const scripts = new Map();
@@ -277,7 +289,9 @@ export function projectTargetsFromNxProjects(projects) {
             root: projectRootFromNxProjectJson(metadata),
             targets: targetNamesFromNxProjectJson(metadata),
             buildDependsOn: targetDependencies.get('build'),
+            targetCache: targetCacheFromNxProjectJson(metadata),
             targetDependencies,
+            targetInputs: targetInputsFromNxProjectJson(metadata),
             targetExecutors: targetExecutorsFromNxProjectJson(metadata),
             targetOptions: targetOptionsFromNxProjectJson(metadata),
             targetOutputs: targetOutputsFromNxProjectJson(metadata),

package/dist/secrets/commands.d.ts

@@ -1,5 +1,5 @@
 /**
- * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ * `smoo secrets` — the operator side of the reconciliation in ./status.ts.
  *
  * Values are handed to `gh` over stdin, never through argv (a process list is
  * world-readable) and never printed. Reading one from the terminal disables
@@ -14,7 +14,7 @@
  * repository reports values that do exist as absent, and sends an operator
  * hunting for a secret that is already set.
  */
-import { type SecretRow } from './index.js';
+import { type SecretRow } from './status.js';
 /**
  * Every secret this checkout declares that the repository does not hold, in
  * the order an operator should fix them: the ones a workflow already promises
@@ -53,15 +53,19 @@ export declare function writeRepositorySecret(name: string, value: string, repo:
     reason: string;
 }>;
 /**
- * Print every known secret and the scopes holding it. Exit code 1 when a
+ * Print every known secret and the scopes holding it, or - with `json` - the
+ * same facts as one document on stdout and nothing else. Exit code 1 when a
  * workflow promises a value no scope a bound job reads can supply — that
  * combination is the one that fails a deploy, and it fails talking about the
- * value rather than the missing secret.
+ * value rather than the missing secret. `--json` reports that refusal in
+ * `unsatisfied` and still exits 1: a machine-readable status that always
+ * succeeded would be a status nobody could gate on.
  */
 export declare function secretsStatus(root: string, options: {
     repo?: string;
     env?: string;
-}): number;
+    json?: boolean;
+}): Promise<number>;
 /**
  * Set one secret, or - with no name - walk every secret this checkout declares
  * and the target scope does not hold, prompting once each. The walk is the

package/dist/secrets/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/secrets/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAKL,KAAK,SAAS,EAOf,MAAM,YAAY,CAAC;AAGpB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAG5E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,CAOxG;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUnD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwB/D;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAYvD;AAyCD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAkF5F;AA8BD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAuBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BzG"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/secrets/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAcH,OAAO,EAIL,KAAK,SAAS,EAKf,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAG5E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,CAOxG;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUnD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwB/D;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAYvD;AAoGD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,OAAO,CAAC,MAAM,CAAC,CAwFjB;AA8BD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,MAAM,CAAC,CA8DjB;AAuBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCzG"}