@codluv/versionguard 0.1.1 → 0.3.0

package/dist/chunks/{index-C6jrxye7.js → index-BrZJDWya.js}

@@ -1,10 +1,11 @@
 import * as childProcess from "node:child_process";
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import * as path from "node:path";
 import * as fs from "node:fs";
+import { parse as parse$2 } from "smol-toml";
+import * as yaml from "js-yaml";
 import { globSync } from "glob";
 import { fileURLToPath } from "node:url";
-import * as yaml from "js-yaml";
 function parseFormat(calverFormat) {
   const parts = calverFormat.split(".");
   const result = {
@@ -245,7 +246,7 @@ function validateChangelog(changelogPath, version, strict = true, requireEntry =
       errors.push("Changelog should include compare links at the bottom");
     }
     const versionHeaderMatch = content.match(
-      new RegExp(`## \\[${escapeRegExp(version)}\\] - ([^\r
+      new RegExp(`## \\[${escapeRegExp$2(version)}\\] - ([^\r
 ]+)`)
     );
     if (requireEntry && hasEntryForVersion) {
@@ -285,10 +286,10 @@ function addVersionEntry(changelogPath, version, date = (/* @__PURE__ */ new Dat
   const updated = `${content.slice(0, insertIndex)}${block}${content.slice(insertIndex)}`;
   fs.writeFileSync(changelogPath, updated, "utf-8");
 }
-function escapeRegExp(value) {
+function escapeRegExp$2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-const HOOK_NAMES = ["pre-commit", "pre-push", "post-tag"];
+const HOOK_NAMES$1 = ["pre-commit", "pre-push", "post-tag"];
 function installHooks(config, cwd = process.cwd()) {
   const gitDir = findGitDir(cwd);
   if (!gitDir) {
@@ -296,7 +297,7 @@ function installHooks(config, cwd = process.cwd()) {
   }
   const hooksDir = path.join(gitDir, "hooks");
   fs.mkdirSync(hooksDir, { recursive: true });
-  for (const hookName of HOOK_NAMES) {
+  for (const hookName of HOOK_NAMES$1) {
     if (config.hooks[hookName]) {
       const hookPath = path.join(hooksDir, hookName);
       fs.writeFileSync(hookPath, generateHookScript(hookName), { encoding: "utf-8", mode: 493 });
@@ -309,7 +310,7 @@ function uninstallHooks(cwd = process.cwd()) {
     return;
   }
   const hooksDir = path.join(gitDir, "hooks");
-  for (const hookName of HOOK_NAMES) {
+  for (const hookName of HOOK_NAMES$1) {
     const hookPath = path.join(hooksDir, hookName);
     if (fs.existsSync(hookPath) && fs.readFileSync(hookPath, "utf-8").includes("versionguard")) {
       fs.unlinkSync(hookPath);
@@ -335,13 +336,14 @@ function areHooksInstalled(cwd = process.cwd()) {
   if (!gitDir) {
     return false;
   }
-  return HOOK_NAMES.every((hookName) => {
+  return HOOK_NAMES$1.every((hookName) => {
     const hookPath = path.join(gitDir, "hooks", hookName);
     return fs.existsSync(hookPath) && fs.readFileSync(hookPath, "utf-8").includes("versionguard");
   });
 }
 function generateHookScript(hookName) {
   return `#!/bin/sh
+# versionguard
 # VersionGuard ${hookName} hook
 # --no-install prevents accidentally downloading an unscoped package
 # if @codluv/versionguard is not installed locally
@@ -353,6 +355,428 @@ if [ $status -ne 0 ]; then
 fi
 `;
 }
+class GitTagSource {
+  name = "git-tag";
+  manifestFile = "";
+  exists(cwd) {
+    try {
+      execFileSync("git", ["rev-parse", "--git-dir"], {
+        cwd,
+        stdio: ["pipe", "pipe", "ignore"]
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  getVersion(cwd) {
+    try {
+      const tag = execFileSync("git", ["describe", "--tags", "--abbrev=0"], {
+        cwd,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      }).trim();
+      return tag.replace(/^v/, "");
+    } catch {
+      throw new Error("No git tags found. Create a tag first (e.g., git tag v0.1.0)");
+    }
+  }
+  setVersion(version, cwd) {
+    const tagName = `v${version}`;
+    execFileSync("git", ["tag", "-a", tagName, "-m", `Release ${version}`], {
+      cwd,
+      stdio: ["pipe", "pipe", "ignore"]
+    });
+  }
+}
+class JsonVersionSource {
+  name;
+  manifestFile;
+  versionPath;
+  constructor(manifestFile = "package.json", versionPath = "version") {
+    this.name = manifestFile;
+    this.manifestFile = manifestFile;
+    this.versionPath = versionPath;
+  }
+  exists(cwd) {
+    return fs.existsSync(path.join(cwd, this.manifestFile));
+  }
+  getVersion(cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    const version = getNestedValue$1(content, this.versionPath);
+    if (typeof version !== "string" || version.length === 0) {
+      throw new Error(`No version field in ${this.manifestFile}`);
+    }
+    return version;
+  }
+  setVersion(version, cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    setNestedValue(content, this.versionPath, version);
+    fs.writeFileSync(filePath, `${JSON.stringify(content, null, 2)}
+`, "utf-8");
+  }
+}
+function getNestedValue$1(obj, dotPath) {
+  let current = obj;
+  for (const key of dotPath.split(".")) {
+    if (current === null || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[key];
+  }
+  return current;
+}
+function setNestedValue(obj, dotPath, value) {
+  const keys = dotPath.split(".");
+  let current = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const key = keys[i];
+    if (typeof current[key] !== "object" || current[key] === null) {
+      current[key] = {};
+    }
+    current = current[key];
+  }
+  current[keys[keys.length - 1]] = value;
+}
+class RegexVersionSource {
+  name;
+  manifestFile;
+  versionRegex;
+  constructor(manifestFile, versionRegex) {
+    this.name = manifestFile;
+    this.manifestFile = manifestFile;
+    try {
+      this.versionRegex = new RegExp(versionRegex, "m");
+    } catch (err) {
+      throw new Error(`Invalid version regex for ${manifestFile}: ${err.message}`);
+    }
+    if (!/\((?!\?)/.test(versionRegex)) {
+      throw new Error(`Version regex for ${manifestFile} must contain at least one capture group`);
+    }
+  }
+  exists(cwd) {
+    return fs.existsSync(path.join(cwd, this.manifestFile));
+  }
+  getVersion(cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = fs.readFileSync(filePath, "utf-8");
+    const match = content.match(this.versionRegex);
+    if (!match?.[1]) {
+      throw new Error(`No version match found in ${this.manifestFile}`);
+    }
+    return match[1];
+  }
+  setVersion(version, cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = fs.readFileSync(filePath, "utf-8");
+    const match = this.versionRegex.exec(content);
+    if (!match || match.index === void 0) {
+      throw new Error(`No version match found in ${this.manifestFile}`);
+    }
+    const captureStart = match.index + match[0].indexOf(match[1]);
+    const captureEnd = captureStart + match[1].length;
+    const updated = content.slice(0, captureStart) + version + content.slice(captureEnd);
+    fs.writeFileSync(filePath, updated, "utf-8");
+  }
+}
+class TomlVersionSource {
+  name;
+  manifestFile;
+  versionPath;
+  constructor(manifestFile = "Cargo.toml", versionPath = "package.version") {
+    this.name = manifestFile;
+    this.manifestFile = manifestFile;
+    this.versionPath = versionPath;
+  }
+  exists(cwd) {
+    return fs.existsSync(path.join(cwd, this.manifestFile));
+  }
+  getVersion(cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = fs.readFileSync(filePath, "utf-8");
+    const parsed = parse$2(content);
+    const version = getNestedValue(parsed, this.versionPath);
+    if (typeof version !== "string" || version.length === 0) {
+      throw new Error(`No version field at '${this.versionPath}' in ${this.manifestFile}`);
+    }
+    return version;
+  }
+  setVersion(version, cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = fs.readFileSync(filePath, "utf-8");
+    const sectionKey = this.getSectionKey();
+    const updated = replaceTomlVersion(content, sectionKey, version);
+    if (updated === content) {
+      throw new Error(`Could not find version field to update in ${this.manifestFile}`);
+    }
+    fs.writeFileSync(filePath, updated, "utf-8");
+  }
+  getSectionKey() {
+    const parts = this.versionPath.split(".");
+    if (parts.length === 1) {
+      return { section: "", key: parts[0] };
+    }
+    return {
+      section: parts.slice(0, -1).join("."),
+      key: parts[parts.length - 1]
+    };
+  }
+}
+function getNestedValue(obj, dotPath) {
+  let current = obj;
+  for (const key of dotPath.split(".")) {
+    if (current === null || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[key];
+  }
+  return current;
+}
+function replaceTomlVersion(content, target, newVersion) {
+  const lines = content.split("\n");
+  const sectionHeader = target.section ? `[${target.section}]` : null;
+  let inSection = sectionHeader === null;
+  const versionRegex = new RegExp(`^(\\s*${escapeRegExp$1(target.key)}\\s*=\\s*)(["'])([^"']*)(\\2)`);
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (sectionHeader !== null) {
+      if (trimmed === sectionHeader) {
+        inSection = true;
+        continue;
+      }
+      if (inSection && trimmed.startsWith("[") && trimmed !== sectionHeader) {
+        inSection = false;
+        continue;
+      }
+    }
+    if (inSection) {
+      const match = lines[i].match(versionRegex);
+      if (match) {
+        lines[i] = lines[i].replace(versionRegex, `$1$2${newVersion}$4`);
+        return lines.join("\n");
+      }
+    }
+  }
+  return content;
+}
+function escapeRegExp$1(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+class VersionFileSource {
+  name;
+  manifestFile;
+  constructor(manifestFile = "VERSION") {
+    this.name = manifestFile;
+    this.manifestFile = manifestFile;
+  }
+  exists(cwd) {
+    return fs.existsSync(path.join(cwd, this.manifestFile));
+  }
+  getVersion(cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const version = fs.readFileSync(filePath, "utf-8").trim();
+    if (version.length === 0) {
+      throw new Error(`${this.manifestFile} is empty`);
+    }
+    return version;
+  }
+  setVersion(version, cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    fs.writeFileSync(filePath, `${version}
+`, "utf-8");
+  }
+}
+class YamlVersionSource {
+  name;
+  manifestFile;
+  versionKey;
+  constructor(manifestFile = "pubspec.yaml", versionKey = "version") {
+    this.name = manifestFile;
+    this.manifestFile = manifestFile;
+    this.versionKey = versionKey;
+  }
+  exists(cwd) {
+    return fs.existsSync(path.join(cwd, this.manifestFile));
+  }
+  getVersion(cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = fs.readFileSync(filePath, "utf-8");
+    const parsed = yaml.load(content);
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error(`Failed to parse ${this.manifestFile}`);
+    }
+    const version = parsed[this.versionKey];
+    if (typeof version !== "string" || version.length === 0) {
+      if (typeof version === "number") {
+        return String(version);
+      }
+      throw new Error(`No version field in ${this.manifestFile}`);
+    }
+    return version;
+  }
+  setVersion(version, cwd) {
+    const filePath = path.join(cwd, this.manifestFile);
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`${this.manifestFile} not found in ${cwd}`);
+    }
+    const content = fs.readFileSync(filePath, "utf-8");
+    const regex = new RegExp(`^(${escapeRegExp(this.versionKey)}:\\s*)(["']?)(.+?)\\2\\s*$`, "m");
+    const updated = content.replace(regex, `$1$2${version}$2`);
+    if (updated === content) {
+      throw new Error(`Could not find version field to update in ${this.manifestFile}`);
+    }
+    fs.writeFileSync(filePath, updated, "utf-8");
+  }
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+const VALID_SOURCES = /* @__PURE__ */ new Set([
+  "auto",
+  "package.json",
+  "composer.json",
+  "Cargo.toml",
+  "pyproject.toml",
+  "pubspec.yaml",
+  "pom.xml",
+  "VERSION",
+  "git-tag",
+  "custom"
+]);
+const DETECTION_TABLE = [
+  {
+    file: "package.json",
+    source: "package.json",
+    factory: () => new JsonVersionSource("package.json", "version")
+  },
+  {
+    file: "Cargo.toml",
+    source: "Cargo.toml",
+    factory: () => new TomlVersionSource("Cargo.toml", "package.version")
+  },
+  {
+    file: "pyproject.toml",
+    source: "pyproject.toml",
+    factory: () => new TomlVersionSource("pyproject.toml", "project.version")
+  },
+  {
+    file: "pubspec.yaml",
+    source: "pubspec.yaml",
+    factory: () => new YamlVersionSource("pubspec.yaml", "version")
+  },
+  {
+    file: "composer.json",
+    source: "composer.json",
+    factory: () => new JsonVersionSource("composer.json", "version")
+  },
+  {
+    // H-002: Use regex that skips <parent> blocks for pom.xml
+    file: "pom.xml",
+    source: "pom.xml",
+    factory: () => new RegexVersionSource("pom.xml", "<project[^>]*>[\\s\\S]*?<version>([^<]+)</version>")
+  },
+  { file: "VERSION", source: "VERSION", factory: () => new VersionFileSource("VERSION") }
+];
+function assertPathContained(manifestFile, cwd) {
+  const resolved = path.resolve(cwd, manifestFile);
+  const root = path.resolve(cwd);
+  if (!resolved.startsWith(`${root}${path.sep}`) && resolved !== root) {
+    throw new Error(`Manifest path "${manifestFile}" resolves outside the project directory`);
+  }
+}
+function createProvider(source, config, cwd) {
+  if (!VALID_SOURCES.has(source)) {
+    throw new Error(
+      `Invalid manifest source "${source}". Valid sources: ${[...VALID_SOURCES].join(", ")}`
+    );
+  }
+  switch (source) {
+    case "package.json":
+      return new JsonVersionSource("package.json", config.path ?? "version");
+    case "composer.json":
+      return new JsonVersionSource("composer.json", config.path ?? "version");
+    case "Cargo.toml":
+      return new TomlVersionSource("Cargo.toml", config.path ?? "package.version");
+    case "pyproject.toml":
+      return new TomlVersionSource("pyproject.toml", config.path ?? "project.version");
+    case "pubspec.yaml":
+      return new YamlVersionSource("pubspec.yaml", config.path ?? "version");
+    case "pom.xml":
+      return new RegexVersionSource(
+        "pom.xml",
+        config.regex ?? "<project[^>]*>[\\s\\S]*?<version>([^<]+)</version>"
+      );
+    case "VERSION":
+      return new VersionFileSource(config.path ?? "VERSION");
+    case "git-tag":
+      return new GitTagSource();
+    case "custom": {
+      if (!config.regex) {
+        throw new Error("Custom manifest source requires a 'regex' field in manifest config");
+      }
+      if (!config.path) {
+        throw new Error(
+          "Custom manifest source requires a 'path' field (manifest filename) in manifest config"
+        );
+      }
+      assertPathContained(config.path, cwd);
+      return new RegexVersionSource(config.path, config.regex);
+    }
+    default:
+      throw new Error(`Unknown manifest source: ${source}`);
+  }
+}
+function resolveVersionSource(config, cwd = process.cwd()) {
+  if (config.source !== "auto") {
+    return createProvider(config.source, config, cwd);
+  }
+  for (const entry of DETECTION_TABLE) {
+    const provider = entry.factory();
+    if (provider.exists(cwd)) {
+      return provider;
+    }
+  }
+  return new JsonVersionSource("package.json", "version");
+}
+function detectManifests(cwd = process.cwd()) {
+  const detected = [];
+  for (const entry of DETECTION_TABLE) {
+    const provider = entry.factory();
+    if (provider.exists(cwd)) {
+      detected.push(entry.source);
+    }
+  }
+  return detected;
+}
 function getPackageJsonPath(cwd = process.cwd()) {
   return path.join(cwd, "package.json");
 }
@@ -367,18 +791,30 @@ function writePackageJson(pkg, cwd = process.cwd()) {
   fs.writeFileSync(getPackageJsonPath(cwd), `${JSON.stringify(pkg, null, 2)}
 `, "utf-8");
 }
-function getPackageVersion(cwd = process.cwd()) {
+function getPackageVersion(cwd = process.cwd(), manifest) {
+  if (manifest) {
+    const provider = resolveVersionSource(manifest, cwd);
+    return provider.getVersion(cwd);
+  }
   const pkg = readPackageJson(cwd);
   if (typeof pkg.version !== "string" || pkg.version.length === 0) {
     throw new Error("No version field in package.json");
   }
   return pkg.version;
 }
-function setPackageVersion(version, cwd = process.cwd()) {
+function setPackageVersion(version, cwd = process.cwd(), manifest) {
+  if (manifest) {
+    const provider = resolveVersionSource(manifest, cwd);
+    provider.setVersion(version, cwd);
+    return;
+  }
   const pkg = readPackageJson(cwd);
   pkg.version = version;
   writePackageJson(pkg, cwd);
 }
+function getVersionSource(manifest, cwd = process.cwd()) {
+  return resolveVersionSource(manifest, cwd);
+}
 const SEMVER_REGEX = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
 function parse(version) {
   const match = version.match(SEMVER_REGEX);
@@ -637,6 +1073,9 @@ const DEFAULT_CONFIG = {
       preventFutureDates: true
     }
   },
+  manifest: {
+    source: "auto"
+  },
   sync: {
     files: ["README.md", "CHANGELOG.md"],
     patterns: [
@@ -896,7 +1335,7 @@ function getCalVerFeedback(version, calverConfig, previousVersion) {
     });
     suggestions.push({
       message: `Expected format: ${format2}`,
-      fix: `Update package.json to use current date: "${getCurrentVersion(format2)}"`,
+      fix: `Update version to current date: "${getCurrentVersion(format2)}"`,
       autoFixable: true
     });
     return { valid: false, errors, suggestions, canAutoFix: true };
@@ -1003,7 +1442,7 @@ function getChangelogFeedback(hasEntry, version, latestChangelogVersion) {
   }
   if (latestChangelogVersion && latestChangelogVersion !== version) {
     suggestions.push({
-      message: `CHANGELOG.md latest entry is ${latestChangelogVersion}, but package.json is ${version}`,
+      message: `CHANGELOG.md latest entry is ${latestChangelogVersion}, but manifest version is ${version}`,
       fix: `Make sure versions are in sync`,
       autoFixable: false
     });
@@ -1014,7 +1453,7 @@ function getTagFeedback(tagVersion, packageVersion, hasUnsyncedFiles) {
   const suggestions = [];
   if (tagVersion !== packageVersion) {
     suggestions.push({
-      message: `Git tag "${tagVersion}" doesn't match package.json "${packageVersion}"`,
+      message: `Git tag "${tagVersion}" doesn't match manifest version "${packageVersion}"`,
       fix: `Delete tag and recreate: git tag -d ${tagVersion} && git tag ${packageVersion}`,
       autoFixable: false
     });
@@ -1028,25 +1467,43 @@ function getTagFeedback(tagVersion, packageVersion, hasUnsyncedFiles) {
   }
   return suggestions;
 }
-function fixPackageVersion(targetVersion, cwd = process.cwd()) {
-  const packagePath = path.join(cwd, "package.json");
-  if (!fs.existsSync(packagePath)) {
-    return { fixed: false, message: "package.json not found" };
+function fixPackageVersion(targetVersion, cwd = process.cwd(), manifest) {
+  if (!manifest) {
+    const packagePath = path.join(cwd, "package.json");
+    if (!fs.existsSync(packagePath)) {
+      return { fixed: false, message: "package.json not found" };
+    }
+    const pkg = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
+    const oldVersion2 = typeof pkg.version === "string" ? pkg.version : void 0;
+    if (oldVersion2 === targetVersion) {
+      return { fixed: false, message: `Already at version ${targetVersion}` };
+    }
+    setPackageVersion(targetVersion, cwd);
+    return {
+      fixed: true,
+      message: `Updated package.json from ${oldVersion2} to ${targetVersion}`,
+      file: packagePath
+    };
+  }
+  const provider = getVersionSource(manifest, cwd);
+  let oldVersion;
+  try {
+    oldVersion = provider.getVersion(cwd);
+  } catch {
+    return { fixed: false, message: "Version source not found" };
   }
-  const pkg = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
-  const oldVersion = typeof pkg.version === "string" ? pkg.version : void 0;
   if (oldVersion === targetVersion) {
     return { fixed: false, message: `Already at version ${targetVersion}` };
   }
-  setPackageVersion(targetVersion, cwd);
+  provider.setVersion(targetVersion, cwd);
   return {
     fixed: true,
-    message: `Updated package.json from ${oldVersion} to ${targetVersion}`,
-    file: packagePath
+    message: `Updated version from ${oldVersion} to ${targetVersion}`,
+    file: provider.manifestFile ? path.join(cwd, provider.manifestFile) : void 0
   };
 }
 function fixSyncIssues(config, cwd = process.cwd()) {
-  const version = getPackageVersion(cwd);
+  const version = getPackageVersion(cwd, config.manifest);
   const results = syncVersion(version, config.sync, cwd).filter((result) => result.updated).map((result) => ({
     fixed: true,
     message: `Updated ${path.relative(cwd, result.file)} (${result.changes.length} changes)`,
@@ -1102,9 +1559,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 }
 function fixAll(config, targetVersion, cwd = process.cwd()) {
   const results = [];
-  const version = targetVersion || getPackageVersion(cwd);
-  if (targetVersion && targetVersion !== getPackageVersion(cwd)) {
-    results.push(fixPackageVersion(targetVersion, cwd));
+  const version = targetVersion || getPackageVersion(cwd, config.manifest);
+  if (targetVersion && targetVersion !== getPackageVersion(cwd, config.manifest)) {
+    results.push(fixPackageVersion(targetVersion, cwd, config.manifest));
   }
   const syncResults = fixSyncIssues(config, cwd);
   results.push(...syncResults);
@@ -1157,6 +1614,122 @@ function getCalVerConfig$1(config) {
   }
   return config.versioning.calver;
 }
+const HOOK_NAMES = ["pre-commit", "pre-push", "post-tag"];
+function checkHooksPathOverride(cwd) {
+  try {
+    const hooksPath = execSync("git config core.hooksPath", {
+      cwd,
+      encoding: "utf-8"
+    }).trim();
+    if (hooksPath) {
+      const resolved = path.resolve(cwd, hooksPath);
+      const huskyDir = path.resolve(cwd, ".husky");
+      if (resolved === huskyDir || resolved.startsWith(`${huskyDir}${path.sep}`)) {
+        return {
+          code: "HOOKS_PATH_HUSKY",
+          severity: "warning",
+          message: `Husky detected — core.hooksPath is set to "${hooksPath}". Hooks in .git/hooks/ are bypassed. Add versionguard validate to your .husky/pre-commit manually or use a tool like forge-ts that manages .husky/ hooks cooperatively.`
+        };
+      }
+      return {
+        code: "HOOKS_PATH_OVERRIDE",
+        severity: "error",
+        message: `git core.hooksPath is set to "${hooksPath}" — hooks in .git/hooks/ are bypassed`,
+        fix: "git config --unset core.hooksPath"
+      };
+    }
+  } catch {
+  }
+  return null;
+}
+function checkHuskyBypass() {
+  if (process.env.HUSKY === "0") {
+    return {
+      code: "HUSKY_BYPASS",
+      severity: "error",
+      message: "HUSKY=0 is set — git hooks are disabled via environment variable",
+      fix: "unset HUSKY"
+    };
+  }
+  return null;
+}
+function checkHookIntegrity(config, cwd) {
+  const warnings = [];
+  const gitDir = findGitDir(cwd);
+  if (!gitDir) {
+    return warnings;
+  }
+  const hooksDir = path.join(gitDir, "hooks");
+  for (const hookName of HOOK_NAMES) {
+    if (!config.git.hooks[hookName]) {
+      continue;
+    }
+    const hookPath = path.join(hooksDir, hookName);
+    if (!fs.existsSync(hookPath)) {
+      warnings.push({
+        code: "HOOK_MISSING",
+        severity: "error",
+        message: `Required hook "${hookName}" is not installed`,
+        fix: "npx versionguard hooks install"
+      });
+      continue;
+    }
+    const actual = fs.readFileSync(hookPath, "utf-8");
+    const expected = generateHookScript(hookName);
+    if (actual !== expected) {
+      if (!actual.includes("versionguard")) {
+        warnings.push({
+          code: "HOOK_REPLACED",
+          severity: "error",
+          message: `Hook "${hookName}" has been replaced — versionguard invocation is missing`,
+          fix: "npx versionguard hooks install"
+        });
+      } else {
+        warnings.push({
+          code: "HOOK_TAMPERED",
+          severity: "warning",
+          message: `Hook "${hookName}" has been modified from the expected template`,
+          fix: "npx versionguard hooks install"
+        });
+      }
+    }
+  }
+  return warnings;
+}
+function checkEnforceHooksPolicy(config) {
+  const anyHookEnabled = HOOK_NAMES.some((name) => config.git.hooks[name]);
+  if (anyHookEnabled && !config.git.enforceHooks) {
+    return {
+      code: "HOOKS_NOT_ENFORCED",
+      severity: "warning",
+      message: "Hooks are enabled but enforceHooks is false — missing hooks will not fail validation",
+      fix: "Set git.enforceHooks: true in .versionguard.yml"
+    };
+  }
+  return null;
+}
+function runGuardChecks(config, cwd) {
+  const warnings = [];
+  const hooksPathWarning = checkHooksPathOverride(cwd);
+  if (hooksPathWarning) {
+    warnings.push(hooksPathWarning);
+  }
+  const huskyWarning = checkHuskyBypass();
+  if (huskyWarning) {
+    warnings.push(huskyWarning);
+  }
+  const integrityWarnings = checkHookIntegrity(config, cwd);
+  warnings.push(...integrityWarnings);
+  const enforceWarning = checkEnforceHooksPolicy(config);
+  if (enforceWarning) {
+    warnings.push(enforceWarning);
+  }
+  const hasErrors = warnings.some((w) => w.severity === "error");
+  return {
+    safe: !hasErrors,
+    warnings
+  };
+}
 function runGit(cwd, args, encoding) {
   return childProcess.execFileSync("git", args, {
     cwd,
@@ -1208,7 +1781,7 @@ function createTag(version, message, autoFix = true, config, cwd = process.cwd()
         actions
       };
     }
-    const packageVersion = getPackageVersion(cwd);
+    const packageVersion = getPackageVersion(cwd, config.manifest);
     const shouldAutoFix = autoFix;
     const preflightError = getTagPreflightError(config, cwd, version, shouldAutoFix);
     if (preflightError) {
@@ -1221,7 +1794,7 @@ function createTag(version, message, autoFix = true, config, cwd = process.cwd()
     if (version !== packageVersion && !autoFix) {
       return {
         success: false,
-        message: `Version mismatch: package.json is ${packageVersion}, tag is ${version}`,
+        message: `Version mismatch: manifest version is ${packageVersion}, tag is ${version}`,
         actions: []
       };
     }
@@ -1281,15 +1854,15 @@ function handlePostTag(config, cwd = process.cwd()) {
         actions
       };
     }
-    const packageVersion = getPackageVersion(cwd);
+    const packageVersion = getPackageVersion(cwd, config.manifest);
     if (tag.version !== packageVersion) {
       return {
         success: false,
-        message: `Tag version ${tag.version} doesn't match package.json ${packageVersion}`,
+        message: `Tag version ${tag.version} doesn't match manifest version ${packageVersion}`,
         actions: [
           "To fix: delete tag and recreate with correct version",
           `  git tag -d ${tag.name}`,
-          `  npm version ${tag.version}`,
+          `  Update manifest to ${tag.version}`,
           `  git tag ${tag.name}`
         ]
       };
@@ -1320,7 +1893,7 @@ function getTagPreflightError(config, cwd, expectedVersion, allowAutoFix = false
   if (hasDirtyWorktree(cwd)) {
     return "Working tree must be clean before creating or validating release tags";
   }
-  const version = expectedVersion ?? getPackageVersion(cwd);
+  const version = expectedVersion ?? getPackageVersion(cwd, config.manifest);
   const versionResult = config.versioning.type === "semver" ? validate$1(version) : validate$2(
     version,
     config.versioning.calver?.format ?? "YYYY.MM.PATCH",
@@ -1414,7 +1987,7 @@ function validate(config, cwd = process.cwd()) {
   const errors = [];
   let version;
   try {
-    version = getPackageVersion(cwd);
+    version = getPackageVersion(cwd, config.manifest);
   } catch (err) {
     return {
       valid: false,
@@ -1485,7 +2058,7 @@ function doctor(config, cwd = process.cwd()) {
   };
 }
 function sync(config, cwd = process.cwd()) {
-  const version = getPackageVersion(cwd);
+  const version = getPackageVersion(cwd, config.manifest);
   syncVersion(version, config.sync, cwd);
 }
 function canBump(currentVersion, newVersion, config) {
@@ -1534,37 +2107,51 @@ function isWorktreeClean(cwd) {
   }
 }
 export {
-  suggestTagMessage as A,
-  sync as B,
-  syncVersion as C,
-  validateChangelog as D,
-  validateTagForPush as E,
-  validateVersion as F,
-  getPackageVersion as a,
-  getVersionFeedback as b,
-  getSyncFeedback as c,
-  getChangelogFeedback as d,
-  doctor as e,
-  fixAll as f,
+  fixChangelog as A,
+  fixPackageVersion as B,
+  getAllTags as C,
+  getLatestTag as D,
+  getTagFeedback as E,
+  getVersionSource as F,
+  GitTagSource as G,
+  resolveVersionSource as H,
+  semver as I,
+  JsonVersionSource as J,
+  suggestTagMessage as K,
+  sync as L,
+  syncVersion as M,
+  validateChangelog as N,
+  validateTagForPush as O,
+  validateVersion as P,
+  RegexVersionSource as R,
+  TomlVersionSource as T,
+  VersionFileSource as V,
+  YamlVersionSource as Y,
+  installHooks as a,
+  getPackageVersion as b,
+  getVersionFeedback as c,
+  getSyncFeedback as d,
+  getChangelogFeedback as e,
+  doctor as f,
   getConfig as g,
   handlePostTag as h,
   initConfig as i,
-  fixSyncIssues as j,
-  setPackageVersion as k,
-  createTag as l,
-  installHooks as m,
+  fixAll as j,
+  fixSyncIssues as k,
+  setPackageVersion as l,
+  createTag as m,
   areHooksInstalled as n,
   calver as o,
   canBump as p,
-  checkHardcodedVersions as q,
-  fixChangelog as r,
+  checkEnforceHooksPolicy as q,
+  runGuardChecks as r,
   suggestNextVersion as s,
-  fixPackageVersion as t,
+  checkHardcodedVersions as t,
   uninstallHooks as u,
   validate as v,
-  getAllTags as w,
-  getLatestTag as x,
-  getTagFeedback as y,
-  semver as z
+  checkHookIntegrity as w,
+  checkHooksPathOverride as x,
+  checkHuskyBypass as y,
+  detectManifests as z
 };
-//# sourceMappingURL=index-C6jrxye7.js.map
+//# sourceMappingURL=index-BrZJDWya.js.map