@precisa-saude/cli 1.0.4 → 1.1.0

package/dist/templates/.claude/agents/refactor-scout.md

@@ -0,0 +1,139 @@
+---
+name: refactor-scout
+description: Find extraction and deduplication opportunities — large components, duplicated patterns, unused shared utilities
+model: sonnet
+tools: Read, Grep, Glob
+---
+
+You are a refactoring analyst for the Precisa Saúde ecosystem. You scan for both project-specific patterns (component extraction, shared package underuse) and general code smells from established software engineering practices (Fowler's _Refactoring_, Martin's _Clean Code_). You report opportunities — you do NOT make changes.
+
+## Input
+
+You will receive either:
+
+- Specific file paths to analyze
+- A feature area (e.g., "biomarker pages", "admin dashboard")
+- No input — in which case, scan broadly for the biggest opportunities
+
+## What to Look For
+
+### 1. Large Components (>300 lines)
+
+Search for React components that have grown beyond ~300 lines and could be decomposed:
+
+```
+Glob: apps/web/src/**/*.tsx
+```
+
+Read files and check line counts. Flag components that:
+
+- Have multiple distinct visual sections that could be separate components
+- Mix data fetching logic with rendering
+- Contain inline sub-components defined within the file
+
+### 2. Duplicated JSX Patterns
+
+Search for similar UI patterns used in multiple places:
+
+- Status badges with the same color mapping logic
+- Card layouts with identical structure but different data
+- Form field groups with repeated validation patterns
+- Table cell renderers with shared formatting
+
+### 3. Shared Package Underuse
+
+The codebase has shared packages that should be used consistently:
+
+- **`@precisa-saude/fhir`**: `normalizeCode()`, `getReferenceRange()`, biomarker definitions
+- **`@precisa-saude/ui`**: Shared UI components
+- **`@precisa-saude/api-types`**: TypeScript types for API responses
+- **`@precisa-saude/evidence`**: Evidence-based content
+
+Search for violations:
+
+- Direct LOINC code strings instead of `normalizeCode()`
+- Hardcoded reference ranges instead of `getReferenceRange()`
+- Manual biomarker name formatting instead of `getBiomarkerDisplayName()`
+- Duplicated TypeScript interfaces that exist in `api-types`
+
+### 4. Hook Duplication
+
+Search for custom hooks with similar state management patterns:
+
+- Multiple hooks doing the same fetch-cache-display pattern
+- Duplicated `useEffect` patterns for keyboard, scroll, or viewport handling
+- Category navigation or filtering logic repeated across pages
+
+### 5. Code Smells & Quality Patterns
+
+Scan for well-known code smells adapted for TypeScript/React:
+
+#### Complexity & Control Flow
+
+- Deeply nested conditionals (>3 levels of if/else/ternary) — flatten with early returns or guard clauses (Fowler: _Replace Nested Conditional with Guard Clauses_)
+- Long functions (>40 lines for utilities, >80 for components) — extract logical sections into named functions (Fowler: _Extract Function_)
+- Complex boolean expressions — extract to named variables or predicate functions (e.g., `isEligibleForTrial` vs `user.plan === 'free' && !user.expired && user.labResults.length > 0`)
+- Switch/if-else chains on type — consider lookup maps or polymorphism (Fowler: _Replace Conditional with Polymorphism_)
+
+#### Function & Parameter Design
+
+- Long parameter lists (>3 params) — group into an options/config object (Fowler: _Introduce Parameter Object_)
+- Flag arguments (boolean params that change function behavior) — split into two clearly named functions (Martin: _Clean Code_ ch. 3)
+- Output parameters — functions that mutate their arguments instead of returning a new value
+
+#### Naming & Clarity
+
+- Generic names that don't communicate intent — `data`, `info`, `item`, `handler`, `process`, `manage`, `utils`
+- Inconsistent naming for the same concept — `user` vs `patient` vs `profile` for the same entity across files
+- Abbreviated names that sacrifice readability — `btn`, `usr`, `calc`, `idx` (outside well-known conventions like `i`, `e`, `ctx`)
+
+#### Code Organization
+
+- Feature envy — a function that reads/writes more from another module than its own (Fowler: _Move Function_)
+- Dead code — unused imports, unreachable branches after early returns, commented-out code blocks, exported functions with zero consumers
+- Primitive obsession — raw strings/numbers where a union type or enum would add safety (e.g., `status: string` instead of `status: 'pending' | 'active' | 'expired'`) (Fowler: _Replace Primitive with Object_)
+- Data clumps — the same group of variables always passed together (e.g., `userId`, `userName`, `userEmail` instead of a `User` type)
+
+#### Error Handling
+
+- Empty catch blocks — silently swallowing errors without logging or re-throwing
+- Overly broad catch — catching generic `Error` when only specific exceptions are expected
+- Error strings instead of types — `throw new Error('NOT_FOUND')` instead of a typed error class or union
+
+#### React-Specific Smells
+
+- Prop drilling (>2 levels) — props passed through components that don't use them; consider context or composition
+- God components — components owning too many concerns (data fetching + complex state + rendering + side effects)
+- Inline object/array literals in JSX props — creates new references every render, defeating memoization
+- useEffect as lifecycle — effects that replicate mount/unmount/update patterns instead of synchronizing with specific data dependencies
+
+## Output Format
+
+```
+Refactoring Opportunities
+=========================
+
+### High Impact (>300 lines or duplicated in 3+ places)
+
+1. **Extract `BiomarkerStatusBadge`** from:
+   - `apps/web/src/components/biomarker/BiomarkerCard.tsx:142-168`
+   - `apps/web/src/components/biomarker/BiomarkerList.tsx:89-115`
+   - Same badge rendering with identical color mapping in both
+
+2. **Use `normalizeCode()` from @precisa-saude/fhir** in:
+   - `apps/api/src/services/lab-results.ts:234` — raw LOINC string comparison
+
+### Medium Impact (repeated in 2 places or >200 lines)
+...
+
+### Low Impact (cleanup opportunities)
+...
+```
+
+## Rules
+
+- **Read-only** — report opportunities, never modify code
+- **Reference existing shared packages** — always check if a utility exists before suggesting a new one
+- **Prioritize by impact** — large components and 3+ duplications first
+- **Include line numbers** — make it easy to navigate to each finding
+- **Don't suggest premature abstractions** — 2 similar lines don't need a helper function

package/dist/templates/AGENTS.md

@@ -0,0 +1,45 @@
+# Specific instructions — {{REPO_NAME}}
+
+> This file holds ONLY the rules specific to this repository. The
+> shared rules across the precisa-saude ecosystem (tone, git, hooks,
+> reviews, worktrees, source verification, test coverage, code
+> conventions) live in `@precisa-saude/agent-instructions`.
+>
+> **Read the shared base online:**
+> https://github.com/Precisa-Saude/tooling/blob/main/packages/agent-instructions/AGENTS.md
+>
+> Claude Code loads both files (shared base + this one) via imports in
+> `CLAUDE.md`. Update the base with:
+> `pnpm update @precisa-saude/agent-instructions`.
+
+## Overview
+
+<!-- One or two sentences on what this repo does. -->
+
+## Structure
+
+```
+packages/
+  ...
+site/  (if applicable)
+```
+
+## Commit scopes
+
+Valid scopes: {{COMMIT_SCOPES_HUMAN}}.
+
+## Worktree — specific values
+
+Worktree flow and commands are in the shared base. The canonical config
+lives in `package.json` under `"worktree"`. For quick reference:
+
+| Field         | Value                                      |
+| ------------- | ------------------------------------------ |
+| Port registry | `/tmp/{{REPO_NAME}}-worktree-ports.json`   |
+| Services      | (filled in when the repo adds dev servers) |
+
+Launch a dev server in a feature worktree:
+
+```bash
+pnpm exec precisa-worktree dev --detach
+```

package/dist/templates/CLAUDE.md

@@ -0,0 +1,9 @@
+# Claude instructions
+
+This repository follows the [AGENTS.md](https://agents.md/) convention.
+Shared rules across the precisa-saude ecosystem live in
+`@precisa-saude/agent-instructions` (installed as a devDependency), and
+repo-specific rules live in `./AGENTS.md`.
+
+@./node_modules/@precisa-saude/agent-instructions/AGENTS.md
+@./AGENTS.md

package/dist/templates/commitlintrc.cjs

@@ -0,0 +1,10 @@
+const base = require('@precisa-saude/commitlint-config');
+
+/** @type {import('@commitlint/types').UserConfig} */
+module.exports = {
+  ...base,
+  rules: {
+    ...base.rules,
+    'scope-enum': [2, 'always', [{{COMMIT_SCOPES_JSON}}]],
+  },
+};

package/dist/templates/eslint.config.js

@@ -0,0 +1,19 @@
+import base from '@precisa-saude/eslint-config/base';
+
+export default [
+  ...base,
+  {
+    // Test files are excluded from package tsconfigs (to keep tsc --noEmit
+    // tight), so disable type-aware parsing for them or ESLint errors
+    // trying to locate a project.
+    files: ['**/*.test.ts', '**/*.test.tsx', '**/*.spec.ts', '**/*.spec.tsx', '**/__tests__/**'],
+    languageOptions: {
+      parserOptions: { project: false },
+    },
+    rules: {
+      '@typescript-eslint/consistent-type-imports': 'off',
+      'max-lines': 'off',
+      'max-lines-per-function': 'off',
+    },
+  },
+];

package/dist/templates/github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,33 @@
+---
+name: Reporte de bug
+about: Algo está quebrado
+title: '[bug] '
+labels: [bug]
+---
+
+## O que aconteceu
+
+<!-- Descrição curta do comportamento inesperado. -->
+
+## Reprodução
+
+<!-- Passos mínimos. Inclua o comando exato executado, pacote + versão, versões do Node/pnpm. -->
+
+```bash
+# comando(s)
+```
+
+## Esperado
+
+<!-- O que você esperava que acontecesse. -->
+
+## Ambiente
+
+- Pacote + versão:
+- Node: `node --version`
+- pnpm: `pnpm --version`
+- SO: macOS / Linux / Windows
+
+## Contexto adicional
+
+<!-- Stack trace, logs de CI, etc. -->

package/dist/templates/github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Security vulnerability
+  - name: Vulnerabilidade de segurança
     url: 'mailto:{{SECURITY_EMAIL}}'
-    about: Report security issues privately — see SECURITY.md
-  - name: General questions and discussions
+    about: Reporte questões de segurança em privado — veja SECURITY.md
+  - name: Perguntas e discussões gerais
     url: 'https://github.com/{{REPO_SLUG}}/discussions'
-    about: Ask questions, share ideas, or discuss
+    about: Faça perguntas, compartilhe ideias ou discuta

package/dist/templates/github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Solicitação de feature
+about: Proponha uma nova funcionalidade ou melhoria
+title: '[feat] '
+labels: [enhancement]
+---
+
+## Problema
+
+<!-- Qual limitação ou fricção você está enfrentando? -->
+
+## Solução proposta
+
+<!-- Esboce a API / comportamento. Exemplos concretos preferíveis a prosa. -->
+
+## Alternativas consideradas
+
+<!-- Outras abordagens que você considerou e por que descartou. -->

package/dist/templates/github/PULL_REQUEST_TEMPLATE.md

@@ -1,18 +1,18 @@
-<!-- Thanks for contributing. Please fill out the sections below. -->
+<!-- Obrigado pela contribuição. Por favor preencha as seções abaixo. -->
 
-## Summary
+## Resumo
 
-<!-- One or two sentences on what this changes and why. -->
+<!-- Uma ou duas frases sobre o que muda e por quê. -->
 
-## Type of change
+## Tipo de alteração
 
-- [ ] Bug fix (patch)
-- [ ] Feature (minor)
-- [ ] Breaking change (major — include a `BREAKING CHANGE:` footer on the commit)
-- [ ] Docs / CI only (no version bump expected)
+- [ ] Correção de bug (`fix` — patch)
+- [ ] Nova funcionalidade (`feat` — minor)
+- [ ] Breaking change (major — inclua um footer `BREAKING CHANGE:` no commit)
+- [ ] Apenas docs / CI (sem bump de versão esperado)
 
-## Test plan
+## Plano de teste
 
-<!-- How a reviewer can verify this. -->
+<!-- Como um revisor pode verificar essa mudança. -->
 
 - [ ]

package/dist/templates/github/workflows/_checks.yml

@@ -0,0 +1,102 @@
+name: CI Checks
+
+# Reusable workflow — parallel CI checks. Each concern runs as its own
+# job so feedback is fast: a lint failure doesn't wait for the test
+# suite. Called by the repo's `ci.yml` orchestrator.
+#
+# Each repo MAY add extra checks (e.g. FHIR IG compile, benchmark
+# invariant scripts) by inlining additional jobs here after sync, or
+# in a separate workflow if the check is big enough to warrant it.
+
+on:
+  workflow_call:
+
+jobs:
+  commitlint-title:
+    name: PR title (Conventional Commits)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - name: Validate PR title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: echo "$PR_TITLE" | pnpm exec commitlint
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm turbo run lint
+
+  typecheck:
+    name: Typecheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm turbo run typecheck
+
+  format:
+    name: Format check
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm format:check
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm turbo run build
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm turbo run build
+      - run: pnpm turbo run test

package/dist/templates/github/workflows/_deploy-site.yml

@@ -0,0 +1,168 @@
+name: Deploy site
+
+# Reusable workflow — builds the repo's site and deploys to Cloudflare
+# Pages when site files changed, then sends a Slack notification.
+# Guards on site file presence across the pushed range.
+
+on:
+  workflow_call:
+    inputs:
+      project_name:
+        description: 'Cloudflare Pages project name'
+        type: string
+        required: true
+      site_filter:
+        description: 'pnpm filter to build the site (e.g. @medbench-brasil/site)'
+        type: string
+        required: true
+      site_path:
+        description: 'Output directory to deploy (default: site/dist)'
+        type: string
+        default: 'site/dist'
+
+jobs:
+  build-site:
+    name: Build site
+    runs-on: ubuntu-latest
+    outputs:
+      site_changed: ${{ steps.changes.outputs.site_changed }}
+    steps:
+      - name: Check for site changes
+        id: changes
+        uses: actions/github-script@v7
+        with:
+          script: |
+            if (context.eventName === 'workflow_dispatch') {
+              core.setOutput('site_changed', 'true');
+              return;
+            }
+            const before = context.payload.before;
+            const after = context.sha;
+            const isInitial = !before || /^0+$/.test(before);
+            let filenames = [];
+            if (isInitial) {
+              const { data: commit } = await github.rest.repos.getCommit({
+                owner: context.repo.owner, repo: context.repo.repo, ref: after,
+              });
+              filenames = (commit.files ?? []).map(f => f.filename);
+            } else {
+              const pages = await github.paginate(
+                github.rest.repos.compareCommitsWithBasehead,
+                {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  basehead: `${before}...${after}`,
+                  per_page: 100,
+                },
+              );
+              filenames = pages.flatMap(p => (p.files ?? []).map(f => f.filename));
+            }
+            const siteChanged = filenames.some(f => f.startsWith('site/'));
+            core.setOutput('site_changed', siteChanged ? 'true' : 'false');
+
+      - uses: actions/checkout@v6
+        if: steps.changes.outputs.site_changed == 'true'
+      - uses: pnpm/action-setup@v4
+        if: steps.changes.outputs.site_changed == 'true'
+      - uses: actions/setup-node@v6
+        if: steps.changes.outputs.site_changed == 'true'
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - name: Install dependencies
+        if: steps.changes.outputs.site_changed == 'true'
+        run: pnpm install --frozen-lockfile
+      # `--filter=<site>...` includes workspace deps; without `...` tsc
+      # breaks not finding types/dist of consumed packages.
+      - name: Build site
+        if: steps.changes.outputs.site_changed == 'true'
+        run: pnpm turbo run build --filter=${{ inputs.site_filter }}...
+      - uses: actions/upload-artifact@v6
+        if: steps.changes.outputs.site_changed == 'true'
+        with:
+          name: site-dist
+          path: ${{ inputs.site_path }}
+          retention-days: 1
+
+  deploy-site:
+    name: Deploy site
+    needs: build-site
+    if: always() && !cancelled() && needs.build-site.outputs.site_changed == 'true' && needs.build-site.result == 'success' && github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v7
+        with:
+          name: site-dist
+          path: ${{ inputs.site_path }}
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          packageManager: npm
+          command: pages deploy ${{ inputs.site_path }} --project-name=${{ inputs.project_name }} --branch=main --commit-hash=${{ github.sha }} --commit-message="${{ github.sha }}"
+      - name: Purge Cloudflare cache
+        if: env.CLOUDFLARE_ZONE_ID != ''
+        env:
+          CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
+        run: |
+          curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${CLOUDFLARE_ZONE_ID}/purge_cache" \
+            -H "Authorization: Bearer ${{ secrets.CLOUDFLARE_API_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            --data '{"purge_everything":true}'
+
+  notify:
+    name: Notify Slack
+    needs: [build-site, deploy-site]
+    if: always() && github.event_name != 'pull_request' && needs.deploy-site.result != 'skipped'
+    runs-on: ubuntu-latest
+    steps:
+      # Slack payload via jq -n — auto-escapes quotes, backslashes,
+      # newlines, control chars. Interpolating commit messages or SHAs raw
+      # into YAML strings is injection-prone.
+      - name: Build notification
+        env:
+          GH_SHA: ${{ github.sha }}
+          GH_SERVER: ${{ github.server_url }}
+          GH_REPO: ${{ github.repository }}
+          GH_RUN_ID: ${{ github.run_id }}
+          DEPLOY_RESULT: ${{ needs.deploy-site.result }}
+          PROJECT_NAME: ${{ inputs.project_name }}
+        run: |
+          SHORT_SHA="${GH_SHA:0:7}"
+          RUN_URL="${GH_SERVER}/${GH_REPO}/actions/runs/${GH_RUN_ID}"
+          COMMIT_URL="${GH_SERVER}/${GH_REPO}/commit/${GH_SHA}"
+
+          if [ "$DEPLOY_RESULT" = "success" ]; then
+            HEADER=":rocket: ${PROJECT_NAME} site deployed"
+            RESULT_LINE=":white_check_mark: *Site* — deployed to Cloudflare Pages"
+            TEXT="Deploy successful"
+          else
+            HEADER=":rotating_light: ${PROJECT_NAME} site deploy failed"
+            RESULT_LINE=":x: *Site* — deploy failed"
+            TEXT="Deploy failed"
+          fi
+
+          jq -n \
+            --arg text "$TEXT" \
+            --arg header "$HEADER" \
+            --arg result_line "$RESULT_LINE" \
+            --arg context "*Commit:* <${COMMIT_URL}|${SHORT_SHA}> | *Run:* <${RUN_URL}|View logs>" \
+            '{
+              text: $text,
+              blocks: [
+                { type: "header",  text: { type: "plain_text", text: $header, emoji: true } },
+                { type: "section", text: { type: "mrkdwn", text: $result_line } },
+                { type: "context", elements: [ { type: "mrkdwn", text: $context } ] }
+              ]
+            }' > /tmp/slack-payload.json
+
+      - name: Send Slack notification
+        uses: slackapi/slack-github-action@v2.1.0
+        with:
+          webhook: ${{ secrets.SLACK_DEPLOY_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          payload-file-path: /tmp/slack-payload.json

package/dist/templates/github/workflows/_publish.yml

@@ -0,0 +1,77 @@
+name: Publish to npm
+
+# Reusable workflow — publishes workspace packages to npm after release.
+# Consumers pass the list of package dirs as a newline-separated input;
+# each dir is published idempotently (checks the registry first).
+#
+# Pins to `release_sha` so a concurrent push can't change the tree
+# between release creation and publish.
+
+on:
+  workflow_call:
+    inputs:
+      release_sha:
+        description: 'Commit SHA to check out (the chore(release) commit from _release.yml)'
+        type: string
+        required: true
+      packages:
+        description: 'Newline-separated list of package directories to publish (e.g. "packages/core\npackages/calculators")'
+        type: string
+        required: true
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    # `id-token: write` is for Sigstore attestations (`--provenance`),
+    # NOT for npm auth. Auth uses `NPM_TOKEN` org-secret — OIDC trusted
+    # publishing was evaluated and rejected because it requires manual
+    # per-package click-through in the npm web UI (no CLI/API to
+    # automate). `--provenance` gives us supply chain attestations
+    # regardless of auth method.
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.release_sha }}
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm turbo run build
+
+      - name: Publish packages
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PACKAGES: ${{ inputs.packages }}
+        run: |
+          set -e
+          publish_if_needed() {
+            local dir="$1"
+            local pkg_name pkg_version
+            pkg_name=$(node -p "require('./$dir/package.json').name")
+            pkg_version=$(node -p "require('./$dir/package.json').version")
+
+            if npm view "$pkg_name@$pkg_version" version 2>/dev/null; then
+              echo "Skipping $pkg_name@$pkg_version (already published)"
+            else
+              echo "Publishing $pkg_name@$pkg_version..."
+              ( cd "$dir" && pnpm publish --provenance --access public --no-git-checks )
+            fi
+          }
+
+          while IFS= read -r dir; do
+            [ -z "$dir" ] && continue
+            publish_if_needed "$dir"
+          done <<< "$PACKAGES"