@smoothbricks/cli 0.3.2 → 0.3.4

package/dist/monorepo/lockfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAWD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CA0C1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA6BhE"}
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAWD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAkD1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiChE"}

package/dist/monorepo/lockfile.js

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
@@ -20,6 +21,12 @@ export function syncBunLockfileVersions(root, options = {}) {
     let lockfile = readFileSync(lockfilePath, 'utf8');
     let updated = 0;
     for (const pkg of packages) {
+        // If the package.json version is a prerelease (e.g. 0.2.2-next.0) it may
+        // never have been published.  Use the latest stable git tag version so
+        // that `bun pm pack` writes an installable dependency range for consumers.
+        const targetVersion = pkg.version.includes('-')
+            ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+            : pkg.version;
         const relativePath = pkg.path.replaceAll('\\', '/');
         const escaped = escapeRegex(relativePath);
         const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -31,15 +38,16 @@ export function syncBunLockfileVersions(root, options = {}) {
             continue;
         }
         const lockVersion = match[2];
-        if (lockVersion === pkg.version) {
+        if (lockVersion === targetVersion) {
             if (log) {
-                console.log(`ok:   ${relativePath} = ${pkg.version}`);
+                console.log(`ok:   ${relativePath} = ${targetVersion}`);
             }
             continue;
         }
-        lockfile = lockfile.replace(pattern, `$1${pkg.version}$3`);
+        lockfile = lockfile.replace(pattern, `$1${targetVersion}$3`);
         if (log) {
-            console.log(`fix:  ${relativePath}: ${lockVersion} -> ${pkg.version}`);
+            const suffix = targetVersion !== pkg.version ? ` (latest stable tag; package.json has ${pkg.version})` : '';
+            console.log(`fix:  ${relativePath}: ${lockVersion} -> ${targetVersion}${suffix}`);
         }
         updated++;
     }
@@ -61,6 +69,9 @@ export function validateBunLockfileVersions(root) {
     const lockfile = readFileSync(lockfilePath, 'utf8');
     let failures = 0;
     for (const pkg of packages) {
+        const targetVersion = pkg.version.includes('-')
+            ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+            : pkg.version;
         const relativePath = pkg.path.replaceAll('\\', '/');
         const escaped = escapeRegex(relativePath);
         const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -71,8 +82,8 @@ export function validateBunLockfileVersions(root) {
             continue;
         }
         const lockVersion = match[2];
-        if (lockVersion !== pkg.version) {
-            console.error(`${relativePath}: bun.lock workspace version must be ${pkg.version}, got ${lockVersion}`);
+        if (lockVersion !== targetVersion) {
+            console.error(`${relativePath}: bun.lock workspace version must be ${targetVersion}, got ${lockVersion}`);
             failures++;
         }
     }
@@ -81,3 +92,26 @@ export function validateBunLockfileVersions(root) {
     }
     return failures;
 }
+function latestStableTagVersion(root, projectName) {
+    try {
+        const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const prefix = `${projectName}@`;
+        for (const line of output.split('\n')) {
+            const tag = line.trim();
+            if (!tag.startsWith(prefix))
+                continue;
+            const version = tag.slice(prefix.length);
+            if (version && !version.includes('-')) {
+                return version;
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/monorepo/packed-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packed-manifest.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-manifest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAUlC;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,WAAW,EAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,MAAM,EAAE,CAoCV"}
+{"version":3,"file":"packed-manifest.d.ts","sourceRoot":"","sources":["../../src/monorepo/packed-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAUlC;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,WAAW,EAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,MAAM,EAAE,CA8CV"}

package/dist/monorepo/packed-manifest.js

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { $ } from 'bun';
 import { isRecord, recordProperty } from '../lib/json.js';
 import { decode } from '../lib/run.js';
@@ -14,7 +15,9 @@ export async function readPackedPackageJson(root, tarball, packageName) {
     return parsed;
 }
 export function validatePackedWorkspaceDependencies(root, sourcePackage, packedPackage) {
-    const workspaceVersions = new Map(getWorkspacePackages(root).map((pkg) => [pkg.name, pkg.version]));
+    const workspacePackages = getWorkspacePackages(root);
+    const workspaceVersions = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.version]));
+    const projectNameByPackage = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.projectName]));
     const failures = [];
     for (const field of workspaceDependencyFields) {
         const sourceDependencies = recordProperty(sourcePackage.json, field);
@@ -39,8 +42,15 @@ export function validatePackedWorkspaceDependencies(root, sourcePackage, packedP
             if (sourceRange !== 'workspace:*') {
                 failures.push(`${sourcePackage.path}: source ${field}.${name} must use workspace:*`);
             }
-            if (packedRange !== workspaceVersion) {
-                failures.push(`${sourcePackage.path}: packed ${field}.${name} must be ${workspaceVersion}, got ${formatRange(packedRange)}`);
+            // When the workspace dep is at a prerelease version that was never
+            // published, the lockfile sync rewrites it to the latest stable tag
+            // version.  Accept that version as valid.
+            const projectName = projectNameByPackage.get(name);
+            const expectedVersion = workspaceVersion.includes('-') && projectName
+                ? (latestStableTagVersion(root, projectName) ?? workspaceVersion)
+                : workspaceVersion;
+            if (packedRange !== expectedVersion) {
+                failures.push(`${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${formatRange(packedRange)}`);
             }
         }
     }
@@ -49,3 +59,26 @@ export function validatePackedWorkspaceDependencies(root, sourcePackage, packedP
 function formatRange(value) {
     return typeof value === 'string' ? value : '<missing>';
 }
+function latestStableTagVersion(root, projectName) {
+    try {
+        const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const prefix = `${projectName}@`;
+        for (const line of output.split('\n')) {
+            const tag = line.trim();
+            if (!tag.startsWith(prefix))
+                continue;
+            const version = tag.slice(prefix.length);
+            if (version && !version.includes('-')) {
+                return version;
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/monorepo/runtime.d.ts

@@ -1,2 +1,5 @@
 export declare function syncRootRuntimeVersions(root: string): Promise<void>;
+type RuntimeTypesPinMode = 'major' | 'exact';
+export declare function runtimeTypesRangeForPublishedVersions(packageName: string, runtimeVersion: string, pinMode: RuntimeTypesPinMode, versions: readonly string[]): string;
+export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/monorepo/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/monorepo/runtime.ts"],"names":[],"mappings":"AAKA,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BzE"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/monorepo/runtime.ts"],"names":[],"mappings":"AAKA,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCzE;AAED,KAAK,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC;AAgB7C,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAsBR"}

package/dist/monorepo/runtime.js

@@ -21,13 +21,77 @@ export async function syncRootRuntimeVersions(root) {
     changed = setStringProperty(engines, 'node', `>=${nodeMajor}.0.0`) || changed;
     changed = setStringProperty(packageJson, 'packageManager', `bun@${bunVersion}`) || changed;
     const devDependencies = getOrCreateRecord(packageJson, 'devDependencies');
-    changed = setStringProperty(devDependencies, '@types/node', `~${nodeMajor}.0.0`) || changed;
-    changed = setStringProperty(devDependencies, '@types/bun', bunVersion) || changed;
+    changed =
+        setStringProperty(devDependencies, '@types/node', await runtimeTypesRange(root, '@types/node', nodeVersion, 'major')) || changed;
+    changed =
+        setStringProperty(devDependencies, '@types/bun', await runtimeTypesRange(root, '@types/bun', bunVersion, 'exact')) || changed;
     if (changed) {
         writeJsonObject(packageJsonPath, packageJson);
         console.log('updated        package.json runtime versions');
     }
 }
+async function runtimeTypesRange(root, packageName, runtimeVersion, pinMode) {
+    const versionsText = await $ `bun pm view ${packageName} versions --json`.cwd(root).text();
+    const versions = JSON.parse(versionsText);
+    if (!Array.isArray(versions) || !versions.every((version) => typeof version === 'string')) {
+        throw new Error(`Unable to read published ${packageName} versions`);
+    }
+    return runtimeTypesRangeForPublishedVersions(packageName, runtimeVersion, pinMode, versions);
+}
+export function runtimeTypesRangeForPublishedVersions(packageName, runtimeVersion, pinMode, versions) {
+    const parsedRuntimeVersion = parseVersion(runtimeVersion);
+    if (!parsedRuntimeVersion) {
+        throw new Error(`Unable to parse runtime version ${runtimeVersion}`);
+    }
+    if (pinMode === 'major') {
+        const runtimeMajor = parsedRuntimeVersion[0].toString();
+        if (latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor))) {
+            return `~${runtimeMajor}.0.0`;
+        }
+    }
+    else if (versions.includes(runtimeVersion)) {
+        return runtimeVersion;
+    }
+    const latest = latestVersion(versions);
+    if (!latest) {
+        throw new Error(`Unable to find any published ${packageName} versions`);
+    }
+    console.warn(`${packageName} has no published types for runtime ${runtimeVersion}; using ${latest}`);
+    return pinMode === 'major' ? `~${latest}` : latest;
+}
+function latestVersion(versions) {
+    let latest = null;
+    for (const version of versions) {
+        if (!parseVersion(version)) {
+            continue;
+        }
+        if (!latest || compareVersions(version, latest) > 0) {
+            latest = version;
+        }
+    }
+    return latest;
+}
+function compareVersions(left, right) {
+    const leftParts = parseVersion(left);
+    const rightParts = parseVersion(right);
+    if (!leftParts || !rightParts) {
+        return 0;
+    }
+    for (let index = 0; index < leftParts.length; index++) {
+        const diff = leftParts[index] - rightParts[index];
+        if (diff !== 0) {
+            return diff;
+        }
+    }
+    return 0;
+}
+function versionMajor(version) {
+    return parseVersion(version)?.[0].toString() ?? null;
+}
+function parseVersion(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
 function runtimeCommand(root, name) {
     const candidates = [
         join(root, 'tooling', 'direnv', '.devenv', 'profile', 'bin', name),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -45,7 +45,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.2.2-next.0",
+    "@smoothbricks/nx-plugin": "0.2.3",
     "@smoothbricks/validation": "0.1.1",
     "commander": "^14.0.3",
     "publint": "^0.3.18",
@@ -72,7 +72,7 @@
       "test": {
         "executor": "@smoothbricks/nx-plugin:bounded-exec",
         "options": {
-          "command": "bun test",
+          "command": "bun test --timeout=30000",
           "cwd": "{projectRoot}",
           "timeoutMs": 120000,
           "killAfterMs": 1e4

package/src/monorepo/lockfile.ts

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
@@ -25,6 +26,13 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   let lockfile = readFileSync(lockfilePath, 'utf8');
   let updated = 0;
   for (const pkg of packages) {
+    // If the package.json version is a prerelease (e.g. 0.2.2-next.0) it may
+    // never have been published.  Use the latest stable git tag version so
+    // that `bun pm pack` writes an installable dependency range for consumers.
+    const targetVersion = pkg.version.includes('-')
+      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+      : pkg.version;
+
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -36,15 +44,16 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
       continue;
     }
     const lockVersion = match[2];
-    if (lockVersion === pkg.version) {
+    if (lockVersion === targetVersion) {
       if (log) {
-        console.log(`ok:   ${relativePath} = ${pkg.version}`);
+        console.log(`ok:   ${relativePath} = ${targetVersion}`);
       }
       continue;
     }
-    lockfile = lockfile.replace(pattern, `$1${pkg.version}$3`);
+    lockfile = lockfile.replace(pattern, `$1${targetVersion}$3`);
     if (log) {
-      console.log(`fix:  ${relativePath}: ${lockVersion} -> ${pkg.version}`);
+      const suffix = targetVersion !== pkg.version ? ` (latest stable tag; package.json has ${pkg.version})` : '';
+      console.log(`fix:  ${relativePath}: ${lockVersion} -> ${targetVersion}${suffix}`);
     }
     updated++;
   }
@@ -69,6 +78,10 @@ export function validateBunLockfileVersions(root: string): number {
   const lockfile = readFileSync(lockfilePath, 'utf8');
   let failures = 0;
   for (const pkg of packages) {
+    const targetVersion = pkg.version.includes('-')
+      ? (latestStableTagVersion(root, pkg.projectName) ?? pkg.version)
+      : pkg.version;
+
     const relativePath = pkg.path.replaceAll('\\', '/');
     const escaped = escapeRegex(relativePath);
     const pattern = new RegExp(`("${escaped}":\\s*\\{[^}]*"version":\\s*")([^"]+)(")`);
@@ -79,8 +92,8 @@ export function validateBunLockfileVersions(root: string): number {
       continue;
     }
     const lockVersion = match[2];
-    if (lockVersion !== pkg.version) {
-      console.error(`${relativePath}: bun.lock workspace version must be ${pkg.version}, got ${lockVersion}`);
+    if (lockVersion !== targetVersion) {
+      console.error(`${relativePath}: bun.lock workspace version must be ${targetVersion}, got ${lockVersion}`);
       failures++;
     }
   }
@@ -89,3 +102,25 @@ export function validateBunLockfileVersions(root: string): number {
   }
   return failures;
 }
+
+function latestStableTagVersion(root: string, projectName: string): string | null {
+  try {
+    const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const prefix = `${projectName}@`;
+    for (const line of output.split('\n')) {
+      const tag = line.trim();
+      if (!tag.startsWith(prefix)) continue;
+      const version = tag.slice(prefix.length);
+      if (version && !version.includes('-')) {
+        return version;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}

package/src/monorepo/package-policy.test.ts

@@ -5,8 +5,12 @@ import { dirname, join } from 'node:path';
 import {
   BOUNDED_TEST_EXECUTOR,
   BOUNDED_TEST_KILL_AFTER_MS,
+  BOUNDED_TEST_PER_TEST_TIMEOUT_MS,
   BOUNDED_TEST_TIMEOUT_MS,
 } from '@smoothbricks/nx-plugin/bounded-test-policy';
+
+const TIMEOUT_FLAG = `--timeout=${BOUNDED_TEST_PER_TEST_TIMEOUT_MS}`;
+
 import {
   applyFixableMonorepoDefaults,
   applyNxPluginDefaults,
@@ -595,7 +599,7 @@ describe('workspace package script policy', () => {
               test: {
                 executor: BOUNDED_TEST_EXECUTOR,
                 options: {
-                  command: 'bun test',
+                  command: `bun test ${TIMEOUT_FLAG}`,
                   cwd: '{projectRoot}',
                   timeoutMs: BOUNDED_TEST_TIMEOUT_MS,
                   killAfterMs: BOUNDED_TEST_KILL_AFTER_MS,
@@ -825,7 +829,7 @@ describe('workspace package script policy', () => {
           test: {
             executor: BOUNDED_TEST_EXECUTOR,
             options: {
-              command: 'bun test --pass-with-no-tests',
+              command: `bun test ${TIMEOUT_FLAG} --pass-with-no-tests`,
               cwd: '{projectRoot}',
               timeoutMs: BOUNDED_TEST_TIMEOUT_MS,
               killAfterMs: BOUNDED_TEST_KILL_AFTER_MS,
@@ -970,7 +974,7 @@ describe('workspace package script policy', () => {
           test: {
             executor: BOUNDED_TEST_EXECUTOR,
             options: {
-              command: 'bun test --pass-with-no-tests',
+              command: `bun test ${TIMEOUT_FLAG} --pass-with-no-tests`,
               cwd: '{projectRoot}',
               timeoutMs: BOUNDED_TEST_TIMEOUT_MS,
               killAfterMs: BOUNDED_TEST_KILL_AFTER_MS,
@@ -1076,6 +1080,7 @@ function validNxJson(): Record<string, unknown> {
       },
       releaseTag: { pattern: '{projectName}@{version}' },
       changelog: {
+        automaticFromRef: true,
         workspaceChangelog: false,
         projectChangelogs: {
           createRelease: false,

package/src/monorepo/packed-manifest.ts

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import { $ } from 'bun';
 import { isRecord, recordProperty } from '../lib/json.js';
 import { decode } from '../lib/run.js';
@@ -25,7 +26,9 @@ export function validatePackedWorkspaceDependencies(
   sourcePackage: PackageInfo,
   packedPackage: Record<string, unknown>,
 ): string[] {
-  const workspaceVersions = new Map(getWorkspacePackages(root).map((pkg) => [pkg.name, pkg.version]));
+  const workspacePackages = getWorkspacePackages(root);
+  const workspaceVersions = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.version]));
+  const projectNameByPackage = new Map(workspacePackages.map((pkg) => [pkg.name, pkg.projectName]));
   const failures: string[] = [];
   for (const field of workspaceDependencyFields) {
     const sourceDependencies = recordProperty(sourcePackage.json, field);
@@ -52,9 +55,17 @@ export function validatePackedWorkspaceDependencies(
       if (sourceRange !== 'workspace:*') {
         failures.push(`${sourcePackage.path}: source ${field}.${name} must use workspace:*`);
       }
-      if (packedRange !== workspaceVersion) {
+      // When the workspace dep is at a prerelease version that was never
+      // published, the lockfile sync rewrites it to the latest stable tag
+      // version.  Accept that version as valid.
+      const projectName = projectNameByPackage.get(name);
+      const expectedVersion =
+        workspaceVersion.includes('-') && projectName
+          ? (latestStableTagVersion(root, projectName) ?? workspaceVersion)
+          : workspaceVersion;
+      if (packedRange !== expectedVersion) {
         failures.push(
-          `${sourcePackage.path}: packed ${field}.${name} must be ${workspaceVersion}, got ${formatRange(packedRange)}`,
+          `${sourcePackage.path}: packed ${field}.${name} must be ${expectedVersion}, got ${formatRange(packedRange)}`,
         );
       }
     }
@@ -65,3 +76,25 @@ export function validatePackedWorkspaceDependencies(
 function formatRange(value: unknown): string {
   return typeof value === 'string' ? value : '<missing>';
 }
+
+function latestStableTagVersion(root: string, projectName: string): string | null {
+  try {
+    const output = execSync(`git tag --list '${projectName}@*' --sort=-v:refname`, {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const prefix = `${projectName}@`;
+    for (const line of output.split('\n')) {
+      const tag = line.trim();
+      if (!tag.startsWith(prefix)) continue;
+      const version = tag.slice(prefix.length);
+      if (version && !version.includes('-')) {
+        return version;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}

package/src/monorepo/runtime.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from 'bun:test';
+import { runtimeTypesRangeForPublishedVersions } from './runtime.js';
+
+describe('runtimeTypesRangeForPublishedVersions', () => {
+  test('uses the installed Node major when @types/node has published it', () => {
+    expect(
+      runtimeTypesRangeForPublishedVersions('@types/node', '24.12.0', 'major', ['24.0.0', '24.12.4', '25.9.1']),
+    ).toBe('~24.0.0');
+  });
+
+  test('falls back to latest published @types/node when the Node major is unpublished', () => {
+    expect(
+      runtimeTypesRangeForPublishedVersions('@types/node', '26.0.0', 'major', ['24.12.4', '25.9.0', '25.9.1']),
+    ).toBe('~25.9.1');
+  });
+
+  test('uses the installed Bun version when @types/bun has published it', () => {
+    expect(runtimeTypesRangeForPublishedVersions('@types/bun', '1.3.14', 'exact', ['1.3.13', '1.3.14'])).toBe('1.3.14');
+  });
+
+  test('falls back to latest published @types/bun when the Bun version is unpublished', () => {
+    expect(runtimeTypesRangeForPublishedVersions('@types/bun', '1.3.15', 'exact', ['1.3.13', '1.3.14'])).toBe('1.3.14');
+  });
+
+  test('ignores non-stable version strings when choosing the fallback', () => {
+    expect(runtimeTypesRangeForPublishedVersions('@types/node', '26.0.0', 'major', ['25.9.1', '26.0.0-beta.1'])).toBe(
+      '~25.9.1',
+    );
+  });
+});

package/src/monorepo/runtime.ts

@@ -23,8 +23,18 @@ export async function syncRootRuntimeVersions(root: string): Promise<void> {
   changed = setStringProperty(engines, 'node', `>=${nodeMajor}.0.0`) || changed;
   changed = setStringProperty(packageJson, 'packageManager', `bun@${bunVersion}`) || changed;
   const devDependencies = getOrCreateRecord(packageJson, 'devDependencies');
-  changed = setStringProperty(devDependencies, '@types/node', `~${nodeMajor}.0.0`) || changed;
-  changed = setStringProperty(devDependencies, '@types/bun', bunVersion) || changed;
+  changed =
+    setStringProperty(
+      devDependencies,
+      '@types/node',
+      await runtimeTypesRange(root, '@types/node', nodeVersion, 'major'),
+    ) || changed;
+  changed =
+    setStringProperty(
+      devDependencies,
+      '@types/bun',
+      await runtimeTypesRange(root, '@types/bun', bunVersion, 'exact'),
+    ) || changed;
 
   if (changed) {
     writeJsonObject(packageJsonPath, packageJson);
@@ -32,6 +42,88 @@ export async function syncRootRuntimeVersions(root: string): Promise<void> {
   }
 }
 
+type RuntimeTypesPinMode = 'major' | 'exact';
+
+async function runtimeTypesRange(
+  root: string,
+  packageName: string,
+  runtimeVersion: string,
+  pinMode: RuntimeTypesPinMode,
+): Promise<string> {
+  const versionsText = await $`bun pm view ${packageName} versions --json`.cwd(root).text();
+  const versions = JSON.parse(versionsText) as unknown;
+  if (!Array.isArray(versions) || !versions.every((version) => typeof version === 'string')) {
+    throw new Error(`Unable to read published ${packageName} versions`);
+  }
+  return runtimeTypesRangeForPublishedVersions(packageName, runtimeVersion, pinMode, versions);
+}
+
+export function runtimeTypesRangeForPublishedVersions(
+  packageName: string,
+  runtimeVersion: string,
+  pinMode: RuntimeTypesPinMode,
+  versions: readonly string[],
+): string {
+  const parsedRuntimeVersion = parseVersion(runtimeVersion);
+  if (!parsedRuntimeVersion) {
+    throw new Error(`Unable to parse runtime version ${runtimeVersion}`);
+  }
+
+  if (pinMode === 'major') {
+    const runtimeMajor = parsedRuntimeVersion[0].toString();
+    if (latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor))) {
+      return `~${runtimeMajor}.0.0`;
+    }
+  } else if (versions.includes(runtimeVersion)) {
+    return runtimeVersion;
+  }
+
+  const latest = latestVersion(versions);
+  if (!latest) {
+    throw new Error(`Unable to find any published ${packageName} versions`);
+  }
+
+  console.warn(`${packageName} has no published types for runtime ${runtimeVersion}; using ${latest}`);
+  return pinMode === 'major' ? `~${latest}` : latest;
+}
+
+function latestVersion(versions: readonly string[]): string | null {
+  let latest: string | null = null;
+  for (const version of versions) {
+    if (!parseVersion(version)) {
+      continue;
+    }
+    if (!latest || compareVersions(version, latest) > 0) {
+      latest = version;
+    }
+  }
+  return latest;
+}
+
+function compareVersions(left: string, right: string): number {
+  const leftParts = parseVersion(left);
+  const rightParts = parseVersion(right);
+  if (!leftParts || !rightParts) {
+    return 0;
+  }
+  for (let index = 0; index < leftParts.length; index++) {
+    const diff = leftParts[index] - rightParts[index];
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+  return 0;
+}
+
+function versionMajor(version: string): string | null {
+  return parseVersion(version)?.[0].toString() ?? null;
+}
+
+function parseVersion(version: string): [number, number, number] | null {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+
 function runtimeCommand(root: string, name: 'bun' | 'node'): string {
   const candidates = [
     join(root, 'tooling', 'direnv', '.devenv', 'profile', 'bin', name),

package/src/release/__tests__/fixture-repo.test.ts

@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'bun:test';
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { $ } from 'bun';
 import { collectOwnedReleaseTagRecords, pendingReleaseTargets, type ReleasePackageInfo, releaseTag } from '../core.js';
 import { completeReleaseAtHead, type ReleaseRepairShell, repairPendingTargets } from '../orchestration.js';
 import {
@@ -9,7 +8,9 @@ import {
   gitIsAncestor,
   gitOutput,
   gitReleaseTagsByCreatorDate,
+  gitSucceeds,
   packageVersionAtRef,
+  runFixtureNx,
   tag,
   withFixtureRepo,
   writeBuildablePackage,
@@ -78,7 +79,7 @@ describe('release planning with fixture git repositories', () => {
       await git(root, ['init', '--bare', 'remote.git']);
       await git(root, ['remote', 'add', 'origin', join(root, 'remote.git')]);
       await git(root, ['push', 'origin', 'main', '--tags']);
-      await $`git clone --branch main ${join(root, 'remote.git')} checkout`.cwd(root).quiet();
+      await git(root, ['clone', '--branch', 'main', join(root, 'remote.git'), 'checkout']);
       const checkout = join(root, 'checkout');
       await git(checkout, ['fetch', '--tags', 'origin', 'main']);
       const head = await gitOutput(checkout, ['rev-parse', 'HEAD']);
@@ -105,7 +106,7 @@ describe('release planning with fixture git repositories', () => {
       await writeBuildablePackage(root, '@scope/a', 'packages/a');
       await writeBuildablePackage(root, '@scope/b', 'packages/b');
 
-      await $`nx run-many -t build --projects=${'a,b'}`.cwd(root).quiet();
+      await runFixtureNx(root, ['run-many', '-t', 'build', '--projects=a,b']);
 
       await expect(readFile(join(root, 'packages/a/dist/index.js'), 'utf8')).resolves.toBe('{}\n');
       await expect(readFile(join(root, 'packages/b/dist/index.js'), 'utf8')).resolves.toBe('{}\n');
@@ -143,7 +144,7 @@ describe('release planning with fixture git repositories', () => {
       await git(author, ['init', '--bare', 'remote.git']);
       await git(author, ['remote', 'add', 'origin', join(author, 'remote.git')]);
       await git(author, ['push', 'origin', 'main', '--tags']);
-      await $`git clone --branch main ${join(author, 'remote.git')} runner`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'runner']);
       const runner = join(author, 'runner');
       await git(runner, ['config', 'user.name', 'Test User']);
       await git(runner, ['config', 'user.email', 'test@example.com']);
@@ -197,7 +198,7 @@ describe('release planning with fixture git repositories', () => {
       await git(author, ['init', '--bare', 'remote.git']);
       await git(author, ['remote', 'add', 'origin', join(author, 'remote.git')]);
       await git(author, ['push', 'origin', 'main']);
-      await $`git clone --branch main ${join(author, 'remote.git')} runner`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'runner']);
       const runner = join(author, 'runner');
       await git(runner, ['config', 'user.name', 'Test User']);
       await git(runner, ['config', 'user.email', 'test@example.com']);
@@ -213,7 +214,7 @@ describe('release planning with fixture git repositories', () => {
 
       expect(summary.pushed).toBe(true);
       expect(shell.pushes).toEqual([['pushed@1.0.0']]);
-      await $`git clone --branch main ${join(author, 'remote.git')} auditor`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'auditor']);
       const auditor = join(author, 'auditor');
       await git(auditor, ['fetch', '--tags', 'origin', 'main']);
       await expect(gitOutput(auditor, ['rev-parse', 'refs/tags/pushed@1.0.0^{}'])).resolves.toBe(
@@ -237,7 +238,7 @@ describe('release planning with fixture git repositories', () => {
       await git(author, ['init', '--bare', 'remote.git']);
       await git(author, ['remote', 'add', 'origin', join(author, 'remote.git')]);
       await git(author, ['push', 'origin', 'main', '--tags']);
-      await $`git clone --branch main ${join(author, 'remote.git')} runner`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'runner']);
       const runner = join(author, 'runner');
       await git(runner, ['config', 'user.name', 'Test User']);
       await git(runner, ['config', 'user.email', 'test@example.com']);
@@ -323,7 +324,12 @@ class LocalGitRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
 
   async buildReleaseCandidate(packages: ReleasePackageInfo[]): Promise<void> {
     this.builds.push(packages.map((pkg) => pkg.name));
-    await $`nx run-many -t build --projects=${packages.map((pkg) => pkg.projectName).join(',')}`.cwd(this.root).quiet();
+    await runFixtureNx(this.root, [
+      'run-many',
+      '-t',
+      'build',
+      `--projects=${packages.map((pkg) => pkg.projectName).join(',')}`,
+    ]);
   }
 
   async publishPackage(pkg: ReleasePackageInfo, distTag: string, dryRun: boolean): Promise<void> {
@@ -357,8 +363,3 @@ class LocalGitRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
     await git(this.root, ['tag', '-a', tagName, '-m', tagName, 'HEAD']);
   }
 }
-
-async function gitSucceeds(root: string, args: string[]): Promise<boolean> {
-  const result = await $`git ${args}`.cwd(root).quiet().nothrow();
-  return result.exitCode === 0;
-}

package/src/release/__tests__/helpers/fixture-repo.ts

@@ -4,6 +4,8 @@ import { join } from 'node:path';
 import { $ } from 'bun';
 import type { GitReleaseTagInfo } from '../../core.js';
 
+const GIT_TIMEOUT_MS = 10_000;
+
 export async function withFixtureRepo(fn: (root: string) => Promise<void>): Promise<void> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-release-test-'));
   try {
@@ -63,26 +65,98 @@ export async function writeBuildablePackage(
 }
 
 export async function git(root: string, args: string[], env?: Record<string, string>): Promise<void> {
-  await $`git ${args}`
-    .cwd(root)
-    .env(env ?? {})
-    .quiet();
+  const result = await gitResult(root, args, env);
+  if (result.exitCode !== 0) {
+    throw new Error(gitErrorMessage(root, args, result));
+  }
 }
 
 export async function gitOutput(root: string, args: string[]): Promise<string> {
-  const result = await $`git ${args}`.cwd(root).quiet();
+  const result = await gitResult(root, args);
+  if (result.exitCode !== 0) {
+    throw new Error(gitErrorMessage(root, args, result));
+  }
   return new TextDecoder().decode(result.stdout).trim();
 }
 
+export async function gitSucceeds(root: string, args: string[]): Promise<boolean> {
+  return (await gitResult(root, args)).exitCode === 0;
+}
+
+async function gitResult(root: string, args: string[], env?: Record<string, string>): Promise<GitResult> {
+  const proc = Bun.spawn(['git', ...args], {
+    cwd: root,
+    env: { ...process.env, ...env },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    proc.kill();
+  }, GIT_TIMEOUT_MS);
+  try {
+    const [exitCode, stdout, stderr] = await Promise.all([
+      proc.exited,
+      streamBytes(proc.stdout),
+      streamBytes(proc.stderr),
+    ]);
+    return { exitCode, stdout, stderr, timedOut };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function streamBytes(stream: ReadableStream<Uint8Array>): Promise<Uint8Array> {
+  return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+
+export async function runFixtureNx(root: string, args: string[]): Promise<void> {
+  await $`nx ${args}`
+    .cwd(root)
+    .env({ ...definedProcessEnv(), NX_DAEMON: 'false' })
+    .quiet();
+}
+
+function definedProcessEnv(): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== undefined) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+
+interface GitResult {
+  exitCode: number;
+  stdout: Uint8Array;
+  stderr: Uint8Array;
+  timedOut: boolean;
+}
+
+function gitErrorMessage(root: string, args: string[], result: GitResult): string {
+  const stderr = new TextDecoder().decode(result.stderr).trim();
+  const timeoutText = result.timedOut
+    ? ` timed out after ${GIT_TIMEOUT_MS}ms`
+    : ` failed with exit code ${result.exitCode}`;
+  return [`git ${args.join(' ')}${timeoutText}`, `cwd: ${root}`, stderr].filter(Boolean).join('\n');
+}
+
 export async function tag(root: string, tagName: string, date: string): Promise<void> {
   await git(root, ['tag', '-a', tagName, '-m', tagName], { GIT_COMMITTER_DATE: date });
 }
 
 export async function gitReleaseTagsByCreatorDate(root: string): Promise<GitReleaseTagInfo[]> {
-  const result =
-    await $`git for-each-ref --sort=-creatordate --format=${'%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)'} refs/tags`
-      .cwd(root)
-      .quiet();
+  const result = await gitResult(root, [
+    'for-each-ref',
+    '--sort=-creatordate',
+    '--format=%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)',
+    'refs/tags',
+  ]);
+  if (result.exitCode !== 0) {
+    throw new Error(gitErrorMessage(root, ['for-each-ref', 'refs/tags'], result));
+  }
   return new TextDecoder()
     .decode(result.stdout)
     .split('\n')
@@ -100,12 +174,11 @@ export async function gitReleaseTagsByCreatorDate(root: string): Promise<GitRele
 }
 
 export async function gitIsAncestor(root: string, ancestor: string, descendant: string): Promise<boolean> {
-  const result = await $`git merge-base --is-ancestor ${ancestor} ${descendant}`.cwd(root).quiet().nothrow();
-  return result.exitCode === 0;
+  return gitSucceeds(root, ['merge-base', '--is-ancestor', ancestor, descendant]);
 }
 
 export async function packageVersionAtRef(root: string, packagePath: string, ref: string): Promise<string | null> {
-  const result = await $`git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
+  const result = await gitResult(root, ['show', `${ref}:${packagePath}/package.json`]);
   if (result.exitCode !== 0) {
     return null;
   }