@varlock/bumpy 0.0.1 → 0.0.2

package/dist/{publish-DZ3m7qkX.mjs → publish-D_7RqEYL.mjs}

@@ -1,16 +1,27 @@
-import { n as log, t as colorize } from "./logger-ZqggsyGZ.mjs";
-import { a as loadConfig } from "./config-CJ2orhTL.mjs";
-import { n as discoverWorkspace, r as detectWorkspaces } from "./workspace-mVjawG8g.mjs";
-import { t as DependencyGraph } from "./dep-graph-DiLeAhl9.mjs";
-import { i as tryRun, n as runAsync } from "./shell-DPlltpzb.mjs";
-import { n as hasUncommittedChanges, r as pushWithTags, t as publishPackages } from "./publish-pipeline-1M5GmbdP.mjs";
+import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
+import { a as loadConfig } from "./config-BkwIEaQg.mjs";
+import { n as detectWorkspaces } from "./package-manager-DcI5TdDE.mjs";
+import { n as discoverWorkspace } from "./workspace-CxEKakDm.mjs";
+import { t as DependencyGraph } from "./dep-graph-E-9-eQ2J.mjs";
+import { n as runArgsAsync, o as tryRunArgs } from "./shell-Dj7JRD_q.mjs";
+import { a as pushWithTags, i as listTags, r as hasUncommittedChanges } from "./git-CGHVXXKw.mjs";
+import { t as publishPackages } from "./publish-pipeline-ChnqW8nR.mjs";
 //#region src/core/github-release.ts
+/** Get the current HEAD commit SHA */
+function getHeadSha(rootDir) {
+	return tryRunArgs([
+		"git",
+		"rev-parse",
+		"HEAD"
+	], { cwd: rootDir });
+}
 /** Create individual GitHub releases for each published package */
 async function createIndividualReleases(releases, changesets, rootDir, opts = {}) {
 	if (!isGhAvailable()) {
 		log.dim("  gh CLI not found — skipping GitHub releases");
 		return;
 	}
+	const headSha = getHeadSha(rootDir);
 	for (const release of releases) {
 		const tag = `${release.name}@${release.newVersion}`;
 		const body = buildReleaseBody(release, changesets);
@@ -20,7 +31,18 @@ async function createIndividualReleases(releases, changesets, rootDir, opts = {}
 			continue;
 		}
 		try {
-			await runAsync(`gh release create "${tag}" --title "${escapeShell(title)}" --notes "${escapeShell(body)}"`, { cwd: rootDir });
+			const args = [
+				"gh",
+				"release",
+				"create",
+				tag,
+				"--title",
+				title,
+				"--notes",
+				body
+			];
+			if (headSha) args.push("--target", headSha);
+			await runArgsAsync(args, { cwd: rootDir });
 			log.dim(`  Created GitHub release: ${title}`);
 		} catch (err) {
 			log.warn(`  Failed to create GitHub release for ${tag}: ${err instanceof Error ? err.message : err}`);
@@ -35,8 +57,7 @@ async function createAggregateRelease(releases, changesets, rootDir, opts = {})
 	}
 	if (releases.length === 0) return;
 	const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-	const title = (opts.title || "Release {{date}}").replace("{{date}}", date);
-	const tag = `release-${date}`;
+	const { tag, title } = resolveAggregateTagAndTitle(date, listTags(`release-${date}*`, { cwd: rootDir }), opts.title);
 	const body = buildAggregateBody(releases, changesets);
 	if (opts.dryRun) {
 		log.dim(`  Would create aggregate GitHub release: ${title}`);
@@ -44,8 +65,24 @@ async function createAggregateRelease(releases, changesets, rootDir, opts = {})
 		return;
 	}
 	try {
-		tryRun(`git tag "${tag}"`, { cwd: rootDir });
-		await runAsync(`gh release create "${tag}" --title "${escapeShell(title)}" --notes "${escapeShell(body)}"`, { cwd: rootDir });
+		tryRunArgs([
+			"git",
+			"tag",
+			tag
+		], { cwd: rootDir });
+		const headSha = getHeadSha(rootDir);
+		const args = [
+			"gh",
+			"release",
+			"create",
+			tag,
+			"--title",
+			title,
+			"--notes",
+			body
+		];
+		if (headSha) args.push("--target", headSha);
+		await runArgsAsync(args, { cwd: rootDir });
 		log.success(`Created aggregate GitHub release: ${title}`);
 	} catch (err) {
 		log.warn(`Failed to create aggregate GitHub release: ${err instanceof Error ? err.message : err}`);
@@ -82,11 +119,17 @@ function buildAggregateBody(releases, changesets) {
 	}
 	return lines.join("\n").trim() || "No changelog entries.";
 }
-function isGhAvailable() {
-	return tryRun("gh --version") !== null;
+/** Compute the aggregate release tag and title, appending -n suffix if a tag for the same date already exists */
+function resolveAggregateTagAndTitle(date, existingTags, titleTemplate) {
+	const baseTag = `release-${date}`;
+	const suffix = existingTags.length === 0 ? "" : `-${existingTags.length + 1}`;
+	return {
+		tag: `${baseTag}${suffix}`,
+		title: (titleTemplate || "Release {{date}}").replace("{{date}}", `${date}${suffix}`)
+	};
 }
-function escapeShell(str) {
-	return str.replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+function isGhAvailable() {
+	return tryRunArgs(["gh", "--version"]) !== null;
 }
 //#endregion
 //#region src/commands/publish.ts
@@ -105,7 +148,7 @@ async function publishCommand(rootDir, opts) {
 	}
 	let toPublish = await findUnpublishedPackages(packages, config);
 	if (opts.filter) {
-		const { matchGlob } = await import("./config-CJ2orhTL.mjs").then((n) => n.t);
+		const { matchGlob } = await import("./config-BkwIEaQg.mjs").then((n) => n.t);
 		const patterns = opts.filter.split(",").map((p) => p.trim());
 		toPublish = toPublish.filter((r) => patterns.some((p) => matchGlob(r.name, p)));
 	}
@@ -176,8 +219,7 @@ async function findUnpublishedPackages(packages, _config) {
 	return unpublished;
 }
 async function checkIfPublished(name, version, pkgConfig) {
-	const { runAsync } = await import("./shell-DPlltpzb.mjs").then((n) => n.r);
-	const { tryRun } = await import("./shell-DPlltpzb.mjs").then((n) => n.r);
+	const { runAsync, runArgsAsync, tryRunArgs } = await import("./shell-Dj7JRD_q.mjs").then((n) => n.i);
 	if (pkgConfig?.checkPublished) try {
 		return (await runAsync(pkgConfig.checkPublished)).trim() === version;
 	} catch {
@@ -185,10 +227,22 @@ async function checkIfPublished(name, version, pkgConfig) {
 	}
 	if (pkgConfig?.skipNpmPublish || pkgConfig?.publishCommand) {
 		const tag = `${name}@${version}`;
-		return tryRun(`git tag -l "${tag}"`) === tag;
+		return tryRunArgs([
+			"git",
+			"tag",
+			"-l",
+			tag
+		]) === tag;
 	}
 	try {
-		return await runAsync(`npm info "${name}@${version}" version ${pkgConfig?.registry ? `--registry ${pkgConfig.registry}` : ""}`.trim()) === version;
+		const args = [
+			"npm",
+			"info",
+			`${name}@${version}`,
+			"version"
+		];
+		if (pkgConfig?.registry) args.push("--registry", pkgConfig.registry);
+		return await runArgsAsync(args) === version;
 	} catch {
 		return false;
 	}

package/dist/{publish-pipeline-1M5GmbdP.mjs → publish-pipeline-ChnqW8nR.mjs}

@@ -1,30 +1,12 @@
-import { n as log, t as colorize } from "./logger-ZqggsyGZ.mjs";
-import { a as readJson, c as writeJson } from "./fs-DbNNEyzq.mjs";
-import { i as resolveCatalogDep } from "./workspace-mVjawG8g.mjs";
-import { r as stripProtocol } from "./semver-DWO6NFKN.mjs";
-import { i as tryRun, n as runAsync, t as run } from "./shell-DPlltpzb.mjs";
+import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
+import { a as readJson, c as writeJson } from "./fs-0AtnPUUe.mjs";
+import { r as resolveCatalogDep } from "./package-manager-DcI5TdDE.mjs";
+import { a as sq, n as runArgsAsync, o as tryRunArgs, r as runAsync } from "./shell-Dj7JRD_q.mjs";
+import { r as stripProtocol } from "./semver-BTzYh8vc.mjs";
+import { o as tagExists, t as createTag } from "./git-CGHVXXKw.mjs";
 import { resolve } from "node:path";
 import { unlink } from "node:fs/promises";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-//#region src/core/git.ts
-/** Create a git tag */
-function createTag(tag, opts) {
-	run(`git tag ${tag}`, opts);
-}
-/** Push commits and tags to remote */
-function pushWithTags(opts) {
-	run("git push --follow-tags", opts);
-}
-/** Check if there are uncommitted changes */
-function hasUncommittedChanges(opts) {
-	const result = tryRun("git status --porcelain", opts);
-	return result !== null && result.length > 0;
-}
-/** Check if a tag already exists */
-function tagExists(tag, opts) {
-	return tryRun(`git tag -l "${tag}"`, opts) === tag;
-}
-//#endregion
 //#region src/core/publish-pipeline.ts
 /**
 * Detect which CI OIDC provider is available for npm trusted publishing.
@@ -42,7 +24,7 @@ function detectOidcProvider() {
 	return null;
 }
 const OIDC_NPM_UPGRADE_HINTS = {
-	"github-actions": "Add `actions/setup-node@v4` with `node-version: lts/*` to your workflow",
+	"github-actions": "Add `actions/setup-node@v6` with `node-version: lts/*` to your workflow",
 	gitlab: "Use a Node.js image with npm >= 11.5.1 or run `npm install -g npm@latest`",
 	circleci: "Use a Node.js image with npm >= 11.5.1 or run `sudo npm install -g npm@latest`"
 };
@@ -67,7 +49,7 @@ function setupNpmAuth(rootDir, publishManager) {
 	}
 	const oidcProvider = detectOidcProvider();
 	if (oidcProvider) {
-		const npmVersion = tryRun("npm --version");
+		const npmVersion = tryRunArgs(["npm", "--version"]);
 		if (npmVersion) {
 			const [major, minor, patch] = npmVersion.split(".").map(Number);
 			if (!(major > 11 || major === 11 && (minor > 5 || minor === 5 && patch >= 1))) {
@@ -135,7 +117,7 @@ async function publishPackages(releasePlan, packages, depGraph, config, rootDir,
 			if (pkgConfig.publishCommand) {
 				const commands = Array.isArray(pkgConfig.publishCommand) ? pkgConfig.publishCommand : [pkgConfig.publishCommand];
 				for (const cmd of commands) {
-					const expanded = cmd.replace(/\{\{version\}\}/g, release.newVersion).replace(/\{\{name\}\}/g, release.name);
+					const expanded = cmd.replace(/\{\{version\}\}/g, sq(release.newVersion)).replace(/\{\{name\}\}/g, sq(release.name));
 					log.dim(`  Running: ${expanded}`);
 					if (!opts.dryRun) await runAsync(expanded, { cwd: pkg.dir });
 				}
@@ -171,18 +153,18 @@ async function publishPackages(releasePlan, packages, depGraph, config, rootDir,
 * then publish the tarball with npm (which supports OIDC/provenance).
 */
 async function packThenPublish(pkg, pkgConfig, config, packManager, opts) {
-	const packCmd = getPackCommand(packManager);
-	log.dim(`  Packing with: ${packCmd}`);
+	const packArgs = getPackArgs(packManager);
+	log.dim(`  Packing with: ${packArgs.join(" ")}`);
 	if (opts.dryRun) {
-		const publishCmd = buildPublishCommand(pkg, pkgConfig, config, opts, "<tarball>");
-		log.dim(`  Would publish with: ${publishCmd}`);
+		const publishArgs = buildPublishArgs(pkg, pkgConfig, config, opts, "<tarball>");
+		log.dim(`  Would publish with: ${publishArgs.join(" ")}`);
 		return;
 	}
-	const tarball = parseTarballPath(await runAsync(packCmd, { cwd: pkg.dir }), pkg.dir);
+	const tarball = parseTarballPath(await runArgsAsync(packArgs, { cwd: pkg.dir }), pkg.dir);
 	try {
-		const publishCmd = buildPublishCommand(pkg, pkgConfig, config, opts, tarball);
-		log.dim(`  Publishing: ${publishCmd}`);
-		await runAsync(publishCmd, { cwd: pkg.dir });
+		const publishArgs = buildPublishArgs(pkg, pkgConfig, config, opts, tarball);
+		log.dim(`  Publishing: ${publishArgs.join(" ")}`);
+		await runArgsAsync(publishArgs, { cwd: pkg.dir });
 	} finally {
 		try {
 			await unlink(tarball);
@@ -191,30 +173,34 @@ async function packThenPublish(pkg, pkgConfig, config, packManager, opts) {
 }
 /** Publish directly from the package directory (no tarball) */
 async function npmPublishDirect(pkg, pkgConfig, config, opts) {
-	const cmd = buildPublishCommand(pkg, pkgConfig, config, opts);
-	log.dim(`  Running: ${cmd}`);
-	if (!opts.dryRun) await runAsync(cmd, { cwd: pkg.dir });
+	const args = buildPublishArgs(pkg, pkgConfig, config, opts);
+	log.dim(`  Running: ${args.join(" ")}`);
+	if (!opts.dryRun) await runArgsAsync(args, { cwd: pkg.dir });
 }
-function getPackCommand(pm) {
+function getPackArgs(pm) {
 	switch (pm) {
-		case "pnpm": return "pnpm pack";
-		case "bun": return "bun pm pack";
-		case "yarn": return "yarn pack";
-		default: return "npm pack";
+		case "pnpm": return ["pnpm", "pack"];
+		case "bun": return [
+			"bun",
+			"pm",
+			"pack"
+		];
+		case "yarn": return ["yarn", "pack"];
+		default: return ["npm", "pack"];
 	}
 }
-function buildPublishCommand(pkg, pkgConfig, config, opts, tarball) {
+function buildPublishArgs(pkg, pkgConfig, config, opts, tarball) {
 	const publishManager = config.publish.publishManager;
-	const parts = [];
-	if (publishManager === "yarn") parts.push("yarn npm publish");
-	else parts.push(`${publishManager} publish`);
-	if (tarball) parts.push(tarball);
+	const args = [];
+	if (publishManager === "yarn") args.push("yarn", "npm", "publish");
+	else args.push(publishManager, "publish");
+	if (tarball) args.push(tarball);
 	const access = pkgConfig?.access || config.access;
-	parts.push(`--access ${access}`);
-	if (pkgConfig?.registry) parts.push(`--registry ${pkgConfig.registry}`);
-	if (opts.tag) parts.push(`--tag ${opts.tag}`);
-	if (config.publish.publishArgs.length > 0) parts.push(...config.publish.publishArgs);
-	return parts.join(" ");
+	args.push("--access", access);
+	if (pkgConfig?.registry) args.push("--registry", pkgConfig.registry);
+	if (opts.tag) args.push("--tag", opts.tag);
+	if (config.publish.publishArgs.length > 0) args.push(...config.publish.publishArgs);
+	return args;
 }
 /**
 * Parse the tarball path from pack command output.
@@ -288,4 +274,4 @@ async function resolveProtocolsInPlace(pkg, packages, releasePlan, catalogs) {
 	if (modified) await writeJson(pkgJsonPath, pkgJson);
 }
 //#endregion
-export { hasUncommittedChanges as n, pushWithTags as r, publishPackages as t };
+export { publishPackages as t };

package/dist/{release-plan-CFnutSHD.mjs → release-plan-BEzwApuK.mjs}

@@ -1,5 +1,5 @@
-import { g as parseIsolatedBump, h as maxBump, l as DEFAULT_BUMP_RULES, m as hasCascade, p as bumpLevel, s as matchGlob } from "./config-CJ2orhTL.mjs";
-import { n as satisfies, r as stripProtocol, t as bumpVersion } from "./semver-DWO6NFKN.mjs";
+import { g as parseIsolatedBump, h as maxBump, l as DEFAULT_BUMP_RULES, m as hasCascade, p as bumpLevel, s as matchGlob } from "./config-BkwIEaQg.mjs";
+import { n as satisfies, r as stripProtocol, t as bumpVersion } from "./semver-BTzYh8vc.mjs";
 //#region src/core/release-plan.ts
 /**
 * Build a release plan from pending changesets, the dependency graph, and config.

package/dist/{semver-DWO6NFKN.mjs → semver-BTzYh8vc.mjs}

@@ -1,4 +1,4 @@
-import { a as __toESM, r as __commonJSMin } from "./logger-ZqggsyGZ.mjs";
+import { i as __commonJSMin, o as __toESM } from "./logger-C2dEe5Su.mjs";
 //#region ../../node_modules/.bun/semver@7.7.4/node_modules/semver/internal/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const SEMVER_SPEC_VERSION = "2.0.0";

package/dist/shell-Dj7JRD_q.mjs

@@ -0,0 +1,92 @@
+import { a as __exportAll } from "./logger-C2dEe5Su.mjs";
+import { exec, execFile, execFileSync } from "node:child_process";
+//#region src/utils/shell.ts
+var shell_exports = /* @__PURE__ */ __exportAll({
+	runArgs: () => runArgs,
+	runArgsAsync: () => runArgsAsync,
+	runAsync: () => runAsync,
+	sq: () => sq,
+	tryRunArgs: () => tryRunArgs
+});
+/**
+* Escape a value for safe interpolation inside a single-quoted shell string.
+* Works by ending the current single-quote, inserting an escaped single-quote,
+* and re-opening the single-quote: "it's" → 'it'\''s'
+*/
+function sq(value) {
+	return "'" + value.replace(/'/g, "'\\''") + "'";
+}
+function checkIntercept(args, opts) {
+	return null;
+}
+function runAsync(cmd, opts) {
+	const result = checkIntercept(cmd.split(/\s+/), opts);
+	if (result?.intercepted) {
+		if ("error" in result) return Promise.reject(new Error(result.error));
+		return Promise.resolve(result.result);
+	}
+	return new Promise((resolve, reject) => {
+		const child = exec(cmd, {
+			cwd: opts?.cwd,
+			encoding: "utf-8"
+		}, (err, stdout, stderr) => {
+			if (err) reject(/* @__PURE__ */ new Error(`Command failed: ${cmd}\n${stderr}`));
+			else resolve(stdout.trim());
+		});
+		if (opts?.input) {
+			child.stdin?.write(opts.input);
+			child.stdin?.end();
+		}
+	});
+}
+/** Run a command with an argument array — bypasses the shell entirely */
+function runArgs(args, opts) {
+	const result = checkIntercept(args, opts);
+	if (result?.intercepted) {
+		if ("error" in result) throw new Error(result.error);
+		return result.result;
+	}
+	const [cmd, ...rest] = args;
+	return execFileSync(cmd, rest, {
+		cwd: opts?.cwd,
+		input: opts?.input,
+		encoding: "utf-8",
+		stdio: [
+			opts?.input ? "pipe" : "pipe",
+			"pipe",
+			"pipe"
+		]
+	}).trim();
+}
+/** Async version of runArgs */
+function runArgsAsync(args, opts) {
+	const result = checkIntercept(args, opts);
+	if (result?.intercepted) {
+		if ("error" in result) return Promise.reject(new Error(result.error));
+		return Promise.resolve(result.result);
+	}
+	const [cmd, ...rest] = args;
+	return new Promise((resolve, reject) => {
+		const child = execFile(cmd, rest, {
+			cwd: opts?.cwd,
+			encoding: "utf-8"
+		}, (err, stdout, stderr) => {
+			if (err) reject(/* @__PURE__ */ new Error(`Command failed: ${args.join(" ")}\n${stderr}`));
+			else resolve(stdout.trim());
+		});
+		if (opts?.input) {
+			child.stdin?.write(opts.input);
+			child.stdin?.end();
+		}
+	});
+}
+/** tryRun equivalent for argument arrays */
+function tryRunArgs(args, opts) {
+	try {
+		return runArgs(args, opts);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { sq as a, shell_exports as i, runArgsAsync as n, tryRunArgs as o, runAsync as r, runArgs as t };

package/dist/{status-DRpq_Mha.mjs → status--Q8yAxQ4.mjs}

@@ -1,9 +1,9 @@
-import { n as log, t as colorize } from "./logger-ZqggsyGZ.mjs";
-import { a as loadConfig } from "./config-CJ2orhTL.mjs";
-import { t as discoverPackages } from "./workspace-mVjawG8g.mjs";
-import { t as DependencyGraph } from "./dep-graph-DiLeAhl9.mjs";
-import { r as readChangesets } from "./changeset-ClCYsChu.mjs";
-import { t as assembleReleasePlan } from "./release-plan-CFnutSHD.mjs";
+import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
+import { a as loadConfig } from "./config-BkwIEaQg.mjs";
+import { t as discoverPackages } from "./workspace-CxEKakDm.mjs";
+import { t as DependencyGraph } from "./dep-graph-E-9-eQ2J.mjs";
+import { r as readChangesets } from "./changeset-UCZdSRDv.mjs";
+import { t as assembleReleasePlan } from "./release-plan-BEzwApuK.mjs";
 //#region src/commands/status.ts
 async function statusCommand(rootDir, opts) {
 	const config = await loadConfig(rootDir);
@@ -26,7 +26,7 @@ async function statusCommand(rootDir, opts) {
 		releases = releases.filter((r) => types.includes(r.type));
 	}
 	if (opts.filter) {
-		const { matchGlob } = await import("./config-CJ2orhTL.mjs").then((n) => n.t);
+		const { matchGlob } = await import("./config-BkwIEaQg.mjs").then((n) => n.t);
 		const patterns = opts.filter.split(",").map((p) => p.trim());
 		releases = releases.filter((r) => patterns.some((p) => matchGlob(r.name, p)));
 	}

package/dist/{version-CJwf8XIA.mjs → version-cAUkfYPx.mjs}

@@ -1,11 +1,12 @@
-import { n as log, t as colorize } from "./logger-ZqggsyGZ.mjs";
-import { a as loadConfig } from "./config-CJ2orhTL.mjs";
-import { r as detectWorkspaces, t as discoverPackages } from "./workspace-mVjawG8g.mjs";
-import { t as DependencyGraph } from "./dep-graph-DiLeAhl9.mjs";
-import { r as readChangesets } from "./changeset-ClCYsChu.mjs";
-import { t as assembleReleasePlan } from "./release-plan-CFnutSHD.mjs";
-import { t as applyReleasePlan } from "./apply-release-plan-DtU3rVyL.mjs";
-import { i as tryRun, t as run } from "./shell-DPlltpzb.mjs";
+import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
+import { a as loadConfig } from "./config-BkwIEaQg.mjs";
+import { n as detectWorkspaces } from "./package-manager-DcI5TdDE.mjs";
+import { t as discoverPackages } from "./workspace-CxEKakDm.mjs";
+import { t as DependencyGraph } from "./dep-graph-E-9-eQ2J.mjs";
+import { o as tryRunArgs, t as runArgs } from "./shell-Dj7JRD_q.mjs";
+import { r as readChangesets } from "./changeset-UCZdSRDv.mjs";
+import { t as assembleReleasePlan } from "./release-plan-BEzwApuK.mjs";
+import { t as applyReleasePlan } from "./apply-release-plan-D6TSrcwX.mjs";
 //#region src/commands/version.ts
 async function versionCommand(rootDir) {
 	const config = await loadConfig(rootDir);
@@ -31,11 +32,26 @@ async function versionCommand(rootDir) {
 	log.dim(`  Deleted ${changesets.length} changeset file(s)`);
 	await updateLockfile(rootDir);
 	if (config.commit) try {
-		run("git add -A .bumpy/", { cwd: rootDir });
+		runArgs([
+			"git",
+			"add",
+			"-A",
+			".bumpy/"
+		], { cwd: rootDir });
 		for (const r of plan.releases) {
 			const pkg = packages.get(r.name);
-			run(`git add "${pkg.relativeDir}/package.json"`, { cwd: rootDir });
-			run(`git add "${pkg.relativeDir}/CHANGELOG.md"`, { cwd: rootDir });
+			runArgs([
+				"git",
+				"add",
+				"--",
+				`${pkg.relativeDir}/package.json`
+			], { cwd: rootDir });
+			runArgs([
+				"git",
+				"add",
+				"--",
+				`${pkg.relativeDir}/CHANGELOG.md`
+			], { cwd: rootDir });
 		}
 		for (const lockfile of [
 			"bun.lock",
@@ -43,8 +59,18 @@ async function versionCommand(rootDir) {
 			"pnpm-lock.yaml",
 			"yarn.lock",
 			"package-lock.json"
-		]) tryRun(`git add "${lockfile}"`, { cwd: rootDir });
-		run("git commit -F -", {
+		]) tryRunArgs([
+			"git",
+			"add",
+			"--",
+			lockfile
+		], { cwd: rootDir });
+		runArgs([
+			"git",
+			"commit",
+			"-F",
+			"-"
+		], {
 			cwd: rootDir,
 			input: [
 				"Version packages",
@@ -60,21 +86,34 @@ async function versionCommand(rootDir) {
 /** Run the package manager's install to update the lockfile */
 async function updateLockfile(rootDir) {
 	const { packageManager } = await detectWorkspaces(rootDir);
-	const installCmd = getInstallCommand(packageManager);
-	log.step(`Updating lockfile (${installCmd})...`);
+	const installArgs = getInstallArgs(packageManager);
+	log.step(`Updating lockfile (${installArgs.join(" ")})...`);
 	try {
-		run(installCmd, { cwd: rootDir });
+		runArgs(installArgs, { cwd: rootDir });
 		log.dim("  Lockfile updated");
 	} catch (err) {
 		log.warn(`  Lockfile update failed: ${err instanceof Error ? err.message : err}`);
 	}
 }
-function getInstallCommand(pm) {
+function getInstallArgs(pm) {
 	switch (pm) {
-		case "pnpm": return "pnpm install --lockfile-only";
-		case "bun": return "bun install";
-		case "yarn": return "yarn install --mode update-lockfile";
-		default: return "npm install --package-lock-only";
+		case "pnpm": return [
+			"pnpm",
+			"install",
+			"--lockfile-only"
+		];
+		case "bun": return ["bun", "install"];
+		case "yarn": return [
+			"yarn",
+			"install",
+			"--mode",
+			"update-lockfile"
+		];
+		default: return [
+			"npm",
+			"install",
+			"--package-lock-only"
+		];
 	}
 }
 //#endregion

package/dist/workspace-CxEKakDm.mjs

@@ -0,0 +1,107 @@
+import { a as readJson, n as exists } from "./fs-0AtnPUUe.mjs";
+import { i as isPackageManaged, o as loadPackageConfig } from "./config-BkwIEaQg.mjs";
+import { n as detectWorkspaces } from "./package-manager-DcI5TdDE.mjs";
+import { relative, resolve } from "node:path";
+import { readdir, stat } from "node:fs/promises";
+//#region src/core/workspace.ts
+/** Discover all workspace packages and catalogs in a monorepo */
+async function discoverWorkspace(rootDir, config) {
+	const { globs, catalogs } = await detectWorkspaces(rootDir);
+	if (globs.length === 0) throw new Error("No workspace globs found. Is this a monorepo?");
+	const packages = /* @__PURE__ */ new Map();
+	for (const glob of globs) {
+		const dirs = await resolveGlob(rootDir, glob);
+		for (const dir of dirs) {
+			const pkg = await loadWorkspacePackage(dir, rootDir, config);
+			if (pkg) {
+				if (!isPackageManaged(pkg.name, pkg.private, config, pkg.bumpy)) continue;
+				packages.set(pkg.name, pkg);
+			}
+		}
+	}
+	return {
+		packages,
+		catalogs
+	};
+}
+/** Convenience wrapper that returns just packages (backwards compat) */
+async function discoverPackages(rootDir, config) {
+	const { packages } = await discoverWorkspace(rootDir, config);
+	return packages;
+}
+/** Resolve a workspace glob pattern to directories containing package.json */
+async function resolveGlob(rootDir, pattern) {
+	return expandGlob(rootDir, pattern.split("/"));
+}
+async function expandGlob(baseDir, parts) {
+	if (parts.length === 0) {
+		if (await exists(resolve(baseDir, "package.json"))) return [baseDir];
+		return [];
+	}
+	const [current, ...rest] = parts;
+	if (current === "*") {
+		const entries = await safeReaddir(baseDir);
+		const results = [];
+		for (const entry of entries) {
+			const entryPath = resolve(baseDir, entry);
+			if (await isDirectory(entryPath)) results.push(...await expandGlob(entryPath, rest));
+		}
+		return results;
+	} else if (current === "**") {
+		const results = [];
+		results.push(...await expandGlob(baseDir, rest));
+		const entries = await safeReaddir(baseDir);
+		for (const entry of entries) {
+			if (entry.startsWith(".") || entry === "node_modules") continue;
+			const entryPath = resolve(baseDir, entry);
+			if (await isDirectory(entryPath)) results.push(...await expandGlob(entryPath, parts));
+		}
+		return results;
+	} else {
+		const next = resolve(baseDir, current);
+		if (await isDirectory(next)) return expandGlob(next, rest);
+		return [];
+	}
+}
+async function safeReaddir(dir) {
+	try {
+		return await readdir(dir);
+	} catch {
+		return [];
+	}
+}
+async function isDirectory(path) {
+	try {
+		return (await stat(path)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+async function loadWorkspacePackage(dir, rootDir, config) {
+	const pkgPath = resolve(dir, "package.json");
+	if (!await exists(pkgPath)) return null;
+	let pkg;
+	try {
+		pkg = await readJson(pkgPath);
+	} catch {
+		return null;
+	}
+	const name = pkg.name;
+	if (!name) return null;
+	const bumpy = await loadPackageConfig(dir, config, name);
+	return {
+		name,
+		version: pkg.version || "0.0.0",
+		dir: resolve(dir),
+		relativeDir: relative(rootDir, dir),
+		packageJson: pkg,
+		private: !!pkg.private,
+		dependencies: pkg.dependencies || {},
+		devDependencies: pkg.devDependencies || {},
+		peerDependencies: pkg.peerDependencies || {},
+		optionalDependencies: pkg.optionalDependencies || {},
+		bumpy
+	};
+}
+//#endregion
+export { discoverWorkspace as n, discoverPackages as t };