@williamthorsen/nmr 0.18.2 → 0.19.0

package/AGENTS.md

@@ -38,7 +38,19 @@ Some root scripts (e.g. `lint`, `typecheck`, `test`) expand to `nmr root:X && pn
 
 ## Managed build
 
-The default `compile` script runs `nmr-compile`, a standalone bin that uses the TypeScript compiler API to emit a package's `src` to `dist/esm` as `.js` and `.d.ts` in one pass, rewriting relative `.ts`→`.js` specifiers and tsconfig `paths` aliases in both outputs, and skipping work when inputs are unchanged. `typescript` is a peer dependency (`>=5.7.0`). There is no repo-local build script to maintain, and no separate typings step; `nmr build` runs `compile` alone. To find or debug the build, look to `nmr-compile`, not a `config/build.ts` in the consuming repo.
+The default `compile` script runs `nmr-compile`, a standalone bin that uses the TypeScript compiler API to emit a package's `src` to `dist/esm` as `.js` and `.d.ts` in one pass, rewriting relative `.ts`→`.js` specifiers and tsconfig `paths` aliases in both outputs, and skipping work when inputs are unchanged. `typescript` is a peer dependency (`>=5.7.0 <7`; TypeScript 7 ships no compiler API). There is no repo-local build script to maintain, and no separate typings step; `nmr build` runs `compile` alone. To find or debug the build, look to `nmr-compile`, not a `config/build.ts` in the consuming repo.
+
+## Dependency upgrades
+
+`nmr upgrade` reports available dependency upgrades, honoring the version ceilings the repo declares in its root `taze.config.ts`. Scope follows context: from the root it covers the root `package.json` and every workspace in one pass; from inside a package, or under `nmr -F <package> upgrade`, it covers that package. `nmr root:upgrade` covers the root `package.json` alone. Run the root-context commands from the monorepo root.
+
+There are no `outdated` or `update` commands; `upgrade` replaced them. Reach for `pnpm outdated` or `pnpm update` directly if you need a report that ignores the ceilings.
+
+Arguments pass through to the underlying tool, including the range mode: `nmr upgrade major` proposes major upgrades, still inside the ceilings. Every form above is report-only until you add `--write`.
+
+**`-w` is not the same on both sides of the command.** `nmr upgrade -w` passes `--write` through and rewrites `package.json`; `nmr -w upgrade` is nmr's own `--workspace-root` and writes nothing. Use the long forms.
+
+To change what a repo holds back, edit its `taze.config.ts`. It imports `defineConfig` from `@williamthorsen/nmr/taze`, which supplies the shared upgrade policy — so that file should carry only the ceilings specific to that repo, and the repo needs no dependency on the upgrade tool itself.
 
 ## Override behaviors
 

package/README.md

@@ -3,17 +3,21 @@
 Context-aware script runner for PNPM monorepos. Ships an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.18.2 (2026-07-18)
+## Release notes — v0.19.0 (2026-07-22)
 
-### 🐛 Bug fixes
+### 🎉 Features
 
-- Fail the build on aliased imports that escape the package source (#475)
+- 🚨 **Breaking:** Replace the dependency commands with nmr upgrade (#491)
 
-  Fixes an issue where an aliased import that resolved to a target outside the package's own source (one Node could not reach at runtime) passed the build but produced published output that crashed with a module-not-found error. `nmr-compile` now fails the build and reports the unresolvable import and where it pointed, so the problem surfaces before publish instead of in production. Aliased imports that resolve outside the source but remain genuinely external and runnable continue to build and ship unchanged.
+  Adds `nmr upgrade` as an ergonomic wrapper for displaying and applying available dependency upgrades. Taze is used under the hood to set a soaking period (customizable, defaulting to 7 days) before recently published dependencies will be accepted.
+
+  Removes the four dependency commands it replaces: `outdated`, `outdated:latest`, `update`, and `update:latest`.
 <!-- /section:release-notes -->
 
 ## Installation
 
+Requires Node.js 24 or later.
+
 ```bash
 pnpm add -D @williamthorsen/nmr
 ```
@@ -133,6 +137,48 @@ For example, if a workspace script resolves to `my-cli --verbose`, nmr rewrites
 
 > **Note:** Path resolution uses a heuristic: any non-flag token containing `/` is treated as a relative path. This works well for typical dev-tool commands but may incorrectly resolve URL-like values or glob patterns. Flags using `--flag=value` syntax are not resolved; use the spaced form `--flag value` for paths that need resolution.
 
+## Dependency upgrades
+
+`nmr upgrade` reports the dependency upgrades available to your repo. What it covers depends on where you run it:
+
+| Invocation                   | Covers                                      |
+| ---------------------------- | ------------------------------------------- |
+| `nmr upgrade` (from root)    | the root `package.json` and every workspace |
+| `nmr upgrade` (in a package) | that package                                |
+| `nmr -F <package> upgrade`   | that package, from anywhere                 |
+| `nmr root:upgrade`           | the root `package.json` alone               |
+
+The upgrade tool ([taze](https://github.com/antfu-collective/taze)) arrives with nmr, so your repo declares no dependency on it. Everything after the command name is passed through, including the range mode:
+
+```bash
+nmr upgrade          # upgrades available within each package's version ceilings
+nmr upgrade major    # major upgrades, still inside the ceilings
+nmr upgrade --write  # apply the proposals to package.json
+```
+
+> **Note:** `-w` means different things on either side of the command. `nmr upgrade -w` passes `--write` to the upgrade tool; `nmr -w upgrade` is nmr's own `--workspace-root` flag and applies no write. Prefer the long forms to keep them apart. Run the root-context commands from the monorepo root: like nmr's other `root:` scripts, they take the current directory as their starting point.
+
+### Configuring upgrades
+
+Declare version ceilings in a `taze.config.ts` at the monorepo root:
+
+```ts
+import { defineConfig } from '@williamthorsen/nmr/taze';
+
+export default defineConfig({
+  packageMode: {
+    // Hold @types/node at the Node major your `engines` floor requires.
+    '@types/node': 'minor',
+  },
+});
+```
+
+`defineConfig` supplies nmr's shared upgrade policy — currently a seven-day quarantine on brand-new releases — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`.
+
+Everything the [taze configuration](https://github.com/antfu-collective/taze#config-file) accepts is accepted here.
+
+> **Note:** `--include-locked` is part of both registry entries because a repo that pins dependencies to exact versions (pnpm's `savePrefix: ''`) has no dependency the tool would otherwise consider — without it, an upgrade pass reports nothing at all. Drop it via `.config/nmr.config.ts` if your repo declares version ranges instead.
+
 ## Default script registries
 
 These scripts are available out of the box. Repo-wide config (tier 2) and per-package overrides (tier 3) can add to or replace any of them.
@@ -157,6 +203,7 @@ These scripts are available out of the box. Repo-wide config (tier 2) and per-pa
 | `test:coverage` | `pnpm exec vitest --coverage`                            |
 | `test:watch`    | `pnpm exec vitest --watch`                               |
 | `typecheck`     | `tsgo --noEmit`                                          |
+| `upgrade`       | `nmr-taze --include-locked`                              |
 | `view-coverage` | `open coverage/index.html`                               |
 
 #### Integration test variant
@@ -236,12 +283,11 @@ A package gets this variant automatically when it contains a `vitest.integration
 
 #### Dependencies
 
-| Command           | Runs                                     |
-| ----------------- | ---------------------------------------- |
-| `outdated`        | `pnpm outdated --compatible --recursive` |
-| `outdated:latest` | `pnpm outdated --recursive`              |
-| `update`          | `pnpm update --recursive`                |
-| `update:latest`   | `pnpm update --latest --recursive`       |
+| Command   | Runs                                    |
+| --------- | --------------------------------------- |
+| `upgrade` | `nmr-taze --include-locked --recursive` |
+
+See [dependency upgrades](#dependency-upgrades) for the workflow and its configuration.
 
 #### Root-only
 
@@ -255,6 +301,7 @@ These scripts operate on root-level code only (not workspace packages):
 | `root:lint:strict` | `strict-lint --ignore-pattern 'packages/**' .`                |
 | `root:test`        | `vitest --config ./vitest.root.config.ts`                     |
 | `root:typecheck`   | `tsgo --noEmit`                                               |
+| `root:upgrade`     | `nmr-taze --include-locked`                                   |
 
 #### Utilities
 
@@ -353,12 +400,22 @@ nmr-clean
 
 Compile a single package's `src` tree to `dist/esm` with the TypeScript compiler API, emitting `.js` and `.d.ts` in one pass. Because the compiler parses each source file, every relative import form — static, re-export, dynamic `import()`, and bare side-effect — is rewritten from `.ts` to `.js` in both outputs, and `.ts` occurrences inside strings and comments are left intact. tsconfig `paths` aliases are resolved to runnable relative `.js` specifiers in both outputs, sourced from the package's tsconfig. An aliased import whose target resolves outside the package's `src/` and is not resolvable without the alias mapping fails the build with a diagnostic, rather than being emitted verbatim to produce output that fails at runtime. The build is skipped when no input has changed and the previous output is still on disk (a content-and-path hash is cached under `node_modules/.cache/nmr-compile/`, outside the published output). Deleting the output by any means — `nmr clean`, `rm -rf dist`, `git clean` — therefore forces a rebuild rather than a skip. This is the default `compile` script — run it from a package directory.
 
-`typescript` is a peer dependency (`>=5.7.0`, required for `rewriteRelativeImportExtensions`); the consuming repo provides it. Relative imports in source must carry explicit `.ts` extensions for them to be rewritten.
+`typescript` is a peer dependency (`>=5.7.0 <7`); the consuming repo provides it. The floor is what `rewriteRelativeImportExtensions` requires; the ceiling is because TypeScript 7 ships no compiler API — its root export is a version constant, so `nmr-compile` cannot run on it. Relative imports in source must carry explicit `.ts` extensions for them to be rewritten.
 
 ```bash
 nmr-compile
 ```
 
+### `nmr-taze`
+
+Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool, forwarding every argument to it untouched. This is what the `upgrade` and `root:upgrade` scripts resolve to — see [dependency upgrades](#dependency-upgrades) for the workflow.
+
+Under pnpm's isolated `node_modules`, a transitive package's binary is absent from the consuming repo's `node_modules/.bin`, so a repo that depends on nmr cannot run `taze` directly. `nmr-taze` can, because nmr is a direct dependency, and it resolves the tool from the tree nmr controls.
+
+```bash
+nmr-taze --include-locked --recursive
+```
+
 ### `ensure-prepublish-hooks`
 
 Verify that all publishable workspace packages have a `prepublishOnly` script. Exits non-zero if any are missing.

package/bin/nmr-taze.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+try {
+  await import('../dist/esm/cli-taze.js');
+} catch (error) {
+  if (error.code === 'ERR_MODULE_NOT_FOUND') {
+    process.stderr.write('nmr-taze: build output not found — run `pnpm run build` first\n');
+  } else {
+    process.stderr.write(`nmr-taze: failed to load: ${error.message}\n`);
+  }
+  process.exit(1);
+}

package/dist/esm/cli-taze.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/cli-taze.js

@@ -0,0 +1,10 @@
+import process from 'node:process';
+import { reportError } from '@williamthorsen/nmr-core';
+import { runTaze } from "./commands/taze.js";
+try {
+    process.exitCode = runTaze(process.argv.slice(2));
+}
+catch (error) {
+    reportError(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+}

package/dist/esm/commands/build.d.ts

@@ -4,6 +4,6 @@ export interface BuildOptions {
     outdir?: string;
 }
 export declare function buildPackage(packageDir: string, options?: BuildOptions): Promise<void>;
-export declare function computeBuildHash(packageDir: string, files: string[], emitConfig: object): Promise<string>;
+export declare function computeBuildHash(packageDir: string, files: string[], emitConfig: object, compilerVersion: string): Promise<string>;
 export declare function resolveTsconfigChain(packageDir: string, configFileName?: string): string[];
 export declare function resolveBuildCachePath(packageDir: string): string;

package/dist/esm/commands/build.js

@@ -24,14 +24,14 @@ export async function buildPackage(packageDir, options = {}) {
         ignore: options.ignore ?? DEFAULT_IGNORE,
     });
     const dependencies = ['package.json', ...resolveTsconfigChain(packageDir)];
-    const { changed, currentHash } = await detectBuildChanges(packageDir, [...entryPoints, ...dependencies], emitConfig, cachePath, hasExpectedBuildOutput(packageDir, outdir, entryPoints));
+    const { changed, currentHash } = await detectBuildChanges(packageDir, [...entryPoints, ...dependencies], emitConfig, ts.version, cachePath, hasExpectedBuildOutput(packageDir, outdir, entryPoints));
     if (!changed) {
         return;
     }
     emitPackage(packageDir, entryPoints, outdir);
     await writeBuildCache(cachePath, currentHash);
 }
-export async function computeBuildHash(packageDir, files, emitConfig) {
+export async function computeBuildHash(packageDir, files, emitConfig, compilerVersion) {
     const hash = createHash('sha256');
     for (const file of [...files].sort()) {
         hash.update(file);
@@ -39,6 +39,8 @@ export async function computeBuildHash(packageDir, files, emitConfig) {
         hash.update(await readFile(path.join(packageDir, file)));
     }
     hash.update(JSON.stringify(emitConfig));
+    hash.update('\0');
+    hash.update(compilerVersion);
     return hash.digest('hex');
 }
 export function resolveTsconfigChain(packageDir, configFileName = 'tsconfig.json') {
@@ -140,7 +142,7 @@ function resolveSpecifierReplacement(specifier, sourceContainingFile, compilerOp
         const rewritten = swapTypeScriptExtension(specifier);
         return rewritten === specifier ? undefined : rewritten;
     }
-    if (!aliasPrefixes.some((prefix) => specifier === prefix || specifier.startsWith(prefix))) {
+    if (aliasPrefixes.every((prefix) => !(specifier === prefix || specifier.startsWith(prefix)))) {
         return undefined;
     }
     const resolved = ts.resolveModuleName(specifier, sourceContainingFile, compilerOptions, ts.sys).resolvedModule;
@@ -207,10 +209,10 @@ function findNearestNodeModulesHost(startDir) {
     }
     return current;
 }
-async function detectBuildChanges(packageDir, files, emitConfig, cachePath, outputPresent) {
+async function detectBuildChanges(packageDir, files, emitConfig, compilerVersion, cachePath, outputPresent) {
     const packageName = path.basename(packageDir);
     const previousHash = existsSync(cachePath) ? readFileSync(cachePath, 'utf8') : undefined;
-    const currentHash = await computeBuildHash(packageDir, files, emitConfig);
+    const currentHash = await computeBuildHash(packageDir, files, emitConfig, compilerVersion);
     if (previousHash === currentHash) {
         if (outputPresent) {
             console.info(`${SKIPPED_ICON} ${packageName}: No changes detected. Skipping build.`);
@@ -235,7 +237,7 @@ async function writeBuildCache(cachePath, hash) {
     await writeFile(cachePath, hash);
 }
 function assertSupportedTypeScript() {
-    const [majorPart, minorPart] = ts.versionMajorMinor.split('.');
+    const [majorPart, minorPart] = ts.versionMajorMinor.split('.', 2);
     const major = majorPart === undefined ? 0 : Number(majorPart);
     const minor = minorPart === undefined ? 0 : Number(minorPart);
     const tooOld = major < MINIMUM_TYPESCRIPT_MAJOR || (major === MINIMUM_TYPESCRIPT_MAJOR && minor < MINIMUM_TYPESCRIPT_MINOR);

package/dist/esm/commands/taze.d.ts

@@ -0,0 +1,12 @@
+import type { Writable } from 'node:stream';
+export interface SpawnOutcome {
+    status: number | null;
+    error?: Error | undefined;
+}
+export interface RunTazeOptions {
+    resolveCliPath?: () => string;
+    spawn?: (nodePath: string, argv: string[]) => SpawnOutcome;
+    stderr?: Writable;
+}
+export declare function runTaze(args: string[], options?: RunTazeOptions): number;
+export declare function resolveTazeCliPath(): string;

package/dist/esm/commands/taze.js

@@ -0,0 +1,32 @@
+import { spawnSync } from 'node:child_process';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { reportError } from '@williamthorsen/nmr-core';
+const TAZE_CLI_SPECIFIER = 'taze/cli';
+export function runTaze(args, options = {}) {
+    const stderr = options.stderr ?? process.stderr;
+    const resolveCliPath = options.resolveCliPath ?? resolveTazeCliPath;
+    const spawn = options.spawn ?? spawnNode;
+    let cliPath;
+    try {
+        cliPath = resolveCliPath();
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        reportError(`Could not resolve '${TAZE_CLI_SPECIFIER}' from nmr's dependencies. Reinstall the workspace to restore it. (${detail})`, stderr);
+        return 1;
+    }
+    const outcome = spawn(process.execPath, [cliPath, ...args]);
+    if (outcome.error) {
+        reportError(`Failed to run taze: ${outcome.error.message}`, stderr);
+        return 1;
+    }
+    return outcome.status ?? 1;
+}
+export function resolveTazeCliPath() {
+    return fileURLToPath(import.meta.resolve(TAZE_CLI_SPECIFIER));
+}
+function spawnNode(nodePath, argv) {
+    const result = spawnSync(nodePath, argv, { stdio: 'inherit' });
+    return { status: result.status, error: result.error };
+}

package/dist/esm/context.js

@@ -76,7 +76,7 @@ export async function resolveContext(cwd) {
     return {
         monorepoRoot,
         isRoot: packageDir === undefined,
-        ...(packageDir === undefined ? {} : { packageDir }),
+        ...(packageDir !== undefined && { packageDir }),
         config,
     };
 }

package/dist/esm/default-scripts.js

@@ -12,6 +12,7 @@ export const commonWorkspaceScripts = {
     'lint:check': 'eslint .',
     'lint:strict': 'strict-lint',
     typecheck: 'tsgo --noEmit',
+    upgrade: 'nmr-taze --include-locked',
     'view-coverage': 'open coverage/index.html',
 };
 export const integrationTestScripts = {
@@ -45,8 +46,6 @@ export const rootScripts = {
     lint: 'nmr root:lint && pnpm --recursive exec nmr lint',
     'lint:check': 'nmr root:lint:check && pnpm --recursive exec nmr lint:check',
     'lint:strict': 'nmr root:lint:strict && pnpm --recursive exec nmr lint:strict',
-    outdated: 'pnpm outdated --compatible --recursive',
-    'outdated:latest': 'pnpm outdated --recursive',
     'report-overrides': 'nmr-report-overrides',
     'root:check': ['root:typecheck', 'fmt:check', 'root:lint:check', 'root:test'],
     'root:lint': "eslint --fix --ignore-pattern 'packages/**' .",
@@ -54,12 +53,12 @@ export const rootScripts = {
     'root:lint:strict': "strict-lint --ignore-pattern 'packages/**' .",
     'root:test': 'vitest --config ./vitest.root.config.ts',
     'root:typecheck': 'tsgo --noEmit',
+    'root:upgrade': 'nmr-taze --include-locked',
     'sync-agent-files': 'nmr-sync-agent-files',
     'sync-pnpm-version': 'nmr-sync-pnpm-version',
     test: 'nmr root:test && pnpm --recursive exec nmr test',
     'test:coverage': 'nmr root:test && pnpm --recursive exec nmr test:coverage',
     'test:watch': 'vitest --watch',
     typecheck: 'nmr root:typecheck && pnpm --recursive exec nmr typecheck',
-    update: 'pnpm update --recursive',
-    'update:latest': 'pnpm update --latest --recursive',
+    upgrade: 'nmr-taze --include-locked --recursive',
 };

package/dist/esm/help.js

@@ -48,10 +48,11 @@ function collectOverrides(packageDir) {
 function applyOverrides(registry, overrides) {
     const marked = new Set();
     for (const [name, value] of Object.entries(overrides)) {
-        if (name in registry) {
-            registry[name] = value;
-            marked.add(name);
+        if (!(name in registry)) {
+            continue;
         }
+        registry[name] = value;
+        marked.add(name);
     }
     return marked;
 }

package/dist/esm/taze.d.ts

@@ -0,0 +1,5 @@
+import type { CheckOptions } from 'taze';
+export type TazeConfig = {
+    [K in keyof CheckOptions]?: CheckOptions[K] | undefined;
+};
+export declare function defineConfig(config: TazeConfig): TazeConfig;

package/dist/esm/taze.js

@@ -0,0 +1,6 @@
+const SHARED_POLICY = {
+    maturityPeriod: 7,
+};
+export function defineConfig(config) {
+    return { ...SHARED_POLICY, ...config };
+}

package/dist/esm/tests/consistency.js

@@ -37,7 +37,7 @@ export function getPnpmVersionFromPackageJson(monorepoRoot) {
     if (typeof pm !== 'string') {
         throw new TypeError('"packageManager" field missing or not a string in package.json.');
     }
-    const [name, version] = pm.split('@');
+    const [name, version] = pm.split('@', 2);
     if (name !== 'pnpm') {
         throw new Error('packageManager is not pnpm.');
     }

package/dist/esm/tests/helpers/get-runtime-version-from-asdf.js

@@ -6,7 +6,7 @@ export async function getRuntimeVersionFromAsdf(runtime, monorepoRoot) {
     const toolVersions = await fs.promises.readFile(toolVersionsPath, { encoding: 'utf8' });
     const versionLine = toolVersions.split('\n').find((line) => line.trim().startsWith(runtime));
     assert.ok(versionLine, `${runtime} not found in .tool-versions`);
-    const [, version] = versionLine.trim().split(/\s+/);
+    const [, version] = versionLine.trim().split(/\s+/, 2);
     assert.ok(version, `${runtime} version missing in .tool-versions`);
     return version;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.18.2",
+  "version": "0.19.0",
   "private": false,
   "description": "Context-aware script runner for PNPM monorepos",
   "keywords": [
@@ -30,6 +30,10 @@
       "types": "./dist/esm/scripts.d.ts",
       "default": "./dist/esm/scripts.js"
     },
+    "./taze": {
+      "types": "./dist/esm/taze.d.ts",
+      "default": "./dist/esm/taze.js"
+    },
     "./tests": {
       "types": "./dist/esm/tests/consistency.d.ts",
       "default": "./dist/esm/tests/consistency.js"
@@ -42,7 +46,8 @@
     "nmr-compile": "bin/nmr-compile.js",
     "nmr-report-overrides": "bin/nmr-report-overrides.js",
     "nmr-sync-agent-files": "bin/nmr-sync-agent-files.js",
-    "nmr-sync-pnpm-version": "bin/nmr-sync-pnpm-version.js"
+    "nmr-sync-pnpm-version": "bin/nmr-sync-pnpm-version.js",
+    "nmr-taze": "bin/nmr-taze.js"
   },
   "files": [
     "AGENTS.md",
@@ -52,15 +57,19 @@
   "dependencies": {
     "glob": "13.0.6",
     "jiti": "2.7.0",
+    "taze": "19.15.1",
     "yaml": "2.9.0",
     "zod": "4.4.3",
-    "@williamthorsen/nmr-core": "0.7.0"
+    "@williamthorsen/nmr-core": "0.7.1"
   },
   "devDependencies": {
-    "@williamthorsen/toolbelt.strings": "3.1.4"
+    "@williamthorsen/toolbelt.strings": "3.1.6"
   },
   "peerDependencies": {
-    "typescript": ">=5.7.0"
+    "typescript": ">=5.7.0 <7"
+  },
+  "engines": {
+    "node": ">=24"
   },
   "publishConfig": {
     "access": "public"