@williamthorsen/nmr 0.32.1 → 0.32.2

package/.readyup/kits/default.js

@@ -43,9 +43,8 @@ var workspaceScripts = {
   "test:unit": "pnpm exec vitest --project unit",
   "test:watch": `pnpm exec vitest ${GATE_PROJECTS} --watch`,
   typecheck: "tsgo --noEmit",
-  // Without `--include-locked`, nothing would be reported in a repo that pins exact version numbers. The
-  // command is a string because neither half names an nmr command: both are binaries.
-  upgrade: "nmr-report-catalog && nmr-taze --include-locked",
+  // The command is a string because neither half names an nmr command: both are binaries.
+  upgrade: "nmr-report-catalog && nmr-taze",
   "view-coverage": "open coverage/index.html"
 };
 var rootScripts = {
@@ -81,7 +80,7 @@ var rootScripts = {
   "root:typecheck": "tsgo --noEmit",
   // Carries the override report for the same reason `upgrade` does: both end in the tool that rewrites a
   // `pnpm.overrides` block, so both need the reporter's rejection ahead of them.
-  "root:upgrade": "nmr-report-overrides && nmr-taze --include-locked",
+  "root:upgrade": "nmr-report-overrides && nmr-taze",
   test: ["root:test", "-R test"],
   "test:all": ["root:test:all", "-R test:all"],
   "test:coverage": ["root:test", "-R test:coverage"],
@@ -93,7 +92,7 @@ var rootScripts = {
   typecheck: [ROOT_TYPECHECK_STEP, { run: "-R typecheck", declinesArgs: true }],
   // The command is a string because neither half names an nmr command: both are binaries, and a composite
   // element can name only a command.
-  upgrade: "nmr-report-overrides && nmr-taze --include-locked --recursive"
+  upgrade: "nmr-report-overrides && nmr-taze --recursive"
 };
 
 // src/resolve-scripts.ts
@@ -272,6 +271,13 @@ var default_default = defineRdyKit({
           check: () => prettierConfigBuildsOnSharedConfig(),
           fix: "Replace the Prettier config with: import { definePrettierConfig } from '@williamthorsen/nmr/prettier'; export default definePrettierConfig();"
         },
+        // -- Shared upgrade policy -----------------------------------------------
+        {
+          name: "taze.config.ts builds on @williamthorsen/nmr/taze",
+          severity: "warn",
+          check: () => tazeConfigBuildsOnSharedConfig(),
+          fix: "Replace the taze config with: import { defineConfig } from '@williamthorsen/nmr/taze'; export default defineConfig(); \u2014 nmr's upgrade policy reaches a repo only through this file, so without it `nmr upgrade` reports nothing where dependencies are pinned to exact versions"
+        },
         // -- Audit dependency --------------------------------------------------------
         {
           name: "v11y-check in devDependencies",
@@ -303,6 +309,8 @@ var CONFIG_EXTENSIONS = "{ts,mts,cts,js,mjs,cjs}";
 var SHARED_VITEST_MODULE = "@williamthorsen/nmr/vitest";
 var SHARED_PRETTIER_MODULE = "@williamthorsen/nmr/prettier";
 var INERT_PRETTIER_CONFIGS = [".prettierrc", ".prettierrc.{json,json5,yaml,yml,toml}"];
+var SHARED_TAZE_MODULE = "@williamthorsen/nmr/taze";
+var INERT_TAZE_CONFIGS = [".tazerc", ".tazerc.json", "taze.config.json"];
 var RE_EXPORT_LINE_PATTERN = /^export\s*(?:\{\s*default\s*}|\*)\s*from\s*['"]\.\.\/[^'"]*['"];?$/;
 var MIN_ESLINT_VERSION = "10.0.0";
 var MIN_STRICT_LINT_VERSION = "9.3.0";
@@ -394,7 +402,7 @@ function formatPaths(paths) {
 ${paths.map((path2) => `      ${path2}`).join("\n")}`;
 }
 function getMinVersion() {
-  const picked = { "version": "0.32.1" };
+  const picked = { "version": "0.32.2" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("nmr/package.json: 'version' must be a string");
   }
@@ -495,6 +503,22 @@ function readPnpmFieldKeys(content) {
 function resolvesVersionViaWorkspace(range) {
   return WORKSPACE_VERSION_MARKERS.some((marker) => range.startsWith(marker));
 }
+function tazeConfigBuildsOnSharedConfig(cwd = process.cwd()) {
+  const configs = findFiles([`taze.config.${CONFIG_EXTENSIONS}`], cwd);
+  if (configs.length === 0) {
+    return { ok: false, detail: describeMissingTazeConfig(cwd) };
+  }
+  const stale = configs.filter(
+    (relativePath) => !importsSharedExport(readFileIn(cwd, relativePath), "defineConfig", SHARED_TAZE_MODULE)
+  );
+  if (stale.length === 0) return true;
+  return { ok: false, detail: `does not import defineConfig from ${SHARED_TAZE_MODULE}: ${stale.join(", ")}` };
+}
+function describeMissingTazeConfig(cwd) {
+  const inert = findFiles(INERT_TAZE_CONFIGS, cwd);
+  if (inert.length > 0) return `holds no code to call the factory: ${inert.join(", ")}`;
+  return "taze.config.ts is missing";
+}
 function toolVersionsHasNoPnpm() {
   const content = readFile(".tool-versions");
   if (content === void 0) return true;
@@ -515,6 +539,7 @@ export {
   noReExportOnlyVitestConfigs,
   noRetiredVitestConfigs,
   prettierConfigBuildsOnSharedConfig,
+  tazeConfigBuildsOnSharedConfig,
   vitestConfigBuildsOnSharedConfig,
   vitestRootConfigBuildsOnSharedConfig
 };

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.1",
       "inputs": [
         {
-          "hash": "67afdcb4",
+          "hash": "904ac753",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "01e1f853",
+          "hash": "cca25de2",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -21,7 +21,7 @@
           ]
         },
         {
-          "hash": "3dfc2ee7",
+          "hash": "94bb3c62",
           "kind": "module",
           "path": "../src/default-scripts.ts"
         },
@@ -40,8 +40,8 @@
       "path": "kits/default.js",
       "readyupVersion": "0.29.0",
       "source": "kits/default.ts",
-      "sourceHash": "67afdcb4",
-      "targetHash": "1fad8728"
+      "sourceHash": "904ac753",
+      "targetHash": "bc4d49d1"
     }
   ]
 }

package/README.md

@@ -3,15 +3,19 @@
 Context-aware script runner for pnpm monorepos. Ships an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.32.1 (2026-08-18)
+## Release notes — v0.32.2 (2026-08-19)
 
 ### 🐛 Bug fixes
 
-- Reject a `package.json` entry that chains steps onto a self-reference (#707)
+- Recognize nmr behind a quoted environment assignment (#709)
 
-  Fixes an issue where a `package.json` script re-invoking its own command alongside other steps (such as `"build": "nmr build && rdy compile"`) silently lost those steps: nmr discarded the entry and ran its own `build` in its place, so `rdy compile` never ran. nmr now refuses to run the entry and reports the error.
+  Fixes an issue where a `package.json` entry that re-invoked its own command from behind an environment assignment whose quoted value carried a space (e.g., `"build": "NODE_OPTIONS=\"--a --b\" nmr build"`) caused nmr to hang.
 
-  Separately, fixes an issue where the same chain written the other way round (e.g., `"build": "rdy compile && nmr build"`) was honored as an ordinary override, causing infinite recursion.
+- Restore upgrade reporting for repos that pin exact versions (#720)
+
+  Fixes an issue where `nmr upgrade` reported nothing in a repo that pins dependencies to exact versions, however far behind the tree was. nmr's shared upgrade policy now supplies both settings the upgrade tool needs to report a bare pin -- locked dependencies are included, and the range searched is `minor` -- and the default `upgrade` scripts no longer pass `--include-locked`, which went inert on its own in taze 20.0.1. The policy reaches a repo only through a `taze.config.ts` calling `defineConfig`, and nmr's ReadyUp kit now warns when a repo carries none.
+
+  The `minor` range mode applies to every dependency, not only a pinned one: a `~` range is searched as `^`, so minor upgrades are proposed for it, and a `packageMode` entry other than `minor` drops its dependency from a default pass rather than narrowing it.
 <!-- /section:release-notes -->
 
 ## Installation
@@ -135,7 +139,7 @@ A string value is spawned through a shell as one command, so an `nmr` invocation
 
 The line names the declaration it is an edit to — the file, the field, and the key — and its remedy follows from that site. A `.config/nmr.config.ts` entry keeps its nmr steps as a step list and moves anything else to a `<command>:pre` or `<command>:post` script: a step-list element is composed into `nmr <element>`, so it can name only an nmr command. A `package.json` entry has to go, since `package.json` holds no step list: delete it outright when it restates what nmr already runs for that command, and move the steps it adds to a `<command>:pre` or `<command>:post` script when they are the package's own. Where the registry defines no such command, both apply: name the command in `.config/nmr.config.ts`, and put the package-specific steps in a hook. The pair is named rather than `:post` alone because an entry's extra steps may run on either side of the chain: `rdy verify && nmr compile` puts them first. A hook is the exception at both tiers: nmr wraps a `:pre` or `:post` script in no hooks of its own, so a hook's other steps become a script of their own that the step list names.
 
-nmr recognizes `nmr` in command position: at the start of a step, after an unquoted `&&`, `||`, `;`, `|`, or a newline, and behind `npx`, `bunx`, or an `exec`, `dlx`, or `x` subcommand of `npm`, `pnpm`, `yarn`, or `bun`. This line reports a boundary rather than enforcing a rule — it covers a step nmr runs as written, and only the reporting of the nested run is degraded — and it stays partial in stated ways: a value-taking flag standing immediately before the program name hides it (`npx -p foo nmr`), a launcher outside that set goes unreported, and a `devBin` substitution that introduces `nmr` itself is not reported, the line being an edit to a declaration rather than to a substitution.
+nmr recognizes `nmr` in command position: at the start of a step, after an unquoted `&&`, `||`, `;`, `|`, or a newline, past any leading `NAME=value` assignments, and behind `npx`, `bunx`, or an `exec`, `dlx`, or `x` subcommand of `npm`, `pnpm`, `yarn`, or `bun`. This line reports a boundary rather than enforcing a rule — it covers a step nmr runs as written, and only the reporting of the nested run is degraded — and it stays partial in stated ways: a value-taking flag standing immediately before the program name hides it (`npx -p foo nmr`), a launcher outside that set goes unreported, and a `devBin` substitution that introduces `nmr` itself is not reported, the line being an edit to a declaration rather than to a substitution.
 
 A [self-referential `package.json` entry](#three-tier-override-system) is the shape nmr cannot run as written, and it is rejected rather than reported. The same recognition finds it, so the same residuals apply — what goes unrecognized there re-enters nmr without bound, which hangs rather than passing quietly.
 
@@ -534,8 +538,8 @@ A `pnpm.overrides` block left in the root `package.json` fails the command inste
 The upgrade tool ([taze](https://github.com/antfu-collective/taze)) arrives with nmr, so your repo declares no dependency on it. Everything after the command name is passed through, including the range mode:
 
 ```bash
-nmr upgrade         # upgrades available within each package's version ceilings
-nmr upgrade major   # major upgrades, still inside the ceilings
+nmr upgrade         # minor and patch upgrades, regardless of the range each dependency declares
+nmr upgrade major   # major upgrades, for dependencies carrying no per-package ceiling
 nmr upgrade --write # apply the proposals to package.json
 ```
 
@@ -554,11 +558,16 @@ export default defineConfig({
 });
 ```
 
-`defineConfig` supplies nmr's shared upgrade policy — currently a seven-day quarantine on brand-new releases — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`.
+`defineConfig` supplies nmr's shared upgrade policy — a seven-day quarantine on brand-new releases, and the pair of settings that report a dependency pinned to an exact version: locked dependencies are included, and the range searched is `minor` — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`. `mode` is the exception: the upgrade tool carries a default of its own for it, and clearing nmr's leaves no valid range to search, so name a mode instead.
 
 Everything the [taze configuration](https://github.com/antfu-collective/taze#config-file) accepts is accepted here.
 
-> **Note:** `--include-locked` is part of both registry entries because a repo that pins dependencies to exact versions (pnpm's `savePrefix: ''`) has no dependency the tool would otherwise consider — without it, an upgrade pass reports nothing at all. Drop it via `.config/nmr.config.ts` if your repo declares version ranges instead.
+> **Note:** This file is what activates nmr's upgrade policy at all. A repo without one gets neither the release quarantine nor the settings that report a dependency pinned to an exact version, and `nmr upgrade` reports nothing in a repo using pnpm's `savePrefix: ''`. nmr's ReadyUp kit warns when the file is missing.
+
+Two consequences of the `minor` range mode the policy declares:
+
+- A `packageMode` entry is honored only by the pass whose mode matches it, or by a `default` pass; every other pass drops that dependency rather than narrowing it. Under the policy's `minor` mode, a `patch` ceiling hides its dependency until you run `nmr upgrade patch`, and a `minor` ceiling hides it from `nmr upgrade major`.
+- A `~` range is searched as `^`, so minor upgrades are proposed for it and `--write` applies them under the original `~`. To hold one dependency to patches, give it a `packageMode` entry of `patch` and read it from `nmr upgrade patch`; to hold the whole repo there, declare `mode: 'patch'`.
 
 ## Default script registries
 
@@ -588,7 +597,7 @@ These scripts are available out of the box. Repo-wide config (tier 2) and per-pa
 | `test:unit`      | `pnpm exec vitest --project unit`                           |
 | `test:watch`     | `pnpm exec vitest --project unit --project tool --watch`    |
 | `typecheck`      | `tsgo --noEmit`                                             |
-| `upgrade`        | `nmr-report-catalog && nmr-taze --include-locked`           |
+| `upgrade`        | `nmr-report-catalog && nmr-taze`                            |
 | `view-coverage`  | `open coverage/index.html`                                  |
 
 `fmt` and `fmt:check` select their files through git rather than by walking the directory, which is what makes a package-level run and a root-level run apply the same ignore rules — see [file selection](#file-selection).
@@ -702,9 +711,9 @@ A file git ignores is never formatted, even when named directly. Trailing argume
 
 #### Dependencies
 
-| Command   | Runs                                                            |
-| --------- | --------------------------------------------------------------- |
-| `upgrade` | `nmr-report-overrides && nmr-taze --include-locked --recursive` |
+| Command   | Runs                                           |
+| --------- | ---------------------------------------------- |
+| `upgrade` | `nmr-report-overrides && nmr-taze --recursive` |
 
 See [dependency upgrades](#dependency-upgrades) for the workflow and its configuration.
 
@@ -723,7 +732,7 @@ These scripts operate on root-level code only (not workspace packages):
 | `root:test:tool`   | `vitest --config ./vitest.root.config.ts --project tool`                |
 | `root:test:unit`   | `vitest --config ./vitest.root.config.ts --project unit`                |
 | `root:typecheck`   | `tsgo --noEmit`                                                         |
-| `root:upgrade`     | `nmr-report-overrides && nmr-taze --include-locked`                     |
+| `root:upgrade`     | `nmr-report-overrides && nmr-taze`                                      |
 
 #### Utilities
 
@@ -875,7 +884,7 @@ Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool
 Under pnpm's isolated `node_modules`, a transitive package's binary is absent from the consuming repo's `node_modules/.bin`, so a repo that depends on nmr cannot run `taze` directly. `nmr-taze` can, because nmr is a direct dependency, and it resolves the tool from the tree nmr controls.
 
 ```bash
-nmr-taze --include-locked --recursive
+nmr-taze --recursive
 ```
 
 ### `ensure-prepublish-hooks`

package/dist/esm/default-scripts.js

@@ -22,7 +22,7 @@ export const workspaceScripts = {
     'test:unit': 'pnpm exec vitest --project unit',
     'test:watch': `pnpm exec vitest ${GATE_PROJECTS} --watch`,
     typecheck: 'tsgo --noEmit',
-    upgrade: 'nmr-report-catalog && nmr-taze --include-locked',
+    upgrade: 'nmr-report-catalog && nmr-taze',
     'view-coverage': 'open coverage/index.html',
 };
 export const rootScripts = {
@@ -52,7 +52,7 @@ export const rootScripts = {
     'root:test:tool': 'vitest --config ./vitest.root.config.ts --project tool',
     'root:test:unit': 'vitest --config ./vitest.root.config.ts --project unit',
     'root:typecheck': 'tsgo --noEmit',
-    'root:upgrade': 'nmr-report-overrides && nmr-taze --include-locked',
+    'root:upgrade': 'nmr-report-overrides && nmr-taze',
     test: ['root:test', '-R test'],
     'test:all': ['root:test:all', '-R test:all'],
     'test:coverage': ['root:test', '-R test:coverage'],
@@ -60,5 +60,5 @@ export const rootScripts = {
     'test:unit': ['root:test:unit', '-R test:unit'],
     'test:watch': `vitest ${GATE_PROJECTS} --watch`,
     typecheck: [ROOT_TYPECHECK_STEP, { run: '-R typecheck', declinesArgs: true }],
-    upgrade: 'nmr-report-overrides && nmr-taze --include-locked --recursive',
+    upgrade: 'nmr-report-overrides && nmr-taze --recursive',
 };

package/dist/esm/steps.js

@@ -10,6 +10,7 @@ const LAUNCHERS = new Map([
 const QUOTES = new Set(['"', "'"]);
 const SEGMENT_SEPARATORS = new Set([';', '|', '&', '\n', '\r']);
 const SHELL_SAFE_TOKEN = /^[\w@%+=:,./-]+$/;
+const TOKEN_SEPARATORS = new Set([' ', '\t', '\n', '\r']);
 export function composeNmrStep(element, workspaceRoot, declinesArgs = false) {
     const flags = workspaceRoot ? ['-w'] : [];
     return { kind: 'structural', argv: ['nmr', ...flags, ...tokenize(element)], ...(declinesArgs && { declinesArgs }) };
@@ -65,7 +66,7 @@ function quoteToken(token) {
     return "'" + token.replaceAll("'", String.raw `'\''`) + "'";
 }
 function readNmrTail(segment) {
-    const [head, ...rest] = dropLeadingAssignments(tokenize(segment));
+    const [head, ...rest] = dropLeadingAssignments(tokenizeSegment(segment));
     if (head === undefined) {
         return undefined;
     }
@@ -167,3 +168,49 @@ function splitSegments(command) {
 function tokenize(element) {
     return element.split(/\s+/).filter((token) => token.length > 0);
 }
+function tokenizeSegment(segment) {
+    const tokens = [];
+    let current = '';
+    let quote;
+    let index = 0;
+    while (index < segment.length) {
+        const char = segment[index] ?? '';
+        if (quote !== undefined) {
+            if (char === '\\' && quote === '"') {
+                current += char + (segment[index + 1] ?? '');
+                index += 2;
+                continue;
+            }
+            current += char;
+            if (char === quote)
+                quote = undefined;
+            index += 1;
+            continue;
+        }
+        if (char === '\\') {
+            current += char + (segment[index + 1] ?? '');
+            index += 2;
+            continue;
+        }
+        if (QUOTES.has(char)) {
+            quote = char;
+            current += char;
+            index += 1;
+            continue;
+        }
+        if (TOKEN_SEPARATORS.has(char)) {
+            if (current !== '') {
+                tokens.push(current);
+            }
+            current = '';
+            index += 1;
+            continue;
+        }
+        current += char;
+        index += 1;
+    }
+    if (current !== '') {
+        tokens.push(current);
+    }
+    return tokens;
+}

package/dist/esm/taze.js

@@ -1,5 +1,7 @@
 const SHARED_POLICY = {
+    includeLocked: true,
     maturityPeriod: 7,
+    mode: 'minor',
 };
 export function defineConfig(config) {
     return { ...SHARED_POLICY, ...config };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.32.1",
+  "version": "0.32.2",
   "private": false,
   "description": "Context-aware script runner for pnpm monorepos",
   "keywords": [
@@ -73,9 +73,10 @@
     "prettier-plugin-sh": "0.19.0",
     "taze": "20.0.1",
     "yaml": "2.9.0",
-    "@williamthorsen/nmr-core": "0.10.1"
+    "@williamthorsen/nmr-core": "0.10.2"
   },
   "devDependencies": {
+    "@williamthorsen/toolbelt.filesystem": "0.6.0",
     "@williamthorsen/toolbelt.testing": "0.3.0",
     "@williamthorsen/toolbelt.vitest": "0.4.0",
     "prettier": "3.9.6",