@williamthorsen/nmr 0.32.1 → 0.33.0

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat — @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.29.0";
+export const __readyupVersion = "0.30.0";
 
 
 // .readyup/kits/default.ts
@@ -25,7 +25,7 @@ var ROOT_TYPECHECK_STEP = { run: "root:typecheck", declinesArgs: true };
 var workspaceScripts = {
   build: ["compile"],
   check: [TYPECHECK_STEP, "fmt:check", "lint:check", "test"],
-  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test:coverage"],
+  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test"],
   clean: "nmr-clean",
   compile: "nmr-compile",
   fix: ["lint", "fmt"],
@@ -43,9 +43,8 @@ var workspaceScripts = {
   "test:unit": "pnpm exec vitest --project unit",
   "test:watch": `pnpm exec vitest ${GATE_PROJECTS} --watch`,
   typecheck: "tsgo --noEmit",
-  // Without `--include-locked`, nothing would be reported in a repo that pins exact version numbers. The
-  // command is a string because neither half names an nmr command: both are binaries.
-  upgrade: "nmr-report-catalog && nmr-taze --include-locked",
+  // The command is a string because neither half names an nmr command: both are binaries.
+  upgrade: "nmr-report-catalog && nmr-taze",
   "view-coverage": "open coverage/index.html"
 };
 var rootScripts = {
@@ -54,7 +53,7 @@ var rootScripts = {
   "audit:prod": "pnpm exec v11y --prod",
   build: ["-R build"],
   check: [TYPECHECK_STEP, "fmt:check", "lint:check", "test"],
-  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test:coverage"],
+  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test"],
   // Excludes the audit, which in CI has a workflow of its own. The build is what the narrowed check runs
   // against, so it declines the arguments rather than being narrowed by them.
   ci: [{ run: "build", declinesArgs: true }, "check:strict"],
@@ -81,7 +80,7 @@ var rootScripts = {
   "root:typecheck": "tsgo --noEmit",
   // Carries the override report for the same reason `upgrade` does: both end in the tool that rewrites a
   // `pnpm.overrides` block, so both need the reporter's rejection ahead of them.
-  "root:upgrade": "nmr-report-overrides && nmr-taze --include-locked",
+  "root:upgrade": "nmr-report-overrides && nmr-taze",
   test: ["root:test", "-R test"],
   "test:all": ["root:test:all", "-R test:all"],
   "test:coverage": ["root:test", "-R test:coverage"],
@@ -93,7 +92,7 @@ var rootScripts = {
   typecheck: [ROOT_TYPECHECK_STEP, { run: "-R typecheck", declinesArgs: true }],
   // The command is a string because neither half names an nmr command: both are binaries, and a composite
   // element can name only a command.
-  upgrade: "nmr-report-overrides && nmr-taze --include-locked --recursive"
+  upgrade: "nmr-report-overrides && nmr-taze --recursive"
 };
 
 // src/resolve-scripts.ts
@@ -272,6 +271,13 @@ var default_default = defineRdyKit({
           check: () => prettierConfigBuildsOnSharedConfig(),
           fix: "Replace the Prettier config with: import { definePrettierConfig } from '@williamthorsen/nmr/prettier'; export default definePrettierConfig();"
         },
+        // -- Shared upgrade policy -----------------------------------------------
+        {
+          name: "taze.config.ts builds on @williamthorsen/nmr/taze",
+          severity: "warn",
+          check: () => tazeConfigBuildsOnSharedConfig(),
+          fix: "Replace the taze config with: import { defineConfig } from '@williamthorsen/nmr/taze'; export default defineConfig(); \u2014 nmr's upgrade policy reaches a repo only through this file, so without it `nmr upgrade` reports nothing where dependencies are pinned to exact versions"
+        },
         // -- Audit dependency --------------------------------------------------------
         {
           name: "v11y-check in devDependencies",
@@ -303,6 +309,8 @@ var CONFIG_EXTENSIONS = "{ts,mts,cts,js,mjs,cjs}";
 var SHARED_VITEST_MODULE = "@williamthorsen/nmr/vitest";
 var SHARED_PRETTIER_MODULE = "@williamthorsen/nmr/prettier";
 var INERT_PRETTIER_CONFIGS = [".prettierrc", ".prettierrc.{json,json5,yaml,yml,toml}"];
+var SHARED_TAZE_MODULE = "@williamthorsen/nmr/taze";
+var INERT_TAZE_CONFIGS = [".tazerc", ".tazerc.json", "taze.config.json"];
 var RE_EXPORT_LINE_PATTERN = /^export\s*(?:\{\s*default\s*}|\*)\s*from\s*['"]\.\.\/[^'"]*['"];?$/;
 var MIN_ESLINT_VERSION = "10.0.0";
 var MIN_STRICT_LINT_VERSION = "9.3.0";
@@ -394,7 +402,7 @@ function formatPaths(paths) {
 ${paths.map((path2) => `      ${path2}`).join("\n")}`;
 }
 function getMinVersion() {
-  const picked = { "version": "0.32.1" };
+  const picked = { "version": "0.33.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("nmr/package.json: 'version' must be a string");
   }
@@ -495,6 +503,22 @@ function readPnpmFieldKeys(content) {
 function resolvesVersionViaWorkspace(range) {
   return WORKSPACE_VERSION_MARKERS.some((marker) => range.startsWith(marker));
 }
+function tazeConfigBuildsOnSharedConfig(cwd = process.cwd()) {
+  const configs = findFiles([`taze.config.${CONFIG_EXTENSIONS}`], cwd);
+  if (configs.length === 0) {
+    return { ok: false, detail: describeMissingTazeConfig(cwd) };
+  }
+  const stale = configs.filter(
+    (relativePath) => !importsSharedExport(readFileIn(cwd, relativePath), "defineConfig", SHARED_TAZE_MODULE)
+  );
+  if (stale.length === 0) return true;
+  return { ok: false, detail: `does not import defineConfig from ${SHARED_TAZE_MODULE}: ${stale.join(", ")}` };
+}
+function describeMissingTazeConfig(cwd) {
+  const inert = findFiles(INERT_TAZE_CONFIGS, cwd);
+  if (inert.length > 0) return `holds no code to call the factory: ${inert.join(", ")}`;
+  return "taze.config.ts is missing";
+}
 function toolVersionsHasNoPnpm() {
   const content = readFile(".tool-versions");
   if (content === void 0) return true;
@@ -515,6 +539,7 @@ export {
   noReExportOnlyVitestConfigs,
   noRetiredVitestConfigs,
   prettierConfigBuildsOnSharedConfig,
+  tazeConfigBuildsOnSharedConfig,
   vitestConfigBuildsOnSharedConfig,
   vitestRootConfigBuildsOnSharedConfig
 };

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.1",
       "inputs": [
         {
-          "hash": "67afdcb4",
+          "hash": "904ac753",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "01e1f853",
+          "hash": "1cd4c58d",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -21,7 +21,7 @@
           ]
         },
         {
-          "hash": "3dfc2ee7",
+          "hash": "74bd7994",
           "kind": "module",
           "path": "../src/default-scripts.ts"
         },
@@ -38,10 +38,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.29.0",
+      "readyupVersion": "0.30.0",
       "source": "kits/default.ts",
-      "sourceHash": "67afdcb4",
-      "targetHash": "1fad8728"
+      "sourceHash": "904ac753",
+      "targetHash": "2b35e5fd"
     }
   ]
 }

package/README.md

@@ -3,15 +3,15 @@
 Context-aware script runner for pnpm monorepos. Ships an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.32.1 (2026-08-18)
+## Release notes — v0.33.0 (2026-08-20)
 
-### 🐛 Bug fixes
+### 🎉 Features
 
-- Reject a `package.json` entry that chains steps onto a self-reference (#707)
+- Drop the coverage step from the `check:strict` gate (#727)
 
-  Fixes an issue where a `package.json` script re-invoking its own command alongside other steps (such as `"build": "nmr build && rdy compile"`) silently lost those steps: nmr discarded the entry and ran its own `build` in its place, so `rdy compile` never ran. nmr now refuses to run the entry and reports the error.
+  Drops the coverage step from `check:strict` in both the workspace and root registries: The gate now runs `test` rather than `test:coverage`.
 
-  Separately, fixes an issue where the same chain written the other way round (e.g., `"build": "rdy compile && nmr build"`) was honored as an ordinary override, causing infinite recursion.
+  Coverage is still available as `nmr test:coverage`, run as a separate step.
 <!-- /section:release-notes -->
 
 ## Installation
@@ -135,7 +135,7 @@ A string value is spawned through a shell as one command, so an `nmr` invocation
 
 The line names the declaration it is an edit to — the file, the field, and the key — and its remedy follows from that site. A `.config/nmr.config.ts` entry keeps its nmr steps as a step list and moves anything else to a `<command>:pre` or `<command>:post` script: a step-list element is composed into `nmr <element>`, so it can name only an nmr command. A `package.json` entry has to go, since `package.json` holds no step list: delete it outright when it restates what nmr already runs for that command, and move the steps it adds to a `<command>:pre` or `<command>:post` script when they are the package's own. Where the registry defines no such command, both apply: name the command in `.config/nmr.config.ts`, and put the package-specific steps in a hook. The pair is named rather than `:post` alone because an entry's extra steps may run on either side of the chain: `rdy verify && nmr compile` puts them first. A hook is the exception at both tiers: nmr wraps a `:pre` or `:post` script in no hooks of its own, so a hook's other steps become a script of their own that the step list names.
 
-nmr recognizes `nmr` in command position: at the start of a step, after an unquoted `&&`, `||`, `;`, `|`, or a newline, and behind `npx`, `bunx`, or an `exec`, `dlx`, or `x` subcommand of `npm`, `pnpm`, `yarn`, or `bun`. This line reports a boundary rather than enforcing a rule — it covers a step nmr runs as written, and only the reporting of the nested run is degraded — and it stays partial in stated ways: a value-taking flag standing immediately before the program name hides it (`npx -p foo nmr`), a launcher outside that set goes unreported, and a `devBin` substitution that introduces `nmr` itself is not reported, the line being an edit to a declaration rather than to a substitution.
+nmr recognizes `nmr` in command position: at the start of a step, after an unquoted `&&`, `||`, `;`, `|`, or a newline, past any leading `NAME=value` assignments, and behind `npx`, `bunx`, or an `exec`, `dlx`, or `x` subcommand of `npm`, `pnpm`, `yarn`, or `bun`. This line reports a boundary rather than enforcing a rule — it covers a step nmr runs as written, and only the reporting of the nested run is degraded — and it stays partial in stated ways: a value-taking flag standing immediately before the program name hides it (`npx -p foo nmr`), a launcher outside that set goes unreported, and a `devBin` substitution that introduces `nmr` itself is not reported, the line being an edit to a declaration rather than to a substitution.
 
 A [self-referential `package.json` entry](#three-tier-override-system) is the shape nmr cannot run as written, and it is rejected rather than reported. The same recognition finds it, so the same residuals apply — what goes unrecognized there re-enters nmr without bound, which hangs rather than passing quietly.
 
@@ -307,7 +307,7 @@ A check that passed on a working tree passes again on the same working tree. nmr
 
 ```console
 $ nmr ci
-# ... four minutes of build, typecheck, lint, and coverage ...
+# ... four minutes of build, typecheck, lint, and tests ...
 
 $ nmr ci
 ⏭️ node-monorepo-tools: ci: passed 2m ago on this tree, saved ~4m
@@ -402,7 +402,7 @@ $ nmr check
 ⏭️ nmr-core: check: passed 3m ago on this tree, saved ~48s — replayed: nmr-core: fmt:check: All matched files use Prettier code style!; nmr-core: test: Test Files 6 passed (6) Tests 41 passed (41)
 ```
 
-The assembly is flat: a constituent that is itself a composite contributes its own leaves' lines, so a skipped `ci` replays a package's `test:coverage` rather than one opaque `check:strict` line. A delegate expands into the scopes it fans out to, and a constituent that recorded no excerpt is absent rather than inferred: `typecheck` and `lint:check` print nothing on success and contribute nothing above, and a command outside the [cacheable set](#what-is-cached) records nothing at all, so `ci` replays what `check:strict` earned and nothing for `build`.
+The assembly is flat: a constituent that is itself a composite contributes its own leaves' lines, so a skipped `ci` replays a package's `test` rather than one opaque `check:strict` line. A delegate expands into the scopes it fans out to, and a constituent that recorded no excerpt is absent rather than inferred: `typecheck` and `lint:check` print nothing on success and contribute nothing above, and a command outside the [cacheable set](#what-is-cached) records nothing at all, so `ci` replays what `check:strict` earned and nothing for `build`.
 
 It is assembled when the composite records its pass rather than when it skips, so every excerpt in it was certified during that one run, on that one tree. `NMR_RUN_ID` is what makes that provable; see [reserved environment variables](#reserved-environment-variables).
 
@@ -534,8 +534,8 @@ A `pnpm.overrides` block left in the root `package.json` fails the command inste
 The upgrade tool ([taze](https://github.com/antfu-collective/taze)) arrives with nmr, so your repo declares no dependency on it. Everything after the command name is passed through, including the range mode:
 
 ```bash
-nmr upgrade         # upgrades available within each package's version ceilings
-nmr upgrade major   # major upgrades, still inside the ceilings
+nmr upgrade         # minor and patch upgrades, regardless of the range each dependency declares
+nmr upgrade major   # major upgrades, for dependencies carrying no per-package ceiling
 nmr upgrade --write # apply the proposals to package.json
 ```
 
@@ -554,11 +554,16 @@ export default defineConfig({
 });
 ```
 
-`defineConfig` supplies nmr's shared upgrade policy — currently a seven-day quarantine on brand-new releases — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`.
+`defineConfig` supplies nmr's shared upgrade policy — a seven-day quarantine on brand-new releases, and the pair of settings that report a dependency pinned to an exact version: locked dependencies are included, and the range searched is `minor` — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`. `mode` is the exception: the upgrade tool carries a default of its own for it, and clearing nmr's leaves no valid range to search, so name a mode instead.
 
 Everything the [taze configuration](https://github.com/antfu-collective/taze#config-file) accepts is accepted here.
 
-> **Note:** `--include-locked` is part of both registry entries because a repo that pins dependencies to exact versions (pnpm's `savePrefix: ''`) has no dependency the tool would otherwise consider — without it, an upgrade pass reports nothing at all. Drop it via `.config/nmr.config.ts` if your repo declares version ranges instead.
+> **Note:** This file is what activates nmr's upgrade policy at all. A repo without one gets neither the release quarantine nor the settings that report a dependency pinned to an exact version, and `nmr upgrade` reports nothing in a repo using pnpm's `savePrefix: ''`. nmr's ReadyUp kit warns when the file is missing.
+
+Two consequences of the `minor` range mode the policy declares:
+
+- A `packageMode` entry is honored only by the pass whose mode matches it, or by a `default` pass; every other pass drops that dependency rather than narrowing it. Under the policy's `minor` mode, a `patch` ceiling hides its dependency until you run `nmr upgrade patch`, and a `minor` ceiling hides it from `nmr upgrade major`.
+- A `~` range is searched as `^`, so minor upgrades are proposed for it and `--write` applies them under the original `~`. To hold one dependency to patches, give it a `packageMode` entry of `patch` and read it from `nmr upgrade patch`; to hold the whole repo there, declare `mode: 'patch'`.
 
 ## Default script registries
 
@@ -570,7 +575,7 @@ These scripts are available out of the box. Repo-wide config (tier 2) and per-pa
 | ---------------- | ----------------------------------------------------------- |
 | `build`          | `compile`                                                   |
 | `check`          | `typecheck`, `fmt:check`, `lint:check`, `test`              |
-| `check:strict`   | `typecheck`, `fmt:check`, `lint:strict`, `test:coverage`    |
+| `check:strict`   | `typecheck`, `fmt:check`, `lint:strict`, `test`             |
 | `clean`          | `nmr-clean`                                                 |
 | `compile`        | `nmr-compile`                                               |
 | `fix`            | `lint`, `fmt`                                               |
@@ -588,7 +593,7 @@ These scripts are available out of the box. Repo-wide config (tier 2) and per-pa
 | `test:unit`      | `pnpm exec vitest --project unit`                           |
 | `test:watch`     | `pnpm exec vitest --project unit --project tool --watch`    |
 | `typecheck`      | `tsgo --noEmit`                                             |
-| `upgrade`        | `nmr-report-catalog && nmr-taze --include-locked`           |
+| `upgrade`        | `nmr-report-catalog && nmr-taze`                            |
 | `view-coverage`  | `open coverage/index.html`                                  |
 
 `fmt` and `fmt:check` select their files through git rather than by walking the directory, which is what makes a package-level run and a root-level run apply the same ignore rules — see [file selection](#file-selection).
@@ -631,10 +636,12 @@ Neither is bound to a git hook. `prepush` is named for when you run it, not for
 
 #### Check and quality
 
-| Command        | Runs                                                     |
-| -------------- | -------------------------------------------------------- |
-| `check`        | `typecheck`, `fmt:check`, `lint:check`, `test`           |
-| `check:strict` | `typecheck`, `fmt:check`, `lint:strict`, `test:coverage` |
+| Command        | Runs                                            |
+| -------------- | ----------------------------------------------- |
+| `check`        | `typecheck`, `fmt:check`, `lint:check`, `test`  |
+| `check:strict` | `typecheck`, `fmt:check`, `lint:strict`, `test` |
+
+Neither gate computes coverage: Instrumentation multiplies the wall time of the run they exist to keep short. Coverage is [`test:coverage`](#test-selections), run as a step of its own; a repo that wants it inside the gate [overrides](#configuration) `check:strict`.
 
 #### Fix
 
@@ -702,9 +709,9 @@ A file git ignores is never formatted, even when named directly. Trailing argume
 
 #### Dependencies
 
-| Command   | Runs                                                            |
-| --------- | --------------------------------------------------------------- |
-| `upgrade` | `nmr-report-overrides && nmr-taze --include-locked --recursive` |
+| Command   | Runs                                           |
+| --------- | ---------------------------------------------- |
+| `upgrade` | `nmr-report-overrides && nmr-taze --recursive` |
 
 See [dependency upgrades](#dependency-upgrades) for the workflow and its configuration.
 
@@ -723,7 +730,7 @@ These scripts operate on root-level code only (not workspace packages):
 | `root:test:tool`   | `vitest --config ./vitest.root.config.ts --project tool`                |
 | `root:test:unit`   | `vitest --config ./vitest.root.config.ts --project unit`                |
 | `root:typecheck`   | `tsgo --noEmit`                                                         |
-| `root:upgrade`     | `nmr-report-overrides && nmr-taze --include-locked`                     |
+| `root:upgrade`     | `nmr-report-overrides && nmr-taze`                                      |
 
 #### Utilities
 
@@ -875,7 +882,7 @@ Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool
 Under pnpm's isolated `node_modules`, a transitive package's binary is absent from the consuming repo's `node_modules/.bin`, so a repo that depends on nmr cannot run `taze` directly. `nmr-taze` can, because nmr is a direct dependency, and it resolves the tool from the tree nmr controls.
 
 ```bash
-nmr-taze --include-locked --recursive
+nmr-taze --recursive
 ```
 
 ### `ensure-prepublish-hooks`

package/dist/esm/default-scripts.js

@@ -4,7 +4,7 @@ const ROOT_TYPECHECK_STEP = { run: 'root:typecheck', declinesArgs: true };
 export const workspaceScripts = {
     build: ['compile'],
     check: [TYPECHECK_STEP, 'fmt:check', 'lint:check', 'test'],
-    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test:coverage'],
+    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test'],
     clean: 'nmr-clean',
     compile: 'nmr-compile',
     fix: ['lint', 'fmt'],
@@ -22,7 +22,7 @@ export const workspaceScripts = {
     'test:unit': 'pnpm exec vitest --project unit',
     'test:watch': `pnpm exec vitest ${GATE_PROJECTS} --watch`,
     typecheck: 'tsgo --noEmit',
-    upgrade: 'nmr-report-catalog && nmr-taze --include-locked',
+    upgrade: 'nmr-report-catalog && nmr-taze',
     'view-coverage': 'open coverage/index.html',
 };
 export const rootScripts = {
@@ -31,7 +31,7 @@ export const rootScripts = {
     'audit:prod': 'pnpm exec v11y --prod',
     build: ['-R build'],
     check: [TYPECHECK_STEP, 'fmt:check', 'lint:check', 'test'],
-    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test:coverage'],
+    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test'],
     ci: [{ run: 'build', declinesArgs: true }, 'check:strict'],
     clean: 'nmr-clean',
     fix: ['lint', 'fmt'],
@@ -52,7 +52,7 @@ export const rootScripts = {
     'root:test:tool': 'vitest --config ./vitest.root.config.ts --project tool',
     'root:test:unit': 'vitest --config ./vitest.root.config.ts --project unit',
     'root:typecheck': 'tsgo --noEmit',
-    'root:upgrade': 'nmr-report-overrides && nmr-taze --include-locked',
+    'root:upgrade': 'nmr-report-overrides && nmr-taze',
     test: ['root:test', '-R test'],
     'test:all': ['root:test:all', '-R test:all'],
     'test:coverage': ['root:test', '-R test:coverage'],
@@ -60,5 +60,5 @@ export const rootScripts = {
     'test:unit': ['root:test:unit', '-R test:unit'],
     'test:watch': `vitest ${GATE_PROJECTS} --watch`,
     typecheck: [ROOT_TYPECHECK_STEP, { run: '-R typecheck', declinesArgs: true }],
-    upgrade: 'nmr-report-overrides && nmr-taze --include-locked --recursive',
+    upgrade: 'nmr-report-overrides && nmr-taze --recursive',
 };

package/dist/esm/steps.js

@@ -10,6 +10,7 @@ const LAUNCHERS = new Map([
 const QUOTES = new Set(['"', "'"]);
 const SEGMENT_SEPARATORS = new Set([';', '|', '&', '\n', '\r']);
 const SHELL_SAFE_TOKEN = /^[\w@%+=:,./-]+$/;
+const TOKEN_SEPARATORS = new Set([' ', '\t', '\n', '\r']);
 export function composeNmrStep(element, workspaceRoot, declinesArgs = false) {
     const flags = workspaceRoot ? ['-w'] : [];
     return { kind: 'structural', argv: ['nmr', ...flags, ...tokenize(element)], ...(declinesArgs && { declinesArgs }) };
@@ -65,7 +66,7 @@ function quoteToken(token) {
     return "'" + token.replaceAll("'", String.raw `'\''`) + "'";
 }
 function readNmrTail(segment) {
-    const [head, ...rest] = dropLeadingAssignments(tokenize(segment));
+    const [head, ...rest] = dropLeadingAssignments(tokenizeSegment(segment));
     if (head === undefined) {
         return undefined;
     }
@@ -167,3 +168,49 @@ function splitSegments(command) {
 function tokenize(element) {
     return element.split(/\s+/).filter((token) => token.length > 0);
 }
+function tokenizeSegment(segment) {
+    const tokens = [];
+    let current = '';
+    let quote;
+    let index = 0;
+    while (index < segment.length) {
+        const char = segment[index] ?? '';
+        if (quote !== undefined) {
+            if (char === '\\' && quote === '"') {
+                current += char + (segment[index + 1] ?? '');
+                index += 2;
+                continue;
+            }
+            current += char;
+            if (char === quote)
+                quote = undefined;
+            index += 1;
+            continue;
+        }
+        if (char === '\\') {
+            current += char + (segment[index + 1] ?? '');
+            index += 2;
+            continue;
+        }
+        if (QUOTES.has(char)) {
+            quote = char;
+            current += char;
+            index += 1;
+            continue;
+        }
+        if (TOKEN_SEPARATORS.has(char)) {
+            if (current !== '') {
+                tokens.push(current);
+            }
+            current = '';
+            index += 1;
+            continue;
+        }
+        current += char;
+        index += 1;
+    }
+    if (current !== '') {
+        tokens.push(current);
+    }
+    return tokens;
+}

package/dist/esm/taze.js

@@ -1,5 +1,7 @@
 const SHARED_POLICY = {
+    includeLocked: true,
     maturityPeriod: 7,
+    mode: 'minor',
 };
 export function defineConfig(config) {
     return { ...SHARED_POLICY, ...config };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.32.1",
+  "version": "0.33.0",
   "private": false,
   "description": "Context-aware script runner for pnpm monorepos",
   "keywords": [
@@ -73,13 +73,14 @@
     "prettier-plugin-sh": "0.19.0",
     "taze": "20.0.1",
     "yaml": "2.9.0",
-    "@williamthorsen/nmr-core": "0.10.1"
+    "@williamthorsen/nmr-core": "0.10.2"
   },
   "devDependencies": {
+    "@williamthorsen/toolbelt.filesystem": "0.6.0",
     "@williamthorsen/toolbelt.testing": "0.3.0",
     "@williamthorsen/toolbelt.vitest": "0.4.0",
     "prettier": "3.9.6",
-    "readyup": "0.29.0",
+    "readyup": "0.30.0",
     "tinyglobby": "0.2.17",
     "typescript": "6.0.3",
     "vitest": "4.1.10"