@williamthorsen/nmr 0.32.2 → 0.34.0

package/.readyup/kits/default.js

@@ -1,10 +1,10 @@
 /** @noformat — @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.29.0";
+export const __readyupVersion = "0.32.0";
 
 
 // .readyup/kits/default.ts
-import { existsSync, globSync, readdirSync as readdirSync2, readFileSync } from "node:fs";
+import { existsSync, globSync, readdirSync as readdirSync2 } from "node:fs";
 import { basename, join, sep } from "node:path";
 import { defineRdyKit } from "readyup";
 import {
@@ -25,7 +25,7 @@ var ROOT_TYPECHECK_STEP = { run: "root:typecheck", declinesArgs: true };
 var workspaceScripts = {
   build: ["compile"],
   check: [TYPECHECK_STEP, "fmt:check", "lint:check", "test"],
-  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test:coverage"],
+  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test"],
   clean: "nmr-clean",
   compile: "nmr-compile",
   fix: ["lint", "fmt"],
@@ -53,7 +53,7 @@ var rootScripts = {
   "audit:prod": "pnpm exec v11y --prod",
   build: ["-R build"],
   check: [TYPECHECK_STEP, "fmt:check", "lint:check", "test"],
-  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test:coverage"],
+  "check:strict": [TYPECHECK_STEP, "fmt:check", "lint:strict", "test"],
   // Excludes the audit, which in CI has a workflow of its own. The build is what the narrowed check runs
   // against, so it declines the arguments rather than being narrowed by them.
   ci: [{ run: "build", declinesArgs: true }, "check:strict"],
@@ -278,6 +278,13 @@ var default_default = defineRdyKit({
           check: () => tazeConfigBuildsOnSharedConfig(),
           fix: "Replace the taze config with: import { defineConfig } from '@williamthorsen/nmr/taze'; export default defineConfig(); \u2014 nmr's upgrade policy reaches a repo only through this file, so without it `nmr upgrade` reports nothing where dependencies are pinned to exact versions"
         },
+        {
+          name: "taze config declares no option taze discards",
+          severity: "warn",
+          quiet: true,
+          check: () => tazeConfigAvoidsClobberedOptions(),
+          fix: "Set these through the upgrade script instead, as rootScripts: { upgrade: 'nmr-report-overrides && nmr-taze --recursive --request-timeout 90000' } in .config/nmr.config.ts, keeping the rest of the default script \u2014 taze's CLI writes a default for each of them over whatever the config file declares, so the value there never reaches taze (antfu-collective/taze#317). nmr already forwards a 30-second request timeout"
+        },
         // -- Audit dependency --------------------------------------------------------
         {
           name: "v11y-check in devDependencies",
@@ -311,6 +318,13 @@ var SHARED_PRETTIER_MODULE = "@williamthorsen/nmr/prettier";
 var INERT_PRETTIER_CONFIGS = [".prettierrc", ".prettierrc.{json,json5,yaml,yml,toml}"];
 var SHARED_TAZE_MODULE = "@williamthorsen/nmr/taze";
 var INERT_TAZE_CONFIGS = [".tazerc", ".tazerc.json", "taze.config.json"];
+var CLOBBERED_TAZE_OPTIONS = [
+  { key: "concurrency", pattern: /\bconcurrency\s*:/ },
+  { key: "githubActions", pattern: /\bgithubActions\s*:\s*(?:false|\{)/ },
+  { key: "ignoreOtherWorkspaces", pattern: /\bignoreOtherWorkspaces\s*:\s*false/ },
+  { key: "nodeVersion", pattern: /\bnodeVersion\s*:\s*false/ },
+  { key: "requestTimeout", pattern: /\brequestTimeout\s*:/ }
+];
 var RE_EXPORT_LINE_PATTERN = /^export\s*(?:\{\s*default\s*}|\*)\s*from\s*['"]\.\.\/[^'"]*['"];?$/;
 var MIN_ESLINT_VERSION = "10.0.0";
 var MIN_STRICT_LINT_VERSION = "9.3.0";
@@ -402,7 +416,7 @@ function formatPaths(paths) {
 ${paths.map((path2) => `      ${path2}`).join("\n")}`;
 }
 function getMinVersion() {
-  const picked = { "version": "0.32.2" };
+  const picked = { "version": "0.34.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("nmr/package.json: 'version' must be a string");
   }
@@ -482,11 +496,7 @@ function noWorkspaceRunScriptReferences() {
   };
 }
 function readFileIn(cwd, relativePath) {
-  try {
-    return readFileSync(join(cwd, relativePath), "utf8");
-  } catch {
-    return void 0;
-  }
+  return readFile(join(cwd, relativePath));
 }
 function readPnpmFieldKeys(content) {
   if (content === void 0) return void 0;
@@ -514,6 +524,18 @@ function tazeConfigBuildsOnSharedConfig(cwd = process.cwd()) {
   if (stale.length === 0) return true;
   return { ok: false, detail: `does not import defineConfig from ${SHARED_TAZE_MODULE}: ${stale.join(", ")}` };
 }
+function tazeConfigAvoidsClobberedOptions(cwd = process.cwd()) {
+  const configs = findFiles([`taze.config.${CONFIG_EXTENSIONS}`], cwd);
+  const findings = [];
+  for (const relativePath of configs) {
+    const content = readFileIn(cwd, relativePath);
+    if (content === void 0) continue;
+    const discarded = CLOBBERED_TAZE_OPTIONS.filter(({ pattern }) => pattern.test(content)).map(({ key }) => key);
+    if (discarded.length > 0) findings.push(`${relativePath}: ${discarded.join(", ")}`);
+  }
+  if (findings.length === 0) return true;
+  return { ok: false, detail: formatPaths(findings) };
+}
 function describeMissingTazeConfig(cwd) {
   const inert = findFiles(INERT_TAZE_CONFIGS, cwd);
   if (inert.length > 0) return `holds no code to call the factory: ${inert.join(", ")}`;
@@ -539,6 +561,7 @@ export {
   noReExportOnlyVitestConfigs,
   noRetiredVitestConfigs,
   prettierConfigBuildsOnSharedConfig,
+  tazeConfigAvoidsClobberedOptions,
   tazeConfigBuildsOnSharedConfig,
   vitestConfigBuildsOnSharedConfig,
   vitestRootConfigBuildsOnSharedConfig

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.1",
       "inputs": [
         {
-          "hash": "904ac753",
+          "hash": "f58e8934",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "cca25de2",
+          "hash": "cbbd2a2c",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -21,7 +21,7 @@
           ]
         },
         {
-          "hash": "94bb3c62",
+          "hash": "74bd7994",
           "kind": "module",
           "path": "../src/default-scripts.ts"
         },
@@ -38,10 +38,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.29.0",
+      "readyupVersion": "0.32.0",
       "source": "kits/default.ts",
-      "sourceHash": "904ac753",
-      "targetHash": "bc4d49d1"
+      "sourceHash": "f58e8934",
+      "targetHash": "debdcb6e"
     }
   ]
 }

package/README.md

@@ -3,19 +3,25 @@
 Context-aware script runner for pnpm monorepos. Ships an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.32.2 (2026-08-19)
+## Release notes — v0.34.0 (2026-08-24)
 
-### 🐛 Bug fixes
+### 🎉 Features
+
+- 🚨 **Breaking:** Make defineVitestConfig resolve from source and isolate git (#749)
+
+  Adds two defaults to `defineVitestConfig` and `defineRootVitestConfig` in `@williamthorsen/nmr/vitest`: Workspace packages resolve through their `source` export condition, so a suite runs without a prior build; and every project loads a setup file that keeps the developer's git configuration out of the subprocesses a test spawns.
 
-- Recognize nmr behind a quoted environment assignment (#709)
+  Each is individually opt-out-able through the new `isolateGit` and `resolveFromSource` options. A consumer's own `resolve.conditions` and `setupFiles` compose alongside what the factory supplies.
 
-  Fixes an issue where a `package.json` entry that re-invoked its own command from behind an environment assignment whose quoted value carried a space (e.g., `"build": "NODE_OPTIONS=\"--a --b\" nmr build"`) caused nmr to hang.
+  Migration: A workspace package declaring a `source` condition is resolved from source in tests that previously read its `dist`. A package that publishes only its build output takes a bespoke condition name instead, as `@williamthorsen/nmr-core` does with `nmr-source`.
 
-- Restore upgrade reporting for repos that pin exact versions (#720)
+### 🐛 Bug fixes
+
+- Stop nmr upgrade from timing out against a proxying registry (#744)
 
-  Fixes an issue where `nmr upgrade` reported nothing in a repo that pins dependencies to exact versions, however far behind the tree was. nmr's shared upgrade policy now supplies both settings the upgrade tool needs to report a bare pin -- locked dependencies are included, and the range searched is `minor` -- and the default `upgrade` scripts no longer pass `--include-locked`, which went inert on its own in taze 20.0.1. The policy reaches a repo only through a `taze.config.ts` calling `defineConfig`, and nmr's ReadyUp kit now warns when a repo carries none.
+  Fixes an issue where `nmr upgrade` timed out intermittently against a registry that proxies npm. Every `upgrade` script now calls taze with a 30-second request timeout in place of the 5-second default; a different request timeout specified by the caller is respected.
 
-  The `minor` range mode applies to every dependency, not only a pinned one: a `~` range is searched as `^`, so minor upgrades are proposed for it, and a `packageMode` entry other than `minor` drops its dependency from a default pass rather than narrowing it.
+  The ReadyUp kit bundled with nmr now warns when a taze config sets a value that the taze CLI will not use.
 <!-- /section:release-notes -->
 
 ## Installation
@@ -311,7 +317,7 @@ A check that passed on a working tree passes again on the same working tree. nmr
 
 ```console
 $ nmr ci
-# ... four minutes of build, typecheck, lint, and coverage ...
+# ... four minutes of build, typecheck, lint, and tests ...
 
 $ nmr ci
 ⏭️ node-monorepo-tools: ci: passed 2m ago on this tree, saved ~4m
@@ -406,7 +412,7 @@ $ nmr check
 ⏭️ nmr-core: check: passed 3m ago on this tree, saved ~48s — replayed: nmr-core: fmt:check: All matched files use Prettier code style!; nmr-core: test: Test Files 6 passed (6) Tests 41 passed (41)
 ```
 
-The assembly is flat: a constituent that is itself a composite contributes its own leaves' lines, so a skipped `ci` replays a package's `test:coverage` rather than one opaque `check:strict` line. A delegate expands into the scopes it fans out to, and a constituent that recorded no excerpt is absent rather than inferred: `typecheck` and `lint:check` print nothing on success and contribute nothing above, and a command outside the [cacheable set](#what-is-cached) records nothing at all, so `ci` replays what `check:strict` earned and nothing for `build`.
+The assembly is flat: a constituent that is itself a composite contributes its own leaves' lines, so a skipped `ci` replays a package's `test` rather than one opaque `check:strict` line. A delegate expands into the scopes it fans out to, and a constituent that recorded no excerpt is absent rather than inferred: `typecheck` and `lint:check` print nothing on success and contribute nothing above, and a command outside the [cacheable set](#what-is-cached) records nothing at all, so `ci` replays what `check:strict` earned and nothing for `build`.
 
 It is assembled when the composite records its pass rather than when it skips, so every excerpt in it was certified during that one run, on that one tree. `NMR_RUN_ID` is what makes that provable; see [reserved environment variables](#reserved-environment-variables).
 
@@ -560,7 +566,7 @@ export default defineConfig({
 
 `defineConfig` supplies nmr's shared upgrade policy — a seven-day quarantine on brand-new releases, and the pair of settings that report a dependency pinned to an exact version: locked dependencies are included, and the range searched is `minor` — so your config carries only what is specific to your repo. Any setting you declare wins over nmr's default. Passing `undefined` clears a default rather than falling back to it, which is how you hand the quarantine policy back to `pnpm-workspace.yaml`'s `minimumReleaseAge`. `mode` is the exception: the upgrade tool carries a default of its own for it, and clearing nmr's leaves no valid range to search, so name a mode instead.
 
-Everything the [taze configuration](https://github.com/antfu-collective/taze#config-file) accepts is accepted here.
+Everything the [taze configuration](https://github.com/antfu-collective/taze#config-file) accepts is accepted here, with five exceptions that reach the upgrade tool from no config file at all: `concurrency`, `githubActions`, `ignoreOtherWorkspaces`, `nodeVersion`, and `requestTimeout`. The tool's CLI writes a default for each of them over whatever the config declares ([taze#317](https://github.com/antfu-collective/taze/issues/317)), so the command line is the only place they can be set. nmr's ReadyUp kit warns when your config declares one, and [request timeout](#request-timeout) below shows how to set it instead.
 
 > **Note:** This file is what activates nmr's upgrade policy at all. A repo without one gets neither the release quarantine nor the settings that report a dependency pinned to an exact version, and `nmr upgrade` reports nothing in a repo using pnpm's `savePrefix: ''`. nmr's ReadyUp kit warns when the file is missing.
 
@@ -569,6 +575,32 @@ Two consequences of the `minor` range mode the policy declares:
 - A `packageMode` entry is honored only by the pass whose mode matches it, or by a `default` pass; every other pass drops that dependency rather than narrowing it. Under the policy's `minor` mode, a `patch` ceiling hides its dependency until you run `nmr upgrade patch`, and a `minor` ceiling hides it from `nmr upgrade major`.
 - A `~` range is searched as `^`, so minor upgrades are proposed for it and `--write` applies them under the original `~`. To hold one dependency to patches, give it a `packageMode` entry of `patch` and read it from `nmr upgrade patch`; to hold the whole repo there, declare `mode: 'patch'`.
 
+### Request timeout
+
+Every `upgrade` script reaches the upgrade tool with a 30-second request timeout, in place of the tool's own 5 seconds.
+
+Five seconds is too tight for a registry that proxies npm. The tool fetches a full packument whenever the resolved registry is not `registry.npmjs.org`, and a large one runs to tens of megabytes; the budget covers the whole retry chain rather than a single attempt, so one slow response ends the run with `Timeout requesting "<package>"`. The symptom is an upgrade pass that succeeds or fails according to how warm the tool's cache happens to be.
+
+Pass a different value for one run:
+
+```bash
+nmr upgrade --request-timeout 90000
+```
+
+To change it for every run, override the `upgrade` script in `.config/nmr.config.ts`, keeping the rest of the default. This is nmr's own config, not the `taze.config.ts` above; taze ignores a `rootScripts` key, and nothing reports it:
+
+```ts
+import { defineConfig } from '@williamthorsen/nmr/config';
+
+export default defineConfig({
+  rootScripts: {
+    upgrade: 'nmr-report-overrides && nmr-taze --recursive --request-timeout 90000',
+  },
+});
+```
+
+The override is one command string rather than a list of steps, because a composite element names an nmr command and both halves here are binaries.
+
 ## Default script registries
 
 These scripts are available out of the box. Repo-wide config (tier 2) and per-package overrides (tier 3) can add to or replace any of them.
@@ -579,7 +611,7 @@ These scripts are available out of the box. Repo-wide config (tier 2) and per-pa
 | ---------------- | ----------------------------------------------------------- |
 | `build`          | `compile`                                                   |
 | `check`          | `typecheck`, `fmt:check`, `lint:check`, `test`              |
-| `check:strict`   | `typecheck`, `fmt:check`, `lint:strict`, `test:coverage`    |
+| `check:strict`   | `typecheck`, `fmt:check`, `lint:strict`, `test`             |
 | `clean`          | `nmr-clean`                                                 |
 | `compile`        | `nmr-compile`                                               |
 | `fix`            | `lint`, `fmt`                                               |
@@ -640,10 +672,12 @@ Neither is bound to a git hook. `prepush` is named for when you run it, not for
 
 #### Check and quality
 
-| Command        | Runs                                                     |
-| -------------- | -------------------------------------------------------- |
-| `check`        | `typecheck`, `fmt:check`, `lint:check`, `test`           |
-| `check:strict` | `typecheck`, `fmt:check`, `lint:strict`, `test:coverage` |
+| Command        | Runs                                            |
+| -------------- | ----------------------------------------------- |
+| `check`        | `typecheck`, `fmt:check`, `lint:check`, `test`  |
+| `check:strict` | `typecheck`, `fmt:check`, `lint:strict`, `test` |
+
+Neither gate computes coverage: Instrumentation multiplies the wall time of the run they exist to keep short. Coverage is [`test:coverage`](#test-selections), run as a step of its own; a repo that wants it inside the gate [overrides](#configuration) `check:strict`.
 
 #### Fix
 
@@ -879,7 +913,7 @@ nmr-fmt --write packages/nmr
 
 ### `nmr-taze`
 
-Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool, forwarding every argument to it untouched. This is what every `upgrade` chain ends with, `root:upgrade` included — see [dependency upgrades](#dependency-upgrades) for the workflow.
+Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool, forwarding every argument to it untouched and adding one of its own: a 30-second request timeout, unless the invocation already carries one. This is what every `upgrade` chain ends with, `root:upgrade` included — see [dependency upgrades](#dependency-upgrades) for the workflow, and [request timeout](#request-timeout) for why the timeout is set here.
 
 Under pnpm's isolated `node_modules`, a transitive package's binary is absent from the consuming repo's `node_modules/.bin`, so a repo that depends on nmr cannot run `taze` directly. `nmr-taze` can, because nmr is a direct dependency, and it resolves the tool from the tree nmr controls.
 
@@ -1060,6 +1094,25 @@ Every tier above `unit` carries a 30-second `testTimeout` and `hookTimeout`, whe
 
 To raise a budget for one tier and no other, use the `tiers` seam below. The `project` seam merges over both budgets as well, but like every option passed through it the value reaches all four projects at once -- raising a tier's budget raises `unit`'s with it. To lift the ceiling for a single file rather than a whole tier, pass a timeout to the individual test or hook, which stays the narrower tool.
 
+### What the config supplies
+
+Two settings a workspace test runner needs almost universally are part of what the factory produces, so a config file declares neither:
+
+- **Workspace packages resolve from source.** `source` leads the emitted `resolve.conditions` and `ssr.resolve.conditions`, so a cross-package import reaches the dependency's `.ts` rather than its `dist/` and a suite runs without a prior build. A package declaring no such condition is unaffected.
+- **Git subprocesses are isolated.** Every project loads a setup file that points `GIT_CONFIG_GLOBAL` and `GIT_CONFIG_SYSTEM` at the null device and sets `GIT_CONFIG_NOSYSTEM`, so a test that spawns `git` reads neither the developer's identity nor a signing config that can block on a passphrase. It leads each project's `setupFiles`, ahead of every entry the layers add, because a shared setup establishes the environment the rest run in.
+
+Both defaults exist because omitting either is silent rather than loud: the tiers still exist and the suite still runs green, testing `dist/` and the developer's git identity instead. Turn either off through its own option, which folds across layers like any other, the last layer to declare it winning:
+
+```ts
+export default defineVitestConfig({ isolateGit: false, resolveFromSource: false });
+```
+
+`resolveFromSource: false` is for a repo that resolves a `source` condition it does not want in tests; `isolateGit: false` is for a suite meant to read the developer's own git configuration.
+
+**Vite replaces its condition defaults rather than extending them.** A config writing `conditions: ['source']` by hand therefore drops `module`, so a dependency exposing a `module` entry falls through to whatever its `exports` lists next. A replaced list still resolves `node` and `development` under Vitest, which is why nothing in a test run reports the loss. The factory emits `source` alongside Vite's defaults for each environment, so a config declaring no conditions of its own starts from a complete list.
+
+**A package declaring a `source` condition must ship its sources.** Every nmr consumer now resolves that condition, so a published package whose `files` carries `dist` alone resolves to a path that is not in the tarball. A package that publishes only its build output takes a bespoke condition name instead, the way `@williamthorsen/nmr-core` uses `nmr-source` for the build's own bootstrap.
+
 ### Customizing by scope
 
 Vitest applies some options at the root of a `projects` config and others per project, and placing one at the wrong level is silent rather than loud. The factory therefore takes separate override surfaces instead of one merged config:
@@ -1067,7 +1120,7 @@ Vitest applies some options at the root of a `projects` config and others per pr
 ```ts
 export default defineVitestConfig({
   // Vite-level options, plus the test options Vitest honours only at the root.
-  root: { resolve: { conditions: ['development'] } },
+  root: { ssr: { resolve: { conditions: ['my-condition'] } } },
   // Applied to every project.
   project: { setupFiles: ['./vitest.setup.ts'] },
   // Applied to one tier, after the `project` block above.
@@ -1081,7 +1134,9 @@ export default defineVitestConfig({
 
 Arrays concatenate rather than replace. `exclude` and `setupFiles` therefore add to what the config already declares, and no surface can narrow `include` or drop a default exclusion. Adding an `include` pattern through `project` widens all four projects at once, so a file matching it is collected by each and runs four times.
 
-`resolve.conditions` concatenates too, but layer order carries no meaning there: Vite consumes conditions as a set, and which one wins is decided by the key order of the consumed package's own `exports`. A later layer can add a condition and can never remove or outrank one an earlier layer contributed. `resolve.alias` is the one key that merges override-first, so a later alias takes precedence over an earlier one.
+`resolve.conditions` concatenates too, onto the `source` condition and the Vite defaults the factory already emits, but layer order carries no meaning there: Vite consumes conditions as a set, and which one wins is decided by the key order of the consumed package's own `exports`. A later layer can add a condition and can never remove or outrank one an earlier layer contributed; removing `source` is what `resolveFromSource: false` is for. `resolve.alias` is the one key that merges override-first, so a later alias takes precedence over an earlier one.
+
+**A condition for the tests' own resolution goes under `ssr`.** `resolve` is per-environment, and Vitest resolves a test's imports through the server environment, so `root: { ssr: { resolve: { conditions: ['my-condition'] } } }` is the seam that reaches them. A top-level `root: { resolve: { conditions: [...] } }` entry reaches the client environment, which only browser-mode tests resolve through; it composes into that array and never reports that a node test did not see it. `resolve.alias` is not per-environment, so a top-level alias reaches both.
 
 ### Sharing options across config files
 
@@ -1094,7 +1149,7 @@ import { fileURLToPath } from 'node:url';
 import type { VitestConfigOptions } from '@williamthorsen/nmr/vitest';
 
 export const shared: VitestConfigOptions = {
-  root: { resolve: { conditions: ['source'] } },
+  root: { resolve: { alias: { '~': fileURLToPath(new URL('.', import.meta.url)) } } },
   project: { setupFiles: [fileURLToPath(new URL('./vitest.setup.ts', import.meta.url))] },
 };
 ```
@@ -1116,7 +1171,7 @@ Order is the point where `setupFiles` is concerned, since a shared setup file es
 
 **Do not merge two returned configs.** `mergeConfig(defineVitestConfig(), defineVitestConfig(mine))` looks like the idiomatic recovery and fails at startup: both sides declare the same four project names, which Vitest rejects with `Project name "unit" ... is not unique`. Layers merge the factory's inputs instead, which is why they yield four projects however many fold.
 
-A config file that omits the shared layer still loses those settings, silently -- Vitest's own resolution contract, not something the factory can intercept. Guard it with a test that fails when a package's suite goes missing, which also catches a shared `exclude` pattern swallowing one package's tests.
+A config file that omits the shared layer still loses those settings, silently -- Vitest's own resolution contract, not something the factory can intercept. Guard it with a test that fails when a package's suite goes missing, which also catches a shared `exclude` pattern swallowing one package's tests. Source resolution and git isolation need no such guard: the factory supplies both, so a config file cannot omit them by forgetting a layer.
 
 ### What the config excludes
 
@@ -1173,3 +1228,17 @@ nmr once selected a package's test scripts by looking for a `vitest.integration.
 Until step 1 is done, every test command that names a tier fails against a config declaring no projects, with `Error: No projects matched the filter "unit", "tool".` at startup. `test:all` is the exception: it names no project, so it runs everything the config collects.
 
 That is a change for the better. While `test` selected by negation, an unmigrated config produced a _green_ run, because `--project '!integration'` had nothing to exclude, so the separation was lost with no error anywhere. Positive selection turns the same state into a startup failure that names the missing projects.
+
+### Migrating a repo that layered source resolution or git isolation by hand
+
+The factory supplies both, so the layer a repo wrote for them, and any guard test that checked every config file imported it, can go.
+
+1. Delete the shared module's `resolve.conditions` entry for `source` and its `ssr.resolve` twin. Keep the module for whatever else it carries; delete it outright once it carries nothing.
+2. Delete the git-isolation setup file and its `setupFiles` entry. nmr's runs in its place, ahead of every entry a layer adds.
+3. Delete the test that asserted each config file imports the shared module, where the module is gone.
+
+Two behaviors change on upgrade even in a repo that layered neither.
+
+A suite whose tests run `git commit` while relying on the developer's global identity now fails with git's own `Please tell me who you are`. Set the identity locally in the fixture repo the test builds -- `git -C <repo> config user.email`, `user.name`, and `commit.gpgsign false` -- which is what makes the test report the same result on every machine.
+
+A workspace package declaring a `source` condition is now resolved from source in tests that previously read its `dist`. That is the point of the default, and it means a suite stops exercising build output it may have been exercising by accident.

package/dist/esm/commands/taze.js

@@ -4,6 +4,10 @@ import { fileURLToPath } from 'node:url';
 import { reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 const TAZE_CLI_SPECIFIER = 'taze/cli';
+const REQUEST_TIMEOUT_FLAG = '--request-timeout';
+const REQUEST_TIMEOUT_FLAGS = [REQUEST_TIMEOUT_FLAG, '--requestTimeout'];
+const REQUEST_TIMEOUT_MS = 30_000;
+const ARGUMENT_TERMINATOR = '--';
 export function runTaze(args, options = {}) {
     const stderr = options.stderr ?? process.stderr;
     const resolveCliPath = options.resolveCliPath ?? resolveTazeCliPath;
@@ -17,7 +21,7 @@ export function runTaze(args, options = {}) {
         reportError(`Could not resolve '${TAZE_CLI_SPECIFIER}' from nmr's dependencies. Reinstall the workspace to restore it. (${detail})`, stderr);
         return 1;
     }
-    const outcome = spawn(process.execPath, [cliPath, ...args]);
+    const outcome = spawn(process.execPath, [cliPath, ...composeRequestTimeoutArgs(args), ...args]);
     if (outcome.error) {
         reportError(`Failed to run taze: ${outcome.error.message}`, stderr);
         return 1;
@@ -27,6 +31,18 @@ export function runTaze(args, options = {}) {
 export function resolveTazeCliPath() {
     return fileURLToPath(import.meta.resolve(TAZE_CLI_SPECIFIER));
 }
+function carriesRequestTimeout(args) {
+    for (const arg of args) {
+        if (arg === ARGUMENT_TERMINATOR)
+            return false;
+        if (REQUEST_TIMEOUT_FLAGS.some((flag) => arg === flag || arg.startsWith(`${flag}=`)))
+            return true;
+    }
+    return false;
+}
+function composeRequestTimeoutArgs(args) {
+    return carriesRequestTimeout(args) ? [] : [REQUEST_TIMEOUT_FLAG, String(REQUEST_TIMEOUT_MS)];
+}
 function spawnNode(nodePath, argv) {
     const result = spawnSync(nodePath, argv, { stdio: 'inherit' });
     return { status: result.status, error: result.error };

package/dist/esm/default-scripts.js

@@ -4,7 +4,7 @@ const ROOT_TYPECHECK_STEP = { run: 'root:typecheck', declinesArgs: true };
 export const workspaceScripts = {
     build: ['compile'],
     check: [TYPECHECK_STEP, 'fmt:check', 'lint:check', 'test'],
-    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test:coverage'],
+    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test'],
     clean: 'nmr-clean',
     compile: 'nmr-compile',
     fix: ['lint', 'fmt'],
@@ -31,7 +31,7 @@ export const rootScripts = {
     'audit:prod': 'pnpm exec v11y --prod',
     build: ['-R build'],
     check: [TYPECHECK_STEP, 'fmt:check', 'lint:check', 'test'],
-    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test:coverage'],
+    'check:strict': [TYPECHECK_STEP, 'fmt:check', 'lint:strict', 'test'],
     ci: [{ run: 'build', declinesArgs: true }, 'check:strict'],
     clean: 'nmr-clean',
     fix: ['lint', 'fmt'],

package/dist/esm/vitest-git-isolation.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/vitest-git-isolation.js

@@ -0,0 +1,4 @@
+import os from 'node:os';
+process.env['GIT_CONFIG_GLOBAL'] = os.devNull;
+process.env['GIT_CONFIG_SYSTEM'] = os.devNull;
+process.env['GIT_CONFIG_NOSYSTEM'] = '1';

package/dist/esm/vitest.d.ts

@@ -10,6 +10,8 @@ export interface VitestConfigOptions {
     root?: RootOverrides;
     project?: ProjectConfig;
     tiers?: Partial<Record<TierName, ProjectConfig>>;
+    isolateGit?: boolean;
+    resolveFromSource?: boolean;
 }
 export interface RootVitestConfigOptions extends VitestConfigOptions {
     monorepoRoot: string;

package/dist/esm/vitest.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { defaultExclude, mergeConfig } from 'vitest/config';
 import { isObject } from "./helpers/type-guards.js";
 import { ALL_TEST_PATTERNS, buildTierPatterns, TEST_COLLECTION_EXCLUDE, TIER_NAMES } from "./tiers.js";
@@ -6,6 +7,9 @@ import { getWorkspacePackageDirs } from "./workspace.js";
 const [RESIDUAL_TIER, ...NAMED_TIERS] = TIER_NAMES;
 const TIERED_PATTERNS = NAMED_TIERS.flatMap(buildTierPatterns);
 const TIER_TIMEOUT = 30_000;
+const GIT_ISOLATION_SETUP_FILE = resolveGitIsolationSetupFile();
+const SOURCE_CLIENT_CONDITIONS = ['source', 'module', 'browser', 'development|production'];
+const SOURCE_SERVER_CONDITIONS = ['source', 'module', 'node', 'development|production'];
 const COVERAGE_EXCLUDE = ['**/__{fixtures,mocks,tests}__/**', '**/index.ts', '**/*.d.ts'];
 const COLLECTION_EXCLUDE = [...new Set([...defaultExclude, ...TEST_COLLECTION_EXCLUDE.map((dir) => `**/${dir}/**`)])];
 const PACKAGE_COVERAGE_INCLUDE = ['**/src/**/*.{ts,tsx}'];
@@ -29,6 +33,10 @@ function buildConfig(declaredLayers, { coverageInclude, projectExclude = [], pro
     const layers = declaredLayers.filter((layer) => layer !== undefined);
     assertKnownTiers(layers);
     const config = {
+        ...(resolveFlag(layers, 'resolveFromSource') && {
+            resolve: { conditions: SOURCE_CLIENT_CONDITIONS },
+            ssr: { resolve: { conditions: SOURCE_SERVER_CONDITIONS } },
+        }),
         test: {
             coverage: {
                 enabled: false,
@@ -59,6 +67,7 @@ function buildProjects(layers, extraExclude, projectRoot) {
             timeout: TIER_TIMEOUT,
         })),
     ];
+    const isolateGit = resolveFlag(layers, 'isolateGit');
     return projectTiers.map(({ exclude, include, name, timeout }) => {
         const project = {
             extends: true,
@@ -67,6 +76,7 @@ function buildProjects(layers, extraExclude, projectRoot) {
                 exclude: [...COLLECTION_EXCLUDE, ...exclude, ...extraExclude],
                 include,
                 name,
+                ...(isolateGit && { setupFiles: [GIT_ISOLATION_SETUP_FILE] }),
                 ...(timeout !== undefined && { hookTimeout: timeout, testTimeout: timeout }),
             },
         };
@@ -98,3 +108,16 @@ function getWorkspaceExcludePatterns(monorepoRoot) {
         .map((dir) => `${path.relative(monorepoRoot, dir).split(path.sep).join('/')}/**`)
         .toSorted();
 }
+function resolveFlag(layers, name) {
+    let resolved = true;
+    for (const layer of layers) {
+        const declared = layer[name];
+        if (declared !== undefined)
+            resolved = declared;
+    }
+    return resolved;
+}
+function resolveGitIsolationSetupFile() {
+    const thisFile = fileURLToPath(import.meta.url);
+    return path.join(path.dirname(thisFile), `vitest-git-isolation${path.extname(thisFile)}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.32.2",
+  "version": "0.34.0",
   "private": false,
   "description": "Context-aware script runner for pnpm monorepos",
   "keywords": [
@@ -21,7 +21,8 @@
   "license": "ISC",
   "author": "William Thorsen <william@thorsen.dev> (https://github.com/williamthorsen)",
   "sideEffects": [
-    "./dist/esm/cli*.js"
+    "./dist/esm/cli*.js",
+    "./dist/esm/vitest-git-isolation.js"
   ],
   "type": "module",
   "exports": {
@@ -68,21 +69,22 @@
     "dist"
   ],
   "dependencies": {
-    "@williamthorsen/toolbelt.errors": "0.5.0",
+    "@williamthorsen/toolbelt.errors": "0.6.1",
     "glob": "13.0.6",
     "prettier-plugin-sh": "0.19.0",
-    "taze": "20.0.1",
+    "taze": "21.1.0",
     "yaml": "2.9.0",
-    "@williamthorsen/nmr-core": "0.10.2"
+    "@williamthorsen/nmr-core": "0.10.3"
   },
   "devDependencies": {
-    "@williamthorsen/toolbelt.filesystem": "0.6.0",
-    "@williamthorsen/toolbelt.testing": "0.3.0",
-    "@williamthorsen/toolbelt.vitest": "0.4.0",
+    "@williamthorsen/toolbelt.filesystem": "0.8.0",
+    "@williamthorsen/toolbelt.testing": "0.4.0",
+    "@williamthorsen/toolbelt.vitest": "0.6.0",
     "prettier": "3.9.6",
-    "readyup": "0.29.0",
+    "readyup": "0.32.0",
     "tinyglobby": "0.2.17",
     "typescript": "6.0.3",
+    "vite": "8.2.1",
     "vitest": "4.1.10"
   },
   "peerDependencies": {