@williamthorsen/nmr 0.44.0 → 0.46.0

package/.readyup/manifest.json

@@ -5,6 +5,7 @@
       "bundledDependencies": {
         "@williamthorsen/toolbelt.errors": "0.8.3",
         "@williamthorsen/toolbelt.filesystem": "0.9.3",
+        "@williamthorsen/toolbelt.packaging": "0.6.3",
         "@williamthorsen/toolbelt.terminal": "0.2.1",
         "ansi-regex": "6.4.0",
         "ansi-styles": "6.2.3",
@@ -29,11 +30,6 @@
           "kind": "module",
           "path": "../../nmr-core/dist/esm/cache-store.js"
         },
-        {
-          "hash": "a5f44396",
-          "kind": "module",
-          "path": "../../nmr-core/dist/esm/findPackageRoot.js"
-        },
         {
           "hash": "54384dca",
           "kind": "module",
@@ -55,7 +51,7 @@
           "path": "../../nmr-core/dist/esm/helpers/workspace-patterns.js"
         },
         {
-          "hash": "1467293d",
+          "hash": "191f7c24",
           "kind": "module",
           "path": "../../nmr-core/dist/esm/index.js"
         },
@@ -64,11 +60,6 @@
           "kind": "module",
           "path": "../../nmr-core/dist/esm/parseArgs.js"
         },
-        {
-          "hash": "a7efc38f",
-          "kind": "module",
-          "path": "../../nmr-core/dist/esm/readPackageVersion.js"
-        },
         {
           "hash": "14547f78",
           "kind": "module",
@@ -95,7 +86,7 @@
           "path": "kits/default.ts"
         },
         {
-          "hash": "747d941f",
+          "hash": "106526b9",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -103,7 +94,7 @@
           ]
         },
         {
-          "hash": "b23f5a52",
+          "hash": "7e066d18",
           "kind": "module",
           "path": "../src/config.ts"
         },
@@ -122,6 +113,11 @@
           "kind": "module",
           "path": "../src/helpers/config-path.ts"
         },
+        {
+          "hash": "a663548a",
+          "kind": "module",
+          "path": "../src/helpers/escapeControlCharacters.ts"
+        },
         {
           "hash": "47249ca4",
           "kind": "module",
@@ -153,17 +149,17 @@
           "path": "../src/resolve-scripts.ts"
         },
         {
-          "hash": "6ae507a5",
+          "hash": "15247f0e",
           "kind": "module",
           "path": "../src/resolver.ts"
         },
         {
-          "hash": "c4b31275",
+          "hash": "ed585ab6",
           "kind": "module",
           "path": "../src/steps.ts"
         },
         {
-          "hash": "19dec003",
+          "hash": "d8368f1a",
           "kind": "module",
           "path": "../src/tiers.ts"
         },
@@ -193,7 +189,7 @@
       "readyupVersion": "0.40.0",
       "source": "kits/default.ts",
       "sourceHash": "aaeb1a84",
-      "targetHash": "25b7edfb"
+      "targetHash": "92d23b08"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.46.0 — 2026-10-13
+
+### 🎉 Features
+
+- Adds a `packageMaturityPeriod` option to the config built with `defineConfig` from `@williamthorsen/nmr/taze`, which sets, for packages whose names match a `*` pattern, how many days after a release `nmr upgrade` waits before proposing it, in place of the shared `maturityPeriod`. (#1036)
+- Defines an embedded test, which runs an engine installed by the package, such as PGlite (Postgres compiled to WebAssembly), inside the test process, and places it in the `tool` tier rather than `unit` in `docs/vitest.md` and the `nmr` rulebook. (#1037)
+- Redefines a package's `peerDependencies` in `docs/vitest.md` as candidate tools rather than as the `tool` boundary, so a test is `tool` only when it makes a peer do work, and a test that imports a peer only for its constants, such as `AST_NODE_TYPES`, stays `unit`. (#1037)
+
+## 0.45.0 — 2026-10-12
+
+### 🎉 Features
+
+- Adds `maintenance.auto=false` to the git config that the Vitest git-isolation setup file injects, so that a git command run by a test does not start a detached `git maintenance` process that can still be writing under `.git` when the test removes the repository. (#1033)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that `nmr-fmt` failed a run in which every path matched by the pathspecs was one that it skips, such as a symlink, a submodule gitlink, or an unreadable file, and makes such a run exit 0 and name the skipped paths on stderr. (#1010)
+- Fixes the issue that a `rootScripts` or `workspaceScripts` entry in `.config/nmr.config.ts` that names its own key, as a shell segment or as a step-list element, re-entered nmr without bound, by rejecting the entry when the config loads with an error that names the file, the field, the key, and the edit that resolves it. (#1011)
+- Fixes the issue that a package's own `package.json` entry running `nmr -R <same command>` re-entered that package without bound instead of being discarded or rejected as a self-reference. (#1011)
+- Fixes the issue that nmr treated a root entry such as `pnpm --recursive exec nmr build` as a re-invocation of its own command, because it ignored the `-r`, `--filter`, and `-w` flags that pnpm applies to the nmr that it launches. (#1011)
+- Fixes the issue that `nmr` hung when a script entry re-entered its own command in the same directory without nmr recognizing the self-reference, as `nmr -F own-pkg build` in `own-pkg`'s own `build` or a cycle through two entries does, by failing the run with an error that names the command and the directory and lists the commands that the run had entered, outermost first. (#1012)
+- Fixes the issue that the test-tier definitions in `vitest.md` gave a test that starts its own loopback server three defensible tiers: `tool` is now a process that the test starts or a program that the environment supplies, `localhost` a service already running on this machine, and an in-process server from the package's own dependency closure `unit`. (#1023)
+- Fixes the issue that `nmr`'s warning about a `package.json` script that runs `nmr` through a shell sent an entry whose whole value is `nmr <name>` to `.config/nmr.config.ts`, when the accurate edit is to replace that value with the command of the `<name>` script in the same file. (#1030)
+
+### ♻️ Refactoring
+
+- Moves the work of `runInvocation` in `nmr` into the phase functions `establishInvocation`, `planRun`, and `executePlan`, which `runCli` calls in order, and changes `runGated` and `reportRecording` to take a named `RunPlan` in place of an options object that repeated its fields. (#1014)
+
+### 🧪 Tests
+
+- Replaces the `GIT_CEILING_DIRECTORIES` stub with a `GIT_DIR` stub that points to a missing path in the no-repository test of `check-cache-gate.tool.test.ts`, and sets `maintenance.auto` to `false` in the file's fixture repository, so that git neither finds a leftover of the removed `repo/.git` nor starts a detached maintenance process that writes under `.git`. (#1032)
+
 ## 0.44.0 — 2026-10-11
 
 ### 🎉 Features

package/README.md

@@ -5,28 +5,13 @@
 Context-aware script runner for pnpm monorepos. Includes an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.44.0 (2026-10-11)
+## Release notes — v0.46.0 (2026-10-13)
 
 ### 🎉 Features
 
-- Enables Prettier's content-keyed cache in `nmr-fmt` (run by `nmr fmt` and `nmr fmt:check`), which skips each file whose content, Prettier version, resolved options, and lockfile are unchanged since a run that passed it, and adds `--no-cache` and `NMR_NO_CACHE=1` to bypass it. (#993)
-- Adds the `shouldRunInBackground` field to a composite element in `.config/nmr.config.ts`, which starts the step, runs the steps after it without waiting, prints the step's output whole after the step ends, and fails the composite if the step fails. (#1003)
-- Adds a `self-hosted runner` checklist to nmr's readyup kit, which reads the repo's GitHub settings through `gh`, recommends setting `CI_RUNS_ON` when a private repo with an online self-hosted runner and compatible workflows has not set it, and warns about each failing condition once the variable is set. (#1006)
-- Adds the root-only config key `selfHostedRunner.exempt`, a non-empty reason that stops the kit from recommending `CI_RUNS_ON` for a repo that qualifies for the self-hosted runners but stays off them. (#1006)
-
-### 🪦 Removed
-
-- 🚨 **Breaking:** Removes the zero-argument form of `getDefaultRootScripts` from the `@williamthorsen/nmr/scripts` export, which now requires the monorepo root so that it can read the declared workspaces. (#992)
-
-### 🐛 Bug fixes
-
-- Fixes the issue that `root:lint`, `root:lint:check`, and `root:lint:strict` linted every workspace outside `packages/` under the root ESLint config, by excluding each workspace package that `pnpm-workspace.yaml` declares, with its `!` exclusions honored, in place of the fixed `packages/**`. (#992)
-- Fixes the issue that `defineConfig({ mode: undefined })` emptied the `nmr upgrade` report, by translating a cleared `mode` into the `'default'` mode of taze (the upgrade tool that `nmr upgrade` runs), which follows the range that each dependency declares. (#1008)
-
-### ⚡ Performance
-
-- Sets `maxWorkers: 3` on every project built by `defineVitestConfig` and `defineRootVitestConfig` when the machine has 2 or fewer cores, such as GitHub's standard runner for a private repo, on which Vitest's default ran every test file serially on one worker. (#994)
-- Changes the default `check` and `check:strict` to start lint first and run it in the background, so that a local check, `nmr ci`, and `nmr prepush` no longer wait for type-aware lint to finish before typecheck, the format check, and the tests run. (#1003)
+- Adds a `packageMaturityPeriod` option to the config built with `defineConfig` from `@williamthorsen/nmr/taze`, which sets, for packages whose names match a `*` pattern, how many days after a release `nmr upgrade` waits before proposing it, in place of the shared `maturityPeriod`. (#1036)
+- Defines an embedded test, which runs an engine installed by the package, such as PGlite (Postgres compiled to WebAssembly), inside the test process, and places it in the `tool` tier rather than `unit` in `docs/vitest.md` and the `nmr` rulebook. (#1037)
+- Redefines a package's `peerDependencies` in `docs/vitest.md` as candidate tools rather than as the `tool` boundary, so a test is `tool` only when it makes a peer do work, and a test that imports a peer only for its constants, such as `AST_NODE_TYPES`, stays `unit`. (#1037)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -124,7 +109,7 @@ Scripts resolve through three tiers. Higher tiers override lower ones:
 2. **Repo-wide config**: Additions and overrides in `.config/nmr.config.ts`
 3. **Per-package overrides**: Scripts in a package's `package.json`
 
-[Scripts and configuration](docs/scripts.md#three-tier-override-system) shows a worked example, how to skip a script for one package, and what nmr does with a `package.json` entry that re-invokes its own command.
+[Scripts and configuration](docs/scripts.md#three-tier-override-system) shows a worked example, how to skip a script for one package, and what nmr does with a `package.json` or `.config/nmr.config.ts` entry that re-invokes its own command.
 
 ## Pre and post hooks
 
@@ -227,7 +212,7 @@ export default definePrettierConfig();
 
 ### Dependency upgrades
 
-`nmr upgrade` reports available dependency upgrades. A `taze.config.ts` at the monorepo root, built with the `defineConfig` exported by `@williamthorsen/nmr/taze`, declares the upgrade policy. [Dependency upgrades](docs/upgrades.md) covers what each invocation reaches, the policy and its ceilings, and the request timeout.
+`nmr upgrade` reports available dependency upgrades. A `taze.config.ts` at the monorepo root, built with the `defineConfig` exported by `@williamthorsen/nmr/taze`, declares the upgrade policy. [Dependency upgrades](docs/upgrades.md) covers what each invocation reaches, the policy and its ceilings, per-package maturity periods, and the request timeout.
 
 ### Workspace introspection
 

package/agents/guidance/rulebooks/nmr.md

@@ -13,5 +13,5 @@ delivery: ambient
 - A check that already passed on the current working tree skips, printing `SKIP <scope>: <command>: passed …` and, when the recalled run left one, `— replayed: <excerpt>` of what that run concluded. Any edit, addition, or deletion re-runs it. Read the replayed excerpt rather than running the check again: Never pass `--no-cache` to get a "real" run, which takes the command's full runtime to reach the same answer. Its one use is a file rather than an exit status -- a skipped command writes none, so a fresh `coverage/` needs `nmr --no-cache test:coverage`. A composite replays its constituents' excerpts, each attributed as `<scope>: <command>: <excerpt>` and cut at the line's ceiling when there are too many to fit. A skip without an excerpt is one whose run wrote to a terminal, or one whose constituents recorded none.
 - `nmr --log <command>` prints the whole run behind that excerpt -- up to 256 KiB, led by when it was recorded, how long it ran, and the command string that produced it. Output that you need in full is a recording to read rather than a command to run again. It runs nothing, and it is held to the tree rather than to the terminal: A recording made by a piped run prints for a reader at one. A composite prints its constituents' excerpts, not their transcripts, so the transcript of one of them is `nmr -F <pkg> --log <command>` or that constituent's own name. When there is nothing to show, `--log` says so on one line, names which case it is, and exits non-zero.
 - Every command that nmr runs reports one line -- `PASS <scope>: <command>: passed in 12.4s`, `FAIL … failed in 1.2s (exit 1)`, `SKIP … passed 4m ago on this tree`, or `NOOP … skipped, the override is empty` -- and a composite reports alongside every command into which it expands. Those are the words that a pipe and a CI log get; a terminal gets ✅, ❌, ⏩, and ⚪ in their place, and `--output-style rich` or `NMR_OUTPUT_STYLE=rich` forces the emoji on any stream. The lines print in every verbosity, so `nmr -q <command>` is the low-noise way to run rather than a silent one: It withholds the output of the commands that nmr runs and keeps nmr's own verdicts, which is how a pass, a cached skip, and a `""`/`":"` override stay distinguishable. nmr reads its own flags only before the command name and passes everything after the name to the commands that run: `nmr ci -q` hands `-q` to `nmr-fmt`, which rejects it. Expect a run to be quiet already without the flag: nmr recognizes a known agent harness in the environment and takes quiet from that, as it does from `NMR_COMMAND_VERBOSITY` or the repo's `output.commandVerbosity`. A command whose output you need in full is one to run with `NMR_COMMAND_VERBOSITY=full`, which outranks both.
-- Every test file lives under a `__tests__` directory and names its isolation tier last: `<subject>[.<aspect>].<tier>.test.ts`, where any earlier segment is free-form documentation. A tier is the furthest thing that the test reaches -- `tool` (a program supplied by the environment), `localhost` (a service on this machine), `remote` (a machine that isn't this one), or `unit`, the residual claiming everything else. A file outside `__tests__`, or one whose tier segment is missing or misspelt, fails the test run in a repo that declares nmr's exported conventions check, which reports both. In a repo that has not, neither fails anything -- the first is collected by nothing and the second runs under `unit` -- and `rdy run --sources` reports both and warns that the check is missing.
+- Every test file lives under a `__tests__` directory and names its isolation tier last: `<subject>[.<aspect>].<tier>.test.ts`, where any earlier segment is free-form documentation. A tier is the furthest thing that the test reaches -- `tool` (a process that the test starts, or a program other than the package's own code that the test makes do its work, including an embedded engine, which the package installs and the test runs in-process, such as PGlite), `localhost` (a service already running on this machine), `remote` (a machine that isn't this one), or `unit`, the residual claiming everything else. A file outside `__tests__`, or one whose tier segment is missing or misspelt, fails the test run in a repo that declares nmr's exported conventions check, which reports both. In a repo that has not, neither fails anything -- the first is collected by nothing and the second runs under `unit` -- and `rdy run --sources` reports both and warns that the check is missing.
 - The rest is in `node_modules/@williamthorsen/nmr/docs/`: `scripts.md` for pre/post hooks (every `nmr X` auto-wraps as `nmr X:pre && nmr X && nmr X:post`) and script overrides and their `""`/`":"` skip values; `upgrades.md` for `nmr upgrade` ceilings (report-only until `nmr upgrade --write`); `utilities.md` for the `nmr-compile` build (the repo does not define a build script of its own); `vitest.md` for the test tiers' timeout budgets, the `tiers` seam that raises one, and which script reaches which tier; and `check-cache.md` for the check-result cache's key, the retention key to which a replayed excerpt is additionally held, the retention ceiling within which `--log` prints, its `checkCache` config, and every condition that disables it.

package/dist/esm/cli-taze.js

@@ -3,7 +3,7 @@ import { reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { runTaze } from "./commands/taze.js";
 try {
-    process.exitCode = runTaze(process.argv.slice(2));
+    process.exitCode = await runTaze(process.argv.slice(2));
 }
 catch (error) {
     reportError(describeError(error));

package/dist/esm/commands/fmt.d.ts

@@ -1,5 +1,7 @@
 export type FormatMode = 'check' | 'write';
 export interface FormatTargets {
+    /** Listed paths that Prettier cannot be handed, such as symlinks and submodule gitlinks. */
+    excludedFiles: string[];
     /** Paths relative to the working directory, as `git ls-files` emits them. */
     files: string[];
     /** Absolute paths to every `.prettierignore` governing the repository, root-most first. */
@@ -42,8 +44,8 @@ export declare function runFmt(argv: string[], cwd?: string): Promise<number>;
  * `pathspecs` narrow the selection and are passed to git verbatim: They have git pathspec semantics rather
  * than shell glob semantics.
  *
- * A listed path that this process is denied access to is set aside in `unreadableFiles`; any other stat failure
- * fails the resolution.
+ * A listed path that Prettier cannot be handed is set aside in `excludedFiles`, and one that this process is denied
+ * access to in `unreadableFiles`; any other stat failure fails the resolution.
  */
 export declare function resolveFormatTargets(cwd: string, pathspecs?: string[]): ResolveTargetsResult;
 /** @internal */

package/dist/esm/commands/fmt.js

@@ -33,15 +33,20 @@ export async function runFmt(argv, cwd = process.cwd()) {
         reportError(`nmr-fmt: ${resolvedTargets.error}`);
         return 1;
     }
-    const { files, ignorePaths, repositoryRoot, unreadableFiles } = resolvedTargets.targets;
+    const { excludedFiles, files, ignorePaths, repositoryRoot, unreadableFiles } = resolvedTargets.targets;
     for (const { file, code } of unreadableFiles) {
         process.stderr.write(`nmr-fmt: skipped ${file}, which cannot be read (${code})\n`);
     }
     if (files.length === 0) {
-        if (parsedArgs.pathspecs.length > 0) {
-            reportError(`nmr-fmt: the pathspecs did not match any formattable file: ${parsedArgs.pathspecs.join(', ')}`);
+        if (parsedArgs.pathspecs.length === 0)
+            return 0;
+        if (excludedFiles.length === 0 && unreadableFiles.length === 0) {
+            reportError(`nmr-fmt: the pathspecs did not match any file that git lists: ${parsedArgs.pathspecs.join(', ')}`);
             return 1;
         }
+        if (excludedFiles.length > 0) {
+            process.stderr.write(`nmr-fmt: nothing to format; skipped paths that are not regular files: ${excludedFiles.join(', ')}\n`);
+        }
         return 0;
     }
     const cli = resolvePrettierCli(cwd);
@@ -84,6 +89,7 @@ export function resolveFormatTargets(cwd, pathspecs = []) {
     const ignoreFiles = runGit([...LIST_FILES_ARGS, '--', IGNORE_FILE_PATHSPEC], repositoryRoot);
     if (!ignoreFiles.ok)
         return ignoreFiles;
+    const excludedFiles = [];
     const files = [];
     const unreadableFiles = [];
     const listedPaths = dedupe(splitNulSeparated(listedFiles.stdout));
@@ -91,6 +97,7 @@ export function resolveFormatTargets(cwd, pathspecs = []) {
         const status = classifyListedFile(cwd, file);
         switch (status.kind) {
             case 'excluded':
+                excludedFiles.push(file);
                 break;
             case 'failed':
                 return { ok: false, error: status.error };
@@ -108,6 +115,7 @@ export function resolveFormatTargets(cwd, pathspecs = []) {
     return {
         ok: true,
         targets: {
+            excludedFiles: excludedFiles.toSorted(),
             files: files.toSorted(),
             ignorePaths: dedupe([path.join(repositoryRoot, IGNORE_FILENAME), ...discoveredIgnorePaths]),
             repositoryRoot,

package/dist/esm/commands/load-package-maturity-period.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Returns the `packageMaturityPeriod` that the taze config governing `cwd` declares, unvalidated, or `undefined`
+ * when no config file is found.
+ *
+ * The sources, the upward search, and the `default` unwrapping mirror `resolveConfig` and `normalizeConfig` in
+ * taze 21.3.0, so that this reads the same file that taze reads. Throws when the file fails to load.
+ */
+export declare function loadPackageMaturityPeriod(cwd: string): Promise<unknown>;

package/dist/esm/commands/load-package-maturity-period.js

@@ -0,0 +1,15 @@
+import { createConfigLoader } from 'unconfig';
+export async function loadPackageMaturityPeriod(cwd) {
+    const { config, sources } = await createConfigLoader({
+        sources: [{ files: ['taze.config'] }, { files: ['.tazerc'], extensions: ['json', ''] }],
+        cwd,
+        merge: false,
+    }).load();
+    if (sources.length === 0)
+        return undefined;
+    const options = isRecord(config) && 'default' in config ? config['default'] : config;
+    return isRecord(options) ? options['packageMaturityPeriod'] : undefined;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}

package/dist/esm/commands/taze-args.d.ts

@@ -0,0 +1,17 @@
+/** Ends the arguments that taze reads: Everything past it is collected for a downstream tool. */
+export declare const ARGUMENT_TERMINATOR = "--";
+/** A flag found among the arguments that taze reads, with the value given to it, if any. */
+export interface FlagReading {
+    value: string | undefined;
+}
+/**
+ * Inserts `inserted` after the arguments that taze reads, ahead of a bare `--` so that taze still reads them.
+ */
+export declare function insertBeforeTerminator(args: readonly string[], inserted: readonly string[]): string[];
+/** Reports whether the invocation silences taze's output, in any spelling that taze's CLI accepts. */
+export declare function isSilent(args: readonly string[]): boolean;
+/**
+ * Finds the first of `spellings` among the arguments that taze reads, returning the value given in its `=value`
+ * form or as the next argument. A next argument that starts with `-` is another flag, not a value.
+ */
+export declare function readFlag(args: readonly string[], spellings: readonly string[]): FlagReading | undefined;

package/dist/esm/commands/taze-args.js

@@ -0,0 +1,25 @@
+export const ARGUMENT_TERMINATOR = '--';
+export function insertBeforeTerminator(args, inserted) {
+    const terminatorIndex = args.indexOf(ARGUMENT_TERMINATOR);
+    if (terminatorIndex === -1)
+        return [...args, ...inserted];
+    return [...args.slice(0, terminatorIndex), ...inserted, ...args.slice(terminatorIndex)];
+}
+export function isSilent(args) {
+    return readFlag(args, ['--silent', '-s']) !== undefined || readFlag(args, ['--loglevel'])?.value === 'silent';
+}
+export function readFlag(args, spellings) {
+    for (const [index, arg] of args.entries()) {
+        if (arg === ARGUMENT_TERMINATOR)
+            return undefined;
+        for (const spelling of spellings) {
+            if (arg.startsWith(`${spelling}=`))
+                return { value: arg.slice(spelling.length + 1) };
+            if (arg === spelling) {
+                const next = args[index + 1];
+                return { value: next === undefined || next.startsWith('-') ? undefined : next };
+            }
+        }
+    }
+    return undefined;
+}

package/dist/esm/commands/taze-passes.d.ts

@@ -0,0 +1,18 @@
+/** One run of taze: the arguments that it receives and, in a split run, the heading printed before it. */
+export interface TazePass {
+    args: string[];
+    heading?: string;
+}
+/**
+ * Splits a taze invocation into one pass per `packageMaturityPeriod` entry and one for every other dependency.
+ *
+ * Each pass is confined by `--exclude` alone: taze subtracts every `--exclude` value from the dependencies that it
+ * checks, so the invocation's own `--include` and `--exclude` narrow each pass as they narrow a single run. An
+ * entry pass excludes every package that its key does not match or that an earlier key matches, so that the first
+ * matching key decides a package's period. A maturity period given on the command line applies to every
+ * dependency, so it returns the invocation as a single pass.
+ *
+ * Throws when `packageMaturityPeriod` is not a record of glob keys to non-negative periods. A key cannot be a regex,
+ * contain a comma, or name a version (`name@range`), each of which taze reads as something other than a name glob.
+ */
+export declare function planTazePasses(args: readonly string[], packageMaturityPeriod: unknown): TazePass[];

package/dist/esm/commands/taze-passes.js

@@ -0,0 +1,59 @@
+import { insertBeforeTerminator, readFlag } from "./taze-args.js";
+const MATURITY_PERIOD_FLAGS = ['--maturity-period', '--maturityPeriod'];
+export function planTazePasses(args, packageMaturityPeriod) {
+    const entries = validatePackageMaturityPeriod(packageMaturityPeriod);
+    if (entries.length === 0 || readFlag(args, MATURITY_PERIOD_FLAGS) !== undefined)
+        return [{ args: [...args] }];
+    const keys = entries.map(([key]) => key);
+    const entryPasses = entries.map(([key, days], index) => ({
+        args: insertBeforeTerminator(args, [
+            '--maturity-period',
+            String(days),
+            '--exclude',
+            composeComplementFilter(key, keys.slice(0, index)),
+        ]),
+        heading: `Packages matching ${key}: ${days}-day maturity period`,
+    }));
+    const remainderPass = {
+        args: insertBeforeTerminator(args, ['--exclude', keys.join(',')]),
+        heading: 'All other packages: configured maturity period',
+    };
+    return [...entryPasses, remainderPass];
+}
+function composeComplementFilter(key, earlierKeys) {
+    const outsideKey = `^(?!${convertGlobToRegexBody(key)}$)`;
+    if (earlierKeys.length === 0)
+        return `/${outsideKey}/`;
+    return `/${outsideKey}|^(?:${earlierKeys.map(convertGlobToRegexBody).join('|')})$/`;
+}
+function convertGlobToRegexBody(glob) {
+    return glob.replaceAll(/[.+?^${}()|[\]\\]/g, String.raw `\$&`).replaceAll(/\*+/g, '.*?');
+}
+function validatePackageMaturityPeriod(value) {
+    if (value === undefined)
+        return [];
+    if (!isPlainObject(value)) {
+        throw new Error('packageMaturityPeriod must be an object mapping package patterns to periods in days');
+    }
+    return Object.entries(value).map(([key, days]) => {
+        if (key.startsWith('/')) {
+            throw new Error(`packageMaturityPeriod entry '${key}': keys are package names with * wildcards, not regexes`);
+        }
+        if (key.includes(',')) {
+            throw new Error(`packageMaturityPeriod entry '${key}': a key cannot contain a comma`);
+        }
+        if (key.lastIndexOf('@') > 0) {
+            throw new Error(`packageMaturityPeriod entry '${key}': a key names packages, not a version selector`);
+        }
+        if (typeof days !== 'number' || !Number.isFinite(days) || days < 0) {
+            throw new Error(`packageMaturityPeriod entry '${key}': the period must be a non-negative number of days`);
+        }
+        return [key, days];
+    });
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}

package/dist/esm/commands/taze.d.ts

@@ -4,28 +4,34 @@ export interface SpawnOutcome {
     error?: Error | undefined;
 }
 export interface RunTazeOptions {
+    /** Returns the `packageMaturityPeriod` that the taze config governing a directory declares. Injected by tests. */
+    loadConfig?: (cwd: string) => Promise<unknown>;
     /** Resolves the absolute path of taze's CLI entry. Injected by tests. */
     resolveCliPath?: () => string;
     /** Runs the CLI and reports how it exited. Injected by tests. */
     spawn?: (nodePath: string, argv: string[]) => SpawnOutcome;
-    /** Stream that error output is written to. Defaults to `process.stderr`. */
+    /** Stream that error output and pass headings are written to. Defaults to `process.stderr`. */
     stderr?: Writable;
 }
 /**
  * Runs taze from nmr's own dependency tree, forwarding `args`, and returns its exit code.
  *
+ * When the repo's taze config declares `packageMaturityPeriod`, runs taze once per entry and once for every other
+ * dependency, each with `args` and the filters and period that `planTazePasses` adds, and returns the first non-zero
+ * exit code among them. Every pass runs; a heading on `stderr` names each pass unless `args` silence taze.
+ *
  * Consumers depend on nmr, not on taze, so taze is transitive and its bin is absent from the consumer's
  * root `node_modules/.bin`. This launcher runs taze without that bin: pnpm links nmr's own bins into the
  * consumer root, and nmr resolves taze from the tree that it does control.
  *
- * A request timeout is the one argument added, and only when `args` does not set one. Neither other site can
- * declare it: Because an invocation's trailing arguments are appended to the resolved command string, the same
- * flag in the `upgrade` script would be doubled by `nmr upgrade --request-timeout ...`, and taze's parser
- * collects the pair into an array that it reads as a near-zero deadline; a `taze.config.ts` setting goes into
- * the object that taze's own CLI defaults overwrite. Because every other argument is forwarded untouched,
- * invocation policy (`--recursive`) stays in the script registry, visible in `nmr` help output and overridable
- * per repo, and upgrade policy stays in `taze.ts`.
+ * Every pass also receives a request timeout, unless `args` sets one. Neither other site can declare it: Because
+ * an invocation's trailing arguments are appended to the resolved command string, the same flag in the `upgrade`
+ * script would be doubled by `nmr upgrade --request-timeout ...`, and taze's parser collects the pair into an
+ * array that it reads as a near-zero deadline; a `taze.config.ts` setting goes into the object that taze's own CLI
+ * defaults overwrite. Because every argument of the invocation reaches taze, invocation policy (`--recursive`)
+ * stays in the script registry, visible in `nmr` help output and overridable per repo, and upgrade policy stays in
+ * `taze.ts`.
  */
-export declare function runTaze(args: string[], options?: RunTazeOptions): number;
+export declare function runTaze(args: string[], options?: RunTazeOptions): Promise<number>;
 /** Resolves the absolute path of taze's CLI entry from nmr's own dependency tree. */
 export declare function resolveTazeCliPath(): string;

package/dist/esm/commands/taze.js

@@ -1,17 +1,21 @@
 import { spawnSync } from 'node:child_process';
+import path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 import { reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
+import { loadPackageMaturityPeriod } from "./load-package-maturity-period.js";
+import { isSilent, readFlag } from "./taze-args.js";
+import { planTazePasses } from "./taze-passes.js";
 const TAZE_CLI_SPECIFIER = 'taze/cli';
 const REQUEST_TIMEOUT_FLAG = '--request-timeout';
 const REQUEST_TIMEOUT_FLAGS = [REQUEST_TIMEOUT_FLAG, '--requestTimeout'];
 const REQUEST_TIMEOUT_MS = 30_000;
-const ARGUMENT_TERMINATOR = '--';
-export function runTaze(args, options = {}) {
+export async function runTaze(args, options = {}) {
     const stderr = options.stderr ?? process.stderr;
     const resolveCliPath = options.resolveCliPath ?? resolveTazeCliPath;
     const spawn = options.spawn ?? spawnNode;
+    const loadConfig = options.loadConfig ?? loadPackageMaturityPeriod;
     let cliPath;
     try {
         cliPath = resolveCliPath();
@@ -21,27 +25,38 @@ export function runTaze(args, options = {}) {
         reportError(`Could not resolve '${TAZE_CLI_SPECIFIER}' from nmr's dependencies. Reinstall the workspace to restore it. (${detail})`, stderr);
         return 1;
     }
-    const outcome = spawn(process.execPath, [cliPath, ...composeRequestTimeoutArgs(args), ...args]);
-    if (outcome.error) {
-        reportError(`Failed to run taze: ${outcome.error.message}`, stderr);
+    let passes;
+    try {
+        passes = planTazePasses(args, await loadConfig(resolveConfigDir(args)));
+    }
+    catch (error) {
+        reportError(`Could not read the taze config: ${describeError(error)}`, stderr);
         return 1;
     }
-    return outcome.status ?? 1;
+    const showHeadings = !isSilent(args);
+    let exitCode = 0;
+    for (const pass of passes) {
+        if (pass.heading !== undefined && showHeadings)
+            stderr.write(`${pass.heading}\n`);
+        const outcome = spawn(process.execPath, [cliPath, ...composeRequestTimeoutArgs(pass.args), ...pass.args]);
+        if (outcome.error) {
+            reportError(`Failed to run taze: ${outcome.error.message}`, stderr);
+            return 1;
+        }
+        const status = outcome.status ?? 1;
+        if (exitCode === 0)
+            exitCode = status;
+    }
+    return exitCode;
 }
 export function resolveTazeCliPath() {
     return fileURLToPath(import.meta.resolve(TAZE_CLI_SPECIFIER));
 }
-function carriesRequestTimeout(args) {
-    for (const arg of args) {
-        if (arg === ARGUMENT_TERMINATOR)
-            return false;
-        if (REQUEST_TIMEOUT_FLAGS.some((flag) => arg === flag || arg.startsWith(`${flag}=`)))
-            return true;
-    }
-    return false;
-}
 function composeRequestTimeoutArgs(args) {
-    return carriesRequestTimeout(args) ? [] : [REQUEST_TIMEOUT_FLAG, String(REQUEST_TIMEOUT_MS)];
+    return readFlag(args, REQUEST_TIMEOUT_FLAGS) === undefined ? [REQUEST_TIMEOUT_FLAG, String(REQUEST_TIMEOUT_MS)] : [];
+}
+function resolveConfigDir(args) {
+    return path.resolve(readFlag(args, ['--cwd', '-C'])?.value ?? '.');
 }
 function spawnNode(nodePath, argv) {
     const result = spawnSync(nodePath, argv, { stdio: 'inherit' });