@williamthorsen/nmr 0.53.1 → 0.54.1

package/dist/esm/helpers/duration.js

@@ -17,7 +17,7 @@ export function formatSaving(durationMs) {
     return `saved ~${formatDuration(durationMs)}`;
 }
 const MILLISECONDS_PER_MINUTE = 60_000;
-const MILLISECONDS_PER_SECOND = 1_000;
+const MILLISECONDS_PER_SECOND = 1000;
 const MINUTES_PER_HOUR = 60;
 const SECONDS_PER_MINUTE = 60;
 function joinUnits(major, minor, minorUnit) {

package/dist/esm/helpers/package-json.js

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
+import { UserError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
-import { UserError } from "../UserError.js";
 import { isMonorepoRoot } from "../workspace.js";
 import { CONFIG_RELATIVE_PATH } from "./config-path.js";
 import { readStringValues } from "./readStringValues.js";

package/dist/esm/machine-lock.js

@@ -28,7 +28,7 @@ export const LOCK_DIR_ENV_VAR = 'NMR_LOCK_DIR';
 export const LOCK_FILE = 'heavy.lock';
 export const LOCK_TOKEN_ENV_VAR = 'NMR_MACHINE_LOCK_TOKEN';
 export const NO_LOCK_ENV_VAR = 'NMR_NO_LOCK';
-export const POLL_INTERVAL_MS = 1_000;
+export const POLL_INTERVAL_MS = 1000;
 export const STALE_AFTER_MS = 60_000;
 export async function acquireMachineLock(options) {
     const { command, dir, env, stderr } = options;

package/dist/esm/pass-manifest.js

@@ -49,7 +49,7 @@ export async function writePassManifestEntry(options) {
         writeDebugNote(`could not report ${command} to the delegating machine: ${describeError(error)}`, env, stderr);
     }
 }
-const MAX_MANIFEST_ENTRIES = 1_000;
+const MAX_MANIFEST_ENTRIES = 1000;
 function findRejection(entry, options) {
     if (!isPassManifestEntry(entry)) {
         return 'the entry is malformed';
@@ -84,6 +84,5 @@ function isRelativeScope(scope) {
     if (scope === '.') {
         return true;
     }
-    return (!path.posix.isAbsolute(scope) &&
-        scope.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..'));
+    return !path.posix.isAbsolute(scope) && scope.split('/').every((segment) => !['', '.', '..'].includes(segment));
 }

package/dist/esm/remote-host-session.js

@@ -8,12 +8,12 @@ export function runHostSession(params) {
     const LOCK_PATH = params.lockPath;
     const RECLAIM_GUARD_PATH = `${params.lockPath}.reclaim`;
     const HEARTBEAT_INTERVAL_MS = 10_000;
-    const POLL_INTERVAL_MS = 1_000;
+    const POLL_INTERVAL_MS = 1000;
     const RECLAIM_GUARD_STALE_AFTER_MS = 10_000;
     const OUTPUT_LIMIT_BYTES = 65_536;
     const COMMAND_NOT_FOUND_EXIT_CODE = 127;
     const DELEGATION_FAILURE_EXIT_CODE = 255;
-    const STOP_GRACE_MS = 5_000;
+    const STOP_GRACE_MS = 5000;
     const NODE_MODULES_DIR = path.join(params.rootDir, 'node_modules');
     const BINS_RECORD_PATH = path.join(NODE_MODULES_DIR, '.nmr-delegate-bins');
     const token = crypto.randomUUID();

package/dist/esm/resolveBinStyles.js

@@ -1,7 +1,6 @@
 import process from 'node:process';
-import { describeInvalidOutputStyle } from '@williamthorsen/nmr-core';
+import { describeInvalidOutputStyle, UserError } from '@williamthorsen/nmr-core';
 import { resolveOutputStyles } from "./output-style.js";
-import { UserError } from "./UserError.js";
 export function resolveBinStyles() {
     const { invalid: invalidStyle, styles } = resolveOutputStyles({
         env: process.env,

package/dist/esm/user-config.js

@@ -9,9 +9,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { UserError } from '@williamthorsen/nmr-core';
 import { assertRecognizedKeys } from "./config-validation.js";
 import { isObject } from "./helpers/type-guards.js";
-import { UserError } from "./UserError.js";
 export const DELEGATE_WHEN_VALUES = ['agent', 'always'];
 export function formatDisplayPath(filePath, env) {
     const home = env['HOME'];

package/dist/esm/vitest-source-resolution.js

@@ -1,10 +1,10 @@
 import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { isBuiltin } from 'node:module';
 import path from 'node:path';
+import { UserError } from '@williamthorsen/nmr-core';
 import { findDirectoryChainMatch } from '@williamthorsen/toolbelt.filesystem';
 import { parsePackageJson } from "./helpers/package-json.js";
 import { isObject } from "./helpers/type-guards.js";
-import { UserError } from "./UserError.js";
 const SHARED_CONDITIONS = ['module', 'import', 'development', 'default'];
 const CLIENT_CONDITION = 'browser';
 const SERVER_CONDITION = 'node';

package/dist/esm/workspace.js

@@ -1,7 +1,7 @@
 import { findMonorepoRoot as findMonorepoRootOrNothing, resolveWorkspace } from '@williamthorsen/nmr-core/workspace';
-import { UserError } from "./UserError.js";
 const WORKSPACE_MANIFEST = 'pnpm-workspace.yaml';
 export { isMonorepoRoot, readWorkspaceOverrides, readWorkspacePackageNames, resolveWorkspace, } from '@williamthorsen/nmr-core/workspace';
+import { UserError } from '@williamthorsen/nmr-core';
 export function findMonorepoRoot(startDir) {
     const monorepoRoot = findMonorepoRootOrNothing(startDir);
     if (monorepoRoot === undefined) {

package/docs/delegate.md

@@ -46,13 +46,15 @@ The first rule that applies decides where a command runs:
 | 1   | `--no-delegate`                                                                         | Here                                                                                                               |
 | 2   | `--delegate` or `--delegate-to`                                                         | On a host; a command that cannot be delegated, or a tree that cannot be snapshotted, is refused                    |
 | 3   | The repo config declares `delegate: false`                                              | Here                                                                                                               |
-| 4   | `NMR_DELEGATE` names hosts                                                              | On a host; a command that cannot be delegated runs here, and a tree that cannot be snapshotted, here with one line |
-| 5   | `NMR_DELEGATE` is set but does not name a host                                          | Here                                                                                                               |
-| 6   | The user config's `when` matches, `CI` is unset, and the invocation is not `-F` or `-R` | On a host, as for rule 4; here with one line when no host answers                                                  |
-| 7   | Otherwise                                                                               | Here                                                                                                               |
+| 4   | `npm_lifecycle_event` names a package install hook, such as `postinstall`               | Here                                                                                                               |
+| 5   | `NMR_DELEGATE` names hosts                                                              | On a host; a command that cannot be delegated runs here, and a tree that cannot be snapshotted, here with one line |
+| 6   | `NMR_DELEGATE` is set but does not name a host                                          | Here                                                                                                               |
+| 7   | The user config's `when` matches, `CI` is unset, and the invocation is not `-F` or `-R` | On a host, as for rule 5; here with one line when no host answers                                                  |
+| 8   | Otherwise                                                                               | Here                                                                                                               |
 
-- **A step and a `-F` or `-R` child run where their parent runs.** nmr gives every process that it starts an empty `NMR_DELEGATE`, which rule 5 reads as "here"; the run on a host already passes `--no-delegate`, so a host does not apply its own user config. A git hook that an agent's command starts is an agent run.
+- **A step and a `-F` or `-R` child run where their parent runs.** nmr gives every process that it starts an empty `NMR_DELEGATE`, which rule 6 reads as "here"; the run on a host already passes `--no-delegate`, so a host does not apply its own user config. A git hook that an agent's command starts is an agent run.
 - **A repo whose checks must run on the machine that has the tree** declares `delegate: false` in `.config/nmr.config.ts`, the only value that the repo config accepts for the key. It outranks `NMR_DELEGATE` and the user config, but not a flag.
+- **A command in a package install hook runs here unless a flag asks otherwise.** During `pnpm add`, a hook such as `postinstall` sees a manifest that its lockfile does not match yet, and the host's frozen install of that tree fails. A command in any other `package.json` script, such as `test`, delegates as usual.
 - **`NMR_DEBUG=1` names what sent a command to a host**, such as `delegating ci per ~/.config/nmr/config.ts (when: agent)`, `per NMR_DELEGATE`, or `per --delegate-to`.
 
 ### Choosing among several hosts

package/docs/upgrades.md

@@ -1,6 +1,6 @@
 # Dependency upgrades
 
-What `nmr upgrade` covers from each scope, how to declare the upgrade policy and its ceilings, and the subcommands and binary that the upgrade chains run.
+What `nmr upgrade` covers from each scope, how to declare the upgrade policy and its ceilings, how it checks the Node version pin, and the subcommands and binary that the upgrade chains run.
 
 `nmr upgrade` reports the dependency upgrades available to the repo. What it covers depends on where it runs:
 
@@ -81,6 +81,23 @@ nmr upgrade --maturity-period 0
 
 Every other argument reaches every run, and `--include` and `--exclude` narrow each run as they narrow a single one. Because each run reports separately, `--json` prints one document per run, `--interactive` opens one selection per run, and `--install` installs after each run.
 
+## Node version pin
+
+Before taze runs, `nmr upgrade` checks the `nodejs` entry of `.tool-versions` in the directory from which taze reads its config: the monorepo root for `upgrade` and `root:upgrade` run there, and a package's own directory for a package-scoped run, which checks nothing unless the package has its own `.tool-versions`. It compares the pin with [Node's release index](https://nodejs.org/dist/index.json) and reports the newest release in the pin's major line:
+
+```text
+nodejs 24.22.1 → 24.22.3 is available. Run with --write to update .tool-versions.
+```
+
+`--write` rewrites that version and leaves the rest of the file unchanged. A newer major line is never proposed, whatever range mode the invocation passes: Changing majors is left to an edit of `.tool-versions`.
+
+- A release is proposed once it is at least 24 hours old. The index dates a release by UTC day alone, so a release dated D is proposed from the start of D+2, UTC.
+- Only a plain `X.Y.Z` pin is checked, and only the first version on the `nodejs` line. Any other pin, such as `lts`, is skipped with a note.
+- A repo without `.tool-versions`, or without a `nodejs` entry in it, is skipped silently.
+- `--no-node-version`, which turns off taze's own checks of `.node-version` and `.nvmrc`, turns off this check too.
+- An unreachable index, or a file that cannot be read or written, produces a warning and does not fail the upgrade.
+- `--silent` suppresses the report but not the warnings. The report goes to stderr, so `--json` output is unaffected.
+
 ## Request timeout
 
 Every `upgrade` script calls the upgrade tool with a 30-second request timeout, in place of the tool's own 5 seconds.
@@ -131,7 +148,7 @@ nmr report-overrides
 
 ## `nmr-taze`
 
-Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool, forwarding every argument to it and adding a 30-second request timeout, unless the invocation already includes one. When the taze config declares [per-package maturity periods](#per-package-maturity-periods), it runs taze once per period, adding to each run the filters and the period that confine it. Every `upgrade` chain ends with it, `root:upgrade` included; see [dependency upgrades](#dependency-upgrades) for the workflow, and [request timeout](#request-timeout) for why the timeout is set here.
+Run the [taze](https://github.com/antfu-collective/taze) dependency-upgrade tool, forwarding every argument to it and adding a 30-second request timeout, unless the invocation already includes one. When the taze config declares [per-package maturity periods](#per-package-maturity-periods), it runs taze once per period, adding to each run the filters and the period that confine it. Before the first run, it checks the [Node version pin](#node-version-pin). Every `upgrade` chain ends with it, `root:upgrade` included; see [dependency upgrades](#dependency-upgrades) for the workflow, and [request timeout](#request-timeout) for why the timeout is set here.
 
 Under pnpm's isolated `node_modules`, a transitive package's binary is absent from the consuming repo's `node_modules/.bin`, so a repo that depends on nmr cannot run `taze` directly. `nmr-taze` can, because nmr is a direct dependency, and it resolves the tool from the tree that nmr controls.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.53.1",
+  "version": "0.54.1",
   "private": false,
   "description": "Context-aware script runner for pnpm monorepos",
   "keywords": [
@@ -79,10 +79,10 @@
     "!docs/*.v*.md"
   ],
   "dependencies": {
-    "@williamthorsen/nmr-core": "0.14.0",
+    "@williamthorsen/nmr-core": "0.15.0",
     "@williamthorsen/toolbelt.errors": "0.9.0",
     "@williamthorsen/toolbelt.filesystem": "0.10.0",
-    "glob": "14.0.2",
+    "glob": "14.0.3",
     "prettier": "3.9.10",
     "prettier-plugin-sh": "0.20.2",
     "taze": "21.3.0",
@@ -90,13 +90,13 @@
   },
   "devDependencies": {
     "@williamthorsen/toolbelt.testing": "0.8.0",
-    "@williamthorsen/toolbelt.vitest": "0.13.0",
+    "@williamthorsen/toolbelt.vitest": "0.13.1",
     "esbuild": "0.28.2",
-    "readyup": "0.44.0",
+    "readyup": "0.45.0",
     "tinyglobby": "0.2.17",
     "typescript": "6.0.3",
     "vite": "8.3.5",
-    "vitest": "5.0.5",
+    "vitest": "5.1.0",
     "yaml": "2.9.1"
   },
   "peerDependencies": {

package/dist/esm/UserError.d.ts

@@ -1,8 +0,0 @@
-/**
- * A failure in what the user declared -- a config file, a `package.json` -- rather than a fault in nmr.
- *
- * The CLI boundary prints one of these as its message alone.
- */
-export declare class UserError extends Error {
-    constructor(message: string);
-}

package/dist/esm/UserError.js

@@ -1,6 +0,0 @@
-export class UserError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'UserError';
-    }
-}

package/dist/esm/reportCliFailure.d.ts

@@ -1,9 +0,0 @@
-import type { Writable } from 'node:stream';
-/**
- * Writes a failure to the CLI's error stream: as its message alone when the user's own declaration caused it,
- * and with its stack otherwise.
- *
- * A stack records where nmr noticed a problem, which says nothing about the file that a user has to edit; for
- * nmr's own fault it is where a report has to start.
- */
-export declare function reportCliFailure(error: unknown, stderr: Writable): void;

package/dist/esm/reportCliFailure.js

@@ -1,11 +0,0 @@
-import { reportError } from '@williamthorsen/nmr-core';
-import { describeError, isError } from '@williamthorsen/toolbelt.errors';
-import { UserError } from "./UserError.js";
-export function reportCliFailure(error, stderr) {
-    if (error instanceof UserError) {
-        reportError(error.message, stderr);
-        return;
-    }
-    const detail = isError(error) && error.stack !== undefined ? error.stack : describeError(error);
-    stderr.write(`${detail}\n`);
-}