everything-dev 1.7.1 → 1.8.0

package/skills/publish-sync/SKILL.md

@@ -0,0 +1,130 @@
+---
+name: publish-sync
+description: Publish bos.config.json to the FastKV registry, sync from upstream, and upgrade workspace packages. Use when deploying, syncing, or managing runtime configuration across projects.
+metadata:
+  sources: "src/plugin.ts,src/cli/sync.ts,src/cli/upgrade.ts,src/fastkv.ts,src/integrity.ts"
+---
+
+# everything-dev Publish & Sync
+
+## Core Workflow
+
+```
+Build → Deploy → Publish → Sync
+  ↓       ↓        ↓        ↓
+rspack  Zephyr   FastKV   bos sync
+        CDN      registry
+```
+
+## Publish
+
+Publish `bos.config.json` to the temporary `dev.everything.near` FastKV registry:
+
+```bash
+bos publish                  # Publish config only
+bos publish --deploy         # Build/deploy all workspaces first, then publish
+bos publish --dry-run        # Preview without sending
+bos publish --network testnet
+bos publish --packages ui,api
+```
+
+After `bos publish --deploy`:
+1. Each workspace builds and deploys to Zephyr CDN
+2. `bos.config.json` is auto-updated with production URLs + integrity hashes
+3. Config is published to the FastKV registry at `{account}/bos/gateways/{gateway}/bos.config.json`
+
+## Sync
+
+Pull updates from a published config:
+
+```bash
+bos sync                                    # From every.near/everything.dev (default)
+bos sync --account foo.near --gateway bar.com
+bos sync --network testnet
+bos sync --force
+bos sync --files                            # Also sync template files (rsbuild.config.ts, etc.)
+```
+
+What gets synced from remote:
+- `app.*.production` — Zephyr URLs
+- `app.*.ssr` — SSR URLs
+- `app.*.template`, `app.*.files`, `app.*.sync` — scaffolding config
+- `shared` — shared dependency versions
+- `gateway` — gateway URLs
+
+What stays local:
+- `account`, `testnet` — your NEAR accounts
+- `app.*.development` — local dev URLs
+
+What gets merged:
+- `app.*.secrets` — union of remote + local
+- `app.*.variables` — merged (local overrides remote)
+
+## Upgrade
+
+Bump `every-plugin` and `everything-dev` across all workspaces:
+
+```bash
+bos upgrade              # Check for new versions, update, then sync
+bos upgrade --dry-run    # Preview without making changes
+```
+
+`bos upgrade` updates **all workspace `package.json`s**, not just root. Also updates `peerDependencies` and `workspaces.catalog`. Correctly skips `workspace:*` and `catalog:` references.
+
+## Build
+
+```bash
+bos build                # Build all packages (skips missing)
+bos build ui             # Build specific package
+bos build ui,api         # Build multiple
+bos build --force        # Force rebuild
+```
+
+## Config Integrity
+
+`bos.config.json` entries can include `integrity` fields with SRI hashes:
+
+```json
+{
+  "app": {
+    "ui": {
+      "production": "https://cdn.example.com/ui/remoteEntry.js",
+      "integrity": "sha384-abc123..."
+    }
+  }
+}
+```
+
+These are auto-generated during `bos publish --deploy` and verified at runtime by the host.
+
+## Project Creation
+
+```bash
+bos create project my-app                           # Interactive
+bos create project my-app -a my.near --testnet my.testnet  # Skip prompts
+```
+
+## Configuration
+
+All runtime config lives in `bos.config.json`. Key sections:
+- `account` — NEAR mainnet account
+- `testnet` — NEAR testnet account
+- `staging.domain` — Staging domain
+- `app.host`, `app.ui`, `app.api`, `app.auth` — Module configs with development/production URLs
+- `plugins.{key}` — Plugin configs with variables, secrets, routes
+- `shared.ui`, `shared.api` — Module Federation shared dependency versions
+
+## Troubleshooting
+
+```bash
+bos info              # Show current configuration
+bos status             # Check remote health
+bos clean              # Clean build artifacts
+```
+
+Process issues:
+```bash
+bos kill               # Kill all tracked processes
+bun install            # Reinstall deps
+bos dev --host remote  # Restart
+```

package/src/app.ts

@@ -1,7 +1,6 @@
 import { existsSync } from "node:fs";
 import { createConnection } from "node:net";
 import { join } from "node:path";
-import { Effect } from "effect";
 import {
   getProjectRoot,
   isLocalDevelopmentTarget,
@@ -10,122 +9,16 @@ import {
   resolvePluginRuntimeName,
 } from "./config";
 import { getNetworkIdForAccount } from "./network";
-import { makeDevProcess, type ProcessCallbacks, type ProcessHandle } from "./orchestrator";
-import type { ProcessRegistry } from "./process-registry";
+import type { AppOrchestrator } from "./service-descriptor";
 import type { BosConfig, RuntimeConfig, RuntimePluginConfig } from "./types";
 
-export interface AppOrchestrator {
-  packages: string[];
-  env: Record<string, string>;
-  description: string;
-  bosConfig: BosConfig;
-  runtimeConfig: RuntimeConfig;
-  port?: number;
-  interactive?: boolean;
-}
+export type { AppOrchestrator };
 
-const STARTUP_ORDER = ["ui-ssr", "ui", "auth", "api", "plugin", "host-build", "host"];
 const DEFAULT_HOST_PORT = 3000;
-const DEFAULT_UI_PORT = 3002;
-const DEFAULT_API_PORT = 3014;
-const DEFAULT_AUTH_PORT = 3020;
-const DEFAULT_PLUGIN_PORT_START = 3021;
-
-const sortByOrder = (packages: string[]): string[] => {
-  return [...packages].sort((a, b) => {
-    const aIdx = a.startsWith("plugin:")
-      ? STARTUP_ORDER.indexOf("plugin")
-      : STARTUP_ORDER.indexOf(a);
-    const bIdx = b.startsWith("plugin:")
-      ? STARTUP_ORDER.indexOf("plugin")
-      : STARTUP_ORDER.indexOf(b);
-    if (aIdx === -1 && bIdx === -1) return 0;
-    if (aIdx === -1) return 1;
-    if (bIdx === -1) return -1;
-    return aIdx - bIdx;
-  });
-};
-
-// Note: log filtering and persistence lives at the CLI layer.
-
-export interface DevServersHandle {
-  handles: ProcessHandle[];
-  shutdown: Effect.Effect<void>;
-}
-
-export const startDevServers = (
-  orchestrator: AppOrchestrator,
-  callbacks: ProcessCallbacks,
-  registry?: ProcessRegistry,
-) => {
-  const run = Effect.gen(function* () {
-    const orderedPackages = sortByOrder(orchestrator.packages);
-    const handles: ProcessHandle[] = [];
-
-    const startProcess = (pkg: string) => {
-      const portOverride = pkg === "host" ? orchestrator.port : undefined;
-      return makeDevProcess(
-        pkg,
-        orchestrator.env,
-        callbacks,
-        portOverride,
-        orchestrator.bosConfig,
-        orchestrator.runtimeConfig,
-        registry,
-      );
-    };
-
-    const startGroup = (packages: string[]) =>
-      Effect.forEach(packages, startProcess, { concurrency: "unbounded" });
-
-    const awaitReady = (pkg: string, handle: ProcessHandle) =>
-      Effect.race(
-        handle.waitForReady,
-        Effect.sleep("30 seconds").pipe(
-          Effect.andThen(
-            Effect.sync(() => {
-              callbacks.onLog(pkg, "Timeout waiting for ready, continuing...", true);
-            }),
-          ),
-        ),
-      );
-
-    const nonHostPackages = orderedPackages.filter((pkg) => pkg !== "host");
-    const hostPackages = orderedPackages.filter((pkg) => pkg === "host");
-
-    const nonHostHandles = yield* startGroup(nonHostPackages);
-    handles.push(...nonHostHandles);
-
-    yield* Effect.forEach(
-      nonHostHandles.map((handle, index) => ({
-        handle,
-        pkg: nonHostPackages[index] ?? handle.name,
-      })),
-      ({ handle, pkg }) => awaitReady(pkg, handle),
-      { concurrency: "unbounded" },
-    );
-
-    const hostHandles = yield* startGroup(hostPackages);
-    handles.push(...hostHandles);
-
-    yield* Effect.forEach(
-      hostHandles.map((handle, index) => ({ handle, pkg: hostPackages[index] ?? handle.name })),
-      ({ handle, pkg }) => awaitReady(pkg, handle),
-      { concurrency: "unbounded" },
-    );
-
-    const shutdown = Effect.gen(function* () {
-      const reversed = [...handles].reverse();
-      for (const handle of reversed) {
-        yield* handle.kill.pipe(Effect.ignore);
-      }
-    });
-
-    return { handles, shutdown } satisfies DevServersHandle;
-  });
-
-  return run;
-};
+const DEFAULT_API_PORT = 3001;
+const DEFAULT_AUTH_PORT = 3002;
+const DEFAULT_UI_PORT = 3003;
+const DEFAULT_PLUGIN_PORT_START = 3010;
 
 export function detectLocalPackages(
   bosConfig?: BosConfig,
@@ -148,7 +41,9 @@ export function detectLocalPackages(
     packages.push("api");
   }
 
-  const hostLocalPath = resolveLocalDevelopmentPath(bosConfig?.app.host.development, configDir);
+  const hostLocalPath =
+    runtimeConfig?.host?.localPath ??
+    resolveLocalDevelopmentPath(bosConfig?.app.host.development, configDir);
   if (hostLocalPath && existsSync(join(hostLocalPath, "package.json"))) {
     packages.push("host");
   } else if (existsSync(join(configDir, "host", "package.json"))) {
@@ -174,120 +69,123 @@ export function detectLocalPackages(
 export function buildRuntimeConfig(
   bosConfig: BosConfig,
   options: {
+    hostSource?: "local" | "remote";
     uiSource?: "local" | "remote";
     apiSource?: "local" | "remote";
     authSource?: "local" | "remote";
-    hostUrl: string;
     proxy?: string;
     env?: "development" | "production";
     plugins?: Record<string, RuntimePluginConfig>;
   },
 ): RuntimeConfig {
   const configDir = getProjectRoot();
+  const hostConfig = bosConfig.app.host;
   const uiConfig = bosConfig.app.ui;
   const apiConfig = bosConfig.app.api;
   const authConfig = bosConfig.app.auth;
-  const uiSource = options.uiSource ?? "local";
-  const apiSource = options.apiSource ?? "local";
-  const authSource = options.authSource ?? "local";
-  const uiLocalPath = resolveLocalDevelopmentPath(uiConfig.development, configDir);
-  const apiLocalPath = resolveLocalDevelopmentPath(apiConfig.development, configDir);
-  const authLocalPath = authConfig
-    ? resolveLocalDevelopmentPath(authConfig.development, configDir)
-    : null;
-  const uiLocalUrl =
-    !uiLocalPath && uiConfig.development && !isLocalDevelopmentTarget(uiConfig.development)
-      ? uiConfig.development
-      : "";
-  const apiLocalUrl =
-    !apiLocalPath && apiConfig.development && !isLocalDevelopmentTarget(apiConfig.development)
-      ? apiConfig.development
-      : "";
-  const authLocalUrl =
-    authConfig &&
-    !authLocalPath &&
-    authConfig.development &&
-    !isLocalDevelopmentTarget(authConfig.development)
-      ? authConfig.development
-      : "";
+
+  function resolveDevelopmentEntry(
+    entry: { development?: string; production?: string },
+    preferredSource: "local" | "remote",
+  ): { source: "local" | "remote"; url: string; localPath?: string; port?: number } {
+    if (preferredSource === "remote") {
+      return { source: "remote", url: entry.production ?? "" };
+    }
+
+    const localPath = resolveLocalDevelopmentPath(entry.development, configDir);
+    if (localPath && existsSync(localPath)) {
+      return { source: "local", url: "", localPath };
+    }
+
+    const devUrl =
+      entry.development && !isLocalDevelopmentTarget(entry.development)
+        ? entry.development.replace(/\/$/, "")
+        : null;
+    if (devUrl) {
+      return { source: "local", url: devUrl, port: parsePort(devUrl) };
+    }
+
+    return { source: "remote", url: entry.production ?? "" };
+  }
+
+  const hostEntry = resolveDevelopmentEntry(hostConfig, options.hostSource ?? "local");
+  const uiEntry = resolveDevelopmentEntry(uiConfig, options.uiSource ?? "local");
+  const apiEntry = resolveDevelopmentEntry(apiConfig, options.apiSource ?? "local");
+  const authEntry = authConfig
+    ? resolveDevelopmentEntry(authConfig, options.authSource ?? "local")
+    : undefined;
+
+  const hostUrl = `http://localhost:${DEFAULT_HOST_PORT}`;
 
   return {
     env: options.env ?? "development",
     account: bosConfig.account,
     domain: bosConfig.domain,
     networkId: getNetworkIdForAccount(bosConfig.account),
-    hostUrl: options.hostUrl,
+    host: {
+      name: "host",
+      url: hostUrl,
+      entry: `${hostUrl}/mf-manifest.json`,
+      localPath: hostEntry.localPath,
+      port: hostEntry.port ?? DEFAULT_HOST_PORT,
+      secrets: hostConfig.secrets,
+      integrity: hostEntry.source === "remote" ? hostConfig.integrity : undefined,
+      source: hostEntry.source,
+      remoteUrl: hostEntry.source === "remote" ? hostEntry.url : undefined,
+    },
     shared: bosConfig.shared,
     ui: uiConfig
       ? {
           name: uiConfig.name,
-          url: uiSource === "remote" ? (uiConfig.production ?? "") : uiLocalUrl,
-          entry:
-            uiSource === "remote"
-              ? `${uiConfig.production ?? ""}/mf-manifest.json`
-              : uiLocalUrl
-                ? `${uiLocalUrl}/mf-manifest.json`
-                : "/mf-manifest.json",
-          localPath: uiSource === "local" ? (uiLocalPath ?? undefined) : undefined,
-          port: uiSource === "local" && uiLocalUrl ? parsePort(uiLocalUrl) : undefined,
-          ssrUrl: uiSource === "remote" ? uiConfig.ssr : undefined,
-          ssrIntegrity: uiSource === "remote" ? uiConfig.ssrIntegrity : undefined,
-          integrity: uiSource === "remote" ? uiConfig.integrity : undefined,
-          source: uiSource === "local" ? (uiLocalPath ? "local" : "remote") : "remote",
+          url: uiEntry.url,
+          entry: uiEntry.url ? `${uiEntry.url}/mf-manifest.json` : "/mf-manifest.json",
+          localPath: uiEntry.localPath,
+          port: uiEntry.port,
+          ssrUrl: uiEntry.source === "remote" ? uiConfig.ssr : undefined,
+          ssrIntegrity: uiEntry.source === "remote" ? uiConfig.ssrIntegrity : undefined,
+          integrity: uiEntry.source === "remote" ? uiConfig.integrity : undefined,
+          source: uiEntry.source,
         }
       : {
           name: "ui",
           url: "",
           entry: "/mf-manifest.json",
-          source: uiSource,
+          source: uiEntry.source,
         },
     api: apiConfig
       ? {
           name: apiConfig.name,
-          url: apiSource === "remote" ? (apiConfig.production ?? "") : apiLocalUrl,
-          entry:
-            apiSource === "remote"
-              ? `${apiConfig.production ?? ""}/mf-manifest.json`
-              : apiLocalUrl
-                ? `${apiLocalUrl}/mf-manifest.json`
-                : "/mf-manifest.json",
-          localPath: apiSource === "local" ? (apiLocalPath ?? undefined) : undefined,
-          port: apiSource === "local" && apiLocalUrl ? parsePort(apiLocalUrl) : undefined,
-          source: apiSource === "local" ? (apiLocalPath ? "local" : "remote") : "remote",
+          url: apiEntry.url,
+          entry: apiEntry.url ? `${apiEntry.url}/mf-manifest.json` : "/mf-manifest.json",
+          localPath: apiEntry.localPath,
+          port: apiEntry.port,
+          source: apiEntry.source,
           proxy: options.proxy ?? apiConfig.proxy,
           variables: apiConfig.variables,
           secrets: apiConfig.secrets,
-          integrity: apiSource === "remote" ? apiConfig.integrity : undefined,
+          integrity: apiEntry.source === "remote" ? apiConfig.integrity : undefined,
         }
       : {
           name: "api",
           url: "",
           entry: "/mf-manifest.json",
-          source: apiSource,
+          source: apiEntry.source,
         },
-    auth: authConfig
-      ? {
-          name: resolvePluginRuntimeName(
-            undefined,
-            authSource === "local" ? (authLocalPath ?? undefined) : undefined,
-            authConfig.name,
-          ),
-          url: authSource === "remote" ? (authConfig.production ?? "") : authLocalUrl,
-          entry:
-            authSource === "remote"
-              ? `${authConfig.production ?? ""}/mf-manifest.json`
-              : authLocalUrl
-                ? `${authLocalUrl}/mf-manifest.json`
-                : "/mf-manifest.json",
-          localPath: authSource === "local" ? (authLocalPath ?? undefined) : undefined,
-          port: authSource === "local" && authLocalUrl ? parsePort(authLocalUrl) : undefined,
-          source: authSource === "local" ? (authLocalPath ? "local" : "remote") : "remote",
-          proxy: authConfig.proxy,
-          variables: authConfig.variables,
-          secrets: authConfig.secrets,
-          integrity: authSource === "remote" ? authConfig.integrity : undefined,
-        }
-      : undefined,
+    auth:
+      authEntry && authConfig
+        ? {
+            name: resolvePluginRuntimeName(undefined, authEntry.localPath, authConfig.name),
+            url: authEntry.url,
+            entry: authEntry.url ? `${authEntry.url}/mf-manifest.json` : "/mf-manifest.json",
+            localPath: authEntry.localPath,
+            port: authEntry.port,
+            source: authEntry.source,
+            proxy: authConfig.proxy,
+            variables: authConfig.variables,
+            secrets: authConfig.secrets,
+            integrity: authEntry.source === "remote" ? authConfig.integrity : undefined,
+          }
+        : undefined,
     plugins: options.plugins,
   };
 }
@@ -339,21 +237,27 @@ export async function prepareDevelopmentRuntimeConfig(
   options?: { hostPort?: number; ssr?: boolean },
 ): Promise<RuntimeConfig> {
   const usedPorts = new Set<number>();
-  const hostPort = await pickAvailablePort(
-    options?.hostPort ??
-      (runtimeConfig.hostUrl ? parsePort(runtimeConfig.hostUrl) : DEFAULT_HOST_PORT),
-    usedPorts,
-  );
+  const hostPort = await pickAvailablePort(options?.hostPort ?? DEFAULT_HOST_PORT, usedPorts);
 
   const next: RuntimeConfig = {
     ...runtimeConfig,
-    hostUrl: `http://localhost:${hostPort}`,
+    host: { ...runtimeConfig.host, url: `http://localhost:${hostPort}`, port: hostPort },
     ui: { ...runtimeConfig.ui },
     api: { ...runtimeConfig.api },
     auth: runtimeConfig.auth ? { ...runtimeConfig.auth } : undefined,
     plugins: runtimeConfig.plugins ? { ...runtimeConfig.plugins } : undefined,
   };
 
+  if (next.api.source === "local" && next.api.localPath) {
+    const apiPort = await pickAvailablePort(next.api.port ?? DEFAULT_API_PORT, usedPorts);
+    next.api = withLocalRuntimeUrl(next.api, apiPort);
+  }
+
+  if (next.auth?.source === "local" && next.auth.localPath) {
+    const authPort = await pickAvailablePort(next.auth.port ?? DEFAULT_AUTH_PORT, usedPorts);
+    next.auth = withLocalRuntimeUrl(next.auth, authPort);
+  }
+
   if (next.ui.source === "local" && next.ui.localPath) {
     const uiPort = await pickAvailablePort(next.ui.port ?? DEFAULT_UI_PORT, usedPorts);
     next.ui = withLocalRuntimeUrl(next.ui, uiPort);
@@ -365,11 +269,6 @@ export async function prepareDevelopmentRuntimeConfig(
     }
   }
 
-  if (next.api.source === "local" && next.api.localPath) {
-    const apiPort = await pickAvailablePort(next.api.port ?? DEFAULT_API_PORT, usedPorts);
-    next.api = withLocalRuntimeUrl(next.api, apiPort);
-  }
-
   if (next.plugins) {
     const entries = Object.entries(next.plugins).sort(([a], [b]) => a.localeCompare(b));
     let pluginBasePort = DEFAULT_PLUGIN_PORT_START;
@@ -385,10 +284,5 @@ export async function prepareDevelopmentRuntimeConfig(
     }
   }
 
-  if (next.auth?.source === "local" && next.auth.localPath) {
-    const authPort = await pickAvailablePort(next.auth.port ?? DEFAULT_AUTH_PORT, usedPorts);
-    next.auth = withLocalRuntimeUrl(next.auth, authPort);
-  }
-
   return next;
 }

package/src/cli/upgrade.ts

@@ -1,5 +1,6 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { glob } from "glob";
 import type { UpgradeOptions, UpgradeResult } from "../contract";
 import { runBunInstall } from "./init";
 import { syncTemplate } from "./sync";
@@ -35,25 +36,115 @@ function readInstalledVersion(projectDir: string, packageName: string): string |
   return version.replace(/^[\^~>=]+/, "");
 }
 
-function updatePackageVersion(projectDir: string, packageName: string, newVersion: string): void {
-  const pkgPath = join(projectDir, "package.json");
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as Record<string, unknown>;
+function isBumpedableVersion(value: string | undefined): boolean {
+  if (!value) return false;
+  if (value === "workspace:*") return false;
+  if (value.startsWith("catalog:")) return false;
+  return true;
+}
+
+function bumpDepField(
+  field: Record<string, string> | undefined,
+  packageName: string,
+  newVersion: string,
+): boolean {
+  if (!field) return false;
+  if (!(packageName in field)) return false;
+  const current = field[packageName];
+  if (!isBumpedableVersion(current)) return false;
+  field[packageName] = `^${newVersion}`;
+  return true;
+}
+
+function bumpCatalog(
+  catalog: Record<string, string> | undefined,
+  packageName: string,
+  newVersion: string,
+): boolean {
+  if (!catalog) return false;
+  if (!(packageName in catalog)) return false;
+  const current = catalog[packageName];
+  if (!isBumpedableVersion(current)) return false;
+  catalog[packageName] = `^${newVersion}`;
+  return true;
+}
 
-  if (pkg.dependencies && typeof pkg.dependencies === "object") {
-    const deps = pkg.dependencies as Record<string, string>;
-    if (deps[packageName] !== undefined) {
-      deps[packageName] = `^${newVersion}`;
+interface BumpResult {
+  modified: boolean;
+  fields: string[];
+}
+
+function bumpPackageJson(
+  pkg: Record<string, unknown>,
+  packageName: string,
+  newVersion: string,
+): BumpResult {
+  const fields: string[] = [];
+
+  for (const fieldName of ["dependencies", "devDependencies", "peerDependencies"] as const) {
+    const field = pkg[fieldName] as Record<string, string> | undefined;
+    if (bumpDepField(field, packageName, newVersion)) {
+      fields.push(fieldName);
     }
   }
 
-  if (pkg.devDependencies && typeof pkg.devDependencies === "object") {
-    const deps = pkg.devDependencies as Record<string, string>;
-    if (deps[packageName] !== undefined) {
-      deps[packageName] = `^${newVersion}`;
+  const workspaces = pkg.workspaces as { catalog?: Record<string, string> } | undefined;
+  if (workspaces?.catalog && bumpCatalog(workspaces.catalog, packageName, newVersion)) {
+    fields.push("workspaces.catalog");
+  }
+
+  return { modified: fields.length > 0, fields };
+}
+
+function updatePackageVersionInFile(
+  filePath: string,
+  packageName: string,
+  newVersion: string,
+): boolean {
+  const pkg = JSON.parse(readFileSync(filePath, "utf-8")) as Record<string, unknown>;
+  const result = bumpPackageJson(pkg, packageName, newVersion);
+  if (result.modified) {
+    writeFileSync(filePath, `${JSON.stringify(pkg, null, 2)}\n`);
+  }
+  return result.modified;
+}
+
+function updatePackageVersion(
+  projectDir: string,
+  packageName: string,
+  newVersion: string,
+): boolean {
+  return updatePackageVersionInFile(join(projectDir, "package.json"), packageName, newVersion);
+}
+
+async function findWorkspacePackageJsons(projectDir: string): Promise<string[]> {
+  const rootPkgPath = join(projectDir, "package.json");
+  if (!existsSync(rootPkgPath)) return [];
+
+  const rootPkg = JSON.parse(readFileSync(rootPkgPath, "utf-8")) as Record<string, unknown>;
+  const workspaceConfig = rootPkg.workspaces as { packages?: string[] } | string[] | undefined;
+
+  const patterns: string[] = [];
+  if (Array.isArray(workspaceConfig)) {
+    patterns.push(...workspaceConfig);
+  } else if (workspaceConfig?.packages && Array.isArray(workspaceConfig.packages)) {
+    patterns.push(...workspaceConfig.packages);
+  }
+
+  if (patterns.length === 0) return [];
+
+  const pkgPaths: string[] = [];
+  for (const pattern of patterns) {
+    const matches = await glob(pattern, { cwd: projectDir, dot: false, absolute: false });
+    for (const match of matches) {
+      const pkgPath = join(projectDir, match, "package.json");
+      if (existsSync(pkgPath) && statSync(pkgPath).isFile()) {
+        pkgPaths.push(pkgPath);
+      }
     }
   }
 
-  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+  return [...new Set(pkgPaths)];
 }
 
 function buildChangelogUrl(
@@ -130,6 +221,15 @@ export async function upgradeTemplate(
     }
   }
 
+  const workspacePkgPaths = await findWorkspacePackageJsons(projectDir);
+  for (const pkgPath of workspacePkgPaths) {
+    for (const pkg of packages) {
+      if (pkg.from !== undefined && pkg.from !== pkg.to) {
+        updatePackageVersionInFile(pkgPath, pkg.name, pkg.to);
+      }
+    }
+  }
+
   if (hasUpdates && !options.noInstall) {
     await runBunInstall(projectDir);
   }