rolldown-pnpm-config 0.6.2 → 0.7.0

package/bin/rolldown-pnpm-config.js

@@ -12,7 +12,7 @@ const root = Command.make("rolldown-pnpm-config").pipe(Command.withSubcommands([
 	exportCommand,
 	previewCommand
 ]));
-Command.run(root, { version: "0.6.2" }).pipe(Effect.provide(NodeServices.layer), NodeRuntime.runMain);
+Command.run(root, { version: "0.7.0" }).pipe(Effect.provide(NodeServices.layer), NodeRuntime.runMain);
 
 //#endregion
 export {  };

package/catalogs.js

@@ -11,6 +11,7 @@
 function normalizeCatalogs(input) {
 	const out = {};
 	for (const [name, decl] of Object.entries(input)) {
+		if (typeof decl !== "object" || decl === null || typeof decl.packages !== "object" || decl.packages === null) continue;
 		const base = {};
 		const peers = {};
 		for (const [pkg, spec] of Object.entries(decl.packages)) {

package/cli/commands/upgrade.js

@@ -4,6 +4,7 @@ import { filterEntriesByCatalog, findConfigFiles, pickConfigCandidate } from "..
 import { detectCapabilities } from "../ui/env.js";
 import { derivePeerRange } from "../peer-range.js";
 import { detectPeerDrift } from "../drift.js";
+import { versionKeyOf } from "../version-key.js";
 import { buildEdits } from "../edits.js";
 import { buildInteropEdits, interopEntryChanged, runInterop } from "../interop.js";
 import { buildGroupModel, computeGroupPeers } from "../interop-live.js";
@@ -15,8 +16,10 @@ import { renderSummary } from "../summary.js";
 import { runWalk } from "../ui/run-walk.js";
 import { validateEdits } from "../validate.js";
 import { buildWalkItems } from "../walk-plan.js";
+import { findWorkspaceRoot, makeWorkspaceResolver } from "../workspace-resolve.js";
 import { Data, Effect, Option, Result } from "effect";
 import { readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import { NodeServices } from "@effect/platform-node";
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import { ReleaseAgeGate } from "@effected/npm";
@@ -41,40 +44,63 @@ function computeGate(source, file, resolver) {
 /** Maximum number of per-package version+times fetches to issue concurrently. @internal */
 const RESOLVE_CONCURRENCY = 12;
 /**
-* Fetch and age-gate the version list for each unique package.
+* Fetch and age-gate the version list for each unique (pkg × route) pair.
+* The returned maps are keyed by `versionKeyOf(entry)`, NOT the bare package
+* name: the same name can appear workspace-sourced in one catalog and
+* registry-sourced in another, and the two routes must neither share a version
+* list nor a gate exemption.
 *
 * @param onProgress - Optional callback invoked after each package resolves with
 *   `(resolved, total)`. Useful for emitting CLI progress feedback. Called with
 *   `(0, total)` before any work starts so callers can emit the initial banner.
+* @param workspace - Optional workspace-backed resolver. An entry whose
+*   `source` is `"workspace"` resolves through it instead of the registry, and
+*   is EXEMPT from the release-age gate: its next version is unpublished, so
+*   `times` is empty and the gate would otherwise hold it forever.
 *
 * @internal
 */
-function resolveGatedVersions(entries, resolver, gate, now, onProgress) {
-	const uniquePkgs = [...new Set(entries.map((e) => e.pkg))];
-	const total = uniquePkgs.length;
+function resolveGatedVersions(entries, resolver, gate, now, onProgress, workspace) {
+	const pairs = /* @__PURE__ */ new Map();
+	for (const e of entries) pairs.set(versionKeyOf(e), {
+		pkg: e.pkg,
+		fromWorkspace: workspace !== void 0 && e.source === "workspace"
+	});
+	const total = pairs.size;
 	let resolved = 0;
 	onProgress?.(0, total);
-	return Effect.forEach(uniquePkgs, (pkg) => Effect.gen(function* () {
-		const vr = yield* resolver.versions(pkg).pipe(Effect.result);
+	return Effect.forEach([...pairs], ([key, { pkg, fromWorkspace }]) => Effect.gen(function* () {
+		const vr = yield* (fromWorkspace && workspace !== void 0 ? workspace : resolver).versions(pkg).pipe(Effect.result);
 		if (Result.isFailure(vr)) {
 			onProgress?.(++resolved, total);
 			return [
+				key,
 				pkg,
 				[],
 				[]
 			];
 		}
+		if (fromWorkspace) {
+			onProgress?.(++resolved, total);
+			return [
+				key,
+				pkg,
+				vr.success,
+				vr.success
+			];
+		}
 		const times = gate.ageMinutes > 0 ? yield* resolver.times(pkg).pipe(Effect.catch(() => Effect.succeed({}))) : {};
 		onProgress?.(++resolved, total);
 		return [
+			key,
 			pkg,
 			[...gate.filterVersions(vr.success, times, pkg, now)],
 			vr.success
 		];
-	}), { concurrency: 12 }).pipe(Effect.map((triples) => ({
-		gated: new Map(triples.map(([pkg, gated]) => [pkg, gated])),
-		raw: new Map(triples.map(([pkg, , raw]) => [pkg, raw])),
-		unresolved: triples.filter(([, , raw]) => raw.length === 0).map(([pkg]) => pkg)
+	}), { concurrency: 12 }).pipe(Effect.map((rows) => ({
+		gated: new Map(rows.map(([key, , gated]) => [key, gated])),
+		raw: new Map(rows.map(([key, , , raw]) => [key, raw])),
+		unresolved: [...new Set(rows.filter(([, , , raw]) => raw.length === 0).map(([, pkg]) => pkg))]
 	})));
 }
 /**
@@ -120,20 +146,35 @@ function runUpgrade(opts) {
 			catch: (e) => new UpgradeError({ message: String(e) })
 		});
 		const gate = yield* computeGate(source, opts.file, opts.resolver);
-		const versionsByPkg = yield* resolveGatedVersions(entries, opts.resolver, gate, Date.now(), opts.onProgress);
+		const versionsByPkg = yield* resolveGatedVersions(entries, opts.resolver, gate, Date.now(), opts.onProgress, opts.workspaceResolver);
 		if (versionsByPkg.unresolved.length > 0) return yield* Effect.fail(new UpgradeError({ message: unresolvedMessage(versionsByPkg.unresolved) }));
 		const edits = [];
 		const interopEdits = [];
 		const warnings = [];
 		const changedSpans = /* @__PURE__ */ new Set();
+		const changedPkgs = /* @__PURE__ */ new Map();
+		const markChanged = (entry, to) => {
+			changedSpans.add(entry.rangeSpan[0]);
+			const name = `${entry.catalog}.${entry.pkg}`;
+			changedPkgs.set(name, {
+				name,
+				catalog: entry.catalog,
+				pkg: entry.pkg,
+				from: entry.currentRange,
+				...to !== void 0 ? { to } : {},
+				source: entry.source ?? "registry"
+			});
+		};
 		for (const entry of entries) {
 			if (entry.strategy === "interop") continue;
-			const versions = versionsByPkg.gated.get(entry.pkg) ?? [];
+			const versionKey = versionKeyOf(entry);
+			const versions = versionsByPkg.gated.get(versionKey) ?? [];
 			const pkg = entry.pkg;
 			const rangeEdit = (span, value) => ({
 				span,
 				text: JSON.stringify(value),
 				pkg,
+				versionKey,
 				kind: "range",
 				value
 			});
@@ -141,6 +182,7 @@ function runUpgrade(opts) {
 				span,
 				text: JSON.stringify(value),
 				pkg,
+				versionKey,
 				kind: "peer",
 				value
 			});
@@ -148,6 +190,7 @@ function runUpgrade(opts) {
 				span: [at, at],
 				text: `, peer: ${JSON.stringify(value)}`,
 				pkg,
+				versionKey,
 				kind: "peer",
 				value
 			});
@@ -159,32 +202,33 @@ function runUpgrade(opts) {
 					const expected = yield* detectPeerDrift(entry).pipe(Effect.catch(() => Effect.succeed(null)));
 					if (expected !== null) {
 						edits.push(peerEdit(entry.peer.span, expected));
-						changedSpans.add(entry.rangeSpan[0]);
+						markChanged(entry);
 						continue;
 					}
 				} else if (!entry.peer && entry.strategy && derived !== null) {
 					edits.push(peerInsert(at, derived.range));
-					changedSpans.add(entry.rangeSpan[0]);
+					markChanged(entry);
 					continue;
 				}
 				skipped.push(`${entry.catalog}.${entry.pkg}`);
 				continue;
 			}
-			const inRange = (yield* planEntry(entry, versions).pipe(Effect.catch(() => Effect.succeed([])))).find((c) => c.kind === "in-range");
+			const candidates = yield* planEntry(entry, versions).pipe(Effect.catch(() => Effect.succeed([])));
+			const inRange = entry.source === "workspace" ? candidates.find((c) => c.kind !== "keep") : candidates.find((c) => c.kind === "in-range");
 			const at = entry.rangeSpan[1];
 			if (inRange) {
 				edits.push(rangeEdit(entry.rangeSpan, inRange.range));
-				changedSpans.add(entry.rangeSpan[0]);
+				markChanged(entry, inRange.range);
 				if (entry.peer && inRange.peerRange) edits.push(peerEdit(entry.peer.span, inRange.peerRange));
 				else if (!entry.peer && entry.strategy && inRange.peerRange) edits.push(peerInsert(at, inRange.peerRange));
 			} else if (!entry.peer && entry.strategy && derived !== null) {
 				edits.push(peerInsert(at, derived.range));
-				changedSpans.add(entry.rangeSpan[0]);
+				markChanged(entry);
 			} else if (entry.peer && entry.strategy) {
 				const expected = yield* detectPeerDrift(entry).pipe(Effect.catch(() => Effect.succeed(null)));
 				if (expected !== null) {
 					edits.push(peerEdit(entry.peer.span, expected));
-					changedSpans.add(entry.rangeSpan[0]);
+					markChanged(entry);
 				}
 			}
 		}
@@ -199,7 +243,7 @@ function runUpgrade(opts) {
 		for (const [, group] of byCatalog) {
 			const members = [];
 			for (const e of group) {
-				const versions = versionsByPkg.gated.get(e.pkg) ?? [];
+				const versions = versionsByPkg.gated.get(versionKeyOf(e)) ?? [];
 				const inRange = (yield* planEntry(e, versions).pipe(Effect.catch(() => Effect.succeed([])))).find((c) => c.kind === "in-range");
 				const ceiling = inRange ? inRange.version : e.currentRange.replace(/^[\^~]/, "");
 				members.push({
@@ -210,10 +254,18 @@ function runUpgrade(opts) {
 			}
 			const result = yield* runInterop(members, opts.resolver);
 			interopEdits.push(...buildInteropEdits(group, result));
-			for (const e of group) if (interopEntryChanged(e, result)) changedSpans.add(e.rangeSpan[0]);
+			for (const e of group) {
+				if (!interopEntryChanged(e, result)) continue;
+				const next = result.resolved.get(e.pkg);
+				const nextRange = next === void 0 ? void 0 : `${e.operator}${next}`;
+				markChanged(e, nextRange !== void 0 && nextRange !== e.currentRange ? nextRange : void 0);
+			}
 			conflicts.push(...result.conflicts);
 		}
-		if (warnings.length > 0) return yield* Effect.fail(new UpgradeError({ message: `Refusing to apply with an incompatible peer strategy:\n${warnings.map((w) => `  ${w}`).join("\n")}` }));
+		if (warnings.length > 0) return yield* Effect.fail(new UpgradeError({
+			message: `Refusing to apply with an incompatible peer strategy:\n${warnings.map((w) => `  ${w}`).join("\n")}`,
+			kind: "peer-strategy"
+		}));
 		const { accepted, rejected } = yield* validateEdits(edits, versionsByPkg.raw);
 		if (rejected.length > 0) return yield* Effect.fail(new UpgradeError({ message: `Refusing to write unsatisfiable range(s):\n${rejected.map((r) => `  ${r.reason}`).join("\n")}` }));
 		const allEdits = [...accepted, ...interopEdits];
@@ -228,7 +280,8 @@ function runUpgrade(opts) {
 			updated: changedSpans.size,
 			skipped,
 			conflicts,
-			rejected
+			rejected,
+			changed: [...changedPkgs.values()]
 		};
 	});
 }
@@ -283,7 +336,7 @@ function unresolvedMessage(unresolved) {
 function projectDecisions(items, full) {
 	const out = [];
 	for (const i of items) {
-		const inRange = i.candidates.find((c) => c.kind === "in-range");
+		const inRange = i.entry.source === "workspace" ? i.candidates.find((c) => c.kind !== "keep") : i.candidates.find((c) => c.kind === "in-range");
 		if (inRange) {
 			out.push({
 				item: i,
@@ -323,13 +376,156 @@ function runUpgradePreview(opts) {
 			catch: (e) => new UpgradeError({ message: String(e) })
 		});
 		const gate = yield* computeGate(source, opts.file, opts.resolver);
-		const versions = yield* resolveGatedVersions(discovered.entries, opts.resolver, gate, Date.now());
+		const versions = yield* resolveGatedVersions(discovered.entries, opts.resolver, gate, Date.now(), void 0, opts.workspaceResolver);
 		const items = yield* buildWalkItems(discovered.entries, versions.gated).pipe(Effect.catch((e) => Effect.fail(new UpgradeError({ message: e.message }))));
 		const text = renderSummary(projectDecisions(items, opts.full), void 0, { color: opts.color ?? false });
 		return versions.unresolved.length > 0 ? `${text}\n⚠ ${unresolvedMessage(versions.unresolved)}` : text;
 	});
 }
 /**
+* Map a check run's drift list to the process outcome. `--check` is a pure
+* gate: exit 0 when every entry is in sync, exit 1 when an `upgrade --yes`
+* would rewrite anything — the exit code IS the contract (a release
+* validation phase calls this), and it never writes.
+*
+* @internal
+*/
+function checkOutcome(changed) {
+	if (changed.length === 0) return {
+		exitCode: 0,
+		text: "Catalogs are in sync.\n"
+	};
+	const list = changed.map((c) => `  ${c.name}  (${c.source})`).join("\n");
+	return {
+		exitCode: 1,
+		text: `Catalog drift detected in ${changed.length} package(s):\n${list}\nRun \`rolldown-pnpm-config upgrade --yes\` to apply.\n`
+	};
+}
+/**
+* Map a check run's FAILURE (a resolution failure or peer warning — an
+* UpgradeError, not drift) to the process outcome. Shares --check's single
+* non-zero exit code with drift, so the OUTPUT must name the failure family:
+* a gate consuming the exit code reports every non-zero as "drifted", and
+* without this label the CI log lies about a typo'd package or auth failure.
+*
+* @internal
+*/
+function checkFailureOutcome(message) {
+	return {
+		exitCode: 1,
+		text: `Catalog check failed before drift could be evaluated (resolution error, not drift):\n${message.split("\n").map((l) => `  ${l}`).join("\n")}\n`
+	};
+}
+/** Project a drift row to its stable `--json` object: catalog/pkg/from/to?/source, camelCase, `to` omitted (never null) when unknown. */
+function driftRowJson(row) {
+	return {
+		catalog: row.catalog,
+		pkg: row.pkg,
+		from: row.from,
+		...row.to !== void 0 ? { to: row.to } : {},
+		source: row.source
+	};
+}
+/** Serialize one single-line JSON document, newline-terminated — the ONLY bytes `--json` puts on stdout. */
+function jsonLine(doc) {
+	return `${JSON.stringify(doc)}\n`;
+}
+/**
+* The `--check --json` outcome. stdout carries exactly one single-line JSON
+* document in EVERY case — including the resolution-failure family, which
+* keeps its non-zero exit but must never leave a bash gate with exit 1 and an
+* empty stdout. The human failure label stays on stderr; the in-sync/drift
+* text is superseded by the document.
+*
+* @internal
+*/
+function checkJsonOutcome(result) {
+	if (Result.isFailure(result)) {
+		const message = result.failure.message;
+		return {
+			exitCode: 1,
+			stdout: jsonLine({
+				command: "check",
+				inSync: false,
+				error: {
+					kind: result.failure.kind ?? "resolution",
+					message
+				}
+			}),
+			stderr: checkFailureOutcome(message).text
+		};
+	}
+	const changed = result.success.changed;
+	return {
+		exitCode: changed.length === 0 ? 0 : 1,
+		stdout: jsonLine({
+			command: "check",
+			inSync: changed.length === 0,
+			drift: changed.map(driftRowJson)
+		}),
+		stderr: ""
+	};
+}
+/**
+* The `--yes --json` / `--dry-run --json` outcome. `applied` reports whether
+* the run wrote at least one change — always false under dry-run AND on an
+* already-in-sync run, so a consumer keying on it never reads a no-op as a
+* real apply; `changed` uses the same row object as check's `drift`. A failure
+* emits an error document on stdout with a non-zero exit and the human message
+* on stderr; `error.kind` is `"peer-strategy"` for a peer-strategy refusal and
+* `"resolution"` otherwise.
+*
+* @internal
+*/
+function upgradeJsonOutcome(result, dryRun) {
+	if (Result.isFailure(result)) {
+		const message = result.failure.message;
+		return {
+			exitCode: 1,
+			stdout: jsonLine({
+				command: "upgrade",
+				applied: false,
+				error: {
+					kind: result.failure.kind ?? "resolution",
+					message
+				}
+			}),
+			stderr: `${message}\n`
+		};
+	}
+	const r = result.success;
+	return {
+		exitCode: 0,
+		stdout: jsonLine({
+			command: "upgrade",
+			applied: !dryRun && r.updated > 0,
+			updated: r.updated,
+			changed: r.changed.map(driftRowJson),
+			skipped: r.skipped,
+			conflicts: r.conflicts.map((c) => ({
+				pkg: c.pkg,
+				ceiling: c.ceiling,
+				blockedBy: c.blockedBy
+			}))
+		}),
+		stderr: ""
+	};
+}
+/**
+* Reject `--json` outside the non-interactive modes it exists for. JSON mode
+* is a machine contract (a GitHub Action parsing stdout from bash); the
+* interactive table and the preview views have no meaningful document to emit.
+* Returns the rejection to fail with, or null when the combination is valid.
+*
+* @internal
+*/
+function validateJsonMode(flags) {
+	if (!flags.json) return null;
+	if (flags.preview) return new UpgradeError({ message: "--json cannot be combined with --preview; use --check, --yes, or --dry-run" });
+	if (!flags.check && !flags.yes && !flags.dryRun) return new UpgradeError({ message: "--json requires a non-interactive mode: combine it with --check, --yes, or --dry-run" });
+	return null;
+}
+/**
 * Resolve the target file: the passed path, or autodetect in cwd.
 *
 * @internal
@@ -350,6 +546,8 @@ const dryRunFlag = Flag.boolean("dry-run").pipe(Flag.withDefault(false));
 const catalogOption = Flag.string("catalog").pipe(Flag.optional);
 const previewFlag = Flag.boolean("preview").pipe(Flag.withDefault(false));
 const fullFlag = Flag.boolean("full").pipe(Flag.withDefault(false));
+const checkFlag = Flag.boolean("check").pipe(Flag.withDefault(false));
+const jsonFlag = Flag.boolean("json").pipe(Flag.withDefault(false));
 /**
 * The "upgrade" command. The default path runs the interactive table;
 * --yes applies latest-in-range non-interactively; --dry-run runs the identical
@@ -364,17 +562,67 @@ const upgradeCommand = Command.make("upgrade", {
 	dryRun: dryRunFlag,
 	catalog: catalogOption,
 	preview: previewFlag,
-	full: fullFlag
-}, ({ file: fileOpt, yes, dryRun, catalog, preview, full }) => Effect.gen(function* () {
+	full: fullFlag,
+	check: checkFlag,
+	json: jsonFlag
+}, ({ file: fileOpt, yes, dryRun, catalog, preview, full, check, json }) => Effect.gen(function* () {
+	const jsonRejection = validateJsonMode({
+		json,
+		check,
+		yes,
+		dryRun,
+		preview
+	});
+	if (jsonRejection !== null) return yield* Effect.fail(jsonRejection);
 	const file = yield* resolveTargetFile(fileOpt);
 	const resolver = yield* RegistryResolver;
 	const caps = detectCapabilities();
+	const workspaceResolver = makeWorkspaceResolver(findWorkspaceRoot(dirname(file)));
+	if (check) {
+		const result = yield* runUpgrade({
+			file,
+			resolver,
+			workspaceResolver,
+			dryRun: true
+		}).pipe(Effect.result);
+		if (json) {
+			const o = checkJsonOutcome(result);
+			yield* Effect.sync(() => {
+				if (o.stderr !== "") process.stderr.write(o.stderr);
+				process.stdout.write(o.stdout);
+				process.exitCode = o.exitCode;
+			});
+			return;
+		}
+		const failed = Result.isFailure(result);
+		const outcome = failed ? checkFailureOutcome(result.failure.message) : checkOutcome(result.success.changed);
+		yield* Effect.sync(() => {
+			(failed ? process.stderr : process.stdout).write(outcome.text);
+			process.exitCode = outcome.exitCode;
+		});
+		return;
+	}
+	if (json) {
+		const o = upgradeJsonOutcome(yield* runUpgrade({
+			file,
+			resolver,
+			dryRun,
+			workspaceResolver
+		}).pipe(Effect.result), dryRun);
+		yield* Effect.sync(() => {
+			if (o.stderr !== "") process.stderr.write(o.stderr);
+			process.stdout.write(o.stdout);
+			process.exitCode = o.exitCode;
+		});
+		return;
+	}
 	if (preview) {
 		const text = yield* runUpgradePreview({
 			file,
 			resolver,
 			full,
-			color: caps.color
+			color: caps.color,
+			workspaceResolver
 		});
 		yield* Effect.sync(() => process.stdout.write(`${text}\n`));
 		return;
@@ -384,6 +632,7 @@ const upgradeCommand = Command.make("upgrade", {
 			file,
 			resolver,
 			dryRun,
+			workspaceResolver,
 			...caps.interactive ? { onProgress: writeResolveProgress } : {}
 		});
 		yield* Effect.sync(() => process.stdout.write(dryRun ? `Dry run — no changes written. ${result.updated} package(s) would be updated; skipped ${result.skipped.length}.\n` : `Updated ${result.updated} package(s); skipped ${result.skipped.length}.\n`));
@@ -403,7 +652,7 @@ const upgradeCommand = Command.make("upgrade", {
 	});
 	const catalogName = Option.getOrUndefined(catalog);
 	const entries = filterEntriesByCatalog(discovered.entries, catalogName);
-	const versions = yield* resolveGatedVersions(entries, resolver, yield* computeGate(source, file, resolver), Date.now(), caps.interactive ? writeResolveProgress : void 0);
+	const versions = yield* resolveGatedVersions(entries, resolver, yield* computeGate(source, file, resolver), Date.now(), caps.interactive ? writeResolveProgress : void 0, workspaceResolver);
 	const items = yield* buildWalkItems(entries, versions.gated).pipe(Effect.catch((e) => Effect.fail(new UpgradeError({ message: e.message }))));
 	if (!caps.interactive) {
 		const text = renderSummary(projectDecisions(items, full), void 0, { color: caps.color });
@@ -492,4 +741,4 @@ const upgradeCommand = Command.make("upgrade", {
 }).pipe(Effect.provide(RegistryResolverLive), Effect.provide(NodeServices.layer))).pipe(Command.withDescription("Upgrade catalog versions in a config file"));
 
 //#endregion
-export { UpgradeError, applyInteropAndDecisions, computeGate, countChangedDecisions, nothingToUpgradeMessage, projectDecisions, resolveGatedVersions, resolveTargetFile, runUpgrade, runUpgradePreview, unresolvedMessage, upgradeCommand, writeResolveProgress };
+export { UpgradeError, applyInteropAndDecisions, checkFailureOutcome, checkJsonOutcome, checkOutcome, computeGate, countChangedDecisions, nothingToUpgradeMessage, projectDecisions, resolveGatedVersions, resolveTargetFile, runUpgrade, runUpgradePreview, unresolvedMessage, upgradeCommand, upgradeJsonOutcome, validateJsonMode, writeResolveProgress };

package/cli/discover.js

@@ -90,6 +90,7 @@ function discoverCatalogEntries(source, filename) {
 			let rangeNode;
 			let peerNode;
 			let strategy;
+			let source;
 			if (value.type === "Literal" && typeof value.value === "string") rangeNode = value;
 			else if (value.type === "ObjectExpression") {
 				const r = prop(value, "range");
@@ -98,6 +99,8 @@ function discoverCatalogEntries(source, filename) {
 				if (p?.type === "Literal" && typeof p.value === "string") peerNode = p;
 				const s = prop(value, "strategy");
 				if (s?.type === "Literal" && (s.value === "lock" || s.value === "lock-minor" || s.value === "interop")) strategy = s.value;
+				const src = prop(value, "source");
+				if (src?.type === "Literal" && (src.value === "registry" || src.value === "workspace")) source = src.value;
 			}
 			if (!rangeNode || !SIMPLE_RANGE_RE.test(rangeNode.value)) {
 				skipped.push(`${catalog}.${pkg}`);
@@ -114,7 +117,8 @@ function discoverCatalogEntries(source, filename) {
 					value: peerNode.value,
 					span: [peerNode.start, peerNode.end]
 				} } : {},
-				...strategy ? { strategy } : {}
+				...strategy ? { strategy } : {},
+				...source ? { source } : {}
 			});
 		}
 	}

package/cli/edits.js

@@ -1,3 +1,5 @@
+import { versionKeyOf } from "./version-key.js";
+
 //#region src/cli/edits.ts
 /**
 * Convert resolved decisions into span edits. A chosen upgrade rewrites the
@@ -15,11 +17,13 @@ function buildEdits(decisions) {
 	for (const { item, chosen } of decisions) {
 		const { entry } = item;
 		const pkg = entry.pkg;
+		const versionKey = versionKeyOf(entry);
 		const insertAt = entry.rangeSpan[1];
 		const range = (span, value) => ({
 			span,
 			text: JSON.stringify(value),
 			pkg,
+			versionKey,
 			kind: "range",
 			value
 		});
@@ -27,6 +31,7 @@ function buildEdits(decisions) {
 			span,
 			text: JSON.stringify(value),
 			pkg,
+			versionKey,
 			kind: "peer",
 			value
 		});
@@ -34,6 +39,7 @@ function buildEdits(decisions) {
 			span: [insertAt, insertAt],
 			text: `, peer: ${JSON.stringify(value)}`,
 			pkg,
+			versionKey,
 			kind: "peer",
 			value
 		});

package/cli/validate.js

@@ -41,9 +41,10 @@ function rangeIsSatisfiable(range, versions) {
 * same drift and re-reject it forever. A package is either fully updated or
 * not touched at all.
 *
-* `versionsByPkg` MUST be the UNGATED version list. Validating against the
-* release-age-gated list would spuriously reject a package whose only matching
-* version was published inside the gate window.
+* `versionsByPkg` MUST be the UNGATED version list, keyed by each edit's
+* route-aware `versionKey` (bare package name for registry-routed edits).
+* Validating against the release-age-gated list would spuriously reject a
+* package whose only matching version was published inside the gate window.
 *
 * @internal
 */
@@ -51,14 +52,16 @@ function validateEdits(edits, versionsByPkg) {
 	return Effect.gen(function* () {
 		const byPkg = /* @__PURE__ */ new Map();
 		for (const e of edits) {
-			const group = byPkg.get(e.pkg) ?? [];
+			const key = e.versionKey ?? e.pkg;
+			const group = byPkg.get(key) ?? [];
 			group.push(e);
-			byPkg.set(e.pkg, group);
+			byPkg.set(key, group);
 		}
 		const accepted = [];
 		const rejected = [];
-		for (const [pkg, group] of byPkg) {
-			const versions = versionsByPkg.get(pkg) ?? [];
+		for (const [key, group] of byPkg) {
+			const pkg = group[0]?.pkg ?? key;
+			const versions = versionsByPkg.get(key) ?? [];
 			const checked = [];
 			for (const e of group) checked.push({
 				edit: e,

package/cli/version-key.js

@@ -0,0 +1,18 @@
+//#region src/cli/version-key.ts
+/**
+* Route-aware key for the resolved-version maps returned by
+* `resolveGatedVersions`. The same package name can appear workspace-sourced
+* in one catalog and registry-sourced in another, and the two routes resolve
+* through DIFFERENT resolvers to different version lists (with different
+* release-age-gate treatment) — so the maps key each (pkg × route) pair
+* separately. The registry route keys by the bare package name; `:` can never
+* appear in an npm package name, so the prefixed workspace form cannot collide.
+*
+* @internal
+*/
+function versionKeyOf(entry) {
+	return entry.source === "workspace" ? `workspace:${entry.pkg}` : entry.pkg;
+}
+
+//#endregion
+export { versionKeyOf };

package/cli/walk-plan.js

@@ -1,5 +1,6 @@
 import { derivePeerRange } from "./peer-range.js";
 import { detectPeerDrift } from "./drift.js";
+import { versionKeyOf } from "./version-key.js";
 import { planEntry } from "./plan.js";
 import { Effect } from "effect";
 
@@ -16,7 +17,7 @@ function buildWalkItems(entries, versionsByPkg) {
 	return Effect.gen(function* () {
 		const items = [];
 		for (const entry of entries) {
-			const versions = versionsByPkg.get(entry.pkg) ?? [];
+			const versions = versionsByPkg.get(versionKeyOf(entry)) ?? [];
 			const candidates = yield* planEntry(entry, [...versions]);
 			const driftPeer = yield* detectPeerDrift(entry);
 			let peerWarning = null;

package/cli/workspace-resolve.js

@@ -0,0 +1,162 @@
+import { ResolveError } from "./resolve.js";
+import { Effect, Layer } from "effect";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { SemVer } from "@effected/semver";
+import { getWorkspacePackagesSync } from "@effected/workspaces";
+import { nodeSyncOps } from "@effected/workspaces/node-sync";
+
+//#region src/cli/workspace-resolve.ts
+const BUMP_ORDER = {
+	patch: 0,
+	minor: 1,
+	major: 2
+};
+/** Matches one changeset frontmatter line: `"@scope/name": minor` (quotes optional). */
+const FRONTMATTER_LINE_RE = /^\s*["']?([^"':\s]+)["']?\s*:\s*(major|minor|patch)\s*$/;
+/**
+* Read every workspace package manifest under `rootDir` with a usable name and
+* version, honoring the workspace's own `pnpm-workspace.yaml` `packages:`
+* globs (including exclusion patterns) via `@effected/workspaces` — never a
+* hardcoded `packages/` directory.
+*
+* There is deliberately NO publishability filter: the resolver's job is
+* finding packages and their versions, full stop. Whether and how a package
+* publishes is the author's decision, made elsewhere — and catalog membership
+* is already an explicit choice in the consuming config.
+*
+* The sync discovery facade is total by contract — an unreadable or malformed
+* manifest (including a version-less workspace root) is skipped, never raised —
+* which is exactly this resolver's degrade-don't-fail contract; the Effect
+* surface (`WorkspaceDiscovery`) instead fails typed on any unusable member.
+*
+* @internal
+*/
+function readManifests(rootDir) {
+	const out = /* @__PURE__ */ new Map();
+	for (const pkg of getWorkspacePackagesSync(rootDir, nodeSyncOps)) out.set(pkg.name, {
+		name: pkg.name,
+		version: pkg.version,
+		peerDependencies: pkg.peerDependencies
+	});
+	return out;
+}
+/**
+* Read the pending changeset bumps from `<rootDir>/.changeset/*.md` (skipping
+* README.md): each file's YAML frontmatter (between the first two `---` lines)
+* maps package name → bump level; the strongest bump per package wins.
+* An absent or unreadable `.changeset/` yields an empty map.
+*/
+function readPendingBumps(rootDir) {
+	const out = /* @__PURE__ */ new Map();
+	const dir = join(rootDir, ".changeset");
+	if (!existsSync(dir)) return out;
+	let names;
+	try {
+		names = readdirSync(dir).filter((n) => n.endsWith(".md") && n !== "README.md");
+	} catch {
+		return out;
+	}
+	for (const name of names) {
+		let text;
+		try {
+			text = readFileSync(join(dir, name), "utf8");
+		} catch {
+			continue;
+		}
+		const lines = text.split("\n");
+		const fences = [];
+		for (let i = 0; i < lines.length && fences.length < 2; i++) if (lines[i]?.trim() === "---") fences.push(i);
+		const [open, close] = fences;
+		if (open === void 0 || close === void 0) continue;
+		for (const line of lines.slice(open + 1, close)) {
+			const m = FRONTMATTER_LINE_RE.exec(line);
+			if (!m) continue;
+			const [, pkg, bump] = m;
+			const prev = out.get(pkg);
+			if (prev === void 0 || BUMP_ORDER[bump] > BUMP_ORDER[prev]) out.set(pkg, bump);
+		}
+	}
+	return out;
+}
+/** Apply the strongest pending bump for each package already present in `versions`. */
+function applyPendingBumps(rootDir, versions) {
+	const bumps = readPendingBumps(rootDir);
+	for (const [pkg, bump] of bumps) {
+		const current = versions.get(pkg);
+		if (current === void 0) continue;
+		let parsed;
+		try {
+			parsed = Effect.runSync(SemVer.parse(current));
+		} catch {
+			continue;
+		}
+		versions.set(pkg, parsed.bump[bump]().toString());
+	}
+}
+/**
+* Read every workspace package's NEXT release version: the current
+* manifest version overlaid with the bump implied by any pending changeset.
+* Absent or unreadable `.changeset/` degrades to current versions.
+*
+* @internal
+*/
+function readWorkspaceVersions(rootDir) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [name, manifest] of readManifests(rootDir)) out.set(name, manifest.version);
+	applyPendingBumps(rootDir, out);
+	return out;
+}
+/**
+* The plain (layer-less) workspace resolver value, for callers that route
+* per-entry between the registry service and the workspace instead of
+* providing one layer for the whole run. Reads lazily on first use so
+* constructing it for a config with no workspace-sourced entries costs nothing.
+*
+* @internal
+*/
+function makeWorkspaceResolver(rootDir) {
+	let manifests;
+	let versions;
+	const load = () => {
+		manifests ??= readManifests(rootDir);
+		versions ??= readWorkspaceVersions(rootDir);
+		return {
+			manifests,
+			versions
+		};
+	};
+	return {
+		versions: (pkg) => {
+			const v = load().versions.get(pkg);
+			return v === void 0 ? Effect.fail(new ResolveError({
+				pkg,
+				message: `${pkg} is not a workspace package`
+			})) : Effect.succeed([v]);
+		},
+		times: () => Effect.succeed({}),
+		peerDependencies: (pkg) => Effect.succeed(load().manifests.get(pkg)?.peerDependencies ?? {}),
+		pnpmConfig: () => Effect.succeed(null)
+	};
+}
+/**
+* Walk upward from `startDir` to the nearest directory containing
+* `pnpm-workspace.yaml`, falling back to `startDir` itself. The config file an
+* upgrade run rewrites may live in a nested package (e.g.
+* `packages/<name>/savvy.build.ts`), while the workspace versions live at the
+* repo root.
+*
+* @internal
+*/
+function findWorkspaceRoot(startDir) {
+	let dir = resolve(startDir);
+	for (;;) {
+		if (existsSync(join(dir, "pnpm-workspace.yaml"))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) return resolve(startDir);
+		dir = parent;
+	}
+}
+
+//#endregion
+export { findWorkspaceRoot, makeWorkspaceResolver, readManifests, readWorkspaceVersions };

package/index.d.ts

@@ -8,9 +8,22 @@ import { Plugin } from "rolldown";
  * @public
  */
 type PeerStrategy = "lock" | "lock-minor" | "interop";
+/**
+ * Where a catalog entry's `range` is resolved from by the `upgrade` CLI.
+ * `"registry"` (the default when omitted) queries published versions;
+ * `"workspace"` reads the local workspace's NEXT release versions (current
+ * manifest versions overlaid with pending changeset bumps). Orthogonal to
+ * `strategy`, which governs how `peer` is derived from `range` — collapsing
+ * the two would drop peer materialization entirely. CLI-only metadata; the
+ * runtime ignores it.
+ *
+ * @public
+ */
+type VersionSource = "registry" | "workspace";
 /**
  * A package's version: a bare range, or an object carrying a materialized peer
- * range (`peer`) and optional CLI recompute `strategy`.
+ * range (`peer`), optional CLI recompute `strategy`, and optional CLI version
+ * `source`.
  *
  * @public
  */
@@ -18,6 +31,7 @@ type CatalogPackageSpec = string | {
   readonly range: string;
   readonly peer?: string;
   readonly strategy?: PeerStrategy;
+  readonly source?: VersionSource;
 };
 /**
  * One catalog's declaration: a map of package name to version spec.
@@ -406,5 +420,5 @@ interface PluginConfig {
  */
 declare function PnpmConfigPlugin(config: PluginConfig): Plugin;
 //#endregion
-export { type AllowedVersionsFromCatalogs, type CatalogDeclaration, type CatalogPackageSpec, type Enforcement, type FieldInput, type LocalDirective, type PeerStrategy, type PluginConfig, PnpmConfigPlugin };
+export { type AllowedVersionsFromCatalogs, type CatalogDeclaration, type CatalogPackageSpec, type Enforcement, type FieldInput, type LocalDirective, type PeerStrategy, type PluginConfig, PnpmConfigPlugin, type VersionSource };
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "rolldown-pnpm-config",
-	"version": "0.6.2",
+	"version": "0.7.0",
 	"private": false,
 	"description": "A dogfooding example of our plugin",
 	"repository": {
@@ -36,8 +36,9 @@
 	},
 	"dependencies": {
 		"@effect/platform-node": "4.0.0-rc.109",
-		"@effected/npm": "^0.11.0",
+		"@effected/npm": "^0.11.1",
 		"@effected/semver": "^0.5.0",
+		"@effected/workspaces": "^0.17.0",
 		"@effected/yaml": "^0.10.0",
 		"effect": "4.0.0-rc.109",
 		"ink": "^7.1.1",

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.58.12"
+      "packageVersion": "7.58.13"
     }
   ]
 }