tegami 1.1.1 → 1.1.3

package/dist/{npm-BLkgWr-D.js → npm-CaBYeOeV.js}

@@ -1,22 +1,372 @@
 import { c as somePromise, i as isNodeError, n as execFailure, r as handlePluginError, s as joinPath } from "./error-BhMYq9iW.js";
 import { t as _accessExpressionAsString } from "./_accessExpressionAsString-QhbUZzwv.js";
 import { n as _validateReport, t as _createStandardSchema } from "./_createStandardSchema-BGQyz-uA.js";
+import { a as parseChangelogFile, i as parsePublishLock, n as validateChangelogStore, r as validatePackageStore } from "./draft-CzUiQasJ.js";
 import { t as _assertGuard } from "./_assertGuard-BBn2NbSz.js";
 import { n as WorkspacePackage } from "./graph-BmXTJZxx.js";
-import { a as parseChangelogFile, i as parsePublishLock, n as validateChangelogStore, r as validatePackageStore } from "./draft-DsxZOCOb.js";
 import fs, { readFile, writeFile } from "node:fs/promises";
 import path, { join } from "node:path";
 import { x } from "tinyexec";
 import * as semver$1 from "semver";
-import { parse as parse$1 } from "yaml";
-import { glob } from "tinyglobby";
+import { parseDocument } from "yaml";
 import { detect } from "package-manager-detector";
 import { tmpdir } from "node:os";
 import { intro, note, outro } from "@clack/prompts";
-//#region src/providers/npm/schema.ts
+import { glob } from "tinyglobby";
+//#region src/plans/publish.ts
+async function initPublishPlan(context, options) {
+	let lock;
+	try {
+		lock = parsePublishLock(await fs.readFile(context.lockPath, "utf8"));
+	} catch {
+		return;
+	}
+	let data;
+	const packages = /* @__PURE__ */ new Map();
+	const changelogs = /* @__PURE__ */ new Map();
+	while (data = lock.read("core:changelogs")) {
+		const validated = validateChangelogStore(data);
+		if (!validated.success) continue;
+		const entry = validated.data;
+		const parsed = parseChangelogFile(entry.filename, entry.content);
+		if (!parsed) continue;
+		changelogs.set(parsed.id, parsed);
+	}
+	while (data = lock.read("core:packages")) {
+		const validated = validatePackageStore(data);
+		if (!validated.success) continue;
+		const parsed = validated.data;
+		if (!context.graph.get(parsed.id)) continue;
+		const pkgChangelogs = [];
+		for (const id of parsed.changelogIds ?? []) {
+			const entry = changelogs.get(id);
+			if (entry) pkgChangelogs.push(entry);
+		}
+		packages.set(parsed.id, {
+			changelogs: pkgChangelogs,
+			updated: parsed.updated
+		});
+	}
+	const plan = {
+		options,
+		changelogs,
+		packages
+	};
+	for (const plugin of context.plugins) await handlePluginError(plugin, "initPublishPlan", () => plugin.initPublishPlan?.call(context, {
+		lock,
+		plan
+	}));
+	return plan;
+}
+function resolvePublishTargets(plan) {
+	/** the iteration order = publish order */
+	const orderedMap = /* @__PURE__ */ new Map();
+	/** package id -> true while scanning hard wait, false while scanning optional wait */
+	const stack = /* @__PURE__ */ new Map();
+	function scan(id) {
+		const preflight = plan.packages.get(id)?.preflight;
+		if (!preflight || !preflight.shouldPublish) return;
+		switch (stack.get(id)) {
+			case true: throw new Error(`circular reference of deps: ${[...stack.keys(), id].join(" -> ")}`);
+			case false: return;
+		}
+		if (orderedMap.has(id)) return;
+		let split = false;
+		if (preflight.wait) {
+			stack.set(id, true);
+			split ||= preflight.wait.length > 0;
+			for (const dep of preflight.wait) scan(dep);
+		}
+		if (preflight.optionalWait) {
+			stack.set(id, false);
+			split ||= preflight.optionalWait.length > 0;
+			for (const dep of preflight.optionalWait) scan(dep);
+		}
+		stack.delete(id);
+		orderedMap.set(id, { split });
+	}
+	for (const id of plan.packages.keys()) scan(id);
+	return orderedMap;
+}
+async function runPublishPlan(context, plan) {
+	const { dryRun = false, unstable_maxChunk = 5 } = plan.options;
+	for (const plugin of context.plugins) await handlePluginError(plugin, "beforePublishAll", () => plugin.beforePublishAll?.call(context, { plan }));
+	async function publish(pkg) {
+		if (dryRun) return { type: "published" };
+		try {
+			for (const plugin of context.plugins) if (await handlePluginError(plugin, "willPublish", () => plugin.willPublish?.call(context, { pkg })) === false) return { type: "skipped" };
+			for (const plugin of context.plugins) {
+				const publishResult = await handlePluginError(plugin, "publish", () => plugin.publish?.call(context, {
+					pkg,
+					plan
+				}));
+				if (publishResult) return publishResult;
+			}
+		} catch (e) {
+			return {
+				type: "failed",
+				error: e instanceof Error ? e.message : String(e)
+			};
+		}
+		return {
+			type: "failed",
+			error: `There is no plugin to publish package "${pkg.id}", please make sure the package has a supported provider plugin.`
+		};
+	}
+	let promises = [];
+	for (const [id, { split }] of resolvePublishTargets(plan)) {
+		const pkg = context.graph.get(id);
+		const packagePlan = plan.packages.get(pkg.id);
+		if (!pkg || !packagePlan) continue;
+		if (split || promises.length >= unstable_maxChunk) {
+			await Promise.all(promises);
+			promises = [];
+		}
+		promises.push(publish(pkg).then(async (result) => {
+			packagePlan.publishResult = result;
+			if (result.type === "skipped") return;
+			for (const plugin of context.plugins) await handlePluginError(plugin, "afterPublish", () => plugin.afterPublish?.call(context, {
+				pkg,
+				plan
+			}));
+		}));
+	}
+	await Promise.all(promises);
+	for (const packagePlan of plan.packages.values()) packagePlan.publishResult ??= { type: "skipped" };
+	for (const plugin of context.plugins) await handlePluginError(plugin, "afterPublishAll", () => plugin.afterPublishAll?.call(context, { plan }));
+}
+async function runPreflights(context, plan) {
+	const { graph } = context;
+	await Promise.all(Array.from(plan.packages, async ([id, packagePlan]) => {
+		const pkg = graph.get(id);
+		packagePlan.preflight = { shouldPublish: false };
+		if (!packagePlan.updated) return;
+		for (const plugin of context.plugins) {
+			const res = await handlePluginError(plugin, "publishPreflight", () => plugin.publishPreflight?.call(context, {
+				pkg,
+				plan
+			}));
+			if (res) {
+				packagePlan.preflight = res;
+				break;
+			}
+		}
+	}));
+	if (plan.options.packages?.length) {
+		const only = /* @__PURE__ */ new Set();
+		function addOnly(id) {
+			if (only.has(id)) return;
+			const preflight = plan.packages.get(id)?.preflight;
+			if (!preflight) return;
+			only.add(id);
+			if (preflight.wait) for (const dep of preflight.wait) addOnly(dep);
+			if (preflight.optionalWait) for (const dep of preflight.optionalWait) addOnly(dep);
+		}
+		for (const name of plan.options.packages) for (const pkg of graph.getByName(name)) addOnly(pkg.id);
+		for (const [id, packagePlan] of plan.packages) {
+			if (only.has(id)) continue;
+			packagePlan.preflight.shouldPublish = false;
+		}
+	}
+	for (const plugin of context.plugins) await handlePluginError(plugin, "afterPreflight", () => plugin.afterPreflight?.call(context, { plan }));
+}
+async function publishPlanStatus(plan, context) {
+	for (const plugin of context.plugins) {
+		const status = await handlePluginError(plugin, "resolvePlanStatus", () => plugin.resolvePlanStatus?.call(context, { plan }));
+		if (Array.isArray(status) && await somePromise(status, (v) => v === "pending")) return "pending";
+		if (status === "pending") return "pending";
+	}
+	return "success";
+}
+//#endregion
+//#region src/providers/npm/cli.ts
+const PLACEHOLDER_VERSION = "0.0.0-tegami-trusted-publish-setup";
+const PLACEHOLDER_DIST_TAG = "temp";
+const PROJECT_FLAG = {
+	gitlab: "--project",
+	github: "--repo"
+};
+function registerNpmCli(cli, options) {
+	cli.command("npm pretrust", { description: "publish empty placeholder packages and configure npm trusted publishing for new packages" }).option("dry-run", {
+		type: "boolean",
+		description: "show packages that would be configured without publishing"
+	}).action(async ({ context, values }) => {
+		intro("npm pretrust");
+		if (!context.graph.getPackages().some((pkg) => pkg instanceof NpmPackage)) throw new Error("No npm packages found in the workspace.");
+		const dryRun = values["dry-run"] ?? false;
+		let repo;
+		if (options.provider === "github") {
+			if (!context.github?.repo) throw new Error("The GitHub plugin must be configured with `repo` specified.");
+			repo = context.github.repo;
+		} else if (options.provider === "gitlab") {
+			if (!context.gitlab?.repo) throw new Error("The GitLab plugin must be configured with `repo` specified.");
+			repo = context.gitlab.repo;
+		} else throw new Error(`Invalid npm trusted publishing provider: ${options.provider}`);
+		const targets = await resolvePretrustTargets(context);
+		if (targets.length === 0) {
+			outro("All publishable packages in the publish lock already exist on npm.");
+			return;
+		}
+		const prepareLines = ["Make sure to run login command first, it will publish empty packages."];
+		for (const pkg of targets) prepareLines.push(`${pkg.name}: will publish a placeholder under dist-tag "${PLACEHOLDER_DIST_TAG}", then configure trusted publishing.`);
+		note(prepareLines.join("\n"), dryRun ? "Dry run" : "Configure trusted publishing");
+		const lines = [];
+		let lock;
+		if (!dryRun) try {
+			lock = parsePublishLock(await fs.readFile(context.lockPath, "utf8"));
+		} catch {}
+		for (const pkg of targets) {
+			if (dryRun) {
+				lines.push(`would configure ${pkg.name} (placeholder ${PLACEHOLDER_VERSION}@${PLACEHOLDER_DIST_TAG})`);
+				continue;
+			}
+			await publishPlaceholder(pkg);
+			await npmTrust(context, pkg, options, repo);
+			lines.push(`configured ${pkg.name} (placeholder ${PLACEHOLDER_VERSION}@${PLACEHOLDER_DIST_TAG})`);
+			lock?.write("npm:mark-latest", { id: pkg.id });
+		}
+		if (lock) await fs.writeFile(context.lockPath, lock.serialize());
+		note(lines.join("\n"), "Result");
+		outro(dryRun ? "Dry run complete. Re-run without --dry-run to publish placeholders and configure trusted publishing." : "Trusted publishing configured. CI can now publish real package versions with OIDC.");
+	});
+}
+async function resolvePretrustTargets(context) {
+	const plan = await initPublishPlan(context, {});
+	if (!plan) throw new Error(`No publish lock found at ${context.lockPath}. Run "tegami version" before configuring trusted publishing.`);
+	await runPreflights(context, plan);
+	return (await Promise.all(Array.from(plan.packages, async ([id, { preflight }]) => {
+		if (!preflight?.shouldPublish) return;
+		const pkg = context.graph.get(id);
+		if (!pkg || !(pkg instanceof NpmPackage)) return;
+		if (await isPackageOnRegistry(pkg.name, pkg.getRegistry())) return;
+		return pkg;
+	}))).filter((pkg) => pkg !== void 0);
+}
+async function isPackageOnRegistry(name, registry = "https://registry.npmjs.org") {
+	const response = await fetch(joinPath(registry, name), { headers: { Accept: "application/json" } });
+	if (response.status === 404) return false;
+	if (!response.ok) throw new Error(`Unable to check whether ${name} exists on the npm registry${registry ? ` "${registry}"` : ""}.`);
+	return true;
+}
+async function publishPlaceholder(pkg) {
+	const registry = pkg.getRegistry();
+	const access = pkg.manifest.publishConfig?.access;
+	const dir = await fs.mkdtemp(join(tmpdir(), "tegami-npm-placeholder-"));
+	try {
+		await fs.writeFile(join(dir, "package.json"), `${JSON.stringify({
+			name: pkg.name,
+			version: PLACEHOLDER_VERSION,
+			description: "Placeholder published by Tegami for npm trusted publishing setup."
+		}, null, 2)}\n`);
+		await fs.writeFile(join(dir, "README.md"), `# Placeholder package
+
+This empty package was published by [Tegami](https://tegami.fuma-nama.dev) to configure npm trusted publishing.
+
+The real package contents will be published via CI with OIDC.
+`);
+		const args = [
+			"publish",
+			"--tag",
+			PLACEHOLDER_DIST_TAG,
+			"--ignore-scripts",
+			"--registry",
+			registry
+		];
+		if (access) args.push("--access", access);
+		const result = await x("npm", args, { nodeOptions: {
+			cwd: dir,
+			stdio: "inherit"
+		} });
+		if (result.exitCode !== 0) {
+			const hint = result.stderr.includes("EOTP") ? " Complete npm 2FA in the terminal, or publish with an OTP-capable session." : "";
+			throw execFailure(`Failed to publish placeholder ${pkg.name}@${PLACEHOLDER_VERSION} with dist-tag "${PLACEHOLDER_DIST_TAG}".${hint}`, result);
+		}
+	} finally {
+		await fs.rm(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+async function npmTrust(context, pkg, options, repo) {
+	const result = await x("npm", [
+		"trust",
+		options.provider,
+		pkg.name,
+		PROJECT_FLAG[options.provider],
+		repo,
+		"--file",
+		options.workflow,
+		"--allow-publish",
+		"-y",
+		"--registry",
+		pkg.getRegistry()
+	], { nodeOptions: {
+		cwd: context.cwd,
+		stdio: "inherit"
+	} });
+	if (result.exitCode !== 0) {
+		const hint = result.stderr.includes("EOTP") ? " Complete npm 2FA in the terminal when prompted." : "";
+		throw execFailure(`Failed to configure trusted publishing for ${pkg.name}.${hint}`, result);
+	}
+}
+//#endregion
+//#region src/providers/npm/graph.ts
+var NpmPackage = class extends WorkspacePackage {
+	path;
+	manifest;
+	manager = "npm";
+	dependencies;
+	constructor(path, manifest) {
+		super();
+		this.path = path;
+		this.manifest = manifest;
+	}
+	get name() {
+		return this.manifest.name;
+	}
+	get version() {
+		return this.manifest.version;
+	}
+	async write() {
+		await writeFile(path.join(this.path, "package.json"), `${JSON.stringify(this.manifest, null, 2)}\n`);
+	}
+	initDraft() {
+		const defaults = super.initDraft();
+		defaults.npm = { distTag: this.manifest.publishConfig?.tag };
+		return defaults;
+	}
+	getRegistry() {
+		return this.manifest.publishConfig?.registry ?? "https://registry.npmjs.org";
+	}
+	configureDraft({ draft }) {
+		super.configureDraft({ draft });
+		const { distTag = this.group?.options?.npm?.distTag } = this.options.npm ?? {};
+		if (distTag) {
+			draft.npm ??= {};
+			draft.npm.distTag = distTag;
+		} else if (draft.prerelease) {
+			draft.npm ??= {};
+			draft.npm.distTag ??= draft.prerelease;
+		}
+	}
+	listDependencies(graph) {
+		return this.dependencies ??= listDependencies(graph, this);
+	}
+};
 const assertPnpmWorkspace = (() => {
-	const _io0 = (input) => void 0 === input.packages || Array.isArray(input.packages) && input.packages.every((elem) => "string" === typeof elem);
-	const _ao0 = (input, _path, _exceptionable = true) => void 0 === input.packages || (Array.isArray(input.packages) || _assertGuard(_exceptionable, {
+	const _io0 = (input) => (void 0 === input.packages || Array.isArray(input.packages) && input.packages.every((elem) => "string" === typeof elem)) && (void 0 === input.catalog || "object" === typeof input.catalog && null !== input.catalog && false === Array.isArray(input.catalog) && _io1(input.catalog)) && (void 0 === input.catalogs || "object" === typeof input.catalogs && null !== input.catalogs && false === Array.isArray(input.catalogs) && _io2(input.catalogs));
+	const _io1 = (input) => Object.keys(input).every((key) => {
+		const value = input[key];
+		if (void 0 === value) return true;
+		return "string" === typeof value;
+	});
+	const _io2 = (input) => Object.keys(input).every((key) => {
+		const value = input[key];
+		if (void 0 === value) return true;
+		return "object" === typeof value && null !== value && false === Array.isArray(value) && _io1(value);
+	});
+	const _ao0 = (input, _path, _exceptionable = true) => (void 0 === input.packages || (Array.isArray(input.packages) || _assertGuard(_exceptionable, {
 		method: "typia.createAssert",
 		path: _path + ".packages",
 		expected: "(Array<string> | undefined)",
@@ -31,7 +381,52 @@ const assertPnpmWorkspace = (() => {
 		path: _path + ".packages",
 		expected: "(Array<string> | undefined)",
 		value: input.packages
-	}, _errorFactory);
+	}, _errorFactory)) && (void 0 === input.catalog || ("object" === typeof input.catalog && null !== input.catalog && false === Array.isArray(input.catalog) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalog",
+		expected: "(Record<string, string> | undefined)",
+		value: input.catalog
+	}, _errorFactory)) && _ao1(input.catalog, _path + ".catalog", _exceptionable) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalog",
+		expected: "(Record<string, string> | undefined)",
+		value: input.catalog
+	}, _errorFactory)) && (void 0 === input.catalogs || ("object" === typeof input.catalogs && null !== input.catalogs && false === Array.isArray(input.catalogs) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalogs",
+		expected: "(Record<string, Record<string, string>> | undefined)",
+		value: input.catalogs
+	}, _errorFactory)) && _ao2(input.catalogs, _path + ".catalogs", _exceptionable) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalogs",
+		expected: "(Record<string, Record<string, string>> | undefined)",
+		value: input.catalogs
+	}, _errorFactory));
+	const _ao1 = (input, _path, _exceptionable = true) => false === _exceptionable || Object.keys(input).every((key) => {
+		const value = input[key];
+		if (void 0 === value) return true;
+		return "string" === typeof value || _assertGuard(_exceptionable, {
+			method: "typia.createAssert",
+			path: _path + _accessExpressionAsString(key),
+			expected: "string",
+			value
+		}, _errorFactory);
+	});
+	const _ao2 = (input, _path, _exceptionable = true) => false === _exceptionable || Object.keys(input).every((key) => {
+		const value = input[key];
+		if (void 0 === value) return true;
+		return ("object" === typeof value && null !== value && false === Array.isArray(value) || _assertGuard(_exceptionable, {
+			method: "typia.createAssert",
+			path: _path + _accessExpressionAsString(key),
+			expected: "Record<string, string>",
+			value
+		}, _errorFactory)) && _ao1(value, _path + _accessExpressionAsString(key), _exceptionable) || _assertGuard(_exceptionable, {
+			method: "typia.createAssert",
+			path: _path + _accessExpressionAsString(key),
+			expected: "Record<string, string>",
+			value
+		}, _errorFactory);
+	});
 	const __is = (input) => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
 	let _errorFactory;
 	return (input, errorFactory) => {
@@ -53,13 +448,19 @@ const assertPnpmWorkspace = (() => {
 	};
 })();
 const assertPackageManifest = (() => {
-	const _io0 = (input) => "string" === typeof input.name && (void 0 === input.version || "string" === typeof input.version) && (void 0 === input["private"] || "boolean" === typeof input["private"]) && (void 0 === input.publishConfig || "object" === typeof input.publishConfig && null !== input.publishConfig && false === Array.isArray(input.publishConfig) && _io1(input.publishConfig)) && (void 0 === input.scripts || "object" === typeof input.scripts && null !== input.scripts && false === Array.isArray(input.scripts) && _io2(input.scripts)) && (void 0 === input.workspaces || Array.isArray(input.workspaces) && input.workspaces.every((elem) => "string" === typeof elem)) && (void 0 === input.dependencies || "object" === typeof input.dependencies && null !== input.dependencies && false === Array.isArray(input.dependencies) && _io2(input.dependencies)) && (void 0 === input.devDependencies || "object" === typeof input.devDependencies && null !== input.devDependencies && false === Array.isArray(input.devDependencies) && _io2(input.devDependencies)) && (void 0 === input.peerDependencies || "object" === typeof input.peerDependencies && null !== input.peerDependencies && false === Array.isArray(input.peerDependencies) && _io2(input.peerDependencies)) && (void 0 === input.optionalDependencies || "object" === typeof input.optionalDependencies && null !== input.optionalDependencies && false === Array.isArray(input.optionalDependencies) && _io2(input.optionalDependencies));
+	const _io0 = (input) => "string" === typeof input.name && (void 0 === input.version || "string" === typeof input.version) && (void 0 === input["private"] || "boolean" === typeof input["private"]) && (void 0 === input.publishConfig || "object" === typeof input.publishConfig && null !== input.publishConfig && false === Array.isArray(input.publishConfig) && _io1(input.publishConfig)) && (void 0 === input.scripts || "object" === typeof input.scripts && null !== input.scripts && false === Array.isArray(input.scripts) && _io2(input.scripts)) && null !== input.workspaces && (void 0 === input.workspaces || Array.isArray(input.workspaces) && input.workspaces.every((elem) => "string" === typeof elem) || "object" === typeof input.workspaces && null !== input.workspaces && false === Array.isArray(input.workspaces) && _io3(input.workspaces)) && (void 0 === input.catalog || "object" === typeof input.catalog && null !== input.catalog && false === Array.isArray(input.catalog) && _io2(input.catalog)) && (void 0 === input.catalogs || "object" === typeof input.catalogs && null !== input.catalogs && false === Array.isArray(input.catalogs) && _io4(input.catalogs)) && (void 0 === input.dependencies || "object" === typeof input.dependencies && null !== input.dependencies && false === Array.isArray(input.dependencies) && _io2(input.dependencies)) && (void 0 === input.devDependencies || "object" === typeof input.devDependencies && null !== input.devDependencies && false === Array.isArray(input.devDependencies) && _io2(input.devDependencies)) && (void 0 === input.peerDependencies || "object" === typeof input.peerDependencies && null !== input.peerDependencies && false === Array.isArray(input.peerDependencies) && _io2(input.peerDependencies)) && (void 0 === input.optionalDependencies || "object" === typeof input.optionalDependencies && null !== input.optionalDependencies && false === Array.isArray(input.optionalDependencies) && _io2(input.optionalDependencies));
 	const _io1 = (input) => (void 0 === input.access || "public" === input.access || "restricted" === input.access) && (void 0 === input.registry || "string" === typeof input.registry) && (void 0 === input.tag || "string" === typeof input.tag);
 	const _io2 = (input) => Object.keys(input).every((key) => {
 		const value = input[key];
 		if (void 0 === value) return true;
 		return "string" === typeof value;
 	});
+	const _io3 = (input) => (void 0 === input.packages || Array.isArray(input.packages) && input.packages.every((elem) => "string" === typeof elem)) && (void 0 === input.catalog || "object" === typeof input.catalog && null !== input.catalog && false === Array.isArray(input.catalog) && _io2(input.catalog)) && (void 0 === input.catalogs || "object" === typeof input.catalogs && null !== input.catalogs && false === Array.isArray(input.catalogs) && _io4(input.catalogs));
+	const _io4 = (input) => Object.keys(input).every((key) => {
+		const value = input[key];
+		if (void 0 === value) return true;
+		return "object" === typeof value && null !== value && false === Array.isArray(value) && _io2(value);
+	});
 	const _ao0 = (input, _path, _exceptionable = true) => ("string" === typeof input.name || _assertGuard(_exceptionable, {
 		method: "typia.createAssert",
 		path: _path + ".name",
@@ -95,21 +496,46 @@ const assertPackageManifest = (() => {
 		path: _path + ".scripts",
 		expected: "(Record<string, string> | undefined)",
 		value: input.scripts
-	}, _errorFactory)) && (void 0 === input.workspaces || (Array.isArray(input.workspaces) || _assertGuard(_exceptionable, {
+	}, _errorFactory)) && (null !== input.workspaces || _assertGuard(_exceptionable, {
 		method: "typia.createAssert",
 		path: _path + ".workspaces",
-		expected: "(Array<string> | undefined)",
+		expected: "(Array<string> | BunWorkspaces | undefined)",
 		value: input.workspaces
-	}, _errorFactory)) && input.workspaces.every((elem, _index2) => "string" === typeof elem || _assertGuard(_exceptionable, {
+	}, _errorFactory)) && (void 0 === input.workspaces || Array.isArray(input.workspaces) && input.workspaces.every((elem, _index3) => "string" === typeof elem || _assertGuard(_exceptionable, {
 		method: "typia.createAssert",
-		path: _path + ".workspaces[" + _index2 + "]",
+		path: _path + ".workspaces[" + _index3 + "]",
 		expected: "string",
 		value: elem
-	}, _errorFactory)) || _assertGuard(_exceptionable, {
+	}, _errorFactory)) || "object" === typeof input.workspaces && null !== input.workspaces && false === Array.isArray(input.workspaces) && _ao3(input.workspaces, _path + ".workspaces", _exceptionable) || _assertGuard(_exceptionable, {
 		method: "typia.createAssert",
 		path: _path + ".workspaces",
-		expected: "(Array<string> | undefined)",
+		expected: "(Array<string> | BunWorkspaces | undefined)",
+		value: input.workspaces
+	}, _errorFactory) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".workspaces",
+		expected: "(Array<string> | BunWorkspaces | undefined)",
 		value: input.workspaces
+	}, _errorFactory)) && (void 0 === input.catalog || ("object" === typeof input.catalog && null !== input.catalog && false === Array.isArray(input.catalog) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalog",
+		expected: "(Record<string, string> | undefined)",
+		value: input.catalog
+	}, _errorFactory)) && _ao2(input.catalog, _path + ".catalog", _exceptionable) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalog",
+		expected: "(Record<string, string> | undefined)",
+		value: input.catalog
+	}, _errorFactory)) && (void 0 === input.catalogs || ("object" === typeof input.catalogs && null !== input.catalogs && false === Array.isArray(input.catalogs) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalogs",
+		expected: "(Record<string, Record<string, string>> | undefined)",
+		value: input.catalogs
+	}, _errorFactory)) && _ao4(input.catalogs, _path + ".catalogs", _exceptionable) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalogs",
+		expected: "(Record<string, Record<string, string>> | undefined)",
+		value: input.catalogs
 	}, _errorFactory)) && (void 0 === input.dependencies || ("object" === typeof input.dependencies && null !== input.dependencies && false === Array.isArray(input.dependencies) || _assertGuard(_exceptionable, {
 		method: "typia.createAssert",
 		path: _path + ".dependencies",
@@ -177,376 +603,363 @@ const assertPackageManifest = (() => {
 			value
 		}, _errorFactory);
 	});
-	const __is = (input) => "object" === typeof input && null !== input && _io0(input);
-	let _errorFactory;
-	return (input, errorFactory) => {
-		if (false === __is(input)) {
-			_errorFactory = errorFactory;
-			((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input || _assertGuard(true, {
-				method: "typia.createAssert",
-				path: _path + "",
-				expected: "PackageManifest",
-				value: input
-			}, _errorFactory)) && _ao0(input, _path + "", true) || _assertGuard(true, {
-				method: "typia.createAssert",
-				path: _path + "",
-				expected: "PackageManifest",
-				value: input
-			}, _errorFactory))(input, "$input", true);
-		}
-		return input;
-	};
-})();
-//#endregion
-//#region src/plans/publish.ts
-async function initPublishPlan(context, options) {
-	let lock;
-	try {
-		lock = parsePublishLock(await fs.readFile(context.lockPath, "utf8"));
-	} catch {
-		return;
-	}
-	let data;
-	const packages = /* @__PURE__ */ new Map();
-	const changelogs = /* @__PURE__ */ new Map();
-	while (data = lock.read("core:changelogs")) {
-		const validated = validateChangelogStore(data);
-		if (!validated.success) continue;
-		const entry = validated.data;
-		const parsed = parseChangelogFile(entry.filename, entry.content);
-		if (!parsed) continue;
-		changelogs.set(parsed.id, parsed);
-	}
-	while (data = lock.read("core:packages")) {
-		const validated = validatePackageStore(data);
-		if (!validated.success) continue;
-		const parsed = validated.data;
-		if (!context.graph.get(parsed.id)) continue;
-		const pkgChangelogs = [];
-		for (const id of parsed.changelogIds ?? []) {
-			const entry = changelogs.get(id);
-			if (entry) pkgChangelogs.push(entry);
-		}
-		packages.set(parsed.id, {
-			changelogs: pkgChangelogs,
-			updated: parsed.updated
-		});
-	}
-	const plan = {
-		options,
-		changelogs,
-		packages
-	};
-	for (const plugin of context.plugins) await handlePluginError(plugin, "initPublishPlan", () => plugin.initPublishPlan?.call(context, {
-		lock,
-		plan
-	}));
-	return plan;
-}
-function resolvePublishTargets(plan) {
-	const ordered = [];
-	const scanned = /* @__PURE__ */ new Set();
-	function scan(id, stack) {
-		const preflight = plan.packages.get(id)?.preflight;
-		if (!preflight || !preflight.shouldPublish) return;
-		if (stack.has(id)) throw new Error(`circular reference of deps: ${[...stack, id].join(" -> ")}`);
-		if (scanned.has(id)) return;
-		if (preflight.wait) {
-			stack.add(id);
-			for (const dep of preflight.wait) scan(dep, stack);
-			stack.delete(id);
-		}
-		ordered.push(id);
-		scanned.add(id);
-	}
-	const stack = /* @__PURE__ */ new Set();
-	for (const id of plan.packages.keys()) scan(id, stack);
-	return ordered;
-}
-async function runPublishPlan(context, plan) {
-	const { dryRun = false } = plan.options;
-	const onPublishResult = async (pkg, publishResult) => {
-		const packagePlan = plan.packages.get(pkg.id);
-		if (!packagePlan) return;
-		packagePlan.publishResult = publishResult;
-		if (publishResult.type === "skipped") return;
-		for (const plugin of context.plugins) await handlePluginError(plugin, "afterPublish", () => plugin.afterPublish?.call(context, {
-			pkg,
-			plan
-		}));
-	};
-	publishLoop: for (const id of resolvePublishTargets(plan)) {
-		const pkg = context.graph.get(id);
-		if (dryRun) {
-			await onPublishResult(pkg, { type: "published" });
-			continue;
-		}
-		for (const plugin of context.plugins) if (await handlePluginError(plugin, "willPublish", () => plugin.willPublish?.call(context, { pkg })) === false) continue publishLoop;
-		for (const plugin of context.plugins) {
-			const publishResult = await handlePluginError(plugin, "publish", () => plugin.publish?.call(context, {
-				pkg,
-				plan
-			}));
-			if (publishResult) {
-				await onPublishResult(pkg, publishResult);
-				continue publishLoop;
-			}
-		}
-		await onPublishResult(pkg, {
-			type: "failed",
-			error: `There is no plugin to publish package "${pkg.id}", please make sure the package has a supported provider plugin.`
-		});
-	}
-	for (const packagePlan of plan.packages.values()) packagePlan.publishResult ??= { type: "skipped" };
-	for (const plugin of context.plugins) await handlePluginError(plugin, "afterPublishAll", () => plugin.afterPublishAll?.call(context, { plan }));
-}
-async function runPreflights(context, plan) {
-	const promises = [];
-	for (const [id, packagePlan] of plan.packages) {
-		const pkg = context.graph.get(id);
-		packagePlan.preflight = { shouldPublish: false };
-		if (!packagePlan.updated) continue;
-		promises.push((async () => {
-			for (const plugin of context.plugins) {
-				const res = await handlePluginError(plugin, "publishPreflight", () => plugin.publishPreflight?.call(context, {
-					pkg,
-					plan
-				}));
-				if (res) {
-					packagePlan.preflight = res;
-					break;
-				}
-			}
-		})());
-	}
-	await Promise.all(promises);
-	for (const plugin of context.plugins) await handlePluginError(plugin, "afterPreflight", () => plugin.afterPreflight?.call(context, { plan }));
-}
-async function publishPlanStatus(plan, context) {
-	for (const plugin of context.plugins) {
-		const status = await handlePluginError(plugin, "resolvePlanStatus", () => plugin.resolvePlanStatus?.call(context, { plan }));
-		if (Array.isArray(status) && await somePromise(status, (v) => v === "pending")) return "pending";
-		if (status === "pending") return "pending";
-	}
-	return "success";
-}
-//#endregion
-//#region src/providers/npm/cli.ts
-const PLACEHOLDER_VERSION = "0.0.0-tegami-trusted-publish-setup";
-const PLACEHOLDER_DIST_TAG = "temp";
-const PROJECT_FLAG = {
-	gitlab: "--project",
-	github: "--repo"
-};
-function registerNpmCli(cli, options) {
-	cli.command("npm pretrust", { description: "publish empty placeholder packages and configure npm trusted publishing for new packages" }).option("dry-run", {
-		type: "boolean",
-		description: "show packages that would be configured without publishing"
-	}).action(async ({ context, values }) => {
-		intro("npm pretrust");
-		if (!context.graph.getPackages().some((pkg) => pkg instanceof NpmPackage)) throw new Error("No npm packages found in the workspace.");
-		const dryRun = values["dry-run"] ?? false;
-		let repo;
-		if (options.provider === "github") {
-			if (!context.github?.repo) throw new Error("The GitHub plugin must be configured with `repo` specified.");
-			repo = context.github.repo;
-		} else if (options.provider === "gitlab") {
-			if (!context.gitlab?.repo) throw new Error("The GitLab plugin must be configured with `repo` specified.");
-			repo = context.gitlab.repo;
-		} else throw new Error(`Invalid npm trusted publishing provider: ${options.provider}`);
-		const targets = await resolvePretrustTargets(context);
-		if (targets.length === 0) {
-			outro("All publishable packages in the publish lock already exist on npm.");
-			return;
-		}
-		const prepareLines = ["Make sure to run login command first, it will publish empty packages."];
-		for (const pkg of targets) prepareLines.push(`${pkg.name}: will publish a placeholder under dist-tag "${PLACEHOLDER_DIST_TAG}", then configure trusted publishing.`);
-		note(prepareLines.join("\n"), dryRun ? "Dry run" : "Configure trusted publishing");
-		const lines = [];
-		let lock;
-		if (!dryRun) try {
-			lock = parsePublishLock(await fs.readFile(context.lockPath, "utf8"));
-		} catch {}
-		for (const pkg of targets) {
-			if (dryRun) {
-				lines.push(`would configure ${pkg.name} (placeholder ${PLACEHOLDER_VERSION}@${PLACEHOLDER_DIST_TAG})`);
-				continue;
-			}
-			await publishPlaceholder(pkg);
-			await npmTrust(context, pkg, options, repo);
-			lines.push(`configured ${pkg.name} (placeholder ${PLACEHOLDER_VERSION}@${PLACEHOLDER_DIST_TAG})`);
-			lock?.write("npm:mark-latest", { id: pkg.id });
-		}
-		if (lock) await fs.writeFile(context.lockPath, lock.serialize());
-		note(lines.join("\n"), "Result");
-		outro(dryRun ? "Dry run complete. Re-run without --dry-run to publish placeholders and configure trusted publishing." : "Trusted publishing configured. CI can now publish real package versions with OIDC.");
+	const _ao3 = (input, _path, _exceptionable = true) => (void 0 === input.packages || (Array.isArray(input.packages) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".packages",
+		expected: "(Array<string> | undefined)",
+		value: input.packages
+	}, _errorFactory)) && input.packages.every((elem, _index4) => "string" === typeof elem || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".packages[" + _index4 + "]",
+		expected: "string",
+		value: elem
+	}, _errorFactory)) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".packages",
+		expected: "(Array<string> | undefined)",
+		value: input.packages
+	}, _errorFactory)) && (void 0 === input.catalog || ("object" === typeof input.catalog && null !== input.catalog && false === Array.isArray(input.catalog) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalog",
+		expected: "(Record<string, string> | undefined)",
+		value: input.catalog
+	}, _errorFactory)) && _ao2(input.catalog, _path + ".catalog", _exceptionable) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalog",
+		expected: "(Record<string, string> | undefined)",
+		value: input.catalog
+	}, _errorFactory)) && (void 0 === input.catalogs || ("object" === typeof input.catalogs && null !== input.catalogs && false === Array.isArray(input.catalogs) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalogs",
+		expected: "(Record<string, Record<string, string>> | undefined)",
+		value: input.catalogs
+	}, _errorFactory)) && _ao4(input.catalogs, _path + ".catalogs", _exceptionable) || _assertGuard(_exceptionable, {
+		method: "typia.createAssert",
+		path: _path + ".catalogs",
+		expected: "(Record<string, Record<string, string>> | undefined)",
+		value: input.catalogs
+	}, _errorFactory));
+	const _ao4 = (input, _path, _exceptionable = true) => false === _exceptionable || Object.keys(input).every((key) => {
+		const value = input[key];
+		if (void 0 === value) return true;
+		return ("object" === typeof value && null !== value && false === Array.isArray(value) || _assertGuard(_exceptionable, {
+			method: "typia.createAssert",
+			path: _path + _accessExpressionAsString(key),
+			expected: "Record<string, string>",
+			value
+		}, _errorFactory)) && _ao2(value, _path + _accessExpressionAsString(key), _exceptionable) || _assertGuard(_exceptionable, {
+			method: "typia.createAssert",
+			path: _path + _accessExpressionAsString(key),
+			expected: "Record<string, string>",
+			value
+		}, _errorFactory);
 	});
-}
-async function resolvePretrustTargets(context) {
-	const plan = await initPublishPlan(context, {});
-	if (!plan) throw new Error(`No publish lock found at ${context.lockPath}. Run "tegami version" before configuring trusted publishing.`);
-	await runPreflights(context, plan);
-	return (await Promise.all(Array.from(plan.packages, async ([id, { preflight }]) => {
-		if (!preflight?.shouldPublish) return;
-		const pkg = context.graph.get(id);
-		if (!pkg || !(pkg instanceof NpmPackage)) return;
-		if (await isPackageOnRegistry(pkg.name, pkg.getRegistry())) return;
-		return pkg;
-	}))).filter((pkg) => pkg !== void 0);
-}
-async function isPackageOnRegistry(name, registry = "https://registry.npmjs.org") {
-	const response = await fetch(joinPath(registry, name), { headers: { Accept: "application/json" } });
-	if (response.status === 404) return false;
-	if (!response.ok) throw new Error(`Unable to check whether ${name} exists on the npm registry${registry ? ` "${registry}"` : ""}.`);
-	return true;
-}
-async function publishPlaceholder(pkg) {
-	const registry = pkg.getRegistry();
-	const access = pkg.manifest.publishConfig?.access;
-	const dir = await fs.mkdtemp(join(tmpdir(), "tegami-npm-placeholder-"));
-	try {
-		await fs.writeFile(join(dir, "package.json"), `${JSON.stringify({
-			name: pkg.name,
-			version: PLACEHOLDER_VERSION,
-			description: "Placeholder published by Tegami for npm trusted publishing setup."
-		}, null, 2)}\n`);
-		await fs.writeFile(join(dir, "README.md"), `# Placeholder package
-
-This empty package was published by [Tegami](https://tegami.fuma-nama.dev) to configure npm trusted publishing.
-
-The real package contents will be published via CI with OIDC.
-`);
-		const args = [
-			"publish",
-			"--tag",
-			PLACEHOLDER_DIST_TAG,
-			"--ignore-scripts",
-			"--registry",
-			registry
-		];
-		if (access) args.push("--access", access);
-		const result = await x("npm", args, { nodeOptions: {
-			cwd: dir,
-			stdio: "inherit"
-		} });
-		if (result.exitCode !== 0) {
-			const hint = result.stderr.includes("EOTP") ? " Complete npm 2FA in the terminal, or publish with an OTP-capable session." : "";
-			throw execFailure(`Failed to publish placeholder ${pkg.name}@${PLACEHOLDER_VERSION} with dist-tag "${PLACEHOLDER_DIST_TAG}".${hint}`, result);
+	const __is = (input) => "object" === typeof input && null !== input && _io0(input);
+	let _errorFactory;
+	return (input, errorFactory) => {
+		if (false === __is(input)) {
+			_errorFactory = errorFactory;
+			((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input || _assertGuard(true, {
+				method: "typia.createAssert",
+				path: _path + "",
+				expected: "PackageManifest",
+				value: input
+			}, _errorFactory)) && _ao0(input, _path + "", true) || _assertGuard(true, {
+				method: "typia.createAssert",
+				path: _path + "",
+				expected: "PackageManifest",
+				value: input
+			}, _errorFactory))(input, "$input", true);
 		}
-	} finally {
-		await fs.rm(dir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-async function npmTrust(context, pkg, options, repo) {
-	const result = await x("npm", [
-		"trust",
-		options.provider,
-		pkg.name,
-		PROJECT_FLAG[options.provider],
-		repo,
-		"--file",
-		options.workflow,
-		"--allow-publish",
-		"-y",
-		"--registry",
-		pkg.getRegistry()
-	], { nodeOptions: {
-		cwd: context.cwd,
-		stdio: "inherit"
-	} });
-	if (result.exitCode !== 0) {
-		const hint = result.stderr.includes("EOTP") ? " Complete npm 2FA in the terminal when prompted." : "";
-		throw execFailure(`Failed to configure trusted publishing for ${pkg.name}.${hint}`, result);
-	}
-}
-//#endregion
-//#region src/providers/npm.ts
+		return input;
+	};
+})();
 const DEP_FIELDS = [
 	"dependencies",
 	"devDependencies",
 	"peerDependencies",
 	"optionalDependencies"
 ];
-var NpmPackage = class extends WorkspacePackage {
-	path;
-	manifest;
-	manager = "npm";
-	constructor(path, manifest) {
-		super();
-		this.path = path;
-		this.manifest = manifest;
+function listDependencies(graph, pkg) {
+	const out = [];
+	for (const field of DEP_FIELDS) {
+		const table = pkg.manifest[field];
+		if (!table) continue;
+		for (const [name, raw] of Object.entries(table)) out.push(resolveDependency(graph, pkg, field, name, raw, (range) => {
+			table[name] = range;
+		}));
 	}
-	get name() {
-		return this.manifest.name;
+	return out;
+}
+function parseDependencySpec(raw) {
+	if (raw.startsWith("workspace:")) {
+		const body = raw.slice(10);
+		if (!body) return {
+			protocol: "workspace",
+			range: "*"
+		};
+		if (body.startsWith(".") || body.startsWith("/")) return {
+			protocol: "workspace",
+			range: body,
+			path: body
+		};
+		const separator = body.lastIndexOf("@");
+		if (separator > 0) return {
+			protocol: "workspace",
+			packageName: body.slice(0, separator),
+			range: body.slice(separator + 1) || "*"
+		};
+		if (separator === 0) return {
+			protocol: "workspace",
+			packageName: body,
+			range: "*"
+		};
+		return {
+			protocol: "workspace",
+			range: body
+		};
 	}
-	get version() {
-		return this.manifest.version;
+	if (raw.startsWith("file:")) return {
+		protocol: "file",
+		path: raw.slice(5)
+	};
+	if (raw.startsWith("portal:")) return {
+		protocol: "portal",
+		path: raw.slice(7)
+	};
+	if (raw === "catalog:") return {
+		protocol: "catalog",
+		catalogName: "default"
+	};
+	if (raw.startsWith("catalog:")) return {
+		protocol: "catalog",
+		catalogName: raw.slice(8).trim() || "default"
+	};
+	if (raw.startsWith("npm:")) {
+		const spec = raw.slice(4);
+		const separator = spec.lastIndexOf("@");
+		if (separator > 0) return {
+			protocol: "npm",
+			alias: spec.slice(0, separator),
+			range: spec.slice(separator + 1)
+		};
 	}
-	async write() {
-		await writeFile(path.join(this.path, "package.json"), `${JSON.stringify(this.manifest, null, 2)}\n`);
+	return { range: raw };
+}
+function formatDependencySpec(spec, range) {
+	switch (spec.protocol) {
+		case "workspace":
+			if (spec.path) return `workspace:${spec.path}`;
+			if (spec.packageName) {
+				const next = range ?? spec.range;
+				return `workspace:${spec.packageName}@${next}`;
+			}
+			return `workspace:${range ?? spec.range}`;
+		case "file": return `file:${spec.path}`;
+		case "portal": return `portal:${spec.path}`;
+		case "catalog": return spec.catalogName === "default" ? "catalog:" : `catalog:${spec.catalogName}`;
+		case "npm": return `npm:${spec.alias}@${range ?? spec.range}`;
+		default: return range ?? spec.range;
 	}
-	initDraft() {
-		const defaults = super.initDraft();
-		defaults.npm = { distTag: this.manifest.publishConfig?.tag };
-		return defaults;
+}
+async function resolveNpmGraph(cwd, client) {
+	const packages = /* @__PURE__ */ new Map();
+	const packagesByPath = /* @__PURE__ */ new Map();
+	const catalogSources = [];
+	function addPackage(packagePath, manifest) {
+		const pkg = new NpmPackage(packagePath, manifest);
+		packages.set(pkg.name, pkg);
+		packagesByPath.set(packagePath, pkg);
 	}
-	getRegistry() {
-		return this.manifest.publishConfig?.registry ?? "https://registry.npmjs.org";
+	const patterns = [];
+	const rootManifest = await readManifest(cwd).catch(() => void 0);
+	if (rootManifest) {
+		catalogSources.push(createRootCatalogSource(rootManifest));
+		if (rootManifest.name) addPackage(cwd, rootManifest);
+		if (Array.isArray(rootManifest.workspaces)) patterns.push(...rootManifest.workspaces);
+		else if (rootManifest.workspaces?.packages) patterns.push(...rootManifest.workspaces.packages);
 	}
-	configureDraft({ draft }) {
-		super.configureDraft({ draft });
-		const { distTag = this.group?.options?.npm?.distTag } = this.options.npm ?? {};
-		if (distTag) {
-			draft.npm ??= {};
-			draft.npm.distTag = distTag;
-		} else if (draft.prerelease) {
-			draft.npm ??= {};
-			draft.npm.distTag ??= draft.prerelease;
+	if (client === "pnpm") {
+		const pnpmWorkspacePath = path.join(cwd, "pnpm-workspace.yaml");
+		const content = await readFile(pnpmWorkspacePath, "utf8").catch((error) => {
+			if (isNodeError(error) && error.code === "ENOENT") return void 0;
+			throw error;
+		});
+		if (content) {
+			const doc = parseDocument(content);
+			const data = assertPnpmWorkspace(doc.toJSON());
+			catalogSources.push(createPnpmCatalogSource(pnpmWorkspacePath, doc));
+			patterns.push(...data.packages ?? []);
 		}
+	} else if (client === "yarn") {
+		const yarnCatalog = await readYarnCatalog(cwd);
+		if (yarnCatalog) catalogSources.push(yarnCatalog);
 	}
-};
-function parseDependencySpec(context, dependent, name, range) {
-	const { graph } = context;
-	if (range.startsWith("workspace:")) return {
-		range: range.slice(10),
-		linked: graph.get(`npm:${name}`),
-		protocol: "workspace"
+	if (patterns?.length) {
+		const candidatePaths = await expandWorkspacePatterns(cwd, patterns);
+		await Promise.all(candidatePaths.map(async (packagePath) => {
+			const manifest = await readManifest(packagePath).catch(() => void 0);
+			if (!manifest) return;
+			addPackage(packagePath, manifest);
+		}));
+	}
+	return {
+		root: cwd,
+		packages,
+		packagesByPath,
+		catalogs: catalogSources
 	};
-	if (range.startsWith("file:")) {
-		let target = path.resolve(dependent.path, range.slice(5));
-		if (path.basename(target) === "package.json") target = path.dirname(target);
-		return {
-			protocol: "file",
-			raw: range,
-			linked: graph.getPackages().find((pkg) => pkg instanceof NpmPackage && pkg.path === target)
-		};
+}
+function resolveDependency(graph, dependent, field, name, raw, write) {
+	const spec = parseDependencySpec(raw);
+	const linked = resolveLinkedPackage(graph, dependent, name, spec);
+	let range;
+	let customSetRange;
+	switch (spec.protocol) {
+		case "catalog":
+			for (const source of graph.catalogs) {
+				const resolved = source.resolve(name, spec.catalogName);
+				if (!resolved) continue;
+				range = resolved;
+				customSetRange = (v) => source.setRange(name, spec.catalogName, v);
+				break;
+			}
+			break;
+		case "workspace":
+			range = semver$1.validRange(spec.range) ? spec.range : void 0;
+			break;
+		case "npm":
+		case void 0:
+			range = spec.range;
+			break;
 	}
-	if (range.startsWith("npm:")) {
-		const spec = range.slice(4);
-		const separator = spec.lastIndexOf("@");
-		if (separator <= 0) return;
-		const alias = spec.slice(0, separator);
-		return {
-			alias,
-			linked: graph.get(`npm:${alias}`),
-			range: spec.slice(separator + 1),
-			protocol: "npm"
-		};
+	return {
+		field,
+		name,
+		spec,
+		linked,
+		range,
+		setRange(nextRange) {
+			if (customSetRange) {
+				customSetRange(nextRange);
+				return;
+			}
+			write(formatDependencySpec(spec, nextRange));
+		}
+	};
+}
+function resolveLinkedPackage(graph, dependent, name, spec) {
+	switch (spec.protocol) {
+		case "workspace":
+			if (spec.path) return findPackageByPath(graph, dependent.path, spec.path);
+			return graph.packages.get(spec.packageName || name);
+		case "file":
+		case "portal": return findPackageByPath(graph, dependent.path, spec.path);
+		case "npm": return graph.packages.get(spec.alias);
+		default: return graph.packages.get(name);
 	}
+}
+function findPackageByPath(graph, from, target) {
+	let absolute = path.resolve(from, target);
+	if (path.basename(absolute) === "package.json") absolute = path.dirname(absolute);
+	return graph.packagesByPath.get(absolute);
+}
+async function expandWorkspacePatterns(cwd, patterns) {
+	if (patterns.length === 0) return [];
+	return (await glob(patterns, {
+		absolute: true,
+		cwd,
+		ignore: ["**/node_modules/**", "**/dist/**"],
+		onlyDirectories: true,
+		onlyFiles: false
+	})).map((item) => item.endsWith(path.sep) ? item.slice(0, -1) : item);
+}
+async function readManifest(packagePath) {
+	const content = await readFile(path.join(packagePath, "package.json"), "utf8");
+	const parsed = JSON.parse(content);
+	assertPackageManifest(parsed);
+	return parsed;
+}
+function createPnpmCatalogSource(filePath, doc) {
+	return {
+		resolve(name, catalogName) {
+			const value = doc.getIn(catalogName === "default" ? ["catalog", name] : [
+				"catalogs",
+				catalogName,
+				name
+			]);
+			return typeof value === "string" ? value : void 0;
+		},
+		setRange(name, catalogName, range) {
+			doc.setIn(catalogName === "default" ? ["catalog", name] : [
+				"catalogs",
+				catalogName,
+				name
+			], range);
+		},
+		async write() {
+			const output = doc.toString();
+			await writeFile(filePath, output.endsWith("\n") ? output : `${output}\n`);
+		}
+	};
+}
+function createRootCatalogSource(manifest) {
 	return {
-		linked: graph.get(`npm:${name}`),
-		range
+		resolve(name, catalogName) {
+			const fromWorkspaces = typeof manifest.workspaces === "object" && !Array.isArray(manifest.workspaces) ? catalogName === "default" ? manifest.workspaces.catalog?.[name] : manifest.workspaces.catalogs?.[catalogName]?.[name] : void 0;
+			if (fromWorkspaces) return fromWorkspaces;
+			if (catalogName === "default") return manifest.catalog?.[name];
+			return manifest.catalogs?.[catalogName]?.[name];
+		},
+		setRange(name, catalogName, range) {
+			if (typeof manifest.workspaces === "object" && !Array.isArray(manifest.workspaces)) if (catalogName === "default") {
+				manifest.workspaces.catalog ??= {};
+				manifest.workspaces.catalog[name] = range;
+			} else {
+				manifest.workspaces.catalogs ??= {};
+				manifest.workspaces.catalogs[catalogName] ??= {};
+				manifest.workspaces.catalogs[catalogName][name] = range;
+			}
+			else if (catalogName === "default") {
+				manifest.catalog ??= {};
+				manifest.catalog[name] = range;
+			} else {
+				manifest.catalogs ??= {};
+				manifest.catalogs[catalogName] ??= {};
+				manifest.catalogs[catalogName][name] = range;
+			}
+		}
 	};
 }
-function formatDependencySpec(spec) {
-	if (spec.protocol === "workspace") return `workspace:${spec.range}`;
-	if (spec.protocol === "file") return spec.raw;
-	if (spec.protocol === "npm") return `npm:${spec.alias}@${spec.range}`;
-	return spec.range;
+async function readYarnCatalog(cwd) {
+	const filePath = path.join(cwd, ".yarnrc.yml");
+	const content = await readFile(filePath, "utf8").catch(() => void 0);
+	if (!content) return;
+	const doc = parseDocument(content);
+	return {
+		resolve(name, catalogName) {
+			const value = doc.getIn(catalogName === "default" ? ["catalog", name] : [
+				"catalogs",
+				catalogName,
+				name
+			]);
+			return typeof value === "string" ? value : void 0;
+		},
+		setRange(name, catalogName, range) {
+			doc.setIn(catalogName === "default" ? ["catalog", name] : [
+				"catalogs",
+				catalogName,
+				name
+			], range);
+		},
+		async write() {
+			const output = doc.toString();
+			await writeFile(filePath, output.endsWith("\n") ? output : `${output}\n`);
+		}
+	};
 }
+//#endregion
+//#region src/providers/npm.ts
 const validateNpmPackageLock = (() => {
 	const _io0 = (input) => "string" === typeof input.id && (void 0 === input.distTag || "string" === typeof input.distTag);
 	const _vo0 = (input, _path, _exceptionable = true) => ["string" === typeof input.id || _report(_exceptionable, {
@@ -650,12 +1063,21 @@ function npm({ client: defaultClient, onBreakPeerDep = "set", updateLockFile = t
 			this.npm = { client };
 		},
 		async resolve() {
-			await discoverNpmPackages(this.cwd, (pkg) => this.graph.add(pkg));
-			active = this.graph.getPackages().some((pkg) => pkg instanceof NpmPackage);
+			if (!this.npm) return;
+			const graph = await resolveNpmGraph(this.cwd, this.npm.client);
+			if (graph.packages.size === 0) return;
+			this.npm.graph = graph;
+			for (const pkg of graph.packages.values()) this.graph.add(pkg);
+			active = true;
 		},
 		async publishPreflight({ pkg }) {
-			if (!(pkg instanceof NpmPackage)) return;
-			return { shouldPublish: pkg.version !== void 0 && pkg.manifest.private !== true };
+			if (!(pkg instanceof NpmPackage) || !this.npm?.graph) return;
+			const optionalWait = [];
+			for (const { linked } of pkg.listDependencies(this.npm.graph)) if (linked) optionalWait.push(linked.id);
+			return {
+				shouldPublish: pkg.version !== void 0 && pkg.manifest.private !== true,
+				optionalWait: optionalWait.length > 0 ? optionalWait : void 0
+			};
 		},
 		resolvePlanStatus({ plan }) {
 			if (!active) return;
@@ -720,50 +1142,35 @@ function npm({ client: defaultClient, onBreakPeerDep = "set", updateLockFile = t
 			plan.addPolicy(depsPolicy(this, getBumpDepType));
 		},
 		async applyDraft(draft) {
-			if (!active) return;
-			const { graph } = this;
+			if (!active || !this.npm?.graph) return;
+			const npmGraph = this.npm.graph;
 			const writes = [];
-			for (const pkg of graph.getPackages()) {
-				if (!(pkg instanceof NpmPackage)) continue;
+			for (const pkg of npmGraph.packages.values()) {
 				const bumped = draft.getPackageDraft(pkg.id)?.bumpVersion(pkg);
 				if (bumped) pkg.manifest.version = bumped;
 			}
-			for (const pkg of graph.getPackages()) {
-				if (!(pkg instanceof NpmPackage)) continue;
-				for (const field of DEP_FIELDS) {
-					const dependencies = pkg.manifest[field];
-					if (!dependencies) continue;
-					for (const [k, v] of Object.entries(dependencies)) {
-						const spec = parseDependencySpec(this, pkg, k, v);
-						if (!spec?.linked || spec.protocol === "workspace" || spec.protocol === "file") continue;
-						if (!semver$1.validRange(spec.range)) continue;
-						if (!spec.linked.version || semver$1.satisfies(spec.linked.version, spec.range)) continue;
-						let updatedRange;
-						const isPeer = field === "peerDependencies";
-						if (isPeer && onBreakPeerDep === "ignore") continue;
-						if (isPeer && onBreakPeerDep === "set") updatedRange = spec.linked.version;
-						else if (isPeer && onBreakPeerDep === "error") throw new Error(`[Tegami] the version of "${spec.linked.name}" is beyond its peer dependency constraint "${v}" in package "${pkg.name}", please update the constraint to satisfy.`);
-						else if (spec.range.startsWith("^")) updatedRange = `^${spec.linked.version}`;
-						else if (spec.range.startsWith("~")) updatedRange = `~${spec.linked.version}`;
-						else updatedRange = spec.linked.version;
-						dependencies[k] = formatDependencySpec({
-							...spec,
-							range: updatedRange
-						});
-					}
+			for (const pkg of npmGraph.packages.values()) {
+				for (const dep of pkg.listDependencies(npmGraph)) {
+					if (!dep.linked || !dep.range || !dep.setRange) continue;
+					if (!dep.linked.version || semver$1.satisfies(dep.linked.version, dep.range)) continue;
+					const isPeer = dep.field === "peerDependencies";
+					if (isPeer && onBreakPeerDep === "ignore") continue;
+					let updatedRange;
+					if (isPeer && onBreakPeerDep === "set") updatedRange = dep.linked.version;
+					else if (isPeer && onBreakPeerDep === "error") throw new Error(`[Tegami] the version of "${dep.linked.name}" is beyond its peer dependency constraint "${formatDependencySpec(dep.spec)}" in package "${pkg.name}", please update the constraint to satisfy.`);
+					else if (dep.range.startsWith("^")) updatedRange = `^${dep.linked.version}`;
+					else if (dep.range.startsWith("~")) updatedRange = `~${dep.linked.version}`;
+					else updatedRange = dep.linked.version;
+					dep.setRange(updatedRange);
 				}
 				writes.push(pkg.write());
 			}
+			for (const source of npmGraph.catalogs) writes.push(source.write?.());
 			await Promise.all(writes);
 		},
 		async applyCliDraft() {
 			if (!active || !updateLockFile) return;
-			let args;
-			if (client === "npm") args = ["ci"];
-			else if (client === "yarn") args = ["install", "--immutable"];
-			else if (client === "bun") args = ["install", "--frozen-lockfile"];
-			else args = ["install", "--frozen-lockfile"];
-			const result = await x(client, args, { nodeOptions: { cwd: this.cwd } });
+			const result = await x(client, ["install"], { nodeOptions: { cwd: this.cwd } });
 			if (result.exitCode !== 0) throw execFailure("Failed to update lockfile.", result);
 		},
 		initCli(cli) {
@@ -773,42 +1180,36 @@ function npm({ client: defaultClient, onBreakPeerDep = "set", updateLockFile = t
 	};
 }
 function depsPolicy(context, getBumpDepType) {
-	const { graph } = context;
+	const npmGraph = context.npm?.graph;
+	if (!npmGraph) throw new Error("npm graph is missing");
 	const dependentMap = /* @__PURE__ */ new Map();
-	for (const pkg of graph.getPackages()) {
-		if (!(pkg instanceof NpmPackage)) continue;
-		for (const kind of DEP_FIELDS) {
-			const dependencies = pkg.manifest[kind];
-			if (!dependencies) continue;
-			for (const [name, range] of Object.entries(dependencies)) {
-				const spec = parseDependencySpec(context, pkg, name, range);
-				if (!spec?.linked) continue;
-				const refs = dependentMap.get(spec.linked.id);
-				if (refs) refs.push({
-					dependent: pkg,
-					kind,
-					name,
-					spec
-				});
-				else dependentMap.set(spec.linked.id, [{
-					dependent: pkg,
-					kind,
-					name,
-					spec
-				}]);
-			}
-		}
+	for (const pkg of npmGraph.packages.values()) for (const resolved of pkg.listDependencies(npmGraph)) {
+		if (!resolved.linked) continue;
+		const refs = dependentMap.get(resolved.linked.id);
+		const ref = {
+			dependent: pkg,
+			kind: resolved.field,
+			name: resolved.name,
+			spec: resolved.spec,
+			resolved
+		};
+		if (refs) refs.push(ref);
+		else dependentMap.set(resolved.linked.id, [ref]);
 	}
-	function needsUpdate(spec, target) {
-		if (spec.linked && spec.protocol === "workspace") switch (spec.range) {
-			case "":
-			case "*": return true;
-			case "^":
-			case "~": return !semver$1.satisfies(target, `${spec.range}${spec.linked.version}`);
+	function needsDependencyUpdate(resolved, target) {
+		if (!resolved.linked) return false;
+		switch (resolved.spec.protocol) {
+			case "file":
+			case "portal": return true;
+			case "workspace": switch (resolved.spec.range) {
+				case "":
+				case "*": return true;
+				case "^":
+				case "~": return !semver$1.satisfies(target, `${resolved.spec.range}${resolved.linked.version ?? "0.0.0"}`);
+			}
 		}
-		if (spec.linked && spec.protocol === "file") return true;
-		if (spec.protocol === "file" || !semver$1.validRange(spec.range)) return false;
-		return !semver$1.satisfies(target, spec.range);
+		if (!resolved.range || !semver$1.validRange(resolved.range)) return false;
+		return !semver$1.satisfies(target, resolved.range);
 	}
 	return {
 		id: "npm:deps",
@@ -820,7 +1221,7 @@ function depsPolicy(context, getBumpDepType) {
 			if (!bumped) return;
 			for (const dep of deps) {
 				if (pkg.group?.options.syncBump && dep.dependent.group === pkg.group) continue;
-				if (!needsUpdate(dep.spec, bumped)) continue;
+				if (!needsDependencyUpdate(dep.resolved, bumped)) continue;
 				const bumpType = getBumpDepType(dep);
 				if (bumpType === false) continue;
 				this.bumpPackage(dep.dependent, {
@@ -888,42 +1289,5 @@ async function isPackagePublished(name, version, registry) {
 	if (!response.ok) throw new Error(`Unable to validate ${name}@${version} against the npm registry${registry ? ` "${registry}"` : ""}.`);
 	return true;
 }
-async function discoverNpmPackages(cwd, add) {
-	const rootManifest = await readManifest(cwd).catch(() => void 0);
-	const pnpmPatterns = await readFile(path.join(cwd, "pnpm-workspace.yaml"), "utf8").then((content) => assertPnpmWorkspace(parse$1(content))).catch((error) => {
-		if (isNodeError(error) && error.code === "ENOENT") return void 0;
-		throw error;
-	});
-	if (rootManifest?.name) add(new NpmPackage(cwd, rootManifest));
-	const patterns = pnpmPatterns?.packages ?? rootManifest?.workspaces;
-	if (!patterns || patterns.length === 0) return;
-	const candidatePaths = await expandWorkspacePatterns(cwd, patterns);
-	const manifests = await Promise.all(candidatePaths.map((path) => readManifest(path).then((manifest) => ({
-		path,
-		manifest
-	})).catch(() => void 0)));
-	for (const entry of manifests) {
-		if (!entry) continue;
-		add(new NpmPackage(entry.path, entry.manifest));
-	}
-}
-async function expandWorkspacePatterns(cwd, patterns) {
-	if (patterns.length === 0) return [];
-	return (await glob(patterns, {
-		absolute: true,
-		cwd,
-		ignore: ["**/node_modules/**", "**/dist/**"],
-		onlyDirectories: true,
-		onlyFiles: false
-	})).map((item) => {
-		return item.endsWith(path.sep) ? item.slice(0, -1) : item;
-	});
-}
-async function readManifest(packagePath) {
-	const content = await readFile(path.join(packagePath, "package.json"), "utf8");
-	const parsed = JSON.parse(content);
-	assertPackageManifest(parsed);
-	return parsed;
-}
 //#endregion
-export { runPreflights as a, publishPlanStatus as i, npm as n, runPublishPlan as o, initPublishPlan as r, NpmPackage as t };
+export { runPreflights as a, publishPlanStatus as i, NpmPackage as n, runPublishPlan as o, initPublishPlan as r, npm as t };