Function loadPackageConfig

packages/bumpy/src/core/config.ts:41–78

(
  pkgDir: string,
  rootConfig: BumpyConfig,
  pkgName: string,
)

/** Load per-package bumpy config from package.json["bumpy"] or .bumpy.config.json */
export async function loadPackageConfig(
  pkgDir: string,
  rootConfig: BumpyConfig,
  pkgName: string,
): Promise<PackageConfig> {
  // Start with what's in the root config's packages map
  const rootPkgConfig = findPackageConfig(rootConfig, pkgName);

  // Layer on package.json["bumpy"]
  let pkgJsonConfig: PackageConfig = {};
  try {
    const pkg = await readJson<Record<string, unknown>>(resolve(pkgDir, 'package.json'));
    if (pkg.bumpy && typeof pkg.bumpy === 'object') {
      pkgJsonConfig = pkg.bumpy as PackageConfig;
    }
  } catch {
    // ignore
  }

  // Block custom commands from per-package config unless the root explicitly allows them.
  // Commands defined in the root config's `packages` map are always trusted.
  const CUSTOM_CMD_KEYS = ['buildCommand', 'publishCommand', 'checkPublished'] as const;
  const disallowedKeys = CUSTOM_CMD_KEYS.filter((k) => pkgJsonConfig[k] != null);
  if (disallowedKeys.length > 0 && !isCustomCommandAllowed(pkgName, rootConfig)) {
    const fields = disallowedKeys.map((k) => `"${k}"`).join(', ');
    throw new Error(
      `Package "${pkgName}" defines custom command(s) (${fields}) in its package.json "bumpy" config, ` +
        'but the root config does not allow this.\n' +
        'Custom commands execute shell commands during publishing and must be explicitly enabled.\n\n' +
        'To fix this, either:\n' +
        '  1. Move the command(s) to .bumpy/_config.json under "packages" (always trusted)\n' +
        `  2. Add "allowCustomCommands": true (or ["${pkgName}"]) to .bumpy/_config.json`,
    );
  }

  // Merge: root packages map → package.json["bumpy"] (later wins)
  return mergePackageConfig(rootPkgConfig, pkgJsonConfig);
}

/** Find a package config from the root config, supporting glob patterns */
function findPackageConfig(config: BumpyConfig, pkgName: string): PackageConfig {