@exadev/semantic-release-workspace 0.0.0 → 1.0.1

package/dist/index.cjs

@@ -0,0 +1,805 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let tinyglobby = require("tinyglobby");
+let yaml = require("yaml");
+let node_child_process = require("node:child_process");
+let node_util = require("node:util");
+let validate_npm_package_name = require("validate-npm-package-name");
+validate_npm_package_name = __toESM(validate_npm_package_name, 1);
+let node_module = require("node:module");
+let _semantic_release_commit_analyzer = require("@semantic-release/commit-analyzer");
+let _semantic_release_release_notes_generator = require("@semantic-release/release-notes-generator");
+let semantic_release = require("semantic-release");
+semantic_release = __toESM(semantic_release, 1);
+//#region src/package-name.ts
+const packageName = "@exadev/semantic-release-workspace";
+//#endregion
+//#region src/errors.ts
+/**
+* Every failure this package raises deliberately is one of these, so a caller (or the CLI) can tell an orchestration failure it should report cleanly apart from an unexpected crash it should let propagate with a stack trace.
+*
+* All of them are thrown, never returned as a status: the orchestrator deliberately has no "skip this package and carry on" path. A workspace that can't be discovered, ordered, or bumped correctly would otherwise publish a partially-consistent set of packages, which is strictly worse than publishing nothing.
+*/
+var WorkspaceReleaseError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = new.target.name;
+	}
+};
+/** The workspace itself could not be read: no `pnpm-workspace.yaml`, no `packages` globs, an unreadable or malformed `package.json`, two packages claiming the same name, or a package sitting at the workspace root (which cannot be path-scoped -- see `discoverWorkspace`). */
+var WorkspaceDiscoveryError = class extends WorkspaceReleaseError {};
+/** The intra-workspace dependency graph contains a cycle, so no release order exists in which every package releases after its own dependencies. */
+var DependencyCycleError = class extends WorkspaceReleaseError {
+	/** The packages forming the cycle, in dependency order, with the first package repeated at the end so the loop reads end to end. */
+	cycle;
+	constructor(cycle) {
+		super(`Cannot compute a release order: the workspace dependency graph contains a cycle: ${cycle.join(" -> ")}`);
+		this.cycle = cycle;
+	}
+};
+/** A dependency on a workspace sibling uses a range this tool cannot rewrite with confidence. Rewriting it wrongly, or leaving it silently stale, both produce a published manifest that disagrees with the repository, so the run stops instead. */
+var UnsupportedDependencyRangeError = class extends WorkspaceReleaseError {};
+/** The semantic-release options handed to the orchestrator cannot be scoped to a single package -- typically a publish plugin list that would leave a release commit or a cross-package manifest bump uncommitted. */
+var ReleaseConfigurationError = class extends WorkspaceReleaseError {};
+/** A git command the orchestrator runs itself (history filtering, dependency-bump commits, pushes) failed. Carries the exit code so callers can distinguish "configuration is missing" (exit 1) from real repository failures. */
+var GitCommandError = class extends WorkspaceReleaseError {
+	exitCode;
+	constructor(args, cwd, exitCode, detail) {
+		super(`git ${args.join(" ")} failed in ${cwd}${exitCode === void 0 ? "" : ` (exit ${exitCode})`}: ${detail}`);
+		this.exitCode = exitCode;
+	}
+};
+/** The workspace's git state does not support the release operation -- for example a detached HEAD, which names no branch that dependency-bump commits could be pushed to. */
+var WorkspaceStateError = class extends WorkspaceReleaseError {};
+//#endregion
+//#region src/git.ts
+const execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+/** `git log --name-only` over everything since a package's last release tag can legitimately produce tens of megabytes of path output on a long-lived monorepo, well past execFile's default buffer, failing on exactly the big workspaces this tool exists for. */
+const GIT_MAX_BUFFER_BYTES = 104857600;
+/** Separates one commit's record in `git log --format` output. Chosen from the C0 control range so it can never appear in a hash or a file path. */
+const COMMIT_RECORD_SEPARATOR = "";
+/** The identity semantic-release's own core writes release commits under in CI when nothing else is configured (its COMMIT_NAME/COMMIT_EMAIL constants); dependency-bump commits use the same fallback so every commit a release run produces has a consistent author when the repository declares none. */
+const BOT_IDENTITY = {
+	name: "semantic-release-bot",
+	email: "semantic-release-bot@martynus.net"
+};
+async function git(args, options) {
+	try {
+		const { stdout } = await execFileAsync("git", [...args], {
+			cwd: options.cwd,
+			maxBuffer: GIT_MAX_BUFFER_BYTES
+		});
+		return stdout;
+	} catch (cause) {
+		throw toGitCommandError(args, options.cwd, cause);
+	}
+}
+/**
+* Maps every commit in `from..HEAD` (or the whole history when `from` is undefined) to the set of paths it changed, by running `git log --name-only` once per package release -- the same diff-and-filter technique the design calls for, so a commit counts for a package only when a path under that package's directory appears in its file list.
+*
+* Merge commits list no files (git shows no diff for them without `--diff-merges`), so they count for no package; their changes arrive through their parents, which the same range covers individually. Squash-merge workflows are unaffected, since a squash commit is an ordinary commit with a full file list.
+*/
+async function changedPathsSince(from, options) {
+	const range = from === void 0 ? "HEAD" : `${from}..HEAD`;
+	return parseChangedPaths(await git([
+		"-c",
+		"core.quotePath=false",
+		"log",
+		"--name-only",
+		"--no-renames",
+		`--format=${COMMIT_RECORD_SEPARATOR}%H`,
+		range
+	], options));
+}
+function parseChangedPaths(output) {
+	const changedPaths = /* @__PURE__ */ new Map();
+	for (const record of output.split(COMMIT_RECORD_SEPARATOR)) {
+		const trimmed = record.trim();
+		if (trimmed === "") continue;
+		const lines = trimmed.split("\n");
+		const hash = lines[0];
+		if (hash === void 0 || hash === "") continue;
+		changedPaths.set(hash, new Set(lines.slice(1).filter((line) => line !== "")));
+	}
+	return changedPaths;
+}
+/** The branch a dependency-bump commit will be pushed to. Refuses a detached HEAD by name rather than pushing `HEAD:HEAD` to the remote and watching it fail somewhere less legible. A detached HEAD is a WorkspaceStateError rather than a GitCommandError because the git command itself succeeded: the repository's state is what cannot support the release, and conflating the two would report a working command as a failed one. */
+async function currentBranch(options) {
+	const branch = (await git([
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], options)).trim();
+	if (branch === "HEAD") throw new WorkspaceStateError(`HEAD is detached in ${options.cwd}; there is no branch name to push dependency-bump commits to. Run the release from a branch checkout.`);
+	return branch;
+}
+/** The commit identity for dependency-bump commits: whatever the repository itself configures, and semantic-release's own bot identity when nothing is (a release run's commits must name an author even on a bare CI runner). */
+async function resolveCommitIdentity(options) {
+	const name = await readConfig("user.name", options);
+	const email = await readConfig("user.email", options);
+	if (name === void 0 || email === void 0) return BOT_IDENTITY;
+	return {
+		name,
+		email
+	};
+}
+/** `git config` exits 1 when a key is simply unset -- that is an expected answer here, not a failure; any other exit code (128 for "not a repository", and so on) propagates. */
+async function readConfig(key, options) {
+	try {
+		const value = (await git(["config", key], options)).trim();
+		return value === "" ? void 0 : value;
+	} catch (cause) {
+		if (cause instanceof GitCommandError && cause.exitCode === 1) return;
+		throw cause;
+	}
+}
+/** Commits exactly the given paths (already written to disk) with an explicit identity, so the bump commit does not depend on whatever ambient git configuration the CI runner happens to have. */
+async function commitFiles(files, message, options) {
+	await git([
+		"add",
+		"--",
+		...files
+	], options);
+	await git([
+		"-c",
+		`user.name=${options.identity.name}`,
+		"-c",
+		`user.email=${options.identity.email}`,
+		"commit",
+		"-m",
+		message,
+		"--",
+		...files
+	], options);
+}
+/** Pushes the current branch's head to origin by explicit refspec. Each dependency bump is pushed the moment it is committed -- the same discipline semantic-release applies to its own release commits -- so an interrupted run never leaves local commits that exist nowhere else. */
+async function pushHead(options) {
+	await git([
+		"push",
+		"origin",
+		`HEAD:${await currentBranch(options)}`
+	], options);
+}
+function toGitCommandError(args, cwd, cause) {
+	const exitCode = cause instanceof Error && "code" in cause && typeof cause.code === "number" ? cause.code : void 0;
+	const stderr = cause instanceof Error && "stderr" in cause && typeof cause.stderr === "string" ? cause.stderr.trim() : "";
+	return new GitCommandError(args, cwd, exitCode, stderr !== "" ? stderr : cause instanceof Error ? cause.message : String(cause));
+}
+//#endregion
+//#region src/json.ts
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringRecord(value) {
+	return isJsonObject(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+/**
+* The indentation of the first indented line in a JSON document, so a rewritten manifest keeps the formatting the repository already uses instead of being reflowed to whatever `JSON.stringify` defaults to. A file with no indented line at all (`{}` on one line) has no evidence either way, in which case two spaces -- npm's own default when it writes a `package.json` -- is the closest thing to a neutral choice.
+*/
+const FIRST_INDENTED_LINE = /^[ \t]+(?=")/m;
+const NPM_DEFAULT_INDENT = "  ";
+function detectIndent(text) {
+	const match = FIRST_INDENTED_LINE.exec(text);
+	return match === null ? NPM_DEFAULT_INDENT : match[0];
+}
+/** Serialises a JSON document back to text with the indentation and trailing-newline convention of the text it was read from, so rewriting one dependency range produces a one-line diff rather than a whole-file reformat. */
+function stringifyJsonLike(value, originalText) {
+	const serialised = JSON.stringify(value, null, detectIndent(originalText));
+	return originalText.endsWith("\n") ? `${serialised}\n` : serialised;
+}
+//#endregion
+//#region src/manifest.ts
+const DEPENDENCY_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+async function readManifest(path) {
+	const text = await (0, node_fs_promises.readFile)(path, "utf8");
+	const parsed = JSON.parse(text);
+	if (!isJsonObject(parsed)) throw new WorkspaceDiscoveryError(`${path} does not contain a JSON object.`);
+	const { name, version } = parsed;
+	if (typeof name !== "string" || name.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "name". Every workspace package needs a name: releases are ordered, tagged, and matched to dependents by it.`);
+	const validity = (0, validate_npm_package_name.default)(name);
+	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${(validity.errors ?? []).join("; ")}`);
+	if (typeof version !== "string" || version.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "version".`);
+	const dependencies = /* @__PURE__ */ new Map();
+	for (const field of DEPENDENCY_FIELDS) {
+		const declared = parsed[field];
+		if (declared === void 0) continue;
+		if (!isStringRecord(declared)) throw new WorkspaceDiscoveryError(`${path} has a "${field}" field that is not an object of name-to-range strings.`);
+		dependencies.set(field, new Map(Object.entries(declared)));
+	}
+	return {
+		name,
+		version,
+		dependencies
+	};
+}
+/**
+* Rewrites one dependency range in a manifest on disk.
+*
+* Deliberately re-reads the file rather than editing a copy held from discovery time: by the time a cross-package bump is applied, semantic-release's own `@semantic-release/npm` prepare step may already have rewritten `version` in this same file for an earlier package in the run. Writing back a manifest parsed before that would silently revert it.
+*/
+async function writeDependencyRange(path, field, dependency, range) {
+	const text = await (0, node_fs_promises.readFile)(path, "utf8");
+	const parsed = JSON.parse(text);
+	if (!isJsonObject(parsed)) throw new WorkspaceDiscoveryError(`${path} does not contain a JSON object.`);
+	const declared = parsed[field];
+	if (!isStringRecord(declared)) throw new WorkspaceDiscoveryError(`${path} no longer has a "${field}" object holding "${dependency}".`);
+	declared[dependency] = range;
+	await (0, node_fs_promises.writeFile)(path, stringifyJsonLike(parsed, text), "utf8");
+}
+//#endregion
+//#region src/workspace.ts
+/** The one filename pnpm recognises as a workspace definition. */
+const WORKSPACE_MANIFEST = "pnpm-workspace.yaml";
+/** Never treat an installed dependency's own manifest as a workspace package, however permissive the configured globs are. pnpm applies the same exclusion. */
+const INSTALLED_PACKAGES = "**/node_modules/**";
+/**
+* Reads `pnpm-workspace.yaml` and every package manifest its globs match, producing the input to both the dependency graph and the per-package release runs.
+*
+* Nothing here knows anything about a particular repository's layout: the globs come from the workspace file, and the package names, versions, and dependency ranges come from the manifests those globs match. Pointing this at any pnpm workspace is the entire configuration.
+*/
+async function discoverWorkspace(root) {
+	const workspaceRoot = (0, node_path.resolve)(root);
+	const patterns = await readWorkspacePatterns(workspaceRoot);
+	const repoPrefix = await resolveRepoPrefix(workspaceRoot);
+	const positive = patterns.filter((pattern) => !pattern.startsWith("!"));
+	const negative = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
+	const manifestPaths = await (0, tinyglobby.glob)(positive.map(toManifestPattern), {
+		cwd: workspaceRoot,
+		absolute: true,
+		expandDirectories: false,
+		ignore: [...negative.flatMap((pattern) => [toManifestPattern(pattern), `${trimTrailingSlashes(pattern)}/**`]), INSTALLED_PACKAGES]
+	});
+	const packages = [];
+	const byName = /* @__PURE__ */ new Map();
+	for (const manifestPath of [...manifestPaths].sort()) {
+		const directory = (0, node_path.dirname)(manifestPath);
+		const relativeDirectory = toPosix((0, node_path.relative)(workspaceRoot, directory));
+		if (relativeDirectory === "") throw new WorkspaceDiscoveryError(`${WORKSPACE_MANIFEST} matches the workspace root itself. A package at the root cannot be scoped to its own commits, because every commit in the repository touches it; move it into a subdirectory or exclude it from the "packages" globs.`);
+		const repoRelativeDirectory = repoPrefix === "" ? relativeDirectory : `${repoPrefix}${relativeDirectory}`;
+		const manifest = await readManifest(manifestPath);
+		const existing = byName.get(manifest.name);
+		if (existing !== void 0) throw new WorkspaceDiscoveryError(`Two workspace packages are both named "${manifest.name}": ${existing} and ${relativeDirectory}. Releases are matched to dependents by name, so names must be unique.`);
+		byName.set(manifest.name, relativeDirectory);
+		packages.push({
+			name: manifest.name,
+			version: manifest.version,
+			directory,
+			relativeDirectory,
+			repoRelativeDirectory,
+			manifestPath,
+			dependencies: manifest.dependencies
+		});
+	}
+	if (packages.length === 0) throw new WorkspaceDiscoveryError(`No packages matched the "packages" globs in ${(0, node_path.resolve)(workspaceRoot, WORKSPACE_MANIFEST)}.`);
+	return {
+		root: workspaceRoot,
+		packages
+	};
+}
+/**
+* Resolves the workspace root's own path relative to the git repository's toplevel, via `git rev-parse --show-prefix` -- for example `''` when `pnpm-workspace.yaml` sits at the repository root, or `'monorepo/'` (always POSIX, always either empty or trailing-slash-terminated, per git's own contract for this flag) when the workspace is nested a level below it. `git log --name-only` always reports changed paths relative to the repository's toplevel regardless of the `cwd` a command runs from, so path-scoped commit filtering has to compare against paths built on this prefix, not against paths relative to `pnpm-workspace.yaml`'s own directory alone -- the two differ whenever the workspace is not itself the git toplevel, and comparing against the wrong base makes every path comparison fail silently (see `repoRelativeDirectory`).
+*/
+async function resolveRepoPrefix(workspaceRoot) {
+	return (await git(["rev-parse", "--show-prefix"], { cwd: workspaceRoot }).catch((cause) => {
+		throw new WorkspaceDiscoveryError(`Cannot resolve the git repository toplevel for ${workspaceRoot}: ${cause instanceof Error ? cause.message : String(cause)}. The workspace must sit inside a git repository, because commit analysis is scoped to each package's directory relative to the repository root.`);
+	})).trim();
+}
+async function readWorkspacePatterns(workspaceRoot) {
+	const path = (0, node_path.resolve)(workspaceRoot, WORKSPACE_MANIFEST);
+	const text = await (0, node_fs_promises.readFile)(path, "utf8").catch((cause) => {
+		throw new WorkspaceDiscoveryError(`Cannot read ${path}: ${cause instanceof Error ? cause.message : String(cause)}`);
+	});
+	const parsed = (0, yaml.parse)(text);
+	if (!isJsonObject(parsed)) throw new WorkspaceDiscoveryError(`${path} does not contain a YAML mapping.`);
+	const { packages } = parsed;
+	if (!isStringArray(packages) || packages.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "packages" globs, so it defines no packages to release.`);
+	return packages;
+}
+/** pnpm's globs match package *directories*; the glob run here matches the manifest inside each of them, which is both what we need to read and the only reliable evidence a matched directory is a package at all. */
+function toManifestPattern(pattern) {
+	return `${trimTrailingSlashes(pattern)}/package.json`;
+}
+const TRAILING_SLASHES = /\/+$/;
+function trimTrailingSlashes(pattern) {
+	return pattern.replace(TRAILING_SLASHES, "");
+}
+function toPosix(path) {
+	return node_path.sep === "/" ? path : path.split(node_path.sep).join("/");
+}
+//#endregion
+//#region src/graph.ts
+/**
+* Builds the inter-package dependency graph from the manifests alone.
+*
+* A dependency on a package outside the workspace is not an edge: it neither constrains the release order nor gets rewritten when something here releases. A package that names itself becomes a self-edge, which `topologicalOrder` then reports as the one-package cycle it is, rather than being quietly dropped.
+*/
+function buildDependencyGraph(packages) {
+	const byName = new Map(packages.map((pkg) => [pkg.name, pkg]));
+	const dependencies = new Map(packages.map((pkg) => [pkg.name, []]));
+	const dependents = new Map(packages.map((pkg) => [pkg.name, []]));
+	for (const pkg of packages) {
+		const outgoing = dependencies.get(pkg.name);
+		if (outgoing === void 0) continue;
+		for (const [field, declared] of pkg.dependencies) for (const [name, range] of declared) {
+			const incoming = dependents.get(name);
+			if (incoming === void 0) continue;
+			const edge = {
+				dependent: pkg.name,
+				dependency: name,
+				field,
+				range
+			};
+			outgoing.push(edge);
+			incoming.push(edge);
+		}
+	}
+	return {
+		packages: byName,
+		dependencies,
+		dependents
+	};
+}
+/**
+* Orders packages so every package appears after every workspace sibling it depends on, using Kahn's algorithm.
+*
+* Packages whose dependencies have all been placed are taken in name order, so the same workspace always produces the same order -- a release run that reorders itself between CI runs is impossible to reason about when something goes wrong halfway through.
+*
+* A cycle has no valid order at all, so it throws rather than picking one of the wrong answers. In a release context an arbitrary order is worse than a failure: it would publish a package whose sibling dependency range points at a version that does not exist yet.
+*/
+function topologicalOrder(graph) {
+	const pending = /* @__PURE__ */ new Map();
+	for (const [name, edges] of graph.dependencies) pending.set(name, new Set(edges.map((edge) => edge.dependency)));
+	const ordered = [];
+	for (;;) {
+		const ready = [...pending].filter(([, unplaced]) => unplaced.size === 0).map(([name]) => name).sort();
+		if (ready.length === 0) break;
+		for (const name of ready) {
+			pending.delete(name);
+			ordered.push(name);
+		}
+		for (const unplaced of pending.values()) for (const name of ready) unplaced.delete(name);
+	}
+	if (pending.size > 0) throw new DependencyCycleError(findCycle(graph, new Set(pending.keys())));
+	return ordered;
+}
+/**
+* Walks dependency edges between the packages Kahn's algorithm could not place, until it revisits one, so the error can name a concrete loop rather than just a set of packages. Every unplaced package is unplaced precisely because at least one of its own dependencies is too, so the walk always reaches a repeat.
+*/
+function findCycle(graph, unplaced) {
+	const path = [];
+	const onPath = /* @__PURE__ */ new Set();
+	let current = firstUnplacedDependency(void 0, graph, unplaced);
+	while (current !== void 0 && !onPath.has(current)) {
+		path.push(current);
+		onPath.add(current);
+		current = firstUnplacedDependency(current, graph, unplaced);
+	}
+	return current === void 0 ? path : [...path.slice(path.indexOf(current)), current];
+}
+/** With no package given, the alphabetically first unplaced package (the walk's starting point); otherwise that package's alphabetically first still-unplaced dependency. Sorting keeps the reported cycle stable across runs. */
+function firstUnplacedDependency(name, graph, unplaced) {
+	if (name === void 0) return [...unplaced].sort()[0];
+	return (graph.dependencies.get(name) ?? []).map((edge) => edge.dependency).filter((dependency) => unplaced.has(dependency)).sort()[0];
+}
+//#endregion
+//#region src/version-range.ts
+const WORKSPACE_PROTOCOL = "workspace:";
+const CATALOG_PROTOCOL = "catalog:";
+const NPM_ALIAS_PROTOCOL = "npm:";
+/** The `workspace:` suffixes pnpm resolves against the sibling's version at pack time rather than against anything written in the manifest. */
+const PUBLISH_RESOLVED_WORKSPACE_SUFFIXES = [
+	"*",
+	"^",
+	"~"
+];
+/** Ranges that pin nothing, so a sibling's new version cannot change what they mean. */
+const WILDCARD_RANGES = [
+	"",
+	"*",
+	"x",
+	"X",
+	"latest"
+];
+/**
+* A single comparator whose version can be replaced in place without changing the comparator's intent. `<` and `<=` are deliberately absent: rewriting `<2.0.0` to `<1.4.0` narrows an upper bound to the very version being released, which is never what the author meant, so such a range is rejected rather than mangled.
+*/
+const REWRITABLE_COMPARATOR = /^(\^|~|>=|=)?(\d+\.\d+\.\d+(?:-[\dA-Za-z.-]+)?(?:\+[\dA-Za-z.-]+)?)$/;
+/**
+* Classifies a dependency range's shape, throwing `UnsupportedDependencyRangeError` for anything this tool cannot rewrite with confidence: a compound range (`>=1.0.0 <2.0.0`), a union (`1.x || 2.x`), a `catalog:` reference whose real version lives in `pnpm-workspace.yaml`, an `npm:` alias, a git or tarball URL. Guessing at those would either corrupt the range or silently leave it pointing at a version that no longer exists in the workspace, and a stale published range is exactly the divergence this tool exists to prevent.
+*
+* This never needs the version a sibling is releasing: every case above depends only on the shape of `current` itself, which is what lets `releaseWorkspace` validate every workspace dependency edge up front, before any package has published anything, rather than discovering an unsupported range only when the first dependency it names happens to release.
+*/
+function classifyDependencyRange(current) {
+	const range = current.trim();
+	if (range.startsWith(WORKSPACE_PROTOCOL)) {
+		const suffix = range.slice(10);
+		if (PUBLISH_RESOLVED_WORKSPACE_SUFFIXES.includes(suffix)) return { kind: "resolved-at-publish" };
+		const inner = classifyDependencyRange(suffix);
+		if (inner.kind !== "rewritable") throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": only "workspace:*", "workspace:^", "workspace:~", and "workspace:" followed by a single concrete version range are supported.`);
+		return {
+			kind: "rewritable",
+			workspacePrefixed: true,
+			comparator: inner.comparator
+		};
+	}
+	if (range.startsWith(CATALOG_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": the version of a "catalog:" dependency lives in pnpm-workspace.yaml, not in the package manifest, so bumping it here would leave the catalog entry stale. Depend on the sibling directly (for example "workspace:^") instead.`);
+	if (range.startsWith(NPM_ALIAS_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": an "npm:" alias points at a differently-named package, so the version released in this workspace is not necessarily the version this range refers to.`);
+	if (WILDCARD_RANGES.includes(range)) return { kind: "wildcard" };
+	const match = REWRITABLE_COMPARATOR.exec(range);
+	if (match === null) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": only a single "^", "~", ">=", "=", or bare version comparator can be rewritten in place.`);
+	return {
+		kind: "rewritable",
+		workspacePrefixed: false,
+		comparator: match[1] ?? ""
+	};
+}
+/**
+* Computes what a dependency range on a workspace sibling becomes once that sibling releases `version`, by classifying the range's shape and then, for a rewritable shape, substituting `version` in place of the version it currently names.
+*/
+function updateDependencyRange(current, version) {
+	const shape = classifyDependencyRange(current);
+	if (shape.kind !== "rewritable") return shape;
+	const rewritten = `${shape.comparator}${version}`;
+	return {
+		kind: "rewritten",
+		range: shape.workspacePrefixed ? `${WORKSPACE_PROTOCOL}${rewritten}` : rewritten
+	};
+}
+//#endregion
+//#region src/dependency-bump-commit.ts
+/**
+* The commit message format for a cross-package dependency-range bump, shared between the code that writes it (`bumpDependents` in `release.ts`) and the code that reads it back (`createScopedPlugins` in `plugins.ts`).
+*
+* The subject line alone (`chore(deps): bump @scope/a to ^1.1.0 in @scope/b [skip ci]`) is for humans reading `git log`. Recovering the forced-patch decision from a commit already sitting in history -- rather than only from the in-memory record a single run builds as it goes -- needs a machine-parseable form as well, because a run that starts after a previous run already committed and pushed the bump (whether that previous run crashed immediately afterwards, or simply finished days ago) has no in-memory record at all: the only place the fact "this dependency range changed because a sibling released" is stated is the repository itself. The trailer below is that statement.
+*/
+const TRAILER_DEPENDENCY = "Bumped-Workspace-Dependency";
+const TRAILER_VERSION = "Bumped-Workspace-Dependency-Version";
+const TRAILER_RANGE = "Bumped-Workspace-Dependency-Range";
+/** Builds the full commit message (subject and trailer) for one dependency-range bump. */
+function formatDependencyBumpMessage(info) {
+	return `${`chore(deps): bump ${info.dependency} to ${info.range} in ${info.dependent} [skip ci]`}\n\n${[
+		`${TRAILER_DEPENDENCY}: ${info.dependency}`,
+		`${TRAILER_VERSION}: ${info.version}`,
+		`${TRAILER_RANGE}: ${info.range}`
+	].join("\n")}`;
+}
+/**
+* Recovers the dependency bump a `formatDependencyBumpMessage` commit recorded, from its full git message (subject and body), or `undefined` if the message carries no such trailer. All three lines must be present for the commit to be treated as a bump commit at all -- a message missing even one is left alone rather than partially trusted.
+*/
+function parseDependencyBumpTrailer(message) {
+	const dependency = matchTrailerLine(message, TRAILER_DEPENDENCY);
+	const version = matchTrailerLine(message, TRAILER_VERSION);
+	const range = matchTrailerLine(message, TRAILER_RANGE);
+	if (dependency === void 0 || version === void 0 || range === void 0) return;
+	return {
+		dependency,
+		version,
+		range
+	};
+}
+function matchTrailerLine(message, key) {
+	const prefix = `${key}: `;
+	const line = message.split("\n").find((candidate) => candidate.startsWith(prefix));
+	return line === void 0 ? void 0 : line.slice(prefix.length).trim();
+}
+//#endregion
+//#region src/plugins.ts
+/** The standard publish pipeline this orchestrator coordinates when a workspace configures none of its own. Every entry reuses the corresponding official plugin -- the orchestrator scopes and sequences them per package, it does not reimplement npm publishing, GitHub release creation, or changelog writing. */
+const DEFAULT_PUBLISH_PLUGINS = [
+	"@semantic-release/changelog",
+	"@semantic-release/npm",
+	"@semantic-release/github",
+	["@semantic-release/git", {
+		assets: ["CHANGELOG.md", "package.json"],
+		message: "chore(release): ${nextRelease.gitTag} [skip ci]"
+	}]
+];
+const STEP_PLUGINS_THE_ORCHESTRATOR_OWNS = /* @__PURE__ */ new Set(["@semantic-release/commit-analyzer", "@semantic-release/release-notes-generator"]);
+/**
+* Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
+*
+* Both apply the same path scoping before delegating to the real @semantic-release/commit-analyzer and @semantic-release/release-notes-generator: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
+*
+* The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
+*/
+function createScopedPlugins(scope) {
+	let cached;
+	async function commitsForPackage(context) {
+		const from = context.lastRelease?.gitHead ?? void 0;
+		if (cached?.from !== from) cached = {
+			from,
+			paths: changedPathsSince(from, { cwd: context.cwd })
+		};
+		return filterCommitsToDirectory(context.commits, await cached.paths, scope.pkg.repoRelativeDirectory);
+	}
+	return {
+		async analyzeCommits(_pluginConfig, context) {
+			const commits = await commitsForPackage(context);
+			const type = await (0, _semantic_release_commit_analyzer.analyzeCommits)(scope.analyzeCommitsConfig, {
+				...context,
+				commits
+			});
+			if (type) return type;
+			const bumps = mergeDependencyBumps(scope.bumps.bumpsFor(scope.pkg.name), commits);
+			if (bumps.length === 0) return false;
+			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${bumps.length} workspace dependency ranges changed`}; forcing a patch release.`);
+			return "patch";
+		},
+		async generateNotes(_pluginConfig, context) {
+			const commits = await commitsForPackage(context);
+			const notes = await (0, _semantic_release_release_notes_generator.generateNotes)(scope.generateNotesConfig, {
+				...context,
+				commits
+			});
+			const bumps = mergeDependencyBumps(scope.bumps.bumpsFor(scope.pkg.name), commits);
+			if (bumps.length === 0) return notes;
+			const section = [
+				"### Dependencies",
+				"",
+				...bumps.map((bump) => describeDependencyBump(bump))
+			].join("\n");
+			return notes ? `${notes}\n\n${section}` : section;
+		}
+	};
+}
+/**
+* Combines the bumps recorded in memory earlier in the current run with bumps recovered from the package's own filtered commit history (a bump commit from this run, already visible because it touches the package's own directory, or one left over from a previous run), de-duplicated by dependency name. The in-memory entry wins on overlap: it carries the manifest field and dependent name a `resolved-at-publish` bump has no commit to recover from at all.
+*/
+function mergeDependencyBumps(runtimeBumps, commits) {
+	const byDependency = /* @__PURE__ */ new Map();
+	for (const commit of commits) {
+		const parsed = parseDependencyBumpTrailer(commit.message);
+		if (parsed !== void 0) byDependency.set(parsed.dependency, {
+			...parsed,
+			kind: "rewritten"
+		});
+	}
+	for (const bump of runtimeBumps) byDependency.set(bump.dependency, bump);
+	return [...byDependency.values()];
+}
+function describeDependencyBump(bump) {
+	return bump.kind === "rewritten" ? `- Updated ${bump.dependency} to ${bump.range}` : `- Updated ${bump.dependency} to ${bump.version} (declared as \`${bump.range}\`, resolved by pnpm at publish time)`;
+}
+/**
+* Keeps a commit for the package when any path it changed lies under the package's directory. The trailing-slash prefix comparison stops `packages/a` from matching `packages/abc/x`.
+*
+* A commit missing from the changed-paths map is kept rather than dropped: it is inside the package's release range (semantic-release put it there), so a failure to parse its file list must not silently swallow a release. Absent evidence errs towards publishing, which is the visible direction for a release tool.
+*/
+function filterCommitsToDirectory(commits, changedPaths, directory) {
+	const prefix = `${directory}/`;
+	return commits.filter((commit) => {
+		const paths = changedPaths.get(commit.hash);
+		if (paths === void 0) return true;
+		return [...paths].some((path) => path === directory || path.startsWith(prefix));
+	});
+}
+function resolvePublishPlugins(specs, workspaceRoot, options) {
+	const requireFromTool = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
+	const requireFromWorkspace = (0, node_module.createRequire)((0, node_path.resolve)(workspaceRoot, "package.json"));
+	const resolved = [];
+	let hasGitPlugin = false;
+	for (const spec of specs) {
+		const [name, config] = parsePublishPluginSpec(spec);
+		if (STEP_PLUGINS_THE_ORCHESTRATOR_OWNS.has(name)) throw new ReleaseConfigurationError(`"${name}" is listed as a publish plugin, but ${packageName} always provides the ${name === "@semantic-release/commit-analyzer" ? "analyzeCommits" : "generateNotes"} step itself, wrapped around that plugin. Passing it here would make its configuration a silent no-op; set that configuration on the orchestrator's analyzeCommits/generateNotes options instead.`);
+		if (name === "@semantic-release/git") hasGitPlugin = true;
+		const entry = [resolvePluginModule(name, requireFromTool, requireFromWorkspace), config];
+		resolved.push(entry);
+	}
+	if (options.requireGitPlugin && !hasGitPlugin) throw new ReleaseConfigurationError(`The publish plugin list does not include @semantic-release/git. Without it, nothing commits each released package's manifest and changelog back to the branch, so the repository would drift out of agreement with the published versions -- the exact divergence this tool exists to prevent. (Dry runs are exempt.)`);
+	return resolved;
+}
+/**
+* Resolves a plugin module name to an absolute file path, first from this tool's own module context (its peer dependencies, which every workspace installing the orchestrator must provide) and then from the workspace root (a workspace's own plugin dependencies, such as a custom changelog plugin). Both bases are named in the error when neither can resolve the name.
+*/
+function resolvePluginModule(name, requireFromTool, requireFromWorkspace) {
+	const attempts = [];
+	for (const [label, requirer] of [["this tool", requireFromTool], ["the workspace root", requireFromWorkspace]]) try {
+		return requirer.resolve(name);
+	} catch (cause) {
+		attempts.push(`${label}: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+	throw new ReleaseConfigurationError(`Cannot resolve the publish plugin "${name}". Tried resolving it from ${attempts.join("; and from ")}.`);
+}
+function parsePublishPluginSpec(spec) {
+	if (typeof spec === "string") return [spec, {}];
+	const [name, config] = spec;
+	return [name, config ?? {}];
+}
+//#endregion
+//#region src/release.ts
+/**
+* Releases every package in a pnpm workspace with independent versions, in dependency order.
+*
+* For each package, in topological order: run semantic-release's programmatic API with `cwd` scoped to the package directory, a `name@version` tag format to keep each package's tags distinct in the one shared tag namespace, and inline `analyzeCommits`/`generateNotes` plugins that filter the release range's commits down to the package's own directory before delegating to the standard plugins. When a package releases, every workspace package that depends on it and has not run yet gets its dependency range rewritten in its manifest and committed immediately -- before its own turn, so its commit analysis and its published manifest both see the new range.
+*/
+async function releaseWorkspace(options = {}) {
+	const root = (0, node_path.resolve)(options.root ?? process.cwd());
+	const log = options.log ?? console.log;
+	const dryRun = options.dryRun === true;
+	const env = options.env ?? process.env;
+	const workspace = await discoverWorkspace(root);
+	const graph = buildDependencyGraph(workspace.packages);
+	validateDependencyRangeShapes(graph);
+	const order = topologicalOrder(graph);
+	log(`${packageName}: ${order.length} packages in release order: ${order.join(" -> ")}`);
+	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
+	const analyzeCommitsConfig = options.analyzeCommits ?? {};
+	const generateNotesConfig = options.generateNotes ?? {};
+	const pendingBumps = /* @__PURE__ */ new Map();
+	let identity;
+	const outcomes = [];
+	for (const name of order) {
+		const pkg = mustGet(graph.packages, name, "package");
+		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
+		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
+		const result = await runPackageRelease(pkg, {
+			publishPlugins,
+			analyzeCommitsConfig,
+			generateNotesConfig,
+			bumpsForThisPackage,
+			dryRun,
+			env,
+			branches: options.branches
+		});
+		const nextRelease = result === false ? void 0 : result.nextRelease;
+		outcomes.push({
+			name,
+			directory: pkg.directory,
+			released: nextRelease !== void 0,
+			version: nextRelease?.version,
+			gitTag: nextRelease?.gitTag,
+			type: nextRelease?.type,
+			dependencyBumps: bumpsForThisPackage
+		});
+		pendingBumps.delete(name);
+		if (nextRelease === void 0) {
+			log(`${name}: no release`);
+			continue;
+		}
+		log(`${name}: released ${nextRelease.gitTag}`);
+		identity ??= await resolveCommitIdentity({ cwd: workspace.root });
+		const bumps = await bumpDependents(pkg, nextRelease.version, graph, {
+			workspace,
+			dryRun,
+			identity,
+			log
+		});
+		for (const bump of bumps) {
+			const forDependent = pendingBumps.get(bump.dependent) ?? [];
+			forDependent.push(bump);
+			pendingBumps.set(bump.dependent, forDependent);
+		}
+	}
+	return {
+		order,
+		packages: outcomes
+	};
+}
+/**
+* Checks every workspace dependency edge's range shape before anything releases, so an `UnsupportedDependencyRangeError` stops the run before the first publish rather than after some sibling has already been published, tagged, committed, and pushed. The shape a range supports depends only on the range text itself (see `classifyDependencyRange`), never on which version a sibling ends up releasing, so this can run once up front for the whole graph instead of only being discovered edge by edge as each dependency happens to release.
+*/
+function validateDependencyRangeShapes(graph) {
+	for (const edges of graph.dependencies.values()) for (const edge of edges) classifyDependencyRange(edge.range);
+}
+async function runPackageRelease(pkg, options) {
+	const scoped = createScopedPlugins({
+		pkg,
+		analyzeCommitsConfig: options.analyzeCommitsConfig,
+		generateNotesConfig: options.generateNotesConfig,
+		bumps: { bumpsFor: () => options.bumpsForThisPackage }
+	});
+	const semanticReleaseOptions = {
+		tagFormat: `${pkg.name}@\${version}`,
+		plugins: options.publishPlugins,
+		analyzeCommits: scoped.analyzeCommits,
+		generateNotes: scoped.generateNotes
+	};
+	if (options.dryRun) semanticReleaseOptions.dryRun = true;
+	if (options.branches !== void 0) semanticReleaseOptions.branches = options.branches;
+	try {
+		return await (0, semantic_release.default)(semanticReleaseOptions, {
+			cwd: pkg.directory,
+			env: { ...options.env }
+		});
+	} catch (cause) {
+		throw new WorkspaceReleaseError(`Release of ${pkg.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+}
+/**
+* Rewrites the released package's range in every dependent's manifest, immediately after the release and before any dependent's own turn.
+*
+* The bump is committed (and pushed) right away rather than staged, because a dependent's semantic-release run analyses git history, not the working tree: an uncommitted bump would be invisible to its commit analysis, and would be stranded uncommitted if the dependent then released nothing -- a manifest that names versions the registry has never seen. Committing immediately means the dependent's own run sees the bump commit (it touches only the dependent's directory, so it passes that dependent's path filter), the forced-patch logic in the scoped analyzer covers the case where that bump is the dependent's only change, and a run interrupted partway leaves the remote describing exactly what was published. Pushing immediately mirrors what semantic-release itself does with release commits.
+*/
+async function bumpDependents(released, version, graph, options) {
+	const applied = [];
+	const dependents = graph.dependents.get(released.name);
+	if (dependents === void 0) return applied;
+	for (const edge of dependents) {
+		const update = updateDependencyRange(edge.range, version);
+		if (update.kind === "wildcard") continue;
+		const dependent = mustGet(graph.packages, edge.dependent, "package");
+		if (update.kind === "rewritten") {
+			if (!options.dryRun) {
+				await writeDependencyRange(dependent.manifestPath, edge.field, released.name, update.range);
+				const message = formatDependencyBumpMessage({
+					dependency: released.name,
+					version,
+					range: update.range,
+					dependent: edge.dependent
+				});
+				await commitFiles([`${dependent.relativeDirectory}/package.json`], message, {
+					cwd: options.workspace.root,
+					identity: options.identity
+				});
+				await pushHead({ cwd: options.workspace.root });
+				options.log(`Bumped ${released.name} to ${update.range} in ${edge.dependent}, committed and pushed`);
+			} else options.log(`Would bump ${released.name} to ${update.range} in ${edge.dependent} (${edge.field})`);
+		} else options.log(`${edge.dependent} declares ${released.name} as ${edge.range}; the manifest needs no edit, pnpm re-resolves it to ${version} at publish time`);
+		applied.push({
+			dependent: edge.dependent,
+			dependency: released.name,
+			field: edge.field,
+			version,
+			range: update.kind === "rewritten" ? update.range : edge.range,
+			kind: update.kind
+		});
+	}
+	return applied;
+}
+function mustGet(map, key, what) {
+	const value = map.get(key);
+	if (value === void 0) throw new WorkspaceReleaseError(`Internal error: ${what} "${key}" disappeared from the dependency graph mid-run.`);
+	return value;
+}
+//#endregion
+exports.DEFAULT_PUBLISH_PLUGINS = DEFAULT_PUBLISH_PLUGINS;
+exports.DependencyCycleError = DependencyCycleError;
+exports.GitCommandError = GitCommandError;
+exports.ReleaseConfigurationError = ReleaseConfigurationError;
+exports.UnsupportedDependencyRangeError = UnsupportedDependencyRangeError;
+exports.WorkspaceDiscoveryError = WorkspaceDiscoveryError;
+exports.WorkspaceReleaseError = WorkspaceReleaseError;
+exports.WorkspaceStateError = WorkspaceStateError;
+exports.buildDependencyGraph = buildDependencyGraph;
+exports.classifyDependencyRange = classifyDependencyRange;
+exports.createScopedPlugins = createScopedPlugins;
+exports.discoverWorkspace = discoverWorkspace;
+exports.filterCommitsToDirectory = filterCommitsToDirectory;
+exports.packageName = packageName;
+exports.readManifest = readManifest;
+exports.releaseWorkspace = releaseWorkspace;
+exports.resolvePublishPlugins = resolvePublishPlugins;
+exports.topologicalOrder = topologicalOrder;
+exports.updateDependencyRange = updateDependencyRange;
+exports.writeDependencyRange = writeDependencyRange;