@exadev/semantic-release-workspace 1.3.4 → 1.3.6

package/dist/index.cjs

@@ -26,7 +26,6 @@ let node_path = require("node:path");
 let tinyglobby = require("tinyglobby");
 let yaml = require("yaml");
 let node_child_process = require("node:child_process");
-let node_util = require("node:util");
 let validate_npm_package_name = require("validate-npm-package-name");
 validate_npm_package_name = __toESM(validate_npm_package_name, 1);
 let node_module = require("node:module");
@@ -70,7 +69,7 @@ var ReleaseConfigurationError = class extends WorkspaceReleaseError {};
 var GitCommandError = class extends WorkspaceReleaseError {
 	exitCode;
 	constructor(args, cwd, exitCode, detail) {
-		super(`git ${args.join(" ")} failed in ${cwd}${exitCode === void 0 ? "" : ` (exit ${exitCode})`}: ${detail}`);
+		super(`git ${args.join(" ")} failed in ${cwd}${exitCode === void 0 ? "" : ` (exit ${String(exitCode)})`}: ${detail}`);
 		this.exitCode = exitCode;
 	}
 };
@@ -83,10 +82,30 @@ var PnpmCommandError = class extends WorkspaceReleaseError {
 	}
 };
 //#endregion
+//#region src/exec-file.ts
+/**
+* A hand-written promise wrapper around `child_process.execFile`, in place of `util.promisify(execFile)`: `execFile` synchronously returns a `ChildProcess` in addition to invoking its callback, which trips `@typescript-eslint/strict-void-return` when the whole function is handed to `promisify` (a value-returning function used where a void-returning one is contextually expected there) -- exactly the void-return contravariance leniency that rule exists to catch, even though `tsc` itself accepts the pattern. Calling `execFile` directly with our own callback, whose own return type really is `void`, sidesteps the mismatch instead of suppressing it.
+*/
+async function execFile(command, args, options) {
+	return new Promise((resolve, reject) => {
+		(0, node_child_process.execFile)(command, [...args], {
+			cwd: options.cwd,
+			env: options.env,
+			maxBuffer: options.maxBuffer
+		}, (error, stdout, stderr) => {
+			if (error) {
+				reject(error instanceof Error ? error : new Error(error.message));
+				return;
+			}
+			resolve({
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+//#endregion
 //#region src/git.ts
-const execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
-/** `git log --name-only` over everything since a package's last release tag can legitimately produce tens of megabytes of path output on a long-lived monorepo, well past execFile's default buffer, failing on exactly the big workspaces this tool exists for. */
-const GIT_MAX_BUFFER_BYTES = 104857600;
 /** Separates one commit's record in `git log --format` output. Chosen from the C0 control range so it can never appear in a hash or a file path. */
 const COMMIT_RECORD_SEPARATOR = "";
 /** The identity semantic-release's own core writes release commits under in CI when nothing else is configured (its COMMIT_NAME/COMMIT_EMAIL constants); dependency-bump commits use the same fallback so every commit a release run produces has a consistent author when the repository declares none. */
@@ -114,18 +133,22 @@ const GIT_REPOSITORY_DISCOVERY_ENV_KEYS = [
 */
 function sanitizeGitEnv(env) {
 	const sanitized = { ...env };
-	for (const key of GIT_REPOSITORY_DISCOVERY_ENV_KEYS) delete sanitized[key];
+	for (const key of GIT_REPOSITORY_DISCOVERY_ENV_KEYS) Reflect.deleteProperty(sanitized, key);
 	return sanitized;
 }
 const SANITIZED_PROCESS_GIT_ENV = sanitizeGitEnv(process.env);
+/** `git log --name-only` over everything since a package's last release tag can legitimately produce tens of megabytes of path output on a long-lived monorepo, well past execFile's default buffer, failing on exactly the big workspaces this tool exists for -- hence the generous 100 MiB default, rather than execFile's own. */
+async function execGit(args, cwd, maxBuffer = 104857600) {
+	const { stdout } = await execFile("git", args, {
+		cwd,
+		maxBuffer,
+		env: SANITIZED_PROCESS_GIT_ENV
+	});
+	return stdout;
+}
 async function git(args, options) {
 	try {
-		const { stdout } = await execFileAsync$1("git", [...args], {
-			cwd: options.cwd,
-			maxBuffer: GIT_MAX_BUFFER_BYTES,
-			env: SANITIZED_PROCESS_GIT_ENV
-		});
-		return stdout;
+		return await execGit(args, options.cwd);
 	} catch (cause) {
 		throw toGitCommandError(args, options.cwd, cause);
 	}
@@ -239,9 +262,11 @@ async function workingTreeChanges(options) {
 	const paths = [];
 	for (let index = 0; index < tokens.length; index += 1) {
 		const entry = tokens[index];
-		if (entry === void 0 || entry.length < 4) continue;
+		if (entry === void 0) continue;
 		const statusCode = entry.slice(0, 2);
-		paths.push(entry.slice(3));
+		const path = entry.slice(3);
+		if (path === "") continue;
+		paths.push(path);
 		if (statusCode.includes("R") || statusCode.includes("C")) index += 1;
 	}
 	return paths;
@@ -306,7 +331,7 @@ async function readManifest(path) {
 	const { name, version } = parsed;
 	if (typeof name !== "string" || name.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "name". Every workspace package needs a name: releases are ordered, tagged, and matched to dependents by it.`);
 	const validity = (0, validate_npm_package_name.default)(name);
-	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${(validity.errors ?? []).join("; ")}`);
+	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${validity.errors.join("; ")}`);
 	if (typeof version !== "string" || version.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "version".`);
 	const dependencies = /* @__PURE__ */ new Map();
 	for (const field of DEPENDENCY_FIELDS) {
@@ -609,6 +634,10 @@ function matchTrailerLine(message, key) {
 }
 //#endregion
 //#region src/plugins.ts
+/** semantic-release's own `getLastRelease` returns `{}` for a package with no prior tag -- not `undefined`, and not a fully-populated `LastRelease` -- contradicting the `gitHead: string` its own type declares. Narrows structurally rather than trusting that declared type, so a first-release context's `lastRelease` (correctly, at runtime) never claims a `gitHead` it does not have. */
+function hasGitHead(lastRelease) {
+	return typeof lastRelease === "object" && lastRelease !== null && "gitHead" in lastRelease && typeof lastRelease.gitHead === "string";
+}
 /** The standard publish pipeline this orchestrator coordinates when a workspace configures none of its own. Every entry reuses the corresponding official plugin -- the orchestrator scopes and sequences them per package, it does not reimplement npm publishing, GitHub release creation, or changelog writing. */
 const DEFAULT_PUBLISH_PLUGINS = [
 	"@semantic-release/changelog",
@@ -619,7 +648,7 @@ const DEFAULT_PUBLISH_PLUGINS = [
 		message: "chore(release): ${nextRelease.gitTag} [skip ci]"
 	}]
 ];
-/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus @semantic-release/git, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
+/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus `@semantic-release/git`, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
 const SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS = [
 	"@semantic-release/changelog",
 	"@semantic-release/npm",
@@ -629,14 +658,14 @@ const STEP_PLUGINS_THE_ORCHESTRATOR_OWNS = /* @__PURE__ */ new Set(["@semantic-r
 /**
 * Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
 *
-* Both apply the same path scoping before delegating to the real @semantic-release/commit-analyzer and @semantic-release/release-notes-generator: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
+* Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
 *
 * The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
 */
 function createScopedPlugins(scope) {
 	let cached;
 	async function commitsForPackage(context) {
-		const from = context.lastRelease?.gitHead ?? void 0;
+		const from = hasGitHead(context.lastRelease) ? context.lastRelease.gitHead : void 0;
 		if (cached === void 0) cached = {
 			from,
 			paths: changedPathsSince(from, { cwd: context.cwd })
@@ -656,10 +685,10 @@ function createScopedPlugins(scope) {
 				...context,
 				commits
 			});
-			if (type) return type;
+			if (typeof type === "string") return type;
 			const bumps = mergeDependencyBumps(scope.bumps.bumpsFor(scope.pkg.name), commits);
 			if (bumps.length === 0) return false;
-			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${bumps.length} workspace dependency ranges changed`}; forcing a patch release.`);
+			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${String(bumps.length)} workspace dependency ranges changed`}; forcing a patch release.`);
 			return "patch";
 		},
 		async generateNotes(_pluginConfig, context) {
@@ -675,7 +704,7 @@ function createScopedPlugins(scope) {
 				"",
 				...bumps.map((bump) => describeDependencyBump(bump))
 			].join("\n");
-			return notes ? `${notes}\n\n${section}` : section;
+			return typeof notes === "string" ? `${notes}\n\n${section}` : section;
 		}
 	};
 }
@@ -747,7 +776,6 @@ function parsePublishPluginSpec(spec) {
 }
 //#endregion
 //#region src/pnpm.ts
-const execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Regenerates `pnpm-lock.yaml` for the whole workspace from the manifests currently on disk, without touching `node_modules` or installing anything -- the same lockfile-refresh step a contributor runs by hand after editing a `package.json` dependency range.
 *
@@ -755,7 +783,7 @@ const execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
 */
 async function regenerateLockfile(options) {
 	try {
-		await execFileAsync("pnpm", ["install", "--lockfile-only"], { cwd: options.cwd });
+		await execFile("pnpm", ["install", "--lockfile-only"], { cwd: options.cwd });
 	} catch (cause) {
 		const stderr = cause instanceof Error && "stderr" in cause && typeof cause.stderr === "string" ? cause.stderr.trim() : "";
 		const detail = stderr !== "" ? stderr : cause instanceof Error ? cause.message : String(cause);
@@ -771,7 +799,7 @@ async function regenerateLockfile(options) {
 *
 * 1. **Analyse** (this file's `analysePackage`): for every package, in topological order, run semantic-release with `dryRun: true` forced (regardless of the caller's own `dryRun` option) using the same path-scoped `analyzeCommits`/`generateNotes` wrapper `commitStrategy: 'per-package'` uses -- computing each package's next version and notes without writing, committing, tagging, or publishing anything. Cross-package dependency bumps are tracked purely in memory during this phase (`pendingBumps`), exactly as the per-package strategy tracks them for the span of one run; nothing is committed yet for a later run to recover from, because this strategy never leaves a partial commit for a crash to recover from in the first place -- either the whole combined commit lands, or nothing does.
 * 2. **Verify** every released package's configured publish plugins' `verifyConditions` step (npm registry auth, GitHub token/repo access), before any file is written -- the same fail-fast-before-anything-releases discipline `validateDependencyRangeShapes` already applies to dependency ranges.
-* 3. **Prepare**: for every released package, in topological order, apply any dependency-range bump its own manifest received (writing `package.json` directly, the same `writeDependencyRange` the per-package strategy uses), then run every configured publish plugin's own `prepare` step generically (whichever it defines -- @semantic-release/npm bumps `package.json`'s version, @semantic-release/changelog writes `CHANGELOG.md`). @semantic-release/git is rejected outright from this mode's plugin list (see `resolvePublishPlugins`'s `forbidGitPlugin`), since its own `prepare` step would create exactly the per-package commit this mode exists to avoid. The lockfile is regenerated once at the end, not once per bump, since `pnpm install --lockfile-only` recomputes it from whatever is on disk regardless of how many manifests changed.
+* 3. **Prepare**: for every released package, in topological order, apply any dependency-range bump its own manifest received (writing `package.json` directly, the same `writeDependencyRange` the per-package strategy uses), then run every configured publish plugin's own `prepare` step generically (whichever it defines -- `@semantic-release/npm` bumps `package.json`'s version, `@semantic-release/changelog` writes `CHANGELOG.md`). `@semantic-release/git` is rejected outright from this mode's plugin list (see `resolvePublishPlugins`'s `forbidGitPlugin`), since its own `prepare` step would create exactly the per-package commit this mode exists to avoid. The lockfile is regenerated once at the end, not once per bump, since `pnpm install --lockfile-only` recomputes it from whatever is on disk regardless of how many manifests changed.
 * 4. **Commit**: discover every file phase 3 touched via `git status` (rather than predicting filenames per plugin), make one commit, tag it once per released package (`name@version`, lightweight, matching semantic-release's own tag form), and push the commit and every tag together.
 * 5. **Publish**: for every released package, in topological order, call each configured plugin's own `publish` step directly (not through semantic-release's top-level orchestrator -- see the note below), then `success`.
 *
@@ -788,7 +816,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	const graph = buildDependencyGraph(workspace.packages);
 	validateDependencyRangeShapes(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order: ${order.join(" -> ")} (commitStrategy: single)`);
+	log(`${packageName}: ${String(order.length)} packages in release order: ${order.join(" -> ")} (commitStrategy: single)`);
 	const resolvedPlugins = resolvePublishPlugins(options.plugins ?? SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, workspace.root, {
 		requireGitPlugin: false,
 		forbidGitPlugin: true
@@ -814,19 +842,26 @@ async function releaseWorkspaceSingleCommit(options) {
 			bumpsForThisPackage,
 			env,
 			branches: options.branches,
-			onCommitsResolved: (commits) => capturedCommits.set(name, commits),
+			onCommitsResolved: (commits) => {
+				capturedCommits.set(name, commits);
+			},
 			onContextCaptured: (context) => {
 				captured.branch = context.branch;
 				captured.repositoryUrl = context.repositoryUrl;
 			}
 		});
-		outcomes.push({
+		outcomes.push(nextRelease === void 0 ? {
 			name,
 			directory: pkg.directory,
-			released: nextRelease !== void 0,
-			version: nextRelease?.version,
-			gitTag: nextRelease?.gitTag,
-			type: nextRelease?.type,
+			released: false,
+			dependencyBumps: bumpsForThisPackage
+		} : {
+			name,
+			directory: pkg.directory,
+			released: true,
+			version: nextRelease.version,
+			gitTag: nextRelease.gitTag,
+			type: nextRelease.type,
 			dependencyBumps: bumpsForThisPackage
 		});
 		if (nextRelease === void 0) {
@@ -854,7 +889,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	};
 	const branch = captured.branch;
 	const repositoryUrl = captured.repositoryUrl;
-	if (branch === void 0 || repositoryUrl === void 0) throw new ReleaseConfigurationError(`Internal error: ${packageName} analysed ${planned.length} package release(s) but never captured a branch/repositoryUrl from semantic-release's own context. This should be impossible when at least one package releases.`);
+	if (branch === void 0 || repositoryUrl === void 0) throw new ReleaseConfigurationError(`Internal error: ${packageName} analysed ${String(planned.length)} package release(s) but never captured a branch/repositoryUrl from semantic-release's own context. This should be impossible when at least one package releases.`);
 	const shared = {
 		env,
 		branch,
@@ -880,7 +915,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	}
 	if (anyRangeRewritten) await regenerateLockfile({ cwd: workspace.root });
 	const touchedPaths = await workingTreeChanges({ cwd: repoRoot });
-	if (touchedPaths.length === 0) throw new ReleaseConfigurationError(`${packageName}: analysis planned ${planned.length} release(s), but no files changed while preparing them. Every configured publish plugin's own "prepare" step (bumping package.json, writing CHANGELOG.md) produced nothing to commit -- check the plugin list includes something that writes the version, e.g. @semantic-release/npm.`);
+	if (touchedPaths.length === 0) throw new ReleaseConfigurationError(`${packageName}: analysis planned ${String(planned.length)} release(s), but no files changed while preparing them. Every configured publish plugin's own "prepare" step (bumping package.json, writing CHANGELOG.md) produced nothing to commit -- check the plugin list includes something that writes the version, e.g. @semantic-release/npm.`);
 	const identity = await resolveCommitIdentity({ cwd: repoRoot });
 	await commitFiles(touchedPaths, describeCombinedCommit(planned), {
 		cwd: repoRoot,
@@ -890,7 +925,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	const tagNames = planned.map((release) => release.gitTag);
 	for (const tagName of tagNames) await createTag(tagName, commitSha, { cwd: repoRoot });
 	await pushHeadAndTags(tagNames, { cwd: repoRoot });
-	log(`${packageName}: committed ${commitSha} and pushed ${tagNames.length} tag(s): ${tagNames.join(", ")}`);
+	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
 	for (const release of planned) {
 		const releases = [];
 		for (const [modulePath, pluginConfig] of resolvedPlugins) {
@@ -982,10 +1017,18 @@ function describeCombinedCommit(planned) {
 }
 function buildPluginContext(release, shared, capturedCommits, releases) {
 	const logger = {
-		log: (...args) => shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`),
-		warn: (...args) => shared.log(`[${release.pkg.name}] warn: ${args.map(String).join(" ")}`),
-		error: (...args) => shared.log(`[${release.pkg.name}] error: ${args.map(String).join(" ")}`),
-		success: (...args) => shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`)
+		log: (...args) => {
+			shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`);
+		},
+		warn: (...args) => {
+			shared.log(`[${release.pkg.name}] warn: ${args.map(String).join(" ")}`);
+		},
+		error: (...args) => {
+			shared.log(`[${release.pkg.name}] error: ${args.map(String).join(" ")}`);
+		},
+		success: (...args) => {
+			shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`);
+		}
 	};
 	return {
 		cwd: release.pkg.directory,
@@ -1045,7 +1088,7 @@ async function detachWorkspaceRelease(options) {
 	const graph = buildDependencyGraph(workspace.packages);
 	validateDependencyRangeShapes(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
+	log(`${packageName}: ${String(order.length)} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
@@ -1067,15 +1110,20 @@ async function detachWorkspaceRelease(options) {
 	});
 	return {
 		order,
-		packages: entries.map((entry) => ({
+		packages: entries.map((entry) => entry.result === null ? {
+			name: entry.name,
+			directory: entry.directory,
+			released: false,
+			dependencyBumps: entry.dependencyBumps
+		} : {
 			name: entry.name,
 			directory: entry.directory,
-			released: entry.result !== null,
-			version: entry.result?.nextRelease.version,
-			gitTag: entry.result?.nextRelease.gitTag,
-			type: entry.result?.nextRelease.type,
+			released: true,
+			version: entry.result.nextRelease.version,
+			gitTag: entry.result.nextRelease.gitTag,
+			type: entry.result.nextRelease.type,
 			dependencyBumps: entry.dependencyBumps
-		})),
+		}),
 		detached: entries.map((entry) => ({
 			name: entry.name,
 			relativeDirectory: entry.relativeDirectory,
@@ -1125,9 +1173,6 @@ async function resumeWorkspaceRelease(options) {
 				name: entry.name,
 				directory: (0, node_path.resolve)(root, entry.relativeDirectory),
 				released: false,
-				version: void 0,
-				gitTag: void 0,
-				type: void 0,
 				dependencyBumps: entry.dependencyBumps
 			});
 			continue;
@@ -1143,7 +1188,7 @@ async function resumeWorkspaceRelease(options) {
 		} catch (cause) {
 			throw new WorkspaceReleaseError(`Resuming ${entry.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
 		}
-		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${releases.length} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
+		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${String(releases.length)} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
 		packages.push({
 			name: entry.name,
 			directory,
@@ -1180,7 +1225,7 @@ async function releaseWorkspace(options = {}) {
 	const graph = buildDependencyGraph(workspace.packages);
 	validateDependencyRangeShapes(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order: ${order.join(" -> ")}`);
+	log(`${packageName}: ${String(order.length)} packages in release order: ${order.join(" -> ")}`);
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
@@ -1204,13 +1249,18 @@ async function releaseWorkspace(options = {}) {
 			};
 		})).map((entry) => {
 			const nextRelease = entry.result === false ? void 0 : entry.result.nextRelease;
-			return {
+			return nextRelease === void 0 ? {
 				name: entry.name,
 				directory: entry.directory,
-				released: nextRelease !== void 0,
-				version: nextRelease?.version,
-				gitTag: nextRelease?.gitTag,
-				type: nextRelease?.type,
+				released: false,
+				dependencyBumps: entry.dependencyBumps
+			} : {
+				name: entry.name,
+				directory: entry.directory,
+				released: true,
+				version: nextRelease.version,
+				gitTag: nextRelease.gitTag,
+				type: nextRelease.type,
 				dependencyBumps: entry.dependencyBumps
 			};
 		})

package/dist/index.d.cts

@@ -139,13 +139,13 @@ interface DependencyBump {
 }
 /** What the scoped plugins need to know about bumps recorded so far in the run, for the package they are about to analyse. */
 interface DependencyBumpSource {
-  bumpsFor(dependent: string): readonly DependencyBump[];
+  bumpsFor: (dependent: string) => readonly DependencyBump[];
 }
 /** A publish-pipeline plugin entry as the orchestrator accepts it: a module name, optionally with a config object. */
 type PublishPluginSpec = string | readonly [string] | readonly [string, Record<string, unknown>];
 /** The standard publish pipeline this orchestrator coordinates when a workspace configures none of its own. Every entry reuses the corresponding official plugin -- the orchestrator scopes and sequences them per package, it does not reimplement npm publishing, GitHub release creation, or changelog writing. */
 export declare const DEFAULT_PUBLISH_PLUGINS: readonly PublishPluginSpec[];
-/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus @semantic-release/git, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
+/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus `@semantic-release/git`, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
 export declare const SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS: readonly PublishPluginSpec[];
 interface ScopedPlugins {
   readonly analyzeCommits: (pluginConfig: Record<string, unknown>, context: AnalyzeCommitsContext & {
@@ -158,7 +158,7 @@ interface ScopedPlugins {
 /**
  * Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
  *
- * Both apply the same path scoping before delegating to the real @semantic-release/commit-analyzer and @semantic-release/release-notes-generator: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
+ * Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
  *
  * The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
  */
@@ -226,11 +226,11 @@ interface ReleaseWorkspaceOptions {
   readonly dryRun?: boolean;
   /** Release branch configuration for semantic-release. Defaults to semantic-release's own default branch list. */
   readonly branches?: readonly BranchSpec[];
-  /** Publish-pipeline plugins (changelog, npm, GitHub, git), each scoped per package by semantic-release's own `cwd`. Defaults to the standard pipeline in DEFAULT_PUBLISH_PLUGINS for `commitStrategy: 'per-package'`, or SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS (the same list minus @semantic-release/git) for `commitStrategy: 'single'`. */
+  /** Publish-pipeline plugins (changelog, npm, GitHub, git), each scoped per package by semantic-release's own `cwd`. Defaults to the standard pipeline in DEFAULT_PUBLISH_PLUGINS for `commitStrategy: 'per-package'`, or SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS (the same list minus `@semantic-release/git`) for `commitStrategy: 'single'`. */
   readonly plugins?: readonly PublishPluginSpec[];
-  /** Options for the wrapped @semantic-release/commit-analyzer, applied per package after path filtering. */
+  /** Options for the wrapped `@semantic-release/commit-analyzer`, applied per package after path filtering. */
   readonly analyzeCommits?: Record<string, unknown>;
-  /** Options for the wrapped @semantic-release/release-notes-generator, applied per package after path filtering. */
+  /** Options for the wrapped `@semantic-release/release-notes-generator`, applied per package after path filtering. */
   readonly generateNotes?: Record<string, unknown>;
   /** Progress sink for the orchestrator's own narration (semantic-release logs its own detail). Defaults to `console.log`. */
   readonly log?: (message: string) => void;
@@ -247,17 +247,22 @@ interface AppliedDependencyBump extends DependencyBump {
   /** Which manifest field held the range that was rewritten. */
   readonly field: DependencyField;
 }
-interface PackageReleaseOutcome {
+type PackageReleaseOutcome = {
   readonly name: string;
   readonly directory: string;
-  readonly released: boolean;
-  readonly version: string | undefined;
-  readonly gitTag: string | undefined;
-  /** The semantic-release release type ('minor', 'patch', ...), including the forced 'patch' of a dependency-bump-only release. */
-  readonly type: string | undefined;
   /** Dependency ranges rewritten in this package's own manifest because a workspace dependency released earlier in the run. */
   readonly dependencyBumps: readonly AppliedDependencyBump[];
-}
+} & ({
+  readonly released: true;
+  readonly version: string;
+  readonly gitTag: string;
+  readonly type: string;
+} | {
+  readonly released: false;
+  readonly version?: undefined;
+  readonly gitTag?: undefined;
+  readonly type?: undefined;
+});
 interface WorkspaceReleaseOutcome {
   /** The topological order the packages were released in. */
   readonly order: readonly string[];

package/dist/index.d.ts

@@ -139,13 +139,13 @@ interface DependencyBump {
 }
 /** What the scoped plugins need to know about bumps recorded so far in the run, for the package they are about to analyse. */
 interface DependencyBumpSource {
-  bumpsFor(dependent: string): readonly DependencyBump[];
+  bumpsFor: (dependent: string) => readonly DependencyBump[];
 }
 /** A publish-pipeline plugin entry as the orchestrator accepts it: a module name, optionally with a config object. */
 type PublishPluginSpec = string | readonly [string] | readonly [string, Record<string, unknown>];
 /** The standard publish pipeline this orchestrator coordinates when a workspace configures none of its own. Every entry reuses the corresponding official plugin -- the orchestrator scopes and sequences them per package, it does not reimplement npm publishing, GitHub release creation, or changelog writing. */
 export declare const DEFAULT_PUBLISH_PLUGINS: readonly PublishPluginSpec[];
-/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus @semantic-release/git, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
+/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus `@semantic-release/git`, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
 export declare const SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS: readonly PublishPluginSpec[];
 interface ScopedPlugins {
   readonly analyzeCommits: (pluginConfig: Record<string, unknown>, context: AnalyzeCommitsContext & {
@@ -158,7 +158,7 @@ interface ScopedPlugins {
 /**
  * Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
  *
- * Both apply the same path scoping before delegating to the real @semantic-release/commit-analyzer and @semantic-release/release-notes-generator: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
+ * Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
  *
  * The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
  */
@@ -226,11 +226,11 @@ interface ReleaseWorkspaceOptions {
   readonly dryRun?: boolean;
   /** Release branch configuration for semantic-release. Defaults to semantic-release's own default branch list. */
   readonly branches?: readonly BranchSpec[];
-  /** Publish-pipeline plugins (changelog, npm, GitHub, git), each scoped per package by semantic-release's own `cwd`. Defaults to the standard pipeline in DEFAULT_PUBLISH_PLUGINS for `commitStrategy: 'per-package'`, or SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS (the same list minus @semantic-release/git) for `commitStrategy: 'single'`. */
+  /** Publish-pipeline plugins (changelog, npm, GitHub, git), each scoped per package by semantic-release's own `cwd`. Defaults to the standard pipeline in DEFAULT_PUBLISH_PLUGINS for `commitStrategy: 'per-package'`, or SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS (the same list minus `@semantic-release/git`) for `commitStrategy: 'single'`. */
   readonly plugins?: readonly PublishPluginSpec[];
-  /** Options for the wrapped @semantic-release/commit-analyzer, applied per package after path filtering. */
+  /** Options for the wrapped `@semantic-release/commit-analyzer`, applied per package after path filtering. */
   readonly analyzeCommits?: Record<string, unknown>;
-  /** Options for the wrapped @semantic-release/release-notes-generator, applied per package after path filtering. */
+  /** Options for the wrapped `@semantic-release/release-notes-generator`, applied per package after path filtering. */
   readonly generateNotes?: Record<string, unknown>;
   /** Progress sink for the orchestrator's own narration (semantic-release logs its own detail). Defaults to `console.log`. */
   readonly log?: (message: string) => void;
@@ -247,17 +247,22 @@ interface AppliedDependencyBump extends DependencyBump {
   /** Which manifest field held the range that was rewritten. */
   readonly field: DependencyField;
 }
-interface PackageReleaseOutcome {
+type PackageReleaseOutcome = {
   readonly name: string;
   readonly directory: string;
-  readonly released: boolean;
-  readonly version: string | undefined;
-  readonly gitTag: string | undefined;
-  /** The semantic-release release type ('minor', 'patch', ...), including the forced 'patch' of a dependency-bump-only release. */
-  readonly type: string | undefined;
   /** Dependency ranges rewritten in this package's own manifest because a workspace dependency released earlier in the run. */
   readonly dependencyBumps: readonly AppliedDependencyBump[];
-}
+} & ({
+  readonly released: true;
+  readonly version: string;
+  readonly gitTag: string;
+  readonly type: string;
+} | {
+  readonly released: false;
+  readonly version?: undefined;
+  readonly gitTag?: undefined;
+  readonly type?: undefined;
+});
 interface WorkspaceReleaseOutcome {
   /** The topological order the packages were released in. */
   readonly order: readonly string[];