@exadev/semantic-release-workspace 1.3.5 → 1.3.7

package/README.md

@@ -37,20 +37,22 @@ Why commit immediately, rather than the alternatives:
 
 Because every dependent sits downstream in topological order, its own run always sees the bump commit: the commit touches only the dependent's directory, so it passes that dependent's path filter and participates in its analysis.
 
-**A package whose only change is dependency bumps still gets a patch release — deliberately.** Whether the range was rewritten on disk (`^1.0.0` → `^1.1.0`) or is a `workspace:^`-style range that pnpm re-resolves at pack time, the dependent's *published* dependency range changes, so the dependent must be republished for the change to reach consumers. This is not left to chance: the wrapped `analyzeCommits` returns `patch` whenever the standard analyzer found nothing but this run bumped one of the package's dependency ranges, so the behaviour does not depend on how the workspace's own analyzer config happens to classify `chore(deps)` commits (many presets release nothing for `chore`). Release notes gain a `### Dependencies` section listing the bumps, so the release is self-explaining rather than empty.
+**A package whose only change is dependency bumps still gets a patch release — deliberately.** A range rewritten on disk (`^1.0.0` → `^1.1.0`) changes the dependent's *published* dependency range, so the dependent must be republished for the change to reach consumers. A range that names no version, such as a bare `workspace:^` in a private package, has nothing to rewrite, but the dependent still releases, so a package always follows a sibling it depends on. This is not left to chance: the wrapped `analyzeCommits` returns `patch` whenever the standard analyzer found nothing but this run bumped one of the package's dependency ranges, so the behaviour does not depend on how the workspace's own analyzer config happens to classify `chore(deps)` commits (many presets release nothing for `chore`). Release notes gain a `### Dependencies` section listing the bumps, so the release is self-explaining rather than empty.
 
 Dependency-range handling, in full:
 
 | Range in the dependent's manifest | What happens |
 | --- | --- |
-| `^1.0.0`, `~1.0.0`, `>=1.0.0`, `=1.0.0`, `1.0.0`, `workspace:^1.0.0` | Rewritten in place, preserving the comparator (`^1.0.0` → `^1.1.0`); `pnpm-lock.yaml` is regenerated to match, and both are committed and pushed together; dependent gets at least a patch release |
-| `workspace:*`, `workspace:^`, `workspace:~` | No manifest edit (pnpm resolves these at pack time), but the published range still changes, so the dependent still gets a patch release |
+| `^1.0.0`, `~1.0.0`, `>=1.0.0`, `=1.0.0`, `1.0.0` | Rewritten in place, preserving the comparator (`^1.0.0` → `^1.1.0`); `pnpm-lock.yaml` is regenerated to match, and both are committed and pushed together; dependent gets at least a patch release |
+| `workspace:^1.0.0` and the other anchored `workspace:` forms, in `devDependencies` or a private package | Rewritten in place with the `workspace:` prefix kept (`workspace:^1.0.0` → `workspace:^1.1.0`), committed and pushed as above; dependent gets at least a patch release |
+| `workspace:*`, `workspace:^`, `workspace:~`, in `devDependencies` or a private package | No manifest edit, since the range names no version; the dependent still gets a patch release |
+| Any `workspace:`, `catalog:`, `link:`, or `file:` specifier in the `dependencies`, `peerDependencies`, or `optionalDependencies` of a package that is not private, whichever package it names | The run stops with `UnsupportedDependencyRangeError`: `npm publish` ships the specifier unchanged, so the published package could not be installed |
 | `*`, `x`, `latest` | Nothing to update and the published range is unaffected — no bump, no forced release |
 | Compound ranges (`>=1.0.0 <2.0.0`), unions (`1.x \|\| 2.x`), `<`/`<=` bounds, `catalog:`, `npm:` aliases, git/tarball URLs | The run stops with `UnsupportedDependencyRangeError` — rewriting any of these wrongly, or leaving them silently stale, both produce a published manifest that disagrees with the repository, so neither is attempted |
 
-Every workspace dependency edge's range is validated against this table before the release loop starts, not just when the dependency it names happens to release: an unsupported range is a static property of the manifests, knowable at discovery time, so `UnsupportedDependencyRangeError` stops the run before the first package publishes, rather than after some upstream sibling has already been published, tagged, committed, and pushed.
+Every range above is validated before the release loop starts, not just when the dependency it names happens to release: both the shape of each workspace dependency edge and the specifiers in each publishable package's installed dependency fields are static properties of the manifests, knowable at discovery time, so `UnsupportedDependencyRangeError` stops the run before the first package publishes, rather than after some upstream sibling has already been published, tagged, committed, and pushed. Every offending entry is listed in one error. `resume` checks the manifests again before it publishes anything.
 
-For that reason concrete ranges (which the orchestrator maintains for you) are the recommended mode. Publishing `workspace:` ranges correctly additionally requires a pack step that substitutes them, as `pnpm publish` does.
+Publishing goes through `@semantic-release/npm`, which is plain `npm publish`: it ships a manifest's specifiers unchanged and never substitutes pnpm's protocols the way `pnpm publish` does. A publishable package therefore declares a concrete version range for each workspace sibling, which the orchestrator keeps up to date for you, and keeps `linkWorkspacePackages: true` in `pnpm-workspace.yaml` so pnpm still links the sibling locally instead of fetching it from the registry. `workspace:` ranges remain usable in private packages, which never publish, and in `devDependencies`, which no consumer installs.
 
 ## Commit strategies
 
@@ -149,7 +151,7 @@ The core technique is the same one multi-semantic-release proved in production:
 - **In-process delegation, not CLI wrapping.** semantic-release is invoked through its programmatic API with inline plugin functions, so the wrappers delegate to the real @semantic-release/commit-analyzer and @semantic-release/release-notes-generator running in the same process. (The analysed plugins are ESM named exports here, resolved as peers of this package — no plugin re-implementation anywhere.)
 - **Bump-only dependents always release.** multi-semantic-release rewrites dependency ranges in the working tree without committing them, so a dependent whose only change is a dependency update can go unreleased until some other commit triggers it. Here the bump is committed before the dependent's turn and a patch release is forced deterministically (see the timing section above).
 - **Loud failures by design.** A dependency cycle, an unsupported dependency range, a publish pipeline without @semantic-release/git (which would leave released manifests uncommitted), an unresolvable plugin, a duplicate package name — each stops the run with a specific error rather than degrading silently. There is deliberately no "skip this package and carry on" path: a partially-consistent set of publishes is worse than none.
-- **pnpm-native range semantics.** `workspace:*`/`workspace:^`/`workspace:~` are understood as publish-resolved (bump the release, not the manifest text); `catalog:` and `npm:` aliases are rejected with an explanation instead of being mangled.
+- **Only installable specifiers reach the registry.** `workspace:`, `catalog:`, `link:`, and `file:` specifiers in a publishable package's installed dependency fields are rejected instead of being published as written. In private packages and `devDependencies`, `workspace:*`/`workspace:^`/`workspace:~` are understood as naming no version (bump the release, not the manifest text), and `catalog:` and `npm:` aliases on a workspace sibling are rejected with an explanation instead of being mangled.
 - **Workspace-agnostic discovery.** Everything comes from `pnpm-workspace.yaml` and the manifests its globs match; pointing the orchestrator at any pnpm workspace is the entire configuration.
 
 Out of scope, on purpose: parallelising independent branches of the dependency graph (packages release sequentially in topological order for correctness first — a real future optimisation, not attempted here), and any Changesets-style explicit-changeset mode, which is a different paradigm rather than a missing feature.

package/dist/cli.js

@@ -6,7 +6,6 @@ import { Command, InvalidArgumentError } from "commander";
 import { dirname, relative, resolve, sep } from "node:path";
 import { detachRelease, resumeRelease } from "@exadev/release-gate";
 import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import validateNpmPackageName from "validate-npm-package-name";
 import { glob } from "tinyglobby";
 import { parse } from "yaml";
@@ -15,7 +14,7 @@ import { generateNotes } from "@semantic-release/release-notes-generator";
 import semanticRelease from "semantic-release";
 import { pathToFileURL } from "node:url";
 //#region package.json
-var version = "1.3.5";
+var version = "1.3.7";
 //#endregion
 //#region src/errors.ts
 /**
@@ -40,7 +39,7 @@ var DependencyCycleError = class extends WorkspaceReleaseError {
 		this.cycle = cycle;
 	}
 };
-/** A dependency on a workspace sibling uses a range this tool cannot rewrite with confidence. Rewriting it wrongly, or leaving it silently stale, both produce a published manifest that disagrees with the repository, so the run stops instead. */
+/** A dependency range this tool cannot release correctly: either a range on a workspace sibling that it cannot rewrite with confidence (rewriting it wrongly, or leaving it silently stale, produces a published manifest that disagrees with the repository), or a `workspace:`, `catalog:`, `link:`, or `file:` specifier in a publishable package's published dependencies, which `npm publish` ships verbatim and no consumer can install. The run stops instead. */
 var UnsupportedDependencyRangeError = class extends WorkspaceReleaseError {};
 /** The semantic-release options handed to the orchestrator cannot be scoped to a single package -- typically a publish plugin list that would leave a release commit or a cross-package manifest bump uncommitted. */
 var ReleaseConfigurationError = class extends WorkspaceReleaseError {};
@@ -48,7 +47,7 @@ var ReleaseConfigurationError = class extends WorkspaceReleaseError {};
 var GitCommandError = class extends WorkspaceReleaseError {
 	exitCode;
 	constructor(args, cwd, exitCode, detail) {
-		super(`git ${args.join(" ")} failed in ${cwd}${exitCode === void 0 ? "" : ` (exit ${exitCode})`}: ${detail}`);
+		super(`git ${args.join(" ")} failed in ${cwd}${exitCode === void 0 ? "" : ` (exit ${String(exitCode)})`}: ${detail}`);
 		this.exitCode = exitCode;
 	}
 };
@@ -61,10 +60,30 @@ var PnpmCommandError = class extends WorkspaceReleaseError {
 	}
 };
 //#endregion
+//#region src/exec-file.ts
+/**
+* A hand-written promise wrapper around `child_process.execFile`, in place of `util.promisify(execFile)`: `execFile` synchronously returns a `ChildProcess` in addition to invoking its callback, which trips `@typescript-eslint/strict-void-return` when the whole function is handed to `promisify` (a value-returning function used where a void-returning one is contextually expected there) -- exactly the void-return contravariance leniency that rule exists to catch, even though `tsc` itself accepts the pattern. Calling `execFile` directly with our own callback, whose own return type really is `void`, sidesteps the mismatch instead of suppressing it.
+*/
+async function execFile$1(command, args, options) {
+	return new Promise((resolve, reject) => {
+		execFile(command, [...args], {
+			cwd: options.cwd,
+			env: options.env,
+			maxBuffer: options.maxBuffer
+		}, (error, stdout, stderr) => {
+			if (error) {
+				reject(error instanceof Error ? error : new Error(error.message));
+				return;
+			}
+			resolve({
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+//#endregion
 //#region src/git.ts
-const execFileAsync$1 = promisify(execFile);
-/** `git log --name-only` over everything since a package's last release tag can legitimately produce tens of megabytes of path output on a long-lived monorepo, well past execFile's default buffer, failing on exactly the big workspaces this tool exists for. */
-const GIT_MAX_BUFFER_BYTES = 104857600;
 /** Separates one commit's record in `git log --format` output. Chosen from the C0 control range so it can never appear in a hash or a file path. */
 const COMMIT_RECORD_SEPARATOR = "";
 /** The identity semantic-release's own core writes release commits under in CI when nothing else is configured (its COMMIT_NAME/COMMIT_EMAIL constants); dependency-bump commits use the same fallback so every commit a release run produces has a consistent author when the repository declares none. */
@@ -92,18 +111,22 @@ const GIT_REPOSITORY_DISCOVERY_ENV_KEYS = [
 */
 function sanitizeGitEnv(env) {
 	const sanitized = { ...env };
-	for (const key of GIT_REPOSITORY_DISCOVERY_ENV_KEYS) delete sanitized[key];
+	for (const key of GIT_REPOSITORY_DISCOVERY_ENV_KEYS) Reflect.deleteProperty(sanitized, key);
 	return sanitized;
 }
 const SANITIZED_PROCESS_GIT_ENV = sanitizeGitEnv(process.env);
+/** `git log --name-only` over everything since a package's last release tag can legitimately produce tens of megabytes of path output on a long-lived monorepo, well past execFile's default buffer, failing on exactly the big workspaces this tool exists for -- hence the generous 100 MiB default, rather than execFile's own. */
+async function execGit(args, cwd, maxBuffer = 104857600) {
+	const { stdout } = await execFile$1("git", args, {
+		cwd,
+		maxBuffer,
+		env: SANITIZED_PROCESS_GIT_ENV
+	});
+	return stdout;
+}
 async function git(args, options) {
 	try {
-		const { stdout } = await execFileAsync$1("git", [...args], {
-			cwd: options.cwd,
-			maxBuffer: GIT_MAX_BUFFER_BYTES,
-			env: SANITIZED_PROCESS_GIT_ENV
-		});
-		return stdout;
+		return await execGit(args, options.cwd);
 	} catch (cause) {
 		throw toGitCommandError(args, options.cwd, cause);
 	}
@@ -217,9 +240,11 @@ async function workingTreeChanges(options) {
 	const paths = [];
 	for (let index = 0; index < tokens.length; index += 1) {
 		const entry = tokens[index];
-		if (entry === void 0 || entry.length < 4) continue;
+		if (entry === void 0) continue;
 		const statusCode = entry.slice(0, 2);
-		paths.push(entry.slice(3));
+		const path = entry.slice(3);
+		if (path === "") continue;
+		paths.push(path);
 		if (statusCode.includes("R") || statusCode.includes("C")) index += 1;
 	}
 	return paths;
@@ -283,6 +308,12 @@ const DEPENDENCY_FIELDS = [
 	"peerDependencies",
 	"optionalDependencies"
 ];
+/** The fields whose entries a consumer's package manager resolves when it installs the published package. `devDependencies` is absent: it is published, but nothing ever installs it for a consumer. */
+const INSTALLED_DEPENDENCY_FIELDS = [
+	"dependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
 async function readManifest(path) {
 	const text = await readFile(path, "utf8");
 	const parsed = JSON.parse(text);
@@ -290,7 +321,7 @@ async function readManifest(path) {
 	const { name, version } = parsed;
 	if (typeof name !== "string" || name.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "name". Every workspace package needs a name: releases are ordered, tagged, and matched to dependents by it.`);
 	const validity = validateNpmPackageName(name);
-	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${(validity.errors ?? []).join("; ")}`);
+	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${validity.errors.join("; ")}`);
 	if (typeof version !== "string" || version.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "version".`);
 	const dependencies = /* @__PURE__ */ new Map();
 	for (const field of DEPENDENCY_FIELDS) {
@@ -302,6 +333,7 @@ async function readManifest(path) {
 	return {
 		name,
 		version,
+		private: parsed.private === true,
 		dependencies
 	};
 }
@@ -324,7 +356,14 @@ async function writeDependencyRange(path, field, dependency, range) {
 const WORKSPACE_PROTOCOL = "workspace:";
 const CATALOG_PROTOCOL = "catalog:";
 const NPM_ALIAS_PROTOCOL = "npm:";
-/** The `workspace:` suffixes pnpm resolves against the sibling's version at pack time rather than against anything written in the manifest. */
+/** Specifier protocols that only a workspace-aware package manager resolves locally. `npm publish` copies them into the registry as written, so a published package declaring one in an installed dependency field cannot be installed. */
+const UNPUBLISHABLE_SPECIFIER_PROTOCOLS = [
+	WORKSPACE_PROTOCOL,
+	CATALOG_PROTOCOL,
+	"link:",
+	"file:"
+];
+/** The `workspace:` suffixes that name no version, and so leave nothing in the manifest to rewrite. */
 const PUBLISH_RESOLVED_WORKSPACE_SUFFIXES = [
 	"*",
 	"^",
@@ -339,6 +378,13 @@ const WILDCARD_RANGES = [
 	"latest"
 ];
 /**
+* The protocol of a specifier that `npm publish` would ship verbatim while no consumer's package manager can resolve it (`workspace:`, `catalog:`, `link:`, `file:`), or `undefined` for a specifier a consumer can install.
+*/
+function unpublishableSpecifierProtocol(specifier) {
+	const trimmed = specifier.trim();
+	return UNPUBLISHABLE_SPECIFIER_PROTOCOLS.find((protocol) => trimmed.startsWith(protocol));
+}
+/**
 * A single comparator whose version can be replaced in place without changing the comparator's intent. `<` and `<=` are deliberately absent: rewriting `<2.0.0` to `<1.4.0` narrows an upper bound to the very version being released, which is never what the author meant, so such a range is rejected rather than mangled.
 */
 const REWRITABLE_COMPARATOR = /^(\^|~|>=|=)?(\d+\.\d+\.\d+(?:-[\dA-Za-z.-]+)?(?:\+[\dA-Za-z.-]+)?)$/;
@@ -360,7 +406,7 @@ function classifyDependencyRange(current) {
 			comparator: inner.comparator
 		};
 	}
-	if (range.startsWith(CATALOG_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": the version of a "catalog:" dependency lives in pnpm-workspace.yaml, not in the package manifest, so bumping it here would leave the catalog entry stale. Depend on the sibling directly (for example "workspace:^") instead.`);
+	if (range.startsWith(CATALOG_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": the version of a "catalog:" dependency lives in pnpm-workspace.yaml, not in the package manifest, so bumping it here would leave the catalog entry stale. Declare the sibling's version range directly (for example "^1.0.0") instead.`);
 	if (range.startsWith(NPM_ALIAS_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": an "npm:" alias points at a differently-named package, so the version released in this workspace is not necessarily the version this range refers to.`);
 	if (WILDCARD_RANGES.includes(range)) return { kind: "wildcard" };
 	const match = REWRITABLE_COMPARATOR.exec(range);
@@ -384,6 +430,27 @@ function updateDependencyRange(current, version) {
 	};
 }
 //#endregion
+//#region src/publishable-dependencies.ts
+/**
+* Throws `UnsupportedDependencyRangeError` unless every publishable package's installed dependencies (`dependencies`, `peerDependencies`, `optionalDependencies`) are ranges a consumer's package manager can resolve.
+*
+* Publishing goes through `@semantic-release/npm`, that is plain `npm publish`, which copies the manifest's specifiers into the registry unchanged. A `workspace:`, `catalog:`, `link:`, or `file:` specifier therefore reaches consumers as written and makes the package uninstallable, whichever sibling or external package it names and whether or not the tool would have rewritten it. `pnpm publish` would substitute some of them at pack time, but this tool never packs with pnpm, so accepting them would mean publishing a broken package with no warning.
+*
+* A `private` package never publishes and is exempt, and so is `devDependencies`, which no consumer installs. Every offending entry across every package is reported in one error, so a workspace with several of them is fixed in one pass rather than one failed run per entry.
+*/
+function assertPublishableDependencies(packages) {
+	const offences = [];
+	for (const pkg of packages) {
+		if (pkg.private) continue;
+		for (const field of INSTALLED_DEPENDENCY_FIELDS) {
+			const declared = pkg.dependencies.get(field);
+			if (declared === void 0) continue;
+			for (const [dependency, specifier] of declared) if (unpublishableSpecifierProtocol(specifier) !== void 0) offences.push(`  ${pkg.name}: "${dependency}" in ${field} is declared as "${specifier}"`);
+		}
+	}
+	if (offences.length > 0) throw new UnsupportedDependencyRangeError(`Refusing to release: npm publish ships these dependency specifiers unchanged, so the published package could not be installed.\n${offences.join("\n")}\nDeclare a plain version range instead (for example "^1.2.3"). For a sibling in this workspace, keep "linkWorkspacePackages: true" in pnpm-workspace.yaml so pnpm still links it locally; this tool rewrites the range whenever the sibling releases. Packages marked "private" are never published and are exempt.`);
+}
+//#endregion
 //#region src/workspace.ts
 /** The one filename pnpm recognises as a workspace definition. */
 const WORKSPACE_MANIFEST = "pnpm-workspace.yaml";
@@ -420,6 +487,7 @@ async function discoverWorkspace(root) {
 		packages.push({
 			name: manifest.name,
 			version: manifest.version,
+			private: manifest.private,
 			directory,
 			relativeDirectory,
 			repoRelativeDirectory,
@@ -539,11 +607,15 @@ function firstUnplacedDependency(name, graph, unplaced) {
 	return (graph.dependencies.get(name) ?? []).map((edge) => edge.dependency).filter((dependency) => unplaced.has(dependency)).sort()[0];
 }
 /**
-* Checks every workspace dependency edge's range shape before anything releases, so an `UnsupportedDependencyRangeError` stops a run before the first publish rather than after some sibling has already been published, tagged, committed, and pushed. The shape a range supports depends only on the range text itself (see `classifyDependencyRange`), never on which version a sibling ends up releasing, so this can run once up front for the whole graph instead of only being discovered edge by edge as each dependency happens to release.
+* Validates every dependency range in the workspace before anything releases, so a run stops before the first publish rather than after some sibling has already been published, tagged, committed, and pushed. Two independent checks, both static properties of the manifests:
+*
+* - Every publishable package's installed dependencies must be specifiers a consumer can install (see `assertPublishableDependencies`), whichever package they name.
+* - Every workspace dependency edge's range must have a shape this tool can maintain (see `classifyDependencyRange`, which depends only on the range text and never on which version a sibling ends up releasing).
 *
-* Shared by both commit strategies (`release.ts`'s per-package loop and `single-commit-release.ts`'s analysis phase), which is why it lives alongside the graph it validates rather than inside either strategy's own module.
+* Both throw `UnsupportedDependencyRangeError`. Shared by every release path (`release.ts`'s per-package loop, `single-commit-release.ts`'s analysis phase, and `gate-publish.ts`'s detach), which is why it lives alongside the graph it validates rather than inside any one of them.
 */
-function validateDependencyRangeShapes(graph) {
+function validateDependencyRanges(graph) {
+	assertPublishableDependencies([...graph.packages.values()]);
 	for (const edges of graph.dependencies.values()) for (const edge of edges) classifyDependencyRange(edge.range);
 }
 /**
@@ -596,6 +668,10 @@ function matchTrailerLine(message, key) {
 }
 //#endregion
 //#region src/plugins.ts
+/** semantic-release's own `getLastRelease` returns `{}` for a package with no prior tag -- not `undefined`, and not a fully-populated `LastRelease` -- contradicting the `gitHead: string` its own type declares. Narrows structurally rather than trusting that declared type, so a first-release context's `lastRelease` (correctly, at runtime) never claims a `gitHead` it does not have. */
+function hasGitHead(lastRelease) {
+	return typeof lastRelease === "object" && lastRelease !== null && "gitHead" in lastRelease && typeof lastRelease.gitHead === "string";
+}
 /** The standard publish pipeline this orchestrator coordinates when a workspace configures none of its own. Every entry reuses the corresponding official plugin -- the orchestrator scopes and sequences them per package, it does not reimplement npm publishing, GitHub release creation, or changelog writing. */
 const DEFAULT_PUBLISH_PLUGINS = [
 	"@semantic-release/changelog",
@@ -606,7 +682,7 @@ const DEFAULT_PUBLISH_PLUGINS = [
 		message: "chore(release): ${nextRelease.gitTag} [skip ci]"
 	}]
 ];
-/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus @semantic-release/git, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
+/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus `@semantic-release/git`, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
 const SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS = [
 	"@semantic-release/changelog",
 	"@semantic-release/npm",
@@ -616,14 +692,14 @@ const STEP_PLUGINS_THE_ORCHESTRATOR_OWNS = /* @__PURE__ */ new Set(["@semantic-r
 /**
 * Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
 *
-* Both apply the same path scoping before delegating to the real @semantic-release/commit-analyzer and @semantic-release/release-notes-generator: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
+* Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
 *
 * The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
 */
 function createScopedPlugins(scope) {
 	let cached;
 	async function commitsForPackage(context) {
-		const from = context.lastRelease?.gitHead ?? void 0;
+		const from = hasGitHead(context.lastRelease) ? context.lastRelease.gitHead : void 0;
 		if (cached === void 0) cached = {
 			from,
 			paths: changedPathsSince(from, { cwd: context.cwd })
@@ -643,10 +719,10 @@ function createScopedPlugins(scope) {
 				...context,
 				commits
 			});
-			if (type) return type;
+			if (typeof type === "string") return type;
 			const bumps = mergeDependencyBumps(scope.bumps.bumpsFor(scope.pkg.name), commits);
 			if (bumps.length === 0) return false;
-			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${bumps.length} workspace dependency ranges changed`}; forcing a patch release.`);
+			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${String(bumps.length)} workspace dependency ranges changed`}; forcing a patch release.`);
 			return "patch";
 		},
 		async generateNotes(_pluginConfig, context) {
@@ -662,7 +738,7 @@ function createScopedPlugins(scope) {
 				"",
 				...bumps.map((bump) => describeDependencyBump(bump))
 			].join("\n");
-			return notes ? `${notes}\n\n${section}` : section;
+			return typeof notes === "string" ? `${notes}\n\n${section}` : section;
 		}
 	};
 }
@@ -734,7 +810,6 @@ function parsePublishPluginSpec(spec) {
 }
 //#endregion
 //#region src/pnpm.ts
-const execFileAsync = promisify(execFile);
 /**
 * Regenerates `pnpm-lock.yaml` for the whole workspace from the manifests currently on disk, without touching `node_modules` or installing anything -- the same lockfile-refresh step a contributor runs by hand after editing a `package.json` dependency range.
 *
@@ -742,7 +817,7 @@ const execFileAsync = promisify(execFile);
 */
 async function regenerateLockfile(options) {
 	try {
-		await execFileAsync("pnpm", ["install", "--lockfile-only"], { cwd: options.cwd });
+		await execFile$1("pnpm", ["install", "--lockfile-only"], { cwd: options.cwd });
 	} catch (cause) {
 		const stderr = cause instanceof Error && "stderr" in cause && typeof cause.stderr === "string" ? cause.stderr.trim() : "";
 		const detail = stderr !== "" ? stderr : cause instanceof Error ? cause.message : String(cause);
@@ -757,8 +832,8 @@ async function regenerateLockfile(options) {
 * Five phases, all inside one `releaseWorkspaceSingleCommit` call:
 *
 * 1. **Analyse** (this file's `analysePackage`): for every package, in topological order, run semantic-release with `dryRun: true` forced (regardless of the caller's own `dryRun` option) using the same path-scoped `analyzeCommits`/`generateNotes` wrapper `commitStrategy: 'per-package'` uses -- computing each package's next version and notes without writing, committing, tagging, or publishing anything. Cross-package dependency bumps are tracked purely in memory during this phase (`pendingBumps`), exactly as the per-package strategy tracks them for the span of one run; nothing is committed yet for a later run to recover from, because this strategy never leaves a partial commit for a crash to recover from in the first place -- either the whole combined commit lands, or nothing does.
-* 2. **Verify** every released package's configured publish plugins' `verifyConditions` step (npm registry auth, GitHub token/repo access), before any file is written -- the same fail-fast-before-anything-releases discipline `validateDependencyRangeShapes` already applies to dependency ranges.
-* 3. **Prepare**: for every released package, in topological order, apply any dependency-range bump its own manifest received (writing `package.json` directly, the same `writeDependencyRange` the per-package strategy uses), then run every configured publish plugin's own `prepare` step generically (whichever it defines -- @semantic-release/npm bumps `package.json`'s version, @semantic-release/changelog writes `CHANGELOG.md`). @semantic-release/git is rejected outright from this mode's plugin list (see `resolvePublishPlugins`'s `forbidGitPlugin`), since its own `prepare` step would create exactly the per-package commit this mode exists to avoid. The lockfile is regenerated once at the end, not once per bump, since `pnpm install --lockfile-only` recomputes it from whatever is on disk regardless of how many manifests changed.
+* 2. **Verify** every released package's configured publish plugins' `verifyConditions` step (npm registry auth, GitHub token/repo access), before any file is written -- the same fail-fast-before-anything-releases discipline `validateDependencyRanges` already applies to dependency ranges.
+* 3. **Prepare**: for every released package, in topological order, apply any dependency-range bump its own manifest received (writing `package.json` directly, the same `writeDependencyRange` the per-package strategy uses), then run every configured publish plugin's own `prepare` step generically (whichever it defines -- `@semantic-release/npm` bumps `package.json`'s version, `@semantic-release/changelog` writes `CHANGELOG.md`). `@semantic-release/git` is rejected outright from this mode's plugin list (see `resolvePublishPlugins`'s `forbidGitPlugin`), since its own `prepare` step would create exactly the per-package commit this mode exists to avoid. The lockfile is regenerated once at the end, not once per bump, since `pnpm install --lockfile-only` recomputes it from whatever is on disk regardless of how many manifests changed.
 * 4. **Commit**: discover every file phase 3 touched via `git status` (rather than predicting filenames per plugin), make one commit, tag it once per released package (`name@version`, lightweight, matching semantic-release's own tag form), and push the commit and every tag together.
 * 5. **Publish**: for every released package, in topological order, call each configured plugin's own `publish` step directly (not through semantic-release's top-level orchestrator -- see the note below), then `success`.
 *
@@ -773,9 +848,9 @@ async function releaseWorkspaceSingleCommit(options) {
 	const repoRoot = (await git(["rev-parse", "--show-toplevel"], { cwd: workspace.root })).trim();
 	await assertCleanWorkingTree({ cwd: repoRoot });
 	const graph = buildDependencyGraph(workspace.packages);
-	validateDependencyRangeShapes(graph);
+	validateDependencyRanges(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order: ${order.join(" -> ")} (commitStrategy: single)`);
+	log(`${packageName}: ${String(order.length)} packages in release order: ${order.join(" -> ")} (commitStrategy: single)`);
 	const resolvedPlugins = resolvePublishPlugins(options.plugins ?? SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, workspace.root, {
 		requireGitPlugin: false,
 		forbidGitPlugin: true
@@ -801,19 +876,26 @@ async function releaseWorkspaceSingleCommit(options) {
 			bumpsForThisPackage,
 			env,
 			branches: options.branches,
-			onCommitsResolved: (commits) => capturedCommits.set(name, commits),
+			onCommitsResolved: (commits) => {
+				capturedCommits.set(name, commits);
+			},
 			onContextCaptured: (context) => {
 				captured.branch = context.branch;
 				captured.repositoryUrl = context.repositoryUrl;
 			}
 		});
-		outcomes.push({
+		outcomes.push(nextRelease === void 0 ? {
+			name,
+			directory: pkg.directory,
+			released: false,
+			dependencyBumps: bumpsForThisPackage
+		} : {
 			name,
 			directory: pkg.directory,
-			released: nextRelease !== void 0,
-			version: nextRelease?.version,
-			gitTag: nextRelease?.gitTag,
-			type: nextRelease?.type,
+			released: true,
+			version: nextRelease.version,
+			gitTag: nextRelease.gitTag,
+			type: nextRelease.type,
 			dependencyBumps: bumpsForThisPackage
 		});
 		if (nextRelease === void 0) {
@@ -841,7 +923,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	};
 	const branch = captured.branch;
 	const repositoryUrl = captured.repositoryUrl;
-	if (branch === void 0 || repositoryUrl === void 0) throw new ReleaseConfigurationError(`Internal error: ${packageName} analysed ${planned.length} package release(s) but never captured a branch/repositoryUrl from semantic-release's own context. This should be impossible when at least one package releases.`);
+	if (branch === void 0 || repositoryUrl === void 0) throw new ReleaseConfigurationError(`Internal error: ${packageName} analysed ${String(planned.length)} package release(s) but never captured a branch/repositoryUrl from semantic-release's own context. This should be impossible when at least one package releases.`);
 	const shared = {
 		env,
 		branch,
@@ -867,7 +949,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	}
 	if (anyRangeRewritten) await regenerateLockfile({ cwd: workspace.root });
 	const touchedPaths = await workingTreeChanges({ cwd: repoRoot });
-	if (touchedPaths.length === 0) throw new ReleaseConfigurationError(`${packageName}: analysis planned ${planned.length} release(s), but no files changed while preparing them. Every configured publish plugin's own "prepare" step (bumping package.json, writing CHANGELOG.md) produced nothing to commit -- check the plugin list includes something that writes the version, e.g. @semantic-release/npm.`);
+	if (touchedPaths.length === 0) throw new ReleaseConfigurationError(`${packageName}: analysis planned ${String(planned.length)} release(s), but no files changed while preparing them. Every configured publish plugin's own "prepare" step (bumping package.json, writing CHANGELOG.md) produced nothing to commit -- check the plugin list includes something that writes the version, e.g. @semantic-release/npm.`);
 	const identity = await resolveCommitIdentity({ cwd: repoRoot });
 	await commitFiles(touchedPaths, describeCombinedCommit(planned), {
 		cwd: repoRoot,
@@ -877,7 +959,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	const tagNames = planned.map((release) => release.gitTag);
 	for (const tagName of tagNames) await createTag(tagName, commitSha, { cwd: repoRoot });
 	await pushHeadAndTags(tagNames, { cwd: repoRoot });
-	log(`${packageName}: committed ${commitSha} and pushed ${tagNames.length} tag(s): ${tagNames.join(", ")}`);
+	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
 	for (const release of planned) {
 		const releases = [];
 		for (const [modulePath, pluginConfig] of resolvedPlugins) {
@@ -969,10 +1051,18 @@ function describeCombinedCommit(planned) {
 }
 function buildPluginContext(release, shared, capturedCommits, releases) {
 	const logger = {
-		log: (...args) => shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`),
-		warn: (...args) => shared.log(`[${release.pkg.name}] warn: ${args.map(String).join(" ")}`),
-		error: (...args) => shared.log(`[${release.pkg.name}] error: ${args.map(String).join(" ")}`),
-		success: (...args) => shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`)
+		log: (...args) => {
+			shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`);
+		},
+		warn: (...args) => {
+			shared.log(`[${release.pkg.name}] warn: ${args.map(String).join(" ")}`);
+		},
+		error: (...args) => {
+			shared.log(`[${release.pkg.name}] error: ${args.map(String).join(" ")}`);
+		},
+		success: (...args) => {
+			shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`);
+		}
 	};
 	return {
 		cwd: release.pkg.directory,
@@ -1037,9 +1127,9 @@ async function releaseWorkspace(options = {}) {
 	const env = sanitizeGitEnv(options.env ?? process.env);
 	const workspace = await discoverWorkspace(root);
 	const graph = buildDependencyGraph(workspace.packages);
-	validateDependencyRangeShapes(graph);
+	validateDependencyRanges(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order: ${order.join(" -> ")}`);
+	log(`${packageName}: ${String(order.length)} packages in release order: ${order.join(" -> ")}`);
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
@@ -1063,13 +1153,18 @@ async function releaseWorkspace(options = {}) {
 			};
 		})).map((entry) => {
 			const nextRelease = entry.result === false ? void 0 : entry.result.nextRelease;
-			return {
+			return nextRelease === void 0 ? {
 				name: entry.name,
 				directory: entry.directory,
-				released: nextRelease !== void 0,
-				version: nextRelease?.version,
-				gitTag: nextRelease?.gitTag,
-				type: nextRelease?.type,
+				released: false,
+				dependencyBumps: entry.dependencyBumps
+			} : {
+				name: entry.name,
+				directory: entry.directory,
+				released: true,
+				version: nextRelease.version,
+				gitTag: nextRelease.gitTag,
+				type: nextRelease.type,
 				dependencyBumps: entry.dependencyBumps
 			};
 		})
@@ -1195,9 +1290,9 @@ async function detachWorkspaceRelease(options) {
 	const env = sanitizeGitEnv(options.env ?? process.env);
 	const workspace = await discoverWorkspace(root);
 	const graph = buildDependencyGraph(workspace.packages);
-	validateDependencyRangeShapes(graph);
+	validateDependencyRanges(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
+	log(`${packageName}: ${String(order.length)} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
@@ -1219,15 +1314,20 @@ async function detachWorkspaceRelease(options) {
 	});
 	return {
 		order,
-		packages: entries.map((entry) => ({
+		packages: entries.map((entry) => entry.result === null ? {
+			name: entry.name,
+			directory: entry.directory,
+			released: false,
+			dependencyBumps: entry.dependencyBumps
+		} : {
 			name: entry.name,
 			directory: entry.directory,
-			released: entry.result !== null,
-			version: entry.result?.nextRelease.version,
-			gitTag: entry.result?.nextRelease.gitTag,
-			type: entry.result?.nextRelease.type,
+			released: true,
+			version: entry.result.nextRelease.version,
+			gitTag: entry.result.nextRelease.gitTag,
+			type: entry.result.nextRelease.type,
 			dependencyBumps: entry.dependencyBumps
-		})),
+		}),
 		detached: entries.map((entry) => ({
 			name: entry.name,
 			relativeDirectory: entry.relativeDirectory,
@@ -1279,6 +1379,7 @@ async function resumeWorkspaceRelease(options) {
 	const root = resolve(options.root ?? process.cwd());
 	const log = options.log ?? console.log;
 	const env = sanitizeGitEnv(options.env ?? process.env);
+	assertPublishableDependencies(await Promise.all(options.detached.filter((entry) => entry.state !== null).map(async (entry) => readManifest(resolve(root, entry.relativeDirectory, "package.json")))));
 	const order = [];
 	const packages = [];
 	for (const entry of options.detached) {
@@ -1289,9 +1390,6 @@ async function resumeWorkspaceRelease(options) {
 				name: entry.name,
 				directory: resolve(root, entry.relativeDirectory),
 				released: false,
-				version: void 0,
-				gitTag: void 0,
-				type: void 0,
 				dependencyBumps: entry.dependencyBumps
 			});
 			continue;
@@ -1307,7 +1405,7 @@ async function resumeWorkspaceRelease(options) {
 		} catch (cause) {
 			throw new WorkspaceReleaseError(`Resuming ${entry.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
 		}
-		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${releases.length} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
+		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${String(releases.length)} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
 		packages.push({
 			name: entry.name,
 			directory,
@@ -1396,7 +1494,7 @@ async function runRelease(flags) {
 	if (gatePublish) {
 		if (flags.gateStateFile === void 0) throw new WorkspaceReleaseError("gatePublish was true but no --gate-state-file was resolved -- this should be unreachable.");
 		await writeFile(flags.gateStateFile, JSON.stringify(outcome.detached ?? [], null, 2));
-		console.log(`${packageName}: wrote gate state for ${(outcome.detached ?? []).length} package(s) to ${flags.gateStateFile}`);
+		console.log(`${packageName}: wrote gate state for ${String((outcome.detached ?? []).length)} package(s) to ${flags.gateStateFile}`);
 	}
 }
 async function runResume(flags) {