@exadev/semantic-release-workspace 1.3.5 → 1.3.7

package/dist/index.cjs

@@ -26,7 +26,6 @@ let node_path = require("node:path");
 let tinyglobby = require("tinyglobby");
 let yaml = require("yaml");
 let node_child_process = require("node:child_process");
-let node_util = require("node:util");
 let validate_npm_package_name = require("validate-npm-package-name");
 validate_npm_package_name = __toESM(validate_npm_package_name, 1);
 let node_module = require("node:module");
@@ -62,7 +61,7 @@ var DependencyCycleError = class extends WorkspaceReleaseError {
 		this.cycle = cycle;
 	}
 };
-/** A dependency on a workspace sibling uses a range this tool cannot rewrite with confidence. Rewriting it wrongly, or leaving it silently stale, both produce a published manifest that disagrees with the repository, so the run stops instead. */
+/** A dependency range this tool cannot release correctly: either a range on a workspace sibling that it cannot rewrite with confidence (rewriting it wrongly, or leaving it silently stale, produces a published manifest that disagrees with the repository), or a `workspace:`, `catalog:`, `link:`, or `file:` specifier in a publishable package's published dependencies, which `npm publish` ships verbatim and no consumer can install. The run stops instead. */
 var UnsupportedDependencyRangeError = class extends WorkspaceReleaseError {};
 /** The semantic-release options handed to the orchestrator cannot be scoped to a single package -- typically a publish plugin list that would leave a release commit or a cross-package manifest bump uncommitted. */
 var ReleaseConfigurationError = class extends WorkspaceReleaseError {};
@@ -70,7 +69,7 @@ var ReleaseConfigurationError = class extends WorkspaceReleaseError {};
 var GitCommandError = class extends WorkspaceReleaseError {
 	exitCode;
 	constructor(args, cwd, exitCode, detail) {
-		super(`git ${args.join(" ")} failed in ${cwd}${exitCode === void 0 ? "" : ` (exit ${exitCode})`}: ${detail}`);
+		super(`git ${args.join(" ")} failed in ${cwd}${exitCode === void 0 ? "" : ` (exit ${String(exitCode)})`}: ${detail}`);
 		this.exitCode = exitCode;
 	}
 };
@@ -83,10 +82,30 @@ var PnpmCommandError = class extends WorkspaceReleaseError {
 	}
 };
 //#endregion
+//#region src/exec-file.ts
+/**
+* A hand-written promise wrapper around `child_process.execFile`, in place of `util.promisify(execFile)`: `execFile` synchronously returns a `ChildProcess` in addition to invoking its callback, which trips `@typescript-eslint/strict-void-return` when the whole function is handed to `promisify` (a value-returning function used where a void-returning one is contextually expected there) -- exactly the void-return contravariance leniency that rule exists to catch, even though `tsc` itself accepts the pattern. Calling `execFile` directly with our own callback, whose own return type really is `void`, sidesteps the mismatch instead of suppressing it.
+*/
+async function execFile(command, args, options) {
+	return new Promise((resolve, reject) => {
+		(0, node_child_process.execFile)(command, [...args], {
+			cwd: options.cwd,
+			env: options.env,
+			maxBuffer: options.maxBuffer
+		}, (error, stdout, stderr) => {
+			if (error) {
+				reject(error instanceof Error ? error : new Error(error.message));
+				return;
+			}
+			resolve({
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+//#endregion
 //#region src/git.ts
-const execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
-/** `git log --name-only` over everything since a package's last release tag can legitimately produce tens of megabytes of path output on a long-lived monorepo, well past execFile's default buffer, failing on exactly the big workspaces this tool exists for. */
-const GIT_MAX_BUFFER_BYTES = 104857600;
 /** Separates one commit's record in `git log --format` output. Chosen from the C0 control range so it can never appear in a hash or a file path. */
 const COMMIT_RECORD_SEPARATOR = "";
 /** The identity semantic-release's own core writes release commits under in CI when nothing else is configured (its COMMIT_NAME/COMMIT_EMAIL constants); dependency-bump commits use the same fallback so every commit a release run produces has a consistent author when the repository declares none. */
@@ -114,18 +133,22 @@ const GIT_REPOSITORY_DISCOVERY_ENV_KEYS = [
 */
 function sanitizeGitEnv(env) {
 	const sanitized = { ...env };
-	for (const key of GIT_REPOSITORY_DISCOVERY_ENV_KEYS) delete sanitized[key];
+	for (const key of GIT_REPOSITORY_DISCOVERY_ENV_KEYS) Reflect.deleteProperty(sanitized, key);
 	return sanitized;
 }
 const SANITIZED_PROCESS_GIT_ENV = sanitizeGitEnv(process.env);
+/** `git log --name-only` over everything since a package's last release tag can legitimately produce tens of megabytes of path output on a long-lived monorepo, well past execFile's default buffer, failing on exactly the big workspaces this tool exists for -- hence the generous 100 MiB default, rather than execFile's own. */
+async function execGit(args, cwd, maxBuffer = 104857600) {
+	const { stdout } = await execFile("git", args, {
+		cwd,
+		maxBuffer,
+		env: SANITIZED_PROCESS_GIT_ENV
+	});
+	return stdout;
+}
 async function git(args, options) {
 	try {
-		const { stdout } = await execFileAsync$1("git", [...args], {
-			cwd: options.cwd,
-			maxBuffer: GIT_MAX_BUFFER_BYTES,
-			env: SANITIZED_PROCESS_GIT_ENV
-		});
-		return stdout;
+		return await execGit(args, options.cwd);
 	} catch (cause) {
 		throw toGitCommandError(args, options.cwd, cause);
 	}
@@ -239,9 +262,11 @@ async function workingTreeChanges(options) {
 	const paths = [];
 	for (let index = 0; index < tokens.length; index += 1) {
 		const entry = tokens[index];
-		if (entry === void 0 || entry.length < 4) continue;
+		if (entry === void 0) continue;
 		const statusCode = entry.slice(0, 2);
-		paths.push(entry.slice(3));
+		const path = entry.slice(3);
+		if (path === "") continue;
+		paths.push(path);
 		if (statusCode.includes("R") || statusCode.includes("C")) index += 1;
 	}
 	return paths;
@@ -299,6 +324,12 @@ const DEPENDENCY_FIELDS = [
 	"peerDependencies",
 	"optionalDependencies"
 ];
+/** The fields whose entries a consumer's package manager resolves when it installs the published package. `devDependencies` is absent: it is published, but nothing ever installs it for a consumer. */
+const INSTALLED_DEPENDENCY_FIELDS = [
+	"dependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
 async function readManifest(path) {
 	const text = await (0, node_fs_promises.readFile)(path, "utf8");
 	const parsed = JSON.parse(text);
@@ -306,7 +337,7 @@ async function readManifest(path) {
 	const { name, version } = parsed;
 	if (typeof name !== "string" || name.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "name". Every workspace package needs a name: releases are ordered, tagged, and matched to dependents by it.`);
 	const validity = (0, validate_npm_package_name.default)(name);
-	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${(validity.errors ?? []).join("; ")}`);
+	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${validity.errors.join("; ")}`);
 	if (typeof version !== "string" || version.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "version".`);
 	const dependencies = /* @__PURE__ */ new Map();
 	for (const field of DEPENDENCY_FIELDS) {
@@ -318,6 +349,7 @@ async function readManifest(path) {
 	return {
 		name,
 		version,
+		private: parsed.private === true,
 		dependencies
 	};
 }
@@ -372,6 +404,7 @@ async function discoverWorkspace(root) {
 		packages.push({
 			name: manifest.name,
 			version: manifest.version,
+			private: manifest.private,
 			directory,
 			relativeDirectory,
 			repoRelativeDirectory,
@@ -420,7 +453,14 @@ function toPosix(path) {
 const WORKSPACE_PROTOCOL = "workspace:";
 const CATALOG_PROTOCOL = "catalog:";
 const NPM_ALIAS_PROTOCOL = "npm:";
-/** The `workspace:` suffixes pnpm resolves against the sibling's version at pack time rather than against anything written in the manifest. */
+/** Specifier protocols that only a workspace-aware package manager resolves locally. `npm publish` copies them into the registry as written, so a published package declaring one in an installed dependency field cannot be installed. */
+const UNPUBLISHABLE_SPECIFIER_PROTOCOLS = [
+	WORKSPACE_PROTOCOL,
+	CATALOG_PROTOCOL,
+	"link:",
+	"file:"
+];
+/** The `workspace:` suffixes that name no version, and so leave nothing in the manifest to rewrite. */
 const PUBLISH_RESOLVED_WORKSPACE_SUFFIXES = [
 	"*",
 	"^",
@@ -435,6 +475,13 @@ const WILDCARD_RANGES = [
 	"latest"
 ];
 /**
+* The protocol of a specifier that `npm publish` would ship verbatim while no consumer's package manager can resolve it (`workspace:`, `catalog:`, `link:`, `file:`), or `undefined` for a specifier a consumer can install.
+*/
+function unpublishableSpecifierProtocol(specifier) {
+	const trimmed = specifier.trim();
+	return UNPUBLISHABLE_SPECIFIER_PROTOCOLS.find((protocol) => trimmed.startsWith(protocol));
+}
+/**
 * A single comparator whose version can be replaced in place without changing the comparator's intent. `<` and `<=` are deliberately absent: rewriting `<2.0.0` to `<1.4.0` narrows an upper bound to the very version being released, which is never what the author meant, so such a range is rejected rather than mangled.
 */
 const REWRITABLE_COMPARATOR = /^(\^|~|>=|=)?(\d+\.\d+\.\d+(?:-[\dA-Za-z.-]+)?(?:\+[\dA-Za-z.-]+)?)$/;
@@ -456,7 +503,7 @@ function classifyDependencyRange(current) {
 			comparator: inner.comparator
 		};
 	}
-	if (range.startsWith(CATALOG_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": the version of a "catalog:" dependency lives in pnpm-workspace.yaml, not in the package manifest, so bumping it here would leave the catalog entry stale. Depend on the sibling directly (for example "workspace:^") instead.`);
+	if (range.startsWith(CATALOG_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": the version of a "catalog:" dependency lives in pnpm-workspace.yaml, not in the package manifest, so bumping it here would leave the catalog entry stale. Declare the sibling's version range directly (for example "^1.0.0") instead.`);
 	if (range.startsWith(NPM_ALIAS_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": an "npm:" alias points at a differently-named package, so the version released in this workspace is not necessarily the version this range refers to.`);
 	if (WILDCARD_RANGES.includes(range)) return { kind: "wildcard" };
 	const match = REWRITABLE_COMPARATOR.exec(range);
@@ -480,6 +527,27 @@ function updateDependencyRange(current, version) {
 	};
 }
 //#endregion
+//#region src/publishable-dependencies.ts
+/**
+* Throws `UnsupportedDependencyRangeError` unless every publishable package's installed dependencies (`dependencies`, `peerDependencies`, `optionalDependencies`) are ranges a consumer's package manager can resolve.
+*
+* Publishing goes through `@semantic-release/npm`, that is plain `npm publish`, which copies the manifest's specifiers into the registry unchanged. A `workspace:`, `catalog:`, `link:`, or `file:` specifier therefore reaches consumers as written and makes the package uninstallable, whichever sibling or external package it names and whether or not the tool would have rewritten it. `pnpm publish` would substitute some of them at pack time, but this tool never packs with pnpm, so accepting them would mean publishing a broken package with no warning.
+*
+* A `private` package never publishes and is exempt, and so is `devDependencies`, which no consumer installs. Every offending entry across every package is reported in one error, so a workspace with several of them is fixed in one pass rather than one failed run per entry.
+*/
+function assertPublishableDependencies(packages) {
+	const offences = [];
+	for (const pkg of packages) {
+		if (pkg.private) continue;
+		for (const field of INSTALLED_DEPENDENCY_FIELDS) {
+			const declared = pkg.dependencies.get(field);
+			if (declared === void 0) continue;
+			for (const [dependency, specifier] of declared) if (unpublishableSpecifierProtocol(specifier) !== void 0) offences.push(`  ${pkg.name}: "${dependency}" in ${field} is declared as "${specifier}"`);
+		}
+	}
+	if (offences.length > 0) throw new UnsupportedDependencyRangeError(`Refusing to release: npm publish ships these dependency specifiers unchanged, so the published package could not be installed.\n${offences.join("\n")}\nDeclare a plain version range instead (for example "^1.2.3"). For a sibling in this workspace, keep "linkWorkspacePackages: true" in pnpm-workspace.yaml so pnpm still links it locally; this tool rewrites the range whenever the sibling releases. Packages marked "private" are never published and are exempt.`);
+}
+//#endregion
 //#region src/graph.ts
 /**
 * Builds the inter-package dependency graph from the manifests alone.
@@ -555,11 +623,15 @@ function firstUnplacedDependency(name, graph, unplaced) {
 	return (graph.dependencies.get(name) ?? []).map((edge) => edge.dependency).filter((dependency) => unplaced.has(dependency)).sort()[0];
 }
 /**
-* Checks every workspace dependency edge's range shape before anything releases, so an `UnsupportedDependencyRangeError` stops a run before the first publish rather than after some sibling has already been published, tagged, committed, and pushed. The shape a range supports depends only on the range text itself (see `classifyDependencyRange`), never on which version a sibling ends up releasing, so this can run once up front for the whole graph instead of only being discovered edge by edge as each dependency happens to release.
+* Validates every dependency range in the workspace before anything releases, so a run stops before the first publish rather than after some sibling has already been published, tagged, committed, and pushed. Two independent checks, both static properties of the manifests:
+*
+* - Every publishable package's installed dependencies must be specifiers a consumer can install (see `assertPublishableDependencies`), whichever package they name.
+* - Every workspace dependency edge's range must have a shape this tool can maintain (see `classifyDependencyRange`, which depends only on the range text and never on which version a sibling ends up releasing).
 *
-* Shared by both commit strategies (`release.ts`'s per-package loop and `single-commit-release.ts`'s analysis phase), which is why it lives alongside the graph it validates rather than inside either strategy's own module.
+* Both throw `UnsupportedDependencyRangeError`. Shared by every release path (`release.ts`'s per-package loop, `single-commit-release.ts`'s analysis phase, and `gate-publish.ts`'s detach), which is why it lives alongside the graph it validates rather than inside any one of them.
 */
-function validateDependencyRangeShapes(graph) {
+function validateDependencyRanges(graph) {
+	assertPublishableDependencies([...graph.packages.values()]);
 	for (const edges of graph.dependencies.values()) for (const edge of edges) classifyDependencyRange(edge.range);
 }
 /**
@@ -609,6 +681,10 @@ function matchTrailerLine(message, key) {
 }
 //#endregion
 //#region src/plugins.ts
+/** semantic-release's own `getLastRelease` returns `{}` for a package with no prior tag -- not `undefined`, and not a fully-populated `LastRelease` -- contradicting the `gitHead: string` its own type declares. Narrows structurally rather than trusting that declared type, so a first-release context's `lastRelease` (correctly, at runtime) never claims a `gitHead` it does not have. */
+function hasGitHead(lastRelease) {
+	return typeof lastRelease === "object" && lastRelease !== null && "gitHead" in lastRelease && typeof lastRelease.gitHead === "string";
+}
 /** The standard publish pipeline this orchestrator coordinates when a workspace configures none of its own. Every entry reuses the corresponding official plugin -- the orchestrator scopes and sequences them per package, it does not reimplement npm publishing, GitHub release creation, or changelog writing. */
 const DEFAULT_PUBLISH_PLUGINS = [
 	"@semantic-release/changelog",
@@ -619,7 +695,7 @@ const DEFAULT_PUBLISH_PLUGINS = [
 		message: "chore(release): ${nextRelease.gitTag} [skip ci]"
 	}]
 ];
-/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus @semantic-release/git, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
+/** The standard publish pipeline for `commitStrategy: 'single'`: the same as `DEFAULT_PUBLISH_PLUGINS` minus `@semantic-release/git`, which that mode never runs -- see `resolvePublishPlugins`'s `forbidGitPlugin` option for why it is rejected outright rather than merely unused. Single-commit mode does its own committing (one combined commit for every released package), so a `prepare`-step git plugin here would create the very per-package commits that mode exists to avoid. */
 const SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS = [
 	"@semantic-release/changelog",
 	"@semantic-release/npm",
@@ -629,14 +705,14 @@ const STEP_PLUGINS_THE_ORCHESTRATOR_OWNS = /* @__PURE__ */ new Set(["@semantic-r
 /**
 * Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
 *
-* Both apply the same path scoping before delegating to the real @semantic-release/commit-analyzer and @semantic-release/release-notes-generator: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
+* Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
 *
 * The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
 */
 function createScopedPlugins(scope) {
 	let cached;
 	async function commitsForPackage(context) {
-		const from = context.lastRelease?.gitHead ?? void 0;
+		const from = hasGitHead(context.lastRelease) ? context.lastRelease.gitHead : void 0;
 		if (cached === void 0) cached = {
 			from,
 			paths: changedPathsSince(from, { cwd: context.cwd })
@@ -656,10 +732,10 @@ function createScopedPlugins(scope) {
 				...context,
 				commits
 			});
-			if (type) return type;
+			if (typeof type === "string") return type;
 			const bumps = mergeDependencyBumps(scope.bumps.bumpsFor(scope.pkg.name), commits);
 			if (bumps.length === 0) return false;
-			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${bumps.length} workspace dependency ranges changed`}; forcing a patch release.`);
+			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${String(bumps.length)} workspace dependency ranges changed`}; forcing a patch release.`);
 			return "patch";
 		},
 		async generateNotes(_pluginConfig, context) {
@@ -675,7 +751,7 @@ function createScopedPlugins(scope) {
 				"",
 				...bumps.map((bump) => describeDependencyBump(bump))
 			].join("\n");
-			return notes ? `${notes}\n\n${section}` : section;
+			return typeof notes === "string" ? `${notes}\n\n${section}` : section;
 		}
 	};
 }
@@ -747,7 +823,6 @@ function parsePublishPluginSpec(spec) {
 }
 //#endregion
 //#region src/pnpm.ts
-const execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Regenerates `pnpm-lock.yaml` for the whole workspace from the manifests currently on disk, without touching `node_modules` or installing anything -- the same lockfile-refresh step a contributor runs by hand after editing a `package.json` dependency range.
 *
@@ -755,7 +830,7 @@ const execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
 */
 async function regenerateLockfile(options) {
 	try {
-		await execFileAsync("pnpm", ["install", "--lockfile-only"], { cwd: options.cwd });
+		await execFile("pnpm", ["install", "--lockfile-only"], { cwd: options.cwd });
 	} catch (cause) {
 		const stderr = cause instanceof Error && "stderr" in cause && typeof cause.stderr === "string" ? cause.stderr.trim() : "";
 		const detail = stderr !== "" ? stderr : cause instanceof Error ? cause.message : String(cause);
@@ -770,8 +845,8 @@ async function regenerateLockfile(options) {
 * Five phases, all inside one `releaseWorkspaceSingleCommit` call:
 *
 * 1. **Analyse** (this file's `analysePackage`): for every package, in topological order, run semantic-release with `dryRun: true` forced (regardless of the caller's own `dryRun` option) using the same path-scoped `analyzeCommits`/`generateNotes` wrapper `commitStrategy: 'per-package'` uses -- computing each package's next version and notes without writing, committing, tagging, or publishing anything. Cross-package dependency bumps are tracked purely in memory during this phase (`pendingBumps`), exactly as the per-package strategy tracks them for the span of one run; nothing is committed yet for a later run to recover from, because this strategy never leaves a partial commit for a crash to recover from in the first place -- either the whole combined commit lands, or nothing does.
-* 2. **Verify** every released package's configured publish plugins' `verifyConditions` step (npm registry auth, GitHub token/repo access), before any file is written -- the same fail-fast-before-anything-releases discipline `validateDependencyRangeShapes` already applies to dependency ranges.
-* 3. **Prepare**: for every released package, in topological order, apply any dependency-range bump its own manifest received (writing `package.json` directly, the same `writeDependencyRange` the per-package strategy uses), then run every configured publish plugin's own `prepare` step generically (whichever it defines -- @semantic-release/npm bumps `package.json`'s version, @semantic-release/changelog writes `CHANGELOG.md`). @semantic-release/git is rejected outright from this mode's plugin list (see `resolvePublishPlugins`'s `forbidGitPlugin`), since its own `prepare` step would create exactly the per-package commit this mode exists to avoid. The lockfile is regenerated once at the end, not once per bump, since `pnpm install --lockfile-only` recomputes it from whatever is on disk regardless of how many manifests changed.
+* 2. **Verify** every released package's configured publish plugins' `verifyConditions` step (npm registry auth, GitHub token/repo access), before any file is written -- the same fail-fast-before-anything-releases discipline `validateDependencyRanges` already applies to dependency ranges.
+* 3. **Prepare**: for every released package, in topological order, apply any dependency-range bump its own manifest received (writing `package.json` directly, the same `writeDependencyRange` the per-package strategy uses), then run every configured publish plugin's own `prepare` step generically (whichever it defines -- `@semantic-release/npm` bumps `package.json`'s version, `@semantic-release/changelog` writes `CHANGELOG.md`). `@semantic-release/git` is rejected outright from this mode's plugin list (see `resolvePublishPlugins`'s `forbidGitPlugin`), since its own `prepare` step would create exactly the per-package commit this mode exists to avoid. The lockfile is regenerated once at the end, not once per bump, since `pnpm install --lockfile-only` recomputes it from whatever is on disk regardless of how many manifests changed.
 * 4. **Commit**: discover every file phase 3 touched via `git status` (rather than predicting filenames per plugin), make one commit, tag it once per released package (`name@version`, lightweight, matching semantic-release's own tag form), and push the commit and every tag together.
 * 5. **Publish**: for every released package, in topological order, call each configured plugin's own `publish` step directly (not through semantic-release's top-level orchestrator -- see the note below), then `success`.
 *
@@ -786,9 +861,9 @@ async function releaseWorkspaceSingleCommit(options) {
 	const repoRoot = (await git(["rev-parse", "--show-toplevel"], { cwd: workspace.root })).trim();
 	await assertCleanWorkingTree({ cwd: repoRoot });
 	const graph = buildDependencyGraph(workspace.packages);
-	validateDependencyRangeShapes(graph);
+	validateDependencyRanges(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order: ${order.join(" -> ")} (commitStrategy: single)`);
+	log(`${packageName}: ${String(order.length)} packages in release order: ${order.join(" -> ")} (commitStrategy: single)`);
 	const resolvedPlugins = resolvePublishPlugins(options.plugins ?? SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, workspace.root, {
 		requireGitPlugin: false,
 		forbidGitPlugin: true
@@ -814,19 +889,26 @@ async function releaseWorkspaceSingleCommit(options) {
 			bumpsForThisPackage,
 			env,
 			branches: options.branches,
-			onCommitsResolved: (commits) => capturedCommits.set(name, commits),
+			onCommitsResolved: (commits) => {
+				capturedCommits.set(name, commits);
+			},
 			onContextCaptured: (context) => {
 				captured.branch = context.branch;
 				captured.repositoryUrl = context.repositoryUrl;
 			}
 		});
-		outcomes.push({
+		outcomes.push(nextRelease === void 0 ? {
+			name,
+			directory: pkg.directory,
+			released: false,
+			dependencyBumps: bumpsForThisPackage
+		} : {
 			name,
 			directory: pkg.directory,
-			released: nextRelease !== void 0,
-			version: nextRelease?.version,
-			gitTag: nextRelease?.gitTag,
-			type: nextRelease?.type,
+			released: true,
+			version: nextRelease.version,
+			gitTag: nextRelease.gitTag,
+			type: nextRelease.type,
 			dependencyBumps: bumpsForThisPackage
 		});
 		if (nextRelease === void 0) {
@@ -854,7 +936,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	};
 	const branch = captured.branch;
 	const repositoryUrl = captured.repositoryUrl;
-	if (branch === void 0 || repositoryUrl === void 0) throw new ReleaseConfigurationError(`Internal error: ${packageName} analysed ${planned.length} package release(s) but never captured a branch/repositoryUrl from semantic-release's own context. This should be impossible when at least one package releases.`);
+	if (branch === void 0 || repositoryUrl === void 0) throw new ReleaseConfigurationError(`Internal error: ${packageName} analysed ${String(planned.length)} package release(s) but never captured a branch/repositoryUrl from semantic-release's own context. This should be impossible when at least one package releases.`);
 	const shared = {
 		env,
 		branch,
@@ -880,7 +962,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	}
 	if (anyRangeRewritten) await regenerateLockfile({ cwd: workspace.root });
 	const touchedPaths = await workingTreeChanges({ cwd: repoRoot });
-	if (touchedPaths.length === 0) throw new ReleaseConfigurationError(`${packageName}: analysis planned ${planned.length} release(s), but no files changed while preparing them. Every configured publish plugin's own "prepare" step (bumping package.json, writing CHANGELOG.md) produced nothing to commit -- check the plugin list includes something that writes the version, e.g. @semantic-release/npm.`);
+	if (touchedPaths.length === 0) throw new ReleaseConfigurationError(`${packageName}: analysis planned ${String(planned.length)} release(s), but no files changed while preparing them. Every configured publish plugin's own "prepare" step (bumping package.json, writing CHANGELOG.md) produced nothing to commit -- check the plugin list includes something that writes the version, e.g. @semantic-release/npm.`);
 	const identity = await resolveCommitIdentity({ cwd: repoRoot });
 	await commitFiles(touchedPaths, describeCombinedCommit(planned), {
 		cwd: repoRoot,
@@ -890,7 +972,7 @@ async function releaseWorkspaceSingleCommit(options) {
 	const tagNames = planned.map((release) => release.gitTag);
 	for (const tagName of tagNames) await createTag(tagName, commitSha, { cwd: repoRoot });
 	await pushHeadAndTags(tagNames, { cwd: repoRoot });
-	log(`${packageName}: committed ${commitSha} and pushed ${tagNames.length} tag(s): ${tagNames.join(", ")}`);
+	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
 	for (const release of planned) {
 		const releases = [];
 		for (const [modulePath, pluginConfig] of resolvedPlugins) {
@@ -982,10 +1064,18 @@ function describeCombinedCommit(planned) {
 }
 function buildPluginContext(release, shared, capturedCommits, releases) {
 	const logger = {
-		log: (...args) => shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`),
-		warn: (...args) => shared.log(`[${release.pkg.name}] warn: ${args.map(String).join(" ")}`),
-		error: (...args) => shared.log(`[${release.pkg.name}] error: ${args.map(String).join(" ")}`),
-		success: (...args) => shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`)
+		log: (...args) => {
+			shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`);
+		},
+		warn: (...args) => {
+			shared.log(`[${release.pkg.name}] warn: ${args.map(String).join(" ")}`);
+		},
+		error: (...args) => {
+			shared.log(`[${release.pkg.name}] error: ${args.map(String).join(" ")}`);
+		},
+		success: (...args) => {
+			shared.log(`[${release.pkg.name}] ${args.map(String).join(" ")}`);
+		}
 	};
 	return {
 		cwd: release.pkg.directory,
@@ -1043,9 +1133,9 @@ async function detachWorkspaceRelease(options) {
 	const env = sanitizeGitEnv(options.env ?? process.env);
 	const workspace = await discoverWorkspace(root);
 	const graph = buildDependencyGraph(workspace.packages);
-	validateDependencyRangeShapes(graph);
+	validateDependencyRanges(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
+	log(`${packageName}: ${String(order.length)} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
@@ -1067,15 +1157,20 @@ async function detachWorkspaceRelease(options) {
 	});
 	return {
 		order,
-		packages: entries.map((entry) => ({
+		packages: entries.map((entry) => entry.result === null ? {
 			name: entry.name,
 			directory: entry.directory,
-			released: entry.result !== null,
-			version: entry.result?.nextRelease.version,
-			gitTag: entry.result?.nextRelease.gitTag,
-			type: entry.result?.nextRelease.type,
+			released: false,
 			dependencyBumps: entry.dependencyBumps
-		})),
+		} : {
+			name: entry.name,
+			directory: entry.directory,
+			released: true,
+			version: entry.result.nextRelease.version,
+			gitTag: entry.result.nextRelease.gitTag,
+			type: entry.result.nextRelease.type,
+			dependencyBumps: entry.dependencyBumps
+		}),
 		detached: entries.map((entry) => ({
 			name: entry.name,
 			relativeDirectory: entry.relativeDirectory,
@@ -1115,6 +1210,7 @@ async function resumeWorkspaceRelease(options) {
 	const root = (0, node_path.resolve)(options.root ?? process.cwd());
 	const log = options.log ?? console.log;
 	const env = sanitizeGitEnv(options.env ?? process.env);
+	assertPublishableDependencies(await Promise.all(options.detached.filter((entry) => entry.state !== null).map(async (entry) => readManifest((0, node_path.resolve)(root, entry.relativeDirectory, "package.json")))));
 	const order = [];
 	const packages = [];
 	for (const entry of options.detached) {
@@ -1125,9 +1221,6 @@ async function resumeWorkspaceRelease(options) {
 				name: entry.name,
 				directory: (0, node_path.resolve)(root, entry.relativeDirectory),
 				released: false,
-				version: void 0,
-				gitTag: void 0,
-				type: void 0,
 				dependencyBumps: entry.dependencyBumps
 			});
 			continue;
@@ -1143,7 +1236,7 @@ async function resumeWorkspaceRelease(options) {
 		} catch (cause) {
 			throw new WorkspaceReleaseError(`Resuming ${entry.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
 		}
-		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${releases.length} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
+		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${String(releases.length)} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
 		packages.push({
 			name: entry.name,
 			directory,
@@ -1178,9 +1271,9 @@ async function releaseWorkspace(options = {}) {
 	const env = sanitizeGitEnv(options.env ?? process.env);
 	const workspace = await discoverWorkspace(root);
 	const graph = buildDependencyGraph(workspace.packages);
-	validateDependencyRangeShapes(graph);
+	validateDependencyRanges(graph);
 	const order = topologicalOrder(graph);
-	log(`${packageName}: ${order.length} packages in release order: ${order.join(" -> ")}`);
+	log(`${packageName}: ${String(order.length)} packages in release order: ${order.join(" -> ")}`);
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
@@ -1204,13 +1297,18 @@ async function releaseWorkspace(options = {}) {
 			};
 		})).map((entry) => {
 			const nextRelease = entry.result === false ? void 0 : entry.result.nextRelease;
-			return {
+			return nextRelease === void 0 ? {
 				name: entry.name,
 				directory: entry.directory,
-				released: nextRelease !== void 0,
-				version: nextRelease?.version,
-				gitTag: nextRelease?.gitTag,
-				type: nextRelease?.type,
+				released: false,
+				dependencyBumps: entry.dependencyBumps
+			} : {
+				name: entry.name,
+				directory: entry.directory,
+				released: true,
+				version: nextRelease.version,
+				gitTag: nextRelease.gitTag,
+				type: nextRelease.type,
 				dependencyBumps: entry.dependencyBumps
 			};
 		})