@exadev/semantic-release-workspace 3.1.28 → 3.2.0

package/dist/cli.js

@@ -5,16 +5,16 @@ import { cosmiconfig } from "cosmiconfig";
 import { Command, InvalidArgumentError } from "commander";
 import { dirname, relative, resolve, sep } from "node:path";
 import { detachRelease, resumeRelease } from "@exadev/release-gate";
-import { execFile } from "node:child_process";
 import validateNpmPackageName from "validate-npm-package-name";
 import { glob } from "tinyglobby";
 import { parse } from "yaml";
+import { execFile } from "node:child_process";
 import { analyzeCommits } from "@semantic-release/commit-analyzer";
 import { generateNotes } from "@semantic-release/release-notes-generator";
 import semanticRelease from "semantic-release";
 import { pathToFileURL } from "node:url";
 //#region package.json
-var version = "3.1.28";
+var version = "3.2.0";
 //#endregion
 //#region src/errors.ts
 /**
@@ -75,6 +75,187 @@ function formatTagForPackage(tagFormat, name) {
 	return tagFormat.replaceAll("${name}", name);
 }
 //#endregion
+//#region src/json.ts
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringRecord(value) {
+	return isJsonObject(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+/**
+* Narrows `unknown` to `unknown[]`. `Array.isArray` alone narrows to `any[]`, whose elements flow as `any` into any later destructuring; going through this guard keeps the elements `unknown` so they must still be narrowed by hand.
+*/
+function isUnknownArray(value) {
+	return Array.isArray(value);
+}
+/**
+* The indentation of the first indented line in a JSON document, so a rewritten manifest keeps the formatting the repository already uses instead of being reflowed to whatever `JSON.stringify` defaults to. A file with no indented line at all (`{}` on one line) has no evidence either way, in which case two spaces -- npm's own default when it writes a `package.json` -- is the closest thing to a neutral choice.
+*/
+const FIRST_INDENTED_LINE = /^[ \t]+(?=")/m;
+const NPM_DEFAULT_INDENT = "  ";
+function detectIndent(text) {
+	const match = FIRST_INDENTED_LINE.exec(text);
+	return match === null ? NPM_DEFAULT_INDENT : match[0];
+}
+/** Serialises a JSON document back to text with the indentation and trailing-newline convention of the text it was read from, so rewriting one dependency range produces a one-line diff rather than a whole-file reformat. */
+function stringifyJsonLike(value, originalText) {
+	const serialised = JSON.stringify(value, null, detectIndent(originalText));
+	return originalText.endsWith("\n") ? `${serialised}\n` : serialised;
+}
+//#endregion
+//#region src/manifest.ts
+const DEPENDENCY_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+/** The fields whose entries a consumer's package manager resolves when it installs the published package. `devDependencies` is absent: it is published, but nothing ever installs it for a consumer. */
+const INSTALLED_DEPENDENCY_FIELDS = [
+	"dependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+async function readManifest(path) {
+	const text = await readFile(path, "utf8");
+	const parsed = JSON.parse(text);
+	if (!isJsonObject(parsed)) throw new WorkspaceDiscoveryError(`${path} does not contain a JSON object.`);
+	const { name, version } = parsed;
+	if (typeof name !== "string" || name.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "name". Every workspace package needs a name: releases are ordered, tagged, and matched to dependents by it.`);
+	const validity = validateNpmPackageName(name);
+	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${validity.errors.join("; ")}`);
+	if (typeof version !== "string" || version.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "version".`);
+	const dependencies = /* @__PURE__ */ new Map();
+	for (const field of DEPENDENCY_FIELDS) {
+		const declared = parsed[field];
+		if (declared === void 0) continue;
+		if (!isStringRecord(declared)) throw new WorkspaceDiscoveryError(`${path} has a "${field}" field that is not an object of name-to-range strings.`);
+		dependencies.set(field, new Map(Object.entries(declared)));
+	}
+	return {
+		name,
+		version,
+		private: parsed.private === true,
+		dependencies
+	};
+}
+/**
+* Rewrites one dependency range in a manifest on disk.
+*
+* Deliberately re-reads the file rather than editing a copy held from discovery time: by the time a cross-package bump is applied, semantic-release's own `@semantic-release/npm` prepare step may already have rewritten `version` in this same file for an earlier package in the run. Writing back a manifest parsed before that would silently revert it.
+*/
+async function writeDependencyRange(path, field, dependency, range) {
+	const text = await readFile(path, "utf8");
+	const parsed = JSON.parse(text);
+	if (!isJsonObject(parsed)) throw new WorkspaceDiscoveryError(`${path} does not contain a JSON object.`);
+	const declared = parsed[field];
+	if (!isStringRecord(declared)) throw new WorkspaceDiscoveryError(`${path} no longer has a "${field}" object holding "${dependency}".`);
+	declared[dependency] = range;
+	await writeFile(path, stringifyJsonLike(parsed, text), "utf8");
+}
+//#endregion
+//#region src/version-range.ts
+const WORKSPACE_PROTOCOL = "workspace:";
+const CATALOG_PROTOCOL = "catalog:";
+const NPM_ALIAS_PROTOCOL = "npm:";
+/** Specifier protocols that only a workspace-aware package manager resolves locally. `npm publish` copies them into the registry as written, so a published package declaring one in an installed dependency field cannot be installed. */
+const UNPUBLISHABLE_SPECIFIER_PROTOCOLS = [
+	WORKSPACE_PROTOCOL,
+	CATALOG_PROTOCOL,
+	"link:",
+	"file:"
+];
+/** The `workspace:` suffixes that name no version, and so leave nothing in the manifest to rewrite. */
+const PUBLISH_RESOLVED_WORKSPACE_SUFFIXES = [
+	"*",
+	"^",
+	"~"
+];
+/** Ranges that pin nothing, so a sibling's new version cannot change what they mean. */
+const WILDCARD_RANGES = [
+	"",
+	"*",
+	"x",
+	"X",
+	"latest"
+];
+/**
+* The protocol of a specifier that `npm publish` would ship verbatim while no consumer's package manager can resolve it (`workspace:`, `catalog:`, `link:`, `file:`), or `undefined` for a specifier a consumer can install.
+*/
+function unpublishableSpecifierProtocol(specifier) {
+	const trimmed = specifier.trim();
+	return UNPUBLISHABLE_SPECIFIER_PROTOCOLS.find((protocol) => trimmed.startsWith(protocol));
+}
+/**
+* A single comparator whose version can be replaced in place without changing the comparator's intent. `<` and `<=` are deliberately absent: rewriting `<2.0.0` to `<1.4.0` narrows an upper bound to the very version being released, which is never what the author meant, so such a range is rejected rather than mangled.
+*/
+const REWRITABLE_COMPARATOR = /^(\^|~|>=|=)?(\d+\.\d+\.\d+(?:-[\dA-Za-z.-]+)?(?:\+[\dA-Za-z.-]+)?)$/;
+/**
+* Classifies a dependency range's shape, throwing `UnsupportedDependencyRangeError` for anything this tool cannot rewrite with confidence: a compound range (`>=1.0.0 <2.0.0`), a union (`1.x || 2.x`), a `catalog:` reference whose real version lives in `pnpm-workspace.yaml`, an `npm:` alias, a git or tarball URL. Guessing at those would either corrupt the range or silently leave it pointing at a version that no longer exists in the workspace, and a stale published range is exactly the divergence this tool exists to prevent.
+*
+* This never needs the version a sibling is releasing: every case above depends only on the shape of `current` itself, which is what lets `releaseWorkspace` validate every workspace dependency edge up front, before any package has published anything, rather than discovering an unsupported range only when the first dependency it names happens to release.
+*/
+function classifyDependencyRange(current) {
+	const range = current.trim();
+	if (range.startsWith(WORKSPACE_PROTOCOL)) {
+		const suffix = range.slice(10);
+		if (PUBLISH_RESOLVED_WORKSPACE_SUFFIXES.includes(suffix)) return { kind: "resolved-at-publish" };
+		const inner = classifyDependencyRange(suffix);
+		if (inner.kind !== "rewritable") throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": only "workspace:*", "workspace:^", "workspace:~", and "workspace:" followed by a single concrete version range are supported.`);
+		return {
+			kind: "rewritable",
+			workspacePrefixed: true,
+			comparator: inner.comparator
+		};
+	}
+	if (range.startsWith(CATALOG_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": the version of a "catalog:" dependency lives in pnpm-workspace.yaml, not in the package manifest, so bumping it here would leave the catalog entry stale. Declare the sibling's version range directly (for example "^1.0.0") instead.`);
+	if (range.startsWith(NPM_ALIAS_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": an "npm:" alias points at a differently-named package, so the version released in this workspace is not necessarily the version this range refers to.`);
+	if (WILDCARD_RANGES.includes(range)) return { kind: "wildcard" };
+	const match = REWRITABLE_COMPARATOR.exec(range);
+	if (match === null) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": only a single "^", "~", ">=", "=", or bare version comparator can be rewritten in place.`);
+	return {
+		kind: "rewritable",
+		workspacePrefixed: false,
+		comparator: match[1] ?? ""
+	};
+}
+/**
+* Computes what a dependency range on a workspace sibling becomes once that sibling releases `version`, by classifying the range's shape and then, for a rewritable shape, substituting `version` in place of the version it currently names.
+*/
+function updateDependencyRange(current, version) {
+	const shape = classifyDependencyRange(current);
+	if (shape.kind !== "rewritable") return shape;
+	const rewritten = `${shape.comparator}${version}`;
+	return {
+		kind: "rewritten",
+		range: shape.workspacePrefixed ? `${WORKSPACE_PROTOCOL}${rewritten}` : rewritten
+	};
+}
+//#endregion
+//#region src/publishable-dependencies.ts
+/**
+* Throws `UnsupportedDependencyRangeError` unless every publishable package's installed dependencies (`dependencies`, `peerDependencies`, `optionalDependencies`) are ranges a consumer's package manager can resolve.
+*
+* Publishing goes through `@semantic-release/npm`, that is plain `npm publish`, which copies the manifest's specifiers into the registry unchanged. A `workspace:`, `catalog:`, `link:`, or `file:` specifier therefore reaches consumers as written and makes the package uninstallable, whichever sibling or external package it names and whether or not the tool would have rewritten it. `pnpm publish` would substitute some of them at pack time, but this tool never packs with pnpm, so accepting them would mean publishing a broken package with no warning.
+*
+* A `private` package never publishes and is exempt, and so is `devDependencies`, which no consumer installs. Every offending entry across every package is reported in one error, so a workspace with several of them is fixed in one pass rather than one failed run per entry.
+*/
+function assertPublishableDependencies(packages) {
+	const offences = [];
+	for (const pkg of packages) {
+		if (pkg.private) continue;
+		for (const field of INSTALLED_DEPENDENCY_FIELDS) {
+			const declared = pkg.dependencies.get(field);
+			if (declared === void 0) continue;
+			for (const [dependency, specifier] of declared) if (unpublishableSpecifierProtocol(specifier) !== void 0) offences.push(`  ${pkg.name}: "${dependency}" in ${field} is declared as "${specifier}"`);
+		}
+	}
+	if (offences.length > 0) throw new UnsupportedDependencyRangeError(`Refusing to release: npm publish ships these dependency specifiers unchanged, so the published package could not be installed.\n${offences.join("\n")}\nDeclare a plain version range instead (for example "^1.2.3"). For a sibling in this workspace, keep "linkWorkspacePackages: true" in pnpm-workspace.yaml so pnpm still links it locally; this tool rewrites the range whenever the sibling releases. Packages marked "private" are never published and are exempt.`);
+}
+//#endregion
 //#region src/exec-file.ts
 /**
 * A hand-written promise wrapper around `child_process.execFile`, in place of `util.promisify(execFile)`: `execFile` synchronously returns a `ChildProcess` in addition to invoking its callback, which trips `@typescript-eslint/strict-void-return` when the whole function is handed to `promisify` (a value-returning function used where a void-returning one is contextually expected there) -- exactly the void-return contravariance leniency that rule exists to catch, even though `tsc` itself accepts the pattern. Calling `execFile` directly with our own callback, whose own return type really is `void`, sidesteps the mismatch instead of suppressing it.
@@ -340,187 +521,6 @@ function toGitCommandError(args, cwd, cause) {
 	return new GitCommandError(args, cwd, exitCode, stderr !== "" ? stderr : cause instanceof Error ? cause.message : String(cause));
 }
 //#endregion
-//#region src/json.ts
-function isJsonObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isStringRecord(value) {
-	return isJsonObject(value) && Object.values(value).every((entry) => typeof entry === "string");
-}
-function isStringArray(value) {
-	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
-}
-/**
-* Narrows `unknown` to `unknown[]`. `Array.isArray` alone narrows to `any[]`, whose elements flow as `any` into any later destructuring; going through this guard keeps the elements `unknown` so they must still be narrowed by hand.
-*/
-function isUnknownArray(value) {
-	return Array.isArray(value);
-}
-/**
-* The indentation of the first indented line in a JSON document, so a rewritten manifest keeps the formatting the repository already uses instead of being reflowed to whatever `JSON.stringify` defaults to. A file with no indented line at all (`{}` on one line) has no evidence either way, in which case two spaces -- npm's own default when it writes a `package.json` -- is the closest thing to a neutral choice.
-*/
-const FIRST_INDENTED_LINE = /^[ \t]+(?=")/m;
-const NPM_DEFAULT_INDENT = "  ";
-function detectIndent(text) {
-	const match = FIRST_INDENTED_LINE.exec(text);
-	return match === null ? NPM_DEFAULT_INDENT : match[0];
-}
-/** Serialises a JSON document back to text with the indentation and trailing-newline convention of the text it was read from, so rewriting one dependency range produces a one-line diff rather than a whole-file reformat. */
-function stringifyJsonLike(value, originalText) {
-	const serialised = JSON.stringify(value, null, detectIndent(originalText));
-	return originalText.endsWith("\n") ? `${serialised}\n` : serialised;
-}
-//#endregion
-//#region src/manifest.ts
-const DEPENDENCY_FIELDS = [
-	"dependencies",
-	"devDependencies",
-	"peerDependencies",
-	"optionalDependencies"
-];
-/** The fields whose entries a consumer's package manager resolves when it installs the published package. `devDependencies` is absent: it is published, but nothing ever installs it for a consumer. */
-const INSTALLED_DEPENDENCY_FIELDS = [
-	"dependencies",
-	"peerDependencies",
-	"optionalDependencies"
-];
-async function readManifest(path) {
-	const text = await readFile(path, "utf8");
-	const parsed = JSON.parse(text);
-	if (!isJsonObject(parsed)) throw new WorkspaceDiscoveryError(`${path} does not contain a JSON object.`);
-	const { name, version } = parsed;
-	if (typeof name !== "string" || name.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "name". Every workspace package needs a name: releases are ordered, tagged, and matched to dependents by it.`);
-	const validity = validateNpmPackageName(name);
-	if (!validity.validForOldPackages) throw new WorkspaceDiscoveryError(`${path} has an invalid "name" ("${name}"): ${validity.errors.join("; ")}`);
-	if (typeof version !== "string" || version.length === 0) throw new WorkspaceDiscoveryError(`${path} has no "version".`);
-	const dependencies = /* @__PURE__ */ new Map();
-	for (const field of DEPENDENCY_FIELDS) {
-		const declared = parsed[field];
-		if (declared === void 0) continue;
-		if (!isStringRecord(declared)) throw new WorkspaceDiscoveryError(`${path} has a "${field}" field that is not an object of name-to-range strings.`);
-		dependencies.set(field, new Map(Object.entries(declared)));
-	}
-	return {
-		name,
-		version,
-		private: parsed.private === true,
-		dependencies
-	};
-}
-/**
-* Rewrites one dependency range in a manifest on disk.
-*
-* Deliberately re-reads the file rather than editing a copy held from discovery time: by the time a cross-package bump is applied, semantic-release's own `@semantic-release/npm` prepare step may already have rewritten `version` in this same file for an earlier package in the run. Writing back a manifest parsed before that would silently revert it.
-*/
-async function writeDependencyRange(path, field, dependency, range) {
-	const text = await readFile(path, "utf8");
-	const parsed = JSON.parse(text);
-	if (!isJsonObject(parsed)) throw new WorkspaceDiscoveryError(`${path} does not contain a JSON object.`);
-	const declared = parsed[field];
-	if (!isStringRecord(declared)) throw new WorkspaceDiscoveryError(`${path} no longer has a "${field}" object holding "${dependency}".`);
-	declared[dependency] = range;
-	await writeFile(path, stringifyJsonLike(parsed, text), "utf8");
-}
-//#endregion
-//#region src/version-range.ts
-const WORKSPACE_PROTOCOL = "workspace:";
-const CATALOG_PROTOCOL = "catalog:";
-const NPM_ALIAS_PROTOCOL = "npm:";
-/** Specifier protocols that only a workspace-aware package manager resolves locally. `npm publish` copies them into the registry as written, so a published package declaring one in an installed dependency field cannot be installed. */
-const UNPUBLISHABLE_SPECIFIER_PROTOCOLS = [
-	WORKSPACE_PROTOCOL,
-	CATALOG_PROTOCOL,
-	"link:",
-	"file:"
-];
-/** The `workspace:` suffixes that name no version, and so leave nothing in the manifest to rewrite. */
-const PUBLISH_RESOLVED_WORKSPACE_SUFFIXES = [
-	"*",
-	"^",
-	"~"
-];
-/** Ranges that pin nothing, so a sibling's new version cannot change what they mean. */
-const WILDCARD_RANGES = [
-	"",
-	"*",
-	"x",
-	"X",
-	"latest"
-];
-/**
-* The protocol of a specifier that `npm publish` would ship verbatim while no consumer's package manager can resolve it (`workspace:`, `catalog:`, `link:`, `file:`), or `undefined` for a specifier a consumer can install.
-*/
-function unpublishableSpecifierProtocol(specifier) {
-	const trimmed = specifier.trim();
-	return UNPUBLISHABLE_SPECIFIER_PROTOCOLS.find((protocol) => trimmed.startsWith(protocol));
-}
-/**
-* A single comparator whose version can be replaced in place without changing the comparator's intent. `<` and `<=` are deliberately absent: rewriting `<2.0.0` to `<1.4.0` narrows an upper bound to the very version being released, which is never what the author meant, so such a range is rejected rather than mangled.
-*/
-const REWRITABLE_COMPARATOR = /^(\^|~|>=|=)?(\d+\.\d+\.\d+(?:-[\dA-Za-z.-]+)?(?:\+[\dA-Za-z.-]+)?)$/;
-/**
-* Classifies a dependency range's shape, throwing `UnsupportedDependencyRangeError` for anything this tool cannot rewrite with confidence: a compound range (`>=1.0.0 <2.0.0`), a union (`1.x || 2.x`), a `catalog:` reference whose real version lives in `pnpm-workspace.yaml`, an `npm:` alias, a git or tarball URL. Guessing at those would either corrupt the range or silently leave it pointing at a version that no longer exists in the workspace, and a stale published range is exactly the divergence this tool exists to prevent.
-*
-* This never needs the version a sibling is releasing: every case above depends only on the shape of `current` itself, which is what lets `releaseWorkspace` validate every workspace dependency edge up front, before any package has published anything, rather than discovering an unsupported range only when the first dependency it names happens to release.
-*/
-function classifyDependencyRange(current) {
-	const range = current.trim();
-	if (range.startsWith(WORKSPACE_PROTOCOL)) {
-		const suffix = range.slice(10);
-		if (PUBLISH_RESOLVED_WORKSPACE_SUFFIXES.includes(suffix)) return { kind: "resolved-at-publish" };
-		const inner = classifyDependencyRange(suffix);
-		if (inner.kind !== "rewritable") throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": only "workspace:*", "workspace:^", "workspace:~", and "workspace:" followed by a single concrete version range are supported.`);
-		return {
-			kind: "rewritable",
-			workspacePrefixed: true,
-			comparator: inner.comparator
-		};
-	}
-	if (range.startsWith(CATALOG_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": the version of a "catalog:" dependency lives in pnpm-workspace.yaml, not in the package manifest, so bumping it here would leave the catalog entry stale. Declare the sibling's version range directly (for example "^1.0.0") instead.`);
-	if (range.startsWith(NPM_ALIAS_PROTOCOL)) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": an "npm:" alias points at a differently-named package, so the version released in this workspace is not necessarily the version this range refers to.`);
-	if (WILDCARD_RANGES.includes(range)) return { kind: "wildcard" };
-	const match = REWRITABLE_COMPARATOR.exec(range);
-	if (match === null) throw new UnsupportedDependencyRangeError(`Cannot bump the workspace dependency range "${current}": only a single "^", "~", ">=", "=", or bare version comparator can be rewritten in place.`);
-	return {
-		kind: "rewritable",
-		workspacePrefixed: false,
-		comparator: match[1] ?? ""
-	};
-}
-/**
-* Computes what a dependency range on a workspace sibling becomes once that sibling releases `version`, by classifying the range's shape and then, for a rewritable shape, substituting `version` in place of the version it currently names.
-*/
-function updateDependencyRange(current, version) {
-	const shape = classifyDependencyRange(current);
-	if (shape.kind !== "rewritable") return shape;
-	const rewritten = `${shape.comparator}${version}`;
-	return {
-		kind: "rewritten",
-		range: shape.workspacePrefixed ? `${WORKSPACE_PROTOCOL}${rewritten}` : rewritten
-	};
-}
-//#endregion
-//#region src/publishable-dependencies.ts
-/**
-* Throws `UnsupportedDependencyRangeError` unless every publishable package's installed dependencies (`dependencies`, `peerDependencies`, `optionalDependencies`) are ranges a consumer's package manager can resolve.
-*
-* Publishing goes through `@semantic-release/npm`, that is plain `npm publish`, which copies the manifest's specifiers into the registry unchanged. A `workspace:`, `catalog:`, `link:`, or `file:` specifier therefore reaches consumers as written and makes the package uninstallable, whichever sibling or external package it names and whether or not the tool would have rewritten it. `pnpm publish` would substitute some of them at pack time, but this tool never packs with pnpm, so accepting them would mean publishing a broken package with no warning.
-*
-* A `private` package never publishes and is exempt, and so is `devDependencies`, which no consumer installs. Every offending entry across every package is reported in one error, so a workspace with several of them is fixed in one pass rather than one failed run per entry.
-*/
-function assertPublishableDependencies(packages) {
-	const offences = [];
-	for (const pkg of packages) {
-		if (pkg.private) continue;
-		for (const field of INSTALLED_DEPENDENCY_FIELDS) {
-			const declared = pkg.dependencies.get(field);
-			if (declared === void 0) continue;
-			for (const [dependency, specifier] of declared) if (unpublishableSpecifierProtocol(specifier) !== void 0) offences.push(`  ${pkg.name}: "${dependency}" in ${field} is declared as "${specifier}"`);
-		}
-	}
-	if (offences.length > 0) throw new UnsupportedDependencyRangeError(`Refusing to release: npm publish ships these dependency specifiers unchanged, so the published package could not be installed.\n${offences.join("\n")}\nDeclare a plain version range instead (for example "^1.2.3"). For a sibling in this workspace, keep "linkWorkspacePackages: true" in pnpm-workspace.yaml so pnpm still links it locally; this tool rewrites the range whenever the sibling releases. Packages marked "private" are never published and are exempt.`);
-}
-//#endregion
 //#region src/workspace.ts
 /** The one filename pnpm recognises as a workspace definition. */
 const WORKSPACE_MANIFEST = "pnpm-workspace.yaml";
@@ -701,9 +701,68 @@ function mustGet(map, key, what) {
 	return value;
 }
 //#endregion
+//#region src/bundling.ts
+/**
+* Validates `bundlingPackages` against the workspace and works out, for every package, which workspace dependencies it bundles.
+*
+* A package named in `bundlingPackages` declares that its build inlines every workspace sibling it lists in `devDependencies`, so consumers never install those siblings from the registry and their code reaches consumers only through this package. When such a sibling releases, this package's release type is at least the sibling's shipped release type (a `feat` in the sibling releases this package as a minor), instead of the patch an ordinary dependency bump forces. Edges in `dependencies`, `peerDependencies` and `optionalDependencies` are installed by consumers, so they keep the forced patch.
+*
+* A private package's own release type never changes: it keeps the patch a dependency bump forces, so its versions and tags are exactly what they would be without `bundlingPackages`. What it gains is a carried release type (see `BundledDependencies.carried`), which lets a bundling package that lists only the private package still see the release type of a private sibling the private package depends on.
+*
+* `bundlingPackages` names public workspace packages whose builds bundle their workspace `devDependencies`; `undefined` or an empty list leaves every package's release type as it was. Returns one entry per package in the graph. Throws `ReleaseConfigurationError` when a name is not a package in the workspace, or names a private package, which never publishes and so ships nothing to consumers.
+*/
+function resolveBundledDependencies(graph, bundlingPackages) {
+	const bundling = new Set(bundlingPackages);
+	const unknown = [...bundling].filter((name) => !graph.packages.has(name));
+	if (unknown.length > 0) throw new ReleaseConfigurationError(`bundlingPackages names ${unknown.map((name) => `"${name}"`).join(", ")}, which ${unknown.length === 1 ? "is" : "are"} not a package in this workspace. Packages: ${[...graph.packages.keys()].join(", ")}.`);
+	const privateNames = [...bundling].filter((name) => mustGet(graph.packages, name, "package").private);
+	if (privateNames.length > 0) throw new ReleaseConfigurationError(`bundlingPackages names ${privateNames.map((name) => `"${name}"`).join(", ")}, which ${privateNames.length === 1 ? "is" : "are"} private. A private package is never published, so nothing it bundles reaches a consumer through it; list the public package whose build inlines it instead.`);
+	const resolved = /* @__PURE__ */ new Map();
+	for (const [name, pkg] of graph.packages) {
+		const edges = mustGet(graph.dependencies, name, "dependency edges");
+		const releaseTypeFrom = new Set(edges.filter((edge) => bundling.has(name) && edge.field === "devDependencies").map((edge) => edge.dependency));
+		const carried = /* @__PURE__ */ new Set([...releaseTypeFrom, ...edges.filter((edge) => pkg.private && isPrivateRuntimeEdge(edge, graph)).map((edge) => edge.dependency)]);
+		resolved.set(name, {
+			releaseTypeFrom,
+			carried
+		});
+	}
+	return resolved;
+}
+function isPrivateRuntimeEdge(edge, graph) {
+	return edge.field !== "devDependencies" && mustGet(graph.packages, edge.dependency, "package").private;
+}
+//#endregion
 //#region src/package-name.ts
 const packageName = "@exadev/semantic-release-workspace";
 //#endregion
+//#region src/release-type.ts
+/** Every release type semantic-release knows, highest first: the order `@semantic-release/commit-analyzer` itself ranks them in (its `lib/default-release-types.js`), so comparing two types here agrees with how the analyzer picks the highest type among a package's own commits. */
+const RELEASE_TYPES_HIGHEST_FIRST = [
+	"major",
+	"premajor",
+	"minor",
+	"preminor",
+	"patch",
+	"prepatch",
+	"prerelease"
+];
+const KNOWN_RELEASE_TYPES = new Set(RELEASE_TYPES_HIGHEST_FIRST);
+/** Whether `value` is one of semantic-release's release types. */
+function isReleaseType(value) {
+	return typeof value === "string" && KNOWN_RELEASE_TYPES.has(value);
+}
+/** The highest of the given release types, ranked as `@semantic-release/commit-analyzer` ranks them, or `undefined` when `types` is empty. */
+function highestReleaseType(types) {
+	let highest;
+	for (const type of types) if (highest === void 0 || RELEASE_TYPES_HIGHEST_FIRST.indexOf(type) < RELEASE_TYPES_HIGHEST_FIRST.indexOf(highest)) highest = type;
+	return highest;
+}
+/** `base`, raised to `other` when `other` is the higher release type; an `undefined` `other` leaves `base` as it is. */
+function raiseReleaseType(base, other) {
+	return other === void 0 || RELEASE_TYPES_HIGHEST_FIRST.indexOf(base) <= RELEASE_TYPES_HIGHEST_FIRST.indexOf(other) ? base : other;
+}
+//#endregion
 //#region src/dependency-bump-commit.ts
 /**
 * The commit message format for a cross-package dependency-range bump, shared between the code that writes it (`bumpDependents` in `release.ts`) and the code that reads it back (`createScopedPlugins` in `plugins.ts`).
@@ -713,26 +772,30 @@ const packageName = "@exadev/semantic-release-workspace";
 const TRAILER_DEPENDENCY = "Bumped-Workspace-Dependency";
 const TRAILER_VERSION = "Bumped-Workspace-Dependency-Version";
 const TRAILER_RANGE = "Bumped-Workspace-Dependency-Range";
+const TRAILER_RELEASE_TYPE = "Bumped-Workspace-Dependency-Release-Type";
 /** Builds the full commit message (subject and trailer) for one dependency-range bump. */
 function formatDependencyBumpMessage(info) {
 	return `${`chore(deps): bump ${info.dependency} to ${info.range} in ${info.dependent} [skip ci]`}\n\n${[
 		`${TRAILER_DEPENDENCY}: ${info.dependency}`,
 		`${TRAILER_VERSION}: ${info.version}`,
-		`${TRAILER_RANGE}: ${info.range}`
+		`${TRAILER_RANGE}: ${info.range}`,
+		`${TRAILER_RELEASE_TYPE}: ${info.releaseType}`
 	].join("\n")}`;
 }
 /**
-* Recovers the dependency bump a `formatDependencyBumpMessage` commit recorded, from its full git message (subject and body), or `undefined` if the message carries no such trailer. All three lines must be present for the commit to be treated as a bump commit at all -- a message missing even one is left alone rather than partially trusted.
+* Recovers the dependency bump a `formatDependencyBumpMessage` commit recorded, from its full git message (subject and body), or `undefined` if the message carries no such trailer. The dependency, version and range lines must all be present for the commit to be treated as a bump commit at all -- a message missing even one is left alone rather than partially trusted. The release type line is optional, since bump commits written before it existed lack it; when it is absent or names no release type, `releaseType` is `undefined`.
 */
 function parseDependencyBumpTrailer(message) {
 	const dependency = matchTrailerLine(message, TRAILER_DEPENDENCY);
 	const version = matchTrailerLine(message, TRAILER_VERSION);
 	const range = matchTrailerLine(message, TRAILER_RANGE);
 	if (dependency === void 0 || version === void 0 || range === void 0) return;
+	const releaseType = matchTrailerLine(message, TRAILER_RELEASE_TYPE);
 	return {
 		dependency,
 		version,
-		range
+		range,
+		releaseType: isReleaseType(releaseType) ? releaseType : void 0
 	};
 }
 function matchTrailerLine(message, key) {
@@ -770,10 +833,11 @@ const STEP_PLUGINS_THE_ORCHESTRATOR_OWNS = /* @__PURE__ */ new Set(["@semantic-r
 *
 * Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
 *
-* The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
+* The `analyzeCommits` wrapper carries two additions beyond filtering. When the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway: a dependent whose only change is a dependency bump still needs a release for that range to reach the registry. And when a bumped dependency is one the package bundles (`scope.bundled.releaseTypeFrom`), the package's release type is raised to at least that dependency's shipped release type, whether or not the package has releasable commits of its own, because the dependency's change reaches consumers only inside this package. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
 */
 function createScopedPlugins(scope) {
 	let cached;
+	let carriedReleaseType;
 	async function commitsForPackage(context) {
 		const from = hasGitHead(context.lastRelease) ? context.lastRelease.gitHead : void 0;
 		if (cached === void 0) cached = {
@@ -791,13 +855,26 @@ function createScopedPlugins(scope) {
 	return {
 		async analyzeCommits(_pluginConfig, context) {
 			const commits = await commitsForPackage(context);
-			const type = await analyzeCommits(scope.analyzeCommitsConfig, {
+			const analysed = await analyzeCommits(scope.analyzeCommitsConfig, {
 				...context,
 				commits
 			});
-			if (typeof type === "string") return type;
+			if (typeof analysed === "string" && !isReleaseType(analysed)) throw new ReleaseConfigurationError(`@semantic-release/commit-analyzer returned "${analysed}" for ${scope.pkg.name}, which is not a semantic-release release type.`);
+			const own = typeof analysed === "string" ? analysed : void 0;
 			const bumps = mergeDependencyBumps(scope.bumps.bumpsFor(scope.pkg.name), commits);
+			carriedReleaseType = releaseTypeOfBumps(bumps.filter((bump) => scope.bundled?.carried.has(bump.dependency) === true));
+			const bundledBumps = bumps.filter((bump) => scope.bundled?.releaseTypeFrom.has(bump.dependency) === true);
+			const fromBundled = releaseTypeOfBumps(bundledBumps);
+			if (own !== void 0) {
+				const type = raiseReleaseType(own, fromBundled);
+				if (type !== own) context.logger.log(`${scope.pkg.name} bundles ${describeBundledBumps(bundledBumps)}; raising its ${own} release to ${type}.`);
+				return type;
+			}
 			if (bumps.length === 0) return false;
+			if (fromBundled !== void 0) {
+				context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but it bundles ${describeBundledBumps(bundledBumps)}; releasing it as ${fromBundled}.`);
+				return fromBundled;
+			}
 			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${String(bumps.length)} workspace dependency ranges changed`}; forcing a patch release.`);
 			return "patch";
 		},
@@ -815,9 +892,19 @@ function createScopedPlugins(scope) {
 				...bumps.map((bump) => describeDependencyBump(bump))
 			].join("\n");
 			return typeof notes === "string" ? `${notes}\n\n${section}` : section;
+		},
+		shippedReleaseType(releaseType) {
+			return raiseReleaseType(releaseType, carriedReleaseType);
 		}
 	};
 }
+/** The highest release type among `bumps`, or `undefined` when there are none. A bump with no recorded type counts as the patch it always forced. */
+function releaseTypeOfBumps(bumps) {
+	return highestReleaseType(bumps.map((bump) => bump.releaseType ?? "patch"));
+}
+function describeBundledBumps(bumps) {
+	return bumps.map((bump) => `${bump.dependency} (released ${bump.version}, ${bump.releaseType ?? "patch"})`).join(", ");
+}
 /**
 * Combines the bumps recorded in memory earlier in the current run with bumps recovered from the package's own filtered commit history (a bump commit from this run, already visible because it touches the package's own directory, or one left over from a previous run), de-duplicated by dependency name. The in-memory entry wins on overlap: it carries the manifest field and dependent name a `resolved-at-publish` bump has no commit to recover from at all.
 */
@@ -1001,6 +1088,7 @@ async function attemptSingleCommitRelease(options) {
 		requireGitPlugin: false,
 		forbidGitPlugin: true
 	});
+	const bundled = resolveBundledDependencies(graph, options.bundlingPackages);
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
 	const tagFormat = validateTagFormat(options.tagFormat ?? "${name}@${version}");
@@ -1022,6 +1110,7 @@ async function attemptSingleCommitRelease(options) {
 			analyzeCommitsConfig,
 			generateNotesConfig,
 			bumpsForThisPackage,
+			bundled: mustGet(bundled, name, "bundled dependencies"),
 			env,
 			branches: options.branches,
 			onCommitsResolved: (commits) => {
@@ -1059,7 +1148,10 @@ async function attemptSingleCommitRelease(options) {
 			notes: nextRelease.notes,
 			bumps: bumpsForThisPackage
 		});
-		for (const bump of planDependentBumps(pkg, nextRelease.version, graph)) {
+		for (const bump of planDependentBumps(pkg, {
+			version: nextRelease.version,
+			releaseType: nextRelease.shippedReleaseType
+		}, graph)) {
 			const forDependent = pendingBumps.get(bump.dependent) ?? [];
 			forDependent.push(bump);
 			pendingBumps.set(bump.dependent, forDependent);
@@ -1165,6 +1257,7 @@ async function analysePackage(pkg, options) {
 		analyzeCommitsConfig: options.analyzeCommitsConfig,
 		generateNotesConfig: options.generateNotesConfig,
 		bumps: { bumpsFor: () => options.bumpsForThisPackage },
+		bundled: options.bundled,
 		onCommitsResolved: options.onCommitsResolved
 	});
 	const semanticReleaseOptions = {
@@ -1190,13 +1283,15 @@ async function analysePackage(pkg, options) {
 	if (result.nextRelease.notes === void 0) throw new ReleaseConfigurationError(`Internal error: ${pkg.name} released with no notes computed.`);
 	return {
 		type: result.nextRelease.type,
+		shippedReleaseType: scoped.shippedReleaseType(result.nextRelease.type),
 		version: result.nextRelease.version,
 		gitTag: result.nextRelease.gitTag,
 		notes: result.nextRelease.notes
 	};
 }
 /** Pure classification of what a released package's version does to each dependent's declared range -- the same logic `bumpDependents` in `release.ts` applies, minus the file write/commit/push: `commitStrategy: 'single'` defers every write to phase 3, applying the same classification once analysis has finished for the whole run. */
-function planDependentBumps(released, version, graph) {
+function planDependentBumps(released, release, graph) {
+	const { version, releaseType } = release;
 	const applied = [];
 	const dependents = graph.dependents.get(released.name);
 	if (dependents === void 0) return applied;
@@ -1209,7 +1304,8 @@ function planDependentBumps(released, version, graph) {
 			field: edge.field,
 			version,
 			range: update.kind === "rewritten" ? update.range : edge.range,
-			kind: update.kind
+			kind: update.kind,
+			releaseType
 		});
 	}
 	return applied;
@@ -1310,17 +1406,19 @@ async function releaseWorkspace(options = {}) {
 		plugins: options.plugins ?? DEFAULT_PUBLISH_PLUGINS,
 		packagePlugins: options.packagePlugins
 	}, workspace.root, { requireGitPlugin: !dryRun });
+	const bundled = resolveBundledDependencies(graph, options.bundlingPackages);
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
 	return {
 		order,
 		packages: (await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
-			const result = await runPackageRelease(pkg, {
+			const { result, releaseType } = await runPackageRelease(pkg, {
 				tagFormat: validateTagFormat(options.tagFormat ?? "${name}@${version}"),
 				publishPlugins: mustGet(publishPlugins, pkg.name, "publish plugins"),
 				analyzeCommitsConfig,
 				generateNotesConfig,
 				bumpsForThisPackage,
+				bundled: mustGet(bundled, pkg.name, "bundled dependencies"),
 				dryRun,
 				env,
 				branches: options.branches
@@ -1329,6 +1427,7 @@ async function releaseWorkspace(options = {}) {
 			return {
 				released: nextRelease !== void 0,
 				version: nextRelease?.version,
+				releaseType,
 				result
 			};
 		})).map((entry) => {
@@ -1351,7 +1450,7 @@ async function releaseWorkspace(options = {}) {
 	};
 }
 /**
-* The per-package release loop shared by `releaseWorkspace` (normal per-package releases) and `detachWorkspaceRelease` (gated tag-only releases): iterate the topological `order`, call the caller's own `releaseOne` for each package, record which dependency-range bumps were already applied to it, and -- when it released -- bump every workspace dependent's manifest before that dependent's own turn (see `bumpDependents`'s doc comment for why this happens immediately rather than being staged). The two call sites differ only in how they call semantic-release (`semanticRelease(...)` vs `detachRelease(...)`) and how they read "did it release, and what version" off the result, both captured by `releaseOne`.
+* The per-package release loop shared by `releaseWorkspace` (normal per-package releases) and `detachWorkspaceRelease` (gated tag-only releases): iterate the topological `order`, call the caller's own `releaseOne` for each package, record which dependency-range bumps were already applied to it, and -- when it released -- bump every workspace dependent's manifest before that dependent's own turn (see `bumpDependents`'s doc comment for why this happens immediately rather than being staged). The two call sites differ only in how they call semantic-release (`semanticRelease(...)` vs `detachRelease(...)`) and how they read "did it release, at what version and with which shipped release type" off the result, all captured by `releaseOne`.
 */
 async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne) {
 	const pendingBumps = /* @__PURE__ */ new Map();
@@ -1361,7 +1460,7 @@ async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne)
 		const pkg = mustGet(graph.packages, name, "package");
 		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
 		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
-		const { released, version, result } = dryRun ? await releaseOne(pkg, bumpsForThisPackage) : await releasePackageAcrossBranchMoves(name, branchTracker(workspace, log), async () => await releaseOne(pkg, bumpsForThisPackage), log);
+		const { released, version, releaseType, result } = dryRun ? await releaseOne(pkg, bumpsForThisPackage) : await releasePackageAcrossBranchMoves(name, branchTracker(workspace, log), async () => await releaseOne(pkg, bumpsForThisPackage), log);
 		entries.push({
 			name,
 			directory: pkg.directory,
@@ -1370,13 +1469,16 @@ async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne)
 			dependencyBumps: bumpsForThisPackage
 		});
 		pendingBumps.delete(name);
-		if (!released || version === void 0) {
+		if (!released || version === void 0 || releaseType === void 0) {
 			log(`${name}: no release`);
 			continue;
 		}
 		log(`${name}: released ${version}`);
 		identity ??= await resolveCommitIdentity({ cwd: workspace.root });
-		const bumps = await bumpDependents(pkg, version, graph, {
+		const bumps = await bumpDependents(pkg, {
+			version,
+			releaseType
+		}, graph, {
 			workspace,
 			dryRun,
 			identity,
@@ -1395,7 +1497,8 @@ async function runPackageRelease(pkg, options) {
 		pkg,
 		analyzeCommitsConfig: options.analyzeCommitsConfig,
 		generateNotesConfig: options.generateNotesConfig,
-		bumps: { bumpsFor: () => options.bumpsForThisPackage }
+		bumps: { bumpsFor: () => options.bumpsForThisPackage },
+		bundled: options.bundled
 	});
 	const semanticReleaseOptions = {
 		tagFormat: formatTagForPackage(options.tagFormat, pkg.name),
@@ -1406,10 +1509,14 @@ async function runPackageRelease(pkg, options) {
 	if (options.dryRun) semanticReleaseOptions.dryRun = true;
 	if (options.branches !== void 0) semanticReleaseOptions.branches = options.branches;
 	try {
-		return await semanticRelease(semanticReleaseOptions, {
+		const result = await semanticRelease(semanticReleaseOptions, {
 			cwd: pkg.directory,
 			env: { ...options.env }
 		});
+		return {
+			result,
+			releaseType: result === false ? void 0 : scoped.shippedReleaseType(result.nextRelease.type)
+		};
 	} catch (cause) {
 		throw new WorkspaceReleaseError(`Release of ${pkg.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
 	}
@@ -1421,10 +1528,11 @@ const LOCKFILE_FILENAME = "pnpm-lock.yaml";
 *
 * The bump is committed (and pushed) right away rather than staged, because a dependent's semantic-release run analyses git history, not the working tree: an uncommitted bump would be invisible to its commit analysis, and would be stranded uncommitted if the dependent then released nothing -- a manifest that names versions the registry has never seen. Committing immediately means the dependent's own run sees the bump commit (it touches only the dependent's directory, so it passes that dependent's path filter), the forced-patch logic in the scoped analyzer covers the case where that bump is the dependent's only change, and a run interrupted partway leaves the remote describing exactly what was published. Pushing immediately mirrors what semantic-release itself does with release commits. The lockfile is regenerated (`pnpm install --lockfile-only`) and committed alongside the manifest for the same reason: a manifest bump committed without it leaves `pnpm-lock.yaml` naming the old range, which `pnpm install --frozen-lockfile` (what CI runs) then rejects.
 */
-async function bumpDependents(released, version, graph, options) {
+async function bumpDependents(released, release, graph, options) {
 	const applied = [];
 	const dependents = graph.dependents.get(released.name);
 	if (dependents === void 0) return applied;
+	const { version, releaseType } = release;
 	for (const edge of dependents) {
 		const update = updateDependencyRange(edge.range, version);
 		if (update.kind === "wildcard") continue;
@@ -1437,6 +1545,7 @@ async function bumpDependents(released, version, graph, options) {
 					dependency: released.name,
 					version,
 					range: update.range,
+					releaseType,
 					dependent: edge.dependent
 				});
 				await commitFiles([`${dependent.relativeDirectory}/package.json`, LOCKFILE_FILENAME], message, {
@@ -1453,7 +1562,8 @@ async function bumpDependents(released, version, graph, options) {
 			field: edge.field,
 			version,
 			range: update.kind === "rewritten" ? update.range : edge.range,
-			kind: update.kind
+			kind: update.kind,
+			releaseType
 		});
 	}
 	return applied;
@@ -1499,14 +1609,16 @@ async function detachWorkspaceRelease(options) {
 		plugins: options.plugins ?? DEFAULT_PUBLISH_PLUGINS,
 		packagePlugins: options.packagePlugins
 	}, workspace.root, { requireGitPlugin: !dryRun });
+	const bundled = resolveBundledDependencies(graph, options.bundlingPackages);
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
 	const entries = await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
-		const state = await runPackageDetach(pkg, {
+		const { state, releaseType } = await runPackageDetach(pkg, {
 			publishPlugins: mustGet(publishPlugins, pkg.name, "publish plugins"),
 			analyzeCommitsConfig,
 			generateNotesConfig,
 			bumpsForThisPackage,
+			bundled: mustGet(bundled, pkg.name, "bundled dependencies"),
 			tagFormat: validateTagFormat(options.tagFormat ?? "${name}@${version}"),
 			dryRun,
 			env,
@@ -1515,6 +1627,7 @@ async function detachWorkspaceRelease(options) {
 		return {
 			released: state !== null,
 			version: state?.nextRelease.version,
+			releaseType,
 			result: state
 		};
 	});
@@ -1547,7 +1660,8 @@ async function runPackageDetach(pkg, options) {
 		pkg,
 		analyzeCommitsConfig: options.analyzeCommitsConfig,
 		generateNotesConfig: options.generateNotesConfig,
-		bumps: { bumpsFor: () => options.bumpsForThisPackage }
+		bumps: { bumpsFor: () => options.bumpsForThisPackage },
+		bundled: options.bundled
 	});
 	const cliOptions = {
 		tagFormat: formatTagForPackage(options.tagFormat, pkg.name),
@@ -1558,10 +1672,14 @@ async function runPackageDetach(pkg, options) {
 	if (options.dryRun) cliOptions.dryRun = true;
 	if (options.branches !== void 0) cliOptions.branches = options.branches;
 	try {
-		return await detachRelease(cliOptions, {
+		const state = await detachRelease(cliOptions, {
 			cwd: pkg.directory,
 			env: { ...options.env }
 		});
+		return {
+			state,
+			releaseType: state === null ? void 0 : scoped.shippedReleaseType(state.nextRelease.type)
+		};
 	} catch (cause) {
 		throw new WorkspaceReleaseError(`Detaching ${pkg.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
 	}
@@ -1638,7 +1756,8 @@ const CONFIG_OPTION_KEYS = /* @__PURE__ */ new Set([
 	"generateNotes",
 	"commitStrategy",
 	"gatePublish",
-	"tagFormat"
+	"tagFormat",
+	"bundlingPackages"
 ]);
 const COMMIT_STRATEGIES = /* @__PURE__ */ new Set(["per-package", "single"]);
 function isCommitStrategy(value) {
@@ -1663,7 +1782,8 @@ function createProgram() {
 	release.option("--tag-format <template>", "template for each package's release tag, with ${name} and ${version} placeholders; must contain ${version} (default: ${name}@${version})", parseTagFormat);
 	release.option("--gate-publish", "tag and push each due package via @exadev/release-gate, but defer publishing -- requires --gate-state-file, and cannot be combined with --commit-strategy single");
 	release.option("--gate-state-file <path>", "with --gate-publish: where to write the state a later \"resume\" run needs to finish publishing");
-	release.option("--config <file>", "config file (.json, .yaml, .yml, .js, .cjs, or .ts) providing any of the release options (dryRun, branches, plugins, packagePlugins, analyzeCommits, generateNotes, commitStrategy, tagFormat, gatePublish); explicit flags win");
+	release.option("--bundling-package <name>", "a public package whose build bundles its workspace devDependencies, so it releases as at least their release type rather than a forced patch; repeat for several packages", collectRepeated, []);
+	release.option("--config <file>", "config file (.json, .yaml, .yml, .js, .cjs, or .ts) providing any of the release options (dryRun, branches, plugins, packagePlugins, analyzeCommits, generateNotes, commitStrategy, tagFormat, gatePublish, bundlingPackages); explicit flags win");
 	release.action(runRelease);
 	const resume = program.command("resume");
 	resume.description("Finish publishing every package a --gate-publish release tagged and pushed but did not publish.");
@@ -1699,7 +1819,8 @@ const NO_CONFIG_FILE = {
 	generateNotes: void 0,
 	commitStrategy: void 0,
 	tagFormat: void 0,
-	gatePublish: void 0
+	gatePublish: void 0,
+	bundlingPackages: void 0
 };
 async function runRelease(flags) {
 	const file = flags.config === void 0 ? NO_CONFIG_FILE : await readReleaseConfigFile(flags.config);
@@ -1715,7 +1836,8 @@ async function runRelease(flags) {
 		generateNotes: flags.generateNotes === void 0 ? file.generateNotes : parseJsonObjectFlag(flags.generateNotes, "--generate-notes"),
 		commitStrategy: flags.commitStrategy ?? file.commitStrategy,
 		tagFormat: flags.tagFormat ?? file.tagFormat,
-		gatePublish
+		gatePublish,
+		bundlingPackages: flags.bundlingPackage.length > 0 ? flags.bundlingPackage : file.bundlingPackages
 	});
 	for (const pkg of outcome.packages) console.log(describeOutcome(pkg));
 	if (gatePublish) {
@@ -1776,7 +1898,7 @@ async function readReleaseConfigFile(path) {
 	const parsed = await readConfigFile(path);
 	if (!isJsonObject(parsed)) throw new InvalidArgumentError(`--config file ${path} must contain a JSON object`);
 	for (const key of Object.keys(parsed)) if (!CONFIG_OPTION_KEYS.has(key)) throw new InvalidArgumentError(`--config file ${path} has an unknown option "${key}"; recognised options: ${[...CONFIG_OPTION_KEYS].join(", ")}`);
-	const { dryRun, branches, plugins, packagePlugins, analyzeCommits, generateNotes, commitStrategy, tagFormat, gatePublish } = parsed;
+	const { dryRun, branches, plugins, packagePlugins, analyzeCommits, generateNotes, commitStrategy, tagFormat, gatePublish, bundlingPackages } = parsed;
 	if (dryRun !== void 0 && typeof dryRun !== "boolean") throw new InvalidArgumentError(`--config file ${path}: "dryRun" must be a boolean`);
 	if (branches !== void 0 && !isStringArray(branches)) throw new InvalidArgumentError(`--config file ${path}: "branches" must be an array of branch name strings`);
 	if (plugins !== void 0 && !Array.isArray(plugins)) throw new InvalidArgumentError(`--config file ${path}: "plugins" must be an array`);
@@ -1786,6 +1908,7 @@ async function readReleaseConfigFile(path) {
 	if (commitStrategy !== void 0 && (typeof commitStrategy !== "string" || !isCommitStrategy(commitStrategy))) throw new InvalidArgumentError(`--config file ${path}: "commitStrategy" must be one of: ${[...COMMIT_STRATEGIES].join(", ")}`);
 	if (tagFormat !== void 0 && typeof tagFormat !== "string") throw new InvalidArgumentError(`--config file ${path}: "tagFormat" must be a string`);
 	if (gatePublish !== void 0 && typeof gatePublish !== "boolean") throw new InvalidArgumentError(`--config file ${path}: "gatePublish" must be a boolean`);
+	if (bundlingPackages !== void 0 && !isStringArray(bundlingPackages)) throw new InvalidArgumentError(`--config file ${path}: "bundlingPackages" must be an array of package name strings`);
 	return {
 		dryRun,
 		branches,
@@ -1795,7 +1918,8 @@ async function readReleaseConfigFile(path) {
 		generateNotes,
 		commitStrategy,
 		tagFormat: tagFormat === void 0 ? void 0 : validateTagFormatOption(tagFormat, (message) => `--config file ${path}: ${message}`),
-		gatePublish
+		gatePublish,
+		bundlingPackages
 	};
 }
 function parseConfigFilePackagePlugins(packagePlugins, path) {