@exadev/semantic-release-workspace 3.1.28 → 3.2.0

package/dist/index.cjs

@@ -702,6 +702,65 @@ function mustGet(map, key, what) {
 	return value;
 }
 //#endregion
+//#region src/bundling.ts
+/**
+* Validates `bundlingPackages` against the workspace and works out, for every package, which workspace dependencies it bundles.
+*
+* A package named in `bundlingPackages` declares that its build inlines every workspace sibling it lists in `devDependencies`, so consumers never install those siblings from the registry and their code reaches consumers only through this package. When such a sibling releases, this package's release type is at least the sibling's shipped release type (a `feat` in the sibling releases this package as a minor), instead of the patch an ordinary dependency bump forces. Edges in `dependencies`, `peerDependencies` and `optionalDependencies` are installed by consumers, so they keep the forced patch.
+*
+* A private package's own release type never changes: it keeps the patch a dependency bump forces, so its versions and tags are exactly what they would be without `bundlingPackages`. What it gains is a carried release type (see `BundledDependencies.carried`), which lets a bundling package that lists only the private package still see the release type of a private sibling the private package depends on.
+*
+* `bundlingPackages` names public workspace packages whose builds bundle their workspace `devDependencies`; `undefined` or an empty list leaves every package's release type as it was. Returns one entry per package in the graph. Throws `ReleaseConfigurationError` when a name is not a package in the workspace, or names a private package, which never publishes and so ships nothing to consumers.
+*/
+function resolveBundledDependencies(graph, bundlingPackages) {
+	const bundling = new Set(bundlingPackages);
+	const unknown = [...bundling].filter((name) => !graph.packages.has(name));
+	if (unknown.length > 0) throw new ReleaseConfigurationError(`bundlingPackages names ${unknown.map((name) => `"${name}"`).join(", ")}, which ${unknown.length === 1 ? "is" : "are"} not a package in this workspace. Packages: ${[...graph.packages.keys()].join(", ")}.`);
+	const privateNames = [...bundling].filter((name) => mustGet(graph.packages, name, "package").private);
+	if (privateNames.length > 0) throw new ReleaseConfigurationError(`bundlingPackages names ${privateNames.map((name) => `"${name}"`).join(", ")}, which ${privateNames.length === 1 ? "is" : "are"} private. A private package is never published, so nothing it bundles reaches a consumer through it; list the public package whose build inlines it instead.`);
+	const resolved = /* @__PURE__ */ new Map();
+	for (const [name, pkg] of graph.packages) {
+		const edges = mustGet(graph.dependencies, name, "dependency edges");
+		const releaseTypeFrom = new Set(edges.filter((edge) => bundling.has(name) && edge.field === "devDependencies").map((edge) => edge.dependency));
+		const carried = /* @__PURE__ */ new Set([...releaseTypeFrom, ...edges.filter((edge) => pkg.private && isPrivateRuntimeEdge(edge, graph)).map((edge) => edge.dependency)]);
+		resolved.set(name, {
+			releaseTypeFrom,
+			carried
+		});
+	}
+	return resolved;
+}
+function isPrivateRuntimeEdge(edge, graph) {
+	return edge.field !== "devDependencies" && mustGet(graph.packages, edge.dependency, "package").private;
+}
+//#endregion
+//#region src/release-type.ts
+/** Every release type semantic-release knows, highest first: the order `@semantic-release/commit-analyzer` itself ranks them in (its `lib/default-release-types.js`), so comparing two types here agrees with how the analyzer picks the highest type among a package's own commits. */
+const RELEASE_TYPES_HIGHEST_FIRST = [
+	"major",
+	"premajor",
+	"minor",
+	"preminor",
+	"patch",
+	"prepatch",
+	"prerelease"
+];
+const KNOWN_RELEASE_TYPES = new Set(RELEASE_TYPES_HIGHEST_FIRST);
+/** Whether `value` is one of semantic-release's release types. */
+function isReleaseType(value) {
+	return typeof value === "string" && KNOWN_RELEASE_TYPES.has(value);
+}
+/** The highest of the given release types, ranked as `@semantic-release/commit-analyzer` ranks them, or `undefined` when `types` is empty. */
+function highestReleaseType(types) {
+	let highest;
+	for (const type of types) if (highest === void 0 || RELEASE_TYPES_HIGHEST_FIRST.indexOf(type) < RELEASE_TYPES_HIGHEST_FIRST.indexOf(highest)) highest = type;
+	return highest;
+}
+/** `base`, raised to `other` when `other` is the higher release type; an `undefined` `other` leaves `base` as it is. */
+function raiseReleaseType(base, other) {
+	return other === void 0 || RELEASE_TYPES_HIGHEST_FIRST.indexOf(base) <= RELEASE_TYPES_HIGHEST_FIRST.indexOf(other) ? base : other;
+}
+//#endregion
 //#region src/dependency-bump-commit.ts
 /**
 * The commit message format for a cross-package dependency-range bump, shared between the code that writes it (`bumpDependents` in `release.ts`) and the code that reads it back (`createScopedPlugins` in `plugins.ts`).
@@ -711,26 +770,30 @@ function mustGet(map, key, what) {
 const TRAILER_DEPENDENCY = "Bumped-Workspace-Dependency";
 const TRAILER_VERSION = "Bumped-Workspace-Dependency-Version";
 const TRAILER_RANGE = "Bumped-Workspace-Dependency-Range";
+const TRAILER_RELEASE_TYPE = "Bumped-Workspace-Dependency-Release-Type";
 /** Builds the full commit message (subject and trailer) for one dependency-range bump. */
 function formatDependencyBumpMessage(info) {
 	return `${`chore(deps): bump ${info.dependency} to ${info.range} in ${info.dependent} [skip ci]`}\n\n${[
 		`${TRAILER_DEPENDENCY}: ${info.dependency}`,
 		`${TRAILER_VERSION}: ${info.version}`,
-		`${TRAILER_RANGE}: ${info.range}`
+		`${TRAILER_RANGE}: ${info.range}`,
+		`${TRAILER_RELEASE_TYPE}: ${info.releaseType}`
 	].join("\n")}`;
 }
 /**
-* Recovers the dependency bump a `formatDependencyBumpMessage` commit recorded, from its full git message (subject and body), or `undefined` if the message carries no such trailer. All three lines must be present for the commit to be treated as a bump commit at all -- a message missing even one is left alone rather than partially trusted.
+* Recovers the dependency bump a `formatDependencyBumpMessage` commit recorded, from its full git message (subject and body), or `undefined` if the message carries no such trailer. The dependency, version and range lines must all be present for the commit to be treated as a bump commit at all -- a message missing even one is left alone rather than partially trusted. The release type line is optional, since bump commits written before it existed lack it; when it is absent or names no release type, `releaseType` is `undefined`.
 */
 function parseDependencyBumpTrailer(message) {
 	const dependency = matchTrailerLine(message, TRAILER_DEPENDENCY);
 	const version = matchTrailerLine(message, TRAILER_VERSION);
 	const range = matchTrailerLine(message, TRAILER_RANGE);
 	if (dependency === void 0 || version === void 0 || range === void 0) return;
+	const releaseType = matchTrailerLine(message, TRAILER_RELEASE_TYPE);
 	return {
 		dependency,
 		version,
-		range
+		range,
+		releaseType: isReleaseType(releaseType) ? releaseType : void 0
 	};
 }
 function matchTrailerLine(message, key) {
@@ -768,10 +831,11 @@ const STEP_PLUGINS_THE_ORCHESTRATOR_OWNS = /* @__PURE__ */ new Set(["@semantic-r
 *
 * Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
 *
-* The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
+* The `analyzeCommits` wrapper carries two additions beyond filtering. When the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway: a dependent whose only change is a dependency bump still needs a release for that range to reach the registry. And when a bumped dependency is one the package bundles (`scope.bundled.releaseTypeFrom`), the package's release type is raised to at least that dependency's shipped release type, whether or not the package has releasable commits of its own, because the dependency's change reaches consumers only inside this package. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
 */
 function createScopedPlugins(scope) {
 	let cached;
+	let carriedReleaseType;
 	async function commitsForPackage(context) {
 		const from = hasGitHead(context.lastRelease) ? context.lastRelease.gitHead : void 0;
 		if (cached === void 0) cached = {
@@ -789,13 +853,26 @@ function createScopedPlugins(scope) {
 	return {
 		async analyzeCommits(_pluginConfig, context) {
 			const commits = await commitsForPackage(context);
-			const type = await (0, _semantic_release_commit_analyzer.analyzeCommits)(scope.analyzeCommitsConfig, {
+			const analysed = await (0, _semantic_release_commit_analyzer.analyzeCommits)(scope.analyzeCommitsConfig, {
 				...context,
 				commits
 			});
-			if (typeof type === "string") return type;
+			if (typeof analysed === "string" && !isReleaseType(analysed)) throw new ReleaseConfigurationError(`@semantic-release/commit-analyzer returned "${analysed}" for ${scope.pkg.name}, which is not a semantic-release release type.`);
+			const own = typeof analysed === "string" ? analysed : void 0;
 			const bumps = mergeDependencyBumps(scope.bumps.bumpsFor(scope.pkg.name), commits);
+			carriedReleaseType = releaseTypeOfBumps(bumps.filter((bump) => scope.bundled?.carried.has(bump.dependency) === true));
+			const bundledBumps = bumps.filter((bump) => scope.bundled?.releaseTypeFrom.has(bump.dependency) === true);
+			const fromBundled = releaseTypeOfBumps(bundledBumps);
+			if (own !== void 0) {
+				const type = raiseReleaseType(own, fromBundled);
+				if (type !== own) context.logger.log(`${scope.pkg.name} bundles ${describeBundledBumps(bundledBumps)}; raising its ${own} release to ${type}.`);
+				return type;
+			}
 			if (bumps.length === 0) return false;
+			if (fromBundled !== void 0) {
+				context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but it bundles ${describeBundledBumps(bundledBumps)}; releasing it as ${fromBundled}.`);
+				return fromBundled;
+			}
 			context.logger.log(`No releasable commits under ${scope.pkg.relativeDirectory}, but ${bumps.length === 1 ? "a workspace dependency range changed" : `${String(bumps.length)} workspace dependency ranges changed`}; forcing a patch release.`);
 			return "patch";
 		},
@@ -813,9 +890,19 @@ function createScopedPlugins(scope) {
 				...bumps.map((bump) => describeDependencyBump(bump))
 			].join("\n");
 			return typeof notes === "string" ? `${notes}\n\n${section}` : section;
+		},
+		shippedReleaseType(releaseType) {
+			return raiseReleaseType(releaseType, carriedReleaseType);
 		}
 	};
 }
+/** The highest release type among `bumps`, or `undefined` when there are none. A bump with no recorded type counts as the patch it always forced. */
+function releaseTypeOfBumps(bumps) {
+	return highestReleaseType(bumps.map((bump) => bump.releaseType ?? "patch"));
+}
+function describeBundledBumps(bumps) {
+	return bumps.map((bump) => `${bump.dependency} (released ${bump.version}, ${bump.releaseType ?? "patch"})`).join(", ");
+}
 /**
 * Combines the bumps recorded in memory earlier in the current run with bumps recovered from the package's own filtered commit history (a bump commit from this run, already visible because it touches the package's own directory, or one left over from a previous run), de-duplicated by dependency name. The in-memory entry wins on overlap: it carries the manifest field and dependent name a `resolved-at-publish` bump has no commit to recover from at all.
 */
@@ -1014,6 +1101,7 @@ async function attemptSingleCommitRelease(options) {
 		requireGitPlugin: false,
 		forbidGitPlugin: true
 	});
+	const bundled = resolveBundledDependencies(graph, options.bundlingPackages);
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
 	const tagFormat = validateTagFormat(options.tagFormat ?? "${name}@${version}");
@@ -1035,6 +1123,7 @@ async function attemptSingleCommitRelease(options) {
 			analyzeCommitsConfig,
 			generateNotesConfig,
 			bumpsForThisPackage,
+			bundled: mustGet(bundled, name, "bundled dependencies"),
 			env,
 			branches: options.branches,
 			onCommitsResolved: (commits) => {
@@ -1072,7 +1161,10 @@ async function attemptSingleCommitRelease(options) {
 			notes: nextRelease.notes,
 			bumps: bumpsForThisPackage
 		});
-		for (const bump of planDependentBumps(pkg, nextRelease.version, graph)) {
+		for (const bump of planDependentBumps(pkg, {
+			version: nextRelease.version,
+			releaseType: nextRelease.shippedReleaseType
+		}, graph)) {
 			const forDependent = pendingBumps.get(bump.dependent) ?? [];
 			forDependent.push(bump);
 			pendingBumps.set(bump.dependent, forDependent);
@@ -1178,6 +1270,7 @@ async function analysePackage(pkg, options) {
 		analyzeCommitsConfig: options.analyzeCommitsConfig,
 		generateNotesConfig: options.generateNotesConfig,
 		bumps: { bumpsFor: () => options.bumpsForThisPackage },
+		bundled: options.bundled,
 		onCommitsResolved: options.onCommitsResolved
 	});
 	const semanticReleaseOptions = {
@@ -1203,13 +1296,15 @@ async function analysePackage(pkg, options) {
 	if (result.nextRelease.notes === void 0) throw new ReleaseConfigurationError(`Internal error: ${pkg.name} released with no notes computed.`);
 	return {
 		type: result.nextRelease.type,
+		shippedReleaseType: scoped.shippedReleaseType(result.nextRelease.type),
 		version: result.nextRelease.version,
 		gitTag: result.nextRelease.gitTag,
 		notes: result.nextRelease.notes
 	};
 }
 /** Pure classification of what a released package's version does to each dependent's declared range -- the same logic `bumpDependents` in `release.ts` applies, minus the file write/commit/push: `commitStrategy: 'single'` defers every write to phase 3, applying the same classification once analysis has finished for the whole run. */
-function planDependentBumps(released, version, graph) {
+function planDependentBumps(released, release, graph) {
+	const { version, releaseType } = release;
 	const applied = [];
 	const dependents = graph.dependents.get(released.name);
 	if (dependents === void 0) return applied;
@@ -1222,7 +1317,8 @@ function planDependentBumps(released, version, graph) {
 			field: edge.field,
 			version,
 			range: update.kind === "rewritten" ? update.range : edge.range,
-			kind: update.kind
+			kind: update.kind,
+			releaseType
 		});
 	}
 	return applied;
@@ -1316,14 +1412,16 @@ async function detachWorkspaceRelease(options) {
 		plugins: options.plugins ?? DEFAULT_PUBLISH_PLUGINS,
 		packagePlugins: options.packagePlugins
 	}, workspace.root, { requireGitPlugin: !dryRun });
+	const bundled = resolveBundledDependencies(graph, options.bundlingPackages);
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
 	const entries = await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
-		const state = await runPackageDetach(pkg, {
+		const { state, releaseType } = await runPackageDetach(pkg, {
 			publishPlugins: mustGet(publishPlugins, pkg.name, "publish plugins"),
 			analyzeCommitsConfig,
 			generateNotesConfig,
 			bumpsForThisPackage,
+			bundled: mustGet(bundled, pkg.name, "bundled dependencies"),
 			tagFormat: validateTagFormat(options.tagFormat ?? "${name}@${version}"),
 			dryRun,
 			env,
@@ -1332,6 +1430,7 @@ async function detachWorkspaceRelease(options) {
 		return {
 			released: state !== null,
 			version: state?.nextRelease.version,
+			releaseType,
 			result: state
 		};
 	});
@@ -1364,7 +1463,8 @@ async function runPackageDetach(pkg, options) {
 		pkg,
 		analyzeCommitsConfig: options.analyzeCommitsConfig,
 		generateNotesConfig: options.generateNotesConfig,
-		bumps: { bumpsFor: () => options.bumpsForThisPackage }
+		bumps: { bumpsFor: () => options.bumpsForThisPackage },
+		bundled: options.bundled
 	});
 	const cliOptions = {
 		tagFormat: formatTagForPackage(options.tagFormat, pkg.name),
@@ -1375,10 +1475,14 @@ async function runPackageDetach(pkg, options) {
 	if (options.dryRun) cliOptions.dryRun = true;
 	if (options.branches !== void 0) cliOptions.branches = options.branches;
 	try {
-		return await (0, _exadev_release_gate.detachRelease)(cliOptions, {
+		const state = await (0, _exadev_release_gate.detachRelease)(cliOptions, {
 			cwd: pkg.directory,
 			env: { ...options.env }
 		});
+		return {
+			state,
+			releaseType: state === null ? void 0 : scoped.shippedReleaseType(state.nextRelease.type)
+		};
 	} catch (cause) {
 		throw new WorkspaceReleaseError(`Detaching ${pkg.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
 	}
@@ -1458,17 +1562,19 @@ async function releaseWorkspace(options = {}) {
 		plugins: options.plugins ?? DEFAULT_PUBLISH_PLUGINS,
 		packagePlugins: options.packagePlugins
 	}, workspace.root, { requireGitPlugin: !dryRun });
+	const bundled = resolveBundledDependencies(graph, options.bundlingPackages);
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
 	return {
 		order,
 		packages: (await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
-			const result = await runPackageRelease(pkg, {
+			const { result, releaseType } = await runPackageRelease(pkg, {
 				tagFormat: validateTagFormat(options.tagFormat ?? "${name}@${version}"),
 				publishPlugins: mustGet(publishPlugins, pkg.name, "publish plugins"),
 				analyzeCommitsConfig,
 				generateNotesConfig,
 				bumpsForThisPackage,
+				bundled: mustGet(bundled, pkg.name, "bundled dependencies"),
 				dryRun,
 				env,
 				branches: options.branches
@@ -1477,6 +1583,7 @@ async function releaseWorkspace(options = {}) {
 			return {
 				released: nextRelease !== void 0,
 				version: nextRelease?.version,
+				releaseType,
 				result
 			};
 		})).map((entry) => {
@@ -1499,7 +1606,7 @@ async function releaseWorkspace(options = {}) {
 	};
 }
 /**
-* The per-package release loop shared by `releaseWorkspace` (normal per-package releases) and `detachWorkspaceRelease` (gated tag-only releases): iterate the topological `order`, call the caller's own `releaseOne` for each package, record which dependency-range bumps were already applied to it, and -- when it released -- bump every workspace dependent's manifest before that dependent's own turn (see `bumpDependents`'s doc comment for why this happens immediately rather than being staged). The two call sites differ only in how they call semantic-release (`semanticRelease(...)` vs `detachRelease(...)`) and how they read "did it release, and what version" off the result, both captured by `releaseOne`.
+* The per-package release loop shared by `releaseWorkspace` (normal per-package releases) and `detachWorkspaceRelease` (gated tag-only releases): iterate the topological `order`, call the caller's own `releaseOne` for each package, record which dependency-range bumps were already applied to it, and -- when it released -- bump every workspace dependent's manifest before that dependent's own turn (see `bumpDependents`'s doc comment for why this happens immediately rather than being staged). The two call sites differ only in how they call semantic-release (`semanticRelease(...)` vs `detachRelease(...)`) and how they read "did it release, at what version and with which shipped release type" off the result, all captured by `releaseOne`.
 */
 async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne) {
 	const pendingBumps = /* @__PURE__ */ new Map();
@@ -1509,7 +1616,7 @@ async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne)
 		const pkg = mustGet(graph.packages, name, "package");
 		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
 		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
-		const { released, version, result } = dryRun ? await releaseOne(pkg, bumpsForThisPackage) : await releasePackageAcrossBranchMoves(name, branchTracker(workspace, log), async () => await releaseOne(pkg, bumpsForThisPackage), log);
+		const { released, version, releaseType, result } = dryRun ? await releaseOne(pkg, bumpsForThisPackage) : await releasePackageAcrossBranchMoves(name, branchTracker(workspace, log), async () => await releaseOne(pkg, bumpsForThisPackage), log);
 		entries.push({
 			name,
 			directory: pkg.directory,
@@ -1518,13 +1625,16 @@ async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne)
 			dependencyBumps: bumpsForThisPackage
 		});
 		pendingBumps.delete(name);
-		if (!released || version === void 0) {
+		if (!released || version === void 0 || releaseType === void 0) {
 			log(`${name}: no release`);
 			continue;
 		}
 		log(`${name}: released ${version}`);
 		identity ??= await resolveCommitIdentity({ cwd: workspace.root });
-		const bumps = await bumpDependents(pkg, version, graph, {
+		const bumps = await bumpDependents(pkg, {
+			version,
+			releaseType
+		}, graph, {
 			workspace,
 			dryRun,
 			identity,
@@ -1543,7 +1653,8 @@ async function runPackageRelease(pkg, options) {
 		pkg,
 		analyzeCommitsConfig: options.analyzeCommitsConfig,
 		generateNotesConfig: options.generateNotesConfig,
-		bumps: { bumpsFor: () => options.bumpsForThisPackage }
+		bumps: { bumpsFor: () => options.bumpsForThisPackage },
+		bundled: options.bundled
 	});
 	const semanticReleaseOptions = {
 		tagFormat: formatTagForPackage(options.tagFormat, pkg.name),
@@ -1554,10 +1665,14 @@ async function runPackageRelease(pkg, options) {
 	if (options.dryRun) semanticReleaseOptions.dryRun = true;
 	if (options.branches !== void 0) semanticReleaseOptions.branches = options.branches;
 	try {
-		return await (0, semantic_release.default)(semanticReleaseOptions, {
+		const result = await (0, semantic_release.default)(semanticReleaseOptions, {
 			cwd: pkg.directory,
 			env: { ...options.env }
 		});
+		return {
+			result,
+			releaseType: result === false ? void 0 : scoped.shippedReleaseType(result.nextRelease.type)
+		};
 	} catch (cause) {
 		throw new WorkspaceReleaseError(`Release of ${pkg.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
 	}
@@ -1569,10 +1684,11 @@ const LOCKFILE_FILENAME = "pnpm-lock.yaml";
 *
 * The bump is committed (and pushed) right away rather than staged, because a dependent's semantic-release run analyses git history, not the working tree: an uncommitted bump would be invisible to its commit analysis, and would be stranded uncommitted if the dependent then released nothing -- a manifest that names versions the registry has never seen. Committing immediately means the dependent's own run sees the bump commit (it touches only the dependent's directory, so it passes that dependent's path filter), the forced-patch logic in the scoped analyzer covers the case where that bump is the dependent's only change, and a run interrupted partway leaves the remote describing exactly what was published. Pushing immediately mirrors what semantic-release itself does with release commits. The lockfile is regenerated (`pnpm install --lockfile-only`) and committed alongside the manifest for the same reason: a manifest bump committed without it leaves `pnpm-lock.yaml` naming the old range, which `pnpm install --frozen-lockfile` (what CI runs) then rejects.
 */
-async function bumpDependents(released, version, graph, options) {
+async function bumpDependents(released, release, graph, options) {
 	const applied = [];
 	const dependents = graph.dependents.get(released.name);
 	if (dependents === void 0) return applied;
+	const { version, releaseType } = release;
 	for (const edge of dependents) {
 		const update = updateDependencyRange(edge.range, version);
 		if (update.kind === "wildcard") continue;
@@ -1585,6 +1701,7 @@ async function bumpDependents(released, version, graph, options) {
 					dependency: released.name,
 					version,
 					range: update.range,
+					releaseType,
 					dependent: edge.dependent
 				});
 				await commitFiles([`${dependent.relativeDirectory}/package.json`, LOCKFILE_FILENAME], message, {
@@ -1601,7 +1718,8 @@ async function bumpDependents(released, version, graph, options) {
 			field: edge.field,
 			version,
 			range: update.kind === "rewritten" ? update.range : edge.range,
-			kind: update.kind
+			kind: update.kind,
+			releaseType
 		});
 	}
 	return applied;
@@ -1647,6 +1765,7 @@ exports.orderedPackages = orderedPackages;
 exports.packageName = packageName;
 exports.readManifest = readManifest;
 exports.releaseWorkspace = releaseWorkspace;
+exports.resolveBundledDependencies = resolveBundledDependencies;
 exports.resolvePublishPlugins = resolvePublishPlugins;
 exports.resolveWorkspacePublishPlugins = resolveWorkspacePublishPlugins;
 exports.resumeWorkspaceRelease = resumeWorkspaceRelease;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { AnalyzeCommitsContext, BranchSpec, Commit, GenerateNotesContext } from "semantic-release";
+import { AnalyzeCommitsContext, BranchSpec, Commit, GenerateNotesContext, ReleaseType } from "semantic-release";
 import { ReleaseGateState } from "@exadev/release-gate";
 //#region src/package-name.d.ts
 export declare const packageName = "@exadev/semantic-release-workspace";
@@ -132,6 +132,31 @@ export declare function classifyDependencyRange(current: string): DependencyRang
  */
 export declare function updateDependencyRange(current: string, version: string): DependencyRangeUpdate;
 //#endregion
+//#region src/bundling.d.ts
+/**
+ * Which of a package's workspace dependencies ship inside its published artefact, as far as release types are concerned. Built by `resolveBundledDependencies`.
+ */
+interface BundledDependencies {
+  /**
+   * The dependencies whose release type sets this package's own when they release: every workspace sibling in the `devDependencies` of a package named in `bundlingPackages`. Empty for every other package, which keeps the forced patch release a dependency bump has always given it.
+   */
+  readonly releaseTypeFrom: ReadonlySet<string>;
+  /**
+   * The dependencies whose shipped release type this package passes on to whatever bundles it: everything in `releaseTypeFrom`, plus, for a private package, every private sibling in its `dependencies`, `peerDependencies` or `optionalDependencies`. A private package is never installed from the registry, and neither is a private sibling it needs at run time, so a bundle that inlines the one inlines the other too.
+   */
+  readonly carried: ReadonlySet<string>;
+}
+/**
+ * Validates `bundlingPackages` against the workspace and works out, for every package, which workspace dependencies it bundles.
+ *
+ * A package named in `bundlingPackages` declares that its build inlines every workspace sibling it lists in `devDependencies`, so consumers never install those siblings from the registry and their code reaches consumers only through this package. When such a sibling releases, this package's release type is at least the sibling's shipped release type (a `feat` in the sibling releases this package as a minor), instead of the patch an ordinary dependency bump forces. Edges in `dependencies`, `peerDependencies` and `optionalDependencies` are installed by consumers, so they keep the forced patch.
+ *
+ * A private package's own release type never changes: it keeps the patch a dependency bump forces, so its versions and tags are exactly what they would be without `bundlingPackages`. What it gains is a carried release type (see `BundledDependencies.carried`), which lets a bundling package that lists only the private package still see the release type of a private sibling the private package depends on.
+ *
+ * `bundlingPackages` names public workspace packages whose builds bundle their workspace `devDependencies`; `undefined` or an empty list leaves every package's release type as it was. Returns one entry per package in the graph. Throws `ReleaseConfigurationError` when a name is not a package in the workspace, or names a private package, which never publishes and so ships nothing to consumers.
+ */
+export declare function resolveBundledDependencies(graph: DependencyGraph, bundlingPackages: readonly string[] | undefined): ReadonlyMap<string, BundledDependencies>;
+//#endregion
 //#region src/plugins.d.ts
 /**
  * One workspace dependency range that changed because its package released a new version during this run. `rewritten` means the dependent's manifest was edited on disk; `resolved-at-publish` means a bare `workspace:^`-style range whose on-disk text is unchanged. Both count towards the dependent's release.
@@ -142,6 +167,10 @@ interface DependencyBump {
   /** The range as it now stands in the dependent's manifest -- the new concrete range for `rewritten`, the untouched `workspace:` range for `resolved-at-publish`. */
   readonly range: string;
   readonly kind: 'rewritten' | 'resolved-at-publish';
+  /**
+   * The highest release type in the code the dependency ships as of this release: its own release type, raised by the shipped release type of every sibling it bundles (see `BundledDependencies`). A dependent that bundles the dependency takes at least this release type; any other dependent ignores it and keeps the forced patch. Absent only for a bump recovered from a commit written before its trailer recorded the type, or supplied by a `DependencyBumpSource` that does not know it, and then counts as a patch.
+   */
+  readonly releaseType?: ReleaseType | undefined;
 }
 /** What the scoped plugins need to know about bumps recorded so far in the run, for the package they are about to analyse. */
 interface DependencyBumpSource {
@@ -167,19 +196,25 @@ interface ScopedPlugins {
   readonly generateNotes: (pluginConfig: Record<string, unknown>, context: GenerateNotesContext & {
     cwd: string;
   }) => Promise<string | false | undefined>;
+  /**
+   * The release type the package's released code carries to whatever bundles it: the highest of `releaseType` (the type the package itself released as) and the release types of the bumps it carries (`BundledDependencies.carried`) from the most recent `analyzeCommits` call. A carried bump with no recorded type counts as a patch. `releaseType` is the type semantic-release released the package as.
+   */
+  readonly shippedReleaseType: (releaseType: ReleaseType) => ReleaseType;
 }
 /**
  * Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
  *
  * Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
  *
- * The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
+ * The `analyzeCommits` wrapper carries two additions beyond filtering. When the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway: a dependent whose only change is a dependency bump still needs a release for that range to reach the registry. And when a bumped dependency is one the package bundles (`scope.bundled.releaseTypeFrom`), the package's release type is raised to at least that dependency's shipped release type, whether or not the package has releasable commits of its own, because the dependency's change reaches consumers only inside this package. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
  */
 export declare function createScopedPlugins(scope: {
   readonly pkg: WorkspacePackage;
   readonly analyzeCommitsConfig: Record<string, unknown>;
   readonly generateNotesConfig: Record<string, unknown>;
   readonly bumps: DependencyBumpSource;
+  /** Which of the package's workspace dependencies it bundles; see `resolveBundledDependencies`. Omitted for a package that bundles none, which keeps the forced patch for every dependency bump. */
+  readonly bundled?: BundledDependencies;
   /** Called with the path-filtered commit list every time this package's commits are resolved (from either step, whichever runs first). Optional: `commitStrategy: 'single'` uses it to capture the same filtered list `success()`'s GitHub plugin step needs later, without recomputing `changedPathsSince`/`filterCommitsToDirectory` itself from the outside. */
   readonly onCommitsResolved?: (commits: readonly Commit[]) => void;
 }): ScopedPlugins;
@@ -287,12 +322,20 @@ interface ReleaseWorkspaceOptions {
    * Raise it for a busier branch or a slower workspace; the cost of a higher bound is only paid when attempts are actually being lost.
    */
   readonly pushAttempts?: number;
+  /**
+   * Names of public packages whose build bundles every workspace sibling they list in `devDependencies`, so consumers never install those siblings from the registry. When such a sibling releases, the bundling package releases as at least the sibling's release type (a `feat` in a bundled package makes the bundling package a minor, a breaking change a major) instead of the patch a dependency bump otherwise forces; with releasable commits of its own, it releases as the higher of the two. A private sibling's release type reaches the bundling package through private packages that depend on it at run time, too, so a sibling bundled only indirectly still counts. Every other package, and every `dependencies`, `peerDependencies` or `optionalDependencies` edge, keeps the forced patch, and private packages' own versions and tags are unchanged.
+   *
+   * Off unless named, because a workspace `devDependencies` entry is not bundled in general: a public package's test helper or lint config is a workspace devDependency whose changes never reach its consumers. A name that is not a package in the workspace, or is a private package, is rejected. Applies under every `commitStrategy` and to `gatePublish`. See `resolveBundledDependencies`.
+   */
+  readonly bundlingPackages?: readonly string[];
 }
 /** One dependency-range change applied to a dependent package's manifest during the run, attached to the dependent's own outcome. */
 interface AppliedDependencyBump extends DependencyBump {
   readonly dependent: string;
   /** Which manifest field held the range that was rewritten. */
   readonly field: DependencyField;
+  /** Always known for a bump made in this run: see `DependencyBump.releaseType`. */
+  readonly releaseType: ReleaseType;
 }
 type PackageReleaseOutcome = {
   readonly name: string;
@@ -353,4 +396,4 @@ export declare class GitCommandError extends WorkspaceReleaseError {
 /** The workspace's git state does not support the release operation -- for example a detached HEAD, which names no branch that dependency-bump commits could be pushed to. */
 export declare class WorkspaceStateError extends WorkspaceReleaseError {}
 //#endregion
-export type { AppliedDependencyBump, CommitStrategy, DependencyBump, DependencyBumpSource, DependencyField, DependencyGraph, DependencyRangeShape, DependencyRangeUpdate, DetachedPackageRelease, PackageManifest, PackagePluginSpecs, PackageReleaseOutcome, PublishPluginPackage, PublishPluginSpec, ReleaseWorkspaceOptions, ResolvedPublishPlugin, ResumeWorkspaceReleaseOptions, ScopedPlugins, Workspace, WorkspaceDependency, WorkspacePackage, WorkspaceReleaseOutcome };
+export type { AppliedDependencyBump, BundledDependencies, CommitStrategy, DependencyBump, DependencyBumpSource, DependencyField, DependencyGraph, DependencyRangeShape, DependencyRangeUpdate, DetachedPackageRelease, PackageManifest, PackagePluginSpecs, PackageReleaseOutcome, PublishPluginPackage, PublishPluginSpec, ReleaseWorkspaceOptions, ResolvedPublishPlugin, ResumeWorkspaceReleaseOptions, ScopedPlugins, Workspace, WorkspaceDependency, WorkspacePackage, WorkspaceReleaseOutcome };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AnalyzeCommitsContext, BranchSpec, Commit, GenerateNotesContext } from "semantic-release";
+import { AnalyzeCommitsContext, BranchSpec, Commit, GenerateNotesContext, ReleaseType } from "semantic-release";
 import { ReleaseGateState } from "@exadev/release-gate";
 //#region src/package-name.d.ts
 export declare const packageName = "@exadev/semantic-release-workspace";
@@ -132,6 +132,31 @@ export declare function classifyDependencyRange(current: string): DependencyRang
  */
 export declare function updateDependencyRange(current: string, version: string): DependencyRangeUpdate;
 //#endregion
+//#region src/bundling.d.ts
+/**
+ * Which of a package's workspace dependencies ship inside its published artefact, as far as release types are concerned. Built by `resolveBundledDependencies`.
+ */
+interface BundledDependencies {
+  /**
+   * The dependencies whose release type sets this package's own when they release: every workspace sibling in the `devDependencies` of a package named in `bundlingPackages`. Empty for every other package, which keeps the forced patch release a dependency bump has always given it.
+   */
+  readonly releaseTypeFrom: ReadonlySet<string>;
+  /**
+   * The dependencies whose shipped release type this package passes on to whatever bundles it: everything in `releaseTypeFrom`, plus, for a private package, every private sibling in its `dependencies`, `peerDependencies` or `optionalDependencies`. A private package is never installed from the registry, and neither is a private sibling it needs at run time, so a bundle that inlines the one inlines the other too.
+   */
+  readonly carried: ReadonlySet<string>;
+}
+/**
+ * Validates `bundlingPackages` against the workspace and works out, for every package, which workspace dependencies it bundles.
+ *
+ * A package named in `bundlingPackages` declares that its build inlines every workspace sibling it lists in `devDependencies`, so consumers never install those siblings from the registry and their code reaches consumers only through this package. When such a sibling releases, this package's release type is at least the sibling's shipped release type (a `feat` in the sibling releases this package as a minor), instead of the patch an ordinary dependency bump forces. Edges in `dependencies`, `peerDependencies` and `optionalDependencies` are installed by consumers, so they keep the forced patch.
+ *
+ * A private package's own release type never changes: it keeps the patch a dependency bump forces, so its versions and tags are exactly what they would be without `bundlingPackages`. What it gains is a carried release type (see `BundledDependencies.carried`), which lets a bundling package that lists only the private package still see the release type of a private sibling the private package depends on.
+ *
+ * `bundlingPackages` names public workspace packages whose builds bundle their workspace `devDependencies`; `undefined` or an empty list leaves every package's release type as it was. Returns one entry per package in the graph. Throws `ReleaseConfigurationError` when a name is not a package in the workspace, or names a private package, which never publishes and so ships nothing to consumers.
+ */
+export declare function resolveBundledDependencies(graph: DependencyGraph, bundlingPackages: readonly string[] | undefined): ReadonlyMap<string, BundledDependencies>;
+//#endregion
 //#region src/plugins.d.ts
 /**
  * One workspace dependency range that changed because its package released a new version during this run. `rewritten` means the dependent's manifest was edited on disk; `resolved-at-publish` means a bare `workspace:^`-style range whose on-disk text is unchanged. Both count towards the dependent's release.
@@ -142,6 +167,10 @@ interface DependencyBump {
   /** The range as it now stands in the dependent's manifest -- the new concrete range for `rewritten`, the untouched `workspace:` range for `resolved-at-publish`. */
   readonly range: string;
   readonly kind: 'rewritten' | 'resolved-at-publish';
+  /**
+   * The highest release type in the code the dependency ships as of this release: its own release type, raised by the shipped release type of every sibling it bundles (see `BundledDependencies`). A dependent that bundles the dependency takes at least this release type; any other dependent ignores it and keeps the forced patch. Absent only for a bump recovered from a commit written before its trailer recorded the type, or supplied by a `DependencyBumpSource` that does not know it, and then counts as a patch.
+   */
+  readonly releaseType?: ReleaseType | undefined;
 }
 /** What the scoped plugins need to know about bumps recorded so far in the run, for the package they are about to analyse. */
 interface DependencyBumpSource {
@@ -167,19 +196,25 @@ interface ScopedPlugins {
   readonly generateNotes: (pluginConfig: Record<string, unknown>, context: GenerateNotesContext & {
     cwd: string;
   }) => Promise<string | false | undefined>;
+  /**
+   * The release type the package's released code carries to whatever bundles it: the highest of `releaseType` (the type the package itself released as) and the release types of the bumps it carries (`BundledDependencies.carried`) from the most recent `analyzeCommits` call. A carried bump with no recorded type counts as a patch. `releaseType` is the type semantic-release released the package as.
+   */
+  readonly shippedReleaseType: (releaseType: ReleaseType) => ReleaseType;
 }
 /**
  * Builds the per-package `analyzeCommits` and `generateNotes` functions handed to semantic-release as inline plugins.
  *
  * Both apply the same path scoping before delegating to the real `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator`: the commit list semantic-release already fetched for the release range is filtered down to commits whose `git log --name-only` file list intersects the package's own directory, and only the filtered list reaches the standard plugin. Conventional-commit parsing and changelog formatting stay entirely inside the standard plugins.
  *
- * The `analyzeCommits` wrapper carries one addition beyond filtering: when the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway. A dependent whose only change is a dependency bump still needs a release for that range to reach the registry. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
+ * The `analyzeCommits` wrapper carries two additions beyond filtering. When the standard analyzer finds no releasable commits but a workspace dependency range of the package's has changed, it returns 'patch' anyway: a dependent whose only change is a dependency bump still needs a release for that range to reach the registry. And when a bumped dependency is one the package bundles (`scope.bundled.releaseTypeFrom`), the package's release type is raised to at least that dependency's shipped release type, whether or not the package has releasable commits of its own, because the dependency's change reaches consumers only inside this package. "Has changed" is read from two sources, merged: bumps recorded in memory earlier in the current run (`scope.bumps`), and bumps recorded in the package's own filtered commit history via the trailer `dependency-bump-commit.ts` writes and reads -- the latter is what lets a run that starts after a previous run already committed and pushed the bump (a crash recovery, or simply a later run) reach the same decision, rather than depending on state that existed only inside the process that made the commit.
  */
 export declare function createScopedPlugins(scope: {
   readonly pkg: WorkspacePackage;
   readonly analyzeCommitsConfig: Record<string, unknown>;
   readonly generateNotesConfig: Record<string, unknown>;
   readonly bumps: DependencyBumpSource;
+  /** Which of the package's workspace dependencies it bundles; see `resolveBundledDependencies`. Omitted for a package that bundles none, which keeps the forced patch for every dependency bump. */
+  readonly bundled?: BundledDependencies;
   /** Called with the path-filtered commit list every time this package's commits are resolved (from either step, whichever runs first). Optional: `commitStrategy: 'single'` uses it to capture the same filtered list `success()`'s GitHub plugin step needs later, without recomputing `changedPathsSince`/`filterCommitsToDirectory` itself from the outside. */
   readonly onCommitsResolved?: (commits: readonly Commit[]) => void;
 }): ScopedPlugins;
@@ -287,12 +322,20 @@ interface ReleaseWorkspaceOptions {
    * Raise it for a busier branch or a slower workspace; the cost of a higher bound is only paid when attempts are actually being lost.
    */
   readonly pushAttempts?: number;
+  /**
+   * Names of public packages whose build bundles every workspace sibling they list in `devDependencies`, so consumers never install those siblings from the registry. When such a sibling releases, the bundling package releases as at least the sibling's release type (a `feat` in a bundled package makes the bundling package a minor, a breaking change a major) instead of the patch a dependency bump otherwise forces; with releasable commits of its own, it releases as the higher of the two. A private sibling's release type reaches the bundling package through private packages that depend on it at run time, too, so a sibling bundled only indirectly still counts. Every other package, and every `dependencies`, `peerDependencies` or `optionalDependencies` edge, keeps the forced patch, and private packages' own versions and tags are unchanged.
+   *
+   * Off unless named, because a workspace `devDependencies` entry is not bundled in general: a public package's test helper or lint config is a workspace devDependency whose changes never reach its consumers. A name that is not a package in the workspace, or is a private package, is rejected. Applies under every `commitStrategy` and to `gatePublish`. See `resolveBundledDependencies`.
+   */
+  readonly bundlingPackages?: readonly string[];
 }
 /** One dependency-range change applied to a dependent package's manifest during the run, attached to the dependent's own outcome. */
 interface AppliedDependencyBump extends DependencyBump {
   readonly dependent: string;
   /** Which manifest field held the range that was rewritten. */
   readonly field: DependencyField;
+  /** Always known for a bump made in this run: see `DependencyBump.releaseType`. */
+  readonly releaseType: ReleaseType;
 }
 type PackageReleaseOutcome = {
   readonly name: string;
@@ -353,4 +396,4 @@ export declare class GitCommandError extends WorkspaceReleaseError {
 /** The workspace's git state does not support the release operation -- for example a detached HEAD, which names no branch that dependency-bump commits could be pushed to. */
 export declare class WorkspaceStateError extends WorkspaceReleaseError {}
 //#endregion
-export type { AppliedDependencyBump, CommitStrategy, DependencyBump, DependencyBumpSource, DependencyField, DependencyGraph, DependencyRangeShape, DependencyRangeUpdate, DetachedPackageRelease, PackageManifest, PackagePluginSpecs, PackageReleaseOutcome, PublishPluginPackage, PublishPluginSpec, ReleaseWorkspaceOptions, ResolvedPublishPlugin, ResumeWorkspaceReleaseOptions, ScopedPlugins, Workspace, WorkspaceDependency, WorkspacePackage, WorkspaceReleaseOutcome };
+export type { AppliedDependencyBump, BundledDependencies, CommitStrategy, DependencyBump, DependencyBumpSource, DependencyField, DependencyGraph, DependencyRangeShape, DependencyRangeUpdate, DetachedPackageRelease, PackageManifest, PackagePluginSpecs, PackageReleaseOutcome, PublishPluginPackage, PublishPluginSpec, ReleaseWorkspaceOptions, ResolvedPublishPlugin, ResumeWorkspaceReleaseOptions, ScopedPlugins, Workspace, WorkspaceDependency, WorkspacePackage, WorkspaceReleaseOutcome };