@mui/internal-code-infra 0.0.4-canary.1 → 0.0.4-canary.10

package/README.md

@@ -35,7 +35,7 @@ This is stored in the `docs` top-level directory.
 
 ### Adding and publishing new packages
 
-Whenever news packages are added to the repo (that will get published to npm) or a private package is turned into a public one, follow the below steps before invoking the publish workflow of the previous section.
+Whenever new packages are added to the repo (that will get published to npm) or a private package is turned into a public one, follow the below steps before invoking the publish workflow of the previous section.
 
 1. Goto your repo's code base on your system, open terminal and run:
 

package/build/babel-config.d.mts

@@ -1,3 +1,7 @@
+export type ReactCompilationMode = 'annotation' | 'syntax' | 'infer' | 'all';
+/**
+ * @typedef {'annotation' | 'syntax' | 'infer' | 'all'} ReactCompilationMode
+ */
 /**
  * @param {Object} param0
  * @param {boolean} [param0.debug]
@@ -8,7 +12,7 @@
  * @param {string | null} param0.outExtension - Specify the output file extension.
  * @param {string} param0.runtimeVersion
  * @param {string} [param0.reactCompilerReactVersion]
- * @param {string} [param0.reactCompilerMode]
+ * @param {ReactCompilationMode} [param0.reactCompilerMode]
  * @returns {import('@babel/core').TransformOptions} The base Babel configuration.
  */
 export declare function getBaseConfig({ debug, optimizeClsx, removePropTypes, noResolveImports, bundle, runtimeVersion, outExtension, reactCompilerReactVersion, reactCompilerMode }: {
@@ -20,7 +24,7 @@ export declare function getBaseConfig({ debug, optimizeClsx, removePropTypes, no
     outExtension: string | null;
     runtimeVersion: string;
     reactCompilerReactVersion?: string;
-    reactCompilerMode?: string;
+    reactCompilerMode?: ReactCompilationMode;
 }): import('@babel/core').TransformOptions;
 export type Options = {
     bundle?: 'esm' | 'cjs';

package/build/cli/cmdListWorkspaces.d.mts

@@ -4,12 +4,14 @@ export type Args = {
     publicOnly?: boolean;
     output?: 'json' | 'path' | 'name' | 'publish-dir';
     sinceRef?: string;
+    filter?: string[];
 };
 /**
  * @typedef {Object} Args
  * @property {boolean} [publicOnly] - Whether to filter to only public packages
  * @property {'json'|'path'|'name'|'publish-dir'} [output] - Output format (name, path, or json)
  * @property {string} [sinceRef] - Git reference to filter changes since
+ * @property {string[]} [filter] - Same as filtering packages with --filter in pnpm. Only include packages matching the filter. See https://pnpm.io/filtering.
  */
 declare const _default: import("yargs").CommandModule<{}, Args>;
 export default /** @type {import('yargs').CommandModule<{}, Args>} */ _default;

package/build/cli/cmdPublish.d.mts

@@ -7,6 +7,7 @@ export type Args = {
     tag: string;
     ci: boolean;
     sha?: string;
+    filter?: string[];
 };
 declare const _default: import("yargs").CommandModule<{}, Args>;
 export default /** @type {import('yargs').CommandModule<{}, Args>} */ _default;

package/build/cli/cmdPublishCanary.d.mts

@@ -5,6 +5,7 @@ export type PublishOptions = import('../utils/pnpm.mjs').PublishOptions;
 export type Args = {
     dryRun?: boolean;
     githubRelease?: boolean;
+    filter?: string[];
 };
 export type Commit = {
     sha: string;

package/build/utils/pnpm.d.mts

@@ -31,6 +31,7 @@ export type GetWorkspacePackagesOptions = {
     publicOnly?: boolean;
     nonPublishedOnly?: boolean;
     cwd?: string;
+    filter?: string[];
 };
 export declare function getWorkspacePackages(options?: {
     publicOnly: true;
@@ -56,6 +57,39 @@ export declare function getPackageVersionInfo(packageName: string, baseVersion:
  * @returns {Promise<void>}
  */
 export declare function publishPackages(packages: PublicPackage[], options?: PublishOptions): Promise<void>;
+export type GetTransitiveDependenciesOptions = {
+    workspacePathByName?: Map<string, string>;
+    includeDev?: boolean;
+};
+/**
+ * @typedef {Object} GetTransitiveDependenciesOptions
+ * @property {Map<string, string>} [workspacePathByName] - Map of workspace package name to directory path
+ * @property {boolean} [includeDev=true] - Whether to include devDependencies in the traversal
+ */
+/**
+ * Get all transitive workspace dependencies for a set of packages.
+ *
+ * Traverses `dependencies`, `peerDependencies`, and optionally `devDependencies`,
+ * following only packages that exist in `workspacePathByName`. Results are cached
+ * per package so each package is read from disk at most once regardless of how many
+ * roots depend on it.
+ *
+ * @param {string[]} packageNames - Package names to start the traversal from
+ * @param {GetTransitiveDependenciesOptions} [options]
+ * @returns {Promise<Set<string>>} All reachable workspace package names, including the input packages themselves
+ */
+export declare function getTransitiveDependencies(packageNames: string[], options?: GetTransitiveDependenciesOptions): Promise<Set<string>>;
+/**
+ * Validate that a set of packages covers all of their transitive workspace dependencies,
+ * and that none of those dependencies are private (which would make them unpublishable).
+ *
+ * @param {PublicPackage[]} packages - The packages intended for publishing
+ * @returns {Promise<{issues: string[]}>}
+ *   List of human-readable issue strings. Empty when the dependency set is valid.
+ */
+export declare function validatePublishDependencies(packages: PublicPackage[]): Promise<{
+    issues: string[];
+}>;
 /**
  * Read package.json from a directory
  * @param {string} packagePath - Path to package directory

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mui/internal-code-infra",
-  "version": "0.0.4-canary.1",
+  "version": "0.0.4-canary.10",
   "description": "Infra scripts and configs to be used across MUI repos.",
   "type": "module",
   "license": "MIT",
@@ -43,13 +43,16 @@
     "./brokenLinksChecker": {
       "types": "./build/brokenLinksChecker/index.d.mts",
       "default": "./src/brokenLinksChecker/index.mjs"
+    },
+    "./build-env": {
+      "types": "./src/build-env.d.ts"
     }
   },
   "bin": {
     "code-infra": "./bin/code-infra.mjs"
   },
   "dependencies": {
-    "@argos-ci/core": "^4.5.0",
+    "@argos-ci/core": "^5.1.1",
     "@babel/cli": "^7.28.6",
     "@babel/core": "^7.29.0",
     "@babel/plugin-syntax-jsx": "^7.28.6",
@@ -58,19 +61,19 @@
     "@babel/preset-env": "^7.29.0",
     "@babel/preset-react": "^7.28.5",
     "@babel/preset-typescript": "^7.28.5",
-    "@eslint/compat": "^2.0.2",
+    "@eslint/compat": "^2.0.3",
     "@eslint/js": "^10.0.1",
-    "@eslint/json": "^1.0.1",
-    "@inquirer/confirm": "^6.0.4",
-    "@inquirer/select": "^5.0.4",
+    "@eslint/json": "^1.1.0",
+    "@inquirer/confirm": "^6.0.8",
+    "@inquirer/select": "^5.1.0",
     "@napi-rs/keyring": "^1.2.0",
     "@octokit/auth-action": "^6.0.2",
     "@octokit/oauth-methods": "^6.0.2",
     "@octokit/rest": "^22.0.1",
     "@pnpm/find-workspace-dir": "^1000.1.4",
-    "@typescript-eslint/types": "^8.56.1",
-    "@typescript-eslint/utils": "^8.56.1",
-    "@vitest/eslint-plugin": "^1.6.9",
+    "@typescript-eslint/types": "^8.57.1",
+    "@typescript-eslint/utils": "^8.57.1",
+    "@vitest/eslint-plugin": "^1.6.11",
     "babel-plugin-optimize-clsx": "^2.6.2",
     "babel-plugin-react-compiler": "^1.0.0",
     "babel-plugin-transform-import-meta": "^2.3.3",
@@ -78,13 +81,13 @@
     "babel-plugin-transform-react-remove-prop-types": "^0.4.24",
     "babel-plugin-transform-remove-imports": "^1.8.1",
     "chalk": "^5.6.2",
-    "clipboardy": "^5.3.0",
+    "clipboardy": "^5.3.1",
     "content-type": "^1.0.5",
     "env-ci": "^11.2.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-module-utils": "^2.12.1",
-    "eslint-plugin-compat": "^6.2.0",
+    "eslint-plugin-compat": "^7.0.1",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-mocha": "^11.2.0",
@@ -92,14 +95,14 @@
     "eslint-plugin-react-compiler": "^19.1.0-rc.2",
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-testing-library": "^7.16.0",
-    "es-toolkit": "^1.44.0",
+    "es-toolkit": "^1.45.1",
     "execa": "^9.6.1",
     "git-url-parse": "^16.1.0",
-    "globals": "^16.5.0",
+    "globals": "^17.4.0",
     "globby": "^16.1.1",
-    "minimatch": "^10.2.2",
-    "node-html-parser": "^7.0.2",
-    "open": "^10.2.0",
+    "minimatch": "^10.2.4",
+    "node-html-parser": "^7.1.0",
+    "open": "^11.0.0",
     "postcss-styled-syntax": "^0.7.1",
     "regexp.escape": "^2.0.1",
     "rehype-slug": "^6.0.0",
@@ -110,12 +113,12 @@
     "resolve-pkg-maps": "^1.0.0",
     "semver": "^7.7.4",
     "stylelint-config-standard": "^40.0.0",
-    "typescript-eslint": "^8.56.1",
+    "typescript-eslint": "^8.57.1",
     "unified": "^11.0.5",
     "yargs": "^18.0.0",
-    "@mui/internal-babel-plugin-display-name": "1.0.4-canary.13",
-    "@mui/internal-babel-plugin-resolve-imports": "2.0.7-canary.32",
-    "@mui/internal-babel-plugin-minify-errors": "2.0.8-canary.22"
+    "@mui/internal-babel-plugin-display-name": "1.0.4-canary.14",
+    "@mui/internal-babel-plugin-resolve-imports": "2.0.7-canary.33",
+    "@mui/internal-babel-plugin-minify-errors": "2.0.8-canary.24"
   },
   "peerDependencies": {
     "@next/eslint-plugin-next": "*",
@@ -143,13 +146,13 @@
     "@types/estree-jsx": "1.0.5",
     "@types/regexp.escape": "2.0.0",
     "@types/yargs": "17.0.35",
-    "@typescript-eslint/parser": "8.56.1",
-    "@typescript-eslint/rule-tester": "8.56.1",
-    "eslint": "10.0.2",
+    "@typescript-eslint/parser": "8.57.1",
+    "@typescript-eslint/rule-tester": "8.57.1",
+    "eslint": "10.0.3",
     "get-port": "7.1.0",
     "prettier": "3.8.1",
-    "serve": "14.2.5",
-    "typescript-eslint": "8.56.1"
+    "serve": "14.2.6",
+    "typescript-eslint": "8.57.1"
   },
   "files": [
     "bin",
@@ -161,10 +164,10 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitSha": "4fc3292722f406f8eae122597b124749bf54476d",
+  "gitSha": "b989d008bd34fbf9fb9d3395da2f6a32536f574d",
   "scripts": {
     "build": "tsgo -p tsconfig.build.json",
-    "typescript": "tsgo -p tsconfig.json",
+    "typescript": "tsgo -noEmit",
     "test": "pnpm -w test --project @mui/internal-code-infra",
     "test:copy": "rm -rf build && node bin/code-infra.mjs copy-files --glob \"src/cli/*.mjs\" --glob \"src/eslint/**/*.mjs:esm\""
   }

package/src/babel-config.mjs

@@ -10,6 +10,10 @@ import pluginTransformImportMeta from 'babel-plugin-transform-import-meta';
 import pluginTransformInlineEnvVars from 'babel-plugin-transform-inline-environment-variables';
 import pluginRemovePropTypes from 'babel-plugin-transform-react-remove-prop-types';
 
+/**
+ * @typedef {'annotation' | 'syntax' | 'infer' | 'all'} ReactCompilationMode
+ */
+
 /**
  * @param {Object} param0
  * @param {boolean} [param0.debug]
@@ -20,7 +24,7 @@ import pluginRemovePropTypes from 'babel-plugin-transform-react-remove-prop-type
  * @param {string | null} param0.outExtension - Specify the output file extension.
  * @param {string} param0.runtimeVersion
  * @param {string} [param0.reactCompilerReactVersion]
- * @param {string} [param0.reactCompilerMode]
+ * @param {ReactCompilationMode} [param0.reactCompilerMode]
  * @returns {import('@babel/core').TransformOptions} The base Babel configuration.
  */
 export function getBaseConfig({
@@ -183,6 +187,6 @@ export default function getBabelConfig(api) {
     removePropTypes: process.env.MUI_REMOVE_PROP_TYPES === 'true',
     noResolveImports,
     reactCompilerReactVersion: process.env.MUI_REACT_COMPILER_REACT_VERSION,
-    reactCompilerMode: process.env.MUI_REACT_COMPILER_MODE,
+    reactCompilerMode: /** @type {ReactCompilationMode} */ (process.env.MUI_REACT_COMPILER_MODE),
   });
 }

package/src/build-env.d.ts

@@ -0,0 +1,13 @@
+export {};
+
+declare global {
+  interface Env {
+    NODE_ENV?: 'production' | undefined;
+  }
+
+  interface Process {
+    env: Env;
+  }
+
+  const process: Process;
+}

package/src/cli/cmdListWorkspaces.mjs

@@ -15,6 +15,7 @@ import { getWorkspacePackages } from '../utils/pnpm.mjs';
  * @property {boolean} [publicOnly] - Whether to filter to only public packages
  * @property {'json'|'path'|'name'|'publish-dir'} [output] - Output format (name, path, or json)
  * @property {string} [sinceRef] - Git reference to filter changes since
+ * @property {string[]} [filter] - Same as filtering packages with --filter in pnpm. Only include packages matching the filter. See https://pnpm.io/filtering.
  */
 
 export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
@@ -37,13 +38,19 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       .option('since-ref', {
         type: 'string',
         description: 'Filter packages changed since git reference',
+      })
+      .option('filter', {
+        type: 'string',
+        array: true,
+        description:
+          'Same as filtering packages with --filter in pnpm. Only include packages matching the filter. See https://pnpm.io/filtering.',
       });
   },
   handler: async (argv) => {
-    const { publicOnly = false, output = 'name', sinceRef } = argv;
+    const { publicOnly = false, output = 'name', sinceRef, filter = [] } = argv;
 
     // Get packages using our helper function
-    const packages = await getWorkspacePackages({ sinceRef, publicOnly });
+    const packages = await getWorkspacePackages({ sinceRef, publicOnly, filter });
 
     if (output === 'json') {
       // Serialize packages to JSON

package/src/cli/cmdNetlifyIgnore.mjs

@@ -12,93 +12,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { findWorkspaceDir } from '@pnpm/find-workspace-dir';
 import { toPosixPath } from '../utils/path.mjs';
-import { getWorkspacePackages } from '../utils/pnpm.mjs';
-
-/**
- * Get all workspace dependencies (direct and transitive) from a package
- * @param {string} packageName - Package name
- * @param {Map<string, string>} workspaceMap - Map of workspace name to path
- * @param {Map<string, Promise<Set<string>>>} cache - Cache of package resolution promises
- * @returns {Promise<Set<string>>} Set of workspace package names (dependencies only, not including the package itself)
- */
-async function getWorkspaceDependenciesRecursive(packageName, workspaceMap, cache) {
-  // Check cache first
-  const cached = cache.get(packageName);
-  if (cached) {
-    return cached;
-  }
-
-  // Create the resolution promise
-  const promise = (async () => {
-    const packagePath = workspaceMap.get(packageName);
-    if (!packagePath) {
-      throw new Error(`Workspace "${packageName}" not found in the repository`);
-    }
-
-    const packageJsonPath = path.join(packagePath, 'package.json');
-    const content = await fs.readFile(packageJsonPath, 'utf8');
-    const packageJson = JSON.parse(content);
-
-    // Collect all dependency names
-    /** @type {Set<string>} */
-    const allDeps = new Set();
-    if (packageJson.dependencies) {
-      Object.keys(packageJson.dependencies).forEach((dep) => allDeps.add(dep));
-    }
-    if (packageJson.devDependencies) {
-      Object.keys(packageJson.devDependencies).forEach((dep) => allDeps.add(dep));
-    }
-    if (packageJson.peerDependencies) {
-      Object.keys(packageJson.peerDependencies).forEach((dep) => allDeps.add(dep));
-    }
-
-    // Filter to only workspace dependencies
-    const workspaceDeps = Array.from(allDeps).filter((dep) => workspaceMap.has(dep));
-
-    // Recursively process workspace dependencies in parallel
-    const recursiveResults = await Promise.all(
-      workspaceDeps.map(async (dep) => {
-        return getWorkspaceDependenciesRecursive(dep, workspaceMap, cache);
-      }),
-    );
-
-    // Merge all results using flatMap
-    return new Set(recursiveResults.flatMap((result) => Array.from(result)).concat(workspaceDeps));
-  })();
-
-  // Store in cache before returning
-  cache.set(packageName, promise);
-
-  return promise;
-}
-
-/**
- * Get transitive workspace dependencies for a list of workspace names
- * @param {string[]} workspaceNames - Array of workspace names
- * @param {Map<string, string>} workspaceMap - Map of workspace name to path
- * @returns {Promise<Set<string>>} Set of workspace package names (including requested packages and all their dependencies)
- */
-async function getTransitiveDependencies(workspaceNames, workspaceMap) {
-  // Shared cache for all workspace dependency resolution
-  const cache = new Map();
-
-  // Validate all workspace names exist
-  for (const workspaceName of workspaceNames) {
-    if (!workspaceMap.has(workspaceName)) {
-      throw new Error(`Workspace "${workspaceName}" not found in the repository`);
-    }
-  }
-
-  // Process each requested workspace in parallel
-  const workspaceResults = await Promise.all(
-    workspaceNames.map((workspaceName) =>
-      getWorkspaceDependenciesRecursive(workspaceName, workspaceMap, cache),
-    ),
-  );
-
-  // Merge all results using flatMap and add the original package names
-  return new Set(workspaceNames.concat(workspaceResults.flatMap((result) => Array.from(result))));
-}
+import { getTransitiveDependencies, getWorkspacePackages } from '../utils/pnpm.mjs';
 
 /**
  * Generate the ignore command string for netlify.toml
@@ -220,7 +134,9 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
         console.log(`Processing ${workspaceName}...`);
 
         // Get transitive dependencies for this specific workspace
-        const dependencyNames = await getTransitiveDependencies([workspaceName], workspaceMap);
+        const dependencyNames = await getTransitiveDependencies([workspaceName], {
+          workspacePathByName: workspaceMap,
+        });
 
         // Convert package names to relative paths (normalize to POSIX separators for git)
         const relativePaths = Array.from(dependencyNames)

package/src/cli/cmdPublish.mjs

@@ -17,7 +17,11 @@ import * as fs from 'node:fs/promises';
 import * as semver from 'semver';
 
 import { persistentAuthStrategy } from '../utils/github.mjs';
-import { getWorkspacePackages, publishPackages } from '../utils/pnpm.mjs';
+import {
+  getWorkspacePackages,
+  publishPackages,
+  validatePublishDependencies,
+} from '../utils/pnpm.mjs';
 import { getCurrentGitSha, getRepositoryInfo } from '../utils/git.mjs';
 
 const isCI = envCI().isCi;
@@ -33,6 +37,7 @@ function getOctokit() {
  * @property {string} tag NPM dist tag to publish to
  * @property {boolean} ci Runs in CI environment
  * @property {string} [sha] Git SHA to use for the GitHub release workflow (local only)
+ * @property {string[]} [filter] Same as filtering packages with --filter in pnpm. Only publish packages matching the filter. See https://pnpm.io/filtering.
  */
 
 /**
@@ -260,10 +265,16 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       .option('sha', {
         type: 'string',
         description: 'Git SHA to use for the GitHub release workflow (local only)',
+      })
+      .option('filter', {
+        type: 'string',
+        array: true,
+        description:
+          'Same as filtering packages with --filter in pnpm. Only publish packages matching the filter. See https://pnpm.io/filtering.',
       });
   },
   handler: async (argv) => {
-    const { dryRun = false, githubRelease = false, tag = 'latest', sha } = argv;
+    const { dryRun = false, githubRelease = false, tag = 'latest', sha, filter = [] } = argv;
 
     if (isCI && !argv.ci) {
       console.error(
@@ -290,13 +301,29 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
     // Get all packages
     console.log('🔍 Discovering all workspace packages...');
 
-    const allPackages = await getWorkspacePackages({ publicOnly: true });
+    const allPackages = await getWorkspacePackages({ publicOnly: true, filter });
 
     if (allPackages.length === 0) {
-      console.log('⚠️  No public packages found in workspace');
+      console.log(
+        `⚠️  No publishable packages found in workspace${filter.length > 0 ? ` matching filter "${filter.join(', ')}"` : ''}`,
+      );
       return;
     }
 
+    if (filter.length > 0) {
+      console.log('🔍 Validating workspace dependencies for filtered packages...');
+
+      const { issues } = await validatePublishDependencies(allPackages);
+
+      if (issues.length > 0) {
+        throw new Error('Invalid dependencies structure of packages to be published.', {
+          cause: issues,
+        });
+      }
+
+      console.log('✅ All workspace dependency requirements satisfied');
+    }
+
     // Get version from root package.json
     const version = await getReleaseVersion();
 

package/src/cli/cmdPublishCanary.mjs

@@ -16,10 +16,12 @@ import * as semver from 'semver';
 
 import {
   getPackageVersionInfo,
+  getTransitiveDependencies,
   getWorkspacePackages,
   publishPackages,
   readPackageJson,
   semverMax,
+  validatePublishDependencies,
   writePackageJson,
 } from '../utils/pnpm.mjs';
 import { getCurrentGitSha, getRepositoryInfo } from '../utils/git.mjs';
@@ -28,6 +30,7 @@ import { getCurrentGitSha, getRepositoryInfo } from '../utils/git.mjs';
  * @typedef {Object} Args
  * @property {boolean} [dryRun] - Whether to run in dry-run mode
  * @property {boolean} [githubRelease] - Whether to create GitHub releases for canary packages
+ * @property {string[]} [filter] - Same as filtering packages with --filter in pnpm. Only publish packages matching the filter. See https://pnpm.io/filtering.
  */
 
 const CANARY_TAG = 'canary';
@@ -118,80 +121,6 @@ function cleanupCommitMessage(message) {
   return `${prefix}${msg}`.trim();
 }
 
-async function getPackageToDependencyMap() {
-  /**
-   * @type {(PublicPackage & { dependencies: Record<string, unknown>; private: boolean; })[]}
-   */
-  const packagesWithDeps = JSON.parse(
-    (await $`pnpm ls -r --json --exclude-peers --only-projects --prod`).stdout,
-  );
-  /** @type {Record<string, string[]>} */
-  const directPkgDependencies = packagesWithDeps
-    .filter((pkg) => !pkg.private)
-    .reduce((acc, pkg) => {
-      if (!pkg.name) {
-        return acc;
-      }
-      const deps = Object.keys(pkg.dependencies || {});
-      if (!deps.length) {
-        return acc;
-      }
-      acc[pkg.name] = deps;
-      return acc;
-    }, /** @type {Record<string, string[]>} */ ({}));
-  return directPkgDependencies;
-}
-
-/**
- * @param {Record<string, string[]>} pkgGraph
- */
-function resolveTransitiveDependencies(pkgGraph = {}) {
-  // Compute transitive (nested) dependencies limited to workspace packages and avoid cycles.
-  const workspacePkgNames = new Set(Object.keys(pkgGraph));
-  const nestedMap = /** @type {Record<string, string[]>} */ ({});
-
-  /**
-   *
-   * @param {string} pkgName
-   * @returns {string[]}
-   */
-  const getTransitiveDeps = (pkgName) => {
-    /**
-     * @type {Set<string>}
-     */
-    const seen = new Set();
-    const stack = (pkgGraph[pkgName] || []).slice();
-
-    while (stack.length) {
-      const dep = stack.pop();
-      if (!dep || seen.has(dep)) {
-        continue;
-      }
-      // Only consider workspace packages for transitive expansion
-      if (!workspacePkgNames.has(dep)) {
-        // still record external deps as direct deps but don't traverse into them
-        seen.add(dep);
-        continue;
-      }
-      seen.add(dep);
-      const children = pkgGraph[dep] || [];
-      for (const c of children) {
-        if (!seen.has(c)) {
-          stack.push(c);
-        }
-      }
-    }
-
-    return Array.from(seen);
-  };
-
-  for (const name of Object.keys(pkgGraph)) {
-    nestedMap[name] = getTransitiveDeps(name);
-  }
-
-  return nestedMap;
-}
-
 /**
  * Prepare changelog data for packages using GitHub API
  * @param {PublicPackage[]} packagesToPublish - Packages that will be published
@@ -224,14 +153,20 @@ async function prepareChangelogsFromGitCli(packagesToPublish, allPackages, canar
       }
     }),
   );
-  // Second pass: check for dependency updates in other packages not part of git history
-  const pkgDependencies = await getPackageToDependencyMap();
-  const transitiveDependencies = resolveTransitiveDependencies(pkgDependencies);
+  // Second pass: check for dependency updates in other packages not part of git history.
+  const workspacePathByName = new Map(allPackages.map((pkg) => [pkg.name, pkg.path]));
+  const publishedNames = new Set(packagesToPublish.map((p) => p.name));
+
+  const transitiveDepSets = await Promise.all(
+    allPackages.map((pkg) =>
+      getTransitiveDependencies([pkg.name], { includeDev: false, workspacePathByName }),
+    ),
+  );
 
   for (let i = 0; i < allPackages.length; i += 1) {
     const pkg = allPackages[i];
-    const depsToPublish = (transitiveDependencies[pkg.name] ?? []).filter((dep) =>
-      packagesToPublish.some((p) => p.name === dep),
+    const depsToPublish = [...transitiveDepSets[i]].filter(
+      (dep) => dep !== pkg.name && publishedNames.has(dep),
     );
     if (depsToPublish.length === 0) {
       continue;
@@ -495,7 +430,11 @@ async function publishCanaryVersions(
   let publishSuccess = false;
   try {
     console.log(`📤 Publishing ${packagesToPublish.length} canary versions...`);
-    await publishPackages(packagesToPublish, { ...options, noGitChecks: true, tag: CANARY_TAG });
+    await publishPackages(packagesToPublish, {
+      dryRun: options.dryRun,
+      noGitChecks: true,
+      tag: CANARY_TAG,
+    });
 
     packagesToPublish.forEach((pkg) => {
       const canaryVersion = canaryVersions.get(pkg.name);
@@ -542,10 +481,16 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
         type: 'boolean',
         default: false,
         description: 'Create GitHub releases for published packages',
+      })
+      .option('filter', {
+        type: 'string',
+        array: true,
+        description:
+          'Same as filtering packages with --filter in pnpm. Only publish packages matching the filter. See https://pnpm.io/filtering.',
       });
   },
   handler: async (argv) => {
-    const { dryRun = false, githubRelease = false } = argv;
+    const { dryRun = false, githubRelease = false, filter = [] } = argv;
 
     const options = { dryRun, githubRelease };
 
@@ -557,22 +502,41 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       console.log('📝 GitHub releases will be created for published packages\n');
     }
 
-    // Always get all packages first
+    // All public packages — needed by publishCanaryVersions to bump versions and update
+    // package.json across the entire workspace, even for packages not being published.
     console.log('🔍 Discovering all workspace packages...');
-    const allPackages = await getWorkspacePackages({ publicOnly: true });
+    const filteredPackages = await getWorkspacePackages({ publicOnly: true, filter });
 
-    if (allPackages.length === 0) {
-      console.log('⚠️  No public packages found in workspace');
+    if (filteredPackages.length === 0) {
+      console.log(
+        `⚠️  No publishable packages found in workspace${filter.length > 0 ? ` matching filter "${filter.join(', ')}"` : ''}`,
+      );
       return;
     }
 
-    // Check for canary tag to determine selective publishing
+    if (filter.length > 0) {
+      console.log('🔍 Validating workspace dependencies for filtered packages...');
+
+      const { issues } = await validatePublishDependencies(filteredPackages);
+
+      if (issues.length > 0) {
+        throw new Error('Invalid dependencies structure of packages to be published.', {
+          cause: issues,
+        });
+      }
+
+      console.log('✅ All workspace dependency requirements satisfied');
+    }
+
+    // Check for canary tag to determine selective publishing.
+    // --filter is applied on top of sinceRef: publish only packages that have
+    // changed since the last canary tag AND match the filter.
     const canaryTag = await getLastCanaryTag();
 
     console.log('🔍 Checking for packages changed since canary tag...');
     const packages = canaryTag
-      ? await getWorkspacePackages({ sinceRef: canaryTag, publicOnly: true })
-      : allPackages;
+      ? await getWorkspacePackages({ sinceRef: canaryTag, publicOnly: true, filter })
+      : filteredPackages;
 
     console.log(`📋 Found ${packages.length} packages(s) for canary publishing:`);
     packages.forEach((pkg) => {
@@ -581,7 +545,7 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
 
     // Fetch version info for all packages in parallel
     console.log('\n🔍 Fetching package version information...');
-    const versionInfoPromises = allPackages.map(async (pkg) => {
+    const versionInfoPromises = filteredPackages.map(async (pkg) => {
       const versionInfo = await getPackageVersionInfo(pkg.name, pkg.version);
       return { packageName: pkg.name, versionInfo };
     });
@@ -593,7 +557,7 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       packageVersionInfo.set(packageName, versionInfo);
     }
 
-    await publishCanaryVersions(packages, allPackages, packageVersionInfo, options);
+    await publishCanaryVersions(packages, filteredPackages, packageVersionInfo, options);
 
     console.log('\n🏁 Publishing complete!');
   },

package/src/utils/pnpm.mjs

@@ -48,6 +48,7 @@ import * as semver from 'semver';
  * @property {boolean} [publicOnly=false] - Whether to filter to only public packages
  * @property {boolean} [nonPublishedOnly=false] - Whether to filter to only non-published packages. It by default means public packages yet to be published.
  * @property {string} [cwd] - Current working directory to run pnpm command in
+ * @property {string[]} [filter] - Same as filtering packages with --filter in pnpm. Only include packages matching the filter. See https://pnpm.io/filtering.
  */
 
 /**
@@ -73,10 +74,15 @@ import * as semver from 'semver';
  * @returns {Promise<(PrivatePackage | PublicPackage)[]>} Array of packages
  */
 export async function getWorkspacePackages(options = {}) {
-  const { sinceRef = null, publicOnly = false, nonPublishedOnly = false } = options;
+  const { sinceRef = null, publicOnly = false, nonPublishedOnly = false, filter = [] } = options;
 
   // Build command with conditional filter
   const filterArg = sinceRef ? ['--filter', `...[${sinceRef}]`] : [];
+  if (filter.length > 0) {
+    filter.forEach((f) => {
+      filterArg.push('--filter', f);
+    });
+  }
   const result = options.cwd
     ? await $({ cwd: options.cwd })`pnpm ls -r --json --depth -1 ${filterArg}`
     : await $`pnpm ls -r --json --depth -1 ${filterArg}`;
@@ -175,6 +181,132 @@ export async function publishPackages(packages, options = {}) {
   await $({ stdio: 'inherit' })`pnpm -r publish --access public --tag=${tag} ${args}`;
 }
 
+/**
+ * @typedef {Object} GetTransitiveDependenciesOptions
+ * @property {Map<string, string>} [workspacePathByName] - Map of workspace package name to directory path
+ * @property {boolean} [includeDev=true] - Whether to include devDependencies in the traversal
+ */
+
+/**
+ * Get all transitive workspace dependencies for a set of packages.
+ *
+ * Traverses `dependencies`, `peerDependencies`, and optionally `devDependencies`,
+ * following only packages that exist in `workspacePathByName`. Results are cached
+ * per package so each package is read from disk at most once regardless of how many
+ * roots depend on it.
+ *
+ * @param {string[]} packageNames - Package names to start the traversal from
+ * @param {GetTransitiveDependenciesOptions} [options]
+ * @returns {Promise<Set<string>>} All reachable workspace package names, including the input packages themselves
+ */
+export async function getTransitiveDependencies(packageNames, options = {}) {
+  const { includeDev = true, workspacePathByName = new Map() } = options;
+
+  /** @type {Map<string, Promise<Set<string>>>} */
+  const cache = new Map();
+
+  /**
+   * @param {string} packageName
+   * @returns {Promise<Set<string>>}
+   */
+  function collectDeps(packageName) {
+    const cached = cache.get(packageName);
+    if (cached) {
+      return cached;
+    }
+
+    const promise = (async () => {
+      const packagePath = workspacePathByName.get(packageName);
+      if (!packagePath) {
+        throw new Error(`Workspace "${packageName}" not found`);
+      }
+
+      const pkgJson = await readPackageJson(packagePath);
+      const allDeps = new Set([
+        ...Object.keys(pkgJson.dependencies ?? {}),
+        ...(includeDev ? Object.keys(pkgJson.devDependencies ?? {}) : []),
+        ...Object.keys(pkgJson.peerDependencies ?? {}),
+      ]);
+      const workspaceDeps = [...allDeps].filter((dep) => workspacePathByName.has(dep));
+
+      const recursiveResults = await Promise.all(workspaceDeps.map(collectDeps));
+      return new Set([...workspaceDeps, ...recursiveResults.flatMap((s) => [...s])]);
+    })();
+
+    cache.set(packageName, promise);
+    return promise;
+  }
+
+  for (const name of packageNames) {
+    if (!workspacePathByName.has(name)) {
+      throw new Error(`Workspace "${name}" not found`);
+    }
+  }
+
+  const results = await Promise.all(packageNames.map(collectDeps));
+  return new Set([...packageNames, ...results.flatMap((s) => [...s])]);
+}
+
+/**
+ * Validate that a set of packages covers all of their transitive workspace dependencies,
+ * and that none of those dependencies are private (which would make them unpublishable).
+ *
+ * @param {PublicPackage[]} packages - The packages intended for publishing
+ * @returns {Promise<{issues: string[]}>}
+ *   List of human-readable issue strings. Empty when the dependency set is valid.
+ */
+export async function validatePublishDependencies(packages) {
+  const allWorkspacePackages = await getWorkspacePackages();
+
+  /** @type {Map<string, PublicPackage | PrivatePackage>} */
+  const workspacePackageByName = new Map(
+    allWorkspacePackages.flatMap((pkg) => (pkg.name ? [[pkg.name, pkg]] : [])),
+  );
+  const workspacePathByName = new Map(
+    allWorkspacePackages.flatMap((pkg) => (pkg.name ? [[pkg.name, pkg.path]] : [])),
+  );
+
+  const publishedNames = new Set(packages.map((pkg) => pkg.name));
+  const transitiveDeps = await getTransitiveDependencies(
+    packages.map((pkg) => pkg.name),
+    { includeDev: false, workspacePathByName },
+  );
+
+  /** @type {Set<string>} */
+  const privateButRequired = new Set();
+  /** @type {Set<string>} */
+  const missingFromPublish = new Set();
+
+  for (const depName of transitiveDeps) {
+    if (publishedNames.has(depName)) {
+      continue;
+    }
+    const workspacePkg = workspacePackageByName.get(depName);
+    if (workspacePkg?.isPrivate) {
+      privateButRequired.add(depName);
+    } else {
+      missingFromPublish.add(depName);
+    }
+  }
+
+  /** @type {string[]} */
+  const issues = [];
+
+  if (privateButRequired.size > 0) {
+    issues.push(
+      `The following private workspace packages are required as dependencies but cannot be published: ${[...privateButRequired].join(', ')}`,
+    );
+  }
+
+  if (missingFromPublish.size > 0) {
+    issues.push(
+      `The following workspace packages are required as dependencies but are not included in the publish set: ${[...missingFromPublish].join(', ')}. Add them to the --filter list.`,
+    );
+  }
+
+  return { issues };
+}
+
 /**
  * Read package.json from a directory
  * @param {string} packagePath - Path to package directory