@smoothbricks/cli 0.2.0 → 0.3.0

package/src/release/__tests__/orchestration.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'bun:test';
-import type { ReleasePackageInfo, ReleaseTarget } from '../core.js';
+import { type ReleasePackageInfo, type ReleaseTarget, releaseTag } from '../core.js';
 import {
+  bumpStableReleaseToNext,
   completeReleaseAtHead,
   type ReleaseRepairShell,
   type ReleaseVersionShell,
@@ -33,7 +34,7 @@ describe('release orchestration', () => {
     expect(shell.builds).toEqual([['@scope/stable']]);
     expect(shell.publishes).toEqual([{ name: '@scope/stable', distTag: 'latest', dryRun: false }]);
     expect(shell.githubCreates).toEqual([{ name: '@scope/prerelease', dryRun: false }]);
-    expect(shell.pushes).toEqual([['@scope/stable', '@scope/prerelease']]);
+    expect(shell.pushes).toEqual([['stable@1.0.0', 'prerelease@2.0.0-beta.1']]);
     expect(summaries).toHaveLength(1);
     expect(summaries[0]?.published.map((pkg) => pkg.name)).toEqual(['@scope/stable']);
     expect(summaries[0]?.githubReleases.map((pkg) => pkg.name)).toEqual(['@scope/prerelease']);
@@ -50,6 +51,33 @@ describe('release orchestration', () => {
     expect(shell.githubCreates).toEqual([{ name: '@scope/prerelease', dryRun: false }]);
   });
 
+  it('dry-run repair reports planned targets without checkout, devenv, build, publish, or GitHub calls', async () => {
+    const target = releaseTarget('github-only', [prerelease], [], [prerelease]);
+    const shell = new RecordingRepairShell();
+
+    const summaries = await repairPendingTargets(shell, [target], 'restore-ref', true);
+
+    expect(shell.checkouts).toEqual([]);
+    expect(shell.devenvLoads).toBe(0);
+    expect(shell.builds).toEqual([]);
+    expect(shell.publishes).toEqual([]);
+    expect(shell.githubCreates).toEqual([]);
+    expect(summaries).toEqual([
+      {
+        sha: 'github-only',
+        dryRun: true,
+        packages: [prerelease],
+        pushed: false,
+        published: [],
+        alreadyPublished: [prerelease],
+        githubReleases: [],
+        githubReleaseLinks: [],
+        rerunRequired: false,
+        noRelease: false,
+      },
+    ]);
+  });
+
   it('publishes a partial HEAD release by building npm-missing packages and creating missing GitHub Releases', async () => {
     const shell = new RecordingRepairShell({ npmMissing: ['@scope/stable'], githubMissing: ['@scope/prerelease'] });
 
@@ -60,9 +88,13 @@ describe('release orchestration', () => {
     expect(shell.builds).toEqual([['@scope/stable']]);
     expect(shell.publishes).toEqual([{ name: '@scope/stable', distTag: 'latest', dryRun: false }]);
     expect(shell.githubCreates).toEqual([{ name: '@scope/prerelease', dryRun: false }]);
+    expect(shell.pushes).toEqual([['stable@1.0.0', 'prerelease@2.0.0-beta.1']]);
     expect(summary.published.map((pkg) => pkg.name)).toEqual(['@scope/stable']);
     expect(summary.alreadyPublished.map((pkg) => pkg.name)).toEqual(['@scope/prerelease']);
     expect(summary.githubReleases.map((pkg) => pkg.name)).toEqual(['@scope/prerelease']);
+    expect(summary.githubReleaseLinks).toEqual([
+      { pkg: prerelease, url: 'https://github.test/prerelease@2.0.0-beta.1' },
+    ]);
     expect(summary.rerunRequired).toBe(true);
   });
 
@@ -77,6 +109,7 @@ describe('release orchestration', () => {
     expect(summary.published).toEqual([]);
     expect(summary.alreadyPublished.map((pkg) => pkg.name)).toEqual(['@scope/stable', '@scope/prerelease']);
     expect(summary.githubReleases).toEqual([]);
+    expect(summary.githubReleaseLinks).toEqual([]);
   });
 
   it('does not run Nx versioning when HEAD is already a release target', async () => {
@@ -127,6 +160,42 @@ describe('release orchestration', () => {
     expect(result).toEqual({ mode: 'new', packages: [stable], status: 'new-release' });
     expect(shell.nxRuns).toEqual([{ packages: ['@scope/stable'], bump: 'auto', dryRun: false }]);
   });
+
+  it('reports dry-run version packages resolved by Nx without creating a release mode', async () => {
+    const preview = { ...stable, version: '1.1.0' };
+    const shell = new RecordingVersionShell({ releasePackagesAtHead: [[]], releaseVersionPackages: [stable], preview });
+
+    const result = await runReleaseVersion(shell, { bump: 'auto', dryRun: true });
+
+    expect(result).toEqual({ mode: 'none', packages: [preview], status: 'dry-run' });
+    expect(shell.nxRuns).toEqual([{ packages: ['@scope/stable'], bump: 'auto', dryRun: true }]);
+  });
+
+  it('bumps stable release packages to next after publish completion', async () => {
+    const shell = new RecordingNextShell();
+
+    const bumped = await bumpStableReleaseToNext(shell, [stable, prerelease], false, false);
+
+    expect(bumped.map((pkg) => pkg.name)).toEqual(['@scope/stable']);
+    expect(shell.bumped).toEqual([['@scope/stable']]);
+  });
+
+  it('does not bump prerelease-only or dry-run publishes to next', async () => {
+    const shell = new RecordingNextShell();
+
+    await expect(bumpStableReleaseToNext(shell, [prerelease], false, false)).resolves.toEqual([]);
+    await expect(bumpStableReleaseToNext(shell, [stable], true, false)).resolves.toEqual([]);
+
+    expect(shell.bumped).toEqual([]);
+  });
+
+  it('does not bump stable packages to next when newer branch commits remain', async () => {
+    const shell = new RecordingNextShell();
+
+    await expect(bumpStableReleaseToNext(shell, [stable], false, true)).resolves.toEqual([]);
+
+    expect(shell.bumped).toEqual([]);
+  });
 });
 
 function releaseTarget(
@@ -161,7 +230,7 @@ class RecordingRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
   }
 
   async pushReleaseRefs(packages: ReleasePackageInfo[]): Promise<boolean> {
-    this.pushes.push(packageNames(packages));
+    this.pushes.push(packages.map((pkg) => releaseTag(pkg)));
     return true;
   }
 
@@ -183,8 +252,9 @@ class RecordingRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
     return packages.filter((pkg) => this.githubMissing.has(pkg.name));
   }
 
-  async createGithubRelease(pkg: ReleasePackageInfo, dryRun: boolean): Promise<void> {
+  async createGithubRelease(pkg: ReleasePackageInfo, dryRun: boolean): Promise<string | null> {
     this.githubCreates.push({ name: pkg.name, dryRun });
+    return dryRun ? null : `https://github.test/${releaseTag(pkg)}`;
   }
 
   async checkout(ref: string): Promise<void> {
@@ -205,15 +275,18 @@ class RecordingVersionShell implements ReleaseVersionShell<ReleasePackageInfo> {
   private readonly releaseBatches: ReleasePackageInfo[][];
   private readonly versionPackages: ReleasePackageInfo[];
   private readonly heads: string[];
+  private readonly preview: ReleasePackageInfo[];
 
   constructor(options: {
     releasePackagesAtHead: ReleasePackageInfo[][];
     releaseVersionPackages?: ReleasePackageInfo[];
     heads?: string[];
+    preview?: ReleasePackageInfo | ReleasePackageInfo[];
   }) {
     this.releaseBatches = [...options.releasePackagesAtHead];
     this.versionPackages = options.releaseVersionPackages ?? [stable, prerelease];
     this.heads = [...(options.heads ?? [])];
+    this.preview = Array.isArray(options.preview) ? options.preview : options.preview ? [options.preview] : [];
   }
 
   async releasePackagesAtHead(): Promise<ReleasePackageInfo[]> {
@@ -232,8 +305,13 @@ class RecordingVersionShell implements ReleaseVersionShell<ReleasePackageInfo> {
     return this.heads.shift() ?? 'head';
   }
 
-  async runNxReleaseVersion(packages: ReleasePackageInfo[], bump: string, dryRun: boolean): Promise<void> {
+  async runNxReleaseVersion(
+    packages: ReleasePackageInfo[],
+    bump: string,
+    dryRun: boolean,
+  ): Promise<ReleasePackageInfo[]> {
     this.nxRuns.push({ packages: packageNames(packages), bump, dryRun });
+    return this.preview;
   }
 
   async assertCleanGitTree(): Promise<void> {
@@ -241,6 +319,14 @@ class RecordingVersionShell implements ReleaseVersionShell<ReleasePackageInfo> {
   }
 }
 
+class RecordingNextShell {
+  readonly bumped: string[][] = [];
+
+  async bumpStablePackagesToNext(packages: ReleasePackageInfo[]): Promise<void> {
+    this.bumped.push(packageNames(packages));
+  }
+}
+
 function packageNames(packages: ReleasePackageInfo[]): string[] {
   return packages.map((pkg) => pkg.name);
 }

package/src/release/__tests__/retag-unpublished.test.ts

@@ -13,25 +13,25 @@ describe('retag unpublished releases', () => {
   it('moves unpublished owned tags, pushes with a remote lease, and dispatches publish auto', async () => {
     const shell = new RecordingRetagShell({
       versionAtRef: '1.2.3',
-      remoteTagObjects: new Map([['@scope/pkg@1.2.3', 'old-tag-object']]),
+      remoteTagObjects: new Map([['pkg@1.2.3', 'old-tag-object']]),
       dispatchSha: 'target-sha',
     });
 
     const updates = await retagUnpublished(shell, retagOptions({ push: true, dispatch: true }));
 
-    expect(updates).toEqual([{ tag: '@scope/pkg@1.2.3', pkg, expectedRemoteObject: 'old-tag-object' }]);
-    expect(shell.movedTags).toEqual([{ tag: '@scope/pkg@1.2.3', ref: 'HEAD' }]);
-    expect(shell.pushed).toEqual([[{ tag: '@scope/pkg@1.2.3', expectedRemoteObject: 'old-tag-object' }]]);
+    expect(updates).toEqual([{ tag: 'pkg@1.2.3', pkg, expectedRemoteObject: 'old-tag-object' }]);
+    expect(shell.movedTags).toEqual([{ tag: 'pkg@1.2.3', ref: 'HEAD' }]);
+    expect(shell.pushed).toEqual([[{ tag: 'pkg@1.2.3', expectedRemoteObject: 'old-tag-object' }]]);
     expect(shell.dispatched).toEqual([{ workflow: 'publish.yml', branch: 'main' }]);
     expect(shell.dispatchRefLookups).toEqual(['main']);
-    expect(shell.remoteTagLookups).toEqual(['@scope/pkg@1.2.3']);
+    expect(shell.remoteTagLookups).toEqual(['pkg@1.2.3']);
   });
 
   it('rejects tags whose package version already exists on npm', async () => {
     const shell = new RecordingRetagShell({ versionAtRef: '1.2.3', npmPublished: true });
 
     await expect(retagUnpublished(shell, retagOptions())).rejects.toThrow(
-      'Cannot retag @scope/pkg@1.2.3: @scope/pkg@1.2.3 already exists on npm.',
+      'Cannot retag pkg@1.2.3: @scope/pkg@1.2.3 already exists on npm.',
     );
 
     expect(shell.movedTags).toEqual([]);
@@ -42,7 +42,7 @@ describe('retag unpublished releases', () => {
     const shell = new RecordingRetagShell({ versionAtRef: '1.2.4' });
 
     await expect(retagUnpublished(shell, retagOptions())).rejects.toThrow(
-      'Release tag @scope/pkg@1.2.3 cannot move to HEAD: packages/pkg/package.json has version 1.2.4, expected 1.2.3.',
+      'Release tag pkg@1.2.3 cannot move to HEAD: packages/pkg/package.json has version 1.2.4, expected 1.2.3.',
     );
   });
 
@@ -66,7 +66,7 @@ describe('retag unpublished releases', () => {
     expect(shell.movedTags).toEqual([]);
     expect(shell.pushed).toEqual([]);
     expect(shell.dispatched).toEqual([]);
-    expect(shell.logs).toContain('Would move @scope/pkg@1.2.3 to HEAD (target-sha).');
+    expect(shell.logs).toContain('Would move pkg@1.2.3 to HEAD (target-sha).');
     expect(shell.logs).toContain('Would push 1 retagged release tag.');
     expect(shell.logs).toContain('Would dispatch publish.yml on main with bump=auto.');
   });
@@ -74,7 +74,7 @@ describe('retag unpublished releases', () => {
 
 function retagOptions(overrides: Partial<RetagUnpublishedOptions> = {}): RetagUnpublishedOptions {
   return {
-    tags: ['@scope/pkg@1.2.3'],
+    tags: ['pkg@1.2.3'],
     toRef: 'HEAD',
     push: false,
     dispatch: false,

package/src/release/__tests__/trust-publisher.test.ts

@@ -1,7 +1,12 @@
 import { describe, expect, it } from 'bun:test';
 import type { BootstrapNpmPackagesOptions } from '../bootstrap-npm-packages.js';
 import type { ReleasePackageInfo } from '../core.js';
-import { configureTrustedPublishers, type TrustPublisherShell } from '../index.js';
+import {
+  configureTrustedPublishers,
+  parseTrustedPublishers,
+  type TrustedPublisher,
+  type TrustPublisherShell,
+} from '../index.js';
 
 const stable: ReleasePackageInfo = {
   name: '@scope/stable',
@@ -20,52 +25,86 @@ describe('trusted publisher setup', () => {
   it('bootstraps missing npm packages before configuring trust', async () => {
     const shell = new RecordingTrustPublisherShell({ packages: [stable, missing], existing: [stable.name] });
 
-    await configureTrustedPublishers(shell, { bootstrap: true, skipLogin: false, otp: '123456' });
+    await configureTrustedPublishers(shell, { bootstrap: true, skipLogin: false });
 
     expect(shell.events).toEqual([
       'bootstrap:false:false',
       `exists:${stable.name}`,
       `exists:${missing.name}`,
-      `trust:${stable.name}:false:123456`,
-      `trust:${missing.name}:false:123456`,
+      `list:${stable.name}`,
+      `trust:${stable.name}:false`,
+      `list:${missing.name}`,
+      `trust:${missing.name}:false`,
     ]);
-    expect(shell.logins).toBe(0);
   });
 
   it('directs missing packages to trust-publisher --bootstrap', async () => {
     const shell = new RecordingTrustPublisherShell({ packages: [missing], existing: [] });
 
-    await expect(configureTrustedPublishers(shell, { otp: '123456' })).rejects.toThrow(
+    await expect(configureTrustedPublishers(shell, {})).rejects.toThrow(
       'Run smoo release trust-publisher --bootstrap locally',
     );
     expect(shell.events).toEqual([`exists:${missing.name}`]);
   });
 
-  it('still logs in for trust when bootstrap finds no missing packages', async () => {
+  it('does not pre-login before trust operations', async () => {
     const shell = new RecordingTrustPublisherShell({ packages: [stable], existing: [stable.name] });
 
-    await configureTrustedPublishers(shell, { bootstrap: true, otp: '123456' });
+    await configureTrustedPublishers(shell, { bootstrap: true });
 
     expect(shell.events).toEqual([
       'bootstrap:false:false',
       `exists:${stable.name}`,
-      `trust:${stable.name}:false:123456`,
+      `list:${stable.name}`,
+      `trust:${stable.name}:false`,
     ]);
-    expect(shell.logins).toBe(1);
   });
 
-  it('treats npm trust conflicts as already configured', async () => {
+  it('skips packages with matching trusted publishers', async () => {
     const shell = new RecordingTrustPublisherShell({
       packages: [stable],
       existing: [stable.name],
-      alreadyTrusted: [stable.name],
+      trustedPublishers: {
+        [stable.name]: [{ id: 'trusted-1', type: 'github', file: 'publish.yml', repository: 'scope/repo' }],
+      },
     });
 
-    await configureTrustedPublishers(shell, { skipLogin: true, otp: '123456' });
+    await configureTrustedPublishers(shell, { skipLogin: true });
 
-    expect(shell.events).toEqual([`exists:${stable.name}`, `trust:${stable.name}:false:123456`]);
+    expect(shell.events).toEqual([`exists:${stable.name}`, `list:${stable.name}`]);
     expect(shell.logs).toContain(`${stable.name}: npm trusted publisher is already configured; skipping.`);
   });
+
+  it('rejects mismatched trusted publishers', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      trustedPublishers: {
+        [stable.name]: [{ id: 'trusted-1', type: 'github', file: 'other.yml', repository: 'scope/repo' }],
+      },
+    });
+
+    await expect(configureTrustedPublishers(shell, { skipLogin: true })).rejects.toThrow(
+      'npm trusted publisher exists but does not match',
+    );
+    expect(shell.events).toEqual([`exists:${stable.name}`, `list:${stable.name}`]);
+  });
+
+  it('configures only selected packages', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable, missing],
+      existing: [stable.name, missing.name],
+    });
+
+    await configureTrustedPublishers(shell, { skipLogin: true, packages: [missing.name] });
+
+    expect(shell.events).toEqual([`exists:${missing.name}`, `list:${missing.name}`, `trust:${missing.name}:false`]);
+  });
+
+  it('parses empty npm trust list output as no trusted publishers', () => {
+    expect(parseTrustedPublishers('', stable.name)).toEqual([]);
+    expect(parseTrustedPublishers('null', stable.name)).toEqual([]);
+  });
 });
 
 class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackageInfo> {
@@ -74,15 +113,18 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
   readonly events: string[] = [];
   readonly logs: string[] = [];
   readonly errors: string[] = [];
-  logins = 0;
   private readonly packages: ReleasePackageInfo[];
   private readonly existing: Set<string>;
-  private readonly alreadyTrusted: Set<string>;
+  private readonly trustedPublisherByPackage: Record<string, TrustedPublisher[]>;
 
-  constructor(options: { packages: ReleasePackageInfo[]; existing: string[]; alreadyTrusted?: string[] }) {
+  constructor(options: {
+    packages: ReleasePackageInfo[];
+    existing: string[];
+    trustedPublishers?: Record<string, TrustedPublisher[]>;
+  }) {
     this.packages = options.packages;
     this.existing = new Set(options.existing);
-    this.alreadyTrusted = new Set(options.alreadyTrusted ?? []);
+    this.trustedPublisherByPackage = options.trustedPublishers ?? {};
   }
 
   listReleasePackages(): ReleasePackageInfo[] {
@@ -103,24 +145,14 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
     return missingPackages;
   }
 
-  async login(): Promise<void> {
-    this.logins += 1;
-  }
-
-  async trustPublisher(
-    pkg: ReleasePackageInfo,
-    dryRun: boolean,
-    env?: Record<string, string>,
-  ): Promise<'configured' | 'already-configured'> {
-    this.events.push(`trust:${pkg.name}:${dryRun}:${env?.NPM_CONFIG_OTP ?? ''}`);
-    if (this.alreadyTrusted.has(pkg.name)) {
-      return 'already-configured';
-    }
+  async trustPublisher(pkg: ReleasePackageInfo, dryRun: boolean): Promise<'configured' | 'already-configured'> {
+    this.events.push(`trust:${pkg.name}:${dryRun}`);
     return 'configured';
   }
 
-  async promptOtp(packageName: string): Promise<string> {
-    throw new Error(`unexpected OTP prompt for ${packageName}`);
+  async trustedPublishers(pkg: ReleasePackageInfo): Promise<TrustedPublisher[]> {
+    this.events.push(`list:${pkg.name}`);
+    return this.trustedPublisherByPackage[pkg.name] ?? [];
   }
 
   log(message: string): void {

package/src/release/candidates.ts

@@ -62,7 +62,7 @@ async function isAutoReleaseCandidate<Package extends ReleasePackageInfo>(
   if (await shell.gitRefExists(tagRef)) {
     return packageHasReleasableChangesSince(shell, tagRef, pkg);
   }
-  return shell.packageHasHistory(pkg.path);
+  return !pkg.version.includes('-') && shell.packageHasHistory(pkg.path);
 }
 
 async function packageHasReleasableChangesSince<Package extends ReleasePackageInfo>(

package/src/release/core.ts

@@ -44,10 +44,18 @@ export interface ReleasePlanningShell {
   durableTagState(pkg: ReleasePackageInfo, tag: string): Promise<DurableTagState>;
 }
 
-export function releaseTag(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>): string {
+export function releaseTag(pkg: Pick<ReleasePackageInfo, 'projectName' | 'version'>): string {
+  return `${pkg.projectName}@${pkg.version}`;
+}
+
+export function legacyReleaseTag(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>): string {
   return `${pkg.name}@${pkg.version}`;
 }
 
+export function releaseTagAliases(pkg: Pick<ReleasePackageInfo, 'name' | 'projectName' | 'version'>): string[] {
+  return [...new Set([releaseTag(pkg), legacyReleaseTag(pkg)])];
+}
+
 export function npmDistTagForVersion(version: string): string {
   return version.includes('-') ? 'next' : 'latest';
 }
@@ -57,7 +65,7 @@ export function releasePackageForTag<Package extends Omit<ReleasePackageInfo, 'v
   tag: string,
 ): { pkg: Package; version: string } | null {
   for (const pkg of packages) {
-    const prefix = `${pkg.name}@`;
+    const prefix = `${pkg.projectName}@`;
     if (tag.startsWith(prefix)) {
       const version = tag.slice(prefix.length);
       if (!version) {
@@ -85,13 +93,14 @@ export async function collectOwnedReleaseTagRecords<Package extends Omit<Release
   ref: string,
   shell: ReleasePlanningShell,
 ): Promise<Array<ReleaseTagRecord<Package & { version: string }>>> {
-  const records: Array<ReleaseTagRecord<Package & { version: string }>> = [];
-  const completedPackages = new Set<string>();
+  const candidates: Array<{
+    tag: GitReleaseTagInfo;
+    pkg: Package & { version: string };
+  }> = [];
+  const durableStates = new BoundedPromiseRunner(8);
+
   for (const tag of await shell.listReleaseTagsByCreatorDate()) {
     const match = releasePackageForTag(packages, tag.name);
-    if (match && completedPackages.has(match.pkg.name)) {
-      continue;
-    }
     if (!match || !(await shell.isAncestor(tag.sha, ref))) {
       continue;
     }
@@ -104,15 +113,91 @@ export async function collectOwnedReleaseTagRecords<Package extends Omit<Release
       );
     }
     const pkg = { ...match.pkg, version: match.version };
-    const state = await shell.durableTagState(pkg, tag.name);
-    records.push(classifyReleaseTag({ tag: tag.name, sha: tag.sha, timestamp: tag.timestamp, pkg }, state));
+    candidates.push({ tag, pkg });
+  }
+
+  const records: Array<ReleaseTagRecord<Package & { version: string }>> = [];
+  const completedPackages = new Set<string>();
+  const activePackages = new Set<string>();
+  const states = new Map<number, Promise<DurableTagState>>();
+
+  // Run durable-state checks concurrently across packages, but do not query an
+  // older tag for the same package until its newer tag proves incomplete.
+  const scheduleFrom = (startIndex: number) => {
+    for (let index = startIndex; index < candidates.length; index += 1) {
+      if (states.size >= 8) {
+        return;
+      }
+      const candidate = candidates[index];
+      if (!candidate || states.has(index) || completedPackages.has(candidate.pkg.name)) {
+        continue;
+      }
+      if (activePackages.has(candidate.pkg.name)) {
+        continue;
+      }
+      activePackages.add(candidate.pkg.name);
+      states.set(
+        index,
+        durableStates.run(() => shell.durableTagState(candidate.pkg, candidate.tag.name)),
+      );
+    }
+  };
+
+  for (const candidate of candidates) {
+    const index = candidates.indexOf(candidate);
+    scheduleFrom(index);
+    if (completedPackages.has(candidate.pkg.name)) {
+      continue;
+    }
+    const state = await states.get(index);
+    if (!state) {
+      throw new Error(`Release tag ${candidate.tag.name} lost durable state planning.`);
+    }
+    activePackages.delete(candidate.pkg.name);
+    states.delete(index);
+    records.push(
+      classifyReleaseTag(
+        { tag: candidate.tag.name, sha: candidate.tag.sha, timestamp: candidate.tag.timestamp, pkg: candidate.pkg },
+        state,
+      ),
+    );
     if (state.npmPublished && state.githubReleaseExists) {
-      completedPackages.add(pkg.name);
+      completedPackages.add(candidate.pkg.name);
     }
   }
   return records;
 }
 
+class BoundedPromiseRunner {
+  private active = 0;
+  private readonly waiting: Array<() => void> = [];
+
+  constructor(private readonly limit: number) {}
+
+  async run<T>(operation: () => Promise<T>): Promise<T> {
+    await this.acquire();
+    try {
+      return await operation();
+    } finally {
+      this.release();
+    }
+  }
+
+  private async acquire(): Promise<void> {
+    if (this.active < this.limit) {
+      this.active += 1;
+      return;
+    }
+    await new Promise<void>((resolve) => this.waiting.push(resolve));
+    this.active += 1;
+  }
+
+  private release(): void {
+    this.active -= 1;
+    this.waiting.shift()?.();
+  }
+}
+
 export function groupReleaseTargets<Package extends ReleasePackageInfo>(
   records: ReleaseTagRecord<Package>[],
 ): ReleaseTarget<Package>[] {

package/src/release/github-release.ts

@@ -112,7 +112,7 @@ function isPrereleaseVersion(version: string): boolean {
   return version.includes('-');
 }
 
-async function withNxWorkspaceRoot<T>(root: string, run: () => Promise<T>): Promise<T> {
+export async function withNxWorkspaceRoot<T>(root: string, run: () => Promise<T>): Promise<T> {
   const workspaceRootModule = await import('nx/src/utils/workspace-root.js');
   const previousWorkspaceRoot = workspaceRootModule.workspaceRoot;
   const previousEnvWorkspaceRoot = process.env.NX_WORKSPACE_ROOT_PATH;