@williamthorsen/release-kit 10.0.0 → 10.2.0

package/.readyup/kits/default.js

@@ -0,0 +1,293 @@
+/** @noformat — @generated. Do not edit. Compiled by rdy. */
+/* eslint-disable */
+export const __readyupVersion = "0.23.0";
+
+
+// .readyup/kits/default.ts
+import { defineRdyKit } from "readyup";
+import {
+  discoverWorkspaces,
+  fileContains,
+  fileDoesNotContain,
+  fileExists,
+  fileMatchesHash,
+  hasDevDependency,
+  hasMinDevDependencyVersion,
+  readFile
+} from "readyup/check-utils";
+
+// src/init/detectRepoType.ts
+import { existsSync, readFileSync } from "node:fs";
+
+// src/typeGuards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/init/parseJsonRecord.ts
+function parseJsonRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  return isRecord(parsed) ? parsed : void 0;
+}
+
+// src/init/detectRepoType.ts
+function detectRepoType() {
+  if (existsSync("pnpm-workspace.yaml")) {
+    return "monorepo";
+  }
+  if (existsSync("package.json")) {
+    const raw = readFileSync("package.json", "utf8");
+    const pkg = parseJsonRecord(raw);
+    if (pkg !== void 0 && Array.isArray(pkg.workspaces)) {
+      return "monorepo";
+    }
+  }
+  return "single-package";
+}
+
+// .readyup/kits/default.ts
+function getMinVersion() {
+  const picked = { "version": "10.2.0" };
+  if (typeof picked.version !== "string") {
+    throw new TypeError("release-kit/package.json: 'version' must be a string");
+  }
+  return picked.version;
+}
+function hasPublishablePackages() {
+  return discoverWorkspaces({ filter: (w) => w.isPackage }).length > 0;
+}
+var CLIFF_TEMPLATE_HASH = "93b72e0b1393cd6b1fe8e2a0e303cd326fd323435951b0493396b305af32d2ec";
+var COMMON_PRESET_HASH = "86f9e1db9000793a91168e8c6b5695311a422ee208121324549c068fe67fa184";
+var SYNC_LABELS_WORKFLOW_HASH = "d6e2403fb551d2d415f679125989c92760444eec887644565b2e05c9bf8f4c1e";
+var RELEASE_WORKFLOW_HASH_MONOREPO = "0a9724b7b3c5e24087fd3a8f36fed8e990d699267fcf36028ce048ab40dc2946";
+var RELEASE_WORKFLOW_HASH_SINGLE = "a3d19bbc1ba8bb30622e53c590137b97e3179e80988c0967737b021cdaeab73f";
+var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";
+var PUBLISH_WORKFLOW_HASH_SINGLE = "6f31183e0a1e66be791a19266c3b028dadbd9fe010f7fc4452f3f8970c937b43";
+var default_default = defineRdyKit({
+  checklists: [
+    {
+      name: "release-kit",
+      checks: [
+        {
+          name: "@williamthorsen/release-kit in devDependencies",
+          severity: "error",
+          check: () => hasDevDependency("@williamthorsen/release-kit"),
+          fix: "pnpm add --save-dev @williamthorsen/release-kit",
+          checks: [
+            {
+              get name() {
+                return `@williamthorsen/release-kit >= ${getMinVersion()}`;
+              },
+              severity: "error",
+              check: () => hasMinDevDependencyVersion("@williamthorsen/release-kit", getMinVersion(), {
+                exempt: (range) => range.startsWith("workspace:")
+              }),
+              get fix() {
+                return `pnpm add --save-dev @williamthorsen/release-kit@^${getMinVersion()}`;
+              }
+            }
+          ]
+        },
+        {
+          name: "release.yaml workflow exists",
+          severity: "warn",
+          check: () => fileExists(".github/workflows/release.yaml"),
+          fix: "Add .github/workflows/release.yaml using the release workflow template",
+          checks: [
+            {
+              name: "release.yaml matches template",
+              severity: "warn",
+              check: () => {
+                const hash = detectRepoType() === "monorepo" ? RELEASE_WORKFLOW_HASH_MONOREPO : RELEASE_WORKFLOW_HASH_SINGLE;
+                return fileMatchesHash(".github/workflows/release.yaml", hash);
+              },
+              fix: "Run `release-kit init --force` to regenerate release.yaml from the current template"
+            },
+            {
+              name: "release.yaml does not reference deprecated tag ref",
+              severity: "error",
+              check: () => fileDoesNotContain(".github/workflows/release.yaml", /@(release|publish)-workflow-v[0-9]/),
+              fix: "Update release.yaml to use @workflow/release-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
+            }
+          ]
+        },
+        {
+          name: "publish.yaml workflow exists",
+          severity: "warn",
+          skip: () => !hasPublishablePackages() ? "no publishable packages" : false,
+          check: () => fileExists(".github/workflows/publish.yaml"),
+          fix: "Add .github/workflows/publish.yaml using the publish workflow template",
+          checks: [
+            {
+              name: "publish.yaml matches template",
+              severity: "warn",
+              check: () => {
+                const hash = detectRepoType() === "monorepo" ? PUBLISH_WORKFLOW_HASH_MONOREPO : PUBLISH_WORKFLOW_HASH_SINGLE;
+                return fileMatchesHash(".github/workflows/publish.yaml", hash);
+              },
+              fix: "Run `release-kit init --force` to regenerate publish.yaml from the current template"
+            },
+            {
+              name: "publish.yaml does not reference deprecated tag ref",
+              severity: "error",
+              check: () => fileDoesNotContain(".github/workflows/publish.yaml", /@(release|publish)-workflow-v[0-9]/),
+              fix: "Update publish.yaml to use @workflow/publish-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
+            }
+          ]
+        },
+        {
+          name: "releaseNotes config is consistent with changelogJson",
+          severity: "warn",
+          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
+          check: () => releaseNotesConfigIsConsistent(),
+          fix: "Either enable changelogJson.enabled or disable releaseNotes.shouldInjectIntoReadme"
+        },
+        {
+          name: "config does not use removed releaseNotes.shouldCreateGithubRelease",
+          severity: "error",
+          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
+          check: () => fileDoesNotContain(".config/release-kit.config.ts", /shouldCreateGithubRelease/),
+          fix: "Remove 'shouldCreateGithubRelease' from .config/release-kit.config.ts. Adoption of GitHub Releases is now signaled by installing the create-github-release workflow (see release-kit README for setup)."
+        },
+        {
+          name: ".config/release-kit.config.ts uses defineConfig",
+          severity: "recommend",
+          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
+          check: () => fileContains(".config/release-kit.config.ts", /defineConfig/),
+          fix: "Wrap your config export with defineConfig() from @williamthorsen/release-kit/config for type safety"
+        },
+        {
+          name: "releaseNotes.shouldInjectIntoReadme is true",
+          severity: "warn",
+          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
+          check: () => releaseNotesInjectsIntoReadme(),
+          fix: "Set releaseNotes.shouldInjectIntoReadme to true in .config/release-kit.config.ts",
+          checks: [
+            {
+              name: "README contains release-notes section markers",
+              severity: "warn",
+              check: readmesHaveReleaseNotesMarkers,
+              fix: "Add `<!-- section:release-notes -->` and `<!-- /section:release-notes -->` markers to each affected README"
+            }
+          ]
+        },
+        {
+          name: "git-cliff not in devDependencies",
+          severity: "recommend",
+          check: () => !hasDevDependency("git-cliff"),
+          fix: "pnpm remove git-cliff \u2014 release-kit handles changelog generation directly"
+        },
+        {
+          name: ".config/git-cliff.toml matches current template",
+          severity: "warn",
+          skip: () => !fileExists(".config/git-cliff.toml") ? "no local cliff config (using fallback)" : false,
+          check: () => fileMatchesHash(".config/git-cliff.toml", CLIFF_TEMPLATE_HASH),
+          fix: "Update .config/git-cliff.toml to match the current cliff.toml.template from release-kit, or delete it to use the bundled fallback"
+        },
+        {
+          name: "sync-labels.yaml workflow exists",
+          severity: "warn",
+          check: () => fileExists(".github/workflows/sync-labels.yaml"),
+          fix: "Run `release-kit sync-labels init` to scaffold the workflow",
+          checks: [
+            {
+              name: "sync-labels.yaml matches template",
+              severity: "warn",
+              check: () => fileMatchesHash(".github/workflows/sync-labels.yaml", SYNC_LABELS_WORKFLOW_HASH),
+              fix: "Run `release-kit sync-labels init --force` to regenerate the workflow from the current template"
+            }
+          ]
+        },
+        {
+          name: "sync-labels.yaml does not reference deprecated tag ref",
+          severity: "error",
+          check: () => fileDoesNotContain(".github/workflows/sync-labels.yaml", /@sync-labels-workflow-v[0-9]/),
+          fix: "Update sync-labels.yaml to use @workflow/sync-labels-v1 (run `release-kit sync-labels init --force` to regenerate, or replace the ref manually)"
+        },
+        {
+          name: "retired .config/sync-labels.config.ts is absent",
+          severity: "error",
+          check: () => !fileExists(".config/sync-labels.config.ts"),
+          fix: "Move the labels into the repoLabels block of .config/release-kit.config.ts, then delete .config/sync-labels.config.ts"
+        },
+        {
+          name: "repoLabels block declared in .config/release-kit.config.ts",
+          severity: "recommend",
+          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
+          check: () => fileContains(".config/release-kit.config.ts", /repoLabels/),
+          fix: "Run `release-kit sync-labels init` to seed a repoLabels block, then customize labels"
+        },
+        {
+          name: ".github/labels.yaml exists",
+          severity: "warn",
+          skip: () => !fileContains(".config/release-kit.config.ts", /repoLabels/) ? "no repoLabels config" : false,
+          check: () => fileExists(".github/labels.yaml"),
+          fix: "Run `release-kit sync-labels generate` to produce the labels file",
+          checks: [
+            {
+              name: "labels.yaml has current common preset",
+              severity: "warn",
+              check: () => labelsHaveCurrentPresetHash("common", COMMON_PRESET_HASH),
+              fix: "Run `release-kit sync-labels generate` to incorporate updated common labels"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+});
+function labelsHaveCurrentPresetHash(presetName, expectedHash) {
+  const content = readFile(".github/labels.yaml");
+  if (content === void 0) return false;
+  const pattern = new RegExp(`^# ${presetName} preset hash: (.+)$`, "m");
+  const match = pattern.exec(content);
+  return match !== null && match[1] === expectedHash;
+}
+function readmeHasReleaseNotesMarkers(content) {
+  return content.includes("<!-- section:release-notes -->") && content.includes("<!-- /section:release-notes -->");
+}
+function readmesHaveReleaseNotesMarkers() {
+  const failing = [];
+  for (const { dir } of discoverWorkspaces({ filter: (w) => w.isPackage })) {
+    const readmePath = dir === "." ? "README.md" : `${dir}/README.md`;
+    const content = readFile(readmePath);
+    if (content === void 0 || !readmeHasReleaseNotesMarkers(content)) {
+      failing.push(readmePath);
+    }
+  }
+  if (failing.length === 0) return true;
+  return {
+    ok: false,
+    detail: `missing markers or README: ${failing.join(", ")}`
+  };
+}
+function releaseNotesConfigIsConsistent() {
+  const content = readFile(".config/release-kit.config.ts");
+  if (content === void 0) return true;
+  const changelogJsonDisabled = /changelogJson\s*:\s*\{[^}]*enabled\s*:\s*false/.test(content);
+  if (!changelogJsonDisabled) return true;
+  const hasReadmeInjection = /shouldInjectIntoReadme\s*:\s*true/.test(content);
+  return !hasReadmeInjection;
+}
+function releaseNotesInjectsIntoReadme() {
+  const content = readFile(".config/release-kit.config.ts");
+  if (content === void 0) return false;
+  return /shouldInjectIntoReadme\s*:\s*true/.test(content);
+}
+export {
+  CLIFF_TEMPLATE_HASH,
+  COMMON_PRESET_HASH,
+  PUBLISH_WORKFLOW_HASH_MONOREPO,
+  PUBLISH_WORKFLOW_HASH_SINGLE,
+  RELEASE_WORKFLOW_HASH_MONOREPO,
+  RELEASE_WORKFLOW_HASH_SINGLE,
+  SYNC_LABELS_WORKFLOW_HASH,
+  default_default as default,
+  readmeHasReleaseNotesMarkers,
+  readmesHaveReleaseNotesMarkers
+};

package/.readyup/kits/npm-auto-publish.js

@@ -0,0 +1,235 @@
+/** @noformat — @generated. Do not edit. Compiled by rdy. */
+/* eslint-disable */
+export const __readyupVersion = "0.23.0";
+
+
+// .readyup/kits/npm-auto-publish.ts
+import { execSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { defineRdyChecklist, defineRdyKit, defineRdyStagedChecklist } from "readyup";
+import {
+  discoverWorkspaces,
+  fileContains,
+  fileExists,
+  getJsonValue,
+  isRecord,
+  readFile,
+  readJsonFile
+} from "readyup/check-utils";
+var PUBLISH_WORKFLOW_FILE = "publish.yaml";
+var repoChecklist = defineRdyStagedChecklist({
+  name: "repo",
+  preconditions: [
+    {
+      name: "publish.yaml exists",
+      check: () => fileExists(".github/workflows/publish.yaml"),
+      fix: 'Run "release-kit init" to scaffold the publish workflow, or create .github/workflows/publish.yaml manually'
+    }
+  ],
+  groups: [
+    [
+      {
+        name: "id-token: write permission declared",
+        check: () => fileContains(".github/workflows/publish.yaml", /id-token:\s*write/),
+        fix: 'Add "permissions: { id-token: write, contents: read }" to .github/workflows/publish.yaml \u2014 required for OIDC-based npm authentication'
+      },
+      {
+        name: "No legacy token references in workflow files",
+        check: () => !hasTokenReferences(),
+        fix: "Remove NPM_TOKEN/NODE_AUTH_TOKEN references from workflow files; OIDC auth replaces token-based auth"
+      },
+      {
+        name: "Provenance setting matches repo visibility",
+        check: checkProvenanceMatchesVisibility
+      }
+    ]
+  ]
+});
+var packagesChecklist = defineRdyChecklist({
+  name: "packages",
+  preconditions: [
+    {
+      name: 'packageManager field starts with "pnpm"',
+      check: () => {
+        const rootPkg = readJsonFile("package.json");
+        const pm = typeof rootPkg?.packageManager === "string" ? rootPkg.packageManager : "";
+        return pm.startsWith("pnpm");
+      },
+      fix: 'Set "packageManager": "pnpm@..." in root package.json'
+    },
+    {
+      name: "At least one workspace discovered",
+      check: () => discoverWorkspaces().length > 0,
+      fix: "Ensure pnpm-workspace.yaml lists package globs, or that a root package.json exists"
+    }
+  ],
+  get checks() {
+    return discoverWorkspaces().map((workspace) => buildWorkspaceCheck(workspace));
+  }
+});
+var npm_auto_publish_default = defineRdyKit({
+  fixLocation: "inline",
+  checklists: [repoChecklist, packagesChecklist]
+});
+function buildWorkspaceCheck(workspace) {
+  const displayName = workspace.name ?? "(unnamed)";
+  const pkgJsonPath = path.join(workspace.dir, "package.json");
+  const children = [
+    {
+      name: "repository field exists",
+      check: () => workspace.packageJson.repository !== void 0 && workspace.packageJson.repository !== null,
+      fix: `Add a "repository" field to ${pkgJsonPath} pointing to the GitHub repo`
+    }
+  ];
+  if (workspace.name?.startsWith("@")) {
+    children.push({
+      name: 'publishConfig.access is "public"',
+      check: () => {
+        const access = getJsonValue(workspace.packageJson, "publishConfig", "access");
+        return typeof access === "string" && access === "public";
+      },
+      fix: `Add "publishConfig": { "access": "public" } to ${pkgJsonPath}`
+    });
+  }
+  children.push(
+    {
+      name: "published to npm",
+      check: () => isPublishedToNpm(displayName),
+      fix: `Run "npm publish --access public" from ${workspace.dir} to bootstrap the package on npm`,
+      checks: [
+        {
+          name: "trusted publisher configured",
+          check: () => hasTrustedPublisher(displayName, getCachedOwnerRepo(), PUBLISH_WORKFLOW_FILE),
+          get fix() {
+            return `Run: npm trust github ${displayName} --repo ${getCachedOwnerRepo()} --file ${PUBLISH_WORKFLOW_FILE}`;
+          }
+        }
+      ]
+    },
+    {
+      name: "files field exists",
+      severity: "warn",
+      check: () => workspace.packageJson.files !== void 0,
+      fix: `Add a "files" field to ${pkgJsonPath} to control which files are included in the published tarball`
+    }
+  );
+  return {
+    name: displayName,
+    skip: () => skipIfNotPublishable(workspace),
+    check: () => true,
+    checks: children
+  };
+}
+function checkProvenanceMatchesVisibility() {
+  const workflowPath = ".github/workflows/publish.yaml";
+  const content = readFile(workflowPath);
+  if (content === void 0) {
+    return { ok: false, detail: `Cannot read ${workflowPath} \u2014 check file permissions` };
+  }
+  const hasProvenance = parseProvenanceSetting(content);
+  let isPrivate;
+  try {
+    isPrivate = isRepoPrivate();
+  } catch {
+    return { ok: false, detail: "Install and authenticate the GitHub CLI: gh auth login" };
+  }
+  if (!isPrivate && !hasProvenance) {
+    return {
+      ok: false,
+      detail: "Set provenance: true in .github/workflows/publish.yaml \u2014 public repos should generate provenance attestations"
+    };
+  }
+  if (isPrivate && hasProvenance) {
+    return {
+      ok: false,
+      detail: "Make the GitHub repo public \u2014 OIDC publishing with provenance requires a public repo"
+    };
+  }
+  return { ok: true };
+}
+var cachedOwnerRepo;
+function getCachedOwnerRepo() {
+  if (cachedOwnerRepo === void 0) {
+    cachedOwnerRepo = getOwnerRepo();
+  }
+  return cachedOwnerRepo;
+}
+function getOwnerRepo() {
+  const url = execSync("git remote get-url origin", {
+    encoding: "utf8"
+  }).trim();
+  const sshMatch = url.match(/git@github\.com:(.+?)(?:\.git)?$/);
+  if (sshMatch?.[1]) {
+    return sshMatch[1];
+  }
+  const httpsMatch = url.match(/github\.com\/(.+?)(?:\.git)?$/);
+  if (httpsMatch?.[1]) {
+    return httpsMatch[1];
+  }
+  throw new Error(`Cannot parse GitHub owner/repo from remote URL: ${url}`);
+}
+function hasTokenReferences() {
+  const workflowDir = path.resolve(process.cwd(), ".github/workflows");
+  if (!existsSync(workflowDir)) {
+    return false;
+  }
+  const files = readdirSync(workflowDir).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
+  for (const file of files) {
+    const content = readFileSync(path.join(workflowDir, file), "utf8");
+    if (content.includes("NPM_TOKEN") || content.includes("NODE_AUTH_TOKEN")) {
+      return true;
+    }
+  }
+  return false;
+}
+function hasTrustedPublisher(packageName, expectedRepo, expectedFile) {
+  let output;
+  try {
+    output = execSync(`npm trust list ${packageName} --json`, {
+      encoding: "utf8",
+      stdio: "pipe"
+    });
+  } catch {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(output);
+  } catch {
+    return false;
+  }
+  if (!isRecord(parsed)) {
+    return false;
+  }
+  return parsed.type === "github" && parsed.repository === expectedRepo && parsed.file === expectedFile;
+}
+function isPublishedToNpm(packageName) {
+  try {
+    execSync(`npm view ${packageName} version`, {
+      encoding: "utf8",
+      stdio: "pipe"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isRepoPrivate() {
+  const ownerRepo = getOwnerRepo();
+  const result = execSync(`gh api repos/${ownerRepo} --jq .private`, {
+    encoding: "utf8"
+  }).trim();
+  return result === "true";
+}
+function parseProvenanceSetting(workflowContent) {
+  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
+}
+function skipIfNotPublishable(workspace) {
+  return workspace.isPackage ? false : "package.json#private is true";
+}
+export {
+  buildWorkspaceCheck,
+  npm_auto_publish_default as default,
+  skipIfNotPublishable
+};

package/.readyup/manifest.json

@@ -0,0 +1,28 @@
+{
+  "version": 1,
+  "kits": [
+    {
+      "checklists": [
+        "release-kit"
+      ],
+      "name": "default",
+      "path": "kits/default.js",
+      "readyupVersion": "0.23.0",
+      "source": "kits/default.ts",
+      "sourceHash": "afe26920",
+      "targetHash": "9b3ddc09"
+    },
+    {
+      "checklists": [
+        "repo",
+        "packages"
+      ],
+      "name": "npm-auto-publish",
+      "path": "kits/npm-auto-publish.js",
+      "readyupVersion": "0.23.0",
+      "source": "kits/npm-auto-publish.ts",
+      "sourceHash": "71e894e6",
+      "targetHash": "c1c05255"
+    }
+  ]
+}

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to this project will be documented in this file.
 
+## 10.2.0 — 2026-08-04
+
+### 🎉 Features
+
+- Add status labels and clear grouped-label descriptions (#585)
+
+  Adds two status labels (`status:blocked` and `status:on-hold`) to the common preset and removes descriptions from other scoped labels (`priority:` and `value:`) to keep scoped groups compact in the GitHub UI.
+
+- Publish each package's readyup kit from the package that owns it (#590)
+
+  ReadyUp checks for `@williamthorsen/nmr`, `@williamthorsen/release-kit`, and `v11y-check` are now run directly against these packages, guaranteeing a version-appropriate check, instead of against their host repo. The package must be installed as a direct dependency in the calling repo.
+
+  The syntax is `rdy run --from npm:<package>`. `rdy run --packages` runs the kits contained in any packages listed in `.config/readyup.config.ts`. Requires `readyup` 0.23 or later.
+
+## 10.1.0 — 2026-08-03
+
+### 🎉 Features
+
+- Publish nmr's readyup kit with a test-tier conformance check (#580)
+
+  `@williamthorsen/nmr` is now bundled with ReadyUp kits that check a repo's alignment with `nmr` requirements and recommendations.
+
+  `rdy run --from npm:@williamthorsen/nmr` checks the repo against the kits without prior configuration. Once the package is added to the ReadyUp config, `rdy run --packages` will run the `nmr` kits along with those of any other registered package. Requires `readyup` v0.23 or greater.
+
+### ♻️ Refactoring
+
+- Load the config with Node's TypeScript support instead of jiti (#573)
+
+  `release-kit` now uses native Node with type-stripping to read its configs. `jiti` is no longer needed as a dependency. As a result, relative imports inside `.config/release-kit.config.ts` now require an explicit file extension.
+
 ## 10.0.0 — 2026-08-03
 
 ### 🎉 Features

package/README.md

@@ -5,15 +5,19 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from `git-cliff --context` output rendered in-process (with optional [editorial overrides](#editorial-overrides)).
 
 <!-- section:release-notes -->
-## Release notes — v10.0.0 (2026-08-03)
+## Release notes — v10.2.0 (2026-08-04)
 
 ### 🎉 Features
 
-- 🚨 **Breaking:** Retire integration label in favor of an isolation-tier test ladder (#552)
+- Add status labels and clear grouped-label descriptions (#585)
 
-  Test groups are now named for what a test reaches rather than for how much of the codebase it covers: `integration` and `app` are replaced by `unit`, `tool`, `localhost`, and `remote`.
+  Adds two status labels (`status:blocked` and `status:on-hold`) to the common preset and removes descriptions from other scoped labels (`priority:` and `value:`) to keep scoped groups compact in the GitHub UI.
 
-  `nmr test` now runs the `tool` group alongside `unit`, so the first run after upgrading may fail on tests that nothing was running before. Upgrading means renaming `*.int.test.ts` files onto the new groups and replacing `nmr test:integration` with `nmr test:tool`.
+- Publish each package's readyup kit from the package that owns it (#590)
+
+  ReadyUp checks for `@williamthorsen/nmr`, `@williamthorsen/release-kit`, and `v11y-check` are now run directly against these packages, guaranteeing a version-appropriate check, instead of against their host repo. The package must be installed as a direct dependency in the calling repo.
+
+  The syntax is `rdy run --from npm:<package>`. `rdy run --packages` runs the kits contained in any packages listed in `.config/readyup.config.ts`. Requires `readyup` 0.23 or later.
 <!-- /section:release-notes -->
 
 ## Installation
@@ -69,7 +73,7 @@ That's it for most repos. The CLI auto-discovers workspaces and applies sensible
 ## How it works
 
 1. **Workspace discovery**: reads `pnpm-workspace.yaml` and resolves its `packages` globs to find workspace directories. Each directory containing a `package.json` becomes a workspace. If no workspace file is found, the repo is treated as a single-package project.
-2. **Config loading**: loads `.config/release-kit.config.ts` (if present) via [jiti](https://github.com/unjs/jiti) and merges it with discovered defaults.
+2. **Config loading**: loads `.config/release-kit.config.ts` (if present) and merges it with discovered defaults.
 3. **Commit analysis**: for each workspace, finds commits since the last version tag, parses them for type and scope, and determines the appropriate version bump.
 4. **Version bump + changelog**: bumps `package.json` versions, builds structured `ChangelogEntry[]` from `git-cliff --context`, applies any [editorial overrides](#editorial-overrides) from per-scope `.meta/changelog-overrides.json` files, and renders both `CHANGELOG.md` and `.meta/changelog.json` from that single source. `git-cliff` is invoked only for its `--context` JSON; markdown rendering happens in-process so `.meta/changelog.json` and `CHANGELOG.md` always agree.
 5. **Release tags file**: writes computed tags to `tmp/.release-tags` for the release workflow to read when tagging and pushing.
@@ -115,6 +119,8 @@ export default defineConfig({
 
 `defineConfig` is a type-safe identity function: it gives the config object validation and completion in `.ts` files and full inference in `.js` ones. The loader also accepts a plain `export default config` or `export const config = { ... }`.
 
+Node loads the file directly, so a relative import inside it needs an explicit file extension — `./work-types.ts`, not `./work-types`.
+
 ### `ReleaseKitConfig` reference
 
 | Field              | Type                                                      | Description                                                                                                                                          |
@@ -866,6 +872,32 @@ The body template is intentionally empty: release-kit reads cliff's `--context`
 
 To customize, scaffold a local copy with `release-kit init --with-config` and edit `.config/git-cliff.toml`. Edit only the `[git]` section — body-template changes have no effect.
 
+## Readiness checks
+
+release-kit publishes two [readyup](https://www.npmjs.com/package/readyup) kits that check a consuming repo against the release it has installed: the `default` kit covers release-kit's own setup — workflows matching the current templates, config free of removed fields, sync-labels wiring — and `npm-auto-publish` covers a repo's OIDC-based npm publishing setup. Both ship inside the package, so they check against the version you installed rather than whatever a repository ref happens to point at, and a check added in a release reaches your repo on upgrade.
+
+Add `readyup` as a devDependency, then name release-kit in its config:
+
+```ts
+// .config/readyup.config.ts
+import { defineRdyConfig } from 'readyup';
+
+export default defineRdyConfig({
+  packages: ['@williamthorsen/release-kit'],
+});
+```
+
+```bash
+rdy run --packages                                               # every kit each listed package publishes
+rdy run --from npm:@williamthorsen/release-kit                   # the default kit alone
+rdy run --from npm:@williamthorsen/release-kit npm-auto-publish  # the npm-auto-publish kit
+rdy list --from npm:@williamthorsen/release-kit                  # what release-kit publishes
+```
+
+`--packages` is the form that survives release-kit publishing further kits. Every form needs `readyup` 0.23 or later, and `@williamthorsen/release-kit` as a _direct_ devDependency: a strict pnpm layout links nothing else into the project, so a transitive copy is unreachable.
+
+These kits are no longer reachable through `rdy run --from github:williamthorsen/node-monorepo-tools`. Repos still using that form should switch to one of the invocations above.
+
 ## External dependencies
 
 This package shells out to two external tools:

package/dist/esm/loadConfig.js

@@ -1,5 +1,14 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { DEFAULT_CHANGELOG_JSON_CONFIG, DEFAULT_PROJECT_TAG_PREFIX, DEFAULT_RELEASE_NOTES_CONFIG, DEFAULT_VERSION_PATTERNS, DEFAULT_WORK_TYPES, } from "./defaults.js";
 import { deriveWorkspaceConfig } from "./deriveWorkspaceConfig.js";
 import { isRecord } from "./typeGuards.js";
@@ -34,13 +43,8 @@ export async function loadConfig() {
     if (!existsSync(absoluteConfigPath)) {
         return undefined;
     }
-    const { createJiti } = await import('jiti');
-    const jiti = createJiti(import.meta.url);
-    const imported = await jiti.import(absoluteConfigPath);
-    if (!isRecord(imported)) {
-        throw new Error(`Config file must export an object, got ${Array.isArray(imported) ? 'array' : typeof imported}`);
-    }
-    const resolved = imported.default ?? imported.config;
+    const imported = await import(__rewriteRelativeImportExtension(pathToFileURL(absoluteConfigPath).href));
+    const resolved = isRecord(imported) ? (imported.default ?? imported.config) : undefined;
     if (resolved === undefined) {
         throw new Error('Config file must have a default export or a named `config` export (e.g., `export default { ... }` or `export const config = { ... }`)');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/release-kit",
-  "version": "10.0.0",
+  "version": "10.2.0",
   "description": "Version-bumping and changelog-generation toolkit for release workflows",
   "keywords": [],
   "homepage": "https://github.com/williamthorsen/node-monorepo-tools/tree/main/packages/release-kit#readme",
@@ -29,6 +29,8 @@
     "release-kit": "./bin/release-kit.js"
   },
   "files": [
+    ".readyup/kits/*.js",
+    ".readyup/manifest.json",
     "bin",
     "dist/*",
     "cliff.toml.template",
@@ -38,15 +40,15 @@
   ],
   "dependencies": {
     "glob": "13.0.6",
-    "jiti": "2.7.0",
     "json-stringify-pretty-compact": "4.0.0",
     "semver": "7.8.5",
     "yaml": "2.9.0",
     "zod": "4.4.3",
-    "@williamthorsen/nmr-core": "0.8.0"
+    "@williamthorsen/nmr-core": "0.9.0"
   },
   "devDependencies": {
     "@types/semver": "7.7.1",
+    "readyup": "0.23.0",
     "smol-toml": "1.7.1"
   },
   "engines": {
@@ -57,7 +59,8 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
-    "build:post": "node scripts/copy-work-types.js",
+    "build:post": "node scripts/copy-work-types.js && rdy compile",
+    "build:pre": "rdy verify",
     "work-types:check": "pnpm exec release-kit work-types check",
     "work-types:sync": "pnpm exec release-kit work-types sync"
   }

package/presets/labels/common.yaml

@@ -70,30 +70,28 @@
 # Priority
 - name: 'priority:critical'
   color: b60205
-  description: Demands immediate attention
 - name: 'priority:high'
   color: d93f0b
-  description: Address soon
 - name: 'priority:medium'
   color: fbca04
-  description: No rush but don't forget
 - name: 'priority:low'
   color: cfd3d7
-  description: Get to it eventually
+
+# Status
+- name: 'status:blocked'
+  color: b83280
+- name: 'status:on-hold'
+  color: fbcfe8
 
 # Value
 - name: 'value:must-have'
   color: 7057ff
-  description: Essential for the application to fulfill its purpose
 - name: 'value:should-have'
   color: 8d83fc
-  description: Important but the application is usable without it
 - name: 'value:nice-to-have'
   color: a8b2f8
-  description: A nice-to-have enhancement
 - name: 'value:questionable'
   color: c5def5
-  description: Decision needed on whether this would add sufficient value
 
 # Triage
 - name: duplicate