@williamthorsen/release-kit 10.2.1 → 10.3.0

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat — @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.23.0";
+export const __readyupVersion = "0.24.0";
 
 
 // .readyup/kits/default.ts
@@ -43,7 +43,7 @@ function detectRepoType() {
   if (existsSync("package.json")) {
     const raw = readFileSync("package.json", "utf8");
     const pkg = parseJsonRecord(raw);
-    if (pkg !== void 0 && Array.isArray(pkg.workspaces)) {
+    if (pkg !== void 0 && Array.isArray(pkg["workspaces"])) {
       return "monorepo";
     }
   }
@@ -52,15 +52,21 @@ function detectRepoType() {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "10.2.1" };
-  if (typeof picked.version !== "string") {
+  const picked = { "version": "10.3.0" };
+  if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
-  return picked.version;
+  return picked["version"];
 }
 function hasPublishablePackages() {
   return discoverWorkspaces({ filter: (w) => w.isPackage }).length > 0;
 }
+var CONFIG_EXPORT_PATTERNS = [
+  /export\s+default\b/,
+  /export\s+(?:const|let|var)\s+config\b/,
+  /export\s*\{[^}]*\b(?:config|default)\b[^}]*\}/,
+  /export\s*\*/
+];
 var CLIFF_TEMPLATE_HASH = "93b72e0b1393cd6b1fe8e2a0e303cd326fd323435951b0493396b305af32d2ec";
 var COMMON_PRESET_HASH = "86f9e1db9000793a91168e8c6b5695311a422ee208121324549c068fe67fa184";
 var SYNC_LABELS_WORKFLOW_HASH = "d6e2403fb551d2d415f679125989c92760444eec887644565b2e05c9bf8f4c1e";
@@ -111,6 +117,7 @@ var default_default = defineRdyKit({
             {
               name: "release.yaml does not reference deprecated tag ref",
               severity: "error",
+              quiet: true,
               check: () => fileDoesNotContain(".github/workflows/release.yaml", /@(release|publish)-workflow-v[0-9]/),
               fix: "Update release.yaml to use @workflow/release-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
             }
@@ -135,50 +142,79 @@ var default_default = defineRdyKit({
             {
               name: "publish.yaml does not reference deprecated tag ref",
               severity: "error",
+              quiet: true,
               check: () => fileDoesNotContain(".github/workflows/publish.yaml", /@(release|publish)-workflow-v[0-9]/),
               fix: "Update publish.yaml to use @workflow/publish-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
             }
           ]
         },
         {
-          name: "releaseNotes config is consistent with changelogJson",
-          severity: "warn",
-          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
-          check: () => releaseNotesConfigIsConsistent(),
-          fix: "Either enable changelogJson.enabled or disable releaseNotes.shouldInjectIntoReadme"
-        },
-        {
-          name: "config does not use removed releaseNotes.shouldCreateGithubRelease",
+          name: ".config/release-kit.config.ts exports a config",
           severity: "error",
           skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
-          check: () => fileDoesNotContain(".config/release-kit.config.ts", /shouldCreateGithubRelease/),
-          fix: "Remove 'shouldCreateGithubRelease' from .config/release-kit.config.ts. Adoption of GitHub Releases is now signaled by installing the create-github-release workflow (see release-kit README for setup)."
-        },
-        {
-          name: ".config/release-kit.config.ts uses defineConfig",
-          severity: "recommend",
-          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
-          check: () => fileContains(".config/release-kit.config.ts", /defineConfig/),
-          fix: "Wrap your config export with defineConfig() from @williamthorsen/release-kit/config for type safety"
-        },
-        {
-          name: "releaseNotes.shouldInjectIntoReadme is true",
-          severity: "warn",
-          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
-          check: () => releaseNotesInjectsIntoReadme(),
-          fix: "Set releaseNotes.shouldInjectIntoReadme to true in .config/release-kit.config.ts",
+          check: () => configFileExportsConfig(),
+          fix: "Export the config from .config/release-kit.config.ts as a default export or as a named `config` export; release-kit resolves no other export",
           checks: [
             {
-              name: "README contains release-notes section markers",
+              name: "releaseNotes config is consistent with changelogJson",
+              severity: "warn",
+              check: () => releaseNotesConfigIsConsistent(),
+              fix: "Either enable changelogJson.enabled or disable releaseNotes.shouldInjectIntoReadme"
+            },
+            {
+              name: ".config/release-kit.config.ts uses defineConfig",
+              severity: "recommend",
+              check: () => fileContains(".config/release-kit.config.ts", /defineConfig/),
+              fix: "Wrap your config export with defineConfig() from @williamthorsen/release-kit/config for type safety"
+            },
+            {
+              name: "releaseNotes.shouldInjectIntoReadme is true",
+              severity: "warn",
+              check: () => releaseNotesInjectsIntoReadme(),
+              fix: "Set releaseNotes.shouldInjectIntoReadme to true in .config/release-kit.config.ts",
+              checks: [
+                {
+                  name: "README contains release-notes section markers",
+                  severity: "warn",
+                  check: readmesHaveReleaseNotesMarkers,
+                  fix: "Add `<!-- section:release-notes -->` and `<!-- /section:release-notes -->` markers to each affected README"
+                }
+              ]
+            },
+            {
+              name: "repoLabels block declared in .config/release-kit.config.ts",
+              severity: "recommend",
+              check: () => fileContains(".config/release-kit.config.ts", /repoLabels/),
+              fix: "Run `release-kit sync-labels init` to seed a repoLabels block, then customize labels"
+            },
+            {
+              name: ".github/labels.yaml exists",
               severity: "warn",
-              check: readmesHaveReleaseNotesMarkers,
-              fix: "Add `<!-- section:release-notes -->` and `<!-- /section:release-notes -->` markers to each affected README"
+              skip: () => !fileContains(".config/release-kit.config.ts", /repoLabels/) ? "no repoLabels config" : false,
+              check: () => fileExists(".github/labels.yaml"),
+              fix: "Run `release-kit sync-labels generate` to produce the labels file",
+              checks: [
+                {
+                  name: "labels.yaml has current common preset",
+                  severity: "warn",
+                  check: () => labelsHaveCurrentPresetHash("common", COMMON_PRESET_HASH),
+                  fix: "Run `release-kit sync-labels generate` to incorporate updated common labels"
+                }
+              ]
             }
           ]
         },
+        {
+          name: "config does not use removed releaseNotes.shouldCreateGithubRelease",
+          severity: "error",
+          quiet: true,
+          check: () => fileDoesNotContain(".config/release-kit.config.ts", /shouldCreateGithubRelease/),
+          fix: "Remove 'shouldCreateGithubRelease' from .config/release-kit.config.ts. Adoption of GitHub Releases is now signaled by installing the create-github-release workflow (see release-kit README for setup)."
+        },
         {
           name: "git-cliff not in devDependencies",
           severity: "recommend",
+          quiet: true,
           check: () => !hasDevDependency("git-cliff"),
           fix: "pnpm remove git-cliff \u2014 release-kit handles changelog generation directly"
         },
@@ -206,41 +242,26 @@ var default_default = defineRdyKit({
         {
           name: "sync-labels.yaml does not reference deprecated tag ref",
           severity: "error",
+          quiet: true,
           check: () => fileDoesNotContain(".github/workflows/sync-labels.yaml", /@sync-labels-workflow-v[0-9]/),
           fix: "Update sync-labels.yaml to use @workflow/sync-labels-v1 (run `release-kit sync-labels init --force` to regenerate, or replace the ref manually)"
         },
         {
           name: "retired .config/sync-labels.config.ts is absent",
           severity: "error",
+          quiet: true,
           check: () => !fileExists(".config/sync-labels.config.ts"),
           fix: "Move the labels into the repoLabels block of .config/release-kit.config.ts, then delete .config/sync-labels.config.ts"
-        },
-        {
-          name: "repoLabels block declared in .config/release-kit.config.ts",
-          severity: "recommend",
-          skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
-          check: () => fileContains(".config/release-kit.config.ts", /repoLabels/),
-          fix: "Run `release-kit sync-labels init` to seed a repoLabels block, then customize labels"
-        },
-        {
-          name: ".github/labels.yaml exists",
-          severity: "warn",
-          skip: () => !fileContains(".config/release-kit.config.ts", /repoLabels/) ? "no repoLabels config" : false,
-          check: () => fileExists(".github/labels.yaml"),
-          fix: "Run `release-kit sync-labels generate` to produce the labels file",
-          checks: [
-            {
-              name: "labels.yaml has current common preset",
-              severity: "warn",
-              check: () => labelsHaveCurrentPresetHash("common", COMMON_PRESET_HASH),
-              fix: "Run `release-kit sync-labels generate` to incorporate updated common labels"
-            }
-          ]
         }
       ]
     }
   ]
 });
+function configFileExportsConfig() {
+  const content = readFile(".config/release-kit.config.ts");
+  if (content === void 0) return false;
+  return CONFIG_EXPORT_PATTERNS.some((pattern) => pattern.test(content));
+}
 function labelsHaveCurrentPresetHash(presetName, expectedHash) {
   const content = readFile(".github/labels.yaml");
   if (content === void 0) return false;
@@ -253,7 +274,8 @@ function readmeHasReleaseNotesMarkers(content) {
 }
 function readmesHaveReleaseNotesMarkers() {
   const failing = [];
-  for (const { dir } of discoverWorkspaces({ filter: (w) => w.isPackage })) {
+  const packageWorkspaces = discoverWorkspaces({ filter: (w) => w.isPackage });
+  for (const { dir } of packageWorkspaces) {
     const readmePath = dir === "." ? "README.md" : `${dir}/README.md`;
     const content = readFile(readmePath);
     if (content === void 0 || !readmeHasReleaseNotesMarkers(content)) {
@@ -287,6 +309,7 @@ export {
   RELEASE_WORKFLOW_HASH_MONOREPO,
   RELEASE_WORKFLOW_HASH_SINGLE,
   SYNC_LABELS_WORKFLOW_HASH,
+  configFileExportsConfig,
   default_default as default,
   readmeHasReleaseNotesMarkers,
   readmesHaveReleaseNotesMarkers

package/.readyup/kits/npm-auto-publish.js

@@ -1,13 +1,13 @@
 /** @noformat — @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.23.0";
+export const __readyupVersion = "0.24.0";
 
 
 // .readyup/kits/npm-auto-publish.ts
 import { execSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { defineRdyChecklist, defineRdyKit, defineRdyStagedChecklist } from "readyup";
+import { defineRdyChecklist, defineRdyKit } from "readyup";
 import {
   discoverWorkspaces,
   fileContains,
@@ -17,33 +17,43 @@ import {
   readFile,
   readJsonFile
 } from "readyup/check-utils";
+var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["E401", "ENEEDAUTH"]);
 var PUBLISH_WORKFLOW_FILE = "publish.yaml";
-var repoChecklist = defineRdyStagedChecklist({
+var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENETUNREACH",
+  "ENOTFOUND",
+  "ERR_SOCKET_TIMEOUT",
+  "ETIMEDOUT"
+]);
+var repoChecklist = defineRdyChecklist({
   name: "repo",
-  preconditions: [
+  checks: [
     {
       name: "publish.yaml exists",
+      skip: () => skipIfNothingPublishable(),
       check: () => fileExists(".github/workflows/publish.yaml"),
-      fix: 'Run "release-kit init" to scaffold the publish workflow, or create .github/workflows/publish.yaml manually'
+      fix: 'Run "release-kit init" to scaffold the publish workflow, or create .github/workflows/publish.yaml manually',
+      checks: [
+        {
+          name: "id-token: write permission declared",
+          check: () => fileContains(".github/workflows/publish.yaml", /id-token:\s*write/),
+          fix: 'Add "permissions: { id-token: write, contents: read }" to .github/workflows/publish.yaml \u2014 required for OIDC-based npm authentication'
+        },
+        {
+          name: "No legacy token references in workflow files",
+          quiet: true,
+          check: () => !hasTokenReferences(),
+          fix: "Remove NPM_TOKEN/NODE_AUTH_TOKEN references from workflow files; OIDC auth replaces token-based auth"
+        },
+        {
+          name: "Provenance setting matches repo visibility",
+          check: checkProvenanceMatchesVisibility
+        }
+      ]
     }
-  ],
-  groups: [
-    [
-      {
-        name: "id-token: write permission declared",
-        check: () => fileContains(".github/workflows/publish.yaml", /id-token:\s*write/),
-        fix: 'Add "permissions: { id-token: write, contents: read }" to .github/workflows/publish.yaml \u2014 required for OIDC-based npm authentication'
-      },
-      {
-        name: "No legacy token references in workflow files",
-        check: () => !hasTokenReferences(),
-        fix: "Remove NPM_TOKEN/NODE_AUTH_TOKEN references from workflow files; OIDC auth replaces token-based auth"
-      },
-      {
-        name: "Provenance setting matches repo visibility",
-        check: checkProvenanceMatchesVisibility
-      }
-    ]
   ]
 });
 var packagesChecklist = defineRdyChecklist({
@@ -53,7 +63,7 @@ var packagesChecklist = defineRdyChecklist({
       name: 'packageManager field starts with "pnpm"',
       check: () => {
         const rootPkg = readJsonFile("package.json");
-        const pm = typeof rootPkg?.packageManager === "string" ? rootPkg.packageManager : "";
+        const pm = typeof rootPkg?.["packageManager"] === "string" ? rootPkg["packageManager"] : "";
         return pm.startsWith("pnpm");
       },
       fix: 'Set "packageManager": "pnpm@..." in root package.json'
@@ -64,9 +74,22 @@ var packagesChecklist = defineRdyChecklist({
       fix: "Ensure pnpm-workspace.yaml lists package globs, or that a root package.json exists"
     }
   ],
-  get checks() {
-    return discoverWorkspaces().map((workspace) => buildWorkspaceCheck(workspace));
-  }
+  checks: [
+    {
+      name: "npm session is usable",
+      skip: () => skipIfNothingPublishable(),
+      check: () => {
+        const auth = getCachedNpmAuthStatus();
+        return auth.status === "authenticated" ? { ok: true } : { ok: false, detail: auth.detail };
+      },
+      // readyup reads `fix` before it consults `skip`, and again when it validates the kit, so a getter here would
+      // reach the registry on every run regardless of the skip. Per-outcome wording goes in the check's detail.
+      fix: 'Restore a usable npm session: log in with "npm login", or restore access to the registry, which the trusted-publisher check queries directly',
+      get checks() {
+        return discoverWorkspaces().map((workspace) => buildWorkspaceCheck(workspace));
+      }
+    }
+  ]
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
@@ -78,7 +101,7 @@ function buildWorkspaceCheck(workspace) {
   const children = [
     {
       name: "repository field exists",
-      check: () => workspace.packageJson.repository !== void 0 && workspace.packageJson.repository !== null,
+      check: () => workspace.packageJson["repository"] !== void 0 && workspace.packageJson["repository"] !== null,
       fix: `Add a "repository" field to ${pkgJsonPath} pointing to the GitHub repo`
     }
   ];
@@ -100,7 +123,7 @@ function buildWorkspaceCheck(workspace) {
       checks: [
         {
           name: "trusted publisher configured",
-          check: () => hasTrustedPublisher(displayName, getCachedOwnerRepo(), PUBLISH_WORKFLOW_FILE),
+          check: () => checkTrustedPublisher(displayName),
           get fix() {
             return `Run: npm trust github ${displayName} --repo ${getCachedOwnerRepo()} --file ${PUBLISH_WORKFLOW_FILE}`;
           }
@@ -110,7 +133,7 @@ function buildWorkspaceCheck(workspace) {
     {
       name: "files field exists",
       severity: "warn",
-      check: () => workspace.packageJson.files !== void 0,
+      check: () => workspace.packageJson["files"] !== void 0,
       fix: `Add a "files" field to ${pkgJsonPath} to control which files are included in the published tarball`
     }
   );
@@ -148,13 +171,79 @@ function checkProvenanceMatchesVisibility() {
   }
   return { ok: true };
 }
-var cachedOwnerRepo;
-function getCachedOwnerRepo() {
-  if (cachedOwnerRepo === void 0) {
-    cachedOwnerRepo = getOwnerRepo();
+function checkTrustedPublisher(packageName) {
+  const result = classifyTrustQuery(
+    runNpmJson(`npm trust list ${packageName} --json`),
+    getCachedOwnerRepo(),
+    PUBLISH_WORKFLOW_FILE
+  );
+  switch (result.status) {
+    case "configured":
+      return { ok: true };
+    case "not-configured":
+      return { ok: false, detail: "No trusted publisher is configured for this package" };
+    default:
+      return { ok: false, detail: result.detail };
   }
-  return cachedOwnerRepo;
 }
+function classifyNpmAuth(result) {
+  if (result.exitOk) {
+    return { status: "authenticated" };
+  }
+  const error = readNpmError(result.stdout);
+  if (error === void 0) {
+    return { status: "unreachable", detail: "The npm registry query failed without a readable error payload" };
+  }
+  if (AUTH_ERROR_CODES.has(error.code)) {
+    return { status: "unauthenticated", detail: `The npm registry rejected the session (${error.code})` };
+  }
+  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+    return { status: "unreachable", detail: `Cannot reach the npm registry (${error.code})` };
+  }
+  return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
+}
+function classifyTrustQuery(result, expectedRepo, expectedFile) {
+  if (!result.exitOk) {
+    const error = readNpmError(result.stdout);
+    if (error === void 0) {
+      return { status: "error", detail: "The npm trust query failed without a readable error payload" };
+    }
+    if (error.code === "E404") {
+      return { status: "not-configured" };
+    }
+    return { status: "error", detail: `The npm trust query failed (${error.code}): ${error.summary}` };
+  }
+  const relationships = readTrustRelationships(result.stdout);
+  if (relationships === void 0) {
+    return { status: "error", detail: "The npm trust query returned a payload this check cannot read" };
+  }
+  if (relationships.length === 0) {
+    return { status: "not-configured" };
+  }
+  const isMatch = relationships.some(
+    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo && relationship.file === expectedFile
+  );
+  return isMatch ? { status: "configured" } : {
+    status: "mismatched",
+    detail: `Expected github ${expectedRepo} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
+  };
+}
+function describeTrustRelationships(relationships) {
+  return relationships.map((relationship) => {
+    const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
+    const repository = typeof relationship.repository === "string" ? relationship.repository : "(unknown)";
+    const file = typeof relationship.file === "string" ? relationship.file : "(unknown)";
+    return `${type} ${repository} (${file})`;
+  }).join(", ");
+}
+var getCachedNpmAuthStatus = /* @__PURE__ */ (() => {
+  let cached;
+  return () => cached ??= classifyNpmAuth(runNpmJson("npm whoami --json"));
+})();
+var getCachedOwnerRepo = /* @__PURE__ */ (() => {
+  let cached;
+  return () => cached ??= getOwnerRepo();
+})();
 function getOwnerRepo() {
   const url = execSync("git remote get-url origin", {
     encoding: "utf8"
@@ -183,27 +272,6 @@ function hasTokenReferences() {
   }
   return false;
 }
-function hasTrustedPublisher(packageName, expectedRepo, expectedFile) {
-  let output;
-  try {
-    output = execSync(`npm trust list ${packageName} --json`, {
-      encoding: "utf8",
-      stdio: "pipe"
-    });
-  } catch {
-    return false;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(output);
-  } catch {
-    return false;
-  }
-  if (!isRecord(parsed)) {
-    return false;
-  }
-  return parsed.type === "github" && parsed.repository === expectedRepo && parsed.file === expectedFile;
-}
 function isPublishedToNpm(packageName) {
   try {
     execSync(`npm view ${packageName} version`, {
@@ -225,11 +293,55 @@ function isRepoPrivate() {
 function parseProvenanceSetting(workflowContent) {
   return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
 }
+function readNpmError(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(parsed) || !isRecord(parsed["error"]) || typeof parsed["error"]["code"] !== "string") {
+    return void 0;
+  }
+  const { code, summary } = parsed["error"];
+  return { code, summary: typeof summary === "string" ? summary : "" };
+}
+function readTrustRelationships(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (Array.isArray(parsed)) {
+    return parsed.filter((entry) => isRecord(entry) && "type" in entry);
+  }
+  if (!isRecord(parsed)) {
+    return void 0;
+  }
+  return "type" in parsed ? [parsed] : [];
+}
+function runNpmJson(command) {
+  try {
+    return { exitOk: true, stdout: execSync(command, { encoding: "utf8", stdio: "pipe" }) };
+  } catch (error) {
+    const stdout = isRecord(error) && typeof error["stdout"] === "string" ? error["stdout"] : "";
+    return { exitOk: false, stdout };
+  }
+}
+function skipIfNothingPublishable() {
+  const publishable = discoverWorkspaces({ filter: (workspace) => workspace.isPackage });
+  return publishable.length > 0 ? false : "no publishable packages";
+}
 function skipIfNotPublishable(workspace) {
   return workspace.isPackage ? false : "package.json#private is true";
 }
 export {
   buildWorkspaceCheck,
+  classifyNpmAuth,
+  classifyTrustQuery,
   npm_auto_publish_default as default,
-  skipIfNotPublishable
+  packagesChecklist,
+  skipIfNotPublishable,
+  skipIfNothingPublishable
 };

package/.readyup/manifest.json

@@ -7,10 +7,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.23.0",
+      "readyupVersion": "0.24.0",
       "source": "kits/default.ts",
-      "sourceHash": "afe26920",
-      "targetHash": "5ac6d830"
+      "sourceHash": "fe239d01",
+      "targetHash": "9bd8fb5d"
     },
     {
       "checklists": [
@@ -19,10 +19,10 @@
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
-      "readyupVersion": "0.23.0",
+      "readyupVersion": "0.24.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "71e894e6",
-      "targetHash": "c1c05255"
+      "sourceHash": "ac484613",
+      "targetHash": "f790e7d5"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,60 @@
 
 All notable changes to this project will be documented in this file.
 
+## 10.3.0 — 2026-08-08
+
+### 🎉 Features
+
+- Stop reporting absence checks that pass (#610)
+
+  A ReadyUp check that checks for a problem (such as an unwanted file or a stale config reference) now stays silent unless it finds one. The `nmr`, `release-kit`, and `v11y-check` ReadyUp kits previously printed a line for every such check on every run.
+
+- Stop reporting non-issues in the readyup kits (#613)
+
+  Modifies the `release-kit` and `nmr` ReadyUp kits to avoid verbose reporting when an initial check determines that further checks aren't applicable. In particular, a repo with no `release-kit` config file gets a single line in the `release-kit` report, and a repo that publishes nothing now bypasses the `npm-auto-publish` kit instead of failing it.
+
+### 🐛 Bug fixes
+
+- Publish build output atomically so a failed build cannot destroy it (#631)
+
+  Fixes an issue where a failed or still-running `nmr build` could leave a package with no build output at all, breaking the tooling that a subsequent build depends on. Separately, the error reported when a package's build output is missing now names the correct recovery command.
+
+### ♻️ Refactoring
+
+- Retire the deferred-lint-rule list and enforce its rules (#628)
+
+  Errors that `release-kit` rethrows now carry the original error as their cause, previously available only as message text. Help text and documentation for `--with-release-notes` now use the same placeholder notation for its output paths.
+
+  All violations of lint rules in the `release-kit` project are now cleared, and the list of deferred lint rules is retired, restoring associated rules to a max severity of "error" during strict linting.
+
+### ⚙️ Tooling
+
+- Migrate to the shared tsconfig baseline (#626)
+
+  Adopts `@williamthorsen/tsconfig` as the standard TypeScript configuration for this repo, replacing the previous hand-maintained copy. Reading a property through an index signature now requires bracket notation or a type that declares the property. The `nmr` build now fails on a base TypeScript config it cannot resolve, rather than building without it, and it now resolves a base config named by package name alone.
+
+## 10.2.2 — 2026-08-05
+
+### 🐛 Bug fixes
+
+- Report the missing npm login once, not per package (#598)
+
+  Fixes an issue where running release-kit's publish-readiness checks without an npm login reported a trusted-publisher failure for every published package. The missing login is now reported once, with `npm login` as the fix. An unreachable registry now has its own check. The trusted publisher check produces more informative failure messages.
+
+- Make prepare all-or-nothing and report the tags file by path (#601)
+
+  Fixes an issue where a failed `prepare` could leave the release flow in a broken intermediate state. A release now lands completely or not at all, and a formatting failure no longer discards one that already landed. When a write fails partway, the error names every file that reached disk, every file that did not, and the commands that undo them.
+
+  `commit` and `tag` now report the full path of the tags file they looked for, and distinguish a missing file from one that could not be read, so that running from the wrong directory or worktree is no longer reported as a release that never happened.
+
+  Runs with `--with-release-notes` now list the preview files they write, and `--dry-run` names the ones a real run would write.
+
+### 🧪 Tests
+
+- Clear the deferred vitest test rules and enforce them (#602)
+
+  Fixes a subset of previously deferred lint violations and restores the severity of Vitest lint rules to "error" for purposes strict linting.
+
 ## 10.2.1 — 2026-08-04
 
 ### 🐛 Bug fixes