@williamthorsen/release-kit 10.8.0 → 11.0.0

package/.meta/changelog.json

@@ -1,4 +1,104 @@
 [
+  {
+    "version": "11.0.0",
+    "date": "2026-09-22",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Return the provenance check's remediation as the outcome's fix (#855)",
+            "body": "- Moves the remediation of the `npm-auto-publish` kit's `Provenance setting matches repo visibility` check from the failing outcome's `detail` into its `fix`, so that readyup marks it as a remedy, lists it in the `Fixes` recap, and reports it under `rdy run --json --detail summary` instead of printing it as a plain reason line.\n- Declares `minReadyupVersion: '0.37.0'` on the kit, the readyup release that introduced `CheckOutcome.fix`, which retires the kit's `version-skew` advisory and makes an older runner fail to load the kit.\n\nMigration: Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.",
+            "breaking": true,
+            "migration": "Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.",
+            "hash": "2455edc46611a47e95707f79cdebda539a844431"
+          },
+          {
+            "description": "Accept a --config argument on every config-reading subcommand (#857)",
+            "body": "- Adds `--config <path>` to `prepare`, `publish`, `create-github-release`, `show-tag-prefixes`, `overrides validate`, `sync-labels init`, and `sync-labels generate`, each of which then reads the named file in place of `.config/release-kit.config.ts`.\n- Requires a named `--config` file to exist, failing if it does not; an absent default path continues to mean that the repo declares no config.\n- Confines scaffolding to the default path: `release-kit init` and `sync-labels init` still write `.config/release-kit.config.ts`, and `sync-labels init --config` reads the named file and fails when it is absent.",
+            "hash": "f605a6fd7e48b27b17fb90bad161f4507979e5aa"
+          },
+          {
+            "description": "Adopt the shared workspace resolver in release-kit, honoring exclusions (#865)",
+            "body": "- 🚨 **Breaking:** Narrows `no-pattern` in `@williamthorsen/nmr-core`'s `EmptyWorkspaceCause`, moving an absent or empty `packages` list onto `no-packages-list` and a value that is not a list of strings onto `unreadable-packages`.\n- Stops `release-kit` from tagging, publishing, and label-syncing a package that a `!` entry in `pnpm-workspace.yaml` excludes, which its previous `glob`-based resolution could not remove from the match.\n- Replaces the release of the root package alone with a failure naming the condition that emptied the workspace, when `pnpm-workspace.yaml` does not hold valid YAML or declares a workspace that does not resolve to a package.\n- Replaces the `no-pattern` remedy that `nmr` printed for a `pnpm-workspace.yaml` declaring no `packages` list, and for one declaring a `packages` value that is not a list of strings.\n- Raises `engines.node` to `>=24.16.0` in `@williamthorsen/nmr-core` and `@williamthorsen/release-kit`, because Node 24.0 through 24.15 ignores the `followSymlinks` option that the workspace matcher passes to `globSync` and drops a symlinked package directory from the resolution without reporting it.\n\nMigration: Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.",
+            "breaking": true,
+            "migration": "Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.",
+            "hash": "b1126866159402b8f027a9b82f2a19591a6e9e1b"
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Truncate release-kit commit subjects by display column (#840)",
+            "body": "- Fixes the issue that the `release-kit` prepare report cut a commit subject at 69 UTF-16 code units instead of at display columns, so a subject of CJK characters printed about twice the intended 72-column width and a cut inside an emoji left a broken character that a terminal drew as a replacement glyph.\n- Replaces the `...` marker on a truncated subject with `…`, the default of the width-aware truncation that now does the cutting.\n- Exports `truncateToWidth` and `measureWidth` from `@williamthorsen/nmr-core`, which measure and cut text by display width without splitting a grapheme cluster.",
+            "hash": "f75d9b4abd9fbda264d5dd40ca5b7abb64f5a3f3"
+          },
+          {
+            "description": "Abort show-tag-prefixes on an unusable config (#861)",
+            "body": "- Fixes the issue that `release-kit show-tag-prefixes` silently ignored a config file that failed schema validation, which left the preview reading no `legacyIdentities` and no `retiredPackages` and reporting already-declared and retired tag prefixes as undeclared candidates; the command now prints those validation errors and exits 1 with no preview.",
+            "hash": "2177873d9a79247385e5a1f09e95971449488d9f"
+          },
+          {
+            "description": "Abort every config-reading command on an unusable default config (#869)",
+            "body": "- Fixes `publish` proceeding on derived defaults when the default config file exists and fails to load, which silently dropped a configured `releaseNotes.shouldInjectIntoReadme`, `changelogJson.outputPath`, or `workTypes`; it now reports the failure and exits 1, as every other config-reading subcommand does.\n- Fixes `publish` and `create-github-release` ignoring a broken or invalid default config when every requested tag names a private package, a case in which both commands return before any loader runs.",
+            "hash": "5b2873f2b9b7e42f1011d90506ca7ea6945d09a1"
+          },
+          {
+            "description": "Strip trailing Change trailers from changelog item bodies (#870)",
+            "body": "- Fixes a changelog item body that kept a commit's trailing `Change:` trailers, which then appeared verbatim in the rendered release notes, including the notes injected into a README.",
+            "hash": "250e52b3a2947202e3a7246fb39ebcb79e2bd1fc"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "10.9.0",
+    "date": "2026-09-18",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Give release-kit plain output in pipes and CI logs (#835)",
+            "body": "- Adds the `RELEASE_KIT_OUTPUT_STYLE` environment variable, which accepts `auto`, `plain`, or `rich` and outranks the detection from `CI`, the stream's terminal state, and `TERM`; any other value is a usage error that exits with code 1.\n- Changes the emoji in rich output so that none has a different meaning from the one that it has in `nmr`: warnings from ⚠️ to 🟠, skips from ⏭️ to ⏩, the errors of `show-tag-prefixes` from ⛔ to ❌, and the tag marker from 🏷️ to 🔖.\n- Adds a required `style` parameter to `formatValidateOverridesResult`, which the package root exports.",
+            "hash": "aae401b4bbcafc7014e4b3804d80528d2d098a30"
+          },
+          {
+            "description": "Give nmr plain output in pipes and CI logs (#838)",
+            "body": "- Stops `nmr` from printing emoji to a pipe or a CI log: When the output stream is not a terminal or `CI` is set, a verdict reads `PASS`, `FAIL`, `SKIP`, or `NOOP` and a command icon is omitted, so that a log can be searched for a verdict.\n- Adds `--output-style <auto|plain|rich>` to `nmr` and the `NMR_OUTPUT_STYLE` variable, each forcing either style; the flag outranks the variable, a value that names no style exits 1 with a usage error, and neither enters a check-cache key: A rich run and a plain run share a recorded pass.\n- Replaces several rich glyphs, taking the status markers from the set that release-kit and v11y-check print so that one status has one glyph across the three tools: a recalled pass shows ⏩ in place of ⏭️, a skipped empty override shows ⚪ in place of ⛔, a warning and the `--log` refusal show 🟠 in place of ⚠️ and 📭, the `--log` header shows 💾 in place of 📼, and `nmr-ensure-prepublish-hooks` reports ✅ and ❌ in place of ✓ and ✗.",
+            "hash": "693b3a7f57def3d299ced240c19bda90f6253bdc"
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Move work-types check and sync from the CLI into maintainer scripts (#820)",
+            "body": "- Removes the `release-kit work-types` command, whose `sync` rewrote an unused copy of `work-types.json` inside `node_modules` and whose `check` reported drift that a consumer could not fix.",
+            "hash": "31db5888038d69369422fdabbb1cc411dc95d6e1"
+          },
+          {
+            "description": "Exclude distributed agent guidance from ai and documentation labels (#825)",
+            "body": "- Marks a `.github/labels.yaml` generated from the previous `common` preset as stale in the default readyup kit, whose \"labels.yaml has current common preset\" check reports the file until the repo regenerates it.",
+            "hash": "0c4b0c59d8d87cdee66257ea7ca1bf9be86ce017"
+          },
+          {
+            "description": "Suppress bold and dim escapes for a stream that cannot render them (#830)",
+            "body": "- Stops `release-kit prepare` from writing raw escape bytes into piped output, redirected files, and CI logs: It styled bold and dim unconditionally, without checking whether the destination renders escapes.\n- Honors `NO_COLOR`, `NODE_DISABLE_COLORS`, and `FORCE_COLOR`, which the previous styling ignored.",
+            "hash": "eee5717f231615f9330c43239279d46d2a77a262"
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "10.8.0",
     "date": "2026-09-15",
@@ -537,7 +637,6 @@
           {
             "description": "Move defineConfig to a dedicated config subpath (#566)",
             "body": "`defineConfig` now comes from the `@williamthorsen/release-kit/config` subpath rather than from the package root. The subpath also carries the config types.",
-            "breaking": true,
             "hash": "e0769815f41c23d64302be26c8369209fad72e22"
           },
           {
@@ -1134,13 +1233,11 @@
           {
             "description": "Rename `component` to `workspace` in config API and internals (#296)",
             "body": "Renames release-kit's per-workspace vocabulary from \"component\" to \"workspace\" throughout the public API, internal types, validation messages, CLI help, init templates, and documentation. Behavior is unchanged; only identifiers, error-message strings, scaffolded template text, and prose have been changed.",
-            "breaking": true,
             "hash": "dfe0a70903997b85a2ebf57a612345be5232a2c6"
           },
           {
             "description": "Rename `node-monorepo-core` to `nmr-core` (#304)",
             "body": "Renames the shared-utilities package from `@williamthorsen/node-monorepo-core` to `@williamthorsen/nmr-core`, aligning it with the repository's `nmr-*` naming convention. The package's functionality and version are unchanged; only the published name differs.",
-            "breaking": true,
             "hash": "085d4a57d1828bcd33933652aa47423989c090a9"
           }
         ]

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.36.0";
+export const __readyupVersion = "0.38.0";
 
 
 // .readyup/kits/default.ts
@@ -98,7 +98,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "10.8.0" };
+  const picked = { "version": "11.0.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -115,7 +115,7 @@ var CONFIG_EXPORT_PATTERNS = [
   /export\s*\*/
 ];
 var CLIFF_TEMPLATE_HASH = "93b72e0b1393cd6b1fe8e2a0e303cd326fd323435951b0493396b305af32d2ec";
-var COMMON_PRESET_HASH = "86f9e1db9000793a91168e8c6b5695311a422ee208121324549c068fe67fa184";
+var COMMON_PRESET_HASH = "8c52654d4eee216c22377dd1e65b89f6bbb0a3478d74379bd28b04a877f0b02a";
 var SYNC_LABELS_WORKFLOW_HASH = "d6e2403fb551d2d415f679125989c92760444eec887644565b2e05c9bf8f4c1e";
 var RELEASE_WORKFLOW_HASH_MONOREPO = "0a9724b7b3c5e24087fd3a8f36fed8e990d699267fcf36028ce048ab40dc2946";
 var RELEASE_WORKFLOW_HASH_SINGLE = "a3d19bbc1ba8bb30622e53c590137b97e3179e80988c0967737b021cdaeab73f";

package/.readyup/kits/npm-auto-publish.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.36.0";
+export const __readyupVersion = "0.38.0";
 
 
 // .readyup/kits/npm-auto-publish.ts
@@ -94,6 +94,9 @@ var packagesChecklist = defineRdyChecklist({
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
+  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. An older
+  // runner drops that `fix` silently, so failing to load the kit is the lesser harm.
+  minReadyupVersion: "0.37.0",
   checklists: [repoChecklist, packagesChecklist]
 });
 function belongsInPackagesChecklist(workspace) {
@@ -107,8 +110,8 @@ function buildSessionCheck() {
       const capability = getCachedTrustCapability();
       return capability.ok ? { ok: true } : { ok: false, detail: capability.detail };
     },
-    // A plain string rather than a getter, because readyup takes outcome-specific wording in `detail`, which the
-    // check above already carries.
+    // A plain string rather than a getter, because the remediation is the same however the session fails; only
+    // the `detail` above varies.
     fix: 'Restore a usable npm session: log in with "npm login", supplying the one-time password when prompted, or restore access to the registry, which the trusted-publisher check queries directly'
   };
 }
@@ -175,29 +178,13 @@ function buildWorkspaceCheck(workspace) {
 function checkProvenanceMatchesVisibility() {
   const workflowPath = ".github/workflows/publish.yaml";
   const content = readFile(workflowPath);
-  if (content === void 0) {
-    return { ok: false, detail: `Cannot read ${workflowPath} \u2014 check file permissions` };
-  }
-  const hasProvenance = parseProvenanceSetting(content);
-  let isPrivate;
+  let visibility;
   try {
-    isPrivate = isRepoPrivate();
+    visibility = isRepoPrivate() ? "private" : "public";
   } catch {
-    return { ok: false, detail: "Install and authenticate the GitHub CLI: gh auth login" };
-  }
-  if (!isPrivate && !hasProvenance) {
-    return {
-      ok: false,
-      detail: "Set provenance: true in .github/workflows/publish.yaml \u2014 public repos should generate provenance attestations"
-    };
-  }
-  if (isPrivate && hasProvenance) {
-    return {
-      ok: false,
-      detail: "Make the GitHub repo public \u2014 OIDC publishing with provenance requires a public repo"
-    };
+    visibility = "unknown";
   }
-  return { ok: true };
+  return classifyProvenanceSetting(content, visibility);
 }
 function checkTrustedPublisher(packageName) {
   const result = getTrustQueryResult(packageName);
@@ -226,6 +213,38 @@ function classifyNpmAuth(result) {
   }
   return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
 }
+function classifyProvenanceSetting(workflowContent, visibility) {
+  if (workflowContent === void 0) {
+    return {
+      ok: false,
+      detail: "Cannot read .github/workflows/publish.yaml",
+      fix: "Check the file's permissions"
+    };
+  }
+  if (visibility === "unknown") {
+    return {
+      ok: false,
+      detail: "The GitHub CLI could not report the repo's visibility",
+      fix: "Install and authenticate the GitHub CLI: gh auth login"
+    };
+  }
+  const hasProvenance = parseProvenanceSetting(workflowContent);
+  if (visibility === "public" && !hasProvenance) {
+    return {
+      ok: false,
+      detail: "The repo is public and publish.yaml does not set provenance: true",
+      fix: "Set provenance: true in .github/workflows/publish.yaml \u2014 public repos should generate provenance attestations"
+    };
+  }
+  if (visibility === "private" && hasProvenance) {
+    return {
+      ok: false,
+      detail: "The repo is private and publish.yaml sets provenance: true",
+      fix: "Make the GitHub repo public \u2014 OIDC publishing with provenance requires a public repo"
+    };
+  }
+  return { ok: true };
+}
 function classifyTrustCapability(auth, probe) {
   if (auth.status !== "authenticated") {
     return { ok: false, detail: auth.detail };
@@ -409,6 +428,7 @@ function skipIfNotPublishable(workspace) {
 export {
   buildWorkspaceCheck,
   classifyNpmAuth,
+  classifyProvenanceSetting,
   classifyTrustCapability,
   classifyTrustQuery,
   npm_auto_publish_default as default,

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "55ff5731",
+          "hash": "a20ce64b",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "a8611365",
+          "hash": "e9aadbb2",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -43,10 +43,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.36.0",
+      "readyupVersion": "0.38.0",
       "source": "kits/default.ts",
-      "sourceHash": "55ff5731",
-      "targetHash": "be5f29ad"
+      "sourceHash": "a20ce64b",
+      "targetHash": "b3fd135a"
     },
     {
       "checklists": [
@@ -56,17 +56,17 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "2f1fb68c",
+          "hash": "c2d2d375",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         }
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
-      "readyupVersion": "0.36.0",
+      "readyupVersion": "0.38.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "2f1fb68c",
-      "targetHash": "cbabceb3"
+      "sourceHash": "c2d2d375",
+      "targetHash": "9d2d224b"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,85 @@
 
 All notable changes to this project will be documented in this file.
 
+## 11.0.0 — 2026-09-22
+
+### 🎉 Features
+
+- 🚨 **Breaking:** Return the provenance check's remediation as the outcome's fix (#855)
+
+  - Moves the remediation of the `npm-auto-publish` kit's `Provenance setting matches repo visibility` check from the failing outcome's `detail` into its `fix`, so that readyup marks it as a remedy, lists it in the `Fixes` recap, and reports it under `rdy run --json --detail summary` instead of printing it as a plain reason line.
+  - Declares `minReadyupVersion: '0.37.0'` on the kit, the readyup release that introduced `CheckOutcome.fix`, which retires the kit's `version-skew` advisory and makes an older runner fail to load the kit.
+
+  Migration: Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.
+
+- Accept a --config argument on every config-reading subcommand (#857)
+
+  - Adds `--config <path>` to `prepare`, `publish`, `create-github-release`, `show-tag-prefixes`, `overrides validate`, `sync-labels init`, and `sync-labels generate`, each of which then reads the named file in place of `.config/release-kit.config.ts`.
+  - Requires a named `--config` file to exist, failing if it does not; an absent default path continues to mean that the repo declares no config.
+  - Confines scaffolding to the default path: `release-kit init` and `sync-labels init` still write `.config/release-kit.config.ts`, and `sync-labels init --config` reads the named file and fails when it is absent.
+
+- 🚨 **Breaking:** Adopt the shared workspace resolver in release-kit, honoring exclusions (#865)
+
+  - 🚨 **Breaking:** Narrows `no-pattern` in `@williamthorsen/nmr-core`'s `EmptyWorkspaceCause`, moving an absent or empty `packages` list onto `no-packages-list` and a value that is not a list of strings onto `unreadable-packages`.
+  - Stops `release-kit` from tagging, publishing, and label-syncing a package that a `!` entry in `pnpm-workspace.yaml` excludes, which its previous `glob`-based resolution could not remove from the match.
+  - Replaces the release of the root package alone with a failure naming the condition that emptied the workspace, when `pnpm-workspace.yaml` does not hold valid YAML or declares a workspace that does not resolve to a package.
+  - Replaces the `no-pattern` remedy that `nmr` printed for a `pnpm-workspace.yaml` declaring no `packages` list, and for one declaring a `packages` value that is not a list of strings.
+  - Raises `engines.node` to `>=24.16.0` in `@williamthorsen/nmr-core` and `@williamthorsen/release-kit`, because Node 24.0 through 24.15 ignores the `followSymlinks` option that the workspace matcher passes to `globSync` and drops a symlinked package directory from the resolution without reporting it.
+
+  Migration: Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.
+
+### 🐛 Bug fixes
+
+- Truncate release-kit commit subjects by display column (#840)
+
+  - Fixes the issue that the `release-kit` prepare report cut a commit subject at 69 UTF-16 code units instead of at display columns, so a subject of CJK characters printed about twice the intended 72-column width and a cut inside an emoji left a broken character that a terminal drew as a replacement glyph.
+  - Replaces the `...` marker on a truncated subject with `…`, the default of the width-aware truncation that now does the cutting.
+  - Exports `truncateToWidth` and `measureWidth` from `@williamthorsen/nmr-core`, which measure and cut text by display width without splitting a grapheme cluster.
+
+- Abort show-tag-prefixes on an unusable config (#861)
+
+  - Fixes the issue that `release-kit show-tag-prefixes` silently ignored a config file that failed schema validation, which left the preview reading no `legacyIdentities` and no `retiredPackages` and reporting already-declared and retired tag prefixes as undeclared candidates; the command now prints those validation errors and exits 1 with no preview.
+
+- Abort every config-reading command on an unusable default config (#869)
+
+  - Fixes `publish` proceeding on derived defaults when the default config file exists and fails to load, which silently dropped a configured `releaseNotes.shouldInjectIntoReadme`, `changelogJson.outputPath`, or `workTypes`; it now reports the failure and exits 1, as every other config-reading subcommand does.
+  - Fixes `publish` and `create-github-release` ignoring a broken or invalid default config when every requested tag names a private package, a case in which both commands return before any loader runs.
+
+- Strip trailing Change trailers from changelog item bodies (#870)
+
+  - Fixes a changelog item body that kept a commit's trailing `Change:` trailers, which then appeared verbatim in the rendered release notes, including the notes injected into a README.
+
+## 10.9.0 — 2026-09-18
+
+### 🎉 Features
+
+- Give release-kit plain output in pipes and CI logs (#835)
+
+  - Adds the `RELEASE_KIT_OUTPUT_STYLE` environment variable, which accepts `auto`, `plain`, or `rich` and outranks the detection from `CI`, the stream's terminal state, and `TERM`; any other value is a usage error that exits with code 1.
+  - Changes the emoji in rich output so that none has a different meaning from the one that it has in `nmr`: warnings from ⚠️ to 🟠, skips from ⏭️ to ⏩, the errors of `show-tag-prefixes` from ⛔ to ❌, and the tag marker from 🏷️ to 🔖.
+  - Adds a required `style` parameter to `formatValidateOverridesResult`, which the package root exports.
+
+- Give nmr plain output in pipes and CI logs (#838)
+
+  - Stops `nmr` from printing emoji to a pipe or a CI log: When the output stream is not a terminal or `CI` is set, a verdict reads `PASS`, `FAIL`, `SKIP`, or `NOOP` and a command icon is omitted, so that a log can be searched for a verdict.
+  - Adds `--output-style <auto|plain|rich>` to `nmr` and the `NMR_OUTPUT_STYLE` variable, each forcing either style; the flag outranks the variable, a value that names no style exits 1 with a usage error, and neither enters a check-cache key: A rich run and a plain run share a recorded pass.
+  - Replaces several rich glyphs, taking the status markers from the set that release-kit and v11y-check print so that one status has one glyph across the three tools: a recalled pass shows ⏩ in place of ⏭️, a skipped empty override shows ⚪ in place of ⛔, a warning and the `--log` refusal show 🟠 in place of ⚠️ and 📭, the `--log` header shows 💾 in place of 📼, and `nmr-ensure-prepublish-hooks` reports ✅ and ❌ in place of ✓ and ✗.
+
+### 🐛 Bug fixes
+
+- Move work-types check and sync from the CLI into maintainer scripts (#820)
+
+  - Removes the `release-kit work-types` command, whose `sync` rewrote an unused copy of `work-types.json` inside `node_modules` and whose `check` reported drift that a consumer could not fix.
+
+- Exclude distributed agent guidance from ai and documentation labels (#825)
+
+  - Marks a `.github/labels.yaml` generated from the previous `common` preset as stale in the default readyup kit, whose "labels.yaml has current common preset" check reports the file until the repo regenerates it.
+
+- Suppress bold and dim escapes for a stream that cannot render them (#830)
+
+  - Stops `release-kit prepare` from writing raw escape bytes into piped output, redirected files, and CI logs: It styled bold and dim unconditionally, without checking whether the destination renders escapes.
+  - Honors `NO_COLOR`, `NODE_DISABLE_COLORS`, and `FORCE_COLOR`, which the previous styling ignored.
+
 ## 10.8.0 — 2026-09-15
 
 ### 🎉 Features
@@ -334,7 +413,7 @@ All notable changes to this project will be documented in this file.
 
 ### ♻️ Refactoring
 
-- 🚨 **Breaking:** Move defineConfig to a dedicated config subpath (#566)
+- Move defineConfig to a dedicated config subpath (#566)
 
   `defineConfig` now comes from the `@williamthorsen/release-kit/config` subpath rather than from the package root. The subpath also carries the config types.
 
@@ -680,11 +759,11 @@ All notable changes to this project will be documented in this file.
 
 ### ♻️ Refactoring
 
-- 🚨 **Breaking:** Rename `component` to `workspace` in config API and internals (#296)
+- Rename `component` to `workspace` in config API and internals (#296)
 
   Renames release-kit's per-workspace vocabulary from "component" to "workspace" throughout the public API, internal types, validation messages, CLI help, init templates, and documentation. Behavior is unchanged; only identifiers, error-message strings, scaffolded template text, and prose have been changed.
 
-- 🚨 **Breaking:** Rename `node-monorepo-core` to `nmr-core` (#304)
+- Rename `node-monorepo-core` to `nmr-core` (#304)
 
   Renames the shared-utilities package from `@williamthorsen/node-monorepo-core` to `@williamthorsen/nmr-core`, aligning it with the repository's `nmr-*` naming convention. The package's functionality and version are unchanged; only the published name differs.
 

package/README.md

@@ -7,20 +7,53 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from `git-cliff --context` output rendered in-process (with optional [editorial overrides](docs/editorial-overrides.md)).
 
 <!-- section:release-notes -->
-## Release notes — v10.8.0 (2026-09-15)
+## Release notes — v11.0.0 (2026-09-22)
 
 ### 🎉 Features
 
-- Allow the breaking marker on fix and perf commits (#818)
+- 🚨 **Breaking:** Return the provenance check's remediation as the outcome's fix (#855)
 
-  - Makes `release-kit prepare` bump the major version for a `fix!` or `perf!` commit under the default breaking policies, instead of reporting a policy violation and bumping only the patch version while the changelog marked the entry breaking.
-  - Corrects `docs/work-types.md` to state that a `breakingPolicies` map replaces the default policies rather than overriding individual types, and that release-kit treats every type omitted by the map as `optional`.
+  - Moves the remediation of the `npm-auto-publish` kit's `Provenance setting matches repo visibility` check from the failing outcome's `detail` into its `fix`, so that readyup marks it as a remedy, lists it in the `Fixes` recap, and reports it under `rdy run --json --detail summary` instead of printing it as a plain reason line.
+  - Declares `minReadyupVersion: '0.37.0'` on the kit, the readyup release that introduced `CheckOutcome.fix`, which retires the kit's `version-skew` advisory and makes an older runner fail to load the kit.
+
+  Migration: Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.
+
+- Accept a --config argument on every config-reading subcommand (#857)
+
+  - Adds `--config <path>` to `prepare`, `publish`, `create-github-release`, `show-tag-prefixes`, `overrides validate`, `sync-labels init`, and `sync-labels generate`, each of which then reads the named file in place of `.config/release-kit.config.ts`.
+  - Requires a named `--config` file to exist, failing if it does not; an absent default path continues to mean that the repo declares no config.
+  - Confines scaffolding to the default path: `release-kit init` and `sync-labels init` still write `.config/release-kit.config.ts`, and `sync-labels init --config` reads the named file and fails when it is absent.
+
+- 🚨 **Breaking:** Adopt the shared workspace resolver in release-kit, honoring exclusions (#865)
+
+  - 🚨 **Breaking:** Narrows `no-pattern` in `@williamthorsen/nmr-core`'s `EmptyWorkspaceCause`, moving an absent or empty `packages` list onto `no-packages-list` and a value that is not a list of strings onto `unreadable-packages`.
+  - Stops `release-kit` from tagging, publishing, and label-syncing a package that a `!` entry in `pnpm-workspace.yaml` excludes, which its previous `glob`-based resolution could not remove from the match.
+  - Replaces the release of the root package alone with a failure naming the condition that emptied the workspace, when `pnpm-workspace.yaml` does not hold valid YAML or declares a workspace that does not resolve to a package.
+  - Replaces the `no-pattern` remedy that `nmr` printed for a `pnpm-workspace.yaml` declaring no `packages` list, and for one declaring a `packages` value that is not a list of strings.
+  - Raises `engines.node` to `>=24.16.0` in `@williamthorsen/nmr-core` and `@williamthorsen/release-kit`, because Node 24.0 through 24.15 ignores the `followSymlinks` option that the workspace matcher passes to `globSync` and drops a symlinked package directory from the resolution without reporting it.
+
+  Migration: Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.
 
 ### 🐛 Bug fixes
 
-- Omit the breaking marker from changelog entries whose type forbids it (#819)
+- Truncate release-kit commit subjects by display column (#840)
+
+  - Fixes the issue that the `release-kit` prepare report cut a commit subject at 69 UTF-16 code units instead of at display columns, so a subject of CJK characters printed about twice the intended 72-column width and a cut inside an emoji left a broken character that a terminal drew as a replacement glyph.
+  - Replaces the `...` marker on a truncated subject with `…`, the default of the width-aware truncation that now does the cutting.
+  - Exports `truncateToWidth` and `measureWidth` from `@williamthorsen/nmr-core`, which measure and cut text by display width without splitting a grapheme cluster.
 
-  - Makes the configured `breakingPolicies` map decide whether the changelog marks a commit breaking, as it already decides the version bump.
+- Abort show-tag-prefixes on an unusable config (#861)
+
+  - Fixes the issue that `release-kit show-tag-prefixes` silently ignored a config file that failed schema validation, which left the preview reading no `legacyIdentities` and no `retiredPackages` and reporting already-declared and retired tag prefixes as undeclared candidates; the command now prints those validation errors and exits 1 with no preview.
+
+- Abort every config-reading command on an unusable default config (#869)
+
+  - Fixes `publish` proceeding on derived defaults when the default config file exists and fails to load, which silently dropped a configured `releaseNotes.shouldInjectIntoReadme`, `changelogJson.outputPath`, or `workTypes`; it now reports the failure and exits 1, as every other config-reading subcommand does.
+  - Fixes `publish` and `create-github-release` ignoring a broken or invalid default config when every requested tag names a private package, a case in which both commands return before any loader runs.
+
+- Strip trailing Change trailers from changelog item bodies (#870)
+
+  - Fixes a changelog item body that kept a commit's trailing `Change:` trailers, which then appeared verbatim in the rendered release notes, including the notes injected into a README.
 <!-- /section:release-notes -->
 
 ## Installation
@@ -54,10 +87,10 @@ Example output from `prepare --dry-run` in a monorepo whose `arrays` workspace h
     [dry-run] Would bump packages/arrays/package.json
   Generating changelogs...
     [dry-run] Would run: npx --prefer-offline --yes git-cliff@<version> ... --output packages/arrays/CHANGELOG.md
-  🏷️  arrays-v1.3.0
+  🔖 arrays-v1.3.0
 
 ✅ Release preparation complete.
-   🏷️  arrays-v1.3.0
+   🔖 arrays-v1.3.0
   [dry-run] Would write tmp/.release-tags: arrays-v1.3.0
   [dry-run] Would write tmp/.release-summary
 ```
@@ -73,8 +106,8 @@ The CLI applies defaults to every discovered workspace and uses the bundled `cli
 
 ## How it works
 
-1. **Workspace discovery**: reads `pnpm-workspace.yaml` and resolves its `packages` globs to find workspace directories. Each directory containing a `package.json` becomes a workspace. If no workspace file is found, the repo is treated as a single-package project.
-2. **Config loading**: loads `.config/release-kit.config.ts` (if present) and merges it with discovered defaults.
+1. **Workspace discovery**: reads `pnpm-workspace.yaml` and resolves its `packages` patterns to find workspace directories, applying pnpm's semantics — a `!`-prefixed entry excludes what it matches, wherever it appears in the list. Each directory containing a `package.json` becomes a workspace. The repo is treated as a single-package project when it holds no workspace file, and when the workspace file declares no `packages` list — a file kept for `catalog:` or `overrides:` alone, which pnpm likewise resolves to the root package. A workspace file that declares patterns resolving to no package is an error naming the condition that emptied it.
+2. **Config loading**: loads `.config/release-kit.config.ts` (if present), or the file named by `--config`, and merges it with discovered defaults.
 3. **Commit analysis**: for each workspace, finds commits since the last version tag, parses them for type and scope, and determines the appropriate version bump.
 4. **Version bump + changelog**: bumps `package.json` versions, builds structured `ChangelogEntry[]` from `git-cliff --context`, applies any [editorial overrides](docs/editorial-overrides.md) from per-scope `.meta/changelog-overrides.json` files, and renders both `CHANGELOG.md` and `.meta/changelog.json` from that single source. `git-cliff` is invoked only for its `--context` JSON; markdown rendering happens in-process so `.meta/changelog.json` and `CHANGELOG.md` always agree.
 5. **Release tags file**: writes computed tags to `tmp/.release-tags` for the release workflow to read when tagging and pushing.
@@ -102,6 +135,8 @@ The `scope|type:` format scopes a commit to a specific workspace in a monorepo.
 
 Configuration is optional. The CLI works out of the box by auto-discovering workspaces and applying defaults. Create `.config/release-kit.config.ts` only when you need to customize behavior.
 
+Every subcommand that reads a config accepts `--config <path>` to read a file elsewhere. An absent default path means "no config"; an absent `--config` path fails the command. See [Config file location](docs/configuration.md#config-file-location).
+
 ```typescript
 import { defineConfig } from '@williamthorsen/release-kit/config';
 
@@ -173,7 +208,7 @@ No cliff config copy is needed — the bundled template is used automatically. T
 - [Publishing](docs/publishing.md): `publish`, the publishability filter, and `create-github-release`
 - [Changelogs](docs/changelogs.md): the `changelog.json` item schema, the git-cliff config, and release-notes injection
 - [Editorial overrides](docs/editorial-overrides.md): correcting generated changelog entries, and `overrides validate`
-- [Work types and tiers](docs/work-types.md): tiers, the `!` policy, markers, custom work types, and `work-types check` and `sync`
+- [Work types and tiers](docs/work-types.md): tiers, the `!` policy, markers, custom work types, and maintenance of the bundled taxonomy
 - [Labels](docs/labels.md): `sync-labels`, label configuration, the workflow's triggers, and the `label-map.json` schema
 - [Readiness checks](docs/readiness-checks.md): both readyup kits, and how to run each
 - [Programmatic API](docs/api.md): `deriveWorkspaceConfig()`, the script-based approach, and `resolveReleaseTags`