@williamthorsen/release-kit 11.0.0 → 13.0.0

package/.meta/changelog.json

@@ -1,4 +1,276 @@
 [
+  {
+    "version": "13.0.0",
+    "date": "2026-10-01",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds the `--config <path>` flag to `release-kit push`, which now reads the config as `publish` and `create-github-release` do and fails when the file exists but is invalid. (#895)",
+            "hash": "6aea08cf0154f2d1cc253a44cd9b09c283ad3248",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit` add an item derived from a change-record entry to a workspace's changelog and version bump only when the entry's `scopes`, after `scopeAliases` resolution, name the workspace's `dir`, are empty, or contain `*`, and extends that rule to the sections of earlier releases that `release-kit prepare` rebuilds. (#896)",
+            "hash": "066c6bde1ad4fda6705066f538283e9c80a92a1e",
+            "entry": 1
+          },
+          {
+            "description": "Adds a warning to the `release-kit prepare` report that lists each change-record entry scope matching no workspace in its commit's window, such as a misspelled scope or the old name of a renamed directory that has no `scopeAliases` entry. (#896)",
+            "hash": "066c6bde1ad4fda6705066f538283e9c80a92a1e",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit overrides validate` check a workspace's overrides against only the entries routed to that workspace, so that an override keyed to an entry routed elsewhere is reported as stale. (#896)",
+            "hash": "066c6bde1ad4fda6705066f538283e9c80a92a1e",
+            "entry": 3
+          },
+          {
+            "description": "Adds `release-kit update-templates`, which writes each scaffolded workflow that is missing or differs from the installed template, prints a diff of each updated file, refreshes `sync-labels.yaml` only when it exists, keeps `publish.yaml`'s provenance setting, and never reads or writes the config files. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 1
+          },
+          {
+            "description": "Changes the readyup kits' fix messages for a workflow that differs from its template, or that references a deprecated tag, to recommend `update-templates` rather than `init --force`. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "🪦 Removed",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Removes `required` as a `breakingPolicies` value, making `drop` default to `optional` so that an unmarked `drop:` commit no longer reports a policy violation. (#905)",
+            "breaking": true,
+            "migration": "Remove each `'required'` value from `breakingPolicies` in `release-kit.config.ts`, or replace it with `'optional'`.",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit` from parsing a commit subject that combines a pipe scope with a parenthesized scope, such as `web|feat(other): ...`, or that lacks a space and a title after the colon, because subjects are now read through `@williamthorsen/change-grammar`. (#905)",
+            "migration": "Rewrite a combined subject such as `web|feat(other): ...` as `web|feat: ...`, and follow the colon with a space and a title.",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 2
+          },
+          {
+            "description": "Stops publishing `schemas/label-map.json` from `release-kit`, whose identical schema `@williamthorsen/change-grammar` now publishes; URLs under existing `release-kit-v*` tags keep resolving. (#905)",
+            "migration": "Point the `$schema` of `.meta/label-map.json` at `https://github.com/williamthorsen/node-monorepo-tools/raw/change-grammar-v<version>/packages/change-grammar/schemas/label-map.json`, and keep an existing `release-kit-v*` URL until a `change-grammar-v*` tag exists, since that URL does not resolve before then.",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Record a changelog entry for a forced release whose commits yield no item (#887)",
+            "body": "Makes `release-kit prepare` record the \"Forced version bump.\" changelog entry for any release forced by `--force` or `--set-version` whose commits yield no changelog item, instead of only for a release with no commits at all. It also stops a monorepo's project release from dropping the forced-release entries that earlier releases recorded.",
+            "hash": "e806c32a4f412abde5d7ab22f150506e946b3a87"
+          },
+          {
+            "description": "Stops `release-kit prepare` from reporting `commitCount` 0 and dropping the unparseable commits and change-record and policy diagnostics of a workspace released only because a dependency was bumped, and makes `prepare` list that workspace's commits in the release commit summary under its tag. (#888)",
+            "hash": "d60ac32b7452b850c98571017e5f7f373479fc10",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit prepare` from labeling a direct release that has no commits as bumped via a dependency, by marking a propagation-only release with the new `propagatedOnly` result field, whose report line now reads `Bumped via dependency: …` in place of `0 commits (bumped via dependency: …)`. (#888)",
+            "hash": "d60ac32b7452b850c98571017e5f7f373479fc10",
+            "entry": 2
+          },
+          {
+            "description": "Stops a `release-kit` command run from inside a package from releasing that package as a single-package repo with its own tag and changelog, by running every command from the repo root: the nearest directory that contains `pnpm-workspace.yaml`, or else the working directory when it contains a `package.json`. (#893)",
+            "hash": "97af8314da5dfe135c680310eb79f8309bc9918e",
+            "entry": 1
+          },
+          {
+            "description": "Stops `sync-labels generate` from writing the `--config` path into the `.github/labels.yaml` header as typed, which made the header and the result of `generate --check` depend on the directory from which the command ran; the header now names the config by its path relative to the repo root. (#893)",
+            "hash": "97af8314da5dfe135c680310eb79f8309bc9918e",
+            "entry": 2
+          },
+          {
+            "description": "Stops `push`, `publish`, and `create-github-release` from pushing, publishing, or creating a GitHub Release for a tag on HEAD whose workspace the config excludes with `shouldExclude: true`, which each command now skips with a warning, including when `--tags` names the tag or when every tag on HEAD is excluded. (#895)",
+            "hash": "6aea08cf0154f2d1cc253a44cd9b09c283ad3248",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit prepare` from silently deleting a `CHANGELOG.md` section whose version is absent from both the release windows and `changelog.json`, such as history written by hand before release-kit was adopted; `prepare` now keeps that section verbatim in version order, lists the kept versions in its report, and warns about each `##` section that names no version and is dropped. (#897)",
+            "hash": "9316ba5903b330895e258786d0fc7de005554cae",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit prepare` from folding every earlier commit into the new version, and deriving the bump from all of them, when the current version was released and recorded in the changelog but never tagged; `prepare` now fails before any write, under `--force` and `--set-version` too, and names each target and the tag to create. (#897)",
+            "hash": "9316ba5903b330895e258786d0fc7de005554cae",
+            "entry": 2
+          },
+          {
+            "description": "Adds the missing `removal` and `formatting` labels to the `common` preset by defining a label for every work type in change-grammar's taxonomy, and keeps the names, colors, and descriptions of the existing type labels. (#906)",
+            "hash": "ccdb3aa585d6fb36b2994cceb59df54caea12a79",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the `release.yaml` generated by `release-kit init`, which `actionlint` rejected because its `bump` choice input listed an empty string as the auto-detect option, by offering `auto` as the default option and passing it to the reusable release workflow as an empty `bump`. (#936)",
+            "hash": "9c0ef936a0d5b91fe64c5a1ea1be258f1678ea62",
+            "entry": 1
+          },
+          {
+            "description": "Rewords the error messages, `prepare` report lines, command help, and readyup kit fix strings of `release-kit` that addressed the reader as \"your\", separated a detail from its subject with an em-dash, or stated an absence with \"no\", such as \"No workspaces had release-worthy changes.\" (#937)",
+            "hash": "22ae182082e683ef94bf59db3bd23ca2c5b72c1f",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that the `release.yaml` and `sync-labels.yaml` workflows generated by `release-kit init` and `release-kit sync-labels init` contained unclear wording in two comments and in the `force` input description, which the change rewrites without altering any job, trigger, or input; the release-kit kit check reports a copy generated before this change as stale until `release-kit init --force` or `release-kit sync-labels init --force` regenerates it. (#946)",
+            "hash": "dc1c4bd4b05425ed1c2a7d031105c402c3d01f20",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit` titled a propagation-only bump's changelog section `Dependency updates` rather than with the resolved `deps` work type's header, `📦 Dependencies` by default or a consumer's `workTypes.deps.header` override, which broke the heading convention and left the section outside the section order. (#950)",
+            "hash": "5a4771a1cb1e1b324a9ce3cb64fc3527199946a7",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit init`'s next steps told a public repo to set `provenance: true` in `publish.yaml`, which the template already sets, and now tells a private repo to remove it instead. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 4
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Narrows the config accepted by `releasePrepare`, `releasePrepareMono`, `releasePrepareProject`, and the helpers that they pass it to, to the new `PrepareConfig` and `MonorepoPrepareConfig` aliases, which omit `releaseNotes` so that typecheck rejects any read of release-notes configuration on the prepare path. (#890)",
+            "hash": "e2b4e44f37a3f8254a42d98f67bc2f15d9e6c2c5",
+            "entry": 1
+          },
+          {
+            "description": "Derives `DEFAULT_WORK_TYPES`, `DEFAULT_BREAKING_POLICIES`, the default `devOnlySections`, and the release-notes breaking marker from change-grammar's `CANONICAL_TAXONOMY`, removing release-kit's taxonomy copy and its `work-types:check` and `work-types:sync` scripts. (#905)",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 4
+          },
+          {
+            "description": "Replaces every `.sort()` call that suppressed `unicorn/no-array-sort` with `toSorted()` and drops the spread copy wherever the source was already an array. (#925)",
+            "hash": "4680fb4e865ffce0bd135fac20d49b766b156992",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Extends the `changelogJson.enabled` tests of `releasePrepareMono` to configure a format command and assert that `formatCommand.files` includes the workspace's `changelog.json` when the feature is enabled and excludes it when the feature is disabled, where the disabled case also requires a format command to exist so that the exclusion cannot pass vacuously. (#889)",
+            "hash": "eaf3782e606b98ba360cde9eab08770e27155d2b",
+            "entry": 1
+          },
+          {
+            "description": "Replaces the inline copies of the fixture in which `app` depends on `core` in `releasePrepareMono.unit.test.ts` with `stubPropagationWorkspaces`, a helper that stubs both manifests at their exact paths and returns the two-workspace config. (#951)",
+            "hash": "c1d511c5ae570e75358cd642b90b4979723fe375",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "📦 Dependencies",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Upgrades all dependencies to the latest versions allowed by the ceilings in `taze.config.ts` and the release quarantine, including pnpm to 12.6.0. (#944)",
+            "hash": "6dffd5df5bc4209dc225d08390ef2b67fe381f1b",
+            "entry": 1
+          },
+          {
+            "description": "Adds `esbuild` 0.28.2 to the pnpm catalog and declares it as a devDependency of `nmr`, `release-kit`, and `v11y-check`, because `readyup` declares it only as an optional peer and `rdy compile` failed in those packages once a regenerated lockfile stopped installing it. (#944)",
+            "hash": "6dffd5df5bc4209dc225d08390ef2b67fe381f1b",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Revises the comments in `packages/release-kit/src` and the `default` and `npm-auto-publish` readyup kits against the comment-discipline rules, correcting comments that misstated the code, such as the `releasePrepareProject` description that said it returns `undefined` where it throws and the `renderChangelogMarkdown` note that said no logic reads the footer. (#922)",
+            "hash": "176d09caec47686fa0023a31c5f77d4e2362d9bb",
+            "entry": 1
+          },
+          {
+            "description": "Rewrites the prose of the `release-kit` README, the pages under `docs/`, and the package's source comments and test names in plain, literal wording. (#937)",
+            "hash": "22ae182082e683ef94bf59db3bd23ca2c5b72c1f",
+            "entry": 2
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "12.0.0",
+    "date": "2026-09-23",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Assign changelog sections from the work-type taxonomy (#877)",
+            "body": "- Adds `excludedFromChangelog` to a `workTypes` entry, which keeps commits of that type out of every changelog while they still count toward the version bump.\n- Fixes the silent omission of a ticketed commit written as `type(scope):` or with a capitalized type such as `FEAT:`, which counted toward the version bump but reached no changelog.\n- Documents that a scaffolded `.config/git-cliff.toml` may vary its enumeration keys alone: a `commit_parsers` entry that skips or narrows drops the commit before classification, with no error.",
+            "hash": "52d4ea928d35b99101947e0509da6699f06f821a"
+          },
+          {
+            "description": "Build changelog items from a merge commit's change-record block (#882)",
+            "body": "Builds `release-kit` changelog items from a commit's `change-record` block, the fenced YAML block at the end of a squash-merge commit that lists the change's outcomes, so that a merge with several outcomes of different types yields one item per outcome, each under its own type's section. Makes `release-kit prepare` warn about a block that cannot be read, an entry whose type is undeclared, and an entry that violates its type's breaking policy. Keeps reading a commit with no usable block from its title, as before.",
+            "hash": "094aac7048a54b6f07d1c97cd37fff570630b936"
+          },
+          {
+            "description": "Derive the version bump from the changelog items (#885)",
+            "body": "Derives the version bump in every `release-kit prepare` path (single-package, project, and monorepo) from the changelog items of the unreleased commits, so that the bump and the changelog describe the same release. A commit that yields no changelog item no longer bumps, and a `BREAKING CHANGE:` footer no longer raises a major bump. Single-package mode now follows the monorepo rules for `--bump` and `--force`, and the `prepare` report shows the diagnostics of a skipped target.\n\nMigration: Mark a breaking change with a `!` on the commit subject or with `breaking: true` on its change-record entry, because a `BREAKING CHANGE:` footer alone now gets the bump of the commit's type. Give each commit that should bump a ticket-ID prefix and a type that the changelog does not exclude. In single-package mode, add `--force` to a release that used `--bump=X` alone, or that relied on the patch floor, when no commit yields a changelog item; without it, `prepare` skips the release.",
+            "breaking": true,
+            "migration": "Mark a breaking change with a `!` on the commit subject or with `breaking: true` on its change-record entry, because a `BREAKING CHANGE:` footer alone now gets the bump of the commit's type. Give each commit that should bump a ticket-ID prefix and a type that the changelog does not exclude. In single-package mode, add `--force` to a release that used `--bump=X` alone, or that relied on the patch floor, when no commit yields a changelog item; without it, `prepare` skips the release.",
+            "hash": "f3d0d8f01d6cd5b5638012a4798e64ab3a3def6d"
+          },
+          {
+            "description": "Key an editorial override to one of several items on a commit (#886)",
+            "body": "Adds the `<hash>:<n>` key to `.meta/changelog-overrides.json`. It targets one of the several changelog items that a commit's change-record block yields, while a bare `<hash>` key still targets all of them. Also makes `release-kit prepare` and `release-kit overrides validate` fail when override keys conflict on an item, and publishes a JSON Schema for the override file.\n\nMigration: Replace a bare key that sets `description` or `body` on a commit with several items with one `<hash>:<n>` key per item, as listed by the error message. Where two keys match the same item, such as `abc1234` beside `abc1234:2`, remove one of them. This includes a root-file key that overlaps a workspace-file key, which now fails even though the two files are separate. In each scope passed to `validateAllChangelogOverrides`, rename `hashes` to `items` and pass `OverrideTargetItem` objects (`{ hash, entry? }`) instead of hash strings.",
+            "breaking": true,
+            "migration": "Replace a bare key that sets `description` or `body` on a commit with several items with one `<hash>:<n>` key per item, as listed by the error message. Where two keys match the same item, such as `abc1234` beside `abc1234:2`, remove one of them. This includes a root-file key that overlaps a workspace-file key, which now fails even though the two files are separate. In each scope passed to `validateAllChangelogOverrides`, rename `hashes` to `items` and pass `OverrideTargetItem` objects (`{ hash, entry? }`) instead of hash strings.",
+            "hash": "f90db5596196e501fef1734bcd978d23f9a0540a"
+          }
+        ]
+      },
+      {
+        "title": "🪦 Removed",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Build changelogs from release-kit's own enumeration and remove git-cliff (#880)",
+            "body": "Removes git-cliff from `@williamthorsen/release-kit`: `prepare` now builds every changelog from the same commit history that decides each version bump, and no longer fetches a git-cliff binary through `npx`. A config that still sets `cliffConfigPath` now fails validation. Two ways in which the changelog and the bump read different commits are gone, affecting single-package repositories with a tag prefix other than `v` and `paths` entries that name a bare directory.\n\nMigration: Remove `cliffConfigPath` from `.config/release-kit.config.ts`, and delete `.config/git-cliff.toml` or `cliff.toml` if the repository has one. Any customization in that file, such as `tag_pattern` or its tag-skipping keys, no longer has an effect: `release-kit` now splits the changelog on the configured tag prefixes alone.",
+            "breaking": true,
+            "migration": "Remove `cliffConfigPath` from `.config/release-kit.config.ts`, and delete `.config/git-cliff.toml` or `cliff.toml` if the repository has one. Any customization in that file, such as `tag_pattern` or its tag-skipping keys, no longer has an effect: `release-kit` now splits the changelog on the configured tag prefixes alone.",
+            "hash": "3dc091ff6067f1c2cbe1576a55114c481294ce22"
+          }
+        ]
+      },
+      {
+        "title": "🏗️ Internal features",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Enumerate release windows and read them on the bump path (#879)",
+            "body": "Adds `enumerateReleaseWindows`, which splits the history reachable from HEAD into release windows from tag prefixes and a path list, and rebuilds `getCommitsSinceTarget` on the newest of those windows in place of its `git describe` baseline lookup. Leaves the changelog on git-cliff's enumeration.",
+            "hash": "30586d1e045ed69dbf81a1c35773c97b89e0c8dc"
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "11.0.0",
     "date": "2026-09-22",
@@ -408,7 +680,7 @@
           },
           {
             "description": "Adopt `isError` and consolidate errno narrowing on a shared helper (#697)",
-            "body": "Replaces every hand-rolled `instanceof Error` narrowing with `hasErrnoCode`, a new predicate exported from `@williamthorsen/nmr-core`, or with `isError` from `@williamthorsen/toolbelt.errors`. Previously the errno question was answered by inline copies alongside two private helpers of differing shape; both helpers are removed.\r\n\r\nSeparately, `eslint.config.ts` now bans `instanceof Error` in every position rather than in a ternary alone.",
+            "body": "Replaces every hand-rolled `instanceof Error` narrowing with `hasErrnoCode`, a new predicate exported from `@williamthorsen/nmr-core`, or with `isError` from `@williamthorsen/toolbelt.errors`. Previously the errno question was answered by inline copies alongside two private helpers of differing shape; both helpers are removed.\n\nSeparately, `eslint.config.ts` now bans `instanceof Error` in every position rather than in a ternary alone.",
             "hash": "c5e8e8a5e006b451e8c5aeea75d35772926d503c"
           }
         ]
@@ -529,7 +801,7 @@
           },
           {
             "description": "Make prepare all-or-nothing and report the tags file by path (#601)",
-            "body": "Fixes an issue where a failed `prepare` could leave the release flow in a broken intermediate state. A release now lands completely or not at all, and a formatting failure no longer discards one that already landed. When a write fails partway, the error names every file that reached disk, every file that did not, and the commands that undo them.\r\n\r\n`commit` and `tag` now report the full path of the tags file they looked for, and distinguish a missing file from one that could not be read, so that running from the wrong directory or worktree is no longer reported as a release that never happened.\r\n\r\nRuns with `--with-release-notes` now list the preview files they write, and `--dry-run` names the ones a real run would write.",
+            "body": "Fixes an issue where a failed `prepare` could leave the release flow in a broken intermediate state. A release now lands completely or not at all, and a formatting failure no longer discards one that already landed. When a write fails partway, the error names every file that reached disk, every file that did not, and the commands that undo them.\n\n`commit` and `tag` now report the full path of the tags file they looked for, and distinguish a missing file from one that could not be read, so that running from the wrong directory or worktree is no longer reported as a release that never happened.\n\nRuns with `--with-release-notes` now list the preview files they write, and `--dry-run` names the ones a real run would write.",
             "hash": "83ac6e45cf9d4b5371650cda42d7830ed4988660"
           }
         ]

package/.readyup/kits/default.js

@@ -98,7 +98,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "11.0.0" };
+  const picked = { "version": "13.0.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -114,11 +114,10 @@ var CONFIG_EXPORT_PATTERNS = [
   /export\s*\{[^}]*\b(?:config|default)\b[^}]*\}/,
   /export\s*\*/
 ];
-var CLIFF_TEMPLATE_HASH = "93b72e0b1393cd6b1fe8e2a0e303cd326fd323435951b0493396b305af32d2ec";
-var COMMON_PRESET_HASH = "8c52654d4eee216c22377dd1e65b89f6bbb0a3478d74379bd28b04a877f0b02a";
-var SYNC_LABELS_WORKFLOW_HASH = "d6e2403fb551d2d415f679125989c92760444eec887644565b2e05c9bf8f4c1e";
-var RELEASE_WORKFLOW_HASH_MONOREPO = "0a9724b7b3c5e24087fd3a8f36fed8e990d699267fcf36028ce048ab40dc2946";
-var RELEASE_WORKFLOW_HASH_SINGLE = "a3d19bbc1ba8bb30622e53c590137b97e3179e80988c0967737b021cdaeab73f";
+var COMMON_PRESET_HASH = "618bb5cbcbdd4f4f0c2a777add7e14d992d48483350dd9651bf8cf4c1fa9d418";
+var SYNC_LABELS_WORKFLOW_HASH = "6b50015e2919ffa4b16d0b4a1f340e585ff3e5b779a2256010d3c62fa07ff8f2";
+var RELEASE_WORKFLOW_HASH_MONOREPO = "f35503bcfc5c131a8309305fed27f8127cb901f422cb8b62978a34b86dda7f7a";
+var RELEASE_WORKFLOW_HASH_SINGLE = "d26dd4ca186632b388ea46bd885721124c03d19918e511baa40821d2d760da69";
 var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";
 var PUBLISH_WORKFLOW_HASH_SINGLE = "6f31183e0a1e66be791a19266c3b028dadbd9fe010f7fc4452f3f8970c937b43";
 var CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO = "c455d88c93d855737c96079945ff729a9d094f846519c24afbefe83a425c1d7f";
@@ -161,14 +160,14 @@ var default_default = defineRdyKit({
                 const hash = detectRepoType() === "monorepo" ? RELEASE_WORKFLOW_HASH_MONOREPO : RELEASE_WORKFLOW_HASH_SINGLE;
                 return fileMatchesHash(".github/workflows/release.yaml", hash);
               },
-              fix: "Run `release-kit init --force` to regenerate release.yaml from the current template"
+              fix: "Run `release-kit update-templates` to regenerate release.yaml from the current template"
             },
             {
               name: "release.yaml does not reference deprecated tag ref",
               severity: "error",
               quiet: true,
               check: () => fileDoesNotContain(".github/workflows/release.yaml", /@(release|publish)-workflow-v[0-9]/),
-              fix: "Update release.yaml to use @workflow/release-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
+              fix: "Update release.yaml to use @workflow/release-v1 (run `release-kit update-templates` to regenerate, or replace the ref manually)"
             }
           ]
         },
@@ -186,14 +185,14 @@ var default_default = defineRdyKit({
                 const hash = detectRepoType() === "monorepo" ? PUBLISH_WORKFLOW_HASH_MONOREPO : PUBLISH_WORKFLOW_HASH_SINGLE;
                 return fileMatchesHash(".github/workflows/publish.yaml", hash);
               },
-              fix: "Run `release-kit init --force` to regenerate publish.yaml from the current template"
+              fix: "Run `release-kit update-templates` to regenerate publish.yaml from the current template"
             },
             {
               name: "publish.yaml does not reference deprecated tag ref",
               severity: "error",
               quiet: true,
               check: () => fileDoesNotContain(".github/workflows/publish.yaml", /@(release|publish)-workflow-v[0-9]/),
-              fix: "Update publish.yaml to use @workflow/publish-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
+              fix: "Update publish.yaml to use @workflow/publish-v1 (run `release-kit update-templates` to regenerate, or replace the ref manually)"
             }
           ]
         },
@@ -205,14 +204,14 @@ var default_default = defineRdyKit({
             const hash = detectRepoType() === "monorepo" ? CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO : CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE;
             return fileMatchesHash(".github/workflows/create-github-release.yaml", hash);
           },
-          fix: "Run `release-kit init --force` to regenerate create-github-release.yaml from the current template"
+          fix: "Run `release-kit update-templates` to regenerate create-github-release.yaml from the current template"
         },
         {
           name: ".config/release-kit.config.ts exports a config",
           severity: "error",
           skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
           check: () => configFileExportsConfig(),
-          fix: "Export the config from .config/release-kit.config.ts as a default export or as a named `config` export; release-kit resolves no other export",
+          fix: "Export the config from .config/release-kit.config.ts as a default export or as a named `config` export; release-kit does not resolve any other export",
           checks: [
             {
               name: "releaseNotes config is consistent with changelogJson",
@@ -224,7 +223,7 @@ var default_default = defineRdyKit({
               name: ".config/release-kit.config.ts uses defineConfig",
               severity: "recommend",
               check: () => fileContains(".config/release-kit.config.ts", /defineConfig/),
-              fix: "Wrap your config export with defineConfig() from @williamthorsen/release-kit/config for type safety"
+              fix: "Wrap the config export with defineConfig() from @williamthorsen/release-kit/config for type safety"
             },
             {
               name: "releaseNotes.shouldInjectIntoReadme is true",
@@ -263,8 +262,9 @@ var default_default = defineRdyKit({
             }
           ]
         },
-        // Deliberately outside the config gate above: that check skips where the config file is absent, and a repo
-        // with no config file still defaults `changelogJson.enabled` to true and still publishes tarballs.
+        // Keep these checks outside the config gate above, which skips when the config file is absent: For a repo
+        // without a config file, release-kit still defaults `changelogJson.enabled` to true, and the repo still
+        // publishes tarballs.
         {
           name: "published packages ship CHANGELOG.md",
           severity: "warn",
@@ -277,7 +277,7 @@ var default_default = defineRdyKit({
           severity: "recommend",
           skip: () => !hasPublishablePackages() ? "no publishable packages" : false,
           check: () => changelogJsonIsEnabled(),
-          fix: "Remove changelogJson.enabled: false from .config/release-kit.config.ts so release-kit writes the machine-readable changelog that upgrade tooling reads before CHANGELOG.md",
+          fix: "Remove changelogJson.enabled: false from .config/release-kit.config.ts so that release-kit writes the machine-readable changelog that upgrade tooling reads before CHANGELOG.md",
           checks: [
             {
               name: "published packages ship the changelog JSON",
@@ -296,13 +296,6 @@ var default_default = defineRdyKit({
           check: () => fileDoesNotContain(".config/release-kit.config.ts", /shouldCreateGithubRelease/),
           fix: "Remove 'shouldCreateGithubRelease' from .config/release-kit.config.ts. Adoption of GitHub Releases is now signaled by installing the create-github-release workflow, which `release-kit init` scaffolds."
         },
-        {
-          name: "git-cliff not in devDependencies",
-          severity: "recommend",
-          quiet: true,
-          check: () => !hasDevDependency("git-cliff"),
-          fix: "pnpm remove git-cliff \u2014 release-kit handles changelog generation directly"
-        },
         {
           name: "@changesets/cli not in devDependencies",
           severity: "recommend",
@@ -310,13 +303,6 @@ var default_default = defineRdyKit({
           check: () => !hasDevDependency("@changesets/cli"),
           fix: "pnpm remove @changesets/cli, then delete .changeset/ and any changeset:* scripts; release-kit supersedes changesets"
         },
-        {
-          name: ".config/git-cliff.toml matches current template",
-          severity: "warn",
-          skip: () => !fileExists(".config/git-cliff.toml") ? "no local cliff config (using fallback)" : false,
-          check: () => fileMatchesHash(".config/git-cliff.toml", CLIFF_TEMPLATE_HASH),
-          fix: "Update .config/git-cliff.toml to match the current cliff.toml.template from release-kit, or delete it to use the bundled fallback"
-        },
         {
           name: "sync-labels.yaml workflow exists",
           severity: "warn",
@@ -327,7 +313,7 @@ var default_default = defineRdyKit({
               name: "sync-labels.yaml matches template",
               severity: "warn",
               check: () => fileMatchesHash(".github/workflows/sync-labels.yaml", SYNC_LABELS_WORKFLOW_HASH),
-              fix: "Run `release-kit sync-labels init --force` to regenerate the workflow from the current template"
+              fix: "Run `release-kit update-templates` to regenerate the workflow from the current template"
             }
           ]
         },
@@ -336,7 +322,7 @@ var default_default = defineRdyKit({
           severity: "error",
           quiet: true,
           check: () => fileDoesNotContain(".github/workflows/sync-labels.yaml", /@sync-labels-workflow-v[0-9]/),
-          fix: "Update sync-labels.yaml to use @workflow/sync-labels-v1 (run `release-kit sync-labels init --force` to regenerate, or replace the ref manually)"
+          fix: "Update sync-labels.yaml to use @workflow/sync-labels-v1 (run `release-kit update-templates` to regenerate, or replace the ref manually)"
         },
         {
           name: "retired .config/sync-labels.config.ts is absent",
@@ -425,7 +411,6 @@ function resolveChangelogJsonOutputPath() {
   return match?.[1] ?? DEFAULT_CHANGELOG_JSON_PATH;
 }
 export {
-  CLIFF_TEMPLATE_HASH,
   COMMON_PRESET_HASH,
   CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO,
   CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE,

package/.readyup/kits/npm-auto-publish.js

@@ -17,6 +17,13 @@ import {
   readFile,
   readJsonFile
 } from "readyup/check-utils";
+
+// src/init/hasProvenance.ts
+function hasProvenance(workflowContent) {
+  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
+}
+
+// .readyup/kits/npm-auto-publish.ts
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["E401", "ENEEDAUTH"]);
 var OTP_ERROR_CODE = "EOTP";
 var PUBLISH_WORKFLOW_FILE = "publish.yaml";
@@ -41,7 +48,7 @@ var repoChecklist = defineRdyChecklist({
         {
           name: "id-token: write permission declared",
           check: () => fileContains(".github/workflows/publish.yaml", /id-token:\s*write/),
-          fix: 'Add "permissions: { id-token: write, contents: read }" to .github/workflows/publish.yaml \u2014 required for OIDC-based npm authentication'
+          fix: 'Add "permissions: { id-token: write, contents: read }" to .github/workflows/publish.yaml; OIDC-based npm authentication requires it'
         },
         {
           name: "No legacy token references in workflow files",
@@ -69,18 +76,17 @@ var packagesChecklist = defineRdyChecklist({
       },
       fix: 'Set "packageManager": "pnpm@..." in root package.json'
     },
-    // Unfalsifiable on readyup 0.33 and later, where discovery reports the repo root and throws on an unreadable
-    // root package.json rather than returning an empty list. It stays for a consumer below that, whose monorepo
-    // mode returns the matched directories alone and so returns nothing when the globs match nothing.
+    // Unfalsifiable on every readyup version that `minReadyupVersion` admits: Discovery reports the repo root, and it
+    // throws on an unreadable root package.json instead of returning an empty list.
     {
       name: "At least one workspace discovered",
       check: () => discoverWorkspaces().length > 0,
       fix: "Ensure pnpm-workspace.yaml lists package globs, or that a root package.json exists"
     }
   ],
-  // The gate stands beside the workspace rows rather than above them, so a session that cannot answer trust queries
-  // suppresses the trusted-publisher rows alone and leaves the package.json checks reporting. The rows no longer
-  // hang beneath the gate's skip, so a repo that publishes nothing has to be held to its one line here.
+  // The session gate is a sibling of the workspace rows, not their parent, so a session that cannot answer trust
+  // queries suppresses only the trusted-publisher rows and leaves the package.json checks reporting. The gate's skip
+  // therefore does not cover the rows, and this getter omits them for a repo that publishes nothing.
   get checks() {
     const sessionCheck = buildSessionCheck();
     if (skipIfNothingPublishable() !== false) {
@@ -94,8 +100,8 @@ var packagesChecklist = defineRdyChecklist({
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
-  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. An older
-  // runner drops that `fix` silently, so failing to load the kit is the lesser harm.
+  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. Because an
+  // older runner drops that `fix` silently, failing to load the kit is the lesser harm.
   minReadyupVersion: "0.37.0",
   checklists: [repoChecklist, packagesChecklist]
 });
@@ -110,9 +116,7 @@ function buildSessionCheck() {
       const capability = getCachedTrustCapability();
       return capability.ok ? { ok: true } : { ok: false, detail: capability.detail };
     },
-    // A plain string rather than a getter, because the remediation is the same however the session fails; only
-    // the `detail` above varies.
-    fix: 'Restore a usable npm session: log in with "npm login", supplying the one-time password when prompted, or restore access to the registry, which the trusted-publisher check queries directly'
+    fix: 'Restore a usable npm session: Log in with "npm login", supplying the one-time password when prompted, or restore access to the registry, which the trusted-publisher check queries directly'
   };
 }
 function buildWorkspaceCheck(workspace) {
@@ -139,7 +143,7 @@ function buildWorkspaceCheck(workspace) {
     {
       name: "published to npm",
       // `npm view` reads the registry without a session, so a missing login or a missing one-time password leaves
-      // this answerable. An unreachable registry does not: the lookup fails for every package, and reporting that
+      // this answerable. An unreachable registry does not: The lookup fails for every package, and reporting that
       // as unpublished would advise publishing a package that is already there.
       skip: () => {
         const auth = getCachedNpmAuthStatus();
@@ -192,7 +196,7 @@ function checkTrustedPublisher(packageName) {
     case "configured":
       return { ok: true };
     case "not-configured":
-      return { ok: false, detail: "No trusted publisher is configured for this package" };
+      return { ok: false, detail: "The npm registry does not list any trusted publisher for this package" };
     default:
       return { ok: false, detail: result.detail };
   }
@@ -228,19 +232,19 @@ function classifyProvenanceSetting(workflowContent, visibility) {
       fix: "Install and authenticate the GitHub CLI: gh auth login"
     };
   }
-  const hasProvenance = parseProvenanceSetting(workflowContent);
-  if (visibility === "public" && !hasProvenance) {
+  const provenance = hasProvenance(workflowContent);
+  if (visibility === "public" && !provenance) {
     return {
       ok: false,
       detail: "The repo is public and publish.yaml does not set provenance: true",
-      fix: "Set provenance: true in .github/workflows/publish.yaml \u2014 public repos should generate provenance attestations"
+      fix: "Set provenance: true in .github/workflows/publish.yaml; public repos should generate provenance attestations"
     };
   }
-  if (visibility === "private" && hasProvenance) {
+  if (visibility === "private" && provenance) {
     return {
       ok: false,
       detail: "The repo is private and publish.yaml sets provenance: true",
-      fix: "Make the GitHub repo public \u2014 OIDC publishing with provenance requires a public repo"
+      fix: "Make the GitHub repo public; OIDC publishing with provenance requires a public repo"
     };
   }
   return { ok: true };
@@ -273,7 +277,7 @@ function classifyTrustQuery(result, expectedRepo, expectedFile) {
   }
   const relationships = readTrustRelationships(result.stdout);
   if (relationships === void 0) {
-    return { status: "error", detail: "The npm trust query returned a payload this check cannot read" };
+    return { status: "error", detail: "The npm trust query returned a payload that this check cannot read" };
   }
   if (relationships.length === 0) {
     return { status: "not-configured" };
@@ -366,9 +370,6 @@ function isRepoPrivate() {
   }).trim();
   return result === "true";
 }
-function parseProvenanceSetting(workflowContent) {
-  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
-}
 function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);