@williamthorsen/release-kit 13.1.0 → 14.1.0

package/.meta/changelog.json

@@ -1,4 +1,106 @@
 [
+  {
+    "version": "14.1.0",
+    "date": "2026-10-11",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)",
+            "hash": "93355490219535fac282ab2256179094ca920e47",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)",
+            "hash": "93355490219535fac282ab2256179094ca920e47",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)",
+            "hash": "7b8b6d67b264af56dff761d0bf987eca8bc2f934",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that the `npm-auto-publish` kit's \"published to npm\" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)",
+            "hash": "7b8b6d67b264af56dff761d0bf987eca8bc2f934",
+            "entry": 2
+          },
+          {
+            "description": "Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)",
+            "hash": "712e7500109b4bb3db579b60c72e4bf85b308098",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)",
+            "hash": "712e7500109b4bb3db579b60c72e4bf85b308098",
+            "entry": 2
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "14.0.0",
+    "date": "2026-10-08",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Changes monorepo `--set-version` to take comma-separated `<workspace>@N.N.N` entries, which `prepare` accepts without `--only` and together with `--bump` and `--force`, and which release each named workspace's dependents. (#970)",
+            "breaking": true,
+            "migration": "Replace `--only arrays --set-version 1.0.0` with `--set-version arrays@1.0.0 --only arrays`, and keep `--only` unless the release should cover every workspace, because a `--set-version` run without `--only` is a full run.",
+            "hash": "07e3e99cb03e6031619bd58dac6ee339ceac0e89",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that `release-kit prepare --only` left each dependent of the named workspaces published against the old version range of its dependency, by also releasing every transitive dependent: a dependent with commits of its own at its own bump, and one without at a propagated patch bump. (#970)",
+            "breaking": true,
+            "migration": "Expect each `--only` run to release the dependents of the named workspaces as well, and remove any dependents that were added to `--only` only to get past the stranded-dependents error, which `prepare` no longer reports.",
+            "hash": "07e3e99cb03e6031619bd58dac6ee339ceac0e89",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Replaces the hand-rolled `console.warn` spies in release-kit's config-warning and push tests with `silenceConsole`, which restores the method when its `using` scope exits. (#964)",
+            "hash": "38cc179b4116bcd5aba8371b17b0816150c9e9a3",
+            "entry": 4
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Updates the readyup examples in the `nmr`, `release-kit`, and `v11y-check` READMEs and the `nmr` rulebook to use the `sources` key and `rdy run --sources`, and states that `--sources` needs readyup 0.40 or later. (#977)",
+            "hash": "41177f8f562d59a4cf0aff9d24199dbd370bb1a1",
+            "entry": 4
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "13.1.0",
     "date": "2026-10-02",
@@ -1923,10 +2025,22 @@
         "audience": "all",
         "items": [
           {
-            "description": "Migrate release-kit from toolbelt (#18)",
-            "body": "Migrates the complete `@williamthorsen/release-kit` package (v1.0.1) from `williamthorsen/toolbelt` into `packages/release-kit/`, adds shebang preservation to the shared esbuild plugin for CLI binaries, and sets up dogfooding infrastructure so this monorepo uses release-kit for its own releases.",
-            "hash": "da3a61fd335fb3e05ce20a0bffcdc1647d7aeb45"
-          },
+            "description": "Allow git-cliff to be used without config (#31)",
+            "body": "Adds a `resolveCliffConfigPath()` function that searches for a git-cliff config in a 4-step cascade (explicit path → `.config/git-cliff.toml` → `cliff.toml` → bundled `cliff.toml.template`), eliminating the requirement for consuming repos to maintain a cliff config copy. Restructures the `init` command to scaffold only the workflow file by default, with new `--with-config` and `--force` flags. Moves `.release-tags` from `/tmp/release-kit/` to project-local `tmp/` for predictable behavior in local runs.",
+            "hash": "0cbd2605d6f5f53d1efe3dda8dd0f6e4376b499f"
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "2.0.0",
+    "date": "2026-03-16",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
           {
             "description": "Slim down release workflow by removing unnecessary pnpm install (#21)",
             "body": "Make release-kit self-contained by invoking git-cliff via `npx --yes` instead of requiring it on PATH, and by appending modified file paths to the format command so lightweight formatters like `npx prettier --write` work without a full `pnpm install`. Update init templates, README, and consuming repo config/workflow to reference workflow v3.",
@@ -1943,11 +2057,6 @@
             "body": "Moves the reusable release workflow from `williamthorsen/.github` into this repo as `release-workflow.yaml`, stripping all pnpm-related steps since release-kit now runs git-cliff and prettier via `npx` internally. Updates this repo's caller workflow to use a relative path and update init templates to reference the new location. Establishes a naming convention (`{name}-workflow.yaml` for reusable, `{name}.yaml` for callers) and independent versioning strategy (`{name}-workflow-v{major}` tags), documented in `.github/workflows/README.md`.",
             "breaking": true,
             "hash": "f3416120cfe5bf0e7dbf51389e0c2647ccf41d30"
-          },
-          {
-            "description": "Allow git-cliff to be used without config (#31)",
-            "body": "Adds a `resolveCliffConfigPath()` function that searches for a git-cliff config in a 4-step cascade (explicit path → `.config/git-cliff.toml` → `cliff.toml` → bundled `cliff.toml.template`), eliminating the requirement for consuming repos to maintain a cliff config copy. Restructures the `init` command to scaffold only the workflow file by default, with new `--with-config` and `--force` flags. Moves `.release-tags` from `/tmp/release-kit/` to project-local `tmp/` for predictable behavior in local runs.",
-            "hash": "0cbd2605d6f5f53d1efe3dda8dd0f6e4376b499f"
           }
         ]
       },

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.38.0";
+export const __readyupVersion = "0.40.0";
 
 
 // .readyup/kits/default.ts
@@ -98,7 +98,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "13.1.0" };
+  const picked = { "version": "14.1.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -115,8 +115,8 @@ var CONFIG_EXPORT_PATTERNS = [
   /export\s*\*/
 ];
 var COMMON_PRESET_HASH = "618bb5cbcbdd4f4f0c2a777add7e14d992d48483350dd9651bf8cf4c1fa9d418";
-var SYNC_LABELS_WORKFLOW_HASH = "6b50015e2919ffa4b16d0b4a1f340e585ff3e5b779a2256010d3c62fa07ff8f2";
-var RELEASE_WORKFLOW_HASH_MONOREPO = "f35503bcfc5c131a8309305fed27f8127cb901f422cb8b62978a34b86dda7f7a";
+var SYNC_LABELS_WORKFLOW_HASH = "0a88829d154c0de7cdd4246fede99e9311a89ab4199034dbe601663d641ab1e4";
+var RELEASE_WORKFLOW_HASH_MONOREPO = "4a20ff3315155500f64a27133c54eb1bc1f07a4acc370ec0d83176109041c60d";
 var RELEASE_WORKFLOW_HASH_SINGLE = "d26dd4ca186632b388ea46bd885721124c03d19918e511baa40821d2d760da69";
 var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";
 var PUBLISH_WORKFLOW_HASH_SINGLE = "6f31183e0a1e66be791a19266c3b028dadbd9fe010f7fc4452f3f8970c937b43";

package/.readyup/kits/npm-auto-publish.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.38.0";
+export const __readyupVersion = "0.40.0";
 
 
 // .readyup/kits/npm-auto-publish.ts
@@ -13,7 +13,7 @@ import {
   fileContains,
   fileExists,
   getJsonValue,
-  isRecord,
+  isRecord as isRecord2,
   readFile,
   readJsonFile
 } from "readyup/check-utils";
@@ -23,10 +23,16 @@ function hasProvenance(workflowContent) {
   return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
 }
 
-// .readyup/kits/npm-auto-publish.ts
+// src/npmRegistry.ts
+import { execFileSync } from "node:child_process";
+
+// src/typeGuards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/npmRegistry.ts
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["E401", "ENEEDAUTH"]);
-var OTP_ERROR_CODE = "EOTP";
-var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
   "EAI_AGAIN",
   "ECONNREFUSED",
@@ -36,6 +42,54 @@ var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
   "ERR_SOCKET_TIMEOUT",
   "ETIMEDOUT"
 ]);
+function classifyNpmPackageLookup(result) {
+  if (result.exitOk) {
+    return { status: "published" };
+  }
+  const error = readNpmError(result.stdout);
+  if (error === void 0) {
+    return { status: "unverifiable", detail: "The npm registry query failed without a readable error payload" };
+  }
+  if (error.code === "E404") {
+    return { status: "unpublished" };
+  }
+  if (AUTH_ERROR_CODES.has(error.code)) {
+    return { status: "unverifiable", detail: `The npm registry rejected the session (${error.code})` };
+  }
+  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+    return { status: "unverifiable", detail: `Cannot reach the npm registry (${error.code})` };
+  }
+  return { status: "unverifiable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
+}
+function lookUpNpmPackage(packageName, registry) {
+  const args = ["view", packageName, "version", "--json", ...registry === void 0 ? [] : ["--registry", registry]];
+  return classifyNpmPackageLookup(runNpmJson(args));
+}
+function readNpmError(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(parsed) || !isRecord(parsed["error"]) || typeof parsed["error"]["code"] !== "string") {
+    return void 0;
+  }
+  const { code, summary } = parsed["error"];
+  return { code, summary: typeof summary === "string" ? summary : "" };
+}
+function runNpmJson(args) {
+  try {
+    return { exitOk: true, stdout: execFileSync("npm", args, { encoding: "utf8", stdio: "pipe" }) };
+  } catch (error) {
+    const stdout = isRecord(error) && typeof error["stdout"] === "string" ? error["stdout"] : "";
+    return { exitOk: false, stdout };
+  }
+}
+
+// .readyup/kits/npm-auto-publish.ts
+var OTP_ERROR_CODE = "EOTP";
+var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var repoChecklist = defineRdyChecklist({
   name: "repo",
   checks: [
@@ -149,7 +203,7 @@ function buildWorkspaceCheck(workspace) {
         const auth = getCachedNpmAuthStatus();
         return auth.status === "unreachable" ? auth.detail : false;
       },
-      check: () => isPublishedToNpm(displayName),
+      check: () => describeNpmPackageLookup(lookUpNpmPackage(displayName, readPublishRegistry(workspace))),
       fix: `Run "npm publish --access public" from ${workspace.dir} to bootstrap the package on npm`,
       checks: [
         {
@@ -290,6 +344,19 @@ function classifyTrustQuery(result, expectedRepo, expectedFile) {
     detail: `Expected github ${expectedRepo} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
   };
 }
+function describeNpmPackageLookup(lookup) {
+  if (lookup.status === "published") {
+    return { ok: true };
+  }
+  if (lookup.status === "unpublished") {
+    return { ok: false, detail: "The npm registry does not list this package" };
+  }
+  return {
+    ok: false,
+    detail: lookup.detail,
+    fix: "Restore access to the npm registry, then run this check again"
+  };
+}
 function describeTrustRelationships(relationships) {
   return relationships.map((relationship) => {
     const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
@@ -300,7 +367,7 @@ function describeTrustRelationships(relationships) {
 }
 var getCachedNpmAuthStatus = /* @__PURE__ */ (() => {
   let cached;
-  return () => cached ??= classifyNpmAuth(runNpmJson("npm whoami --json"));
+  return () => cached ??= classifyNpmAuth(runNpmJson(["whoami", "--json"]));
 })();
 var getCachedOwnerRepo = /* @__PURE__ */ (() => {
   let cached;
@@ -331,7 +398,7 @@ function getTrustQueryResult(packageName) {
     return cached;
   }
   const result = classifyTrustQuery(
-    runNpmJson(`npm trust list ${packageName} --json`),
+    runNpmJson(["trust", "list", packageName, "--json"]),
     getCachedOwnerRepo(),
     PUBLISH_WORKFLOW_FILE
   );
@@ -352,17 +419,6 @@ function hasTokenReferences() {
   }
   return false;
 }
-function isPublishedToNpm(packageName) {
-  try {
-    execSync(`npm view ${packageName} version`, {
-      encoding: "utf8",
-      stdio: "pipe"
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
 function isRepoPrivate() {
   const ownerRepo = getOwnerRepo();
   const result = execSync(`gh api repos/${ownerRepo} --jq .private`, {
@@ -374,18 +430,9 @@ function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);
 }
-function readNpmError(stdout) {
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout);
-  } catch {
-    return void 0;
-  }
-  if (!isRecord(parsed) || !isRecord(parsed["error"]) || typeof parsed["error"]["code"] !== "string") {
-    return void 0;
-  }
-  const { code, summary } = parsed["error"];
-  return { code, summary: typeof summary === "string" ? summary : "" };
+function readPublishRegistry(workspace) {
+  const registry = getJsonValue(workspace.packageJson, "publishConfig", "registry");
+  return typeof registry === "string" ? registry : void 0;
 }
 function readTrustRelationships(stdout) {
   let parsed;
@@ -395,9 +442,9 @@ function readTrustRelationships(stdout) {
     return void 0;
   }
   if (Array.isArray(parsed)) {
-    return parsed.filter((entry) => isRecord(entry) && "type" in entry);
+    return parsed.filter((entry) => isRecord2(entry) && "type" in entry);
   }
-  if (!isRecord(parsed)) {
+  if (!isRecord2(parsed)) {
     return void 0;
   }
   return "type" in parsed ? [parsed] : [];
@@ -406,14 +453,6 @@ function resolveTrustCapability() {
   const auth = getCachedNpmAuthStatus();
   return classifyTrustCapability(auth, auth.status === "authenticated" ? probeTrustQuery() : void 0);
 }
-function runNpmJson(command) {
-  try {
-    return { exitOk: true, stdout: execSync(command, { encoding: "utf8", stdio: "pipe" }) };
-  } catch (error) {
-    const stdout = isRecord(error) && typeof error["stdout"] === "string" ? error["stdout"] : "";
-    return { exitOk: false, stdout };
-  }
-}
 function selectProbeName() {
   return discoverWorkspaces({ filter: (workspace) => workspace.isPackage }).find(
     (workspace) => workspace.name !== void 0
@@ -433,6 +472,7 @@ export {
   classifyTrustCapability,
   classifyTrustQuery,
   npm_auto_publish_default as default,
+  describeNpmPackageLookup,
   packagesChecklist,
   selectProbeName,
   skipIfNotPublishable,

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "91bc3638",
+          "hash": "dee24ab4",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "fd27a632",
+          "hash": "4aa0967e",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -43,10 +43,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.38.0",
+      "readyupVersion": "0.40.0",
       "source": "kits/default.ts",
-      "sourceHash": "91bc3638",
-      "targetHash": "a3266cf2"
+      "sourceHash": "dee24ab4",
+      "targetHash": "25d17b58"
     },
     {
       "checklists": [
@@ -56,7 +56,7 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "d9910d60",
+          "hash": "70c0bb99",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         },
@@ -64,14 +64,24 @@
           "hash": "d360febf",
           "kind": "module",
           "path": "../src/init/hasProvenance.ts"
+        },
+        {
+          "hash": "3e39b9be",
+          "kind": "module",
+          "path": "../src/npmRegistry.ts"
+        },
+        {
+          "hash": "1424b343",
+          "kind": "module",
+          "path": "../src/typeGuards.ts"
         }
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
-      "readyupVersion": "0.38.0",
+      "readyupVersion": "0.40.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "d9910d60",
-      "targetHash": "8bdbefef"
+      "sourceHash": "70c0bb99",
+      "targetHash": "d97d6123"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to this project will be documented in this file.
 
+## 14.1.0 — 2026-10-11
+
+### 🎉 Features
+
+- Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)
+- Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)
+- Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that the `npm-auto-publish` kit's "published to npm" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)
+- Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)
+- Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)
+
+## 14.0.0 — 2026-10-08
+
+### 🎉 Features
+
+- 🚨 **Breaking:** Changes monorepo `--set-version` to take comma-separated `<workspace>@N.N.N` entries, which `prepare` accepts without `--only` and together with `--bump` and `--force`, and which release each named workspace's dependents. (#970)
+
+### 🐛 Bug fixes
+
+- 🚨 **Breaking:** Fixes the issue that `release-kit prepare --only` left each dependent of the named workspaces published against the old version range of its dependency, by also releasing every transitive dependent: a dependent with commits of its own at its own bump, and one without at a propagated patch bump. (#970)
+
+### 🧪 Tests
+
+- Replaces the hand-rolled `console.warn` spies in release-kit's config-warning and push tests with `silenceConsole`, which restores the method when its `using` scope exits. (#964)
+
+### 📚 Documentation
+
+- Updates the readyup examples in the `nmr`, `release-kit`, and `v11y-check` READMEs and the `nmr` rulebook to use the `sources` key and `rdy run --sources`, and states that `--sources` needs readyup 0.40 or later. (#977)
+
 ## 13.1.0 — 2026-10-02
 
 ### 🎉 Features
@@ -1111,9 +1143,13 @@ All notable changes to this project will be documented in this file.
 
 ### 🎉 Features
 
-- Migrate release-kit from toolbelt (#18)
+- Allow git-cliff to be used without config (#31)
 
-  Migrates the complete `@williamthorsen/release-kit` package (v1.0.1) from `williamthorsen/toolbelt` into `packages/release-kit/`, adds shebang preservation to the shared esbuild plugin for CLI binaries, and sets up dogfooding infrastructure so this monorepo uses release-kit for its own releases.
+  Adds a `resolveCliffConfigPath()` function that searches for a git-cliff config in a 4-step cascade (explicit path → `.config/git-cliff.toml` → `cliff.toml` → bundled `cliff.toml.template`), eliminating the requirement for consuming repos to maintain a cliff config copy. Restructures the `init` command to scaffold only the workflow file by default, with new `--with-config` and `--force` flags. Moves `.release-tags` from `/tmp/release-kit/` to project-local `tmp/` for predictable behavior in local runs.
+
+## 2.0.0 — 2026-03-16
+
+### 🎉 Features
 
 - 🚨 **Breaking:** Slim down release workflow by removing unnecessary pnpm install (#21)
 
@@ -1127,10 +1163,6 @@ All notable changes to this project will be documented in this file.
 
   Moves the reusable release workflow from `williamthorsen/.github` into this repo as `release-workflow.yaml`, stripping all pnpm-related steps since release-kit now runs git-cliff and prettier via `npx` internally. Updates this repo's caller workflow to use a relative path and update init templates to reference the new location. Establishes a naming convention (`{name}-workflow.yaml` for reusable, `{name}.yaml` for callers) and independent versioning strategy (`{name}-workflow-v{major}` tags), documented in `.github/workflows/README.md`.
 
-- Allow git-cliff to be used without config (#31)
-
-  Adds a `resolveCliffConfigPath()` function that searches for a git-cliff config in a 4-step cascade (explicit path → `.config/git-cliff.toml` → `cliff.toml` → bundled `cliff.toml.template`), eliminating the requirement for consuming repos to maintain a cliff config copy. Restructures the `init` command to scaffold only the workflow file by default, with new `--with-config` and `--force` flags. Moves `.release-tags` from `/tmp/release-kit/` to project-local `tmp/` for predictable behavior in local runs.
-
 ### ♻️ Refactoring
 
 - Clean up release-kit post-migration issues (#19)

package/README.md

@@ -7,11 +7,19 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
 <!-- section:release-notes -->
-## Release notes — v13.1.0 (2026-10-02)
+## Release notes — v14.1.0 (2026-10-11)
 
 ### 🎉 Features
 
-- Adds an `archived: true` mark to `repoLabels.labels` entries, which `sync-labels generate` writes to `.github/labels.yaml` without changing the output for unmarked labels. (#955)
+- Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)
+- Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)
+- Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that the `npm-auto-publish` kit's "published to npm" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)
+- Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)
+- Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -57,7 +65,7 @@ Commit the scaffolded workflows, then start a release from the `release` workflo
 
 ```sh
 gh workflow run release.yaml                  # every workspace with release-worthy changes
-gh workflow run release.yaml -f only=arrays   # the named workspaces alone
+gh workflow run release.yaml -f only=arrays   # the named workspaces and their dependents
 ```
 
 After upgrading release-kit, run `release-kit update-templates` to update the scaffolded workflows to its templates; it leaves the config files alone.
@@ -136,15 +144,15 @@ release-kit publishes two [readyup](https://www.npmjs.com/package/readyup) kits:
 import { defineRdyConfig } from 'readyup';
 
 export default defineRdyConfig({
-  packages: ['@williamthorsen/release-kit'],
+  sources: ['npm:@williamthorsen/release-kit'],
 });
 ```
 
 ```bash
-rdy run --packages
+rdy run --sources
 ```
 
-`rdy run` needs `readyup` 0.23 or later, and `@williamthorsen/release-kit` as a _direct_ devDependency: A strict pnpm layout links nothing else into the project; therefore, a transitive copy is unreachable.
+`rdy run --sources` needs `readyup` 0.40 or later, and `@williamthorsen/release-kit` as a _direct_ devDependency: A strict pnpm layout links nothing else into the project; therefore, a transitive copy is unreachable.
 
 [Readiness checks](docs/readiness-checks.md) covers running each kit alone and what `npm-auto-publish` needs from the npm session.
 

package/dist/esm/assertReleasesOnNpm.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Throws when npm doesn't list, or can't confirm, a publishable package among the given workspaces.
+ *
+ * Each workspace path is repo-relative and is read from the current directory. A private package is not looked up,
+ * and an empty list doesn't call the registry at all.
+ */
+export declare function assertReleasesOnNpm(workspacePaths: readonly string[]): void;

package/dist/esm/assertReleasesOnNpm.js

@@ -0,0 +1,56 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isPublishableManifest } from "./isPublishableManifest.js";
+import { lookUpNpmPackage } from "./npmRegistry.js";
+import { isRecord } from "./typeGuards.js";
+export function assertReleasesOnNpm(workspacePaths) {
+    const unpublished = [];
+    const unverifiable = [];
+    for (const workspacePath of workspacePaths) {
+        const candidate = buildNpmCandidate(workspacePath);
+        if (candidate === undefined) {
+            continue;
+        }
+        const lookup = lookUpNpmPackage(candidate.name, candidate.registry);
+        if (lookup.status === 'unpublished') {
+            unpublished.push(candidate);
+        }
+        else if (lookup.status === 'unverifiable') {
+            unverifiable.push({ candidate, detail: lookup.detail });
+        }
+    }
+    if (unpublished.length === 0 && unverifiable.length === 0) {
+        return;
+    }
+    throw new Error(describeRefusal(unpublished, unverifiable));
+}
+function buildNpmCandidate(workspacePath) {
+    const manifest = JSON.parse(readFileSync(join(workspacePath, 'package.json'), 'utf8'));
+    if (!isRecord(manifest) || !isPublishableManifest(manifest) || typeof manifest['name'] !== 'string') {
+        return undefined;
+    }
+    const publishConfig = manifest['publishConfig'];
+    const registry = isRecord(publishConfig) ? publishConfig['registry'] : undefined;
+    return {
+        name: manifest['name'],
+        workspacePath,
+        ...(typeof registry === 'string' && { registry }),
+    };
+}
+function describeRefusal(unpublished, unverifiable) {
+    const sections = ['Cannot prepare the release: npm must already have every package that the release publishes.'];
+    if (unpublished.length > 0) {
+        sections.push([
+            'Not on npm yet:',
+            ...unpublished.map(({ name, workspacePath }) => `  - ${name}: run "npm publish --access public" from ${workspacePath}`),
+            'Then register each one as a trusted publisher; "rdy run --from npm:@williamthorsen/release-kit npm-auto-publish" prints the command.',
+        ].join('\n'));
+    }
+    if (unverifiable.length > 0) {
+        sections.push([
+            'Could not confirm on npm:',
+            ...unverifiable.map(({ candidate, detail }) => `  - ${candidate.name}: ${detail}`),
+        ].join('\n'));
+    }
+    return sections.join('\n\n');
+}

package/dist/esm/bin/release-kit.js

@@ -108,7 +108,8 @@ function showInitHelp() {
 Usage: release-kit init [options]
 
 Initialize release-kit in the current repository.
-By default, scaffolds only the GitHub Actions workflow files.
+By default, scaffolds only the GitHub Actions workflow files. When every
+package is private, skips publish.yaml and create-github-release.yaml.
 
 Options:
   --with-config   Also scaffold .config/release-kit.config.ts
@@ -124,7 +125,9 @@ Usage: release-kit update-templates [options]
 Update the GitHub Actions workflows that release-kit scaffolds to the templates
 of the installed version, showing what changed in each file. Creates a missing
 workflow that \`init\` would create, and refreshes sync-labels.yaml only when it
-exists. Keeps publish.yaml's provenance setting. Never touches config files.
+exists. When every package is private, refreshes publish.yaml and
+create-github-release.yaml only when they exist. Keeps publish.yaml's provenance
+setting. Never touches config files.
 
 Options:
   --dry-run       Preview changes without writing files