@williamthorsen/release-kit 13.1.0 → 14.1.0

package/dist/esm/previewTagPrefixes.js

@@ -5,6 +5,7 @@ import { describeError } from '@williamthorsen/toolbelt.errors';
 import { deriveWorkspaceConfig } from "./deriveWorkspaceConfig.js";
 import { detectUndeclaredTagPrefixes } from "./detectUndeclaredTagPrefixes.js";
 import { describeEmptyWorkspace, discoverWorkspaces } from "./discoverWorkspaces.js";
+import { matchesTagPrefix } from "./matchesTagPrefix.js";
 export function previewTagPrefixes(config) {
     const workspace = discoverWorkspaces();
     if (workspace.kind === 'empty') {
@@ -62,7 +63,7 @@ function countTagsMatching(prefix) {
             maxBuffer: GIT_OUTPUT_LIMIT,
             stdio: ['pipe', 'pipe', 'pipe'],
         });
-        return output.split('\n').filter((line) => line.trim() !== '').length;
+        return output.split('\n').filter((line) => matchesTagPrefix(line.trim(), [prefix])).length;
     }
     catch {
         return 0;

package/dist/esm/releasePrepare.d.ts

@@ -10,24 +10,10 @@ export interface ReleasePrepareOptions {
     /** Level of the release, in place of the level that the changelog items call for; it doesn't trigger a release. */
     bumpOverride?: ReleaseType;
     /**
-     * Explicit target version (canonical `N.N.N`) that bypasses commit-derived bump logic.
-     * Mutually exclusive with `bumpOverride`. In monorepo mode the caller must narrow
-     * `config.workspaces` to a single workspace before invoking.
+     * Explicit target version (canonical `N.N.N`) that bypasses commit-derived bump logic and takes precedence over
+     * `bumpOverride` and `force`.
      */
     setVersion?: string;
-    /**
-     * Workspace directories to which `--only` narrowed the run (monorepo only), with
-     * `config.workspaces` already filtered to match. Present only for a narrowed run, which
-     * skips the project release: The project tier rolls up every contributing workspace, and
-     * the narrowing has changed which workspaces those are.
-     */
-    only?: string[];
-    /**
-     * Every configured workspace `dir`, taken before `--only` narrowed `config.workspaces`; the unrouted-scope report
-     * does not report a scope naming one of them that the run did not read. Defaults to the `dir`s of
-     * `config.workspaces`.
-     */
-    configuredWorkspaceDirs?: readonly string[];
     /**
      * If true, plan per-workspace release-notes previews under `{workspacePath}/docs/`
      * (`README.v{version}.md` and `RELEASE_NOTES.v{version}.md`) from each workspace's

package/dist/esm/releasePrepareMono.d.ts

@@ -1,14 +1,29 @@
 import type { ReleasePlan } from './releasePlan.js';
 import type { ReleasePrepareOptions } from './releasePrepare.js';
 import type { MonorepoPrepareConfig } from './types.js';
+/** Options for monorepo release preparation. */
+export interface MonorepoPrepareOptions extends Omit<ReleasePrepareOptions, 'setVersion'> {
+    /**
+     * Workspace `dir`s from which the release starts; the run plans them and their transitive dependents. Present only
+     * for a narrowed run, which skips the project release: The project tier rolls up every contributing workspace, and
+     * the narrowing has changed which workspaces those are.
+     */
+    only?: readonly string[];
+    /**
+     * Explicit target versions (canonical `N.N.N`), keyed by workspace `dir`. Each named workspace starts the release
+     * and releases at its version, which takes precedence over `bumpOverride` and `force`.
+     */
+    setVersions?: ReadonlyMap<string, string>;
+}
 /**
  * Orchestrates release preparation for a monorepo with multiple workspaces.
  *
+ * Phase 0: Selects the planned workspaces: those from which the release starts and their transitive dependents.
  * Phase 1: Determines direct bumps from commits for each workspace.
- * Phase 2: Builds the dependency graph and propagates bumps to dependents.
+ * Phase 2: Propagates bumps to dependents.
  * Phase 2b: Sorts the full release set topologically.
  * Phase 3: Plans bumps and changelogs in dependency order.
  * Phase 3b: Plans the project release.
  * Phase 4: Renders the format command.
  */
-export declare function releasePrepareMono(config: MonorepoPrepareConfig, options: ReleasePrepareOptions): ReleasePlan;
+export declare function releasePrepareMono(fullConfig: MonorepoPrepareConfig, options: MonorepoPrepareOptions): ReleasePlan;

package/dist/esm/releasePrepareMono.js

@@ -11,6 +11,7 @@ import { applyWorkspaceOverrides, createOverrideContext, formatStaleOverrideKeyW
 import { decideRelease } from "./decideRelease.js";
 import { deriveDependenciesHeader, deriveSectionOrder } from "./deriveReleaseNotesConfig.js";
 import { detectUndeclaredTagPrefixes } from "./detectUndeclaredTagPrefixes.js";
+import { findTransitiveDependents } from "./findTransitiveDependents.js";
 import { findUnroutedEntryScopes } from "./findUnroutedEntryScopes.js";
 import { getAllTagPrefixes } from "./generateChangelogs.js";
 import { hasPrettierConfig } from "./hasPrettierConfig.js";
@@ -21,10 +22,17 @@ import { propagateBumps } from "./propagateBumps.js";
 import { planPreservedSections } from "./readChangelogSections.js";
 import { releasePrepareProject } from "./releasePrepareProject.js";
 import { renderChangelogMarkdown } from "./renderChangelogMarkdown.js";
-export function releasePrepareMono(config, options) {
+export function releasePrepareMono(fullConfig, options) {
     const { only, withReleaseNotes } = options;
     const writes = [];
     const warnings = [];
+    const graph = buildDependencyGraph(fullConfig.workspaces);
+    const startDirs = selectStartDirs(fullConfig.workspaces, options);
+    const plannedDirs = findTransitiveDependents(graph, startDirs);
+    const config = {
+        ...fullConfig,
+        workspaces: fullConfig.workspaces.filter((workspace) => plannedDirs.has(workspace.dir)),
+    };
     if (withReleaseNotes === true && !config.changelogJson.enabled) {
         warnings.push('--with-release-notes requires changelogJson.enabled; skipping preview generation');
     }
@@ -32,10 +40,9 @@ export function releasePrepareMono(config, options) {
     const sectionOrder = deriveSectionOrder(workTypes);
     const dependenciesHeader = deriveDependenciesHeader(workTypes);
     const overrideContext = createOverrideContext(config.workspaces);
-    const { directBumps, directResults, skippedResults, untaggedBaselines } = determineDirectBumps(config, options);
-    reportUnroutedEntryScopes([...directResults.values(), ...skippedResults], config, options);
+    const { directBumps, directResults, skippedResults, untaggedBaselines } = determineDirectBumps(config, options, startDirs);
+    reportUnroutedEntryScopes([...directResults.values(), ...skippedResults], config, fullConfig.workspaces.map((workspace) => workspace.dir));
     const skippedHistories = new Map(skippedResults.map((skipped) => [skipped.workspace.dir, skipped.history]));
-    const graph = buildDependencyGraph(config.workspaces);
     const fullReleaseSet = propagateBumps(directBumps, graph);
     assertTaggedBaseline([...untaggedBaselines]
         .filter(([dir]) => directBumps.has(dir) || !fullReleaseSet.has(dir))
@@ -107,11 +114,15 @@ export function releasePrepareMono(config, options) {
         ...(project !== undefined && { project }),
     };
 }
-function determineDirectBumps(config, options) {
-    const { force, bumpOverride, setVersion } = options;
-    if (setVersion !== undefined && config.workspaces.length !== 1) {
-        throw new Error(`--set-version requires exactly one workspace; received ${config.workspaces.length}`);
+function selectStartDirs(workspaces, options) {
+    const { only, setVersions } = options;
+    if (only === undefined) {
+        return new Set(workspaces.map((workspace) => workspace.dir));
     }
+    return new Set([...only, ...(setVersions?.keys() ?? [])]);
+}
+function determineDirectBumps(config, options, startDirs) {
+    const { force, bumpOverride, setVersions } = options;
     const directBumps = new Map();
     const directResults = new Map();
     const skippedResults = [];
@@ -138,6 +149,7 @@ function determineDirectBumps(config, options) {
         if (tag === undefined) {
             maybeEmitBaselineHint(workspace, knownPrefixes, hintState);
         }
+        const setVersion = setVersions?.get(workspace.dir);
         if (setVersion !== undefined) {
             directBumps.set(workspace.dir, { releaseType: 'patch', newVersionOverride: setVersion });
             directResults.set(workspace.dir, {
@@ -152,7 +164,7 @@ function determineDirectBumps(config, options) {
         const decision = decideRelease({
             naturalBump: history.unreleased.bump,
             commitCount: history.unreleased.commits.length,
-            force,
+            force: force === true && startDirs.has(workspace.dir),
             bumpOverride,
             skipReasons: {
                 noCommits: `No commits for ${name} ${since}. Pass --force to release at patch. Skipping.`,
@@ -173,8 +185,8 @@ function determineDirectBumps(config, options) {
     }
     return { directBumps, directResults, skippedResults, untaggedBaselines };
 }
-function reportUnroutedEntryScopes(results, config, options) {
-    const findings = findUnroutedEntryScopes(results.map(({ workspace, history }) => ({ dir: workspace.dir, commits: history.unreleased.commits })), options.configuredWorkspaceDirs ?? config.workspaces.map((workspace) => workspace.dir), config.scopeAliases ?? {});
+function reportUnroutedEntryScopes(results, config, configuredWorkspaceDirs) {
+    const findings = findUnroutedEntryScopes(results.map(({ workspace, history }) => ({ dir: workspace.dir, commits: history.unreleased.commits })), configuredWorkspaceDirs, config.scopeAliases ?? {});
     for (const { workspace, history } of results) {
         history.unreleased.diagnostics.unroutedEntryScopes = findings.get(workspace.dir) ?? [];
     }

package/dist/esm/sync-labels/templates.js

@@ -11,7 +11,7 @@ on:
     paths:
       - .github/labels.yaml
 
-  # Preview on review: The check's log has a full computed diff, including deletions of labels not declared by the file.
+  # Preview on review: The check's log has the computed diff, and the check warns about each label not declared by the file.
   pull_request:
     paths:
       - .github/labels.yaml

package/docs/configuration.md

@@ -90,7 +90,7 @@ Tag prefixes from distinct owners must not be identical or be a strict prefix of
 - A `retiredPackages[]` entry (one owner per entry).
 - The `project` block, when configured.
 
-Because release-kit matches a tag to a prefix when the tag name starts with the prefix and continues with a digit, a strict-prefix overlap between distinct owners can match the wrong owner's tags. For example, a project prefix of `v` collides with a workspace prefix of `v11y-check-v`, since `v11y-check-v1.0.0` starts with `v` followed by a digit. The rule rejects every strict-prefix overlap, including one such as `v` and `vue-helpers-v`, whose shorter prefix can't match any tag of the longer one.
+Because release-kit matches a tag to a prefix when the tag name is the prefix followed by a complete SemVer version, a strict-prefix overlap between distinct owners can match the wrong owner's tags. For example, a retired prefix of `pkg-` collides with a workspace prefix of `pkg-1.0.0-v`, since `pkg-1.0.0-v1.2.3` is `pkg-` followed by the pre-release version `1.0.0-v1.2.3`. The rule rejects every strict-prefix overlap, including one such as `v` and `vue-helpers-v`, whose shorter prefix can't match any tag of the longer one.
 
 The rule is enforced at config load; the resulting error identifies both colliding declarations.
 

package/docs/labels.md

@@ -52,7 +52,7 @@ labels: {
 },
 ```
 
-The sync workflow archives a marked label rather than deleting it. An archived label stays on the issues and pull requests that have it, but it cannot be added to new ones and does not appear in the label picker. Removing the mark unarchives the label on the next sync. Removing the entry instead deletes the label, as the sync deletes every label that `.github/labels.yaml` does not declare, and the label disappears from every issue and pull request that had it.
+The sync workflow archives a marked label rather than deleting it. An archived label stays on the issues and pull requests that have it, but it cannot be added to new ones and does not appear in the label picker. Removing the mark unarchives the label on the next sync. Removing the entry leaves the label in place: The sync does not delete a label that `.github/labels.yaml` does not declare, and it reports each such label as a warning. To delete a label, run `gh label delete <name>`; the label disappears from every issue and pull request that had it.
 
 The mark is set only in the `labels` record, not in a preset. To retire a preset's label, replace it with an entry that restates its color and adds the mark.
 
@@ -68,15 +68,17 @@ The scaffolded workflow declares three triggers:
 
 Applying on merge closes the window in which a regenerated `.github/labels.yaml` remains unapplied. In that window, a later manual dispatch would apply an unreviewed label set.
 
-The `check` job runs the same sync in dry-run. Its **Label diff** log group lists every create, edit, rename, and deletion that the sync would perform, including deletions of labels that the file does not declare: the destructive edits that a diff of `.github/labels.yaml` alone cannot show, because a label created by hand or by another workflow is absent from the file both before and after. Read that log; the check reports success whether or not the diff is destructive, so a green check is not evidence that nothing will be deleted.
+The `check` job runs the same sync in dry-run. Its **Label diff** log group lists every create, edit, and rename that the sync would perform.
 
 Its **Archive state** log group lists each label that the sync would archive or unarchive. Archiving runs after the rest of the sync, so a label that the file both adds and marks is created and then archived.
 
+Both jobs end with an **Undeclared labels** log group, and they report each repository label that the file does not declare as a warning annotation, which appears on the run and on the pull request's check. A label created by hand, for example to put it on the ticket that will declare it, therefore survives every sync until the file declares it or someone deletes it.
+
 The two jobs are split because a job's permissions are fixed when the run is created and cannot vary by trigger. The split keeps a write-scoped token out of pull-request runs.
 
 The push trigger filters on the path alone; the `sync` job compares `github.ref_name` against the repository's default branch. The workflow therefore doesn't need a per-repo edit, whatever that branch is named, and a push touching `.github/labels.yaml` on any other branch produces a run whose jobs all skip.
 
-Manual dispatch is not a preview. It matches the `sync` job, so it applies the labels, deletions included; only the pull-request path runs in dry-run.
+Manual dispatch is not a preview. It matches the `sync` job, so it applies the labels; only the pull-request path runs in dry-run.
 
 ### Dry-run checks on fork pull requests
 

package/docs/project-releases.md

@@ -68,7 +68,7 @@ CLI flag interactions:
 - `--dry-run` previews project artifacts alongside workspace artifacts; it doesn't write any files.
 - `--bump=major|minor|patch` propagates to the project release as a level chooser. It does not trigger a release on its own when the window doesn't have any commits or any bump-worthy commits.
 - `--force` runs the project release even when the history since the last project tag doesn't have any commits or any bump-worthy commits. Defaults to patch when `--bump` is not given; combine with `--bump=X` to release at a different level.
-- `--only` narrows the run to the named workspaces and skips the project release, which is reported as a warning. The project release rolls up every contributing workspace, and `--only` changes which workspaces those are, so rolling up a narrowed set would release a project version covering work that the run excluded. Run a full `prepare` (without `--only`) to include the project release.
-- `--set-version` is rejected with an error when `project` is configured. `--set-version` operates on a single workspace, but a project release rolls up every contributing workspace; the two semantics don't compose. To use `--set-version`, run on a config without a `project` block.
+- `--only` narrows the run to the named workspaces and their dependents and skips the project release, which is reported as a warning. The project release rolls up every contributing workspace, and `--only` changes which workspaces those are, so rolling up a narrowed set would release a project version covering work that the run excluded. Run a full `prepare` (without `--only`) to include the project release.
+- `--set-version` is rejected with an error when `project` is configured. `--set-version` sets individual workspaces' versions, but a project release rolls up every contributing workspace; the two semantics don't compose. To use `--set-version`, run on a config without a `project` block.
 
 How `--bump` and `--force` combine for every target is in [Releasing](releasing.md#release-kit-prepare).

package/docs/readiness-checks.md

@@ -7,12 +7,12 @@ release-kit publishes two [readyup](https://www.npmjs.com/package/readyup) kits
 The [README](../README.md#readiness-checks) shows how to name release-kit in the readyup config.
 
 ```bash
-rdy run --packages                                               # every kit each listed package publishes
+rdy run --sources                                                # every kit each listed package publishes
 rdy run --from npm:@williamthorsen/release-kit                   # the default kit alone
 rdy run --from npm:@williamthorsen/release-kit npm-auto-publish  # the npm-auto-publish kit
 rdy list --from npm:@williamthorsen/release-kit                  # what release-kit publishes
 ```
 
-`--packages` is the form that keeps working when release-kit publishes further kits.
+`--sources` is the form that keeps working when release-kit publishes further kits.
 
 Because `npm-auto-publish` queries the npm registry for each package's trusted publisher, it needs an npm session elevated by two-factor authentication, and is meant to be invoked deliberately rather than included in an unattended run. A session that cannot answer those queries, whether it is missing a login, missing the elevation, or facing an unreachable registry, is reported once by the `npm session can answer trust queries` gate. The rows that would repeat the failed query are then skipped: the trusted-publisher rows in every case, and `published to npm` when the registry itself is unreachable. Each package's `package.json` checks report throughout, since they don't read a registry.

package/docs/releasing.md

@@ -15,13 +15,15 @@ Scaffolded files:
 - `.github/workflows/release.yaml`: Workflow that delegates to a reusable release workflow
 - `.config/release-kit.config.ts`: Starter config with commented-out customization examples (with `--with-config`)
 
+When every workspace, or the single package, sets `private: true`, `init` skips `create-github-release.yaml` and `publish.yaml`, `--force` included, and reports each skip: `publish` and `create-github-release` skip private packages, so neither workflow would do anything. Its next steps then leave out the provenance and trusted-publisher steps.
+
 ## `release-kit update-templates`
 
 Updates the scaffolded workflows to the templates of the installed release-kit version, and prints what changed in each file. Run it after upgrading release-kit; `--dry-run` previews the changes without writing them.
 
 The workflows are managed files: release-kit renders them, and a change made by hand is overwritten on the next update. The config files are the repository's own, and the command never reads or writes them.
 
-- It creates a missing workflow that `init` would create.
+- It creates a missing workflow that `init` would create. In a repo whose packages are all private, `init` does not create `create-github-release.yaml` or `publish.yaml`, so the command does not create either one when it is missing and reports the skip; it still refreshes either one that exists.
 - It refreshes `.github/workflows/sync-labels.yaml` only when the file exists, because `sync-labels init` scaffolds it on request.
 - It keeps `publish.yaml`'s provenance setting: When the file does not set `provenance: true`, as in a private repository, the updated file does not either.
 
@@ -29,7 +31,7 @@ The workflows are managed files: release-kit renders them, and a change made by
 
 Runs release preparation with automatic workspace discovery.
 
-Workspace names for `--only` match the package directory name (e.g., `arrays`, `release-kit`).
+`--only` names the workspaces from which the release starts, by package directory name (e.g., `arrays`, `release-kit`). The run also releases every workspace that depends on one of them, directly or transitively: A dependent with commits of its own releases at its own bump, and one without releases at a propagated patch bump, so that it publishes against the new version. Workspaces outside that set are left out of the run.
 
 `prepare` reads each target's history once and builds the changelog items of its unreleased commits. The bump is the highest level that those items call for, under [`versionPatterns`](configuration.md#versionpatterns), so the bump and the changelog describe the same release: A `feat` entry in a [change-record block](changelogs.md#change-record-blocks) bumps minor under a `docs:` title, and a breaking item bumps major.
 
@@ -57,6 +59,10 @@ release-kit prepare --force --bump=minor
 release-kit prepare --bump=minor
 ```
 
+### Packages that npm doesn't have yet
+
+Before it writes any file, and in a dry run as well, `prepare` asks npm about each publishable package that the release includes, querying the registry that the package's `publishConfig.registry` names when it sets one. OIDC trusted publishing can't publish a package's first version, so `prepare` refuses to release a package that npm doesn't list, and names each one with its fix: Run `npm publish --access public` from the package's directory once, then register the package as a trusted publisher. The `npm-auto-publish` [readiness kit](readiness-checks.md) prints the `npm trust` command. `prepare` also refuses when it can't look a package up, such as when the registry is unreachable, and reports npm's error for that package.
+
 ### Previewing release notes with `--with-release-notes`
 
 `--with-release-notes` writes two versioned files per workspace after each workspace's `changelog.json` is produced:
@@ -82,18 +88,20 @@ docs/*.v*.md
 
 The `--set-version` flag is a first-class escape hatch for the cases in which the derived bump produces the wrong version, most notably when promoting a pre-1.0 package to 1.0.0. Pre-1.0 packages collapse a `feat!` breaking change to a minor bump (matching semantic-release's `initialMajor: false` and release-please's `bump-minor-pre-major`), so a deliberate promotion to 1.0.0 must be requested explicitly.
 
+In a single-package repo, the value is the version: `--set-version 1.0.0`. In a monorepo, it names the workspace with each version, as comma-separated `<workspace>@N.N.N` entries: `--set-version arrays@1.0.0,strings@2.0.0`. Each named workspace releases at its version whether or not it has commits, and starts the release like a workspace named by `--only`.
+
 The flag validates that:
 
-- The value is canonical `N.N.N` semver (pre-release suffixes are rejected).
-- The target is strictly greater than the current version (numeric comparison on each component).
-- In monorepo mode, `--only` is set and resolves to exactly one workspace.
+- Each version is canonical `N.N.N` semver (pre-release suffixes are rejected).
+- In a monorepo, each entry names a known workspace, and none names it twice.
+- Each version is strictly greater than the workspace's current version (numeric comparison on each component).
 
-`--set-version` is mutually exclusive with `--bump` and `--force`. The rest of the pipeline (changelog generation, tag creation, commit summary, propagation to dependents) runs unchanged, so dependents receive a propagated patch bump triggered by the overridden version.
+The rest of the pipeline (changelog generation, tag creation, commit summary, propagation to dependents) runs unchanged, so each dependent receives a propagated patch bump that records the explicit version. Without `--only`, the run is a full run with the explicit versions applied. `--bump` and `--force` combine with `--set-version` and govern every other workspace.
 
-Promoting a pre-1.0 package to 1.0.0 in a monorepo:
+Promoting a pre-1.0 package to 1.0.0 in a monorepo, which also releases its dependents:
 
 ```sh
-release-kit prepare --only arrays --set-version 1.0.0
+release-kit prepare --set-version arrays@1.0.0 --only arrays
 ```
 
 An empty changelog section is expected for a bare promotion, because the changelog is generated from commits since the last tag. To include a narrative entry, merge a descriptive release commit (e.g., a `feat!` describing the stable API) before running `prepare`.
@@ -118,19 +126,21 @@ The `init` command scaffolds a release workflow at `.github/workflows/release.ya
 
 | Input   | Type    | Description                                                                                                                                     |
 | ------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
-| `only`  | string  | Workspaces to release (comma-separated, leave empty for all)                                                                                    |
+| `only`  | string  | Workspaces to release, with their dependents (comma-separated, leave empty for all)                                                             |
 | `bump`  | choice  | Bump type: `auto` (default, detects it from commits), `patch`, `minor`, or `major`                                                              |
 | `force` | boolean | Release even when the window doesn't have any commits or any bump-worthy commits (defaults to patch; combine with `bump` for a different level) |
 
 For repos that need a self-contained workflow instead of the reusable one, the scaffolded file can be expanded. The key steps are: checkout with full history (`fetch-depth: 0`), run `release-kit prepare` with optional `--only`, `--bump`, and `--force` flags, check for changes, read tags from `tmp/.release-tags`, then commit, tag, and push.
 
+The reusable `release`, `create-github-release`, and `sync-labels` workflows run on `ubuntu-latest` unless the repository's `CI_RUNS_ON` variable names another runner; `publish` always runs on `ubuntu-latest`. See [Runner selection](https://github.com/williamthorsen/node-monorepo-tools/blob/main/.github/workflows/README.md#runner-selection).
+
 ### Triggering a release
 
 ```sh
 # All workspaces
 gh workflow run release.yaml
 
-# Specific workspace(s)
+# Specific workspace(s), with their dependents
 gh workflow run release.yaml -f only=arrays
 gh workflow run release.yaml -f only=arrays,strings -f bump=minor
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/release-kit",
-  "version": "13.1.0",
+  "version": "14.1.0",
   "description": "Version-bumping and changelog-generation toolkit for release workflows",
   "keywords": [
     "changelog",
@@ -50,9 +50,9 @@
     "schemas/**"
   ],
   "dependencies": {
-    "@williamthorsen/change-grammar": "0.1.0",
-    "@williamthorsen/nmr-core": "0.13.1",
-    "@williamthorsen/toolbelt.errors": "0.8.1",
+    "@williamthorsen/change-grammar": "0.2.0",
+    "@williamthorsen/nmr-core": "0.13.2",
+    "@williamthorsen/toolbelt.errors": "0.8.3",
     "json-stringify-pretty-compact": "4.0.0",
     "semver": "7.8.5",
     "yaml": "2.9.1",
@@ -60,12 +60,12 @@
   },
   "devDependencies": {
     "@types/semver": "7.8.0",
-    "@williamthorsen/toolbelt.filesystem": "0.9.1",
-    "@williamthorsen/toolbelt.testing": "0.6.1",
-    "@williamthorsen/toolbelt.vitest": "0.10.1",
+    "@williamthorsen/toolbelt.filesystem": "0.9.3",
+    "@williamthorsen/toolbelt.testing": "0.6.3",
+    "@williamthorsen/toolbelt.vitest": "0.10.3",
     "actionlint": "2.0.6",
     "esbuild": "0.28.2",
-    "readyup": "0.38.0",
+    "readyup": "0.40.0",
     "smol-toml": "1.9.0",
     "vitest": "4.1.11"
   },

package/dist/esm/validateOnlyExcludesStrandedDependents.d.ts

@@ -1,37 +0,0 @@
-import type { DependencyGraph } from './buildDependencyGraph.js';
-import type { WorkspaceConfig } from './types.js';
-/** Result of probing a workspace's commits since its last tag. */
-export interface CommitsProbeResult {
-    /** Whether the workspace has any commits since its last tag (excluding `release:` commits). */
-    has: boolean;
-    /**
-     * The baseline tag from which the commits were measured; `undefined` when the workspace does not have a prior tag.
-     */
-    tag: string | undefined;
-}
-/** A single excluded workspace whose changes would be stranded by the `--only` invocation. */
-export interface StrandedDependentViolation {
-    /** The excluded workspace's `dir`. */
-    dir: string;
-    /** The `dir` of the released (or anticipated-release) dependency whose release republishes this workspace. */
-    downstreamOf: string;
-    /**
-     * The baseline tag from which this workspace's commits were counted; `undefined` if the workspace does not have a
-     * prior tag.
-     */
-    tag: string | undefined;
-}
-/** Probe callback that returns whether a workspace has commits since its last tag. */
-type CommitsProbe = (workspace: WorkspaceConfig) => CommitsProbeResult;
-/**
- * Detects `--only` invocations that would silently strand changes in excluded internal dependents.
- *
- * First computes R, the `--only` workspaces that will release, then walks the reverse-dependency graph breadth-first
- * from R and records each excluded workspace with its own commits as a violation. The walk continues through a
- * violation, as though the user had added it to `--only`, which reports deeper violations in the same pass. It stops
- * at an excluded workspace without commits, which does not republish, so its dependents are unaffected by R.
- *
- * Returns `undefined` when the walk does not find any violation, or the violations sorted by `dir`.
- */
-export declare function validateOnlyExcludesStrandedDependents(workspaces: readonly WorkspaceConfig[], only: readonly string[], graph: DependencyGraph, hasCommits: CommitsProbe): StrandedDependentViolation[] | undefined;
-export {};

package/dist/esm/validateOnlyExcludesStrandedDependents.js

@@ -1,115 +0,0 @@
-export function validateOnlyExcludesStrandedDependents(workspaces, only, graph, hasCommits) {
-    const probeCommits = memoizeCommitsProbe(hasCommits);
-    const workspaceByDir = new Map(workspaces.map((w) => [w.dir, w]));
-    const released = computeReleasedSet(only, workspaceByDir, graph, probeCommits);
-    const violations = collectStrandedViolations(released, new Set(only), graph, probeCommits);
-    if (violations.length === 0)
-        return undefined;
-    violations.sort((a, b) => a.dir.localeCompare(b.dir));
-    return violations;
-}
-function memoizeCommitsProbe(probe) {
-    const cache = new Map();
-    return (workspace) => {
-        const cached = cache.get(workspace.dir);
-        if (cached !== undefined)
-            return cached;
-        const result = probe(workspace);
-        cache.set(workspace.dir, result);
-        return result;
-    };
-}
-function computeReleasedSet(only, workspaceByDir, graph, probeCommits) {
-    const released = new Set();
-    for (const dir of only) {
-        const workspace = workspaceByDir.get(dir);
-        if (workspace !== undefined && probeCommits(workspace).has) {
-            released.add(dir);
-        }
-    }
-    let changed = true;
-    while (changed) {
-        changed = false;
-        for (const dir of only) {
-            if (released.has(dir))
-                continue;
-            if (hasDependencyIn(dir, graph, released)) {
-                released.add(dir);
-                changed = true;
-            }
-        }
-    }
-    return released;
-}
-function hasDependencyIn(dir, graph, released) {
-    const forwardDeps = graph.dependenciesOf.get(dir);
-    if (forwardDeps === undefined)
-        return false;
-    for (const depPackageName of forwardDeps) {
-        const depDir = graph.packageNameToDir.get(depPackageName);
-        if (depDir !== undefined && released.has(depDir))
-            return true;
-    }
-    return false;
-}
-function collectStrandedViolations(released, onlySet, graph, probeCommits) {
-    const violations = [];
-    const violationDirs = new Set();
-    const visited = new Set();
-    const queue = [];
-    for (const dir of released) {
-        const packageName = graph.dirToPackageName.get(dir);
-        if (packageName !== undefined) {
-            queue.push({ packageName, attributionRoot: dir });
-        }
-    }
-    while (queue.length > 0) {
-        const item = queue.shift();
-        if (item === undefined)
-            break;
-        if (visited.has(item.packageName))
-            continue;
-        visited.add(item.packageName);
-        const dependents = graph.dependentsOf.get(item.packageName);
-        if (dependents === undefined)
-            continue;
-        for (const dependent of dependents) {
-            visitDependent(dependent, item.attributionRoot, {
-                released,
-                onlySet,
-                graph,
-                probeCommits,
-                queue,
-                violations,
-                violationDirs,
-            });
-        }
-    }
-    return violations;
-}
-function visitDependent(dependent, attributionRoot, ctx) {
-    if (ctx.onlySet.has(dependent.dir)) {
-        if (ctx.released.has(dependent.dir)) {
-            enqueueDependent(dependent, ctx);
-        }
-        return;
-    }
-    const probe = ctx.probeCommits(dependent);
-    if (!probe.has)
-        return;
-    if (!ctx.violationDirs.has(dependent.dir)) {
-        ctx.violationDirs.add(dependent.dir);
-        ctx.violations.push({
-            dir: dependent.dir,
-            downstreamOf: attributionRoot,
-            tag: probe.tag,
-        });
-    }
-    enqueueDependent(dependent, ctx);
-}
-function enqueueDependent(dependent, ctx) {
-    const packageName = ctx.graph.dirToPackageName.get(dependent.dir);
-    if (packageName !== undefined) {
-        ctx.queue.push({ packageName, attributionRoot: dependent.dir });
-    }
-}