@williamthorsen/release-kit 14.0.0 → 14.1.0

package/.meta/changelog.json

@@ -1,4 +1,52 @@
 [
+  {
+    "version": "14.1.0",
+    "date": "2026-10-11",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)",
+            "hash": "93355490219535fac282ab2256179094ca920e47",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)",
+            "hash": "93355490219535fac282ab2256179094ca920e47",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)",
+            "hash": "7b8b6d67b264af56dff761d0bf987eca8bc2f934",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that the `npm-auto-publish` kit's \"published to npm\" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)",
+            "hash": "7b8b6d67b264af56dff761d0bf987eca8bc2f934",
+            "entry": 2
+          },
+          {
+            "description": "Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)",
+            "hash": "712e7500109b4bb3db579b60c72e4bf85b308098",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)",
+            "hash": "712e7500109b4bb3db579b60c72e4bf85b308098",
+            "entry": 2
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "14.0.0",
     "date": "2026-10-08",

package/.readyup/kits/default.js

@@ -98,7 +98,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "14.0.0" };
+  const picked = { "version": "14.1.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -115,7 +115,7 @@ var CONFIG_EXPORT_PATTERNS = [
   /export\s*\*/
 ];
 var COMMON_PRESET_HASH = "618bb5cbcbdd4f4f0c2a777add7e14d992d48483350dd9651bf8cf4c1fa9d418";
-var SYNC_LABELS_WORKFLOW_HASH = "6b50015e2919ffa4b16d0b4a1f340e585ff3e5b779a2256010d3c62fa07ff8f2";
+var SYNC_LABELS_WORKFLOW_HASH = "0a88829d154c0de7cdd4246fede99e9311a89ab4199034dbe601663d641ab1e4";
 var RELEASE_WORKFLOW_HASH_MONOREPO = "4a20ff3315155500f64a27133c54eb1bc1f07a4acc370ec0d83176109041c60d";
 var RELEASE_WORKFLOW_HASH_SINGLE = "d26dd4ca186632b388ea46bd885721124c03d19918e511baa40821d2d760da69";
 var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";

package/.readyup/kits/npm-auto-publish.js

@@ -13,7 +13,7 @@ import {
   fileContains,
   fileExists,
   getJsonValue,
-  isRecord,
+  isRecord as isRecord2,
   readFile,
   readJsonFile
 } from "readyup/check-utils";
@@ -23,10 +23,16 @@ function hasProvenance(workflowContent) {
   return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
 }
 
-// .readyup/kits/npm-auto-publish.ts
+// src/npmRegistry.ts
+import { execFileSync } from "node:child_process";
+
+// src/typeGuards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/npmRegistry.ts
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["E401", "ENEEDAUTH"]);
-var OTP_ERROR_CODE = "EOTP";
-var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
   "EAI_AGAIN",
   "ECONNREFUSED",
@@ -36,6 +42,54 @@ var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
   "ERR_SOCKET_TIMEOUT",
   "ETIMEDOUT"
 ]);
+function classifyNpmPackageLookup(result) {
+  if (result.exitOk) {
+    return { status: "published" };
+  }
+  const error = readNpmError(result.stdout);
+  if (error === void 0) {
+    return { status: "unverifiable", detail: "The npm registry query failed without a readable error payload" };
+  }
+  if (error.code === "E404") {
+    return { status: "unpublished" };
+  }
+  if (AUTH_ERROR_CODES.has(error.code)) {
+    return { status: "unverifiable", detail: `The npm registry rejected the session (${error.code})` };
+  }
+  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+    return { status: "unverifiable", detail: `Cannot reach the npm registry (${error.code})` };
+  }
+  return { status: "unverifiable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
+}
+function lookUpNpmPackage(packageName, registry) {
+  const args = ["view", packageName, "version", "--json", ...registry === void 0 ? [] : ["--registry", registry]];
+  return classifyNpmPackageLookup(runNpmJson(args));
+}
+function readNpmError(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(parsed) || !isRecord(parsed["error"]) || typeof parsed["error"]["code"] !== "string") {
+    return void 0;
+  }
+  const { code, summary } = parsed["error"];
+  return { code, summary: typeof summary === "string" ? summary : "" };
+}
+function runNpmJson(args) {
+  try {
+    return { exitOk: true, stdout: execFileSync("npm", args, { encoding: "utf8", stdio: "pipe" }) };
+  } catch (error) {
+    const stdout = isRecord(error) && typeof error["stdout"] === "string" ? error["stdout"] : "";
+    return { exitOk: false, stdout };
+  }
+}
+
+// .readyup/kits/npm-auto-publish.ts
+var OTP_ERROR_CODE = "EOTP";
+var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var repoChecklist = defineRdyChecklist({
   name: "repo",
   checks: [
@@ -149,7 +203,7 @@ function buildWorkspaceCheck(workspace) {
         const auth = getCachedNpmAuthStatus();
         return auth.status === "unreachable" ? auth.detail : false;
       },
-      check: () => isPublishedToNpm(displayName),
+      check: () => describeNpmPackageLookup(lookUpNpmPackage(displayName, readPublishRegistry(workspace))),
       fix: `Run "npm publish --access public" from ${workspace.dir} to bootstrap the package on npm`,
       checks: [
         {
@@ -290,6 +344,19 @@ function classifyTrustQuery(result, expectedRepo, expectedFile) {
     detail: `Expected github ${expectedRepo} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
   };
 }
+function describeNpmPackageLookup(lookup) {
+  if (lookup.status === "published") {
+    return { ok: true };
+  }
+  if (lookup.status === "unpublished") {
+    return { ok: false, detail: "The npm registry does not list this package" };
+  }
+  return {
+    ok: false,
+    detail: lookup.detail,
+    fix: "Restore access to the npm registry, then run this check again"
+  };
+}
 function describeTrustRelationships(relationships) {
   return relationships.map((relationship) => {
     const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
@@ -300,7 +367,7 @@ function describeTrustRelationships(relationships) {
 }
 var getCachedNpmAuthStatus = /* @__PURE__ */ (() => {
   let cached;
-  return () => cached ??= classifyNpmAuth(runNpmJson("npm whoami --json"));
+  return () => cached ??= classifyNpmAuth(runNpmJson(["whoami", "--json"]));
 })();
 var getCachedOwnerRepo = /* @__PURE__ */ (() => {
   let cached;
@@ -331,7 +398,7 @@ function getTrustQueryResult(packageName) {
     return cached;
   }
   const result = classifyTrustQuery(
-    runNpmJson(`npm trust list ${packageName} --json`),
+    runNpmJson(["trust", "list", packageName, "--json"]),
     getCachedOwnerRepo(),
     PUBLISH_WORKFLOW_FILE
   );
@@ -352,17 +419,6 @@ function hasTokenReferences() {
   }
   return false;
 }
-function isPublishedToNpm(packageName) {
-  try {
-    execSync(`npm view ${packageName} version`, {
-      encoding: "utf8",
-      stdio: "pipe"
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
 function isRepoPrivate() {
   const ownerRepo = getOwnerRepo();
   const result = execSync(`gh api repos/${ownerRepo} --jq .private`, {
@@ -374,18 +430,9 @@ function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);
 }
-function readNpmError(stdout) {
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout);
-  } catch {
-    return void 0;
-  }
-  if (!isRecord(parsed) || !isRecord(parsed["error"]) || typeof parsed["error"]["code"] !== "string") {
-    return void 0;
-  }
-  const { code, summary } = parsed["error"];
-  return { code, summary: typeof summary === "string" ? summary : "" };
+function readPublishRegistry(workspace) {
+  const registry = getJsonValue(workspace.packageJson, "publishConfig", "registry");
+  return typeof registry === "string" ? registry : void 0;
 }
 function readTrustRelationships(stdout) {
   let parsed;
@@ -395,9 +442,9 @@ function readTrustRelationships(stdout) {
     return void 0;
   }
   if (Array.isArray(parsed)) {
-    return parsed.filter((entry) => isRecord(entry) && "type" in entry);
+    return parsed.filter((entry) => isRecord2(entry) && "type" in entry);
   }
-  if (!isRecord(parsed)) {
+  if (!isRecord2(parsed)) {
     return void 0;
   }
   return "type" in parsed ? [parsed] : [];
@@ -406,14 +453,6 @@ function resolveTrustCapability() {
   const auth = getCachedNpmAuthStatus();
   return classifyTrustCapability(auth, auth.status === "authenticated" ? probeTrustQuery() : void 0);
 }
-function runNpmJson(command) {
-  try {
-    return { exitOk: true, stdout: execSync(command, { encoding: "utf8", stdio: "pipe" }) };
-  } catch (error) {
-    const stdout = isRecord(error) && typeof error["stdout"] === "string" ? error["stdout"] : "";
-    return { exitOk: false, stdout };
-  }
-}
 function selectProbeName() {
   return discoverWorkspaces({ filter: (workspace) => workspace.isPackage }).find(
     (workspace) => workspace.name !== void 0
@@ -433,6 +472,7 @@ export {
   classifyTrustCapability,
   classifyTrustQuery,
   npm_auto_publish_default as default,
+  describeNpmPackageLookup,
   packagesChecklist,
   selectProbeName,
   skipIfNotPublishable,

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "7a8522cd",
+          "hash": "dee24ab4",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "6eab98d1",
+          "hash": "4aa0967e",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -45,8 +45,8 @@
       "path": "kits/default.js",
       "readyupVersion": "0.40.0",
       "source": "kits/default.ts",
-      "sourceHash": "7a8522cd",
-      "targetHash": "4e21467f"
+      "sourceHash": "dee24ab4",
+      "targetHash": "25d17b58"
     },
     {
       "checklists": [
@@ -56,7 +56,7 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "d9910d60",
+          "hash": "70c0bb99",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         },
@@ -64,14 +64,24 @@
           "hash": "d360febf",
           "kind": "module",
           "path": "../src/init/hasProvenance.ts"
+        },
+        {
+          "hash": "3e39b9be",
+          "kind": "module",
+          "path": "../src/npmRegistry.ts"
+        },
+        {
+          "hash": "1424b343",
+          "kind": "module",
+          "path": "../src/typeGuards.ts"
         }
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
       "readyupVersion": "0.40.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "d9910d60",
-      "targetHash": "2a6931b6"
+      "sourceHash": "70c0bb99",
+      "targetHash": "d97d6123"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file.
 
+## 14.1.0 — 2026-10-11
+
+### 🎉 Features
+
+- Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)
+- Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)
+- Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that the `npm-auto-publish` kit's "published to npm" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)
+- Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)
+- Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)
+
 ## 14.0.0 — 2026-10-08
 
 ### 🎉 Features

package/README.md

@@ -7,15 +7,19 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
 <!-- section:release-notes -->
-## Release notes — v14.0.0 (2026-10-08)
+## Release notes — v14.1.0 (2026-10-11)
 
 ### 🎉 Features
 
-- 🚨 **Breaking:** Changes monorepo `--set-version` to take comma-separated `<workspace>@N.N.N` entries, which `prepare` accepts without `--only` and together with `--bump` and `--force`, and which release each named workspace's dependents. (#970)
+- Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)
+- Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)
+- Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)
 
 ### 🐛 Bug fixes
 
-- 🚨 **Breaking:** Fixes the issue that `release-kit prepare --only` left each dependent of the named workspaces published against the old version range of its dependency, by also releasing every transitive dependent: a dependent with commits of its own at its own bump, and one without at a propagated patch bump. (#970)
+- Fixes the issue that the `npm-auto-publish` kit's "published to npm" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)
+- Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)
+- Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)
 <!-- /section:release-notes -->
 
 ## Installation

package/dist/esm/assertReleasesOnNpm.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Throws when npm doesn't list, or can't confirm, a publishable package among the given workspaces.
+ *
+ * Each workspace path is repo-relative and is read from the current directory. A private package is not looked up,
+ * and an empty list doesn't call the registry at all.
+ */
+export declare function assertReleasesOnNpm(workspacePaths: readonly string[]): void;

package/dist/esm/assertReleasesOnNpm.js

@@ -0,0 +1,56 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isPublishableManifest } from "./isPublishableManifest.js";
+import { lookUpNpmPackage } from "./npmRegistry.js";
+import { isRecord } from "./typeGuards.js";
+export function assertReleasesOnNpm(workspacePaths) {
+    const unpublished = [];
+    const unverifiable = [];
+    for (const workspacePath of workspacePaths) {
+        const candidate = buildNpmCandidate(workspacePath);
+        if (candidate === undefined) {
+            continue;
+        }
+        const lookup = lookUpNpmPackage(candidate.name, candidate.registry);
+        if (lookup.status === 'unpublished') {
+            unpublished.push(candidate);
+        }
+        else if (lookup.status === 'unverifiable') {
+            unverifiable.push({ candidate, detail: lookup.detail });
+        }
+    }
+    if (unpublished.length === 0 && unverifiable.length === 0) {
+        return;
+    }
+    throw new Error(describeRefusal(unpublished, unverifiable));
+}
+function buildNpmCandidate(workspacePath) {
+    const manifest = JSON.parse(readFileSync(join(workspacePath, 'package.json'), 'utf8'));
+    if (!isRecord(manifest) || !isPublishableManifest(manifest) || typeof manifest['name'] !== 'string') {
+        return undefined;
+    }
+    const publishConfig = manifest['publishConfig'];
+    const registry = isRecord(publishConfig) ? publishConfig['registry'] : undefined;
+    return {
+        name: manifest['name'],
+        workspacePath,
+        ...(typeof registry === 'string' && { registry }),
+    };
+}
+function describeRefusal(unpublished, unverifiable) {
+    const sections = ['Cannot prepare the release: npm must already have every package that the release publishes.'];
+    if (unpublished.length > 0) {
+        sections.push([
+            'Not on npm yet:',
+            ...unpublished.map(({ name, workspacePath }) => `  - ${name}: run "npm publish --access public" from ${workspacePath}`),
+            'Then register each one as a trusted publisher; "rdy run --from npm:@williamthorsen/release-kit npm-auto-publish" prints the command.',
+        ].join('\n'));
+    }
+    if (unverifiable.length > 0) {
+        sections.push([
+            'Could not confirm on npm:',
+            ...unverifiable.map(({ candidate, detail }) => `  - ${candidate.name}: ${detail}`),
+        ].join('\n'));
+    }
+    return sections.join('\n\n');
+}

package/dist/esm/bin/release-kit.js

@@ -108,7 +108,8 @@ function showInitHelp() {
 Usage: release-kit init [options]
 
 Initialize release-kit in the current repository.
-By default, scaffolds only the GitHub Actions workflow files.
+By default, scaffolds only the GitHub Actions workflow files. When every
+package is private, skips publish.yaml and create-github-release.yaml.
 
 Options:
   --with-config   Also scaffold .config/release-kit.config.ts
@@ -124,7 +125,9 @@ Usage: release-kit update-templates [options]
 Update the GitHub Actions workflows that release-kit scaffolds to the templates
 of the installed version, showing what changed in each file. Creates a missing
 workflow that \`init\` would create, and refreshes sync-labels.yaml only when it
-exists. Keeps publish.yaml's provenance setting. Never touches config files.
+exists. When every package is private, refreshes publish.yaml and
+create-github-release.yaml only when they exist. Keeps publish.yaml's provenance
+setting. Never touches config files.
 
 Options:
   --dry-run       Preview changes without writing files

package/dist/esm/deriveWorkspaceConfig.js

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { basename } from 'node:path';
 import { chainError } from '@williamthorsen/toolbelt.errors/candidate';
+import { isPublishableManifest } from "./isPublishableManifest.js";
 import { isRecord } from "./typeGuards.js";
 export function deriveWorkspaceConfig(workspacePath) {
     const dir = basename(workspacePath);
@@ -17,8 +18,7 @@ export function deriveWorkspaceConfig(workspacePath) {
         throw new Error(`${packageJsonPath} is missing a 'name' field (required for tag derivation).`);
     }
     const unscopedName = stripNpmScope(name);
-    const privateField = isRecord(parsed) ? parsed['private'] : undefined;
-    const isPublishable = privateField === undefined || privateField === false;
+    const isPublishable = isPublishableManifest(parsed);
     return {
         dir,
         name,

package/dist/esm/enumerateReleaseWindows.d.ts

@@ -22,7 +22,7 @@ export interface ReleaseWindow {
 export interface EnumerateReleaseWindowsOptions {
     /** Git pathspecs restricting the enumeration to commits that touch them. */
     paths?: readonly string[];
-    /** Tag prefixes to match as a union; a matching tag name continues with a digit. */
+    /** Tag prefixes to match as a union; a matching tag name continues with a complete SemVer version. */
     tagPrefixes: readonly string[];
     /** The version that the unreleased window reports, such as the tag that the release being prepared will write. */
     unreleasedTag: string;

package/dist/esm/enumerateReleaseWindows.js

@@ -1,6 +1,7 @@
 import { execFileSync } from 'node:child_process';
 import { GIT_OUTPUT_LIMIT } from '@williamthorsen/nmr-core';
 import { chainError } from '@williamthorsen/toolbelt.errors/candidate';
+import { matchesTagPrefix } from "./matchesTagPrefix.js";
 const FIELD_SEPARATOR = '\u{1F}';
 const RECORD_SEPARATOR = '\u{1E}';
 export function enumerateReleaseWindows(options) {
@@ -46,9 +47,6 @@ function claimAncestors(boundaries, parentsByHash) {
     }
     return windowIndexByHash;
 }
-function matchesTagPrefix(tagName, tagPrefixes) {
-    return tagPrefixes.some((prefix) => tagName.startsWith(prefix) && /^\d/.test(tagName.slice(prefix.length)));
-}
 function parseCommitRecord(record) {
     const [hash, subject, message] = record.replace(/^\n+/, '').split(FIELD_SEPARATOR);
     if (hash === undefined || subject === undefined || message === undefined || hash === '') {

package/dist/esm/init/hasPublishablePackage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Reports whether the repo at `root` contains a package that can be published: a discovered workspace, or the root
+ * package of a single-package repo, whose `package.json` is not private.
+ *
+ * Returns `true` whenever the answer cannot be determined (an empty workspace, a failed discovery, or an unreadable
+ * manifest), so that the scaffolding commands keep the publish workflows in every repo that might need them.
+ */
+export declare function hasPublishablePackage(root?: string): boolean;
+/** Formats the line that reports a workflow skipped because the repo does not contain any publishable package. */
+export declare function formatPrivateWorkflowSkip(filePath: string): string;

package/dist/esm/init/hasPublishablePackage.js

@@ -0,0 +1,28 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { discoverWorkspaces } from "../discoverWorkspaces.js";
+import { isPublishableManifest } from "../isPublishableManifest.js";
+export function hasPublishablePackage(root = process.cwd()) {
+    let packageDirs;
+    try {
+        const workspace = discoverWorkspaces(root);
+        if (workspace.kind === 'empty')
+            return true;
+        packageDirs = workspace.kind === 'single-package' ? ['.'] : workspace.packageDirs;
+    }
+    catch {
+        return true;
+    }
+    return packageDirs.some((packageDir) => isPublishableAt(path.join(root, packageDir, 'package.json')));
+}
+export function formatPrivateWorkflowSkip(filePath) {
+    return `Skipping ${filePath}: every package is private`;
+}
+function isPublishableAt(manifestPath) {
+    try {
+        return isPublishableManifest(JSON.parse(readFileSync(manifestPath, 'utf8')));
+    }
+    catch {
+        return true;
+    }
+}

package/dist/esm/init/initCommand.js

@@ -1,8 +1,9 @@
-import { printError, printStep, printSuccess, reportWriteResult, } from '@williamthorsen/nmr-core';
+import { printError, printSkip, printStep, printSuccess, reportWriteResult, } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { hasPackageJson, isGitRepo, usesPnpm } from "./checks.js";
 import { detectRepoType } from "./detectRepoType.js";
-import { scaffoldFiles } from "./scaffold.js";
+import { formatPrivateWorkflowSkip, hasPublishablePackage } from "./hasPublishablePackage.js";
+import { PUBLISHING_WORKFLOW_PATHS, scaffoldFiles } from "./scaffold.js";
 export function checkEligibility(styles) {
     printStep('Checking eligibility');
     if (!runRequiredCheck('Git repository detected', isGitRepo(), styles))
@@ -37,10 +38,16 @@ export function initCommand({ dryRun, force, styles, withConfig }) {
         return 1;
     }
     printSuccess(`Detected: ${repoType}`, styles.stdout);
+    const publishable = hasPublishablePackage();
     printStep('Scaffolding files');
+    if (!publishable) {
+        for (const filePath of PUBLISHING_WORKFLOW_PATHS) {
+            printSkip(formatPrivateWorkflowSkip(filePath), styles.stdout);
+        }
+    }
     let results;
     try {
-        results = scaffoldFiles({ repoType, dryRun, overwrite: force, withConfig });
+        results = scaffoldFiles({ repoType, dryRun, overwrite: force, publishable, withConfig });
     }
     catch (error) {
         printError(`Failed to scaffold files: ${describeError(error)}`, styles.stderr);
@@ -53,18 +60,21 @@ export function initCommand({ dryRun, force, styles, withConfig }) {
         return 1;
     }
     printStep('Next steps');
-    const configHint = withConfig
-        ? '1. (Optional) Customize .config/release-kit.config.ts.'
-        : '1. (Optional) Run again with --with-config to scaffold config files.';
-    console.info(`
-  ${configHint}
-  2. If this is a private repo, remove provenance: true from .github/workflows/publish.yaml.
-  3. Test by running: npx @williamthorsen/release-kit prepare --dry-run
-  4. Commit the generated files.
-  5. Register each package as a trusted publisher on npmjs.com.
-`);
+    console.info(`\n${formatNextSteps({ publishable, withConfig })}\n`);
     return 0;
 }
+function formatNextSteps({ publishable, withConfig }) {
+    const steps = [
+        withConfig
+            ? '(Optional) Customize .config/release-kit.config.ts.'
+            : '(Optional) Run again with --with-config to scaffold config files.',
+        ...(publishable ? ['If this is a private repo, remove provenance: true from .github/workflows/publish.yaml.'] : []),
+        'Test by running: npx @williamthorsen/release-kit prepare --dry-run',
+        'Commit the generated files.',
+        ...(publishable ? ['Register each package as a trusted publisher on npmjs.com.'] : []),
+    ];
+    return steps.map((step, index) => `  ${String(index + 1)}. ${step}`).join('\n');
+}
 function runRequiredCheck(label, result, styles) {
     if (result.ok) {
         printSuccess(label, styles.stdout);

package/dist/esm/init/scaffold.d.ts

@@ -4,8 +4,13 @@ interface ScaffoldOptions {
     repoType: RepoType;
     dryRun: boolean;
     overwrite: boolean;
+    publishable: boolean;
     withConfig: boolean;
 }
+export declare const CREATE_GITHUB_RELEASE_WORKFLOW_PATH = ".github/workflows/create-github-release.yaml";
+export declare const PUBLISH_WORKFLOW_PATH = ".github/workflows/publish.yaml";
+/** The workflows that act only on publishable packages, which a repo whose packages are all private does not get. */
+export declare const PUBLISHING_WORKFLOW_PATHS: readonly [".github/workflows/create-github-release.yaml", ".github/workflows/publish.yaml"];
 /** Scaffolds release-kit files for the target repo, returning a result for each file attempted. */
-export declare function scaffoldFiles({ repoType, dryRun, overwrite, withConfig }: ScaffoldOptions): WriteResult[];
+export declare function scaffoldFiles({ repoType, dryRun, overwrite, publishable, withConfig, }: ScaffoldOptions): WriteResult[];
 export {};

package/dist/esm/init/scaffold.js

@@ -1,14 +1,17 @@
 import { writeFileWithCheck } from '@williamthorsen/nmr-core';
 import { createGithubReleaseWorkflow, publishWorkflow, releaseConfigScript, releaseWorkflow } from "./templates.js";
-export function scaffoldFiles({ repoType, dryRun, overwrite, withConfig }) {
-    const results = [
-        writeFileWithCheck('.github/workflows/create-github-release.yaml', createGithubReleaseWorkflow(repoType), {
+export const CREATE_GITHUB_RELEASE_WORKFLOW_PATH = '.github/workflows/create-github-release.yaml';
+export const PUBLISH_WORKFLOW_PATH = '.github/workflows/publish.yaml';
+export const PUBLISHING_WORKFLOW_PATHS = [CREATE_GITHUB_RELEASE_WORKFLOW_PATH, PUBLISH_WORKFLOW_PATH];
+export function scaffoldFiles({ repoType, dryRun, overwrite, publishable, withConfig, }) {
+    const results = [];
+    if (publishable) {
+        results.push(writeFileWithCheck(CREATE_GITHUB_RELEASE_WORKFLOW_PATH, createGithubReleaseWorkflow(repoType), {
             dryRun,
             overwrite,
-        }),
-        writeFileWithCheck('.github/workflows/publish.yaml', publishWorkflow(repoType), { dryRun, overwrite }),
-        writeFileWithCheck('.github/workflows/release.yaml', releaseWorkflow(repoType), { dryRun, overwrite }),
-    ];
+        }), writeFileWithCheck(PUBLISH_WORKFLOW_PATH, publishWorkflow(repoType), { dryRun, overwrite }));
+    }
+    results.push(writeFileWithCheck('.github/workflows/release.yaml', releaseWorkflow(repoType), { dryRun, overwrite }));
     if (withConfig) {
         results.push(writeFileWithCheck('.config/release-kit.config.ts', releaseConfigScript(repoType), { dryRun, overwrite }));
     }

package/dist/esm/init/updateTemplatesCommand.d.ts

@@ -7,7 +7,8 @@ interface UpdateTemplatesOptions {
  * Runs the `release-kit update-templates` command and returns the process exit code.
  *
  * Brings each workflow that release-kit scaffolds up to date with the installed templates. The opt-in
- * `sync-labels.yaml` is refreshed only when it exists, and config files are never read or written.
+ * `sync-labels.yaml` is refreshed only when it exists, as are the publishing workflows in a repo whose packages are
+ * all private. Config files are never read or written.
  */
 export declare function updateTemplatesCommand({ dryRun, styles }: UpdateTemplatesOptions): number;
 export {};

package/dist/esm/init/updateTemplatesCommand.js

@@ -1,12 +1,13 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { printError, printStep, printSuccess, reportTemplateUpdate, updateManagedFile, } from '@williamthorsen/nmr-core';
+import { printError, printSkip, printStep, printSuccess, reportTemplateUpdate, updateManagedFile, } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { syncLabelsWorkflow } from "../sync-labels/templates.js";
 import { detectRepoType } from "./detectRepoType.js";
 import { hasProvenance } from "./hasProvenance.js";
+import { formatPrivateWorkflowSkip, hasPublishablePackage } from "./hasPublishablePackage.js";
 import { checkEligibility } from "./initCommand.js";
+import { CREATE_GITHUB_RELEASE_WORKFLOW_PATH, PUBLISH_WORKFLOW_PATH, PUBLISHING_WORKFLOW_PATHS } from "./scaffold.js";
 import { createGithubReleaseWorkflow, publishWorkflow, releaseWorkflow } from "./templates.js";
-const PUBLISH_WORKFLOW_PATH = '.github/workflows/publish.yaml';
 const SYNC_LABELS_WORKFLOW_PATH = '.github/workflows/sync-labels.yaml';
 export function updateTemplatesCommand({ dryRun, styles }) {
     if (dryRun) {
@@ -35,7 +36,11 @@ export function updateTemplatesCommand({ dryRun, styles }) {
     printStep('Updating workflows');
     let results;
     try {
-        results = buildManagedFiles(repoType).map(([filePath, content]) => updateManagedFile(filePath, content, { dryRun }));
+        const { files, skipped } = buildManagedFiles(repoType, hasPublishablePackage());
+        for (const filePath of skipped) {
+            printSkip(formatPrivateWorkflowSkip(filePath), styles.stdout);
+        }
+        results = files.map(([filePath, content]) => updateManagedFile(filePath, content, { dryRun }));
     }
     catch (error) {
         printError(`Failed to render workflows: ${describeError(error)}`, styles.stderr);
@@ -46,16 +51,17 @@ export function updateTemplatesCommand({ dryRun, styles }) {
     }
     return results.some((result) => result.outcome === 'failed') ? 1 : 0;
 }
-function buildManagedFiles(repoType) {
+function buildManagedFiles(repoType, publishable) {
+    const skipped = publishable ? [] : PUBLISHING_WORKFLOW_PATHS.filter((filePath) => !existsSync(filePath));
     const files = [
-        ['.github/workflows/create-github-release.yaml', createGithubReleaseWorkflow(repoType)],
+        [CREATE_GITHUB_RELEASE_WORKFLOW_PATH, createGithubReleaseWorkflow(repoType)],
         [PUBLISH_WORKFLOW_PATH, publishWorkflow(repoType, { provenance: readProvenanceSetting() })],
         ['.github/workflows/release.yaml', releaseWorkflow(repoType)],
     ];
     if (existsSync(SYNC_LABELS_WORKFLOW_PATH)) {
         files.push([SYNC_LABELS_WORKFLOW_PATH, syncLabelsWorkflow()]);
     }
-    return files;
+    return { files: files.filter(([filePath]) => !skipped.includes(filePath)), skipped };
 }
 function readProvenanceSetting() {
     if (!existsSync(PUBLISH_WORKFLOW_PATH))

package/dist/esm/isPublishableManifest.d.ts

@@ -0,0 +1,2 @@
+/** Reports whether a parsed `package.json` can be published: its `private` field is absent or `false`. */
+export declare function isPublishableManifest(manifest: unknown): boolean;

package/dist/esm/isPublishableManifest.js

@@ -0,0 +1,5 @@
+import { isRecord } from "./typeGuards.js";
+export function isPublishableManifest(manifest) {
+    const privateField = isRecord(manifest) ? manifest['private'] : undefined;
+    return privateField === undefined || privateField === false;
+}

package/dist/esm/matchesTagPrefix.d.ts

@@ -0,0 +1,2 @@
+/** Checks whether a tag name is one of the prefixes followed by a complete SemVer version. */
+export declare function matchesTagPrefix(tagName: string, tagPrefixes: readonly string[]): boolean;

package/dist/esm/matchesTagPrefix.js

@@ -0,0 +1,4 @@
+const SEMVER_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+export function matchesTagPrefix(tagName, tagPrefixes) {
+    return tagPrefixes.some((prefix) => tagName.startsWith(prefix) && SEMVER_VERSION_PATTERN.test(tagName.slice(prefix.length)));
+}

package/dist/esm/npmRegistry.d.ts

@@ -0,0 +1,35 @@
+export declare const AUTH_ERROR_CODES: ReadonlySet<string>;
+export declare const UNREACHABLE_ERROR_CODES: ReadonlySet<string>;
+/**
+ * Classifies the outcome of `npm view <package> version --json`.
+ *
+ * Only `E404` means that the registry doesn't know the package; any other failure leaves the question open.
+ */
+export declare function classifyNpmPackageLookup(result: NpmCommandResult): NpmPackageLookup;
+/** Looks up whether a package exists on the npm registry, querying `registry` when one is given. */
+export declare function lookUpNpmPackage(packageName: string, registry?: string): NpmPackageLookup;
+export interface NpmCommandResult {
+    exitOk: boolean;
+    stdout: string;
+}
+export interface NpmErrorPayload {
+    code: string;
+    summary: string;
+}
+export type NpmPackageLookup = {
+    status: 'published';
+} | {
+    status: 'unpublished';
+} | {
+    status: 'unverifiable';
+    detail: string;
+};
+/** Reads npm's `--json` error envelope, which npm writes to stdout on both the success and failure paths. */
+export declare function readNpmError(stdout: string): NpmErrorPayload | undefined;
+/**
+ * Runs npm with the given arguments, capturing stdout whether or not the command exits zero.
+ *
+ * The arguments are expected to include `--json`: npm writes its machine-readable error envelope to stdout,
+ * which `execFileSync` attaches to the thrown error instead of returning it.
+ */
+export declare function runNpmJson(args: readonly string[]): NpmCommandResult;

package/dist/esm/npmRegistry.js

@@ -0,0 +1,58 @@
+import { execFileSync } from 'node:child_process';
+import { isRecord } from "./typeGuards.js";
+export const AUTH_ERROR_CODES = new Set(['E401', 'ENEEDAUTH']);
+export const UNREACHABLE_ERROR_CODES = new Set([
+    'EAI_AGAIN',
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'ENETUNREACH',
+    'ENOTFOUND',
+    'ERR_SOCKET_TIMEOUT',
+    'ETIMEDOUT',
+]);
+export function classifyNpmPackageLookup(result) {
+    if (result.exitOk) {
+        return { status: 'published' };
+    }
+    const error = readNpmError(result.stdout);
+    if (error === undefined) {
+        return { status: 'unverifiable', detail: 'The npm registry query failed without a readable error payload' };
+    }
+    if (error.code === 'E404') {
+        return { status: 'unpublished' };
+    }
+    if (AUTH_ERROR_CODES.has(error.code)) {
+        return { status: 'unverifiable', detail: `The npm registry rejected the session (${error.code})` };
+    }
+    if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+        return { status: 'unverifiable', detail: `Cannot reach the npm registry (${error.code})` };
+    }
+    return { status: 'unverifiable', detail: `The npm registry query failed (${error.code}): ${error.summary}` };
+}
+export function lookUpNpmPackage(packageName, registry) {
+    const args = ['view', packageName, 'version', '--json', ...(registry === undefined ? [] : ['--registry', registry])];
+    return classifyNpmPackageLookup(runNpmJson(args));
+}
+export function readNpmError(stdout) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(parsed) || !isRecord(parsed['error']) || typeof parsed['error']['code'] !== 'string') {
+        return undefined;
+    }
+    const { code, summary } = parsed['error'];
+    return { code, summary: typeof summary === 'string' ? summary : '' };
+}
+export function runNpmJson(args) {
+    try {
+        return { exitOk: true, stdout: execFileSync('npm', args, { encoding: 'utf8', stdio: 'pipe' }) };
+    }
+    catch (error) {
+        const stdout = isRecord(error) && typeof error['stdout'] === 'string' ? error['stdout'] : '';
+        return { exitOk: false, stdout };
+    }
+}

package/dist/esm/prepareCommand.js

@@ -2,6 +2,7 @@ import { execSync } from 'node:child_process';
 import { formatGlyphLine, parseArgsOrExit, reportError, } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { assertCleanWorkingTree } from "./assertCleanWorkingTree.js";
+import { assertReleasesOnNpm } from "./assertReleasesOnNpm.js";
 import { configFlagSchema } from "./configFlagSchema.js";
 import { describeEmptyWorkspace, discoverWorkspaces } from "./discoverWorkspaces.js";
 import { dim } from "./format.js";
@@ -116,7 +117,11 @@ function runSinglePackageMode(userConfig, options, only, setVersion, dryRun, sty
         process.exit(1);
     }
     const config = mergeSinglePackageConfig(userConfig);
-    runAndReport(() => releasePrepare(config, { ...options, ...(setVersion !== undefined && { setVersion }) }), dryRun, style);
+    runAndReport(() => {
+        const plan = releasePrepare(config, { ...options, ...(setVersion !== undefined && { setVersion }) });
+        assertReleasesOnNpm(plan.workspaces.some((result) => result.status === 'released') ? ['.'] : []);
+        return plan;
+    }, dryRun, style);
 }
 function runMonorepoMode(discoveredPaths, userConfig, options, only, setVersion, dryRun, style) {
     let config;
@@ -148,7 +153,15 @@ function runMonorepoMode(discoveredPaths, userConfig, options, only, setVersion,
         ...(only !== undefined && { only }),
         ...(setVersion !== undefined && { setVersions: parseSetVersions(setVersion, knownNames) }),
     };
-    runAndReport(() => releasePrepareMono(config, monorepoOptions), dryRun, style);
+    runAndReport(() => {
+        const plan = releasePrepareMono(config, monorepoOptions);
+        assertReleasesOnNpm(findReleasedWorkspacePaths(plan, config.workspaces));
+        return plan;
+    }, dryRun, style);
+}
+function findReleasedWorkspacePaths(plan, workspaces) {
+    const releasedDirs = new Set(plan.workspaces.flatMap((result) => result.status === 'released' && result.name !== undefined ? [result.name] : []));
+    return workspaces.filter((workspace) => releasedDirs.has(workspace.dir)).map((workspace) => workspace.workspacePath);
 }
 function parseSetVersions(value, knownNames) {
     const setVersions = new Map();

package/dist/esm/previewTagPrefixes.js

@@ -5,6 +5,7 @@ import { describeError } from '@williamthorsen/toolbelt.errors';
 import { deriveWorkspaceConfig } from "./deriveWorkspaceConfig.js";
 import { detectUndeclaredTagPrefixes } from "./detectUndeclaredTagPrefixes.js";
 import { describeEmptyWorkspace, discoverWorkspaces } from "./discoverWorkspaces.js";
+import { matchesTagPrefix } from "./matchesTagPrefix.js";
 export function previewTagPrefixes(config) {
     const workspace = discoverWorkspaces();
     if (workspace.kind === 'empty') {
@@ -62,7 +63,7 @@ function countTagsMatching(prefix) {
             maxBuffer: GIT_OUTPUT_LIMIT,
             stdio: ['pipe', 'pipe', 'pipe'],
         });
-        return output.split('\n').filter((line) => line.trim() !== '').length;
+        return output.split('\n').filter((line) => matchesTagPrefix(line.trim(), [prefix])).length;
     }
     catch {
         return 0;

package/dist/esm/sync-labels/templates.js

@@ -11,7 +11,7 @@ on:
     paths:
       - .github/labels.yaml
 
-  # Preview on review: The check's log has a full computed diff, including deletions of labels not declared by the file.
+  # Preview on review: The check's log has the computed diff, and the check warns about each label not declared by the file.
   pull_request:
     paths:
       - .github/labels.yaml

package/docs/configuration.md

@@ -90,7 +90,7 @@ Tag prefixes from distinct owners must not be identical or be a strict prefix of
 - A `retiredPackages[]` entry (one owner per entry).
 - The `project` block, when configured.
 
-Because release-kit matches a tag to a prefix when the tag name starts with the prefix and continues with a digit, a strict-prefix overlap between distinct owners can match the wrong owner's tags. For example, a project prefix of `v` collides with a workspace prefix of `v11y-check-v`, since `v11y-check-v1.0.0` starts with `v` followed by a digit. The rule rejects every strict-prefix overlap, including one such as `v` and `vue-helpers-v`, whose shorter prefix can't match any tag of the longer one.
+Because release-kit matches a tag to a prefix when the tag name is the prefix followed by a complete SemVer version, a strict-prefix overlap between distinct owners can match the wrong owner's tags. For example, a retired prefix of `pkg-` collides with a workspace prefix of `pkg-1.0.0-v`, since `pkg-1.0.0-v1.2.3` is `pkg-` followed by the pre-release version `1.0.0-v1.2.3`. The rule rejects every strict-prefix overlap, including one such as `v` and `vue-helpers-v`, whose shorter prefix can't match any tag of the longer one.
 
 The rule is enforced at config load; the resulting error identifies both colliding declarations.
 

package/docs/labels.md

@@ -52,7 +52,7 @@ labels: {
 },
 ```
 
-The sync workflow archives a marked label rather than deleting it. An archived label stays on the issues and pull requests that have it, but it cannot be added to new ones and does not appear in the label picker. Removing the mark unarchives the label on the next sync. Removing the entry instead deletes the label, as the sync deletes every label that `.github/labels.yaml` does not declare, and the label disappears from every issue and pull request that had it.
+The sync workflow archives a marked label rather than deleting it. An archived label stays on the issues and pull requests that have it, but it cannot be added to new ones and does not appear in the label picker. Removing the mark unarchives the label on the next sync. Removing the entry leaves the label in place: The sync does not delete a label that `.github/labels.yaml` does not declare, and it reports each such label as a warning. To delete a label, run `gh label delete <name>`; the label disappears from every issue and pull request that had it.
 
 The mark is set only in the `labels` record, not in a preset. To retire a preset's label, replace it with an entry that restates its color and adds the mark.
 
@@ -68,15 +68,17 @@ The scaffolded workflow declares three triggers:
 
 Applying on merge closes the window in which a regenerated `.github/labels.yaml` remains unapplied. In that window, a later manual dispatch would apply an unreviewed label set.
 
-The `check` job runs the same sync in dry-run. Its **Label diff** log group lists every create, edit, rename, and deletion that the sync would perform, including deletions of labels that the file does not declare: the destructive edits that a diff of `.github/labels.yaml` alone cannot show, because a label created by hand or by another workflow is absent from the file both before and after. Read that log; the check reports success whether or not the diff is destructive, so a green check is not evidence that nothing will be deleted.
+The `check` job runs the same sync in dry-run. Its **Label diff** log group lists every create, edit, and rename that the sync would perform.
 
 Its **Archive state** log group lists each label that the sync would archive or unarchive. Archiving runs after the rest of the sync, so a label that the file both adds and marks is created and then archived.
 
+Both jobs end with an **Undeclared labels** log group, and they report each repository label that the file does not declare as a warning annotation, which appears on the run and on the pull request's check. A label created by hand, for example to put it on the ticket that will declare it, therefore survives every sync until the file declares it or someone deletes it.
+
 The two jobs are split because a job's permissions are fixed when the run is created and cannot vary by trigger. The split keeps a write-scoped token out of pull-request runs.
 
 The push trigger filters on the path alone; the `sync` job compares `github.ref_name` against the repository's default branch. The workflow therefore doesn't need a per-repo edit, whatever that branch is named, and a push touching `.github/labels.yaml` on any other branch produces a run whose jobs all skip.
 
-Manual dispatch is not a preview. It matches the `sync` job, so it applies the labels, deletions included; only the pull-request path runs in dry-run.
+Manual dispatch is not a preview. It matches the `sync` job, so it applies the labels; only the pull-request path runs in dry-run.
 
 ### Dry-run checks on fork pull requests
 

package/docs/releasing.md

@@ -15,13 +15,15 @@ Scaffolded files:
 - `.github/workflows/release.yaml`: Workflow that delegates to a reusable release workflow
 - `.config/release-kit.config.ts`: Starter config with commented-out customization examples (with `--with-config`)
 
+When every workspace, or the single package, sets `private: true`, `init` skips `create-github-release.yaml` and `publish.yaml`, `--force` included, and reports each skip: `publish` and `create-github-release` skip private packages, so neither workflow would do anything. Its next steps then leave out the provenance and trusted-publisher steps.
+
 ## `release-kit update-templates`
 
 Updates the scaffolded workflows to the templates of the installed release-kit version, and prints what changed in each file. Run it after upgrading release-kit; `--dry-run` previews the changes without writing them.
 
 The workflows are managed files: release-kit renders them, and a change made by hand is overwritten on the next update. The config files are the repository's own, and the command never reads or writes them.
 
-- It creates a missing workflow that `init` would create.
+- It creates a missing workflow that `init` would create. In a repo whose packages are all private, `init` does not create `create-github-release.yaml` or `publish.yaml`, so the command does not create either one when it is missing and reports the skip; it still refreshes either one that exists.
 - It refreshes `.github/workflows/sync-labels.yaml` only when the file exists, because `sync-labels init` scaffolds it on request.
 - It keeps `publish.yaml`'s provenance setting: When the file does not set `provenance: true`, as in a private repository, the updated file does not either.
 
@@ -57,6 +59,10 @@ release-kit prepare --force --bump=minor
 release-kit prepare --bump=minor
 ```
 
+### Packages that npm doesn't have yet
+
+Before it writes any file, and in a dry run as well, `prepare` asks npm about each publishable package that the release includes, querying the registry that the package's `publishConfig.registry` names when it sets one. OIDC trusted publishing can't publish a package's first version, so `prepare` refuses to release a package that npm doesn't list, and names each one with its fix: Run `npm publish --access public` from the package's directory once, then register the package as a trusted publisher. The `npm-auto-publish` [readiness kit](readiness-checks.md) prints the `npm trust` command. `prepare` also refuses when it can't look a package up, such as when the registry is unreachable, and reports npm's error for that package.
+
 ### Previewing release notes with `--with-release-notes`
 
 `--with-release-notes` writes two versioned files per workspace after each workspace's `changelog.json` is produced:
@@ -126,6 +132,8 @@ The `init` command scaffolds a release workflow at `.github/workflows/release.ya
 
 For repos that need a self-contained workflow instead of the reusable one, the scaffolded file can be expanded. The key steps are: checkout with full history (`fetch-depth: 0`), run `release-kit prepare` with optional `--only`, `--bump`, and `--force` flags, check for changes, read tags from `tmp/.release-tags`, then commit, tag, and push.
 
+The reusable `release`, `create-github-release`, and `sync-labels` workflows run on `ubuntu-latest` unless the repository's `CI_RUNS_ON` variable names another runner; `publish` always runs on `ubuntu-latest`. See [Runner selection](https://github.com/williamthorsen/node-monorepo-tools/blob/main/.github/workflows/README.md#runner-selection).
+
 ### Triggering a release
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/release-kit",
-  "version": "14.0.0",
+  "version": "14.1.0",
   "description": "Version-bumping and changelog-generation toolkit for release workflows",
   "keywords": [
     "changelog",
@@ -52,7 +52,7 @@
   "dependencies": {
     "@williamthorsen/change-grammar": "0.2.0",
     "@williamthorsen/nmr-core": "0.13.2",
-    "@williamthorsen/toolbelt.errors": "0.8.2",
+    "@williamthorsen/toolbelt.errors": "0.8.3",
     "json-stringify-pretty-compact": "4.0.0",
     "semver": "7.8.5",
     "yaml": "2.9.1",
@@ -60,9 +60,9 @@
   },
   "devDependencies": {
     "@types/semver": "7.8.0",
-    "@williamthorsen/toolbelt.filesystem": "0.9.2",
-    "@williamthorsen/toolbelt.testing": "0.6.2",
-    "@williamthorsen/toolbelt.vitest": "0.10.2",
+    "@williamthorsen/toolbelt.filesystem": "0.9.3",
+    "@williamthorsen/toolbelt.testing": "0.6.3",
+    "@williamthorsen/toolbelt.vitest": "0.10.3",
     "actionlint": "2.0.6",
     "esbuild": "0.28.2",
     "readyup": "0.40.0",