@williamthorsen/release-kit 16.0.0 → 16.1.0

package/.meta/changelog.json

@@ -1,4 +1,31 @@
 [
+  {
+    "version": "16.1.0",
+    "date": "2026-11-03",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Makes `prepare` and `publish` refuse a release, dry runs included, when a tarball packed from a clean checkout of HEAD lacks a file named by the package's `main`, `types`, `bin`, or `exports`, which keeps a package with missing build output from reaching the registry. (#1147)",
+            "hash": "c730654140e89d52ac7430987497d8b954fa7f00",
+            "entry": 1
+          },
+          {
+            "description": "Adds the `devExportConditions` config key, which lists the export conditions that resolve only inside the repo and whose targets the tarball check does not require, in addition to `source`. (#1147)",
+            "hash": "c730654140e89d52ac7430987497d8b954fa7f00",
+            "entry": 2
+          },
+          {
+            "description": "Adds a `content` label to the `common` label preset, for consumer-facing material such as copy, images, or displayed data rather than functionality. (#1150)",
+            "hash": "8c7b990041e5744c26547fe0ce8c9305f0f7c6f4",
+            "entry": 1
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "16.0.0",
     "date": "2026-10-28",

package/.readyup/kits/default.js

@@ -223,7 +223,7 @@ function stripYamlQuotes(value) {
 }
 
 // .readyup/lib/workflow-hashes.ts
-var COMMON_PRESET_HASH = "1d3e2df1ccd7deea4707fa07a4ae171d761344b65c1a311467fc0f66b70ee646";
+var COMMON_PRESET_HASH = "5c6d7efcc8744d9d30720d24e345b04e03f2b28677ad0c6782020d91731b8aa4";
 var SYNC_LABELS_WORKFLOW_HASH = "0a88829d154c0de7cdd4246fede99e9311a89ab4199034dbe601663d641ab1e4";
 var RELEASE_WORKFLOW_HASH_MONOREPO = "f63f4cabb57f94ee6550f17a9874c7a346d46554595ddbcd46fdd3208d613437";
 var RELEASE_WORKFLOW_HASH_SINGLE = "d26dd4ca186632b388ea46bd885721124c03d19918e511baa40821d2d760da69";
@@ -234,7 +234,7 @@ var CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE = "d6de961de913c67b08dfa7e07f7349
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "16.0.0" };
+  const picked = { "version": "16.1.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }

package/.readyup/manifest.json

@@ -7,7 +7,7 @@
           "checklist": "release-kit",
           "checks": [
             "@williamthorsen/release-kit in devDependencies",
-            "@williamthorsen/release-kit >= 16.0.0",
+            "@williamthorsen/release-kit >= 16.1.0",
             "release.yaml workflow exists",
             "release.yaml matches template",
             "release.yaml does not reference deprecated tag ref",
@@ -58,12 +58,12 @@
           "path": "lib/config-checks.ts"
         },
         {
-          "hash": "13f15dfe",
+          "hash": "f652dae3",
           "kind": "module",
           "path": "lib/workflow-hashes.ts"
         },
         {
-          "hash": "de7d08de",
+          "hash": "b44f7148",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -101,7 +101,7 @@
       "readyupVersion": "0.44.0",
       "source": "kits/default.ts",
       "sourceHash": "56566d0b",
-      "targetHash": "43d5913f"
+      "targetHash": "5f810bb7"
     },
     {
       "checklistChecks": [

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
+## 16.1.0 — 2026-11-03
+
+### 🎉 Features
+
+- Makes `prepare` and `publish` refuse a release, dry runs included, when a tarball packed from a clean checkout of HEAD lacks a file named by the package's `main`, `types`, `bin`, or `exports`, which keeps a package with missing build output from reaching the registry. (#1147)
+- Adds the `devExportConditions` config key, which lists the export conditions that resolve only inside the repo and whose targets the tarball check does not require, in addition to `source`. (#1147)
+- Adds a `content` label to the `common` label preset, for consumer-facing material such as copy, images, or displayed data rather than functionality. (#1150)
+
 ## 16.0.0 — 2026-10-28
 
 ### 🎉 Features

package/README.md

@@ -7,11 +7,13 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
 <!-- section:release-notes -->
-## Release notes — v16.0.0 (2026-10-28)
+## Release notes — v16.1.0 (2026-11-03)
 
 ### 🎉 Features
 
-- 🚨 **Breaking:** Renames the `changelogMarkdown.keepVersions` config key to `changelogMarkdown.keptVersionCount` and makes config validation reject the old key with an error that names the replacement. (#1134)
+- Makes `prepare` and `publish` refuse a release, dry runs included, when a tarball packed from a clean checkout of HEAD lacks a file named by the package's `main`, `types`, `bin`, or `exports`, which keeps a package with missing build output from reaching the registry. (#1147)
+- Adds the `devExportConditions` config key, which lists the export conditions that resolve only inside the repo and whose targets the tarball check does not require, in addition to `source`. (#1147)
+- Adds a `content` label to the `common` label preset, for consumer-facing material such as copy, images, or displayed data rather than functionality. (#1150)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -71,8 +73,9 @@ Every command other than `--version` and `--help` first locates the repo root an
 1. **Workspace discovery**: Reads `pnpm-workspace.yaml` and resolves its `packages` patterns to find workspace directories, applying pnpm's semantics: A `!`-prefixed entry excludes what it matches, wherever it appears in the list. Each directory containing a `package.json` becomes a workspace. The repo is treated as a single-package project when it doesn't contain a workspace file, and when the workspace file doesn't declare a `packages` list: a file kept for `catalog:` or `overrides:` alone, which pnpm likewise resolves to the root package. A workspace file that declares patterns that don't resolve to any package is an error naming the condition that emptied it.
 2. **Config loading**: Loads `.config/release-kit.config.ts` (if present) from the repo root, or the file named by `--config` relative to the invocation directory, and merges it with discovered defaults.
 3. **Commit analysis**: For each workspace, reads the history once, builds the changelog items of the commits since the last version tag, and takes the bump as the highest level that those items call for.
-4. **Version bump + changelog**: Bumps `package.json` versions, builds structured `ChangelogEntry[]` from the commits between each pair of release tags, applies any [editorial overrides](docs/editorial-overrides.md) from per-scope `.meta/changelog-overrides.json` files, and renders both `CHANGELOG.md` and `.meta/changelog.json` from that single source, so the two always agree.
-5. **Release tags file**: Writes computed tags to `tmp/.release-tags` for the release workflow to read when tagging and pushing.
+4. **Tarball check**: Packs each publishable package that the release includes from a clean checkout of HEAD, and refuses the release when a tarball lacks a file that the package's manifest names; see [Packages whose tarball would lack a manifest file](docs/releasing.md#packages-whose-tarball-would-lack-a-manifest-file).
+5. **Version bump + changelog**: Bumps `package.json` versions, builds structured `ChangelogEntry[]` from the commits between each pair of release tags, applies any [editorial overrides](docs/editorial-overrides.md) from per-scope `.meta/changelog-overrides.json` files, and renders both `CHANGELOG.md` and `.meta/changelog.json` from that single source, so the two always agree.
+6. **Release tags file**: Writes computed tags to `tmp/.release-tags` for the release workflow to read when tagging and pushing.
 
 [Changelogs](docs/changelogs.md) covers what a published tarball includes, the `changelog.json` item schema, and which commits appear in a changelog.
 

package/dist/esm/assertTarballsComplete.d.ts

@@ -0,0 +1,9 @@
+import { packFromCleanCheckout } from './packFromCleanCheckout.js';
+/**
+ * Throws when the tarball of a publishable package among the given workspaces would lack a file that its manifest
+ * names, or when the packages cannot be packed from a clean checkout of HEAD.
+ *
+ * Each workspace path is repo-relative and is read from the current directory. A private package is not packed, and
+ * an empty list doesn't clone anything.
+ */
+export declare function assertTarballsComplete(workspacePaths: readonly string[], devExportConditions: readonly string[], pack?: typeof packFromCleanCheckout): void;

package/dist/esm/assertTarballsComplete.js

@@ -0,0 +1,52 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describeError } from '@williamthorsen/toolbelt.errors';
+import { detectPackageManager } from "./detectPackageManager.js";
+import { findMissingManifestPaths } from "./findMissingManifestPaths.js";
+import { isPublishableManifest } from "./isPublishableManifest.js";
+import { packFromCleanCheckout } from "./packFromCleanCheckout.js";
+import { isRecord } from "./typeGuards.js";
+export function assertTarballsComplete(workspacePaths, devExportConditions, pack = packFromCleanCheckout) {
+    const candidates = workspacePaths
+        .map((workspacePath) => ({ workspacePath, manifest: readManifest(workspacePath) }))
+        .filter(({ manifest }) => isPublishableManifest(manifest));
+    if (candidates.length === 0) {
+        return;
+    }
+    process.stderr.write(`Checking the tarballs of ${candidates.length} ${candidates.length === 1 ? 'package' : 'packages'} from a clean checkout of HEAD...\n`);
+    let filesByWorkspace;
+    try {
+        filesByWorkspace = pack(candidates.map(({ workspacePath }) => workspacePath), detectPackageManager());
+    }
+    catch (error) {
+        throw new Error(`Cannot release: The packages could not be packed from a clean checkout of HEAD.\n${describeError(error)}`, { cause: error });
+    }
+    const incompletePackages = candidates
+        .map(({ workspacePath, manifest }) => ({
+        workspacePath,
+        manifest,
+        missingPaths: findMissingManifestPaths(manifest, filesByWorkspace.get(workspacePath) ?? [], devExportConditions),
+    }))
+        .filter(({ missingPaths }) => missingPaths.length > 0);
+    if (incompletePackages.length === 0) {
+        return;
+    }
+    throw new Error(describeRefusal(incompletePackages));
+}
+function describeRefusal(incompletePackages) {
+    const sections = ['Cannot release: The tarball of every package must contain each file that its manifest names.'];
+    for (const { workspacePath, manifest, missingPaths } of incompletePackages) {
+        const name = typeof manifest['name'] === 'string' ? manifest['name'] : workspacePath;
+        sections.push([
+            `${name} (${workspacePath}) lacks:`,
+            ...missingPaths.map(({ location, path }) => `  - ${path} (${location})`),
+        ].join('\n'));
+    }
+    sections.push('Build these files in the package\'s publish lifecycle, such as in a "prepack" script. ' +
+        'If an export condition is for development only, list it in the "devExportConditions" config key.');
+    return sections.join('\n\n');
+}
+function readManifest(workspacePath) {
+    const manifest = JSON.parse(readFileSync(join(workspacePath, 'package.json'), 'utf8'));
+    return isRecord(manifest) ? manifest : {};
+}

package/dist/esm/buildChangelogEntries.js

@@ -75,7 +75,7 @@ function buildSections(sectionMap, devOnlySections) {
     return sections.toSorted((a, b) => getCanonicalSectionPriority(a.title) - getCanonicalSectionPriority(b.title));
 }
 function formatDate(timestampSec) {
-    return new Date(timestampSec * 1_000).toISOString().slice(0, 10);
+    return new Date(timestampSec * 1000).toISOString().slice(0, 10);
 }
 function getCanonicalSectionPriority(title) {
     const index = CANONICAL_SECTION_ORDER.get(stripGroupDecorations(title));
@@ -170,7 +170,7 @@ function transformReleases(windows, context) {
         unreleasedReading: {
             bump: determineBumpType(signals, context.workTypes, context.versionPatterns),
             commits: unreleasedCommits.filter((commit) => !isReleaseSubject(commit.subject)).toReversed(),
-            date: formatDate(unreleasedWindow?.timestampSec ?? Math.floor(Date.now() / 1_000)),
+            date: formatDate(unreleasedWindow?.timestampSec ?? Math.floor(Date.now() / 1000)),
             diagnostics,
             parsedCommitCount,
             sections: buildSections(sectionMap, context.devOnlySections),

package/dist/esm/configSchema.d.ts

@@ -166,6 +166,7 @@ export declare const releaseKitConfigSchema: z.ZodObject<{
     changelogMarkdown: z.ZodOptional<z.ZodObject<{
         keptVersionCount: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
+    devExportConditions: z.ZodOptional<z.ZodArray<z.ZodString>>;
     formatCommand: z.ZodOptional<z.ZodString>;
     project: z.ZodOptional<z.ZodObject<{
         paths: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/esm/configSchema.js

@@ -89,6 +89,7 @@ export const releaseKitConfigSchema = z
     breakingPolicies: z.record(z.string(), breakingPolicyValueSchema).optional(),
     changelogJson: changelogJsonInputSchema.optional(),
     changelogMarkdown: changelogMarkdownInputSchema.optional(),
+    devExportConditions: z.array(z.string().min(1)).optional(),
     formatCommand: z.string().min(1).optional(),
     project: projectConfigSchema.optional(),
     releaseNotes: releaseNotesInputSchema.optional(),

package/dist/esm/detectPackageManager.d.ts

@@ -4,3 +4,5 @@ export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'yarn-berry';
  * and otherwise returns `npm`. Yarn v2+ is `'yarn-berry'`, to distinguish it from Yarn Classic.
  */
 export declare function detectPackageManager(): PackageManager;
+/** Maps a `PackageManager` value to its CLI executable name. */
+export declare function resolveExecutable(packageManager: PackageManager): string;

package/dist/esm/detectPackageManager.js

@@ -20,6 +20,9 @@ export function detectPackageManager() {
     }
     return detectFromLockfile();
 }
+export function resolveExecutable(packageManager) {
+    return packageManager === 'yarn-berry' ? 'yarn' : packageManager;
+}
 function isYarnBerry(version) {
     if (version === undefined) {
         return false;

package/dist/esm/enumerateReleaseWindows.js

@@ -11,7 +11,7 @@ export function enumerateReleaseWindows(options) {
     }
     const unreleasedWindow = {
         version: unreleasedTag,
-        timestampSec: Math.floor(now() / 1_000),
+        timestampSec: Math.floor(now() / 1000),
         commits: [],
     };
     const ancestry = readAncestry();

package/dist/esm/findMissingManifestPaths.d.ts

@@ -0,0 +1,14 @@
+/** A path that a manifest names but the tarball lacks, with the manifest location that names it. */
+export interface MissingManifestPath {
+    location: string;
+    path: string;
+}
+/**
+ * Lists each path named by the manifest's `main`, `types`, `bin`, and `exports` that `packedFiles` lacks.
+ *
+ * `packedFiles` holds tarball entries relative to the package root. `main` resolves as Node resolves it: the path
+ * itself, then with `.js` or `.json` appended, then as a directory containing `index.js`. An `exports` target
+ * containing `*` passes when any entry matches it, with `*` spanning `/` as in Node's subpath patterns. A target under
+ * `source` or under one of `devExportConditions` is exempt, at any depth.
+ */
+export declare function findMissingManifestPaths(manifest: Record<string, unknown>, packedFiles: readonly string[], devExportConditions: readonly string[]): MissingManifestPath[];

package/dist/esm/findMissingManifestPaths.js

@@ -0,0 +1,90 @@
+import { isRecord } from "./typeGuards.js";
+const BUILT_IN_DEV_CONDITION = 'source';
+export function findMissingManifestPaths(manifest, packedFiles, devExportConditions) {
+    const packedSet = new Set(packedFiles);
+    const exemptConditions = new Set([BUILT_IN_DEV_CONDITION, ...devExportConditions]);
+    const missingPaths = [];
+    const main = manifest['main'];
+    if (typeof main === 'string' && listMainCandidates(main).every((candidate) => !packedSet.has(candidate))) {
+        missingPaths.push({ location: 'main', path: main });
+    }
+    const types = manifest['types'];
+    if (typeof types === 'string' && !packedSet.has(normalizePath(types))) {
+        missingPaths.push({ location: 'types', path: types });
+    }
+    const binTargets = listBinTargets(manifest['bin']);
+    for (const { location, path } of binTargets) {
+        if (!packedSet.has(normalizePath(path))) {
+            missingPaths.push({ location, path });
+        }
+    }
+    const exportTargets = [];
+    collectExportTargets(manifest['exports'], 'exports', exemptConditions, exportTargets);
+    for (const target of exportTargets) {
+        if (!isTargetPacked(target.path, packedFiles, packedSet)) {
+            missingPaths.push(target);
+        }
+    }
+    return missingPaths;
+}
+function collectExportTargets(value, location, exemptConditions, targets) {
+    if (typeof value === 'string') {
+        targets.push({ location, path: value });
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const [index, element] of value.entries()) {
+            collectExportTargets(element, `${location}[${index}]`, exemptConditions, targets);
+        }
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    for (const [key, nestedValue] of Object.entries(value)) {
+        if (key.startsWith('.')) {
+            collectExportTargets(nestedValue, `${location}[${JSON.stringify(key)}]`, exemptConditions, targets);
+        }
+        else if (!exemptConditions.has(key)) {
+            collectExportTargets(nestedValue, `${location}.${key}`, exemptConditions, targets);
+        }
+    }
+}
+function isTargetPacked(target, packedFiles, packedSet) {
+    const normalizedTarget = normalizePath(target);
+    if (!normalizedTarget.includes('*')) {
+        return packedSet.has(normalizedTarget);
+    }
+    const pattern = new RegExp(`^${normalizedTarget
+        .split('*')
+        .map((part) => RegExp.escape(part))
+        .join('.*')}$`);
+    return packedFiles.some((file) => pattern.test(file));
+}
+function listBinTargets(bin) {
+    if (typeof bin === 'string') {
+        return [{ location: 'bin', path: bin }];
+    }
+    if (!isRecord(bin))
+        return [];
+    const targets = [];
+    for (const [command, path] of Object.entries(bin)) {
+        if (typeof path === 'string') {
+            targets.push({ location: `bin.${command}`, path });
+        }
+    }
+    return targets;
+}
+function listMainCandidates(main) {
+    const normalizedMain = normalizePath(main);
+    const directoryPrefix = normalizedMain === '' ? '' : `${normalizedMain}/`;
+    const indexCandidates = [`${directoryPrefix}index.js`, `${directoryPrefix}index.json`];
+    if (normalizedMain === '')
+        return indexCandidates;
+    return [normalizedMain, `${normalizedMain}.js`, `${normalizedMain}.json`, ...indexCandidates];
+}
+function normalizePath(path) {
+    return path
+        .replace(/^\.?\/+/, '')
+        .replace(/^\.$/, '')
+        .replace(/\/+$/, '');
+}

package/dist/esm/packFromCleanCheckout.d.ts

@@ -0,0 +1,11 @@
+import { type PackageManager } from './detectPackageManager.js';
+/**
+ * Packs each workspace as the publish environment would and returns each one's tarball entries, keyed by workspace
+ * path and relative to the package root.
+ *
+ * Clones HEAD of the repo at the current directory into a temporary directory, runs a frozen install there, then for
+ * each workspace runs its `prepublishOnly` when it declares one and packs it. Workspace paths are relative to the repo
+ * root. Throws an error that names the failing step and contains its output. Leaves the repo and its working tree
+ * untouched, and removes the temporary directory.
+ */
+export declare function packFromCleanCheckout(workspacePaths: readonly string[], packageManager: PackageManager): Map<string, string[]>;

package/dist/esm/packFromCleanCheckout.js

@@ -0,0 +1,81 @@
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveExecutable } from "./detectPackageManager.js";
+import { isRecord } from "./typeGuards.js";
+export function packFromCleanCheckout(workspacePaths, packageManager) {
+    const repoRoot = runStep('find the repository root', 'git', ['rev-parse', '--show-toplevel'], process.cwd()).trim();
+    const headSha = runStep('resolve HEAD', 'git', ['rev-parse', 'HEAD'], repoRoot).trim();
+    const scratchDir = mkdtempSync(join(tmpdir(), 'release-kit-pack-'));
+    try {
+        const cloneDir = join(scratchDir, 'checkout');
+        runStep('clone HEAD', 'git', ['clone', '--quiet', '--shared', '--no-checkout', repoRoot, cloneDir], scratchDir);
+        runStep('check out HEAD', 'git', ['checkout', '--quiet', '--detach', headSha], cloneDir);
+        const executable = resolveExecutable(packageManager);
+        const commands = PACKAGE_MANAGER_COMMANDS[packageManager];
+        runStep('install dependencies', executable, commands.installArgs, cloneDir);
+        const filesByWorkspace = new Map();
+        for (const [index, workspacePath] of workspacePaths.entries()) {
+            const packageDir = join(cloneDir, workspacePath);
+            if (declaresPrepublishOnly(packageDir)) {
+                runStep(`run prepublishOnly in ${workspacePath}`, executable, ['run', 'prepublishOnly'], packageDir);
+            }
+            const packDir = join(scratchDir, 'packs', String(index));
+            mkdirSync(packDir, { recursive: true });
+            runStep(`pack ${workspacePath}`, executable, commands.buildPackArgs(packDir), packageDir);
+            filesByWorkspace.set(workspacePath, listTarballEntries(findTarball(packDir, workspacePath)));
+        }
+        return filesByWorkspace;
+    }
+    finally {
+        rmSync(scratchDir, { force: true, recursive: true });
+    }
+}
+const PACKAGE_MANAGER_COMMANDS = {
+    npm: {
+        installArgs: ['ci', '--prefer-offline'],
+        buildPackArgs: (packDir) => ['pack', '--pack-destination', packDir],
+    },
+    pnpm: {
+        installArgs: ['install', '--frozen-lockfile', '--prefer-offline'],
+        buildPackArgs: (packDir) => ['pack', '--pack-destination', packDir],
+    },
+    yarn: {
+        installArgs: ['install', '--frozen-lockfile'],
+        buildPackArgs: (packDir) => ['pack', '--filename', join(packDir, 'package.tgz')],
+    },
+    'yarn-berry': {
+        installArgs: ['install', '--immutable'],
+        buildPackArgs: (packDir) => ['pack', '--out', join(packDir, 'package.tgz')],
+    },
+};
+function declaresPrepublishOnly(packageDir) {
+    const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+    const scripts = isRecord(manifest) ? manifest['scripts'] : undefined;
+    return isRecord(scripts) && typeof scripts['prepublishOnly'] === 'string';
+}
+function findTarball(packDir, workspacePath) {
+    const tarballs = readdirSync(packDir).filter((name) => name.endsWith('.tgz'));
+    const [tarball] = tarballs;
+    if (tarballs.length !== 1 || tarball === undefined) {
+        throw new Error(`Could not pack ${workspacePath}: expected one tarball, found ${tarballs.length}.`);
+    }
+    return join(packDir, tarball);
+}
+function listTarballEntries(tarballPath) {
+    const listing = runStep('list the tarball', 'tar', ['--list', '--gzip', '--file', tarballPath], process.cwd());
+    return listing
+        .split('\n')
+        .filter((entry) => entry !== '' && !entry.endsWith('/'))
+        .map((entry) => entry.replace(/^package\//, ''));
+}
+function runStep(step, command, args, cwd) {
+    const result = spawnSync(command, args, { cwd, encoding: 'utf8', maxBuffer: 2 ** 26 });
+    if (result.error === undefined && result.status === 0) {
+        return result.stdout;
+    }
+    const outcome = result.error === undefined ? `exited with status ${result.status}` : result.error.message;
+    const output = [result.stdout, result.stderr].filter((text) => text !== '').join('\n');
+    throw new Error(`Could not ${step}: \`${[command, ...args].join(' ')}\` ${outcome}.${output === '' ? '' : `\n${output}`}`);
+}

package/dist/esm/prepareCommand.js

@@ -3,6 +3,7 @@ import { formatGlyphLine, reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { assertCleanWorkingTree } from "./assertCleanWorkingTree.js";
 import { assertReleasesOnNpm } from "./assertReleasesOnNpm.js";
+import { assertTarballsComplete } from "./assertTarballsComplete.js";
 import { describeEmptyWorkspace, discoverWorkspaces } from "./discoverWorkspaces.js";
 import { dim } from "./format.js";
 import { RELEASE_GLYPHS } from "./glyphs.js";
@@ -63,7 +64,9 @@ export async function prepareCommand(argv, styles, invocationDir) {
     };
     runAndReport(() => {
         const plan = prepareReleaseTargets(config, targetOptions);
-        assertReleasesOnNpm(findReleasedPackagePaths(plan, config.targets));
+        const releasedPackagePaths = findReleasedPackagePaths(plan, config.targets);
+        assertReleasesOnNpm(releasedPackagePaths);
+        assertTarballsComplete(releasedPackagePaths, userConfig?.devExportConditions ?? []);
         return plan;
     }, isDryRun, styles.stdout);
 }

package/dist/esm/publish.d.ts

@@ -1,4 +1,4 @@
-import type { PackageManager } from './detectPackageManager.js';
+import { type PackageManager } from './detectPackageManager.js';
 import type { ResolvedTag } from './resolveReleaseTags.js';
 export interface PublishOptions {
     isDryRun: boolean;

package/dist/esm/publish.js

@@ -1,4 +1,5 @@
 import { execFileSync } from 'node:child_process';
+import { resolveExecutable } from "./detectPackageManager.js";
 export function publishPackage(resolvedTag, packageManager, options) {
     const { isDryRun, shouldGenerateProvenance } = options;
     const executable = resolveExecutable(packageManager);
@@ -6,12 +7,6 @@ export function publishPackage(resolvedTag, packageManager, options) {
     console.info(`\n${isDryRun ? '[dry-run] ' : ''}Running: ${executable} ${args.join(' ')} (cwd: ${resolvedTag.workspacePath})`);
     execFileSync(executable, args, { cwd: resolvedTag.workspacePath, stdio: 'inherit' });
 }
-function resolveExecutable(packageManager) {
-    if (packageManager === 'yarn-berry') {
-        return 'yarn';
-    }
-    return packageManager;
-}
 function buildPublishArgs(packageManager, options) {
     const args = packageManager === 'yarn-berry' ? ['npm', 'publish'] : ['publish'];
     if (options.isDryRun) {

package/dist/esm/publishCommand.d.ts

@@ -1,7 +1,7 @@
 import { type StreamStyles } from '@williamthorsen/nmr-core';
 /**
- * Orchestrates the CLI `publish` command: checks for a clean working tree, resolves the tags on HEAD, and publishes
- * each publishable one, injecting release notes into its README for the duration of the publish.
- * A relative `--config` resolves against `invocationDir`.
+ * Orchestrates the CLI `publish` command: checks for a clean working tree, resolves the tags on HEAD, checks the
+ * tarballs of the publishable ones from a clean checkout, and publishes each one, injecting release notes into its
+ * README for the duration of the publish. A relative `--config` resolves against `invocationDir`.
  */
 export declare function publishCommand(argv: string[], styles: StreamStyles, invocationDir: string): Promise<void>;

package/dist/esm/publishCommand.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { parseArgsOrExit, reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { assertCleanWorkingTree } from "./assertCleanWorkingTree.js";
+import { assertTarballsComplete } from "./assertTarballsComplete.js";
 import { configFlagSchema } from "./configFlagSchema.js";
 import { deriveReleaseNotesConfig } from "./deriveReleaseNotesConfig.js";
 import { detectPackageManager } from "./detectPackageManager.js";
@@ -46,6 +47,13 @@ export async function publishCommand(argv, styles, invocationDir) {
         console.info('Nothing to publish.');
         return;
     }
+    try {
+        assertTarballsComplete(publishableTags.map(({ workspacePath }) => workspacePath), userConfig?.devExportConditions ?? []);
+    }
+    catch (error) {
+        reportError(describeError(error));
+        process.exit(1);
+    }
     const packageManager = detectPackageManager();
     const { releaseNotes, changelogJsonOutputPath, sectionOrder } = deriveReleaseNotesConfig(userConfig);
     const shouldInject = releaseNotes.shouldInjectIntoReadme;

package/docs/configuration.md

@@ -16,21 +16,22 @@ The two paths differ in what an absent file means. An absent default path means
 
 ## `ReleaseKitConfig` reference
 
-| Field               | Type                                        | Description                                                                                                                                                                                                                                                                              |
-| ------------------- | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `releases`          | `Record<string, ReleaseEntry>`              | Names, excludes, or composes release targets; see [`releases`](#releases). Can't be combined with `workspaces` or `project`                                                                                                                                                              |
-| `workspaces`        | `WorkspaceOverride[]`                       | Override or exclude discovered workspaces (matched by `dir`)                                                                                                                                                                                                                             |
-| `formatCommand`     | `string`                                    | Shell command to run after changelog generation; modified file paths are appended as arguments                                                                                                                                                                                           |
-| `versionPatterns`   | `VersionPatterns`                           | Rules for which commit types trigger major/minor bumps                                                                                                                                                                                                                                   |
-| `scopeAliases`      | `Record<string, string>`                    | Maps shorthand scope names to canonical names in commit titles and in change-record entry `scopes`, which [route items to workspaces](changelogs.md#routing-to-workspaces). A renamed workspace directory or [release target](#releases) needs an entry from its old name to its new one |
-| `workTypes`         | `Record<string, WorkTypeConfig>`            | Work type definitions, merged with defaults by key                                                                                                                                                                                                                                       |
-| `breakingPolicies`  | `Record<string, 'forbidden' \| 'optional'>` | Per-type `!`-policy lookup. Defaults to `DEFAULT_BREAKING_POLICIES`. Replaces the default entirely when provided. Set to `{}` to disable enforcement                                                                                                                                     |
-| `retiredPackages`   | `RetiredPackage[]`                          | Packages that once lived in this repo but have been extracted or removed; suppresses undeclared-tag-prefix warnings                                                                                                                                                                      |
-| `project`           | `ProjectConfig`                             | Opt-in project-level release block. Declaring `project: {}` (even empty) enables a project-release stage in `prepare`                                                                                                                                                                    |
-| `repoLabels`        | `RepoLabelsConfig`                          | Declares the repository's label registry for `sync-labels`; see [Label configuration](labels.md#label-configuration)                                                                                                                                                                     |
-| `changelogJson`     | `ChangelogJsonConfig`                       | Controls `.meta/changelog.json`: `enabled` (default `true`), `outputPath` (default `'.meta/changelog.json'`), and `devOnlySections`; see [Custom work types](work-types.md#custom-work-types)                                                                                            |
-| `changelogMarkdown` | `ChangelogMarkdownConfig`                   | `keptVersionCount` (an integer, at least 1) bounds `CHANGELOG.md` to that many of the newest versions and moves the rest into per-major archive files; omitted, `CHANGELOG.md` renders every version. See [Archived versions](changelogs.md#archived-versions)                           |
-| `releaseNotes`      | `ReleaseNotesConfig`                        | `shouldInjectIntoReadme` (default `false`) injects release notes into each package's README while it publishes; see [Release-notes injection](changelogs.md#release-notes-injection)                                                                                                     |
+| Field                 | Type                                        | Description                                                                                                                                                                                                                                                                              |
+| --------------------- | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `releases`            | `Record<string, ReleaseEntry>`              | Names, excludes, or composes release targets; see [`releases`](#releases). Can't be combined with `workspaces` or `project`                                                                                                                                                              |
+| `workspaces`          | `WorkspaceOverride[]`                       | Override or exclude discovered workspaces (matched by `dir`)                                                                                                                                                                                                                             |
+| `devExportConditions` | `string[]`                                  | Export conditions that resolve only inside the repo, such as one that points at unpublished source; the [tarball check](releasing.md#packages-whose-tarball-would-lack-a-manifest-file) does not require their targets in the tarball. `source` is exempt without being listed           |
+| `formatCommand`       | `string`                                    | Shell command to run after changelog generation; modified file paths are appended as arguments                                                                                                                                                                                           |
+| `versionPatterns`     | `VersionPatterns`                           | Rules for which commit types trigger major/minor bumps                                                                                                                                                                                                                                   |
+| `scopeAliases`        | `Record<string, string>`                    | Maps shorthand scope names to canonical names in commit titles and in change-record entry `scopes`, which [route items to workspaces](changelogs.md#routing-to-workspaces). A renamed workspace directory or [release target](#releases) needs an entry from its old name to its new one |
+| `workTypes`           | `Record<string, WorkTypeConfig>`            | Work type definitions, merged with defaults by key                                                                                                                                                                                                                                       |
+| `breakingPolicies`    | `Record<string, 'forbidden' \| 'optional'>` | Per-type `!`-policy lookup. Defaults to `DEFAULT_BREAKING_POLICIES`. Replaces the default entirely when provided. Set to `{}` to disable enforcement                                                                                                                                     |
+| `retiredPackages`     | `RetiredPackage[]`                          | Packages that once lived in this repo but have been extracted or removed; suppresses undeclared-tag-prefix warnings                                                                                                                                                                      |
+| `project`             | `ProjectConfig`                             | Opt-in project-level release block. Declaring `project: {}` (even empty) enables a project-release stage in `prepare`                                                                                                                                                                    |
+| `repoLabels`          | `RepoLabelsConfig`                          | Declares the repository's label registry for `sync-labels`; see [Label configuration](labels.md#label-configuration)                                                                                                                                                                     |
+| `changelogJson`       | `ChangelogJsonConfig`                       | Controls `.meta/changelog.json`: `enabled` (default `true`), `outputPath` (default `'.meta/changelog.json'`), and `devOnlySections`; see [Custom work types](work-types.md#custom-work-types)                                                                                            |
+| `changelogMarkdown`   | `ChangelogMarkdownConfig`                   | `keptVersionCount` (an integer, at least 1) bounds `CHANGELOG.md` to that many of the newest versions and moves the rest into per-major archive files; omitted, `CHANGELOG.md` renders every version. See [Archived versions](changelogs.md#archived-versions)                           |
+| `releaseNotes`        | `ReleaseNotesConfig`                        | `shouldInjectIntoReadme` (default `false`) injects release notes into each package's README while it publishes; see [Release-notes injection](changelogs.md#release-notes-injection)                                                                                                     |
 
 All fields are optional.
 

package/docs/publishing.md

@@ -23,6 +23,10 @@ Example warning when an explicit tag is unpublishable:
 Skipping basic-v1.0.0 (packages/basic): package.json#private is true.
 ```
 
+### Tarball check
+
+Before it publishes any package, and in a dry run as well, `publish` packs every publishable package from a clean checkout of HEAD and refuses when a tarball lacks a file that its manifest names. It is the same check that `prepare` runs; see [Packages whose tarball would lack a manifest file](releasing.md#packages-whose-tarball-would-lack-a-manifest-file).
+
 ## `release-kit create-github-release`
 
 Creates GitHub Releases from `changelog.json` for tags on HEAD. Independent of `npm publish`: Invoking this command creates Releases for publishable packages whether or not they were published to a registry. Private workspaces are skipped, and a project tag gets a Release (see [Publishability filter](#publishability-filter)).

package/docs/releasing.md

@@ -63,6 +63,12 @@ release-kit prepare --bump=minor
 
 Before it writes any file, and in a dry run as well, `prepare` asks npm about each publishable package that the release includes, querying the registry that the package's `publishConfig.registry` names when it sets one. OIDC trusted publishing can't publish a package's first version, so `prepare` refuses to release a package that npm doesn't list, and names each one with its fix: Run `npm publish --access public` from the package's directory once, then register the package as a trusted publisher. The `npm-auto-publish` [readiness kit](readiness-checks.md) prints the `npm trust` command. `prepare` also refuses when it can't look a package up, such as when the registry is unreachable, and reports npm's error for that package.
 
+### Packages whose tarball would lack a manifest file
+
+Before it writes any file, and in a dry run as well, `prepare` packs each publishable package that the release includes as the publish workflow would: It clones HEAD into a temporary directory, runs the package manager's frozen install there, runs the package's `prepublishOnly` script when it declares one, and packs the package. Build output in the working tree therefore does not count, and the check adds the time of one install and one build to every release. `prepare` refuses the release when a tarball lacks a file named by the package's `main`, `types`, `bin`, or `exports`, and names each package with each missing path and the manifest field that names it. The usual fix is to build the files in the package's publish lifecycle, such as in a `prepack` script. A failed install or build in the clean checkout also refuses the release, with the failing step's output.
+
+A target under the `source` export condition is exempt, and so is a target under a condition listed in [`devExportConditions`](configuration.md#releasekitconfig-reference), which declares the conditions that resolve only inside the repo. [`publish`](publishing.md#tarball-check) runs the same check before it publishes any package.
+
 ### Previewing release notes with `--with-release-notes`
 
 `--with-release-notes` writes two versioned files per workspace after each workspace's `changelog.json` is produced:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/release-kit",
-  "version": "16.0.0",
+  "version": "16.1.0",
   "description": "Version-bumping and changelog-generation toolkit for release workflows",
   "keywords": [
     "changelog",
@@ -63,7 +63,7 @@
     "@types/semver": "7.8.0",
     "@williamthorsen/toolbelt.filesystem": "0.10.0",
     "@williamthorsen/toolbelt.testing": "0.8.0",
-    "@williamthorsen/toolbelt.vitest": "0.13.0",
+    "@williamthorsen/toolbelt.vitest": "0.13.1",
     "actionlint": "2.0.6",
     "esbuild": "0.28.2",
     "readyup": "0.44.0",

package/presets/labels/common.yaml

@@ -9,6 +9,9 @@
 - name: bug
   color: d73a4a
   description: "Something isn't working"
+- name: content
+  color: 0e8a16
+  description: Consumer-facing material, such as copy, images, or displayed data, rather than functionality
 - name: operational
   color: '000000'
   description: Actions outside the codebase