@williamthorsen/release-kit 5.3.0 → 5.3.2

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## 5.3.2 — 2026-06-16
+
+### ♻️ Refactoring
+
+- Migrate from js-yaml to yaml (#410)
+
+  Replaces the `js-yaml` dependency with the `yaml` package for all YAML reading and writing, with no change to behavior or generated output. The swap trims the dependency footprint by dropping a direct dependency and its companion type-definitions package, since `yaml` ships its own types.
+
+## 5.3.1 — 2026-05-19
+
+### 🐛 Bug fixes
+
+- Validate overrides against the full release history (#401)
+
+  Fixes an issue where `release-kit overrides validate` reported overrides as stale when they targeted commits in past releases, even though `release-kit prepare` correctly matched them. The two commands now agree on which overrides are stale.
+
+### ♻️ Refactoring
+
+- Restructure tests and align core package directory with package name (#405)
+
+  Tests in every package are now typechecked alongside the code they cover, so type breakage in tests fails the build instead of slipping through. The `core` package's workspace directory is renamed to match its package name, so `nmr -F nmr-core ...` and `pnpm --filter nmr-core ...` now resolve where they previously failed.
+
 ## 5.3.0 — 2026-05-10
 
 ### 🎉 Features
@@ -435,6 +457,7 @@ All notable changes to this project will be documented in this file.
 - Cover multi-changelogPaths and error paths (#44)
 
   Add three tests for previously untested code paths:
+
   - `releasePrepareMono`: component with two `changelogPaths` entries, asserting `git-cliff` is invoked once per path with the correct `--output` target.
   - `getCommitsSinceTarget`: `git describe` failure with a non-128 exit status propagates as a wrapped error instead of being swallowed.
   - `getCommitsSinceTarget`: `git log` failure is wrapped and re-thrown with the commit range in the message.
@@ -451,6 +474,10 @@ All notable changes to this project will be documented in this file.
 
 ### 🎉 Features
 
+- Migrate release-kit from toolbelt (#18)
+
+  Migrates the complete `@williamthorsen/release-kit` package (v1.0.1) from `williamthorsen/toolbelt` into `packages/release-kit/`, adds shebang preservation to the shared esbuild plugin for CLI binaries, and sets up dogfooding infrastructure so this monorepo uses release-kit for its own releases.
+
 - 🚨 **Breaking:** Slim down release workflow by removing unnecessary pnpm install (#21)
 
   Make release-kit self-contained by invoking git-cliff via `npx --yes` instead of requiring it on PATH, and by appending modified file paths to the format command so lightweight formatters like `npx prettier --write` work without a full `pnpm install`. Update init templates, README, and consuming repo config/workflow to reference workflow v3.

package/README.md

@@ -4,43 +4,7 @@ Version-bumping and changelog-generation toolkit for release workflows.
 
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from `git-cliff --context` output rendered in-process (with optional [editorial overrides](#editorial-overrides)).
 
-<!-- section:release-notes -->
-## Release notes — v5.3.0 (2026-05-10)
-
-### 🎉 Features
-
-- Enable editorial overrides for changelog entries (#387)
-
-  Allows `release-kit` consumers to skip or correct historical changelog entries by means of an overrides file.
-
-- Decentralize changelog overrides to per-scope .meta/ files (#391)
-
-  Adds support for workspace-scoped editorial-override files for `release-kit`-generated changelogs. A repo-root file applies overrides to every workspace's changelog; a workspace-tier file applies only to that workspace.
-
-- Add section markers and authenticated upstream fetch (#393)
-
-  A new `markers` block in `work-types.json` describes the breaking-changes emoji and label, making them available for use by consumers.
-
-  `work-types check` and `work-types sync` now authenticate when `GITHUB_TOKEN` is set, so they can reach private upstream repositories.
-
-- Validate changelog overrides from the command line (#395)
-
-  Adds a `release-kit overrides validate` subcommand that audits every `.meta/changelog-overrides.json` file across the project root and per-workspace scopes in one pass. The command reports schema errors, ambiguous-prefix collisions, and stale-key warnings with tiered exit codes so CI can choose its own failure threshold. The same validation is also available via a library function exported by the package.
-
-### 🐛 Bug fixes
-
-- Suppress git-cliff stale-version warnings on prepare (#373)
-
-  Fixes an issue where `release-kit prepare` repeatedly printed git-cliff's "A new version of git-cliff is available" notice — twice per release unit, so 2 × N times for an N-package monorepo run — while never updating the locally cached git-cliff binary. Each `prepare` run now revalidates the npm cache once before any cliff work, so the binary stays current with upstream releases and the notice no longer surfaces on every per-workspace invocation.
-
-- Use synthetic changelogs for forced empty-range releases (#376)
-
-  Fixes an issue where `release-kit prepare` with `--force`, `--bump=X`, or `--set-version` would invoke git-cliff against units that had no commits since their last tag, surfacing confusing `WARN  git_cliff > There is already a tag (...)` lines (twice per affected unit) and silently leaving `CHANGELOG.md` and `.meta/changelog.json` stale. Empty-range bumps now write a synthetic `Notes / Forced version bump.` entry to both files instead of invoking git-cliff. Applies to all three release stages: single-package, per-workspace, and project. Prior changelog history is preserved on every path.
-
-- Accept `breakingPolicies` field in config files (#394)
-
-  Fixes an issue where setting `breakingPolicies` in `release-kit.config.ts` was rejected as an unknown field, leaving per-work-type breaking-policy configuration unreachable from the config file. Each entry accepts `'forbidden'`, `'optional'`, or `'required'`; an empty object opts out of enforcement.
-<!-- /section:release-notes -->
+<!-- section:release-notes --><!-- /section:release-notes -->
 
 ## Installation
 
@@ -495,7 +459,7 @@ The override file is validated when `release-kit prepare` loads it. Each error n
 
 #### Standalone validation: `release-kit overrides validate`
 
-For a fast overrides-only health check (locally or as a CI gate), run:
+For a focused overrides-only health check (locally or as a CI gate), run:
 
 ```sh
 pnpm exec release-kit overrides validate

package/dist/esm/.cache

@@ -1 +1 @@
-18bd566d86a692ebdc23649a475e7d5e01562a58df99b6091e222e890cef8f80
+a675735fcc8ee6abbe7201c05a9cec6517a6495d796f61322b141ed79e4e7bcf

package/dist/esm/discoverWorkspaces.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { glob } from "glob";
-import { load } from "js-yaml";
+import { parse } from "yaml";
 import { isRecord } from "./typeGuards.js";
 async function discoverWorkspaces() {
   const workspaceFile = "pnpm-workspace.yaml";
@@ -15,7 +15,7 @@ async function discoverWorkspaces() {
     console.warn(`Warning: Failed to read ${workspaceFile}: ${error instanceof Error ? error.message : String(error)}`);
     return void 0;
   }
-  const parsed = load(content);
+  const parsed = parse(content);
   if (!isRecord(parsed)) {
     return void 0;
   }

package/dist/esm/generateChangelogs.d.ts

@@ -1,4 +1,6 @@
+import type { WorkspaceConfig } from './types.ts';
 export declare function buildTagPattern(tagPrefixes: readonly string[]): string;
+export declare function getAllTagPrefixes(workspace: WorkspaceConfig): string[];
 export interface GenerateChangelogOptions {
     tagPattern?: string;
     includePaths?: string[];

package/dist/esm/generateChangelogs.js

@@ -9,9 +9,13 @@ function buildTagPattern(tagPrefixes) {
   const escaped = tagPrefixes.map(escapeRegex);
   return `(${escaped.join("|")})[0-9].*`;
 }
+function getAllTagPrefixes(workspace) {
+  return [workspace.tagPrefix, ...workspace.legacyIdentities?.map((identity) => identity.tagPrefix) ?? []];
+}
 function escapeRegex(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
 }
 export {
-  buildTagPattern
+  buildTagPattern,
+  getAllTagPrefixes
 };

package/dist/esm/releasePrepareMono.js

@@ -19,7 +19,7 @@ import { isForwardVersion } from "./compareVersions.js";
 import { decideRelease } from "./decideRelease.js";
 import { DEFAULT_BREAKING_POLICIES, DEFAULT_VERSION_PATTERNS, DEFAULT_WORK_TYPES } from "./defaults.js";
 import { detectUndeclaredTagPrefixes } from "./detectUndeclaredTagPrefixes.js";
-import { buildTagPattern } from "./generateChangelogs.js";
+import { buildTagPattern, getAllTagPrefixes } from "./generateChangelogs.js";
 import { getCommitsSinceTarget } from "./getCommitsSinceTarget.js";
 import { hasPrettierConfig } from "./hasPrettierConfig.js";
 import { resolveWorkTypes } from "./loadConfig.js";
@@ -550,9 +550,6 @@ function topologicalSort(releaseSet, graph) {
   }
   return { sorted, cyclicDirs };
 }
-function getAllTagPrefixes(workspace) {
-  return [workspace.tagPrefix, ...workspace.legacyIdentities?.map((identity) => identity.tagPrefix) ?? []];
-}
 export {
   releasePrepareMono
 };

package/dist/esm/sync-labels/generateCommand.js

@@ -1,6 +1,6 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
-import { dump } from "js-yaml";
+import { stringify } from "yaml";
 import { loadSyncLabelsConfig, SYNC_LABELS_CONFIG_PATH } from "./loadSyncLabelsConfig.js";
 import { hashPresetFile } from "./presets.js";
 import { resolveLabels } from "./resolveLabels.js";
@@ -10,7 +10,7 @@ function formatLabelsYaml(labels, presetHashes) {
   for (const [name, hash] of [...presetHashes.entries()].sort(([a], [b]) => a.localeCompare(b))) {
     headerLines.push(`# ${name} preset hash: ${hash}`);
   }
-  const yamlBody = dump(labels, { quotingType: "'", forceQuotes: false, lineWidth: -1 });
+  const yamlBody = stringify(labels, { singleQuote: true, lineWidth: 0 });
   return headerLines.join("\n") + "\n" + yamlBody;
 }
 async function generateCommand() {

package/dist/esm/sync-labels/presets.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { findPackageRoot } from "@williamthorsen/nmr-core";
-import { load } from "js-yaml";
+import { parse } from "yaml";
 import { isRecord } from "../typeGuards.js";
 function resolvePresetPath(presetName) {
   const root = findPackageRoot(import.meta.url);
@@ -28,7 +28,7 @@ function loadPreset(presetName) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Failed to read preset "${presetName}": ${message}`);
   }
-  const parsed = load(content);
+  const parsed = parse(content);
   if (!Array.isArray(parsed)) {
     throw new TypeError(`Preset "${presetName}" must be a YAML array of label definitions`);
   }

package/dist/esm/validateOverridesCommand.d.ts

@@ -1,4 +1,5 @@
 import { type ValidateAllChangelogOverridesInputs, type ValidateAllChangelogOverridesResult } from './changelogOverrides.ts';
+import type { ChangelogEntry, ReleaseConfig } from './types.ts';
 export interface ValidateOverridesCommandResult {
     exitCode: 0 | 1 | 2;
     message: string;
@@ -6,7 +7,7 @@ export interface ValidateOverridesCommandResult {
 export interface ValidateOverridesCommandDependencies {
     discoverWorkspaces?: () => Promise<string[] | undefined>;
     loadConfig?: () => Promise<unknown>;
-    collectHashes?: (tagPrefixes: readonly string[], paths?: string[]) => readonly string[];
+    buildEntries?: (config: Pick<ReleaseConfig, 'cliffConfigPath' | 'changelogJson'>, tagPattern?: string, includePaths?: string[]) => ChangelogEntry[];
     validate?: (inputs: ValidateAllChangelogOverridesInputs) => ValidateAllChangelogOverridesResult;
 }
 export declare function validateOverridesCommand(dependencies?: ValidateOverridesCommandDependencies): Promise<ValidateOverridesCommandResult>;

package/dist/esm/validateOverridesCommand.js

@@ -1,15 +1,17 @@
+import { buildChangelogEntries } from "./buildChangelogEntries.js";
 import {
   resolveOverridePath,
   validateAllChangelogOverrides
 } from "./changelogOverrides.js";
 import { discoverWorkspaces } from "./discoverWorkspaces.js";
-import { getCommitsSinceTarget } from "./getCommitsSinceTarget.js";
+import { buildTagPattern, getAllTagPrefixes } from "./generateChangelogs.js";
 import { loadConfig, mergeMonorepoConfig, mergeSinglePackageConfig, readRootPackageVersion } from "./loadConfig.js";
 import { validateConfig } from "./validateConfig.js";
+const SYNTHETIC_VALIDATE_TAG = "validate-only";
 async function validateOverridesCommand(dependencies = {}) {
   const discover = dependencies.discoverWorkspaces ?? discoverWorkspaces;
   const load = dependencies.loadConfig ?? loadConfig;
-  const collect = dependencies.collectHashes ?? defaultCollectHashes;
+  const buildEntries = dependencies.buildEntries ?? defaultBuildEntries;
   const validate = dependencies.validate ?? validateAllChangelogOverrides;
   let userConfig;
   try {
@@ -25,7 +27,7 @@ async function validateOverridesCommand(dependencies = {}) {
   }
   let inputs;
   try {
-    inputs = discoveredPaths === void 0 ? buildSinglePackageInputs(userConfig, collect) : buildMonorepoInputs(discoveredPaths, userConfig, collect);
+    inputs = discoveredPaths === void 0 ? buildSinglePackageInputs(userConfig, buildEntries) : buildMonorepoInputs(discoveredPaths, userConfig, buildEntries);
   } catch (error) {
     return { exitCode: 2, message: `Error resolving overrides scope: ${errorMessage(error)}` };
   }
@@ -60,11 +62,28 @@ function pluralize(count, noun) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function defaultCollectHashes(tagPrefixes, paths) {
-  if (tagPrefixes.length === 0) {
-    return [];
+function defaultBuildEntries(config, tagPattern, includePaths) {
+  const options = {};
+  if (tagPattern !== void 0) {
+    options.tagPattern = tagPattern;
   }
-  return getCommitsSinceTarget(tagPrefixes, paths).commits.map((commit) => commit.hash);
+  if (includePaths !== void 0) {
+    options.includePaths = includePaths;
+  }
+  return buildChangelogEntries(config, SYNTHETIC_VALIDATE_TAG, options);
+}
+function flattenEntriesToHashes(entries) {
+  const hashes = [];
+  for (const entry of entries) {
+    for (const section of entry.sections) {
+      for (const item of section.items) {
+        if (item.hash !== void 0) {
+          hashes.push(item.hash);
+        }
+      }
+    }
+  }
+  return hashes;
 }
 async function loadAndValidateConfig(load) {
   let rawConfig;
@@ -83,24 +102,21 @@ async function loadAndValidateConfig(load) {
   }
   return config;
 }
-function buildSinglePackageInputs(userConfig, collect) {
+function buildSinglePackageInputs(userConfig, buildEntries) {
   const config = mergeSinglePackageConfig(userConfig);
-  const hashes = [...collect([config.tagPrefix])];
+  const hashes = flattenEntriesToHashes(buildEntries(config));
   return {
     project: { filePath: resolveOverridePath("."), hashes }
   };
 }
-function buildMonorepoInputs(discoveredPaths, userConfig, collect) {
+function buildMonorepoInputs(discoveredPaths, userConfig, buildEntries) {
   const rootPackage = readRootPackageVersion();
   const config = mergeMonorepoConfig(discoveredPaths, userConfig, rootPackage);
   const workspaces = config.workspaces.map((workspace) => {
-    const tagPrefixes = [
-      workspace.tagPrefix,
-      ...workspace.legacyIdentities?.map((identity) => identity.tagPrefix) ?? []
-    ];
+    const tagPattern = buildTagPattern(getAllTagPrefixes(workspace));
     return {
       filePath: resolveOverridePath(workspace.workspacePath),
-      hashes: [...collect(tagPrefixes, workspace.paths)]
+      hashes: flattenEntriesToHashes(buildEntries(config, tagPattern, workspace.paths))
     };
   });
   const project = config.project;
@@ -109,7 +125,8 @@ function buildMonorepoInputs(discoveredPaths, userConfig, collect) {
   };
   if (project !== void 0) {
     const contributingPaths = config.workspaces.flatMap((workspace) => workspace.paths);
-    projectScope.hashes = [...collect([project.tagPrefix], contributingPaths)];
+    const projectTagPattern = buildTagPattern([project.tagPrefix]);
+    projectScope.hashes = flattenEntriesToHashes(buildEntries(config, projectTagPattern, contributingPaths));
   }
   return { project: projectScope, workspaces };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/release-kit",
-  "version": "5.3.0",
+  "version": "5.3.2",
   "description": "Version-bumping and changelog-generation toolkit for release workflows",
   "keywords": [],
   "homepage": "https://github.com/williamthorsen/node-monorepo-tools/tree/main/packages/release-kit#readme",
@@ -34,14 +34,13 @@
   "dependencies": {
     "glob": "13.0.6",
     "jiti": "2.7.0",
-    "js-yaml": "4.1.1",
     "json-stringify-pretty-compact": "4.0.0",
-    "semver": "7.8.0",
+    "semver": "7.8.4",
+    "yaml": "2.9.0",
     "zod": "4.4.3",
-    "@williamthorsen/nmr-core": "0.3.1"
+    "@williamthorsen/nmr-core": "0.3.2"
   },
   "devDependencies": {
-    "@types/js-yaml": "4.0.9",
     "@types/semver": "7.7.1",
     "smol-toml": "1.6.1"
   },