@wpelevator/wp-release 0.9.0 → 0.11.0

package/dist/changeset-dependents.d.ts

@@ -0,0 +1,132 @@
+import type { ChangesetConfig, DependentsConfig } from './changeset-config.ts';
+import type { ChangedPackages, ConfiguredPackage } from './changeset-packages.ts';
+import type { Changeset, ChangesetPackage, ChangesetReleasePlan, PackageRelease } from './changesets.ts';
+import type { FileJournal } from './file-journal.ts';
+/**
+ * A declared dependency of a package on another configured package.
+ */
+export interface DependencySpec {
+    /** Absolute path of the manifest that declares the dependency. */
+    file: string;
+    /** Dependency name in the manifest, like the npm package name. */
+    name: string;
+    /** Declared spec, like ^1.2.0 or workspace:*. */
+    spec: string;
+}
+/**
+ * Add releases for dependents of packages that release, applying the
+ * configured dependents policy until the plan settles.
+ *
+ * @param releases Planned releases, mutated in place.
+ * @param packages Discovered packages.
+ * @param config   Repository release configuration.
+ */
+export declare function applyDependents(releases: PackageRelease[], packages: ConfiguredPackage[], config: ChangesetConfig): Promise<void>;
+/**
+ * Limit a release plan to some packages and the changesets that name them.
+ *
+ * @param  plan           Release plan of all pending changesets.
+ * @param  packages       Configured packages.
+ * @param  names          Packages to version.
+ * @param  config         Repository release configuration.
+ * @param  withDependents Whether the selection also releases the dependents of the selected sources.
+ * @return Release plan of the selected packages and their dependents.
+ * @throws {ValidationError} For unknown packages.
+ */
+export declare function selectReleasePlan(plan: ChangesetReleasePlan, packages: ConfiguredPackage[], names: string[], config: ChangesetConfig, withDependents?: boolean): Promise<ChangesetReleasePlan>;
+/**
+ * Drop bundle sources that aren't released by the selected plan.
+ *
+ * @param plan Selected release plan.
+ * @return Release plan with dependents bundling only its released sources.
+ */
+export declare function expandDependentsPlan(plan: ChangesetReleasePlan): ChangesetReleasePlan;
+/**
+ * Remove the derived dependent releases of a plan, keeping only the releases
+ * of packages that have their own changesets.
+ *
+ * @param plan Release plan of all pending changesets.
+ * @return Release plan without derived dependent releases.
+ */
+export declare function stripDependentsPlan(plan: ChangesetReleasePlan): ChangesetReleasePlan;
+/**
+ * Fail when a planned release bundles a source package that has pending
+ * changesets released by a later run, so that no dependent ships unreleased
+ * code under a changelog that cannot credit it.
+ *
+ * @param  plan     Planned releases.
+ * @param  fullPlan Release plan of all pending changesets.
+ * @param  packages Discovered packages.
+ * @param  config   Repository release configuration.
+ * @throws {ValidationError} If a source of a planned release stays pending.
+ */
+export declare function assertDependentsSourcesReleased(plan: ChangesetReleasePlan, fullPlan: ChangesetReleasePlan, packages: ConfiguredPackage[], config: ChangesetConfig): Promise<void>;
+/**
+ * Find the changed packages that need no changeset of their own, because the
+ * dependents policy releases them with their sources. A dependent releases
+ * with its sources, which the release pull request already announces when
+ * the changesets of the diff release one of them. Exempting its package
+ * manifest pin change keeps the check from demanding an entry for what
+ * versioning rewrites anyway; documentation and code changes still need
+ * their own changesets.
+ *
+ * @param changed          Changed packages and their files.
+ * @param changesetsInDiff Changesets added or changed by the diff.
+ * @param packages         Discovered packages.
+ * @param config           Repository release configuration.
+ * @return Names of the packages whose only changes are manifests of released dependents.
+ */
+export declare function findBundledPinChanges(changed: ChangedPackages, changesetsInDiff: Changeset[], packages: ConfiguredPackage[], config: ChangesetConfig): Promise<Set<string>>;
+/**
+ * Check whether a changeset names a package.
+ *
+ * @param changesets Changesets.
+ * @param name       Package name.
+ * @return Whether one of the changesets names the package.
+ */
+export declare function hasChangeset(changesets: Changeset[], name: string): boolean;
+/**
+ * Update how a dependent declares its dependency on a released source, with
+ * the configured hook or the built-in spec rewrite.
+ *
+ * @param input           Dependent, source, released version, policy and journal.
+ * @param input.dependent The released dependent package.
+ * @param input.source    Released source package that the dependent bundles.
+ * @param input.version   Released version of the source.
+ * @param input.rule      Dependents policy with its sections and dependency hooks.
+ * @param input.journal   File journal for rolling back.
+ */
+export declare function updateDependencyDeclaration(input: {
+    dependent: ChangesetPackage;
+    source: ChangesetPackage;
+    version: string;
+    rule?: DependentsConfig;
+    journal: FileJournal;
+}): Promise<void>;
+/**
+ * Update a dependency spec to the released version, keeping its shape, like
+ * the caret of ^0.9.0 or the x of 0.9.x.
+ *
+ * @param spec    Declared spec of the source.
+ * @param version Released version of the source.
+ * @return The updated spec, undefined when nothing has to change, like a wildcard or a workspace spec, or null when the spec can't be rewritten.
+ */
+export declare function updatedSpec(spec: string, version: string): string | null | undefined;
+/**
+ * Warn about declared pins of configured packages that don't resolve the
+ * current version of the package they name.
+ *
+ * @param config   Repository release configuration.
+ * @param packages Discovered packages.
+ * @return Warnings, one per package pair.
+ */
+export declare function collectPinDriftWarnings(config: ChangesetConfig, packages: ConfiguredPackage[]): Promise<string[]>;
+/**
+ * Check whether a spec points at the workspace copy of a package, by
+ * resolving the current version through its range or its workspace protocol.
+ *
+ * @param spec           Declared spec of the source.
+ * @param currentVersion Current version of the source package.
+ * @return Whether the spec is a dependency of the source.
+ */
+export declare function isDependencyOfSource(spec: string, currentVersion: string): boolean;

package/dist/changeset-dependents.js

@@ -0,0 +1,540 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import semverSatisfies from 'semver/functions/satisfies.js';
+import validRange from 'semver/ranges/valid.js';
+import { assertKnownPackages, globRegExp } from "./changeset-packages.js";
+import { getNextVersion } from "./changesets.js";
+import { ValidationError } from "./errors.js";
+import { readJsonIfExists } from "./json-files.js";
+import { escapeRegExp } from "./regexp.js";
+/** npm dependency sections whose declared dependency re-releases the dependent. */
+const DEFAULT_SECTIONS = ['dependencies', 'optionalDependencies'];
+/**
+ * Add releases for dependents of packages that release, applying the
+ * configured dependents policy until the plan settles.
+ *
+ * @param releases Planned releases, mutated in place.
+ * @param packages Discovered packages.
+ * @param config   Repository release configuration.
+ */
+export async function applyDependents(releases, packages, config) {
+    const rule = config.dependents;
+    if (!rule) {
+        return;
+    }
+    // Dependents may themselves be dependents of other sources, so expand until stable.
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const source of [...releases]) {
+            for (const dependent of packages) {
+                if (await deriveDependentRelease(source, dependent, releases, rule)) {
+                    grew = true;
+                }
+            }
+        }
+    }
+}
+/**
+ * Plan the release of a package that bundles a source package, or add the
+ * source to the bundle list of its own pending release.
+ *
+ * @param source    Package release of the source.
+ * @param dependent Package that would bundle the source.
+ * @param releases  Planned releases, mutated in place.
+ * @param rule      Dependents policy.
+ * @return Whether a new dependent release was planned.
+ */
+async function deriveDependentRelease(source, dependent, releases, rule) {
+    if (dependent.name === source.package.name ||
+        isExcludedDependent(dependent, rule)) {
+        return false;
+    }
+    const specs = await findDependencySpecs(dependent, source.package, rule);
+    if (!specs.length || !dependentNeedsRelease(specs, source, rule)) {
+        return false;
+    }
+    const release = releases.find((item) => item.package.name === dependent.name);
+    if (release) {
+        const sources = release.sources ?? [];
+        if (!sources.includes(source.package.name)) {
+            // A dependent that releases for its own reasons still notes the bundle.
+            release.sources = [...sources, source.package.name];
+        }
+        return false;
+    }
+    const bump = rule.bump ?? 'patch';
+    releases.push({
+        package: dependent,
+        bump,
+        currentVersion: dependent.currentVersion,
+        nextVersion: getNextVersion(dependent.currentVersion, bump),
+        changesets: [],
+        sources: [source.package.name],
+    });
+    return true;
+}
+/**
+ * Limit a release plan to some packages and the changesets that name them.
+ *
+ * @param  plan           Release plan of all pending changesets.
+ * @param  packages       Configured packages.
+ * @param  names          Packages to version.
+ * @param  config         Repository release configuration.
+ * @param  withDependents Whether the selection also releases the dependents of the selected sources.
+ * @return Release plan of the selected packages and their dependents.
+ * @throws {ValidationError} For unknown packages.
+ */
+export async function selectReleasePlan(plan, packages, names, config, withDependents = true) {
+    assertKnownPackages(packages, names);
+    // Dependents that need a release close over the selected sources.
+    const selected = new Set(names);
+    let grew = true;
+    // Dependents may depend on other selected dependents, so expand until stable.
+    while (grew && withDependents && config.dependents) {
+        grew = false;
+        const selectedSources = plan.releases.filter((release) => selected.has(release.package.name));
+        for (const source of selectedSources) {
+            for (const dependent of packages) {
+                if (await selectDependentRelease(source, dependent, packages, config.dependents, selected)) {
+                    grew = true;
+                }
+            }
+        }
+    }
+    const selectedNames = [...selected];
+    return {
+        releases: plan.releases.filter((release) => {
+            if (!selected.has(release.package.name)) {
+                return false;
+            }
+            // Explicitly selected dependents without their own changesets only
+            // release when their source releases in the same selection.
+            return (release.changesets.length > 0 ||
+                (release.sources ?? []).some((name) => selected.has(name)));
+        }),
+        changesets: plan.changesets.filter((changeset) => selectedNames.some((name) => Object.hasOwn(changeset.packages, name))),
+    };
+}
+/**
+ * Add a package to the selected release plan when it bundles a selected source.
+ *
+ * @param source    Selected package release.
+ * @param dependent Package that would bundle the source.
+ * @param packages  Discovered packages.
+ * @param rule      Dependents policy.
+ * @param selected  Selected package names, mutated in place.
+ * @return Whether the package was selected.
+ */
+async function selectDependentRelease(source, dependent, packages, rule, selected) {
+    const skip = selected.has(dependent.name) ||
+        dependent.name === source.package.name ||
+        isExcludedDependent(dependent, rule);
+    if (skip) {
+        return false;
+    }
+    const specs = await findDependencySpecs(dependent, source.package, rule);
+    if (!specs.length || !dependentNeedsRelease(specs, source, rule)) {
+        return false;
+    }
+    selected.add(dependent.name);
+    return true;
+}
+/**
+ * Drop bundle sources that aren't released by the selected plan.
+ *
+ * @param plan Selected release plan.
+ * @return Release plan with dependents bundling only its released sources.
+ */
+export function expandDependentsPlan(plan) {
+    const released = new Set(plan.releases.map((release) => release.package.name));
+    plan.releases.forEach((release) => {
+        if (release.sources) {
+            release.sources = release.sources.filter((name) => released.has(name));
+            if (!release.sources.length) {
+                delete release.sources;
+            }
+        }
+    });
+    return plan;
+}
+/**
+ * Remove the derived dependent releases of a plan, keeping only the releases
+ * of packages that have their own changesets.
+ *
+ * @param plan Release plan of all pending changesets.
+ * @return Release plan without derived dependent releases.
+ */
+export function stripDependentsPlan(plan) {
+    return {
+        ...plan,
+        releases: plan.releases
+            .filter((release) => release.changesets.length > 0)
+            .map(({ sources, ...release }) => release),
+    };
+}
+/**
+ * Fail when a planned release bundles a source package that has pending
+ * changesets released by a later run, so that no dependent ships unreleased
+ * code under a changelog that cannot credit it.
+ *
+ * @param  plan     Planned releases.
+ * @param  fullPlan Release plan of all pending changesets.
+ * @param  packages Discovered packages.
+ * @param  config   Repository release configuration.
+ * @throws {ValidationError} If a source of a planned release stays pending.
+ */
+export async function assertDependentsSourcesReleased(plan, fullPlan, packages, config) {
+    const releasing = new Set(plan.releases.map((release) => release.package.name));
+    const pending = new Set(fullPlan.releases.map((release) => release.package.name));
+    for (const release of plan.releases) {
+        // Dependencies built into the dependent, like bundled or vendored
+        // directories, stay out of the check, which only guards released
+        // packages that the dependent declares.
+        const names = await collectDependencyNames(release.package, packages, config);
+        for (const name of names) {
+            const blocked = pending.has(name) &&
+                !releasing.has(name) &&
+                name !== release.package.name;
+            if (blocked) {
+                throw new ValidationError(`Cannot release package "${release.package.name}" while its source "${name}" has pending changesets; release them together or pass --no-dependents.`);
+            }
+        }
+    }
+}
+/**
+ * Find the changed packages that need no changeset of their own, because the
+ * dependents policy releases them with their sources. A dependent releases
+ * with its sources, which the release pull request already announces when
+ * the changesets of the diff release one of them. Exempting its package
+ * manifest pin change keeps the check from demanding an entry for what
+ * versioning rewrites anyway; documentation and code changes still need
+ * their own changesets.
+ *
+ * @param changed          Changed packages and their files.
+ * @param changesetsInDiff Changesets added or changed by the diff.
+ * @param packages         Discovered packages.
+ * @param config           Repository release configuration.
+ * @return Names of the packages whose only changes are manifests of released dependents.
+ */
+export async function findBundledPinChanges(changed, changesetsInDiff, packages, config) {
+    const candidates = changed.packages.filter((pkg) => undefined !== config.dependents &&
+        !hasChangeset(changesetsInDiff, pkg.name) &&
+        (changed.filesByPackage[pkg.name] ?? []).every((file) => 'package.json' === path.basename(file)));
+    const bundled = await Promise.all(candidates.map(async (pkg) => {
+        const sources = await collectDeclarationNames(pkg, packages, config);
+        return sources.some((source) => hasChangeset(changesetsInDiff, source))
+            ? pkg.name
+            : undefined;
+    }));
+    return new Set(bundled.filter((name) => undefined !== name));
+}
+/**
+ * Check whether a changeset names a package.
+ *
+ * @param changesets Changesets.
+ * @param name       Package name.
+ * @return Whether one of the changesets names the package.
+ */
+export function hasChangeset(changesets, name) {
+    return changesets.some((changeset) => Object.hasOwn(changeset.packages, name));
+}
+/**
+ * Collect the names of the configured sources that a package declares, by the
+ * dependency sections of the policy, without resolving the specs against the
+ * versions. The changeset check uses this to see through a pin that the
+ * versioning will rewrite after the source releases.
+ *
+ * @param pkg      Planned package.
+ * @param packages Discovered packages.
+ * @param config   Repository release configuration.
+ * @return Release package names the package declares.
+ */
+async function collectDeclarationNames(pkg, packages, config) {
+    const names = [];
+    for (const source of packages) {
+        if (pkg.name !== source.name &&
+            (await findNpmSpecs(pkg, source, dependentsSections(config.dependents))).length > 0) {
+            names.push(source.name);
+        }
+    }
+    return names;
+}
+/**
+ * Collect the names of the configured sources that a package builds against,
+ * through specs that resolve the current version or point at the workspace.
+ *
+ * @param pkg      Planned package.
+ * @param packages Discovered packages.
+ * @param config   Repository release configuration.
+ * @return Release package names the package declares.
+ */
+async function collectDependencyNames(pkg, packages, config) {
+    const names = [];
+    for (const source of packages) {
+        if (pkg.name !== source.name &&
+            (await findDependencySpecs(pkg, source, config.dependents))
+                .length > 0) {
+            names.push(source.name);
+        }
+    }
+    return names;
+}
+/**
+ * Update how a dependent declares its dependency on a released source, with
+ * the configured hook or the built-in spec rewrite.
+ *
+ * @param input           Dependent, source, released version, policy and journal.
+ * @param input.dependent The released dependent package.
+ * @param input.source    Released source package that the dependent bundles.
+ * @param input.version   Released version of the source.
+ * @param input.rule      Dependents policy with its sections and dependency hooks.
+ * @param input.journal   File journal for rolling back.
+ */
+export async function updateDependencyDeclaration(input) {
+    const { dependent, source, version, rule, journal } = input;
+    const specs = await findDependencySpecs(dependent, source, rule);
+    const update = rule?.dependency?.update;
+    if (update) {
+        await update({
+            package: dependent,
+            source,
+            version,
+            specs,
+            remember: (file) => journal.remember(file),
+        });
+        return;
+    }
+    for (const { file, name, spec } of specs) {
+        const nextSpec = updatedSpec(spec, version);
+        if (null === nextSpec &&
+            isOutOfRange(version, spec, source.currentVersion)) {
+            throw new ValidationError(`Cannot rewrite the dependency spec "${spec}" of "${name}" in ${dependent.name}'s ${file}; declare a range or pin that versioning rewrites, like "^${version}".`);
+        }
+        const changed = undefined !== nextSpec && nextSpec !== spec;
+        if (changed) {
+            const contents = await readFile(file, 'utf8');
+            const declared = new RegExp(`"${escapeRegExp(name)}"\\s*:\\s*"${escapeRegExp(spec)}"`);
+            if (!declared.test(contents)) {
+                throw new ValidationError(`The dependency spec of "${name}" in ${dependent.name}'s ${file} doesn't match "${spec}"; rewrite it to "${nextSpec}".`);
+            }
+            await journal.remember(file);
+            await writeFile(file, contents.replace(declared, `"${name}": "${nextSpec}"`));
+        }
+    }
+}
+/**
+ * Update a dependency spec to the released version, keeping its shape, like
+ * the caret of ^0.9.0 or the x of 0.9.x.
+ *
+ * @param spec    Declared spec of the source.
+ * @param version Released version of the source.
+ * @return The updated spec, undefined when nothing has to change, like a wildcard or a workspace spec, or null when the spec can't be rewritten.
+ */
+export function updatedSpec(spec, version) {
+    if (spec.startsWith('workspace:')) {
+        // Workspace specs resolve to the local package, so the manifest
+        // keeps them instead of a published version.
+        return undefined;
+    }
+    const prefix = /^[=\^~]/.exec(spec)?.[0] ?? '';
+    const bare = spec.slice(prefix.length).trim();
+    const partial = /^(v?\d+(?:\.\d+)*)(\.x)?$/.exec(bare);
+    if (partial?.[1]) {
+        const depth = partial[1].split('.').length;
+        const stem = version.split('.').slice(0, depth).join('.');
+        // npm partials like 1.x pin the major, and 0.9 pins the major.minor.
+        return `${prefix}${stem}${partial[2] ?? ''}`;
+    }
+    // Wildcards and keyword specs like * or latest already accept the release.
+    return null;
+}
+/**
+ * Warn about declared pins of configured packages that don't resolve the
+ * current version of the package they name.
+ *
+ * @param config   Repository release configuration.
+ * @param packages Discovered packages.
+ * @return Warnings, one per package pair.
+ */
+export async function collectPinDriftWarnings(config, packages) {
+    const warnings = [];
+    for (const dependent of packages) {
+        const others = packages.filter((source) => source.name !== dependent.name);
+        for (const source of others) {
+            const driftedPin = (await findNpmSpecs(dependent, source, dependentsSections(config.dependents)))
+                .filter(({ spec }) => !spec.startsWith('workspace:') &&
+                isOutOfRange(source.currentVersion, spec, source.currentVersion))
+                .at(0);
+            if (driftedPin) {
+                warnings.push(`"${dependent.name}" pins "${driftedPin.name}@${driftedPin.spec}", but the package is at ${source.currentVersion}; the dependents policy won't re-release it until the pin resolves the package.`);
+            }
+        }
+    }
+    return warnings;
+}
+/**
+ * Check whether a spec points at the workspace copy of a package, by
+ * resolving the current version through its range or its workspace protocol.
+ *
+ * @param spec           Declared spec of the source.
+ * @param currentVersion Current version of the source package.
+ * @return Whether the spec is a dependency of the source.
+ */
+export function isDependencyOfSource(spec, currentVersion) {
+    if (spec.startsWith('workspace:')) {
+        return true;
+    }
+    const range = effectiveRange(spec, currentVersion);
+    return (validRange(range) !== null && semverSatisfies(currentVersion, range));
+}
+/**
+ * Find the specs through which a package declares a dependency on another.
+ *
+ * A spec is a dependency of the source that the current version resolves,
+ * like a range that covers it or a workspace spec, or one that the
+ * configured hook reports. A pin like an older version of the source
+ * selects a registry release instead, which keeps the local code out of
+ * the dependent's build.
+ *
+ * @param dependent Package potentially declaring the dependency.
+ * @param source    Released source package.
+ * @param rule      Dependents policy, with its dependency hook and sections.
+ * @return The declared specs, with their manifest files and package names.
+ */
+async function findDependencySpecs(dependent, source, rule) {
+    const specs = (await findNpmSpecs(dependent, source, dependentsSections(rule))).filter(({ spec }) => isDependencyOfSource(spec, source.currentVersion));
+    return rule?.dependency?.find
+        ? [
+            ...specs,
+            ...(await findDependencyHookSpecs(dependent, source, rule)),
+        ]
+        : specs;
+}
+/**
+ * Find the specs that the configured dependency hook reports.
+ *
+ * @param dependent Package potentially declaring the dependency.
+ * @param source    Released source package.
+ * @param rule      Dependents policy.
+ * @return The hook's specs, with absolute manifest paths and package names.
+ */
+async function findDependencyHookSpecs(dependent, source, rule) {
+    const found = await rule.dependency?.find?.({
+        package: dependent,
+        source,
+    });
+    return (found ?? []).map((entry) => ({
+        file: path.resolve(dependent.directory, entry.file),
+        name: entry.name,
+        spec: entry.spec,
+    }));
+}
+/**
+ * Find the npm specs that a package declares for a source, without the
+ * dependency filtering of dependents links, for drift warnings.
+ *
+ * @param dependent Package potentially declaring the dependency.
+ * @param source    Package the dependency is declared of.
+ * @param sections  Dependency sections to scan.
+ * @return The declared specs.
+ */
+async function findNpmSpecs(dependent, source, sections) {
+    const sourceManifest = await readJsonIfExists(path.join(source.directory, 'package.json'));
+    if ('string' !== typeof sourceManifest?.name) {
+        return [];
+    }
+    const identifier = sourceManifest.name;
+    const parsed = await readJsonIfExists(path.join(dependent.directory, 'package.json'));
+    const specs = [];
+    for (const section of sections) {
+        const sectionSpecs = parsed?.[section];
+        const declared = 'object' === typeof sectionSpecs &&
+            null !== sectionSpecs &&
+            Object.hasOwn(sectionSpecs, identifier)
+            ? String(sectionSpecs[identifier])
+            : undefined;
+        if (undefined !== declared) {
+            specs.push({
+                file: path.join(dependent.directory, 'package.json'),
+                name: identifier,
+                spec: declared,
+            });
+        }
+    }
+    return specs;
+}
+/**
+ * The dependency sections that a dependents policy scans.
+ *
+ * @param rule Dependents policy.
+ * @return Dependency section names.
+ */
+function dependentsSections(rule) {
+    return (rule?.sections ?? DEFAULT_SECTIONS);
+}
+/**
+ * Check whether a dependent has to release when its declared source releases.
+ *
+ * @param specs  Declared specs of the source in the dependent.
+ * @param source Released source package.
+ * @param rule   Dependents policy.
+ * @return Whether the dependent needs a release.
+ */
+function dependentNeedsRelease(specs, source, rule) {
+    if ('always' === rule.when) {
+        return true;
+    }
+    // Without a range that accepts the next version, like an exact pin, the
+    // dependent has to release and rewrite its specs.
+    return specs.some(({ spec }) => isOutOfRange(source.nextVersion, spec, source.currentVersion));
+}
+/**
+ * Check whether a version falls outside a declared range.
+ *
+ * @param nextVersion    Next version of the source package.
+ * @param spec           Declared spec of the source).
+ * @param currentVersion Current version of the source package.
+ * @return Whether the next version falls outside the range.
+ */
+function isOutOfRange(nextVersion, spec, currentVersion) {
+    const range = effectiveRange(spec, currentVersion);
+    if (validRange(range) === null) {
+        // Unrecognized ranges of dependencies like git URLs are left to the consumer.
+        return false;
+    }
+    return !semverSatisfies(nextVersion, range);
+}
+/**
+ * Resolve a dependency spec to the range it selects for an internal package.
+ *
+ * @param spec           Declared spec.
+ * @param currentVersion Current version of the source package.
+ * @return The effective semver range.
+ */
+function effectiveRange(spec, currentVersion) {
+    if (!spec.startsWith('workspace:')) {
+        return spec;
+    }
+    // Workspace specs resolve to the exact published version, and to a
+    // prefixed one with their operator.
+    const bare = spec.slice('workspace:'.length);
+    if ('*' === bare) {
+        return currentVersion;
+    }
+    if ('^' === bare || '~' === bare) {
+        return `${bare}${currentVersion}`;
+    }
+    return bare;
+}
+/**
+ * Check whether the dependents policy excludes a package.
+ *
+ * @param dependent Candidate dependent package.
+ * @param rule      Dependents policy.
+ * @return Whether the package is excluded from re-releases.
+ */
+function isExcludedDependent(dependent, rule) {
+    return (rule.exclude ?? []).some((pattern) => pattern === dependent.name ||
+        globRegExp(pattern).test(dependent.path));
+}