rman 2.24.0 → 2.25.0

package/builtins/platforms/node/node-manifest.provider.d.ts

@@ -33,6 +33,15 @@ export declare class NodeManifestProvider implements ManifestProvider {
      * Only an explicit version after `workspace:` needs bumping, like a plain range.
      */
     updateDependencyVersions(manifest: Manifest, bumped: ReadonlyMap<Package, string>): void;
+    /**
+     * Every field naming `dependency`, with npm's answer to whether its range accepts `version` and
+     * the range with its floor raised to it - see `ManifestProvider.referencesTo`.
+     *
+     * A bare `"workspace:*"`/`"^"`/`"~"` is `dynamic`: it already follows the sibling, so there is
+     * nothing to keep or raise. An explicit `"workspace:<range>"` is judged by the range after it.
+     */
+    referencesTo(manifest: Manifest, dependency: string, version: string): ManifestProvider.Reference[];
+    setReference(manifest: Manifest, field: string, dependency: string, range: string): void;
     /**
      * What the npm registry says this package's current version is - used *only* by
      * `detectChangeHash`, to guess a tag name for a package that has no git tag yet. See
@@ -55,6 +64,15 @@ export declare class NodeManifestProvider implements ManifestProvider {
     stampVersion(file: string, content: string, version: string, options?: {
         constant?: string;
     }): string | undefined;
+    /**
+     * `range` with its lower bound moved up to `version`, keeping its upper bound and its operator -
+     * `undefined` when the floor is already at or above it, `null` for a shape with no single floor
+     * to move.
+     *
+     * The shapes a hand-written range takes: `^a`, `~a`, `>=a`, `>=a <b` (or `<=b`) and `a - b`. An
+     * exact pin never needs moving - one that accepts `version` already is it.
+     */
+    protected raiseFloor(range: string, version: string): string | null | undefined;
     write(dir: string, manifest: Manifest): void;
     /** The peers this manifest marks `"optional": true`, which `dependencies` leaves out of the
      *  graph. `optionalDependencies` is deliberately *not* read the same way: an optional peer says

package/builtins/platforms/node/node-manifest.provider.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import semver from 'semver';
 import { Manifest } from '../../../core/interfaces/manifest.js';
 import { stampVersionConstant } from '../../../utils/version-stamp.js';
 import { npmViewVersion } from '../../publish-targets/npm/npm-view.js';
@@ -91,6 +92,44 @@ export class NodeManifestProvider {
             }
         }
     }
+    /**
+     * Every field naming `dependency`, with npm's answer to whether its range accepts `version` and
+     * the range with its floor raised to it - see `ManifestProvider.referencesTo`.
+     *
+     * A bare `"workspace:*"`/`"^"`/`"~"` is `dynamic`: it already follows the sibling, so there is
+     * nothing to keep or raise. An explicit `"workspace:<range>"` is judged by the range after it.
+     */
+    referencesTo(manifest, dependency, version) {
+        const refs = [];
+        for (const field of DEPENDENCY_KEYS) {
+            const declared = manifest.raw[field]?.[dependency];
+            if (typeof declared !== 'string')
+                continue;
+            const workspace = parseWorkspaceRange(declared);
+            if (workspace && workspace.selector !== 'explicit') {
+                refs.push({ field, range: declared, dynamic: true, accepts: true });
+                continue;
+            }
+            const range = workspace ? workspace.range : declared;
+            const raised = this.raiseFloor(range, version);
+            refs.push({
+                field,
+                range: declared,
+                accepts: semver.satisfies(version, range),
+                ...(raised === null
+                    ? { unraisable: true }
+                    : raised
+                        ? { raised: workspace ? `workspace:${raised}` : raised }
+                        : {}),
+            });
+        }
+        return refs;
+    }
+    setReference(manifest, field, dependency, range) {
+        const deps = manifest.raw[field];
+        if (deps && typeof deps === 'object')
+            deps[dependency] = range;
+    }
     /**
      * What the npm registry says this package's current version is - used *only* by
      * `detectChangeHash`, to guess a tag name for a package that has no git tag yet. See
@@ -115,6 +154,45 @@ export class NodeManifestProvider {
     stampVersion(file, content, version, options) {
         return stampVersionConstant(content, version, options?.constant);
     }
+    /**
+     * `range` with its lower bound moved up to `version`, keeping its upper bound and its operator -
+     * `undefined` when the floor is already at or above it, `null` for a shape with no single floor
+     * to move.
+     *
+     * The shapes a hand-written range takes: `^a`, `~a`, `>=a`, `>=a <b` (or `<=b`) and `a - b`. An
+     * exact pin never needs moving - one that accepts `version` already is it.
+     */
+    /* **`null` rather than a guess for anything else**, `||` above all: which alternative's floor is
+     * meant cannot be read off the range, and rewriting the wrong one changes what it accepts.
+     * `version` reports it instead, so the range can be raised by hand. */
+    raiseFloor(range, version) {
+        const r = range.trim();
+        let floor;
+        try {
+            floor = semver.minVersion(r);
+        }
+        catch {
+            return null;
+        }
+        if (!floor)
+            return null;
+        if (semver.lte(version, floor))
+            return undefined;
+        if (semver.valid(r))
+            return undefined;
+        const caret = /^([\^~])\s*v?\d[^\s|]*$/.exec(r);
+        if (caret)
+            return `${caret[1]}${version}`;
+        if (/^>=\s*v?\d\S*$/.test(r))
+            return `>=${version}`;
+        const bounded = /^>=\s*v?\d\S*\s+(<=?\s*v?\d\S*)$/.exec(r);
+        if (bounded)
+            return `>=${version} ${bounded[1]}`;
+        const hyphen = /^v?\d\S*\s+-\s+(v?\d\S*)$/.exec(r);
+        if (hyphen)
+            return `${version} - ${hyphen[1]}`;
+        return null;
+    }
     write(dir, manifest) {
         /**
          * The version is written back into `raw` before serializing, because `raw` is the document and

package/builtins/platforms/node/services/clean.service.js

@@ -226,12 +226,14 @@ async function cleanGlobs(dirname, include, exclude, dryRun) {
  * **The build directory is excluded by name from the config, never as the literal `build`** - see
  * `buildDirOf`. Its contents are the *point* of a build and are removed by `clean.include` when the
  * repository asks, not by a rule about stray files. */
-async function cleanTsArtifacts(pkg, dryRun) {
+async function cleanTsArtifacts(pkg, exclude, dryRun) {
     const dirname = pkg.dirname;
     const buildDir = buildDirOf(pkg);
     const files = await fg('**/*.{js,js.map,d.ts}', {
         cwd: dirname,
-        ignore: ['**/node_modules/**', `${buildDir}/**`, `**/${buildDir}/**`],
+        /** `clean.exclude` protects a file from this sweep too - the one way to keep a file the rules
+         *  below would read as output. */
+        ignore: ['**/node_modules/**', `${buildDir}/**`, `**/${buildDir}/**`, ...exclude],
         onlyFiles: true,
         dot: true,
         absolute: true,
@@ -264,17 +266,24 @@ async function cleanTsArtifacts(pkg, dryRun) {
  * - **A `.d.ts` always needs its `.ts`/`.tsx` beside it**, everywhere including `src` - a
  *   hand-written declaration is an ordinary thing to keep in a source tree, and this is the rule
  *   that has always been here.
- * - **A `.js`/`.js.map` under `src`/`test` goes regardless.** Everything there is TypeScript, so an
- *   orphan - output whose source was renamed or deleted - is still output, and sweeping it is the
- *   `ts-cleanup --all` behaviour this replaced.
+ * - **A `.js`/`.js.map` under `src`/`test` goes**, unless a `.d.ts` with no `.ts` sits beside the
+ *   `.js`. Everything else there is TypeScript, so an orphan - output whose source was renamed or
+ *   deleted - is still output, and sweeping it is the `ts-cleanup --all` behaviour this replaced.
  * - **A `.js`/`.js.map` anywhere else needs its source beside it**, because out there it could just
  *   as easily be `index.js`, `*.config.js` or `scripts/*.js`, which nobody generated.
  */
+/* **A `.js` declared by a hand-written `.d.ts` is kept**, because the first rule already reads that
+ * `.d.ts` as hand-written - and a declaration nobody generated describes a module nobody compiled.
+ * Measured on `panates/hl7v2`: `src/data/hl7-data.js`, a generated plain-JS data module with its
+ * `.d.ts` beside it, was deleted by the preset's `rman clean` before every build, and the next step
+ * failed with esbuild's `Could not resolve "./data/hl7-data.js"` - an error about the import, far
+ * from the cause. The cost, stated: a tsc orphan *pair* (`.js` and `.d.ts` whose `.ts` was renamed)
+ * now stays, where before only its `.d.ts` did. */
 function isBuildOutput(dirname, file) {
     if (file.endsWith('.d.ts'))
         return hasTsSource(file, '.d.ts');
     if (insideTsSourceDir(dirname, file))
-        return true;
+        return !(file.endsWith('.js') && isDeclaredByHand(file));
     return hasTsSource(file, file.endsWith('.js.map') ? '.js.map' : '.js');
 }
 /** Directories where everything is TypeScript, so a compiled file needs no source beside it to be
@@ -293,6 +302,11 @@ function hasTsSource(file, suffix) {
     const base = file.slice(0, -suffix.length);
     return fs.existsSync(base + '.ts') || fs.existsSync(base + '.tsx');
 }
+/** Whether a `.js` has a `.d.ts` beside it and no `.ts`/`.tsx` - a module with a hand-written
+ *  declaration, not compiled output. */
+function isDeclaredByHand(file) {
+    return fs.existsSync(file.slice(0, -'.js'.length) + '.d.ts') && !hasTsSource(file, '.js');
+}
 /**
  * Removes TypeScript's incremental-build cache files (`*.tsbuildinfo`) anywhere under `dirname` -
  * `tsc --build`/`composite`/`incremental` output that `ts-cleanup` never touched, but which can
@@ -316,11 +330,11 @@ async function cleanPackage(pkg, item, panelEnabled, dryRun, logger) {
     item.status = 'running';
     item.startedAt = Date.now();
     try {
+        const { include, exclude } = cleanConfig(pkg);
         item.currentStep = 'ts';
-        const tsRemoved = await cleanTsArtifacts(pkg, dryRun);
+        const tsRemoved = await cleanTsArtifacts(pkg, exclude, dryRun);
         const buildInfoRemoved = await cleanTsBuildInfo(pkg.dirname, dryRun);
         item.currentStep = 'glob';
-        const { include, exclude } = cleanConfig(pkg);
         const globRemoved = await cleanGlobs(pkg.dirname, include, exclude, dryRun);
         const removed = [...tsRemoved, ...buildInfoRemoved, ...globRemoved];
         const verb = dryRun ? 'would rm' : 'rm';

package/commands/version.command.d.ts

@@ -86,6 +86,12 @@ declare const config: {
         type: "string";
         choices: readonly ["changed", "dependents", "group"];
     };
+    dependentRanges: {
+        target: "config";
+        describe: string;
+        type: "string";
+        choices: readonly ["rewrite", "keep"];
+    };
     releaseTagPattern: {
         target: "config";
         describe: string;
@@ -292,6 +298,12 @@ declare const versionCommand: (app: import("../index.js").RmanApplication) => {
             type: "string";
             choices: readonly ["changed", "dependents", "group"];
         };
+        dependentRanges: {
+            target: "config";
+            describe: string;
+            type: "string";
+            choices: readonly ["rewrite", "keep"];
+        };
         releaseTagPattern: {
             target: "config";
             describe: string;

package/commands/version.command.js

@@ -5,6 +5,7 @@ import { registerCommand } from '../interfaces/rman-config.interface.js';
 import { VersionPlanService } from '../services/version-plan.service.js';
 import { assertAllowedBranch, branchGuardOptions, readBranchGuardOptions } from '../utils/branch-guard.js';
 import { fitTable } from '../utils/fit-table.js';
+import { UNCOMMITTED } from '../utils/git.js';
 import { packageFilterOptions, readPackageFilterOptions } from '../utils/package-filter.js';
 import { isNamedGroupKey, isSoloGroupKey, ROOT_GROUP_KEY } from '../utils/version-group.js';
 /**
@@ -119,6 +120,17 @@ const config = {
         type: 'string',
         choices: ['changed', 'dependents', 'group'],
     },
+    dependentRanges: {
+        target: 'config',
+        describe: "What happens to this package's range on an in-repo dependency that is getting a new " +
+            'version: "rewrite" (the default) sets it to the new version and releases this package for ' +
+            'it; "keep" leaves a range that still accepts the new version alone and does not release ' +
+            "this package for it, refuses the run when the range does not, and raises the range's " +
+            'lower bound when this package is released for changes of its own. A prerelease never ' +
+            "fails a range and never raises one. Per-package cascaded - the range is the package's own.",
+        type: 'string',
+        choices: ['rewrite', 'keep'],
+    },
     releaseTagPattern: {
         target: 'config',
         describe: "Tag naming the repository's own release, as opposed to the per-package tags " +
@@ -235,8 +247,11 @@ const versionCommand = registerCommand(app => {
             printPlan(plan);
             const errors = plan.filter(e => e.status === 'error');
             if (errors.length) {
-                const message = `${errors.length} package(s) have uncommitted local changes ` +
-                    '(pass --ignore-dirty to exclude them instead of aborting)';
+                const dirty = errors.filter(e => e.reason?.startsWith(UNCOMMITTED)).length;
+                const message = dirty === errors.length
+                    ? `${errors.length} package(s) have uncommitted local changes ` +
+                        '(pass --ignore-dirty to exclude them instead of aborting)'
+                    : `${errors.length} package(s) cannot be versioned - see the Reason column`;
                 console.log(colors.red(message));
                 const err = new Error(message);
                 err.logged = true;

package/constants.js

@@ -1 +1 @@
-export const version = '2.24.0';
+export const version = '2.25.0';

package/core/interfaces/manifest.d.ts

@@ -159,6 +159,42 @@ export interface ManifestProvider {
      * by path.
      */
     updateDependencyVersions?(manifest: Manifest, bumped: ReadonlyMap<Package, string>): void;
+    /**
+     * Every reference this manifest makes to the in-repo package `dependency`, one per field naming
+     * it, each judged against `version` - whether the range written there accepts it, and the range
+     * with its lower bound raised to it.
+     *
+     * What `.rmanrc "version.dependentRanges": keep` asks instead of `updateDependencyVersions`: a
+     * hand-written range is left alone while it accepts the new version, refused when it does not,
+     * and has its floor raised when the package holding it is released for reasons of its own.
+     *
+     * Omit it and a package has no ranges to keep, so `keep` behaves like `rewrite` for it.
+     */
+    referencesTo?(manifest: Manifest, dependency: string, version: string): ManifestProvider.Reference[];
+    /**
+     * Writes `range` as this manifest's reference to `dependency` in `field` - one of the fields
+     * `referencesTo` reported. Mutates `manifest.raw`, like `updateDependencyVersions`.
+     */
+    setReference?(manifest: Manifest, field: string, dependency: string, range: string): void;
+}
+export declare namespace ManifestProvider {
+    /** One field's reference to an in-repo package - see `ManifestProvider.referencesTo`. */
+    interface Reference {
+        /** Where it is written - npm's `dependencies`, `peerDependencies`, ... */
+        field: string;
+        /** The range as written. */
+        range: string;
+        /** It follows the dependency by itself (npm's bare `"workspace:^"`) - always accepts, never
+         *  rewritten, and keeps `rewrite`'s handling under `keep` too. */
+        dynamic?: boolean;
+        /** Whether the range accepts the version asked about. */
+        accepts: boolean;
+        /** The range with its lower bound raised to the version asked about, when that moves it.
+         *  Unset when the floor is already there, or when `unraisable`. */
+        raised?: string;
+        /** The range's shape has no single lower bound this provider knows how to move. */
+        unraisable?: boolean;
+    }
 }
 /**
  * The registry, merged onto the `Manifest` interface so one name carries both the shape and the
@@ -218,6 +254,11 @@ export declare namespace Manifest {
      * reference each other by path has nothing here to go stale.
      */
     function updateDependencyVersions(pkg: Package, bumped: ReadonlyMap<Package, string>): void;
+    /** `pkg`'s references to `dependency`, judged against `version` - see
+     *  `ManifestProvider.referencesTo`. Empty where the provider has no opinion. */
+    function referencesTo(pkg: Package, dependency: string, version: string): ManifestProvider.Reference[];
+    /** Writes one of `pkg`'s references - see `ManifestProvider.setReference`. */
+    function setReference(pkg: Package, field: string, dependency: string, range: string): void;
     /**
      * Rewrites a hard-coded version in `content` through `pkg`'s own ecosystem - see
      * `Plugin.stampVersion`.

package/core/interfaces/manifest.js

@@ -88,6 +88,17 @@ export var Manifest;
         platformOf(pkg)?.manifestProvider.updateDependencyVersions?.(pkg.manifest, bumped);
     }
     Manifest.updateDependencyVersions = updateDependencyVersions;
+    /** `pkg`'s references to `dependency`, judged against `version` - see
+     *  `ManifestProvider.referencesTo`. Empty where the provider has no opinion. */
+    function referencesTo(pkg, dependency, version) {
+        return platformOf(pkg)?.manifestProvider.referencesTo?.(pkg.manifest, dependency, version) ?? [];
+    }
+    Manifest.referencesTo = referencesTo;
+    /** Writes one of `pkg`'s references - see `ManifestProvider.setReference`. */
+    function setReference(pkg, field, dependency, range) {
+        platformOf(pkg)?.manifestProvider.setReference?.(pkg.manifest, field, dependency, range);
+    }
+    Manifest.setReference = setReference;
     /**
      * Rewrites a hard-coded version in `content` through `pkg`'s own ecosystem - see
      * `Plugin.stampVersion`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rman",
   "description": "Repository manager",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "author": "Panates",
   "license": "MIT",
   "dependencies": {

package/services/version-plan.service.d.ts

@@ -142,6 +142,26 @@ export declare abstract class VersionPlanService {
      */
     protected declaredPreid(members: Package[], label: string): string | undefined;
     protected declaredCascade(members: Package[]): VersionPlanService.Cascade | undefined;
+    /**
+     * Whether `dependent` keeps its range on `dependency` (`.rmanrc "version.dependentRanges": keep`)
+     * and that range still accepts `version` - so the new version reaches it without a release of
+     * its own. `undefined` means "release it as `rewrite` would": the key says `rewrite`, the range
+     * no longer accepts the version (refused later, by `checkKeptRanges`), or there is no range to
+     * judge - a reference that follows the dependency by itself, or an edge `.rmanrc
+     * "dependencies"` declared with no range at all.
+     *
+     * A prerelease is accepted whatever the range says: a range written for stable releases is not
+     * meant to take a beta, and the dependent keeps resolving the stable one it was built against.
+     */
+    protected rangeVerdict(dependent: Package, dependency: Package, version: string): 'accepts' | undefined;
+    /**
+     * The plan's last word on kept ranges: every package that keeps its ranges is checked against
+     * the versions its in-repo dependencies are getting. A range that refuses one makes the package
+     * an `'error'` naming the field, the range and the version, so `version` writes nothing and the
+     * range can be widened by hand. One left out of the release because its range still accepts says
+     * so in its reason, and one being released notes a range whose floor cannot be raised.
+     */
+    protected checkKeptRanges(packages: Package[], entries: Map<string, VersionPlanService.Entry>): void;
     /**
      * The largest bump `commits` ask for, in `scheme`'s own names.
      *

package/services/version-plan.service.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { RmanApplication } from '../core/application.js';
 import { assertOneScheme, semverScheme, VersionScheme } from '../core/classes/version-scheme.js';
+import { Manifest } from '../core/interfaces/manifest.js';
 import { skipReasonFor, targetsOf } from '../core/interfaces/publish-target.js';
 import { dirtyReason, filesUnder, GitHelper } from '../utils/git.js';
 import { filterPackages } from '../utils/package-filter.js';
@@ -185,6 +186,7 @@ export class VersionPlanService {
             this.computeGroupPlan(key, members, changeByPackage, explicitVersion, preid, entries);
         }
         this.rippleCrossGroup(packages, entries, options.preid);
+        this.checkKeptRanges(packages, entries);
         const result = packages.map(pkg => entries.get(pkg.name));
         if (repository.monorepo) {
             result.push(this.buildRootEntry(repository, result, {
@@ -364,6 +366,86 @@ export class VersionPlanService {
                 return widest;
         return undefined;
     }
+    /**
+     * Whether `dependent` keeps its range on `dependency` (`.rmanrc "version.dependentRanges": keep`)
+     * and that range still accepts `version` - so the new version reaches it without a release of
+     * its own. `undefined` means "release it as `rewrite` would": the key says `rewrite`, the range
+     * no longer accepts the version (refused later, by `checkKeptRanges`), or there is no range to
+     * judge - a reference that follows the dependency by itself, or an edge `.rmanrc
+     * "dependencies"` declared with no range at all.
+     *
+     * A prerelease is accepted whatever the range says: a range written for stable releases is not
+     * meant to take a beta, and the dependent keeps resolving the stable one it was built against.
+     */
+    /* **Why `keep` exists**, asked for by `panates/syncbridge`: nine extensions declare
+     * `"@syncbridge/common": ">=1.1.0 <2"` so that a release of `common` does not have to release
+     * all nine. `rewrite` turned the range back into `^1.2.0` and released every one of them anyway.
+     * That narrows the cascade npm's own table asks for, and the cost is stated rather than hidden: a
+     * dependent that bundles its dependency keeps shipping the older code until it is released
+     * itself. Choosing `keep` is the repository accepting that; it is not the default. */
+    rangeVerdict(dependent, dependency, version) {
+        if (dependent.config?.version?.dependentRanges !== 'keep')
+            return undefined;
+        const refs = Manifest.referencesTo(dependent, dependency.name, version).filter(r => !r.dynamic);
+        if (!refs.length)
+            return undefined;
+        if (dependency.versionScheme.isPrerelease(version))
+            return 'accepts';
+        return refs.every(r => r.accepts) ? 'accepts' : undefined;
+    }
+    /**
+     * The plan's last word on kept ranges: every package that keeps its ranges is checked against
+     * the versions its in-repo dependencies are getting. A range that refuses one makes the package
+     * an `'error'` naming the field, the range and the version, so `version` writes nothing and the
+     * range can be widened by hand. One left out of the release because its range still accepts says
+     * so in its reason, and one being released notes a range whose floor cannot be raised.
+     */
+    /* **Every kept package, released or not - a `publish.skip` one included.** A range that no longer
+     * accepts its sibling breaks more than a publish: npm workspaces link a sibling only while the
+     * range accepts its version, and otherwise install it from the registry, silently. */
+    checkKeptRanges(packages, entries) {
+        for (const pkg of packages) {
+            if (pkg.config?.version?.dependentRanges !== 'keep')
+                continue;
+            const entry = entries.get(pkg.name);
+            if (!entry)
+                continue;
+            const refused = [];
+            const kept = [];
+            const unraisable = [];
+            for (const dep of pkg.dependencies) {
+                const depEntry = entries.get(dep.name);
+                const version = depEntry?.status === 'bump' ? depEntry.to : dep.version;
+                const refs = Manifest.referencesTo(pkg, dep.name, version).filter(r => !r.dynamic);
+                if (!refs.length || dep.versionScheme.isPrerelease(version))
+                    continue;
+                for (const ref of refs) {
+                    if (!ref.accepts) {
+                        /** Only a version this run gives: a range already refusing the version on disk is not
+                         *  this run's doing, and npm reports it at install time. */
+                        if (depEntry?.status === 'bump') {
+                            refused.push(`${ref.field} "${dep.name}": "${ref.range}" does not accept ${version}`);
+                        }
+                    }
+                    else if (entry.status === 'bump' && ref.unraisable) {
+                        unraisable.push(`${dep.name} "${ref.range}"`);
+                    }
+                }
+                if (depEntry?.status === 'bump' && refs.every(r => r.accepts))
+                    kept.push(`${dep.name} "${refs[0].range}"`);
+            }
+            if (refused.length) {
+                entry.status = 'error';
+                entry.reason = `range does not accept the new version - ${refused.join('; ')}`;
+            }
+            else if (entry.status === 'no-change' && kept.length) {
+                entry.reason = `range ${kept.join(', ')} still satisfied`;
+            }
+            else if (unraisable.length) {
+                entry.reason = `${entry.reason ? `${entry.reason}; ` : ''}lower bound not raised: ${unraisable.join(', ')}`;
+            }
+        }
+    }
     /**
      * The largest bump `commits` ask for, in `scheme`'s own names.
      *
@@ -478,7 +560,7 @@ export class VersionPlanService {
                 for (const m of members) {
                     if (bumping.has(m))
                         continue;
-                    if (m.dependencies.includes(cur)) {
+                    if (m.dependencies.includes(cur) && !this.rangeVerdict(m, cur, to)) {
                         bumping.add(m);
                         worklist.push(m);
                     }
@@ -536,6 +618,10 @@ export class VersionPlanService {
                     continue;
                 if (!pkg.dependencies.includes(source.package))
                     continue;
+                /** Its range still takes the new version, so nothing it publishes is out of date; one that
+                 *  does not is refused by `checkKeptRanges`, after every bump is known. */
+                if (this.rangeVerdict(pkg, source.package, source.to))
+                    continue;
                 /** The group always contains `pkg` itself, so there is always at least one version here -
                  *  the fallback is for the type, not for a case that can happen. */
                 const groupCeiling = pkg.versionScheme.highestVersion(packages

package/services/version.service.d.ts

@@ -104,6 +104,13 @@ export declare namespace VersionService {
     /** `topo` is refused by default here, which is the one way this differs from `RunService`'s: a
      *  version hook has no package ordering to join. */
     function normalizeScriptValue(value: unknown, at: string): RunStepValue[];
+    /**
+     * Raises the lower bound of each of `pkg`'s ranges on an in-repo dependency to the version that
+     * dependency now has - `bumped`'s for one this run moves, its own otherwise. Upper bounds stay.
+     * What `.rmanrc "version.dependentRanges": keep` does for a package released for changes of its
+     * own, in place of `Manifest.updateDependencyVersions`.
+     */
+    function raiseKeptFloors(pkg: Package, bumped: ReadonlyMap<Package, string>): void;
     /**
      * Keeps a package's Dockerfile `org.opencontainers.image.version` label in step with the version
      * just written, returning the absolute path when it actually changed (so the caller can fold it

package/services/version.service.js

@@ -98,7 +98,10 @@ export class VersionService extends Service {
             /** Which fields hold a sibling reference, and what a reference even looks like, is the
              *  ecosystem's - npm's four fields and its `"workspace:"` protocol used to be spelled out
              *  here. See `Plugin.updateDependencyVersions`. */
-            Manifest.updateDependencyVersions(pkg, bumpedVersions);
+            if (pkg.config?.version?.dependentRanges === 'keep')
+                VersionService.raiseKeptFloors(pkg, bumpedVersions);
+            else
+                Manifest.updateDependencyVersions(pkg, bumpedVersions);
             await hook('exec');
             pkg.writeManifest();
             // Before the `after` hook, so a script reacting to the bump sees the whole new state.
@@ -308,6 +311,32 @@ export class VersionService extends Service {
         return RunService.normalizeScriptValue(value, at, { topo: false });
     }
     VersionService.normalizeScriptValue = normalizeScriptValue;
+    /**
+     * Raises the lower bound of each of `pkg`'s ranges on an in-repo dependency to the version that
+     * dependency now has - `bumped`'s for one this run moves, its own otherwise. Upper bounds stay.
+     * What `.rmanrc "version.dependentRanges": keep` does for a package released for changes of its
+     * own, in place of `Manifest.updateDependencyVersions`.
+     */
+    /* **Only when the package itself is released**, because that is the only time it can have
+     * started using something new: code relying on a newer dependency is a change in the dependent,
+     * and a change is what releases it. Left unreleased, the range it published is still true. The
+     * floor may end up higher than strictly needed - that errs toward what was built and tested, and
+     * the upper bound keeps every consumer installable.
+     *
+     * A prerelease never raises one: a stable range floored on a beta would no longer install for
+     * anyone on stable releases. */
+    function raiseKeptFloors(pkg, bumped) {
+        for (const dep of pkg.dependencies) {
+            const version = bumped.get(dep) ?? dep.version;
+            if (dep.versionScheme.isPrerelease(version))
+                continue;
+            for (const ref of Manifest.referencesTo(pkg, dep.name, version)) {
+                if (ref.raised && ref.accepts)
+                    Manifest.setReference(pkg, ref.field, dep.name, ref.raised);
+            }
+        }
+    }
+    VersionService.raiseKeptFloors = raiseKeptFloors;
     /**
      * Keeps a package's Dockerfile `org.opencontainers.image.version` label in step with the version
      * just written, returning the absolute path when it actually changed (so the caller can fold it