diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 67977cc..2375fc8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,6 +28,9 @@ jobs:
         with:
           run_install: true
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+
       - name: Lint
         run: pnpm lint
 
diff --git a/README.md b/README.md
index 0c155ea..e1f5f97 100644
--- a/README.md
+++ b/README.md
@@ -63,7 +63,7 @@ git-publish
 
 | Flag                    | Description                                                   |
 | ----------------------- | ------------------------------------------------------------- |
-| `-b, --branch <name>`   | Target branch name. Defaults to `npm/<current branch or tag>` |
+| `-b, --branch <template>` | Target branch template. Supports `{gitRef}`, `{gitSha}`, and `{package}` |
 | `-r, --remote <remote>` | Git remote name or URL to push to (default: `origin`)         |
 | `-o, --fresh`           | Create a fresh single-commit branch. Force-pushes to remote   |
 | `-d, --dry`             | Simulate the process. Does not commit or push                 |
@@ -95,6 +95,10 @@ Add your build command to the [`prepack`](https://docs.npmjs.com/cli/v8/using-np
 
 This mirrors the same behavior as `npm publish`.
 
+`git-publish` checks each positive `package.json` `"files"` entry from the packed package after lifecycle hooks run. If an entry matches no packed file or directory, it warns and still publishes. That usually means the build did not run, or the entry is wrong.
+
+You can also run the build before `git-publish`. Existing build output, including gitignored files such as `dist/`, is included when it matches the package's `files` field. See [Preparing monorepo packages](#preparing-monorepo-packages) for workspace builds and custom hooks in a fork.
+
 ### What does `git-publish` do?
 
 1. Checks out or creates the publish branch
@@ -126,10 +130,66 @@ Manual commits often:
 
 Yes. Run `git-publish` from inside the specific package directory (e.g., `packages/my-lib`).
 
-It will detect and publish only that package's contents to the root of the Git branch.
+`git-publish` publishes the selected package and its internal `workspace:` dependencies from `dependencies` and `optionalDependencies`. It creates each package commit before one atomic push, so a failed branch update does not expose a partial dependency closure.
+
+`--branch` accepts a small branch template with these placeholders:
+
+- `{gitRef}`: The current branch, exact tag, or short commit fallback.
+- `{gitSha}`: The full source commit object ID.
+- `{package}`: The package name from `package.json`.
+
+Quote branch templates in the shell, for example `'preview/{package}'`.
+
+When `--branch` is omitted, workspace packages use the default template `npm/{gitRef}-{package}`. For a `core <- broker <- adapter` closure published from `feature/auth`, it creates:
+
+```text
+npm/feature/auth-@acme/core
+npm/feature/auth-@acme/broker
+npm/feature/auth-@acme/adapter
+```
+
+Pass a template to choose each workspace branch independently:
+
+```sh
+git-publish --branch 'preview/{package}'
+```
+
+For one package, a literal branch remains exact. For example, `git-publish --branch preview` publishes to `preview`. A multi-package workspace closure must render a unique branch for every package. Include `{package}` when a literal template would collide.
+
+Standalone packages keep the default `npm/<gitRef>` branch. An explicit `--branch` can use the same placeholders or remain a literal branch name.
+
+Internal workspace peer dependencies are not published. `git-publish` prints a warning for each peer so consumers can provide it.
 
 > [!IMPORTANT]
-> Currently does not support resolving `workspace:` protocol dependencies. Avoid using those or pre-bundle them before publishing.
+> A recursive publication requires one push URL. Git cannot atomically push one dependency closure to multiple destinations.
+
+#### Preparing monorepo packages
+
+Install the repository's dependencies before publishing so the package manager can resolve [`workspace:` references](https://pnpm.io/workspaces#workspace-protocol-workspace) and run package hooks. `git-publish` does not automatically run a script named `build`.
+
+If the repository has a workspace build command, run it before publishing. For example, in a pnpm monorepo with a root `build` script and a remote named `fork` pointing to your fork:
+
+```sh
+# From the repository root
+pnpm install
+pnpm build
+cd packages/my-lib
+git-publish --remote fork
+```
+
+Use the repository's documented build command to generate output for the selected package and all its required workspace dependencies. Each package's `files` field must include its build output.
+
+If packages need custom preparation, add or adjust their `prepack` scripts in your fork's `package.json` files. Each package can use its own command. Commit the manifest and source changes before running `git-publish`: it requires a clean tracked working tree and packs from the committed source. Gitignored build output does not need to be committed.
+
+Package hooks run in an isolated checkout that is cleaned between packages. If one package's build needs another package's generated files, build those dependencies in your source checkout first; do not rely on output from an earlier package's pack hook being retained for the next package.
+
+#### Installing with pnpm
+
+pnpm can block a Git dependency declared by another Git dependency with [`blockExoticSubdeps`](https://pnpm.io/settings/dependency-resolution#blockexoticsubdeps). A consumer that installs a published workspace closure must opt in:
+
+```sh
+pnpm install --config.block-exotic-subdeps=false '<install-specifier>'
+```
 
 ### Can I publish to and install from a private repository?
 
diff --git a/package.json b/package.json
index baa00f4..cb2cdd3 100644
--- a/package.json
+++ b/package.json
@@ -36,27 +36,30 @@
 		"@manypkg/tools": "^2.1.2",
 		"fast-glob": "^3.3.3",
 		"gunzip-maybe": "^1.4.2",
+		"micromatch": "^4.0.8",
 		"tar-fs": "^3.1.2",
-		"tasuku": "^2.3.0"
+		"tasuku": "3.0.0-beta.7"
 	},
 	"devDependencies": {
 		"@types/gunzip-maybe": "^1.4.3",
 		"@types/js-yaml": "^4.0.9",
+		"@types/micromatch": "^4.0.10",
 		"@types/node": "^25.9.2",
 		"@types/npmcli__package-json": "^4.0.4",
 		"@types/tar-fs": "^2.0.4",
+		"ansis": "^4.3.1",
 		"byte-size": "^9.0.1",
 		"clean-pkg-json": "^2.0.0",
 		"cleye": "^2.6.0",
 		"find-up-simple": "^1.0.1",
 		"fs-fixture": "^2.16.0",
 		"js-yaml": "^4.2.0",
-		"kolorist": "^1.8.0",
 		"lintroll": "^1.30.2",
 		"manten": "^2.0.0",
 		"nano-spawn": "^2.1.0",
 		"pkgroll": "^2.27.1",
 		"skills-npm": "^1.2.0",
+		"terminal-columns": "^2.0.0",
 		"terminal-link": "^5.0.0",
 		"typescript": "^6.0.3"
 	}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c52f6ee..da0fe5c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -20,12 +20,15 @@ importers:
       gunzip-maybe:
         specifier: ^1.4.2
         version: 1.4.2
+      micromatch:
+        specifier: ^4.0.8
+        version: 4.0.8
       tar-fs:
         specifier: ^3.1.2
         version: 3.1.2
       tasuku:
-        specifier: ^2.3.0
-        version: 2.3.0
+        specifier: 3.0.0-beta.7
+        version: 3.0.0-beta.7
     devDependencies:
       '@types/gunzip-maybe':
         specifier: ^1.4.3
@@ -33,6 +36,9 @@ importers:
       '@types/js-yaml':
         specifier: ^4.0.9
         version: 4.0.9
+      '@types/micromatch':
+        specifier: ^4.0.10
+        version: 4.0.10
       '@types/node':
         specifier: ^25.9.2
         version: 25.9.2
@@ -42,6 +48,9 @@ importers:
       '@types/tar-fs':
         specifier: ^2.0.4
         version: 2.0.4
+      ansis:
+        specifier: ^4.3.1
+        version: 4.3.1
       byte-size:
         specifier: ^9.0.1
         version: 9.0.1
@@ -60,9 +69,6 @@ importers:
       js-yaml:
         specifier: ^4.2.0
         version: 4.2.0
-      kolorist:
-        specifier: ^1.8.0
-        version: 1.8.0
       lintroll:
         specifier: ^1.30.2
         version: 1.30.2(@types/estree@1.0.9)(@typescript-eslint/utils@8.60.1(eslint@9.39.4(jiti@2.6.1))(typescript@6.0.3))(jiti@2.6.1)(jsonc-eslint-parser@2.4.2)(typescript@6.0.3)
@@ -78,6 +84,9 @@ importers:
       skills-npm:
         specifier: ^1.2.0
         version: 1.2.0
+      terminal-columns:
+        specifier: ^2.0.0
+        version: 2.0.0
       terminal-link:
         specifier: ^5.0.0
         version: 5.0.0
@@ -860,6 +869,9 @@ packages:
   '@tybys/wasm-util@0.10.2':
     resolution: {integrity: sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==}
 
+  '@types/braces@3.0.5':
+    resolution: {integrity: sha512-SQFof9H+LXeWNz8wDe7oN5zu7ket0qwMu5vZubW4GCJ8Kkeh6nBWUz87+KTz/G3Kqsrp0j/W253XJb3KMEeg3w==}
+
   '@types/debug@4.1.13':
     resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
 
@@ -890,6 +902,9 @@ packages:
   '@types/mdast@4.0.4':
     resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
 
+  '@types/micromatch@4.0.10':
+    resolution: {integrity: sha512-5jOhFDElqr4DKTrTEbnW8DZ4Hz5LRUEmyrGpCMrD/NphYv3nUnaF08xmSLx1rGGnyEs/kFnhiw6dCgcDqMr5PQ==}
+
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
@@ -1132,6 +1147,10 @@ packages:
     resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
     engines: {node: '>=12'}
 
+  ansis@4.3.1:
+    resolution: {integrity: sha512-BJ8/l4R5LRE7hW9WdSuGYrLSHi2ynxeFpDFbH0K/CgNeY/tyhk+vO6TYxXC5r5CpUhNVX310xzPsN/H9lCdfOA==}
+    engines: {node: '>=14'}
+
   argparse@1.0.10:
     resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
 
@@ -2243,9 +2262,6 @@ packages:
     resolution: {integrity: sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==}
     engines: {node: '>=0.10.0'}
 
-  kolorist@1.8.0:
-    resolution: {integrity: sha512-Y+60/zizpJ3HRH8DCss+q95yr6145JXZo46OTpFvDZWLfRCE4qChOyk1b26nMaNpfHHgxagk9dXT5OP0Tfe+dQ==}
-
   levn@0.4.1:
     resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
     engines: {node: '>= 0.8.0'}
@@ -2869,8 +2885,9 @@ packages:
   tar-stream@3.1.8:
     resolution: {integrity: sha512-U6QpVRyCGHva435KoNWy9PRoi2IFYCgtEhq9nmrPPpbRacPs9IH4aJ3gbrFC8dPcXvdSZ4XXfXT5Fshbp2MtlQ==}
 
-  tasuku@2.3.0:
-    resolution: {integrity: sha512-9Jtk+XAnttslCw4i9RceSZGr2PT5TLn0vUyWnoP2SdlSYzkiYRY6kB5qnPi5IQ/Em8e4oBow1rpaA39iijTIrA==}
+  tasuku@3.0.0-beta.7:
+    resolution: {integrity: sha512-pIxZdMnWjoE6k6xeGVRuqOW29cqhskJOJJroVTMusIAm10c1mMHvSAjSDZf0UTqnt/ABKnx9Sl0XUSLf5Es/3Q==}
+    engines: {node: '>=20.20'}
 
   teex@1.0.1:
     resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}
@@ -3703,6 +3720,8 @@ snapshots:
       tslib: 2.8.1
     optional: true
 
+  '@types/braces@3.0.5': {}
+
   '@types/debug@4.1.13':
     dependencies:
       '@types/ms': 2.1.0
@@ -3733,6 +3752,10 @@ snapshots:
     dependencies:
       '@types/unist': 3.0.3
 
+  '@types/micromatch@4.0.10':
+    dependencies:
+      '@types/braces': 3.0.5
+
   '@types/ms@2.1.0': {}
 
   '@types/node@25.9.2':
@@ -3950,6 +3973,8 @@ snapshots:
 
   ansi-styles@6.2.3: {}
 
+  ansis@4.3.1: {}
+
   argparse@1.0.10:
     dependencies:
       sprintf-js: 1.0.3
@@ -5251,8 +5276,6 @@ snapshots:
 
   kind-of@6.0.3: {}
 
-  kolorist@1.8.0: {}
-
   levn@0.4.1:
     dependencies:
       prelude-ls: 1.2.1
@@ -6220,7 +6243,7 @@ snapshots:
       - bare-buffer
       - react-native-b4a
 
-  tasuku@2.3.0: {}
+  tasuku@3.0.0-beta.7: {}
 
   teex@1.0.1:
     dependencies:
diff --git a/src/index.ts b/src/index.ts
index 68fee4a..2388262 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,29 +1,56 @@
 import path from 'node:path';
 import fs from 'node:fs/promises';
-import { randomBytes } from 'node:crypto';
-import spawn, { SubprocessError } from 'nano-spawn';
-import task from 'tasuku';
+import spawn from 'nano-spawn';
 import { cli } from 'cleye';
 import type { PackageJson } from '@npmcli/package-json';
-import byteSize from 'byte-size';
-import { cyan, dim, lightBlue } from 'kolorist';
+import { cyan, dim } from 'ansis';
 import terminalLink from 'terminal-link';
 import packageMeta from '../package.json' with { type: 'json' };
+import task from './utils/task.ts';
 import { getStdout } from './utils/get-stdout.ts';
 import {
-	assertCleanTree, getCurrentSourceName, gitStatusTracked, getCurrentCommit,
+	assertCleanTree, getCurrentSourceName, getCurrentCommit,
+	getCurrentCommitId,
 } from './utils/git.ts';
 import { readJson } from './utils/read-json.ts';
 import { detectPackageManager } from './utils/detect-package-manager.ts';
-import { packPackage } from './utils/pack-package.ts';
-import { extractTarball } from './utils/extract-tarball.ts';
-import { getGitHubRepositoryName } from './utils/github.ts';
-import { createPublishRepository, type PublishRepository } from './publish-repository/create.ts';
-import { preparePublishBranch } from './publish-repository/prepare-branch.ts';
+import { getGitHubInstallSpecifier, getGitHubRepositoryName } from './utils/github.ts';
 import { getPublishRemote } from './publish-repository/remote.ts';
+import { renderPackageBranch } from './package-publication/branch.ts';
+import { assertAtomicPackagePublicationDestination } from './package-publication/push.ts';
+import { planWorkspacePublication, type WorkspacePublicationPlan } from './workspace-publication/plan.ts';
+import { publishWorkspaceClosure } from './workspace-publication/publish.ts';
+import { publishStandalonePackage } from './standalone-publication/publish.ts';
 
 const { stringify } = JSON;
 
+const formatWorkspacePublicationPlan = (
+	plan: WorkspacePublicationPlan,
+	sourceName: string,
+): string => {
+	const lines = [`Publishing packages for ${JSON.stringify(plan.selected)} from ${JSON.stringify(sourceName)}:`];
+	const nodesByName = new Map(plan.nodes.map(node => [node.key, node]));
+	for (const node of plan.nodes) {
+		const rewrites = node.dependencies.map(edge => `${edge.key} → ${nodesByName.get(edge.target)!.branch}`).join(', ');
+		lines.push(`- ${node.key} → ${node.branch}${rewrites ? ` (dependencies: ${rewrites})` : ''}`);
+	}
+	return lines.join('\n');
+};
+
+const formatWorkspacePeerDiagnostics = (plan: WorkspacePublicationPlan): string | undefined => {
+	if (plan.peers.length === 0) {
+		return undefined;
+	}
+	const lines = ['Internal workspace peer dependencies are not published. Consumers must provide them:'];
+	for (const peer of plan.peers) {
+		const target = peer.target
+			? ` resolves to ${JSON.stringify(peer.target)}`
+			: ' does not resolve to a workspace package';
+		lines.push(`- ${JSON.stringify(peer.from)} declares ${JSON.stringify(peer.key)}: ${JSON.stringify(peer.specification)}${target}.`);
+	}
+	return lines.join('\n');
+};
+
 (async () => {
 	let usedDefaultRemote = false;
 	const argv = cli({
@@ -34,8 +61,8 @@ const { stringify } = JSON;
 			branch: {
 				type: String,
 				alias: 'b',
-				placeholder: '<branch name>',
-				description: 'The branch to publish the package to. Defaults to prefixing "npm/" to the current branch or tag name.',
+				placeholder: '<branch template>',
+				description: 'Branch template. Supports {gitRef}, {gitSha}, and {package}.',
 			},
 			remote: {
 				type: String,
@@ -75,7 +102,6 @@ const { stringify } = JSON;
 
 	const cwd = process.cwd();
 	const gitRootPath = await getStdout(spawn('git', ['rev-parse', '--show-toplevel']));
-	const gitSubdirectory = path.relative(gitRootPath, cwd);
 	const sourceName = await getCurrentSourceName();
 	const sourceCommit = await getCurrentCommit();
 	const packageJsonPath = 'package.json';
@@ -91,284 +117,170 @@ const { stringify } = JSON;
 		throw new Error('This package is marked as private. Use --force to publish it anyway.');
 	}
 
-	const workspaceDependencies: string[] = [];
-	for (const [field, dependencies] of Object.entries({
-		dependencies: packageJson.dependencies,
-		optionalDependencies: packageJson.optionalDependencies,
-	})) {
-		if (!dependencies) {
-			continue;
-		}
-
-		for (const [name, specification] of Object.entries(dependencies)) {
-			if (specification?.startsWith('workspace:')) {
-				workspaceDependencies.push(`- ${field}.${name}: ${specification}`);
-			}
-		}
-	}
-
-	if (workspaceDependencies.length > 0) {
-		throw new Error(`Cannot publish packages with workspace dependencies:
-${workspaceDependencies.join('\n')}
-Pre-bundle these dependencies before publishing.`);
-	}
-
 	const {
 		branch, remote, fresh, dry,
 	} = argv.flags;
+	const sourceCommitId = branch?.includes('{gitSha}')
+		? await getCurrentCommitId()
+		: undefined;
+	const packageManager = await detectPackageManager(cwd, gitRootPath);
+	const closurePlan = await planWorkspacePublication({
+		cwd,
+		gitRootPath,
+		sourceName,
+		sourceCommitId,
+		packageManager,
+		publishBranch: branch,
+		force: argv.flags.force,
+	});
+	let installSpecifier: string | undefined;
 
-	const publishBranch = branch || (
-		gitSubdirectory
-			? `npm/${sourceName}-${packageJson.name}`
-			: `npm/${sourceName}`
-	);
-	try {
-		await getStdout(spawn('git', ['check-ref-format', '--branch', publishBranch]));
-	} catch {
-		throw new Error(`Invalid publish branch ${stringify(publishBranch)}.`);
-	}
-	const publishRemote = await getPublishRemote(gitRootPath, remote, usedDefaultRemote);
-	const remoteUrl = publishRemote.fetchUrl;
-
-	await task(
-		`Publishing source ${stringify(sourceName)} → ${stringify(publishBranch)}`,
-		async ({
-			task, setTitle, setStatus, setOutput,
-		}) => {
-			if (dry) {
-				setStatus('Dry run');
-			}
-
-			const localTemporaryBranch = `git-publish-${randomBytes(16).toString('hex')}`;
-			let publishRepository: PublishRepository;
-
-			let success = false;
-
-			let commitSha: string;
-			const packageManager = await detectPackageManager(cwd, gitRootPath);
-			let primaryError: unknown;
-
-			try {
-				const creatingWorktrees = await task('Creating temporary repositories', async ({ setWarning }) => {
-					if (dry) {
-						setWarning('');
-						return;
-					}
+	if (closurePlan) {
+		const publishRemote = await getPublishRemote(gitRootPath, remote, usedDefaultRemote);
+		const remoteUrl = publishRemote.fetchUrl;
+		assertAtomicPackagePublicationDestination(publishRemote.pushUrls);
 
-					publishRepository = await createPublishRepository({
-						sourceRepositoryPath: gitRootPath,
-						publishRemote,
-					});
-				});
+		if (dry) {
+			console.log(formatWorkspacePublicationPlan(closurePlan, sourceName));
+		}
+		const peerDiagnostics = formatWorkspacePeerDiagnostics(closurePlan);
+		if (peerDiagnostics) {
+			console.warn(peerDiagnostics);
+		}
 
-				if (!dry) {
-					creatingWorktrees.clear();
+		const workspacePublish = await task(
+			`Publishing ${stringify(closurePlan.selected)} from ${stringify(sourceName)}`,
+			async ({
+				setTitle, setStatus,
+			}) => {
+				if (dry) {
+					setStatus('Dry run');
+					return;
 				}
 
-				const checkoutBranch = await task('Loading publish branch', async ({ setWarning }) => {
-					if (dry) {
-						setWarning('');
-						return;
-					}
-
-					await preparePublishBranch({
-						repository: publishRepository,
-						publishBranch,
-						localBranch: localTemporaryBranch,
-						fresh,
-					});
+				const preparationsByName = await publishWorkspaceClosure({
+					plan: closurePlan,
+					packageManager,
+					repositoryPath: gitRootPath,
+					publishRemote,
+					sourceName,
+					sourceCommit: sourceCommit ?? undefined,
+					fresh,
 				});
 
-				if (!dry) {
-					checkoutBranch.clear();
-				}
-
-				const packTask = await task('Packing package', async ({ streamPreview, setWarning }) => {
-					if (dry) {
-						setWarning('');
-						return;
-					}
-
-					let tarballPath;
-					try {
-						tarballPath = await packPackage(
-							packageManager,
-							publishRepository.packWorktreePath,
-							publishRepository.packTemporaryDirectory,
-							cwd,
-							gitRootPath,
-							gitSubdirectory,
-						);
-					} catch (error) {
-						// The pack subprocess (e.g. a failing prepack/build script) captures
-						// the real reason in its output, but nano-spawn's error.message only
-						// says "Command failed with exit code N". Surface the output inline
-						// under this task so the failure is diagnosable.
-						if (error instanceof SubprocessError) {
-							const details = error.output || error.stderr;
-							if (details) {
-								streamPreview.write(details);
-							}
-						}
-						throw error;
-					}
-
-					const publishFiles = await extractTarball(
-						tarballPath,
-						publishRepository.publishWorktreePath,
-					);
-					const publishedPackageJsonPath = path.join(
-						publishRepository.publishWorktreePath,
-						packageJsonPath,
+				const selected = preparationsByName.get(closurePlan.selected)!;
+				const repositoryName = getGitHubRepositoryName(remoteUrl);
+				if (repositoryName) {
+					const successLink = terminalLink(
+						`${cyan(selected.publication.branch)} ${dim(`(${selected.publication.commit})`)}`,
+						`https://github.com/${repositoryName}/tree/${selected.publication.branch!}`,
 					);
-					const publishedPackageJson = await readJson(publishedPackageJsonPath) as PackageJson;
-					const { scripts } = publishedPackageJson;
-					if (scripts && ('prepare' in scripts || 'prepack' in scripts)) {
-						/*
-						 * npm reruns these hooks when installing Git dependencies:
-						 * https://github.com/npm/cli/blob/2a03860fcafe92b22770fc554b25994b29bacbdb/docs/lib/content/using-npm/scripts.md#L49-L65
-						 */
-						delete scripts.prepare;
-						delete scripts.prepack;
-						await fs.writeFile(publishedPackageJsonPath, stringify(publishedPackageJson, null, 2));
-					}
-
-					return publishFiles;
-				});
-
-				if (!dry) {
-					packTask.clear();
+					setTitle(`Published ${stringify(closurePlan.selected)} from ${stringify(sourceName)}: ${successLink}`);
+				} else {
+					setTitle(`Published ${stringify(closurePlan.selected)} from ${stringify(sourceName)}`);
 				}
 
-				const commit = await task('Committing publish assets', async ({ setWarning }) => {
-					if (dry) {
-						setWarning('');
-						return;
-					}
-
-					await spawn('git', ['add', '-A'], publishRepository.gitOptions);
-
-					const publishFiles = await packTask.result;
-					if (!publishFiles || publishFiles.length === 0) {
-						throw new Error('No publish files found');
-					}
-
-					const totalSize = publishFiles.reduce((accumulator, { size }) => accumulator + size, 0);
-
-					console.log(lightBlue(`Publishing ${packageJson.name}`));
-					console.log(publishFiles.map(({ file, size }) => `${file} ${dim(byteSize(size).toString())}`).join('\n'));
-					console.log(`\n${lightBlue('Total size')}`, byteSize(totalSize).toString());
-
-					const trackedFiles = await gitStatusTracked(publishRepository.gitOptions);
-					if (trackedFiles.length === 0) {
-						console.warn('⚠️  No new changes found to commit.');
-					} else {
-						let commitMessage = `Published from "${sourceName}"`;
-						if (sourceCommit) {
-							commitMessage += ` (${sourceCommit})`;
-						}
-
-						await spawn(
-							'git',
-							[
-								'-c',
-								'user.name=git-publish',
-								'-c',
-								'user.email=bot@git-publish',
-								'commit',
-								'--no-verify',
-								'-m',
-								commitMessage,
-								'--author=git-publish <bot@git-publish>',
-							],
-							publishRepository.gitOptions,
-						);
-					}
-
-					commitSha = (await getCurrentCommit(publishRepository.gitOptions))!;
-				});
+				return selected;
+			},
+		).catch(() => {
+			// Any failure here is already rendered within the task tree above
+			// (including the pack subprocess output), so exit without re-printing it.
+			// Set exitCode (instead of process.exit) so tasuku can flush its final render.
+			process.exitCode = 1;
+		});
+		const selected = workspacePublish;
+		if (selected) {
+			installSpecifier = getGitHubInstallSpecifier(remoteUrl, selected.publication.commit)
+				?? selected.publication.installSpecifier;
+		}
+	} else {
+		const workspaceDependencies: string[] = [];
+		for (const [field, dependencies] of Object.entries({
+			dependencies: packageJson.dependencies,
+			optionalDependencies: packageJson.optionalDependencies,
+		})) {
+			if (!dependencies) {
+				continue;
+			}
 
-				if (!dry) {
-					commit.clear();
+			for (const [name, specification] of Object.entries(dependencies)) {
+				if (specification?.startsWith('workspace:')) {
+					workspaceDependencies.push(`- ${field}.${name}: ${specification}`);
 				}
+			}
+		}
+		if (workspaceDependencies.length > 0) {
+			throw new Error(`Cannot publish packages with workspace dependencies:
+${workspaceDependencies.join('\n')}
+Pre-bundle these dependencies before publishing.`);
+		}
 
-				const push = await task(
-					`Pushing branch ${stringify(publishBranch)} to remote ${stringify(remote)}`,
-					async ({ setStatus, setWarning }) => {
-						if (dry) {
-							setWarning('');
-							return;
-						}
-
-						const { pushRemoteNames } = publishRepository;
-						for (const [index, pushRemoteName] of pushRemoteNames.entries()) {
-							setStatus(`${index + 1} of ${pushRemoteNames.length}`);
-							await spawn('git', [
-								'push',
-								...(fresh ? ['--force'] : []),
-								'--no-verify',
-								pushRemoteName,
-								`HEAD:${publishBranch}`,
-							], publishRepository.gitOptions);
-						}
-						success = true;
-					},
-				);
-
-				if (!dry) {
-					push.clear();
+		const gitSubdirectory = path.relative(gitRootPath, cwd);
+		const defaultPublishBranch = gitSubdirectory
+			? `npm/${sourceName}-${packageJson.name}`
+			: `npm/${sourceName}`;
+		const publishBranch = branch
+			? renderPackageBranch({
+				template: branch,
+				gitRef: sourceName,
+				gitSha: sourceCommitId,
+				packageName: packageJson.name!,
+			})
+			: defaultPublishBranch;
+		try {
+			await getStdout(spawn('git', ['check-ref-format', '--branch', publishBranch]));
+		} catch {
+			throw new Error(`Invalid publish branch ${stringify(publishBranch)}.`);
+		}
+		const publishRemote = await getPublishRemote(gitRootPath, remote, usedDefaultRemote);
+		const remoteUrl = publishRemote.fetchUrl;
+
+		const preparation = await task(
+			`Publishing source ${stringify(sourceName)} → ${stringify(publishBranch)}`,
+			async ({ setStatus, setTitle }) => {
+				if (dry) {
+					setStatus('Dry run');
 				}
-			} catch (error) {
-				primaryError = error;
-				throw error;
-			} finally {
-				const cleanup = await task('Cleaning up', async ({ setWarning }) => {
-					if (dry) {
-						setWarning('');
-						return;
-					}
-
-					if (publishRepository) {
-						await publishRepository.dispose().catch((error: unknown) => {
-							if (error instanceof AggregateError) {
-								setWarning(error.errors.map(nested => (nested instanceof Error ? nested.message : String(nested))).join('\n'));
-							} else {
-								setWarning(error instanceof Error ? error.message : String(error));
-							}
-							if (!primaryError) {
-								throw error;
-							}
-						});
-					}
+				const result = await publishStandalonePackage({
+					packageName: packageJson.name!,
+					packageManager,
+					packagePath: cwd,
+					repositoryPath: gitRootPath,
+					gitSubdirectory,
+					publishBranch,
+					publishRemote,
+					remoteName: remote,
+					sourceName,
+					sourceCommit: sourceCommit ?? undefined,
+					fresh,
+					dry,
 				});
-
-				cleanup.clear();
-			}
-
-			if (success) {
 				const repositoryName = getGitHubRepositoryName(remoteUrl);
-				if (repositoryName) {
-					const successLink = terminalLink(
-						`${cyan(publishBranch)} ${dim(`(${commitSha!})`)}`,
-						`https://github.com/${repositoryName}/tree/${publishBranch!}`,
+				if (result && repositoryName) {
+					const branchLink = terminalLink(
+						publishBranch,
+						`https://github.com/${repositoryName}/tree/${publishBranch}`,
+						{ fallback: false },
 					);
-					setTitle(`Successfully published branch: ${successLink}`);
-
-					const output = [
-						'Install command',
-						`${packageManager} i '${remoteUrl}#${publishBranch}'`,
-					].join('\n');
-
-					setOutput(output);
+					const commitLink = terminalLink(
+						result.publication.commit.slice(0, 7),
+						`https://github.com/${repositoryName}/commit/${result.publication.commit}`,
+						{ fallback: false },
+					);
+					setTitle(`Successfully published branch: ${branchLink} ${dim(`(${commitLink})`)}`);
 				}
-			}
-		},
-	).catch(() => {
-		// Any failure here is already rendered within the task tree above
-		// (including the pack subprocess output), so exit without re-printing it.
-		// Set exitCode (instead of process.exit) so tasuku can flush its final render.
-		process.exitCode = 1;
-	});
+				return result;
+			},
+		).catch(() => {
+			process.exitCode = 1;
+		});
+		if (preparation && getGitHubRepositoryName(remoteUrl)) {
+			installSpecifier = getGitHubInstallSpecifier(remoteUrl, publishBranch);
+		}
+	}
+	if (installSpecifier) {
+		console.log(`\n→ Install command\n  ${packageManager} i '${installSpecifier}'`);
+	}
 })().catch((error) => {
 	console.error('Error:', error.message);
 	process.exit(1);
diff --git a/src/package-publication/branch.ts b/src/package-publication/branch.ts
new file mode 100644
index 0000000..87076ee
--- /dev/null
+++ b/src/package-publication/branch.ts
@@ -0,0 +1,34 @@
+const placeholders = ['{gitRef}', '{gitSha}', '{package}'] as const;
+
+const supportedPlaceholders = placeholders.join(', ');
+
+export const renderPackageBranch = ({
+	template,
+	gitRef,
+	gitSha,
+	packageName,
+}: {
+	template: string;
+	gitRef: string;
+	gitSha: string | undefined;
+	packageName: string;
+}): string => {
+	const values = {
+		'{gitRef}': gitRef,
+		'{gitSha}': gitSha,
+		'{package}': packageName,
+	};
+	const rendered = template.replaceAll(/\{[^{}]*\}/g, (placeholder) => {
+		if (!(placeholder in values)) {
+			throw new Error(`Unknown branch template placeholder ${JSON.stringify(placeholder)}. Supported placeholders: ${supportedPlaceholders}.`);
+		}
+		if (placeholder === '{gitSha}' && !gitSha) {
+			throw new Error(`Branch template ${JSON.stringify(template)} uses {gitSha}, but the source repository has no commit.`);
+		}
+		return values[placeholder as keyof typeof values]!;
+	});
+	if (rendered.includes('{') || rendered.includes('}')) {
+		throw new Error(`Invalid branch template ${JSON.stringify(template)}. Supported placeholders: ${supportedPlaceholders}.`);
+	}
+	return rendered;
+};
diff --git a/src/package-publication/prepare.ts b/src/package-publication/prepare.ts
new file mode 100644
index 0000000..1b47e19
--- /dev/null
+++ b/src/package-publication/prepare.ts
@@ -0,0 +1,122 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import spawn, { type Options as SpawnOptions } from 'nano-spawn';
+import type { PackageJson } from '@npmcli/package-json';
+import { extractTarball, type File } from '../utils/extract-tarball.ts';
+import { getStdout } from '../utils/get-stdout.ts';
+import { gitStatusTracked } from '../utils/git.ts';
+import { readJson } from '../utils/read-json.ts';
+import { findUnpublishedFilesFieldEntries } from '../utils/unpublished-files-field.ts';
+
+const { stringify } = JSON;
+
+export type PackagePublication = {
+	packageName: string;
+	branch: string;
+	commit: string;
+	installSpecifier: string;
+};
+
+export type PackagePreparation = {
+	publication: PackagePublication;
+	files: File[];
+	unpublishedFilesFieldEntries: string[];
+	reusedExistingCommit: boolean;
+};
+
+export type PackagePublicationDependency = {
+	key: string;
+	field: 'dependencies' | 'optionalDependencies';
+	target: string;
+};
+
+const toPackageManagerGitUrl = (url: string) => {
+	if (url.startsWith('git+')) {
+		return url;
+	}
+	if (/^(?:file|git|https?|ssh):\/\//.test(url)) {
+		return `git+${url}`;
+	}
+	const scpUrl = /^(?<user>[^@/:]+@)?(?<host>[^/:]+):(?<path>.+)$/.exec(url)?.groups;
+	if (scpUrl) {
+		return `git+ssh://${scpUrl.user ?? ''}${scpUrl.host}/${scpUrl.path}`;
+	}
+	return `git+file://${path.resolve(url)}`;
+};
+
+export const toInstallSpecifier = (fetchUrl: string, commit: string) => `${toPackageManagerGitUrl(fetchUrl)}#${commit}`;
+
+export const preparePackagePublication = async ({
+	packageName,
+	packedTarball,
+	publishWorktree,
+	branch,
+	fetchUrl,
+	commitMessage,
+	dependencyEdges,
+	dependencyPublications,
+	gitOptions,
+}: {
+	packageName: string;
+	packedTarball: string;
+	publishWorktree: string;
+	branch: string;
+	fetchUrl: string;
+	commitMessage: string;
+	dependencyEdges: PackagePublicationDependency[];
+	dependencyPublications: ReadonlyMap<string, PackagePublication>;
+	gitOptions: SpawnOptions;
+}): Promise<PackagePreparation> => {
+	const worktreeOptions = {
+		cwd: publishWorktree,
+		env: gitOptions.env,
+	};
+	const files = await extractTarball(packedTarball, publishWorktree);
+	const manifestPath = path.join(publishWorktree, 'package.json');
+	const manifest = await readJson(manifestPath) as PackageJson;
+	const original = stringify(manifest);
+	for (const edge of dependencyEdges) {
+		const dependency = dependencyPublications.get(edge.target)!;
+		const field = manifest[edge.field] ?? {};
+		field[edge.key] = dependency.installSpecifier;
+		manifest[edge.field] = field;
+	}
+	const { scripts } = manifest;
+	if (scripts && ('prepare' in scripts || 'prepack' in scripts)) {
+		delete scripts.prepare;
+		delete scripts.prepack;
+	}
+	if (stringify(manifest) !== original) {
+		await fs.writeFile(manifestPath, stringify(manifest, null, 2));
+	}
+	await spawn('git', ['add', '--all'], worktreeOptions);
+	const tracked = await gitStatusTracked(worktreeOptions);
+	if (tracked.length > 0) {
+		await spawn('git', [
+			'-c',
+			'user.name=git-publish',
+			'-c',
+			'user.email=bot@git-publish',
+			'commit',
+			'--no-verify',
+			'-m',
+			commitMessage,
+			'--author=git-publish <bot@git-publish>',
+		], worktreeOptions);
+	}
+	const commit = await getStdout(spawn('git', ['rev-parse', 'HEAD'], worktreeOptions));
+	return {
+		publication: {
+			packageName,
+			branch,
+			commit,
+			installSpecifier: toInstallSpecifier(fetchUrl, commit),
+		},
+		files,
+		unpublishedFilesFieldEntries: findUnpublishedFilesFieldEntries(
+			manifest.files,
+			files.map(file => file.file),
+		),
+		reusedExistingCommit: tracked.length === 0,
+	};
+};
diff --git a/src/package-publication/push.ts b/src/package-publication/push.ts
new file mode 100644
index 0000000..e07a392
--- /dev/null
+++ b/src/package-publication/push.ts
@@ -0,0 +1,66 @@
+import spawn from 'nano-spawn';
+import type { PublishRepository } from '../publish-repository/create.ts';
+import { getStdout } from '../utils/get-stdout.ts';
+import type { PackagePublication } from './prepare.ts';
+
+export type PackagePublicationPushPlan = {
+	fresh: boolean;
+	remoteTips: ReadonlyMap<string, string>;
+};
+
+export const assertAtomicPackagePublicationDestination = (pushUrls: string[]) => {
+	if (pushUrls.length !== 1) {
+		throw new Error(`Workspace publication requires exactly one push URL, but the selected remote has ${pushUrls.length}.`);
+	}
+};
+
+const readRemoteTips = async (
+	repository: PublishRepository,
+	branches: Iterable<string>,
+): Promise<Map<string, string>> => {
+	const references = [...branches].map(branch => `refs/heads/${branch}`);
+	const output = await getStdout(spawn('git', ['ls-remote', repository.pushRemoteNames[0]!, ...references], repository.gitOptions));
+	const tips = new Map<string, string>();
+	for (const line of output.split('\n')) {
+		const separator = line.indexOf('\t');
+		if (separator === -1) {
+			continue;
+		}
+		const sha = line.slice(0, separator);
+		const ref = line.slice(separator + 1);
+		if (ref.startsWith('refs/heads/')) {
+			tips.set(ref.slice('refs/heads/'.length), sha);
+		}
+	}
+	return tips;
+};
+
+export const planPackagePublicationPush = async (
+	repository: PublishRepository,
+	fresh: boolean | undefined,
+	branches: Iterable<string>,
+): Promise<PackagePublicationPushPlan> => ({
+	fresh: Boolean(fresh),
+	remoteTips: fresh ? await readRemoteTips(repository, branches) : new Map(),
+});
+
+export const pushPackagePublications = async ({
+	repository,
+	publications: input,
+	pushPlan,
+}: {
+	repository: PublishRepository;
+	publications: Iterable<PackagePublication>;
+	pushPlan: PackagePublicationPushPlan;
+}): Promise<void> => {
+	const [pushRemoteName] = repository.pushRemoteNames;
+	const publications = [...input];
+	const args = ['push', '--atomic'];
+	if (pushPlan.fresh) {
+		for (const publication of publications) {
+			args.push(`--force-with-lease=refs/heads/${publication.branch}:${pushPlan.remoteTips.get(publication.branch) ?? ''}`);
+		}
+	}
+	args.push('--no-verify', pushRemoteName!, ...publications.map(publication => `${publication.commit}:refs/heads/${publication.branch}`));
+	await spawn('git', args, repository.gitOptions);
+};
diff --git a/src/publish-repository/run-graph.ts b/src/publish-repository/run-graph.ts
deleted file mode 100644
index 5dfb8dc..0000000
--- a/src/publish-repository/run-graph.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-export type GraphNode<Key, Value> = {
-	key: Key;
-	value: Value;
-	dependencies: readonly Key[];
-};
-
-export const runDependencyGraph = async <Key, Value, Result>(
-	nodes: readonly GraphNode<Key, Value>[],
-	run: (
-		node: GraphNode<Key, Value>,
-		dependencyResults: ReadonlyMap<Key, Result>,
-	) => Promise<Result>,
-): Promise<ReadonlyMap<Key, Result>> => {
-	const byKey = new Map<Key, GraphNode<Key, Value>>();
-	for (const node of nodes) {
-		if (byKey.has(node.key)) {
-			throw new Error(`Duplicate graph node key ${JSON.stringify(node.key)}.`);
-		}
-		byKey.set(node.key, node);
-	}
-	for (const node of nodes) {
-		for (const dependency of node.dependencies) {
-			if (!byKey.has(dependency)) {
-				throw new Error(`Unknown graph dependency ${JSON.stringify(dependency)} required by ${JSON.stringify(node.key)}.`);
-			}
-		}
-	}
-
-	const visited = new Set<Key>();
-	const visiting: Key[] = [];
-	const checkCycles = (node: GraphNode<Key, Value>): void => {
-		if (visited.has(node.key)) {
-			return;
-		}
-		const cycleStart = visiting.indexOf(node.key);
-		if (cycleStart !== -1) {
-			const cycle = [...visiting.slice(cycleStart), node.key].map(String);
-			throw new Error(`Dependency cycle detected: ${cycle.join(' -> ')}.`);
-		}
-		visiting.push(node.key);
-		for (const dependency of node.dependencies) {
-			checkCycles(byKey.get(dependency)!);
-		}
-		visiting.pop();
-		visited.add(node.key);
-	};
-	for (const node of nodes) {
-		checkCycles(node);
-	}
-
-	const results = new Map<Key, Result>();
-	const pending = new Map<Key, Promise<Result>>();
-	const runNode = (key: Key): Promise<Result> => {
-		const existing = pending.get(key);
-		if (existing) {
-			return existing;
-		}
-		const task = (async () => {
-			const node = byKey.get(key)!;
-			const dependencyResults = new Map<Key, Result>();
-			for (const dependency of node.dependencies) {
-				dependencyResults.set(dependency, await runNode(dependency));
-			}
-			const result = await run(node, dependencyResults);
-			results.set(key, result);
-			return result;
-		})();
-		pending.set(key, task);
-		return task;
-	};
-	const tasks = nodes.map(node => runNode(node.key));
-	try {
-		await Promise.all(tasks);
-	} catch (error) {
-		await Promise.allSettled(tasks);
-		throw error;
-	}
-	return results;
-};
diff --git a/src/standalone-publication/publish.ts b/src/standalone-publication/publish.ts
new file mode 100644
index 0000000..ae43aa5
--- /dev/null
+++ b/src/standalone-publication/publish.ts
@@ -0,0 +1,194 @@
+import { randomBytes } from 'node:crypto';
+import spawn from 'nano-spawn';
+import byteSize from 'byte-size';
+import { blueBright, dim } from 'ansis';
+import { terminalColumns } from 'terminal-columns';
+import task from '../utils/task.ts';
+import { createPublishRepository, type PublishRepository } from '../publish-repository/create.ts';
+import type { PublishRemote } from '../publish-repository/remote.ts';
+import { preparePublishBranch } from '../publish-repository/prepare-branch.ts';
+import { preparePackagePublication, type PackagePreparation } from '../package-publication/prepare.ts';
+import type { PackageManager } from '../utils/detect-package-manager.ts';
+import { getErrorDetails, writeSubprocessErrorOutput } from '../utils/error.ts';
+import { packPackage } from '../utils/pack-package.ts';
+import { formatUnpublishedFilesFieldWarning } from '../utils/unpublished-files-field.ts';
+
+const { stringify } = JSON;
+
+const styleSizeColumn = (line: string) => blueBright(line);
+
+export const publishStandalonePackage = async ({
+	packageName,
+	packageManager,
+	packagePath,
+	repositoryPath,
+	gitSubdirectory,
+	publishBranch,
+	publishRemote,
+	remoteName,
+	sourceName,
+	sourceCommit,
+	fresh,
+	dry,
+}: {
+	packageName: string;
+	packageManager: PackageManager;
+	packagePath: string;
+	repositoryPath: string;
+	gitSubdirectory: string;
+	publishBranch: string;
+	publishRemote: PublishRemote;
+	remoteName: string;
+	sourceName: string;
+	sourceCommit: string | undefined;
+	fresh: boolean | undefined;
+	dry: boolean | undefined;
+}): Promise<PackagePreparation | undefined> => {
+	let repository: PublishRepository | undefined;
+	let preparation: PackagePreparation | undefined;
+	try {
+		const createRepository = task('Creating temporary repositories', async ({ setWarning }) => {
+			if (dry) {
+				setWarning('');
+				return;
+			}
+			repository = await createPublishRepository({
+				sourceRepositoryPath: repositoryPath,
+				publishRemote,
+			});
+		});
+		await createRepository;
+		if (!dry) {
+			createRepository.clear();
+		}
+
+		const loadBranch = task('Loading publish branch', async ({ setWarning }) => {
+			if (dry) {
+				setWarning('');
+				return;
+			}
+			await preparePublishBranch({
+				repository: repository!,
+				publishBranch,
+				localBranch: `git-publish-${randomBytes(16).toString('hex')}`,
+				fresh,
+			});
+		});
+		await loadBranch;
+		if (!dry) {
+			loadBranch.clear();
+		}
+
+		const pack = task('Packing package', async ({ streamPreview, setWarning }) => {
+			if (dry) {
+				setWarning('');
+				return;
+			}
+			try {
+				return await packPackage(
+					packageManager,
+					repository!.packWorktreePath,
+					repository!.packTemporaryDirectory,
+					packagePath,
+					repositoryPath,
+					gitSubdirectory,
+				);
+			} catch (error) {
+				writeSubprocessErrorOutput(streamPreview, error);
+				throw error;
+			}
+		});
+		const packedTarball = await pack;
+		if (!dry) {
+			pack.clear();
+		}
+
+		const prepare = task('Committing publish assets', async ({ setWarning }) => {
+			if (dry) {
+				setWarning('');
+				return;
+			}
+			preparation = await preparePackagePublication({
+				packageName,
+				packedTarball: packedTarball!,
+				publishWorktree: repository!.publishWorktreePath,
+				branch: publishBranch,
+				fetchUrl: publishRemote.fetchUrl,
+				commitMessage: `Published from ${stringify(sourceName)}${sourceCommit ? ` (${sourceCommit})` : ''}`,
+				dependencyEdges: [],
+				dependencyPublications: new Map(),
+				gitOptions: repository!.gitOptions,
+			});
+			const unpublishedFilesWarning = formatUnpublishedFilesFieldWarning(
+				preparation.unpublishedFilesFieldEntries,
+			);
+			if (unpublishedFilesWarning) {
+				setWarning(unpublishedFilesWarning);
+			}
+			const totalSize = preparation.files.reduce((sum, file) => sum + file.size, 0);
+			console.log(terminalColumns([
+				...preparation.files.slice().sort((a, b) => (
+					a.file < b.file ? -1 : (a.file > b.file ? 1 : 0)
+				)).map(({ file, size }) => [
+					dim(file), dim(byteSize(size).toString()),
+				]),
+				['Total size', byteSize(totalSize).toString()],
+			], {
+				stdoutColumns: Number.POSITIVE_INFINITY,
+				columns: [
+					{
+						width: 'content-width',
+						paddingRight: 2,
+					},
+					{
+						width: 'content-width',
+						align: 'right',
+						postprocess: styleSizeColumn,
+					},
+				],
+			}));
+		});
+		await prepare;
+		if (!dry && !prepare.warning) {
+			prepare.clear();
+		}
+
+		const push = task(`Pushing branch ${stringify(publishBranch)} to remote ${stringify(remoteName)}`, async ({ setStatus, setWarning }) => {
+			if (dry) {
+				setWarning('');
+				return;
+			}
+			for (const [index, pushRemoteName] of repository!.pushRemoteNames.entries()) {
+				setStatus(`${index + 1} of ${repository!.pushRemoteNames.length}`);
+				await spawn('git', [
+					'push',
+					...(fresh ? ['--force'] : []),
+					'--no-verify',
+					pushRemoteName,
+						`HEAD:${publishBranch}`,
+				], repository!.gitOptions);
+			}
+		});
+		await push;
+		if (!dry) {
+			push.clear();
+		}
+	} finally {
+		if (repository) {
+			const publishRepository = repository;
+			const cleanup = task('Cleaning up', async ({ setWarning }) => {
+				try {
+					await publishRepository.dispose();
+				} catch (error) {
+					setWarning(getErrorDetails(error));
+				}
+			});
+			await cleanup;
+			if (!cleanup.warning) {
+				cleanup.clear();
+			}
+		}
+	}
+
+	return preparation;
+};
diff --git a/src/utils/error.ts b/src/utils/error.ts
new file mode 100644
index 0000000..fb728ef
--- /dev/null
+++ b/src/utils/error.ts
@@ -0,0 +1,23 @@
+import type { Writable } from 'node:stream';
+import { SubprocessError } from 'nano-spawn';
+
+export const getErrorDetails = (error: unknown): string => {
+	if (error instanceof AggregateError) {
+		return error.errors.map(getErrorDetails).join('\n');
+	}
+	if (error instanceof SubprocessError) {
+		return error.output || error.stderr || error.message;
+	}
+
+	return error instanceof Error ? error.message : String(error);
+};
+
+export const writeSubprocessErrorOutput = (stream: Writable, error: unknown) => {
+	if (!(error instanceof SubprocessError)) {
+		return;
+	}
+	const details = error.output || error.stderr;
+	if (details) {
+		stream.write(details);
+	}
+};
diff --git a/src/utils/git.ts b/src/utils/git.ts
index eb9fe7c..1ed0221 100644
--- a/src/utils/git.ts
+++ b/src/utils/git.ts
@@ -37,7 +37,14 @@ export const getCurrentSourceName = async () => {
 
 export const getCurrentCommit = async (
 	options?: SpawnOptions,
-) => (
+): Promise<string | undefined> => (
 	// Can be empty if new git repository with no commits
-	getStdout(spawn('git', ['rev-parse', '--short', 'HEAD'], options)).catch(() => {})
+	getStdout(spawn('git', ['rev-parse', '--short', 'HEAD'], options)).catch(() => undefined)
+);
+
+export const getCurrentCommitId = async (
+	options?: SpawnOptions,
+): Promise<string | undefined> => (
+	// Can be empty if new git repository with no commits
+	getStdout(spawn('git', ['rev-parse', 'HEAD'], options)).catch(() => undefined)
 );
diff --git a/src/utils/github.ts b/src/utils/github.ts
index e7f7461..b80969c 100644
--- a/src/utils/github.ts
+++ b/src/utils/github.ts
@@ -30,3 +30,8 @@ export const getGitHubRepositoryName = (remoteUrl: string) => {
 	const [, owner, repository] = repositoryPathMatch;
 	return `${owner}/${repository}`;
 };
+
+export const getGitHubInstallSpecifier = (remoteUrl: string, revision: string) => {
+	const repositoryName = getGitHubRepositoryName(remoteUrl);
+	return repositoryName ? `${repositoryName}#${revision}` : undefined;
+};
diff --git a/src/utils/pack-package.ts b/src/utils/pack-package.ts
index 9aea985..36ec6ad 100644
--- a/src/utils/pack-package.ts
+++ b/src/utils/pack-package.ts
@@ -147,8 +147,18 @@ export const packPackage = async (
 	const packCwd = gitSubdirectory
 		? path.join(packWorktreePath, gitSubdirectory)
 		: packWorktreePath;
-
-	await spawn(packageManager, packArgs, { cwd: packCwd });
+	const binaryPaths = new Set([
+		path.join(cwd, 'node_modules', '.bin'),
+		path.join(gitRootPath, 'node_modules', '.bin'),
+		process.env.PATH,
+	]);
+
+	await spawn(packageManager, packArgs, {
+		cwd: packCwd,
+		env: {
+			PATH: [...binaryPaths].filter(pathEntry => pathEntry !== undefined).join(path.delimiter),
+		},
+	});
 
 	// Find the generated tarball (package managers create it with their own naming)
 	const files = await fs.readdir(packDestinationDirectory);
diff --git a/src/utils/task.ts b/src/utils/task.ts
new file mode 100644
index 0000000..e5105d7
--- /dev/null
+++ b/src/utils/task.ts
@@ -0,0 +1,6 @@
+import { createTasuku, inline } from 'tasuku/create';
+
+export default createTasuku({
+	renderer: inline,
+	outputStream: process.stdout,
+});
diff --git a/src/utils/unpublished-files-field.ts b/src/utils/unpublished-files-field.ts
new file mode 100644
index 0000000..cfe52eb
--- /dev/null
+++ b/src/utils/unpublished-files-field.ts
@@ -0,0 +1,70 @@
+import micromatch from 'micromatch';
+
+const normalizeFilesFieldEntry = (entry: string) => (
+	entry.replace(/^(?:\.\/|\/)+/, '').replace(/\/+$/, '')
+);
+
+const getPackedPaths = (packedFiles: readonly string[]) => {
+	const packedPaths = [...packedFiles];
+	const packedPathSet = new Set(packedPaths);
+	for (const packedFile of packedFiles) {
+		let slashIndex = packedFile.lastIndexOf('/');
+		while (slashIndex !== -1) {
+			const directory = packedFile.slice(0, slashIndex);
+			if (!packedPathSet.has(directory)) {
+				packedPathSet.add(directory);
+				packedPaths.push(directory);
+			}
+			slashIndex = packedFile.lastIndexOf('/', slashIndex - 1);
+		}
+	}
+
+	return packedPaths;
+};
+
+export const findUnpublishedFilesFieldEntries = (
+	filesField: unknown,
+	packedFiles: readonly string[],
+) => {
+	if (!Array.isArray(filesField)) {
+		return [];
+	}
+
+	const packedPaths = getPackedPaths(packedFiles);
+	const unpublished: string[] = [];
+	for (const entry of filesField) {
+		if (typeof entry !== 'string' || entry.length === 0 || micromatch.scan(entry).negated) {
+			continue;
+		}
+
+		const normalized = normalizeFilesFieldEntry(entry);
+		if (!normalized) {
+			continue;
+		}
+
+		const matchesEntry = micromatch.matcher(normalized, { dot: true });
+		let hasMatch = false;
+		for (const packedPath of packedPaths) {
+			if (matchesEntry(packedPath)) {
+				hasMatch = true;
+				break;
+			}
+		}
+		if (!hasMatch) {
+			unpublished.push(entry);
+		}
+	}
+
+	return unpublished;
+};
+
+export const formatUnpublishedFilesFieldWarning = (
+	entries: readonly string[],
+) => {
+	if (entries.length === 0) {
+		return undefined;
+	}
+
+	const listed = entries.map(entry => JSON.stringify(entry)).join(', ');
+	return `package.json "files" lists paths that were not published: ${listed}`;
+};
diff --git a/src/publish-repository/workspace.ts b/src/workspace-publication/discover.ts
similarity index 54%
rename from src/publish-repository/workspace.ts
rename to src/workspace-publication/discover.ts
index aabc236..ffc0d3a 100644
--- a/src/publish-repository/workspace.ts
+++ b/src/workspace-publication/discover.ts
@@ -1,3 +1,4 @@
+import path from 'node:path';
 import { getPackages, type Package } from '@manypkg/get-packages';
 import {
 	BunTool, NpmTool, PnpmTool, YarnTool, type Tool,
@@ -7,13 +8,10 @@ import type { PackageManager } from '../utils/detect-package-manager.ts';
 export type WorkspacePackage = {
 	name: string;
 	dir: string;
-	relativeDir: string;
 	packageJson: Package['packageJson'];
 };
 
 export type Workspace = {
-	rootDir: string;
-	packageManager: PackageManager;
 	packages: WorkspacePackage[];
 };
 
@@ -29,24 +27,56 @@ const workspaceTools: Record<PackageManager, Tool> = {
 	bun: BunTool,
 };
 
+const findWorkspaceRoot = async (
+	directory: string,
+	packageManager: PackageManager,
+	boundaryDirectory: string,
+): Promise<string | undefined> => {
+	const tool = workspaceTools[packageManager];
+	const boundary = path.resolve(boundaryDirectory);
+	let candidate = path.resolve(directory);
+	while (true) {
+		if (await tool.isMonorepoRoot(candidate)) {
+			return candidate;
+		}
+		if (candidate === boundary) {
+			return undefined;
+		}
+		const parent = path.dirname(candidate);
+		if (parent === candidate) {
+			return undefined;
+		}
+		candidate = parent;
+	}
+};
+
 export const discoverWorkspacePackages = async (
 	directory: string,
 	packageManager: PackageManager,
 ): Promise<Workspace> => {
 	const tool = workspaceTools[packageManager];
 	const options = { tools: [tool] };
-	const { packages, rootDir } = await getPackages(directory, options).catch((error: unknown) => {
+	const { packages } = await getPackages(directory, options).catch((error: unknown) => {
 		const reason = error instanceof Error ? error.message : String(error);
 		throw new Error(`No ${packageManager} workspace found in ${directory}: ${reason}`);
 	});
 	return {
-		rootDir,
-		packageManager,
-		packages: packages.map(({ packageJson, dir, relativeDir }) => ({
+		packages: packages.map(({ packageJson, dir }) => ({
 			name: packageJson.name,
 			dir,
-			relativeDir,
 			packageJson,
 		})),
 	};
 };
+
+export const findWorkspacePackages = async (
+	directory: string,
+	packageManager: PackageManager,
+	boundaryDirectory = directory,
+): Promise<Workspace | undefined> => {
+	const rootDirectory = await findWorkspaceRoot(directory, packageManager, boundaryDirectory);
+	if (!rootDirectory) {
+		return undefined;
+	}
+	return discoverWorkspacePackages(rootDirectory, packageManager);
+};
diff --git a/src/publish-repository/graph.ts b/src/workspace-publication/graph.ts
similarity index 95%
rename from src/publish-repository/graph.ts
rename to src/workspace-publication/graph.ts
index 4606b5a..fe62e9e 100644
--- a/src/publish-repository/graph.ts
+++ b/src/workspace-publication/graph.ts
@@ -1,5 +1,5 @@
 import path from 'node:path';
-import type { Workspace, WorkspacePackage } from './workspace.ts';
+import type { Workspace, WorkspacePackage } from './discover.ts';
 
 export type DependencyField = 'dependencies' | 'optionalDependencies';
 
@@ -7,7 +7,6 @@ export type PublishGraphEdge = {
 	key: string;
 	field: DependencyField;
 	target: string;
-	specification: string;
 };
 
 export type PublishGraphNode = {
@@ -24,7 +23,6 @@ export type WorkspacePeer = {
 };
 
 export type PublishGraph = {
-	rootDir: string;
 	selected: string;
 	nodes: PublishGraphNode[];
 	peers: WorkspacePeer[];
@@ -102,10 +100,10 @@ export const selectWorkspacePackage = (
 	return selected;
 };
 
-export const resolvePackageDirectory = (
+export const findWorkspacePackageDirectory = (
 	workspace: Workspace,
 	cwd: string,
-): WorkspacePackage => {
+): WorkspacePackage | undefined => {
 	const directory = path.resolve(cwd);
 	let selected: WorkspacePackage | undefined;
 	let selectedLength = -1;
@@ -119,9 +117,6 @@ export const resolvePackageDirectory = (
 			selectedLength = candidateDirectory.length;
 		}
 	}
-	if (!selected) {
-		throw new Error(`Current directory ${directory} is not inside a workspace package.`);
-	}
 	return selected;
 };
 
@@ -209,7 +204,6 @@ export const createPublishGraph = (
 					key,
 					field,
 					target,
-					specification,
 				});
 				visit(byName.get(target)![0]);
 			}
@@ -248,7 +242,6 @@ export const createPublishGraph = (
 	visit(selectWorkspacePackage(workspace, selected));
 
 	return {
-		rootDir: workspace.rootDir,
 		selected,
 		nodes: [...nodes.values()],
 		peers,
diff --git a/src/workspace-publication/plan.ts b/src/workspace-publication/plan.ts
new file mode 100644
index 0000000..8b4e30b
--- /dev/null
+++ b/src/workspace-publication/plan.ts
@@ -0,0 +1,88 @@
+import path from 'node:path';
+import spawn from 'nano-spawn';
+import { renderPackageBranch } from '../package-publication/branch.ts';
+import type { PackageManager } from '../utils/detect-package-manager.ts';
+import { getStdout } from '../utils/get-stdout.ts';
+import {
+	createPublishGraph, findWorkspacePackageDirectory, type PublishGraphNode, type WorkspacePeer,
+} from './graph.ts';
+import { findWorkspacePackages } from './discover.ts';
+
+export type WorkspacePublicationNode = PublishGraphNode & {
+	branch: string;
+};
+
+export type WorkspacePublicationPlan = {
+	selected: string;
+	nodes: WorkspacePublicationNode[];
+	peers: WorkspacePeer[];
+};
+
+export const planWorkspacePublication = async ({
+	cwd,
+	gitRootPath,
+	sourceName,
+	sourceCommitId,
+	packageManager,
+	publishBranch,
+	force,
+}: {
+	cwd: string;
+	gitRootPath: string;
+	sourceName: string;
+	sourceCommitId: string | undefined;
+	packageManager: PackageManager;
+	publishBranch?: string;
+	force: boolean | undefined;
+}): Promise<WorkspacePublicationPlan | undefined> => {
+	const workspace = await findWorkspacePackages(cwd, packageManager, gitRootPath);
+	if (!workspace) {
+		return undefined;
+	}
+	const selectedPackage = findWorkspacePackageDirectory(workspace, cwd);
+	if (!selectedPackage) {
+		return undefined;
+	}
+	const selected = selectedPackage.name;
+	const graph = createPublishGraph(workspace, selected);
+	if (!force) {
+		const privatePackage = graph.nodes.find(node => node.package.packageJson.private);
+		if (privatePackage) {
+			throw new Error(`Workspace package ${JSON.stringify(privatePackage.key)} is marked as private. Use --force to publish it anyway.`);
+		}
+	}
+	const nodes: WorkspacePublicationNode[] = [];
+	const branchTemplate = publishBranch ?? 'npm/{gitRef}-{package}';
+	const packagesByBranch = new Map<string, string>();
+	for (const node of graph.nodes) {
+		const relative = path.relative(gitRootPath, node.package.dir);
+		if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+			throw new Error(`Workspace package ${JSON.stringify(node.key)} is outside the Git repository and cannot be published.`);
+		}
+		const branch = renderPackageBranch({
+			template: branchTemplate,
+			gitRef: sourceName,
+			gitSha: sourceCommitId,
+			packageName: node.key,
+		});
+		try {
+			await getStdout(spawn('git', ['check-ref-format', '--branch', branch]));
+		} catch {
+			throw new Error(`Invalid publish branch ${JSON.stringify(branch)}.`);
+		}
+		const otherPackage = packagesByBranch.get(branch);
+		if (otherPackage) {
+			throw new Error(`Workspace branch template ${JSON.stringify(branchTemplate)} renders ${JSON.stringify(branch)} for both ${JSON.stringify(otherPackage)} and ${JSON.stringify(node.key)}. Include {package} to publish each package to a unique branch.`);
+		}
+		packagesByBranch.set(branch, node.key);
+		nodes.push({
+			...node,
+			branch,
+		});
+	}
+	return {
+		selected,
+		nodes,
+		peers: graph.peers,
+	};
+};
diff --git a/src/workspace-publication/process-package.ts b/src/workspace-publication/process-package.ts
new file mode 100644
index 0000000..ab1c7e5
--- /dev/null
+++ b/src/workspace-publication/process-package.ts
@@ -0,0 +1,76 @@
+import path from 'node:path';
+import spawn from 'nano-spawn';
+import {
+	preparePackagePublication, type PackagePreparation, type PackagePublication,
+} from '../package-publication/prepare.ts';
+import { preparePublishBranch } from '../publish-repository/prepare-branch.ts';
+import type { PublishRepository } from '../publish-repository/create.ts';
+import type { PublishRemote } from '../publish-repository/remote.ts';
+import type { PackageManager } from '../utils/detect-package-manager.ts';
+import { packPackage } from '../utils/pack-package.ts';
+import type { WorkspacePublicationNode } from './plan.ts';
+
+export const processWorkspacePackage = async ({
+	index,
+	node,
+	packageManager,
+	repository,
+	repositoryPath,
+	publishRemote,
+	sourceName,
+	sourceCommit,
+	fresh,
+	preparations,
+	setStatus,
+}: {
+	index: number;
+	node: WorkspacePublicationNode;
+	packageManager: PackageManager;
+	repository: PublishRepository;
+	repositoryPath: string;
+	publishRemote: PublishRemote;
+	sourceName: string;
+	sourceCommit: string | undefined;
+	fresh: boolean | undefined;
+	preparations: ReadonlyMap<string, PackagePreparation>;
+	setStatus: (status?: string) => void;
+}): Promise<PackagePreparation> => {
+	setStatus('Preparing isolated checkout');
+	const packWorktreeOptions = {
+		cwd: repository.packWorktreePath,
+		env: repository.gitOptions.env,
+	};
+	await spawn('git', ['reset', '--hard', 'HEAD'], packWorktreeOptions);
+	await spawn('git', ['clean', '-fdx'], packWorktreeOptions);
+	setStatus('Packing package and running lifecycle scripts');
+	const tarball = await packPackage(
+		packageManager,
+		repository.packWorktreePath,
+		path.join(repository.packTemporaryDirectory, String(index)),
+		node.package.dir,
+		repositoryPath,
+		path.relative(repositoryPath, node.package.dir),
+	);
+	setStatus('Preparing publication commit');
+	await preparePublishBranch({
+		repository,
+		publishBranch: node.branch,
+		localBranch: `git-publish-${index}`,
+		fresh,
+	});
+	const dependencyPublications = new Map<string, PackagePublication>();
+	for (const edge of node.dependencies) {
+		dependencyPublications.set(edge.target, preparations.get(edge.target)!.publication);
+	}
+	return preparePackagePublication({
+		packageName: node.key,
+		packedTarball: tarball,
+		publishWorktree: repository.publishWorktreePath,
+		branch: node.branch,
+		fetchUrl: publishRemote.fetchUrl,
+		commitMessage: `Published ${JSON.stringify(node.key)} from ${JSON.stringify(sourceName)}${sourceCommit ? ` (${sourceCommit})` : ''}`,
+		dependencyEdges: node.dependencies,
+		dependencyPublications,
+		gitOptions: repository.gitOptions,
+	});
+};
diff --git a/src/workspace-publication/publish.ts b/src/workspace-publication/publish.ts
new file mode 100644
index 0000000..2799482
--- /dev/null
+++ b/src/workspace-publication/publish.ts
@@ -0,0 +1,124 @@
+import type { TaskInnerAPI } from 'tasuku';
+import task from '../utils/task.ts';
+import { createPublishRepository } from '../publish-repository/create.ts';
+import type { PublishRemote } from '../publish-repository/remote.ts';
+import type { PackagePreparation } from '../package-publication/prepare.ts';
+import { planPackagePublicationPush, pushPackagePublications } from '../package-publication/push.ts';
+import type { PackageManager } from '../utils/detect-package-manager.ts';
+import { getErrorDetails, writeSubprocessErrorOutput } from '../utils/error.ts';
+import { formatUnpublishedFilesFieldWarning } from '../utils/unpublished-files-field.ts';
+import type { WorkspacePublicationPlan } from './plan.ts';
+import { processWorkspacePackage } from './process-package.ts';
+
+export const publishWorkspaceClosure = async ({
+	plan,
+	packageManager,
+	repositoryPath,
+	publishRemote,
+	sourceName,
+	sourceCommit,
+	fresh,
+}: {
+	plan: WorkspacePublicationPlan;
+	packageManager: PackageManager;
+	repositoryPath: string;
+	publishRemote: PublishRemote;
+	sourceName: string;
+	sourceCommit: string | undefined;
+	fresh: boolean | undefined;
+}): Promise<ReadonlyMap<string, PackagePreparation>> => {
+	const repository = await createPublishRepository({
+		sourceRepositoryPath: repositoryPath,
+		publishRemote,
+	});
+	try {
+		const pushPlan = await planPackagePublicationPush(
+			repository,
+			fresh,
+			plan.nodes.map(node => node.branch),
+		);
+		const preparations = new Map<string, PackagePreparation>();
+		const processPackage = async (index: number, {
+			streamPreview,
+			setStatus,
+			setWarning,
+			startTime,
+		}: TaskInnerAPI) => {
+			const node = plan.nodes[index]!;
+			startTime();
+			try {
+				const preparation = await processWorkspacePackage({
+					index,
+					node,
+					packageManager,
+					repository,
+					repositoryPath,
+					publishRemote,
+					sourceName,
+					sourceCommit,
+					fresh,
+					preparations,
+					setStatus,
+				});
+				preparations.set(node.key, preparation);
+				if (preparation.reusedExistingCommit) {
+					setStatus('Unchanged; reusing existing commit');
+				} else {
+					setStatus();
+				}
+				const unpublishedFilesWarning = formatUnpublishedFilesFieldWarning(
+					preparation.unpublishedFilesFieldEntries,
+				);
+				if (unpublishedFilesWarning) {
+					setWarning(unpublishedFilesWarning);
+				}
+				return preparation;
+			} catch (error) {
+				writeSubprocessErrorOutput(streamPreview, error);
+				throw error;
+			}
+		};
+		const selectedIndex = plan.nodes.findIndex(node => node.key === plan.selected);
+		if (selectedIndex > 0) {
+			await task('Required workspace dependencies', async () => task.group(
+				createTask => plan.nodes.slice(0, selectedIndex).map((_, index) => createTask(
+					plan.nodes[index]!.key,
+					async taskApi => processPackage(index, taskApi),
+				)),
+			));
+		}
+		await task(
+			plan.nodes[selectedIndex]!.key,
+			async taskApi => processPackage(selectedIndex, taskApi),
+		);
+		const packageCount = plan.nodes.length;
+		await task(
+			`Pushing ${packageCount} ${packageCount === 1 ? 'package' : 'packages'}${packageCount === 1 ? '' : ' together'}`,
+			async ({ streamPreview }) => {
+				try {
+					await pushPackagePublications({
+						repository,
+						publications: [...preparations.values()].map(preparation => preparation.publication),
+						pushPlan,
+					});
+				} catch (error) {
+					writeSubprocessErrorOutput(streamPreview, error);
+					throw error;
+				}
+			},
+		);
+		return preparations;
+	} finally {
+		const cleanup = task('Cleaning up temporary files', async ({ setWarning }) => {
+			try {
+				await repository.dispose();
+			} catch (error) {
+				setWarning(getErrorDetails(error));
+			}
+		});
+		await cleanup;
+		if (!cleanup.warning) {
+			cleanup.clear();
+		}
+	}
+};
diff --git a/tests/index.ts b/tests/index.ts
index 6e636ec..5df8ca0 100644
--- a/tests/index.ts
+++ b/tests/index.ts
@@ -2,9 +2,13 @@ import { describe } from 'manten';
 
 describe('git-publish', () => {
 	import('./specs/workspace-discovery.ts');
-	import('./specs/run-graph.ts');
+	import('./specs/workspace-publication.ts');
+	import('./specs/package-publication.ts');
+	import('./specs/branch-template.ts');
+	import('./specs/standalone-branch-template.ts');
 	import('./specs/publish-graph.ts');
 	import('./specs/github-remotes.ts');
+	import('./specs/error.ts');
 	import('./specs/git-config.ts');
 	import('./specs/validation-errors.ts');
 	import('./specs/remote-transport.ts');
diff --git a/tests/specs/branch-template.ts b/tests/specs/branch-template.ts
new file mode 100644
index 0000000..6c99db4
--- /dev/null
+++ b/tests/specs/branch-template.ts
@@ -0,0 +1,53 @@
+import { describe, expect, test } from 'manten';
+import { renderPackageBranch } from '../../src/package-publication/branch.ts';
+
+describe('Branch templates', () => {
+	for (const {
+		title,
+		template,
+		expected,
+	} of [
+			{
+				title: 'replaces {gitRef}',
+				template: 'preview/{gitRef}',
+				expected: 'preview/feature/auth',
+			},
+			{
+				title: 'replaces {gitSha}',
+				template: 'preview/{gitSha}',
+				expected: 'preview/0123456789abcdef0123456789abcdef01234567',
+			},
+			{
+				title: 'replaces every occurrence of a placeholder',
+				template: 'preview/{package}/{package}',
+				expected: 'preview/@test/adapter/@test/adapter',
+			},
+		]) {
+		test(title, () => {
+			expect(renderPackageBranch({
+				template,
+				gitRef: 'feature/auth',
+				gitSha: '0123456789abcdef0123456789abcdef01234567',
+				packageName: '@test/adapter',
+			})).toBe(expected);
+		});
+	}
+
+	test('rejects unknown placeholders', () => {
+		expect(() => renderPackageBranch({
+			template: 'preview/{version}',
+			gitRef: 'feature/auth',
+			gitSha: '0123456789abcdef0123456789abcdef01234567',
+			packageName: '@test/adapter',
+		})).toThrow('Unknown branch template placeholder "{version}". Supported placeholders: {gitRef}, {gitSha}, {package}.');
+	});
+
+	test('rejects {gitSha} without a source commit', () => {
+		expect(() => renderPackageBranch({
+			template: 'preview/{gitSha}',
+			gitRef: 'main',
+			gitSha: undefined,
+			packageName: 'test-package',
+		})).toThrow('Branch template "preview/{gitSha}" uses {gitSha}, but the source repository has no commit.');
+	});
+});
diff --git a/tests/specs/error.ts b/tests/specs/error.ts
new file mode 100644
index 0000000..523188b
--- /dev/null
+++ b/tests/specs/error.ts
@@ -0,0 +1,21 @@
+import spawn from 'nano-spawn';
+import { expect, test } from 'manten';
+import { getErrorDetails } from '../../src/utils/error.ts';
+
+test('formats nested cleanup and subprocess diagnostics', async () => {
+	let subprocessError: unknown;
+	try {
+		await spawn(process.execPath, ['-'], {
+			stdin: { string: 'console.error("worktree removal failed"); process.exit(1)' },
+		});
+	} catch (error) {
+		subprocessError = error;
+	}
+	const cleanupError = new AggregateError([
+		new AggregateError([subprocessError], 'Nested cleanup failure'),
+		new Error('Temporary directory removal failed'),
+	], 'Cleanup failed');
+
+	expect(getErrorDetails(cleanupError)).toContain('worktree removal failed');
+	expect(getErrorDetails(cleanupError)).toContain('Temporary directory removal failed');
+});
diff --git a/tests/specs/github-remotes.ts b/tests/specs/github-remotes.ts
index cdd7235..c0cff14 100644
--- a/tests/specs/github-remotes.ts
+++ b/tests/specs/github-remotes.ts
@@ -1,5 +1,5 @@
 import { describe, test, expect } from 'manten';
-import { getGitHubRepositoryName } from '../../src/utils/github.ts';
+import { getGitHubInstallSpecifier, getGitHubRepositoryName } from '../../src/utils/github.ts';
 
 describe('GitHub remotes', () => {
 	test('normalizes supported remote URLs', () => {
@@ -30,4 +30,19 @@ describe('GitHub remotes', () => {
 			expect(getGitHubRepositoryName(remoteUrl)).toBeUndefined();
 		}
 	});
+
+	test('formats GitHub install specifiers with shorthand', () => {
+		expect(getGitHubInstallSpecifier(
+			'git@github.com:owner/repository.git',
+			'0123456789abcdef',
+		)).toBe('owner/repository#0123456789abcdef');
+		expect(getGitHubInstallSpecifier(
+			'https://github.com/owner/repository.git',
+			'main',
+		)).toBe('owner/repository#main');
+		expect(getGitHubInstallSpecifier(
+			'git@example.com:owner/repository.git',
+			'main',
+		)).toBeUndefined();
+	});
 });
diff --git a/tests/specs/lifecycle-hooks.ts b/tests/specs/lifecycle-hooks.ts
index 5df4717..1ea58f2 100644
--- a/tests/specs/lifecycle-hooks.ts
+++ b/tests/specs/lifecycle-hooks.ts
@@ -6,6 +6,7 @@ import { createFixture } from 'fs-fixture';
 import { detectPackageManager } from '../../src/utils/detect-package-manager.ts';
 import { createGitFixture } from '../utils/create-git.ts';
 import { gitPublish } from '../utils/git-publish.ts';
+import { createCleanupFailureHook } from '../utils/create-cleanup-failure-hook.ts';
 
 describe('Lifecycle hooks', async () => {
 	const remoteFixture = await createGitFixture(undefined, ['--bare']);
@@ -285,4 +286,29 @@ require('node:fs').writeFileSync('build-output.txt', 'built');
 		// "Error: Command failed with exit code N: …".
 		expect(gitPublishProcess.output).not.toMatch('Error: Command failed');
 	});
+
+	test('retains publication and cleanup diagnostics when both fail', async () => {
+		const missingBinary = 'this-binary-does-not-exist-with-cleanup';
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-pack-and-cleanup-error-output',
+				version: '1.0.0',
+				scripts: { prepack: missingBinary },
+			}, null, 2),
+		}, ['--initial-branch=test-pack-and-cleanup-error-output']);
+		await using hookFixture = await createFixture();
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', remoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, [], {
+			NODE_OPTIONS: await createCleanupFailureHook(hookFixture),
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(true);
+		expect(gitPublishProcess.output).toContain(missingBinary);
+		expect(gitPublishProcess.output).toContain('Test cleanup failure at');
+		expect(gitPublishProcess.output).not.toContain('→ Install command');
+	});
 });
diff --git a/tests/specs/package-contents.ts b/tests/specs/package-contents.ts
index 55b9f28..c9e3471 100644
--- a/tests/specs/package-contents.ts
+++ b/tests/specs/package-contents.ts
@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { stripVTControlCharacters } from 'node:util';
 import {
 	describe, test, expect, onFinish, onTestFail,
 } from 'manten';
@@ -50,6 +51,15 @@ describe('Package contents', async () => {
 
 		expect('exitCode' in gitPublishProcess).toBe(false);
 		expect(gitPublishProcess.stdout).toMatch('✔');
+		const outputLines = stripVTControlCharacters(gitPublishProcess.stdout).split('\n');
+		const totalIndex = outputLines.findIndex(line => line.startsWith('Total size'));
+		const fileRows = outputLines.slice(totalIndex - 2, totalIndex + 1);
+		expect(fileRows.map(line => line.trim().split(/\s{2,}/)[0])).toStrictEqual([
+			'dist/index.js',
+			'package.json',
+			'Total size',
+		]);
+		expect(new Set(fileRows.map(line => line.trimEnd().length)).size).toBe(1);
 
 		// Published branch should have exactly 1 commit
 		const publishedBranch = `npm/${branchName}-${packageName}`;
@@ -252,4 +262,171 @@ describe('Package contents', async () => {
 		const dotfileContent = await remoteGit('show', [`${publishedBranch}:.env.production`]);
 		expect(dotfileContent).toBe('PRODUCTION=true');
 	});
+
+	test('warns when files field paths are missing from the packed package', async () => {
+		const branchName = 'test-missing-files-field';
+
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-missing-files-field',
+				version: '1.0.0',
+				files: ['dist', 'bin', 'index.js'],
+			}, null, 2),
+			'index.js': 'export default true;',
+		}, [`--initial-branch=${branchName}`]);
+
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', remoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, ['--fresh']);
+		onTestFail(() => {
+			console.log(gitPublishProcess);
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(stripVTControlCharacters(gitPublishProcess.stdout)).toContain('package.json "files" lists paths that were not published: "dist", "bin"');
+
+		const publishedBranch = `npm/${branchName}`;
+		const filesInTreeString = await remoteGit('ls-tree', ['-r', '--name-only', publishedBranch]);
+		const filesInTree = filesInTreeString.split('\n').filter(Boolean).sort();
+		expect(filesInTree).toEqual([
+			'index.js',
+			'package.json',
+		]);
+	});
+
+	test('does not warn when listed files are packed', async () => {
+		const branchName = 'test-files-field-present';
+
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-files-field-present',
+				version: '1.0.0',
+				files: ['dist', '!ignored.js'],
+			}, null, 2),
+			dist: {
+				'index.js': 'export default true;',
+			},
+		}, [`--initial-branch=${branchName}`]);
+
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', remoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, ['--fresh']);
+		onTestFail(() => {
+			console.log(gitPublishProcess);
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(stripVTControlCharacters(gitPublishProcess.stdout)).not.toContain('were not published');
+	});
+
+	test('does not warn when files patterns match packed dotfiles', async () => {
+		const branchName = 'test-files-field-dotfile-pattern';
+
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-files-field-dotfile-pattern',
+				version: '1.0.0',
+				files: ['assets/*'],
+			}, null, 2),
+			assets: {
+				'.hidden.json': '{}',
+			},
+		}, [`--initial-branch=${branchName}`]);
+
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', remoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, ['--fresh']);
+		onTestFail(() => {
+			console.log(gitPublishProcess);
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(stripVTControlCharacters(gitPublishProcess.stdout)).not.toContain('were not published');
+
+		const publishedBranch = `npm/${branchName}`;
+		const filesInTreeString = await remoteGit('ls-tree', ['-r', '--name-only', publishedBranch]);
+		expect(filesInTreeString.split('\n').filter(Boolean).sort()).toEqual([
+			'assets/.hidden.json',
+			'package.json',
+		]);
+	});
+
+	test('does not warn when files patterns match packed paths', async () => {
+		const branchName = 'test-files-field-patterns';
+
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-files-field-patterns',
+				version: '1.0.0',
+				files: [
+					'dist/**/*.js',
+					'dist/*.{js,mjs}',
+					'dist/[ab].js',
+					'dist/@(a|b).js',
+					'./dist',
+				],
+			}, null, 2),
+			dist: {
+				'a.js': 'export default true;',
+			},
+		}, [`--initial-branch=${branchName}`]);
+
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', remoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, ['--fresh']);
+		onTestFail(() => {
+			console.log(gitPublishProcess);
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(stripVTControlCharacters(gitPublishProcess.stdout)).not.toContain('were not published');
+	});
+
+	test('does not warn when prepack creates listed files', async () => {
+		const branchName = 'test-files-field-prepack';
+
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-files-field-prepack',
+				version: '1.0.0',
+				files: ['dist'],
+				scripts: {
+					prepack: 'mkdir dist && echo "built" > dist/index.js',
+				},
+			}, null, 2),
+		}, [`--initial-branch=${branchName}`]);
+
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', remoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, ['--fresh']);
+		onTestFail(() => {
+			console.log(gitPublishProcess);
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(stripVTControlCharacters(gitPublishProcess.stdout)).not.toContain('were not published');
+
+		const publishedBranch = `npm/${branchName}`;
+		const filesInTreeString = await remoteGit('ls-tree', ['-r', '--name-only', publishedBranch]);
+		const filesInTree = filesInTreeString.split('\n').filter(Boolean).sort();
+		expect(filesInTree).toEqual([
+			'dist/index.js',
+			'package.json',
+		]);
+	});
 });
diff --git a/tests/specs/package-managers.ts b/tests/specs/package-managers.ts
index 6715387..69760ac 100644
--- a/tests/specs/package-managers.ts
+++ b/tests/specs/package-managers.ts
@@ -12,6 +12,48 @@ describe('Package managers', async () => {
 	onFinish(() => remoteFixture.rm());
 	const { git: remoteGit } = remoteFixture;
 
+	describe('bun', () => {
+		test('pack hooks can access dependency binaries', async () => {
+			const branchName = 'test-bun-pack-hook-dependency';
+			await using fixture = await createGitFixture({
+				'package.json': JSON.stringify({
+					name: 'test-bun-pack-hook-dependency',
+					version: '1.0.0',
+					files: ['build-output.txt'],
+					scripts: {
+						prepack: 'fixture-build',
+					},
+					devDependencies: {
+						'fixture-build': 'file:./fixture-build',
+					},
+				}, null, 2),
+				'.gitignore': 'node_modules',
+				'fixture-build': {
+					'package.json': JSON.stringify({
+						name: 'fixture-build',
+						version: '1.0.0',
+						bin: 'index.js',
+					}, null, 2),
+					'index.js': `#!/usr/bin/env node
+require('node:fs').writeFileSync('build-output.txt', 'built');
+`,
+				},
+			}, [`--initial-branch=${branchName}`]);
+
+			await spawn('bun', ['install'], { cwd: fixture.path });
+			const { git } = fixture;
+			await git('add', ['.']);
+			await git('commit', ['-m', 'Initial commit']);
+			await git('remote', ['add', 'origin', remoteFixture.path]);
+
+			const gitPublishProcess = await gitPublish(fixture.path);
+			onTestFail(() => console.log(gitPublishProcess));
+
+			expect('exitCode' in gitPublishProcess).toBe(false);
+			expect(await remoteGit('show', [`npm/${branchName}:build-output.txt`])).toBe('built');
+		});
+	});
+
 	describe('pnpm', () => {
 		test('catalog protocol is resolved', async () => {
 			const branchName = 'test-pnpm-catalog';
diff --git a/tests/specs/package-publication.ts b/tests/specs/package-publication.ts
new file mode 100644
index 0000000..f2901f3
--- /dev/null
+++ b/tests/specs/package-publication.ts
@@ -0,0 +1,98 @@
+import fs from 'node:fs/promises';
+import { createWriteStream } from 'node:fs';
+import path from 'node:path';
+import { createGzip } from 'node:zlib';
+import { pipeline } from 'node:stream/promises';
+import { describe, expect, test } from 'manten';
+import { createFixture } from 'fs-fixture';
+import tarFs from 'tar-fs';
+import { preparePackagePublication } from '../../src/package-publication/prepare.ts';
+import { createGitFixture } from '../utils/create-git.ts';
+
+describe('Package publication', () => {
+	test('rewrites direct closure dependencies before committing the packed package', async () => {
+		await using packageFixture = await createFixture({
+			package: {
+				'package.json': JSON.stringify({
+					name: '@test/adapter',
+					version: '1.0.0',
+					scripts: {
+						prepare: 'node prepare.js',
+						prepack: 'node prepack.js',
+						postpack: 'node postpack.js',
+					},
+					dependencies: {
+						'core-alias': 'workspace:@test/core@*',
+					},
+					optionalDependencies: {
+						'@test/optional': 'workspace:*',
+					},
+				}, null, 2),
+				'index.js': 'module.exports = 1;',
+			},
+		});
+		const tarballPath = packageFixture.getPath('package.tgz');
+		await pipeline(
+			tarFs.pack(packageFixture.getPath('package'), {
+				map: (header) => {
+					header.name = `package/${header.name}`;
+					return header;
+				},
+			}),
+			createGzip(),
+			createWriteStream(tarballPath),
+		);
+		await using publishFixture = await createGitFixture();
+		await publishFixture.git('commit', ['--allow-empty', '-m', 'Initial commit']);
+		const preparation = await preparePackagePublication({
+			packageName: '@test/adapter',
+			packedTarball: tarballPath,
+			publishWorktree: publishFixture.path,
+			branch: 'npm/adapter',
+			fetchUrl: '/remote.git',
+			commitMessage: 'Published "@test/adapter" from "main" (1234567)',
+			dependencyEdges: [
+				{
+					key: 'core-alias',
+					field: 'dependencies',
+					target: '@test/core',
+				},
+				{
+					key: '@test/optional',
+					field: 'optionalDependencies',
+					target: '@test/optional',
+				},
+			],
+			dependencyPublications: new Map([
+				['@test/core', {
+					packageName: '@test/core',
+					branch: 'npm/core',
+					commit: 'core-commit',
+					installSpecifier: 'git+file:///remote.git#core-commit',
+				}],
+				['@test/optional', {
+					packageName: '@test/optional',
+					branch: 'npm/optional',
+					commit: 'optional-commit',
+					installSpecifier: 'git+file:///remote.git#optional-commit',
+				}],
+			]),
+			gitOptions: {},
+		});
+		const manifest = JSON.parse(await fs.readFile(path.join(publishFixture.path, 'package.json'), 'utf8'));
+		expect(manifest.dependencies).toStrictEqual({
+			'core-alias': 'git+file:///remote.git#core-commit',
+		});
+		expect(manifest.optionalDependencies).toStrictEqual({
+			'@test/optional': 'git+file:///remote.git#optional-commit',
+		});
+		expect(manifest.scripts).toStrictEqual({ postpack: 'node postpack.js' });
+		expect(preparation.reusedExistingCommit).toBe(false);
+		expect(preparation.publication).toStrictEqual({
+			packageName: '@test/adapter',
+			branch: 'npm/adapter',
+			commit: await publishFixture.git('rev-parse', ['HEAD']),
+			installSpecifier: `git+file://${path.resolve('/remote.git')}#${preparation.publication.commit}`,
+		});
+	});
+});
diff --git a/tests/specs/publish-graph.ts b/tests/specs/publish-graph.ts
index 1489b1b..6948e9b 100644
--- a/tests/specs/publish-graph.ts
+++ b/tests/specs/publish-graph.ts
@@ -1,11 +1,11 @@
 import { describe, test, expect } from 'manten';
 import { createFixture } from 'fs-fixture';
-import { discoverWorkspacePackages } from '../../src/publish-repository/workspace.ts';
+import { discoverWorkspacePackages } from '../../src/workspace-publication/discover.ts';
 import {
 	createPublishGraph,
-	resolvePackageDirectory,
+	findWorkspacePackageDirectory,
 	selectWorkspacePackage,
-} from '../../src/publish-repository/graph.ts';
+} from '../../src/workspace-publication/graph.ts';
 
 const discoverTestWorkspace = async (packages: Record<string, unknown>) => {
 	await using fixture = await createFixture({
@@ -73,7 +73,6 @@ describe('Publication graph', () => {
 			key: '@hunk/session-broker-core',
 			field: 'dependencies',
 			target: '@hunk/session-broker-core',
-			specification: 'workspace:*',
 		}]);
 		expect(graph.peers).toStrictEqual([]);
 	});
@@ -154,7 +153,6 @@ describe('Publication graph', () => {
 			key: '@test/core',
 			field: 'optionalDependencies',
 			target: '@test/core',
-			specification: 'workspace:*',
 		}]);
 	});
 
@@ -294,7 +292,6 @@ describe('Publication graph', () => {
 			key: '@test/alias',
 			field: 'dependencies',
 			target: '@test/actual',
-			specification: 'workspace:@test/actual@^1.0.0',
 		}]);
 	});
 
@@ -492,7 +489,7 @@ describe('Publication graph', () => {
 		expect(message).toContain('@test/a -> @test/b -> @test/a');
 	});
 
-	test('resolves the package containing the working directory', async () => {
+	test('finds the package containing the working directory', async () => {
 		await using fixture = await createFixture({
 			'package.json': JSON.stringify({
 				name: 'test-monorepo',
@@ -517,16 +514,8 @@ describe('Publication graph', () => {
 		});
 		const workspace = await discoverWorkspacePackages(fixture.path, 'npm');
 
-		expect(resolvePackageDirectory(workspace, fixture.getPath('packages/app')).name).toBe('@test/app');
-		expect(resolvePackageDirectory(workspace, fixture.getPath('packages/app/src')).name).toBe('@test/app');
-
-		let message = '';
-		try {
-			resolvePackageDirectory(workspace, fixture.path);
-		} catch (error) {
-			expect(error).toBeInstanceOf(Error);
-			message = (error as Error).message;
-		}
-		expect(message).toContain('not inside a workspace package');
+		expect(findWorkspacePackageDirectory(workspace, fixture.getPath('packages/app'))?.name).toBe('@test/app');
+		expect(findWorkspacePackageDirectory(workspace, fixture.getPath('packages/app/src'))?.name).toBe('@test/app');
+		expect(findWorkspacePackageDirectory(workspace, fixture.path)).toBeUndefined();
 	});
 });
diff --git a/tests/specs/publish-history.ts b/tests/specs/publish-history.ts
index f5828f3..c2518b0 100644
--- a/tests/specs/publish-history.ts
+++ b/tests/specs/publish-history.ts
@@ -56,6 +56,59 @@ describe('Publish history', async () => {
 		expect(await remoteGit('rev-parse', [`npm/${sourceCommit}`])).toBeTruthy();
 	});
 
+	test('preserves standalone publication commit messages', async () => {
+		const branchName = 'test-standalone-commit-message';
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-pkg',
+				version: '1.0.0',
+			}, null, 2),
+		}, [`--initial-branch=${branchName}`]);
+
+		const { git } = fixture;
+		await git('add', ['package.json']);
+		await git('commit', ['-m', 'Initial commit']);
+		const sourceCommit = await git('rev-parse', ['--short', 'HEAD']);
+		await git('remote', ['add', 'origin', remoteFixture.path]);
+
+		expect('exitCode' in await gitPublish(fixture.path)).toBe(false);
+		expect(await remoteGit('show', ['--format=%s', '--no-patch', `npm/${branchName}`])).toBe(`Published from "${branchName}" (${sourceCommit})`);
+	});
+
+	test('prints one branch-based GitHub install command after standalone publication', async () => {
+		const branchName = 'test-standalone-install-command';
+		const githubUrl = 'https://github.com/test/repository.git';
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-pkg',
+				version: '1.0.0',
+			}, null, 2),
+		}, [`--initial-branch=${branchName}`]);
+		await using configFixture = await createFixture();
+		const { git } = fixture;
+		await git('add', ['package.json']);
+		await git('commit', ['-m', 'Initial commit']);
+		const globalConfig = configFixture.getPath('gitconfig');
+		await spawn('git', ['config', '--file', globalConfig, `url.file://${remoteFixture.path}.insteadOf`, githubUrl]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, ['--remote', githubUrl], {
+			GIT_CONFIG_GLOBAL: globalConfig,
+			GIT_CONFIG_SYSTEM: configFixture.getPath('system-config'),
+			FORCE_HYPERLINK: '1',
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(gitPublishProcess.stdout).toContain(`npm i 'test/repository#npm/${branchName}'`);
+		const publishedCommit = await remoteGit('rev-parse', [`npm/${branchName}`]);
+		expect(gitPublishProcess.stdout).toContain(`https://github.com/test/repository/tree/npm/${branchName}`);
+		expect(gitPublishProcess.stdout).toContain(`https://github.com/test/repository/commit/${publishedCommit}`);
+		expect(gitPublishProcess.stdout).toContain(`\u0007${publishedCommit.slice(0, 7)}\u001B]8;;`);
+		expect(gitPublishProcess.stdout.split('→ Install command')).toHaveLength(2);
+		expect(gitPublishProcess.stdout.indexOf('→ Install command')).toBeGreaterThan(
+			gitPublishProcess.stdout.indexOf('Successfully published branch:'),
+		);
+	});
+
 	test('preserves history', async () => {
 		const branchName = 'test-preserve-history';
 
diff --git a/tests/specs/run-graph.ts b/tests/specs/run-graph.ts
deleted file mode 100644
index 1421eee..0000000
--- a/tests/specs/run-graph.ts
+++ /dev/null
@@ -1,275 +0,0 @@
-import { describe, test, expect } from 'manten';
-import {
-	runDependencyGraph, type GraphNode,
-} from '../../src/publish-repository/run-graph.ts';
-
-describe('Dependency graph runner', () => {
-	test('relays dependency results up a linear chain', async () => {
-		const order: string[] = [];
-		const nodes: GraphNode<string, string>[] = [
-			{
-				key: 'a',
-				value: 'a',
-				dependencies: [],
-			},
-			{
-				key: 'b',
-				value: 'b',
-				dependencies: ['a'],
-			},
-			{
-				key: 'c',
-				value: 'c',
-				dependencies: ['b'],
-			},
-		];
-		const results = await runDependencyGraph(nodes, async (node, dependencyResults) => {
-			order.push(node.key);
-			return `${node.key}<-[${[...dependencyResults.entries()].map(([key, result]) => `${key}=${result}`).join(',')}]`;
-		});
-
-		expect(order).toStrictEqual(['a', 'b', 'c']);
-		expect(results.get('a')).toBe('a<-[]');
-		expect(results.get('b')).toBe('b<-[a=a<-[]]');
-		expect(results.get('c')).toBe('c<-[b=b<-[a=a<-[]]]');
-	});
-
-	test('runs diamond dependencies concurrently without duplicating work', async () => {
-		const aStarted = Promise.withResolvers<void>();
-		const bStarted = Promise.withResolvers<void>();
-		let coreRuns = 0;
-		const order: string[] = [];
-		const results = await runDependencyGraph<string, string, string>([
-			{
-				key: 'core',
-				value: 'core',
-				dependencies: [],
-			},
-			{
-				key: 'a',
-				value: 'a',
-				dependencies: ['core'],
-			},
-			{
-				key: 'b',
-				value: 'b',
-				dependencies: ['core'],
-			},
-			{
-				key: 'app',
-				value: 'app',
-				dependencies: ['a', 'b'],
-			},
-		], async (node, dependencyResults) => {
-			if (node.key === 'core') {
-				coreRuns += 1;
-			}
-			if (node.key === 'a') {
-				aStarted.resolve();
-				await bStarted.promise;
-			}
-			if (node.key === 'b') {
-				bStarted.resolve();
-				await aStarted.promise;
-			}
-			if (node.key === 'app') {
-				expect([...dependencyResults.keys()].sort()).toStrictEqual(['a', 'b']);
-			}
-			order.push(node.key);
-			return `${node.key}-result`;
-		});
-
-		expect(coreRuns).toBe(1);
-		expect(order[0]).toBe('core');
-		expect(order.at(-1)).toBe('app');
-		expect(results.get('app')).toBe('app-result');
-		expect(results.size).toBe(4);
-	});
-
-	test('runs unrelated leaves concurrently', async () => {
-		const allStarted = Promise.withResolvers<void>();
-		let started = 0;
-		const results = await runDependencyGraph<string, string, string>([
-			{
-				key: 'x',
-				value: 'x',
-				dependencies: [],
-			},
-			{
-				key: 'y',
-				value: 'y',
-				dependencies: [],
-			},
-			{
-				key: 'z',
-				value: 'z',
-				dependencies: [],
-			},
-		], async (node) => {
-			started += 1;
-			if (started === 3) {
-				allStarted.resolve();
-			}
-			await allStarted.promise;
-			return node.key;
-		});
-
-		expect([...results.keys()].sort()).toStrictEqual(['x', 'y', 'z']);
-	});
-
-	test('associates results by key despite completion order', async () => {
-		const gates = new Map<string, ReturnType<typeof Promise.withResolvers<void>>>();
-		for (const key of ['slow', 'fast', 'medium']) {
-			gates.set(key, Promise.withResolvers<void>());
-		}
-		const graphPromise = runDependencyGraph<string, string, string>([
-			{
-				key: 'slow',
-				value: 'slow',
-				dependencies: [],
-			},
-			{
-				key: 'fast',
-				value: 'fast',
-				dependencies: [],
-			},
-			{
-				key: 'medium',
-				value: 'medium',
-				dependencies: [],
-			},
-		], async (node) => {
-			await gates.get(node.key)!.promise;
-			return `${node.key}-done`;
-		});
-		gates.get('medium')!.resolve();
-		gates.get('fast')!.resolve();
-		gates.get('slow')!.resolve();
-		const results = await graphPromise;
-
-		expect(results.get('slow')).toBe('slow-done');
-		expect(results.get('fast')).toBe('fast-done');
-		expect(results.get('medium')).toBe('medium-done');
-	});
-
-	test('prevents dependents from running after a failure while independents settle', async () => {
-		const slowStarted = Promise.withResolvers<void>();
-		const releaseSlow = Promise.withResolvers<void>();
-		const failureObserved = Promise.withResolvers<void>();
-		const ran: string[] = [];
-		let slowFinished = false;
-		let graphSettled = false;
-		const graphPromise = runDependencyGraph<string, string, string>([
-			{
-				key: 'failing',
-				value: 'failing',
-				dependencies: [],
-			},
-			{
-				key: 'blocked',
-				value: 'blocked',
-				dependencies: ['failing'],
-			},
-			{
-				key: 'slow',
-				value: 'slow',
-				dependencies: [],
-			},
-		], async (node) => {
-			ran.push(node.key);
-			if (node.key === 'slow') {
-				slowStarted.resolve();
-				await releaseSlow.promise;
-				slowFinished = true;
-				return node.key;
-			}
-			if (node.key === 'failing') {
-				await slowStarted.promise;
-				failureObserved.resolve();
-				throw new Error('boom');
-			}
-			return node.key;
-		}).finally(() => {
-			graphSettled = true;
-		});
-
-		await failureObserved.promise;
-		expect(graphSettled).toBe(false);
-
-		releaseSlow.resolve();
-
-		let message = '';
-		try {
-			await graphPromise;
-		} catch (error) {
-			expect(error).toBeInstanceOf(Error);
-			message = (error as Error).message;
-		}
-		expect(message).toBe('boom');
-		expect(ran).not.toContain('blocked');
-		expect(slowFinished).toBe(true);
-		expect(graphSettled).toBe(true);
-	});
-
-	for (const [label, nodes, message] of [
-		['duplicate keys', [
-			{
-				key: 'a',
-				value: 'first',
-				dependencies: [],
-			},
-			{
-				key: 'a',
-				value: 'second',
-				dependencies: [],
-			},
-		], 'Duplicate graph node key'],
-		['unknown dependencies', [
-			{
-				key: 'a',
-				value: 'a',
-				dependencies: ['ghost'],
-			},
-		], 'Unknown graph dependency'],
-		['self cycles', [
-			{
-				key: 'a',
-				value: 'a',
-				dependencies: ['a'],
-			},
-		], 'Dependency cycle detected'],
-		['multi-node cycles', [
-			{
-				key: 'a',
-				value: 'a',
-				dependencies: ['b'],
-			},
-			{
-				key: 'b',
-				value: 'b',
-				dependencies: ['c'],
-			},
-			{
-				key: 'c',
-				value: 'c',
-				dependencies: ['a'],
-			},
-		], 'Dependency cycle detected'],
-	] as const) {
-		test(`rejects ${label} before running callbacks`, async () => {
-			const ran: string[] = [];
-			let caught = '';
-			try {
-				await runDependencyGraph(nodes, async (node) => {
-					ran.push(node.key);
-					return node.key;
-				});
-			} catch (error) {
-				expect(error).toBeInstanceOf(Error);
-				caught = (error as Error).message;
-			}
-			expect(caught).toContain(message);
-			expect(ran).toStrictEqual([]);
-		});
-	}
-});
diff --git a/tests/specs/standalone-branch-template.ts b/tests/specs/standalone-branch-template.ts
new file mode 100644
index 0000000..2ab4302
--- /dev/null
+++ b/tests/specs/standalone-branch-template.ts
@@ -0,0 +1,47 @@
+import { describe, expect, test } from 'manten';
+import { createGitFixture } from '../utils/create-git.ts';
+import { gitPublish } from '../utils/git-publish.ts';
+
+describe('Standalone branch templates', () => {
+	for (const {
+		title,
+		template,
+		branch,
+	} of [
+			{
+				title: 'renders {gitRef}',
+				template: 'preview/{gitRef}',
+				branch: (_sourceCommit: string) => 'preview/feature/auth',
+			},
+			{
+				title: 'renders the full {gitSha}',
+				template: 'preview/{gitSha}',
+				branch: (sourceCommit: string) => `preview/${sourceCommit}`,
+			},
+			{
+				title: 'keeps literal branches exact',
+				template: 'preview',
+				branch: (_sourceCommit: string) => 'preview',
+			},
+		]) {
+		test(title, async () => {
+			await using remoteFixture = await createGitFixture(undefined, ['--bare']);
+			const { git: remoteGit } = remoteFixture;
+			await using fixture = await createGitFixture({
+				'package.json': JSON.stringify({
+					name: 'test-package',
+					version: '1.0.0',
+				}),
+			}, ['--initial-branch=feature/auth']);
+			await fixture.git('add', ['package.json']);
+			await fixture.git('commit', ['-m', 'Initial commit']);
+			await fixture.git('remote', ['add', 'origin', remoteFixture.path]);
+			const sourceCommit = await fixture.git('rev-parse', ['HEAD']);
+
+			const gitPublishProcess = await gitPublish(fixture.path, ['--branch', template]);
+
+			expect('exitCode' in gitPublishProcess).toBe(false);
+			expect(await remoteGit('show', [`${branch(sourceCommit)}:package.json`])).toContain('test-package');
+		});
+	}
+});
diff --git a/tests/specs/validation-errors.ts b/tests/specs/validation-errors.ts
index bbe9a7b..5eace60 100644
--- a/tests/specs/validation-errors.ts
+++ b/tests/specs/validation-errors.ts
@@ -163,6 +163,7 @@ exit 1
 
 		const gitPublishProcess = await gitPublish(fixture.path, ['--dry'], { TMPDIR: temporaryFixture.path });
 		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(gitPublishProcess.stdout).not.toContain('→ Install command');
 		expect(await temporaryFixture.readdir('')).toStrictEqual([]);
 	});
 
diff --git a/tests/specs/workspace-discovery.ts b/tests/specs/workspace-discovery.ts
index 21f8c15..b6e5c2f 100644
--- a/tests/specs/workspace-discovery.ts
+++ b/tests/specs/workspace-discovery.ts
@@ -1,7 +1,6 @@
-import fs from 'node:fs/promises';
 import { describe, test, expect } from 'manten';
 import { createFixture } from 'fs-fixture';
-import { discoverWorkspacePackages } from '../../src/publish-repository/workspace.ts';
+import { discoverWorkspacePackages, findWorkspacePackages } from '../../src/workspace-publication/discover.ts';
 
 describe('Workspace discovery', () => {
 	test('discovers npm workspace packages', async () => {
@@ -33,11 +32,8 @@ describe('Workspace discovery', () => {
 
 		const workspace = await discoverWorkspacePackages(fixture.path, 'npm');
 
-		expect(workspace.rootDir).toBe(await fs.realpath(fixture.path));
-		expect(workspace.packageManager).toBe('npm');
 		expect(workspace.packages.map(entry => entry.name).sort()).toStrictEqual(['@test/a', '@test/b']);
 		const entry = workspace.packages.find(candidate => candidate.name === '@test/b');
-		expect(entry?.relativeDir).toBe('packages/b');
 		expect(entry?.packageJson.dependencies).toStrictEqual({ '@test/a': 'workspace:*' });
 	});
 
@@ -83,7 +79,6 @@ describe('Workspace discovery', () => {
 
 		const workspace = await discoverWorkspacePackages(fixture.path, 'bun');
 
-		expect(workspace.packageManager).toBe('bun');
 		expect(workspace.packages.map(entry => entry.name)).toStrictEqual(['@test/a']);
 	});
 
@@ -107,7 +102,6 @@ describe('Workspace discovery', () => {
 
 		const workspace = await discoverWorkspacePackages(fixture.path, 'yarn');
 
-		expect(workspace.packageManager).toBe('yarn');
 		expect(workspace.packages.map(entry => entry.name)).toStrictEqual(['@test/a']);
 	});
 
@@ -132,7 +126,6 @@ describe('Workspace discovery', () => {
 
 		const workspace = await discoverWorkspacePackages(fixture.path, 'pnpm');
 
-		expect(workspace.packageManager).toBe('pnpm');
 		expect(workspace.packages.map(entry => entry.name)).toStrictEqual(['@test/a']);
 	});
 
@@ -181,4 +174,15 @@ describe('Workspace discovery', () => {
 		}
 		expect(message).toContain('No npm workspace found');
 	});
+
+	test('returns undefined for a package outside a workspace', async () => {
+		await using fixture = await createFixture({
+			'package.json': JSON.stringify({
+				name: 'test-pkg',
+				version: '1.0.0',
+			}),
+		});
+
+		expect(await findWorkspacePackages(fixture.path, 'npm')).toBeUndefined();
+	});
 });
diff --git a/tests/specs/workspace-publication.ts b/tests/specs/workspace-publication.ts
new file mode 100644
index 0000000..1759e4b
--- /dev/null
+++ b/tests/specs/workspace-publication.ts
@@ -0,0 +1,491 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import {
+	describe, test, expect, onFinish,
+} from 'manten';
+import { createFixture } from 'fs-fixture';
+import spawn from 'nano-spawn';
+import { createGit, createGitFixture } from '../utils/create-git.ts';
+import { gitPublish } from '../utils/git-publish.ts';
+import { createCleanupFailureHook } from '../utils/create-cleanup-failure-hook.ts';
+
+describe('Workspace publication', async () => {
+	const remoteFixture = await createGitFixture(undefined, ['--bare']);
+	onFinish(() => remoteFixture.rm());
+	const { git: remoteGit } = remoteFixture;
+
+	const createChainWorkspace = async (
+		branchName: string,
+		remote: string,
+		{
+			adapterSpecification = 'workspace:*',
+			corePrivate,
+			corePrepack,
+			peerSpecification,
+		}: {
+			adapterSpecification?: string;
+			corePrivate?: boolean;
+			corePrepack?: string;
+			peerSpecification?: string;
+		} = {},
+	) => {
+		const fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-monorepo',
+				private: true,
+				workspaces: ['packages/*'],
+			}, null, 2),
+			'package-lock.json': '{}',
+			packages: {
+				core: {
+					'package.json': JSON.stringify({
+						name: '@test/core',
+						version: '0.0.0',
+						...(corePrivate ? { private: true } : {}),
+						...(corePrepack
+							? {
+								scripts: {
+									prepack: corePrepack,
+								},
+							}
+							: {}),
+					}, null, 2),
+					'index.js': 'module.exports = { core: 1 };',
+				},
+				broker: {
+					'package.json': JSON.stringify({
+						name: '@test/broker',
+						version: '0.0.0',
+						dependencies: {
+							'@test/core': 'workspace:*',
+						},
+					}, null, 2),
+					'index.js': 'module.exports = { core: require("@test/core") };',
+				},
+				adapter: {
+					'package.json': JSON.stringify({
+						name: '@test/adapter',
+						version: '0.0.0',
+						dependencies: {
+							'@test/broker': adapterSpecification,
+						},
+						...(peerSpecification
+							? {
+								peerDependencies: {
+									'@test/core': peerSpecification,
+								},
+							}
+							: {}),
+					}, null, 2),
+					'index.js': 'module.exports = { broker: require("@test/broker") };',
+				},
+			},
+		}, [`--initial-branch=${branchName}`]);
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', remote]);
+		return fixture;
+	};
+
+	test('rejects private workspace dependencies unless --force is used', async () => {
+		const branchName = 'test-private-workspace-dependency';
+		await using fixture = await createChainWorkspace(branchName, remoteFixture.path, {
+			corePrivate: true,
+		});
+		const packagePath = path.join(fixture.path, 'packages/adapter');
+
+		const rejectedPublication = await gitPublish(packagePath);
+
+		expect(('exitCode' in rejectedPublication) && rejectedPublication.exitCode).toBe(1);
+		expect(rejectedPublication.stderr).toContain('Workspace package "@test/core" is marked as private');
+		expect(rejectedPublication.stderr).toContain('Use --force to publish it anyway');
+		expect(await remoteGit('for-each-ref')).toBe('');
+
+		const forcedPublication = await gitPublish(packagePath, ['--force']);
+
+		expect('exitCode' in forcedPublication).toBe(false);
+		expect(await remoteGit('show', [`npm/${branchName}-@test/core:package.json`])).toContain('"private": true');
+	});
+
+	test('keeps a literal --branch for an independent workspace package', async () => {
+		await using branchRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: branchRemoteGit } = branchRemoteFixture;
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-monorepo',
+				private: true,
+				workspaces: ['packages/*'],
+			}, null, 2),
+			'package-lock.json': '{}',
+			packages: {
+				adapter: {
+					'package.json': JSON.stringify({
+						name: '@test/adapter',
+						version: '0.0.0',
+					}, null, 2),
+					'index.js': 'module.exports = 1;',
+				},
+			},
+		}, ['--initial-branch=test-workspace-branch-flag']);
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', branchRemoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'), ['--branch', 'custom']);
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(await branchRemoteGit('show', ['custom:package.json'])).toContain('@test/adapter');
+		expect(gitPublishProcess.stdout).not.toContain('Required workspace dependencies');
+		expect(gitPublishProcess.stdout).toContain('Pushing 1 package');
+	});
+
+	test('groups required dependencies under the selected package publication', async () => {
+		const branchName = 'test-workspace-progress';
+		await using fixture = await createChainWorkspace(branchName, remoteFixture.path, {
+			corePrepack: 'node -e "setTimeout(() => {}, 1100)"',
+		});
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'));
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(gitPublishProcess.stdout).toContain(`Published "@test/adapter" from "${branchName}"`);
+		expect(gitPublishProcess.stdout).toContain('Required workspace dependencies');
+		expect(gitPublishProcess.stdout).toContain('@test/core');
+		expect(gitPublishProcess.stdout).toMatch(/@test\/core[^\n]*\(\d+(?:\.\d+)?(?:ms|s)\)/);
+		expect(gitPublishProcess.stdout).toContain('@test/broker');
+		expect(gitPublishProcess.stdout).toContain('@test/adapter');
+		expect(gitPublishProcess.stdout).toContain('Pushing 3 packages together');
+		expect(gitPublishProcess.stdout).not.toContain('workspace closure');
+		expect(gitPublishProcess.stdout.indexOf('→ Install command')).toBeGreaterThan(
+			gitPublishProcess.stdout.lastIndexOf(`Published "@test/adapter" from "${branchName}"`),
+		);
+		expect(gitPublishProcess.stdout.split('→ Install command')).toHaveLength(2);
+	});
+
+	test('retains publication success when cleanup fails', async () => {
+		const branchName = 'test-workspace-cleanup-failure';
+		await using fixture = await createChainWorkspace(branchName, remoteFixture.path);
+		await using hookFixture = await createFixture();
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'), [], {
+			NODE_OPTIONS: await createCleanupFailureHook(hookFixture),
+		});
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(await remoteGit('rev-parse', [`npm/${branchName}-@test/adapter`])).toBeTruthy();
+		expect(gitPublishProcess.stdout).toContain(`Published "@test/adapter" from "${branchName}"`);
+		expect(gitPublishProcess.stdout).toContain('Test cleanup failure at');
+		expect(gitPublishProcess.stdout).toContain('→ Install command');
+	});
+
+	test('ignores an outer workspace beyond the Git root', async () => {
+		await using nestedRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: nestedRemoteGit } = nestedRemoteFixture;
+		await using outerFixture = await createFixture({
+			'package.json': JSON.stringify({
+				name: 'outer-workspace',
+				private: true,
+				workspaces: ['packages/*'],
+			}, null, 2),
+			'package-lock.json': '{}',
+			packages: {
+				outer: {
+					'package.json': JSON.stringify({
+						name: '@test/outer',
+						version: '0.0.0',
+					}, null, 2),
+				},
+				inner: {
+					'package.json': JSON.stringify({
+						name: '@test/inner',
+						version: '0.0.0',
+					}, null, 2),
+					'index.js': 'module.exports = 1;',
+				},
+			},
+		});
+		const repositoryPath = outerFixture.getPath('packages/inner');
+		const git = createGit(repositoryPath);
+		await git.init(['--initial-branch=inner']);
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', nestedRemoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(repositoryPath);
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(gitPublishProcess.stdout).toContain('Publishing source "inner" → "npm/inner"');
+		expect(await nestedRemoteGit('show', ['npm/inner:package.json'])).toContain('@test/inner');
+	});
+
+	test('renders --branch for every package in a workspace closure', async () => {
+		await using branchRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: branchRemoteGit } = branchRemoteFixture;
+		await using fixture = await createChainWorkspace('test-workspace-derived-branches', branchRemoteFixture.path);
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'), ['--branch', 'preview/{package}']);
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		for (const branch of ['preview/@test/adapter', 'preview/@test/broker', 'preview/@test/core']) {
+			expect(await branchRemoteGit('rev-parse', [branch])).toMatch(/^[0-9a-f]{40}$/);
+		}
+	});
+
+	test('rejects a literal --branch for a multi-package workspace closure before creating refs', async () => {
+		await using collisionRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: collisionRemoteGit } = collisionRemoteFixture;
+		await using fixture = await createChainWorkspace('test-workspace-branch-collision', collisionRemoteFixture.path);
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'), ['--branch', 'preview']);
+
+		expect(('exitCode' in gitPublishProcess) && gitPublishProcess.exitCode).toBe(1);
+		expect(gitPublishProcess.stderr).toContain('renders "preview" for both "@test/core" and "@test/broker"');
+		expect(gitPublishProcess.stderr).toContain('Include {package}');
+		expect(await collisionRemoteGit('for-each-ref')).toBe('');
+	});
+
+	for (const {
+		title,
+		template,
+		error,
+	} of [
+			{
+				title: 'rejects unknown workspace branch template placeholders before creating refs',
+				template: 'preview/{version}',
+				error: 'Unknown branch template placeholder "{version}". Supported placeholders: {gitRef}, {gitSha}, {package}.',
+			},
+			{
+				title: 'rejects invalid rendered workspace branches before creating refs',
+				template: 'preview/invalid..{package}',
+				error: 'Invalid publish branch "preview/invalid..@test/core".',
+			},
+		]) {
+		test(title, async () => {
+			await using validationRemoteFixture = await createGitFixture(undefined, ['--bare']);
+			const { git: validationRemoteGit } = validationRemoteFixture;
+			await using fixture = await createChainWorkspace('test-workspace-template-validation', validationRemoteFixture.path);
+
+			const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'), ['--branch', template]);
+
+			expect(('exitCode' in gitPublishProcess) && gitPublishProcess.exitCode).toBe(1);
+			expect(gitPublishProcess.stderr).toContain(error);
+			expect(await validationRemoteGit('for-each-ref')).toBe('');
+		});
+	}
+
+	test('rejects {gitSha} without a source commit before creating refs', async () => {
+		await using sourceRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: sourceRemoteGit } = sourceRemoteFixture;
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-package',
+				version: '1.0.0',
+			}),
+		}, ['--initial-branch=main']);
+		await fixture.git('remote', ['add', 'origin', sourceRemoteFixture.path]);
+
+		const gitPublishProcess = await gitPublish(fixture.path, ['--branch', 'preview/{gitSha}']);
+
+		expect(('exitCode' in gitPublishProcess) && gitPublishProcess.exitCode).toBe(1);
+		expect(gitPublishProcess.stderr).toContain('Branch template "preview/{gitSha}" uses {gitSha}, but the source repository has no commit.');
+		expect(await sourceRemoteGit('for-each-ref')).toBe('');
+	});
+
+	test('reports workspace dependency planning errors', async () => {
+		const branchName = 'test-workspace-invalid-specification';
+		await using fixture = await createChainWorkspace(branchName, remoteFixture.path, {
+			adapterSpecification: 'workspace:',
+		});
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'));
+
+		expect(('exitCode' in gitPublishProcess) && gitPublishProcess.exitCode).toBe(1);
+		expect(gitPublishProcess.stderr).toContain('Unsupported workspace specification "workspace:"');
+		expect(gitPublishProcess.stderr).not.toContain('Pre-bundle these dependencies');
+	});
+
+	test('warns when workspace peers are excluded from publication', async () => {
+		const branchName = 'test-workspace-peer-diagnostic';
+		await using fixture = await createChainWorkspace(branchName, remoteFixture.path, {
+			peerSpecification: 'workspace:*',
+		});
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'));
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(gitPublishProcess.stderr).toContain('Internal workspace peer dependencies are not published');
+		expect(gitPublishProcess.stderr).toContain('"@test/adapter" declares "@test/core": "workspace:*" resolves to "@test/core"');
+	});
+
+	test('rejects multiple push URLs', async () => {
+		const branchName = 'test-workspace-push-urls';
+		await using secondPushFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: secondRemoteGit } = secondPushFixture;
+		await using fixture = await createChainWorkspace(branchName, remoteFixture.path);
+		const { git } = fixture;
+		await git('config', ['--add', 'remote.origin.pushurl', remoteFixture.path]);
+		await git('config', ['--add', 'remote.origin.pushurl', secondPushFixture.path]);
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'));
+
+		expect(('exitCode' in gitPublishProcess) && gitPublishProcess.exitCode).toBe(1);
+		expect(gitPublishProcess.stderr).toContain('requires exactly one push URL');
+		expect(await remoteGit('for-each-ref')).toBe('');
+		expect(await secondRemoteGit('for-each-ref')).toBe('');
+	});
+
+	test('uses the push destination tip for --fresh leases', async () => {
+		await using fetchRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		await using pushRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: pushRemoteGit } = pushRemoteFixture;
+		await using fixture = await createGitFixture({
+			'package.json': JSON.stringify({
+				name: 'test-monorepo',
+				private: true,
+				workspaces: ['packages/*'],
+			}, null, 2),
+			'package-lock.json': '{}',
+			packages: {
+				adapter: {
+					'package.json': JSON.stringify({
+						name: '@test/adapter',
+						version: '0.0.0',
+					}, null, 2),
+					'index.js': 'module.exports = 1;',
+				},
+			},
+		}, ['--initial-branch=test-workspace-fresh-push-url']);
+		const { git } = fixture;
+		await git('add', ['.']);
+		await git('commit', ['-m', 'Initial commit']);
+		await git('remote', ['add', 'origin', fetchRemoteFixture.path]);
+		await git('config', ['remote.origin.pushurl', pushRemoteFixture.path]);
+		await git('push', [pushRemoteFixture.path, 'HEAD:preview']);
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'), ['--branch', 'preview', '--fresh']);
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(await pushRemoteGit('show', ['preview:package.json'])).toContain('@test/adapter');
+	});
+
+	test('isolates packages from sibling lifecycle mutations', async () => {
+		await using isolatedRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: isolatedRemoteGit } = isolatedRemoteFixture;
+		await using fixture = await createChainWorkspace('test-workspace-pack-isolation', isolatedRemoteFixture.path, {
+			corePrepack: 'node -e "require(\'node:fs\').writeFileSync(\'../broker/index.js\', \'module.exports = 2;\')"',
+		});
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'));
+
+		expect('exitCode' in gitPublishProcess).toBe(false);
+		expect(await isolatedRemoteGit('show', ['npm/test-workspace-pack-isolation-@test/broker:index.js'])).toBe('module.exports = { core: require("@test/core") };');
+	});
+
+	test('does not update any package branch when an atomic push is rejected', async () => {
+		const branchName = 'test-workspace-atomic-rejection';
+		await using rejectedRemoteFixture = await createGitFixture(undefined, ['--bare']);
+		const { git: rejectedRemoteGit } = rejectedRemoteFixture;
+		const hookPath = path.join(rejectedRemoteFixture.path, 'hooks/pre-receive');
+		await fs.writeFile(hookPath, `#!/bin/sh
+		while read _ _ ref; do
+			if [ "$ref" = "refs/heads/npm/${branchName}-@test/adapter" ]; then
+				echo 'Adapter publication is rejected by this test hook' >&2
+				exit 1
+			fi
+		done
+`);
+		await fs.chmod(hookPath, 0o755);
+		await using fixture = await createChainWorkspace(branchName, rejectedRemoteFixture.path);
+
+		const gitPublishProcess = await gitPublish(path.join(fixture.path, 'packages/adapter'));
+
+		expect(('exitCode' in gitPublishProcess) && gitPublishProcess.exitCode).toBe(1);
+		expect(gitPublishProcess.stdout).toContain('Adapter publication is rejected by this test hook');
+		expect(await rejectedRemoteGit('for-each-ref')).toBe('');
+	});
+
+	test('uses the default workspace template and installs the selected package when pnpm allows Git subdependencies', async () => {
+		const branchName = 'test-workspace-acceptance';
+		const remoteUrl = `git@example.test:${remoteFixture.path}`;
+		const packageManagerRemoteUrl = `git+ssh://git@example.test/${remoteFixture.path}`;
+		await using commandsFixture = await createFixture(async (fixture) => {
+			await fixture.writeFile('ssh', `#!/bin/sh
+shift
+exec sh -c "$*"
+`);
+			await fixture.writeFile('upload-pack', `#!/bin/sh
+			if [ "$1" = "-G" ]; then
+				exit 0
+			fi
+			exec git-upload-pack '${remoteFixture.path}'
+`);
+			await fs.chmod(fixture.getPath('ssh'), 0o755);
+			await fs.chmod(fixture.getPath('upload-pack'), 0o755);
+		});
+		await using fixture = await createChainWorkspace(branchName, remoteUrl);
+		const { git } = fixture;
+		await git('config', ['core.sshCommand', commandsFixture.getPath('ssh')]);
+		await git('config', ['ssh.variant', 'simple']);
+
+		const adapterPath = path.join(fixture.path, 'packages/adapter');
+		const gitPublishProcess = await gitPublish(adapterPath);
+		expect('exitCode' in gitPublishProcess).toBe(false);
+
+		const branches = {
+			core: `npm/${branchName}-@test/core`,
+			broker: `npm/${branchName}-@test/broker`,
+			adapter: `npm/${branchName}-@test/adapter`,
+		};
+		const shas = {
+			core: await remoteGit('rev-parse', [branches.core]),
+			broker: await remoteGit('rev-parse', [branches.broker]),
+			adapter: await remoteGit('rev-parse', [branches.adapter]),
+		};
+		for (const sha of Object.values(shas)) {
+			expect(sha).toMatch(/^[0-9a-f]{40}$/);
+		}
+		for (const [name, branch] of Object.entries(branches)) {
+			const manifest = JSON.parse(await remoteGit('show', [`${branch}:package.json`]));
+			expect(manifest.name).toBe(`@test/${name}`);
+		}
+
+		const brokerManifest = JSON.parse(await remoteGit('show', [`${branches.broker}:package.json`]));
+		expect(brokerManifest.dependencies['@test/core']).toBe(`${packageManagerRemoteUrl}#${shas.core}`);
+		const adapterManifest = JSON.parse(await remoteGit('show', [`${branches.adapter}:package.json`]));
+		expect(adapterManifest.dependencies['@test/broker']).toBe(`${packageManagerRemoteUrl}#${shas.broker}`);
+
+		const adapterSpecifier = `${packageManagerRemoteUrl}#${shas.adapter}`;
+		expect(gitPublishProcess.stdout).toContain(`i '${adapterSpecifier}'`);
+
+		await using consumerFixture = await createFixture({
+			'package.json': JSON.stringify({
+				name: 'test-consumer',
+				version: '1.0.0',
+				dependencies: {
+					'@test/adapter': adapterSpecifier,
+				},
+			}),
+		});
+		await spawn('pnpm', ['install', '--ignore-scripts'], {
+			cwd: consumerFixture.path,
+			env: {
+				PATH: process.env.PATH,
+				GIT_SSH_COMMAND: commandsFixture.getPath('upload-pack'),
+				// pnpm blocks Git dependencies of Git dependencies unless the consumer opts in.
+				PNPM_CONFIG_BLOCK_EXOTIC_SUBDEPS: 'false',
+			},
+		});
+
+		const resolved = await spawn('node', ['-e', 'console.log(require("@test/adapter").broker.core.core)'], {
+			cwd: consumerFixture.path,
+		});
+		expect(resolved.stdout).toBe('1');
+
+		const lockfile = await consumerFixture.readFile('pnpm-lock.yaml', 'utf8');
+		expect(lockfile).not.toContain('registry.npmjs.org');
+		for (const sha of Object.values(shas)) {
+			expect(lockfile).toContain(sha);
+		}
+	});
+});
diff --git a/tests/utils/create-cleanup-failure-hook.ts b/tests/utils/create-cleanup-failure-hook.ts
new file mode 100644
index 0000000..97b3380
--- /dev/null
+++ b/tests/utils/create-cleanup-failure-hook.ts
@@ -0,0 +1,18 @@
+import type { FsFixture } from 'fs-fixture';
+
+export const createCleanupFailureHook = async (fixture: FsFixture) => {
+	const hookPath = fixture.getPath('fail-cleanup.mjs');
+	await fixture.writeFile('fail-cleanup.mjs', `
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+const remove = fs.rm;
+fs.rm = async (target, options) => {
+	if (path.basename(String(target)).startsWith('git-publish-')) {
+		throw new Error('Test cleanup failure at ' + target);
+	}
+	return remove(target, options);
+};
+`);
+	return `--import=${hookPath}`;
+};