`@workglow/aws` and `@workglow/cloudflare` are `private: true` at 0.4.9 — thirteen releases of versioning two packages nobody can install

[sroussey]

What

$ python3 -c "import json;d=json.load(open('providers/aws/package.json'));print({k:d.get(k) for k in ['name','version','private','description']})"
{'name': '@workglow/aws', 'version': '0.4.9', 'private': True, 'description': 'AWS backends for @workglow/job-queue (SQS).'}

$ python3 -c "import json;d=json.load(open('providers/cloudflare/package.json'));print({k:d.get(k) for k in ['name','version','private','description']})"
{'name': '@workglow/cloudflare', 'version': '0.4.9', 'private': True, 'description': 'Cloudflare backends for @workglow/job-queue (Queues).'}

package.json:55 is bunset --patch --all --push --commit --tag --sections=all --release, so --all bumps both on every cut regardless of private. They have now been carried from 0.3.x to 0.4.9 — thirteen consecutive releases — and publish-workspaces.ts skips them, so no version of either has ever been installable.

They are not stubs, and this is the point

Both are finished, tested queue backends, not placeholders:

providers/aws/src/job-queue/         SqsMessageQueue.ts  SqsClaim.ts  createSqsQueue.ts  persistWithRetry.ts  types.ts
providers/cloudflare/src/job-queue/  CloudflareMessageQueue.ts  CloudflareClaim.ts  createCloudflareQueue.ts  handleQueueBatch.ts  persistWithRetry.ts  types.ts

They ride the shared cross-backend contract suite —
packages/test/src/test/aws/job-queue/SqsGenericQueue.test.ts and
packages/test/src/test/cloudflare/job-queue/CloudflareGenericQueue.test.ts both call runGenericJobQueueTests, alongside the InMemory / SQLite / Postgres / IndexedDb / Supabase backends — and they are in the typecheck budget (scripts/typecheck-budget.json:21,25). Executed at fb861bb:

$ npx vitest run packages/test/src/test/aws packages/test/src/test/cloudflare
 Test Files  12 passed (12)
      Tests  56 passed (56)

Discovery counts them as their own sections (aws 6 files, cloudflare 7), and both are selected by a CI job — they are not among the 11 CI-invisible files. So this is two fully-conforming backends held back by one flag.

Ask

Decide, and record the decision:

• Publish them. Drop private: true, and the next release makes an SQS-backed and a Cloudflare-Queues-backed job-queue available to consumers who today have to vendor the source. Both already meet the bar every published backend meets.
• Or exclude them from versioning. If they are deliberately unreleased, --all should skip private packages so their version field stops advancing and their CHANGELOG.md stops accruing sections for releases that never shipped (providers/aws/CHANGELOG.md gained 16 lines this window for exactly this reason). This overlaps #854 and #874 were closed with no mechanism added, and three more breaking changes shipped as patches in the six days since #903's item 3.

Either is fine. What is not fine is a thirteenth cycle in which the version number says something happened and nothing did.

Found during the 2026-09-07 review of providers/. Verified against origin/main @ fb861bb.