publish: should not be possible to publish a public package which depends on a private package

Recently I moved istanbuljs over to a monorepo;

I was attempting the initial publication of the repository, and didn't yet have publication rights on npm for append-transform; to allow myself to publish several updates that were enqueued, I tried setting private=true in the append-transform repo -- my assumption being that this would skip attempting to publish this one module.

This worked like a charm, unfortunately it also published the modules that depended on append-transform with an un-installable version #:

https://github.com/facebook/jest/issues/3179

Expected Behavior

• throw an exception rather than publishing a package that depends on a private repo.
• in general, it would be nice to have a helper that allows flagged publications to be skipped (how could I have easily indicated that I didn't actually want to publish append-transform or its dependents after the initial import?

Current Behavior

Lerna hapily publishes a broken versions of any modules that depend on a private repo.