@varlock/bumpy 0.0.1 → 1.0.0

package/.claude-plugin/plugin.json

@@ -1,13 +1,13 @@
 {
   "name": "bumpy",
   "version": "0.0.1",
-  "description": "AI-assisted changeset creation for bumpy monorepo versioning",
+  "description": "AI-assisted bump file creation for bumpy monorepo versioning",
   "author": {
     "name": "DMNO",
     "url": "https://github.com/dmno-dev"
   },
   "repository": "https://github.com/dmno-dev/bumpy",
   "license": "MIT",
-  "keywords": ["monorepo", "versioning", "changelog", "changesets"],
+  "keywords": ["monorepo", "versioning", "changelog", "bump-files"],
   "skills": "./skills/"
 }

package/dist/add-CgCjs4d-.mjs

@@ -0,0 +1,313 @@
+import { n as log, o as __toESM, r as require_picocolors } from "./logger-C2dEe5Su.mjs";
+import { n as exists, t as ensureDir } from "./fs-DYR2XuFE.mjs";
+import { a as loadConfig, r as getBumpyDir, s as matchGlob } from "./config-XZWUL3ma.mjs";
+import { t as discoverPackages } from "./workspace-C5ULTyUN.mjs";
+import { t as DependencyGraph } from "./dep-graph-E-9-eQ2J.mjs";
+import { i as writeBumpFile } from "./bump-file-CCLXMLA8.mjs";
+import { n as getChangedFiles } from "./git-CGHVXXKw.mjs";
+import { c as ot, d as yt, i as _t, l as pt, o as gt, r as Ot, s as mt, t as unwrap, u as wt } from "./clack-CDRCHrC-.mjs";
+import { n as slugify, t as randomName } from "./names-9VubBmL0.mjs";
+import { relative, resolve } from "node:path";
+import * as readline from "node:readline";
+//#region src/prompts/bump-select.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+const LEVELS = [
+	"none",
+	"patch",
+	"minor",
+	"major"
+];
+/**
+* Custom interactive prompt for selecting bump levels for multiple packages.
+* - Up/Down arrows to navigate between packages
+* - Left/Right arrows to change the bump level
+* - Changed packages default to "patch", unchanged to "none"
+* - Enter to confirm
+* - Ctrl+C / Escape to cancel
+*/
+async function bumpSelectPrompt(items) {
+	const changedEntries = items.map((item, idx) => ({
+		item,
+		idx
+	})).filter(({ item }) => item.changed);
+	const unchangedEntries = items.map((item, idx) => ({
+		item,
+		idx
+	})).filter(({ item }) => !item.changed);
+	const displayOrder = [...changedEntries, ...unchangedEntries];
+	let cursor = 0;
+	const levels = items.map((item) => item.changed ? "patch" : "none");
+	return new Promise((resolve) => {
+		const { stdin, stdout } = process;
+		const rl = readline.createInterface({
+			input: stdin,
+			terminal: true
+		});
+		stdout.write("\x1B[?25l");
+		let renderedLines = 0;
+		function render(final = false) {
+			if (renderedLines > 0) {
+				stdout.write(`\x1B[${renderedLines}A`);
+				stdout.write("\x1B[0J");
+			}
+			const lines = [];
+			if (final) {
+				lines.push(`${import_picocolors.default.green("◇")}  Bump levels selected`);
+				const selected = displayOrder.filter(({ idx }) => levels[idx] !== "none");
+				if (selected.length === 0) lines.push(`${import_picocolors.default.dim("│")}  ${import_picocolors.default.dim("(none)")}`);
+				else for (const { item, idx } of selected) lines.push(`${import_picocolors.default.dim("│")}  ${import_picocolors.default.cyan(item.name)} ${import_picocolors.default.dim("→")} ${import_picocolors.default.bold(levels[idx])}`);
+				lines.push(import_picocolors.default.dim("│"));
+			} else {
+				lines.push(`${import_picocolors.default.cyan("◆")}  Select bump levels`);
+				lines.push(`${import_picocolors.default.dim("│")}  ${import_picocolors.default.dim("↑/↓ navigate · ←/→ change level · enter to confirm")}`);
+				lines.push(`${import_picocolors.default.dim("│")}  ${import_picocolors.default.dim("0 clear current · x clear all · r reset all to defaults")}`);
+				lines.push(import_picocolors.default.dim("│"));
+				let displayIdx = 0;
+				if (changedEntries.length > 0) {
+					lines.push(`${import_picocolors.default.dim("│")}  ${import_picocolors.default.underline("Changed")}`);
+					for (const { item, idx } of changedEntries) {
+						lines.push(formatRow(item, levels[idx], cursor === displayIdx));
+						displayIdx++;
+					}
+					if (unchangedEntries.length > 0) lines.push(import_picocolors.default.dim("│"));
+				}
+				if (unchangedEntries.length > 0) {
+					lines.push(`${import_picocolors.default.dim("│")}  ${import_picocolors.default.underline("Unchanged")}`);
+					for (const { item, idx } of unchangedEntries) {
+						lines.push(formatRow(item, levels[idx], cursor === displayIdx));
+						displayIdx++;
+					}
+				}
+				lines.push(import_picocolors.default.dim("│"));
+				const selectedCount = levels.filter((l) => l !== "none").length;
+				lines.push(`${import_picocolors.default.dim("│")}  ${import_picocolors.default.dim(`${selectedCount} package${selectedCount !== 1 ? "s" : ""} selected`)}`);
+				lines.push(`${import_picocolors.default.dim("└")}`);
+			}
+			const output = lines.join("\n") + "\n";
+			stdout.write(output);
+			renderedLines = lines.length;
+		}
+		function cleanup() {
+			rl.close();
+			stdout.write("\x1B[?25h");
+			if (stdin.isTTY) stdin.setRawMode(false);
+		}
+		function finish(result) {
+			render(true);
+			cleanup();
+			resolve(result);
+		}
+		if (stdin.isTTY) stdin.setRawMode(true);
+		stdin.resume();
+		render();
+		stdin.on("keypress", (_str, key) => {
+			if (!key) return;
+			if (key.name === "escape" || key.ctrl && key.name === "c") {
+				cleanup();
+				if (renderedLines > 0) {
+					stdout.write(`\x1B[${renderedLines}A`);
+					stdout.write("\x1B[0J");
+				}
+				stdout.write(`${import_picocolors.default.red("■")}  Cancelled\n`);
+				resolve(Symbol("cancel"));
+				return;
+			}
+			if (key.name === "return") {
+				const results = [];
+				for (let i = 0; i < items.length; i++) if (levels[i] !== "none") results.push({
+					name: items[i].name,
+					type: levels[i]
+				});
+				finish(results);
+				return;
+			}
+			if (key.name === "up" || key.name === "k") cursor = (cursor - 1 + displayOrder.length) % displayOrder.length;
+			else if (key.name === "down" || key.name === "j") cursor = (cursor + 1) % displayOrder.length;
+			else if (key.name === "right" || key.name === "l") {
+				const entry = displayOrder[cursor];
+				const currentLevel = LEVELS.indexOf(levels[entry.idx]);
+				if (currentLevel < LEVELS.length - 1) levels[entry.idx] = LEVELS[currentLevel + 1];
+			} else if (key.name === "left" || key.name === "h") {
+				const entry = displayOrder[cursor];
+				const currentLevel = LEVELS.indexOf(levels[entry.idx]);
+				if (currentLevel > 0) levels[entry.idx] = LEVELS[currentLevel - 1];
+			} else if (_str === "0" || key.name === "backspace") {
+				const entry = displayOrder[cursor];
+				levels[entry.idx] = "none";
+			} else if (_str === "r") for (let i = 0; i < items.length; i++) levels[i] = items[i].changed ? "patch" : "none";
+			else if (_str === "x") for (let i = 0; i < items.length; i++) levels[i] = "none";
+			render();
+		});
+		readline.emitKeypressEvents(stdin, rl);
+	});
+}
+function formatRow(item, level, focused) {
+	return `${import_picocolors.default.dim("│")}  ${focused ? import_picocolors.default.cyan("›") : " "} ${focused ? import_picocolors.default.cyan(item.name) : item.name} ${import_picocolors.default.dim(`(${item.version})`)}  ${formatLevel(level, focused)}`;
+}
+function formatLevel(level, focused) {
+	if (!focused) {
+		if (level === "none") return import_picocolors.default.dim("·");
+		if (level === "major") return import_picocolors.default.red(level);
+		if (level === "minor") return import_picocolors.default.yellow(level);
+		return import_picocolors.default.green(level);
+	}
+	return `◄ ${LEVELS.map((l) => {
+		if (l === level) {
+			if (l === "none") return import_picocolors.default.bold(import_picocolors.default.dim("[none]"));
+			if (l === "major") return import_picocolors.default.bold(import_picocolors.default.red(`[${l}]`));
+			if (l === "minor") return import_picocolors.default.bold(import_picocolors.default.yellow(`[${l}]`));
+			return import_picocolors.default.bold(import_picocolors.default.green(`[${l}]`));
+		}
+		return import_picocolors.default.dim(l);
+	}).join(import_picocolors.default.dim(" · "))} ►`;
+}
+//#endregion
+//#region src/commands/add.ts
+const CASCADE_CHOICES = [
+	{
+		label: "patch",
+		value: "patch"
+	},
+	{
+		label: "minor",
+		value: "minor"
+	},
+	{
+		label: "major",
+		value: "major"
+	}
+];
+async function addCommand(rootDir, opts) {
+	const config = await loadConfig(rootDir);
+	const bumpyDir = getBumpyDir(rootDir);
+	await ensureDir(bumpyDir);
+	if (opts.empty) {
+		const filename = opts.name ? slugify(opts.name) : randomName();
+		const filePath = resolve(bumpyDir, `${filename}.md`);
+		const { writeText } = await import("./fs-DYR2XuFE.mjs").then((n) => n.r);
+		await writeText(filePath, "---\n---\n");
+		log.success(`Created empty bump file: .bumpy/${filename}.md`);
+		return;
+	}
+	let releases;
+	let summary;
+	let filename;
+	if (opts.packages) {
+		releases = parsePackagesFlag(opts.packages);
+		summary = opts.message || "";
+		filename = opts.name ? slugify(opts.name) : randomName();
+	} else {
+		mt(import_picocolors.default.bgCyan(import_picocolors.default.black(" bumpy add ")));
+		const pkgs = await discoverPackages(rootDir, config);
+		const depGraph = new DependencyGraph(pkgs);
+		if (pkgs.size === 0) {
+			pt("No managed packages found in this workspace.");
+			process.exit(1);
+		}
+		const baseBranch = config.baseBranch;
+		const changedFiles = getChangedFiles(rootDir, baseBranch);
+		const changedPackageNames = /* @__PURE__ */ new Set();
+		for (const file of changedFiles) for (const [name, pkg] of pkgs) {
+			const pkgRelDir = relative(rootDir, pkg.dir);
+			if (file.startsWith(pkgRelDir + "/")) changedPackageNames.add(name);
+		}
+		const bumpSelectResult = await bumpSelectPrompt([...pkgs.values()].map((pkg) => ({
+			name: pkg.name,
+			version: pkg.version,
+			changed: changedPackageNames.has(pkg.name)
+		})));
+		if (typeof bumpSelectResult === "symbol") {
+			pt("Aborted");
+			process.exit(0);
+		}
+		const bumpSelections = bumpSelectResult;
+		if (bumpSelections.length === 0) {
+			pt("No packages selected.");
+			process.exit(0);
+		}
+		releases = [];
+		for (const { name, type: bumpType } of bumpSelections) {
+			const release = {
+				name,
+				type: bumpType
+			};
+			{
+				const dependents = depGraph.getDependents(name);
+				const cascadeTargets = pkgs.get(name).bumpy?.cascadeTo;
+				if (dependents.length > 0 || cascadeTargets) {
+					if (unwrap(await ot({
+						message: `${import_picocolors.default.cyan(name)} has ${import_picocolors.default.bold(String(dependents.length))} dependents. Specify explicit cascades?`,
+						initialValue: false
+					}))) {
+						const allTargets = /* @__PURE__ */ new Set();
+						for (const d of dependents) allTargets.add(d.name);
+						if (cascadeTargets) {
+							for (const pattern of Object.keys(cascadeTargets)) for (const [pName] of pkgs) if (matchGlob(pName, pattern)) allTargets.add(pName);
+						}
+						const cascadeSelected = unwrap(await yt({
+							message: "Which packages should cascade?",
+							options: [...allTargets].map((n) => ({
+								label: n,
+								value: n
+							})),
+							required: false
+						}));
+						if (cascadeSelected.length > 0) {
+							const cascadeBump = unwrap(await _t({
+								message: "Cascade bump type",
+								options: CASCADE_CHOICES
+							}));
+							const cascade = {};
+							for (const target of cascadeSelected) cascade[target] = cascadeBump;
+							release.cascade = cascade;
+						}
+					}
+				}
+			}
+			releases.push(release);
+		}
+		summary = unwrap(await Ot({
+			message: "Summary (what changed and why)",
+			placeholder: "A short description of the change",
+			validate: (value) => {
+				if (!value || !value.trim()) return "Summary is required";
+			}
+		}));
+		const defaultName = randomName();
+		filename = slugify(unwrap(await Ot({
+			message: "Bump file name",
+			placeholder: defaultName,
+			defaultValue: defaultName,
+			validate: (value) => {
+				if (!value) return void 0;
+				if (!slugify(value)) return "Name must contain at least one alphanumeric character";
+			}
+		}))) || defaultName;
+	}
+	if (await exists(resolve(bumpyDir, `${filename}.md`))) filename = `${filename}-${Date.now()}`;
+	await writeBumpFile(rootDir, filename, releases, summary);
+	if (opts.packages) {
+		log.success(`Created bump file: .bumpy/${filename}.md`);
+		for (const r of releases) log.dim(`  ${r.name}: ${r.type}${formatCascade(r)}`);
+	} else {
+		wt(releases.map((r) => `${import_picocolors.default.cyan(r.name)} ${import_picocolors.default.dim("→")} ${import_picocolors.default.bold(r.type)}${formatCascade(r)}`).join("\n"), "Bump file");
+		gt(import_picocolors.default.green(`Created .bumpy/${filename}.md`));
+	}
+}
+function formatCascade(r) {
+	if (!("cascade" in r) || Object.keys(r.cascade).length === 0) return "";
+	const parts = Object.entries(r.cascade).map(([k, v]) => `${k}:${v}`);
+	return import_picocolors.default.dim(` (cascade: ${parts.join(", ")})`);
+}
+function parsePackagesFlag(input) {
+	return input.split(",").map((entry) => {
+		const [name, type] = entry.trim().split(":");
+		if (!name || !type) throw new Error(`Invalid package format: "${entry}". Expected "name:bumpType"`);
+		return {
+			name: name.trim(),
+			type: type.trim()
+		};
+	});
+}
+//#endregion
+export { addCommand };

package/dist/{ai-B8ZL2x8z.mjs → ai-sMYUf3lP.mjs}

@@ -1,10 +1,12 @@
-import { n as log } from "./logger-ZqggsyGZ.mjs";
-import { l as writeText, n as exists, t as ensureDir } from "./fs-DbNNEyzq.mjs";
+import { n as log } from "./logger-C2dEe5Su.mjs";
+import { d as writeText, n as exists, t as ensureDir } from "./fs-DYR2XuFE.mjs";
 import { dirname, resolve } from "node:path";
 import { readFile } from "node:fs/promises";
+import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 //#region src/commands/ai.ts
 const SUPPORTED_TARGETS = [
+	"claude",
 	"opencode",
 	"cursor",
 	"codex"
@@ -13,13 +15,16 @@ async function aiSetupCommand(rootDir, opts) {
 	const target = opts.target;
 	if (!target) {
 		log.error(`Please specify a target: bumpy ai setup --target <${SUPPORTED_TARGETS.join("|")}>`);
-		log.dim("  Claude Code users: install the plugin instead — claude plugin install @varlock/bumpy");
 		process.exit(1);
 	}
 	if (!SUPPORTED_TARGETS.includes(target)) {
 		log.error(`Unknown target: "${target}". Supported: ${SUPPORTED_TARGETS.join(", ")}`);
 		process.exit(1);
 	}
+	if (target === "claude") {
+		setupClaude();
+		return;
+	}
 	const promptContent = await loadPromptTemplate();
 	switch (target) {
 		case "opencode":
@@ -36,6 +41,18 @@ async function aiSetupCommand(rootDir, opts) {
 async function loadPromptTemplate() {
 	return (await readFile(resolve(dirname(fileURLToPath(import.meta.url)), "../../skills/add-change/SKILL.md"), "utf-8")).replace(/^---\n[\s\S]*?\n---\n\n?/, "");
 }
+/** Install as a Claude Code plugin */
+function setupClaude() {
+	log.step("Installing Claude Code plugin...");
+	try {
+		execSync("claude plugin install @varlock/bumpy", { stdio: "inherit" });
+		log.success("Installed Claude Code plugin");
+		log.dim("  Usage: /bumpy:add-change in Claude Code");
+	} catch {
+		log.error("Failed to install Claude Code plugin. Make sure `claude` is installed and available in your PATH.");
+		process.exit(1);
+	}
+}
 /** Install as an OpenCode custom command */
 async function setupOpenCode(rootDir, promptContent) {
 	const commandsDir = resolve(rootDir, ".opencode", "commands");
@@ -43,7 +60,7 @@ async function setupOpenCode(rootDir, promptContent) {
 	await ensureDir(commandsDir);
 	if (await exists(targetPath)) log.warn(".opencode/commands/add-bumpy-change.md already exists — overwriting");
 	await writeText(targetPath, `---
-description: Create a bumpy changeset to track package version bumps
+description: Create a bumpy bump file to track package version bumps
 ---
 
 ${promptContent}`);
@@ -58,7 +75,7 @@ async function setupCursor(rootDir, promptContent) {
 	await ensureDir(rulesDir);
 	if (await exists(targetPath)) log.warn(".cursor/rules/add-bumpy-change.mdc already exists — overwriting");
 	await writeText(targetPath, `---
-description: Create a bumpy changeset to track package version bumps
+description: Create a bumpy bump file to track package version bumps
 globs:
 alwaysApply: false
 ---

package/dist/{apply-release-plan-DtU3rVyL.mjs → apply-release-plan-CczGWJTk.mjs}

@@ -1,33 +1,34 @@
-import { n as log } from "./logger-ZqggsyGZ.mjs";
-import { a as readJson, c as writeJson, l as writeText, n as exists, o as readText } from "./fs-DbNNEyzq.mjs";
-import { t as deleteChangesets } from "./changeset-ClCYsChu.mjs";
-import { resolve } from "node:path";
+import { n as log } from "./logger-C2dEe5Su.mjs";
+import { a as readJson, c as updateJsonFields, d as writeText, l as updateJsonNestedField, n as exists, o as readText } from "./fs-DYR2XuFE.mjs";
+import { t as deleteBumpFiles } from "./bump-file-CCLXMLA8.mjs";
+import { relative, resolve } from "node:path";
+import { realpathSync } from "node:fs";
 //#region src/core/changelog.ts
 /** Default formatter — version heading, date, bullet points */
 const defaultFormatter = (ctx) => {
-	const { release, changesets, date } = ctx;
+	const { release, bumpFiles, date } = ctx;
 	const lines = [];
 	lines.push(`## ${release.newVersion}`);
 	lines.push("");
 	lines.push(`_${date}_`);
 	lines.push("");
-	const relevantChangesets = changesets.filter((cs) => release.changesets.includes(cs.id));
-	if (relevantChangesets.length > 0) {
-		for (const cs of relevantChangesets) if (cs.summary) {
-			const summaryLines = cs.summary.split("\n");
+	const relevantBumpFiles = bumpFiles.filter((bf) => release.bumpFiles.includes(bf.id));
+	if (relevantBumpFiles.length > 0) {
+		for (const bf of relevantBumpFiles) if (bf.summary) {
+			const summaryLines = bf.summary.split("\n");
 			lines.push(`- ${summaryLines[0]}`);
 			for (let i = 1; i < summaryLines.length; i++) if (summaryLines[i].trim()) lines.push(`  ${summaryLines[i]}`);
 		}
 	}
-	if (release.isDependencyBump && relevantChangesets.length === 0) lines.push("- Updated dependencies");
-	if (release.isCascadeBump && !release.isDependencyBump && relevantChangesets.length === 0) lines.push("- Version bump via cascade rule");
+	if (release.isDependencyBump && relevantBumpFiles.length === 0) lines.push("- Updated dependencies");
+	if (release.isCascadeBump && !release.isDependencyBump && relevantBumpFiles.length === 0) lines.push("- Version bump via cascade rule");
 	lines.push("");
 	return lines.join("\n");
 };
 const BUILTIN_FORMATTERS = {
 	default: defaultFormatter,
 	github: async () => {
-		const { createGithubFormatter } = await import("./changelog-github-n-3zV1p9.mjs");
+		const { createGithubFormatter } = await import("./changelog-github-Cd8uJHZI.mjs");
 		return createGithubFormatter();
 	}
 };
@@ -37,17 +38,26 @@ const BUILTIN_FORMATTERS = {
 */
 async function loadFormatter(changelog, rootDir) {
 	const [name, options] = Array.isArray(changelog) ? changelog : [changelog, {}];
+	if (name === "github") {
+		const { createGithubFormatter } = await import("./changelog-github-Cd8uJHZI.mjs");
+		return createGithubFormatter(options);
+	}
 	if (typeof name === "string" && BUILTIN_FORMATTERS[name]) {
 		const builtin = BUILTIN_FORMATTERS[name];
 		if (typeof builtin === "function" && builtin.length === 0) return builtin();
 		return builtin;
 	}
-	if (name === "github") {
-		const { createGithubFormatter } = await import("./changelog-github-n-3zV1p9.mjs");
-		return createGithubFormatter(options);
-	}
 	if (typeof name === "string") try {
-		const mod = await (name.startsWith(".") ? import(resolve(rootDir, name)) : import(name));
+		let modulePath;
+		if (name.startsWith(".")) {
+			modulePath = resolve(rootDir, name);
+			try {
+				modulePath = realpathSync(modulePath);
+			} catch {}
+			const rel = relative(realpathSync(rootDir), modulePath);
+			if (rel.startsWith("..") || resolve("/", rel) === resolve("/")) throw new Error(`Changelog formatter path "${name}" resolves outside the project root`);
+		} else modulePath = name;
+		const mod = await import(modulePath);
 		const exported = mod.default || mod.changelogFormatter;
 		if (typeof exported === "function") {
 			const result = exported(options);
@@ -63,10 +73,10 @@ async function loadFormatter(changelog, rootDir) {
 	return defaultFormatter;
 }
 /** Generate a changelog entry using the configured formatter */
-async function generateChangelogEntry(release, changesets, formatter = defaultFormatter, date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0]) {
+async function generateChangelogEntry(release, bumpFiles, formatter = defaultFormatter, date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0]) {
 	return formatter({
 		release,
-		changesets,
+		bumpFiles,
 		date
 	});
 }
@@ -82,14 +92,14 @@ function prependToChangelog(existingContent, newEntry) {
 }
 //#endregion
 //#region src/core/apply-release-plan.ts
-/** Apply the release plan: bump versions, update changelogs, delete changesets */
+/** Apply the release plan: bump versions, update changelogs, delete bump files */
 async function applyReleasePlan(releasePlan, packages, rootDir, config) {
 	const releaseMap = new Map(releasePlan.releases.map((r) => [r.name, r]));
 	const formatter = await loadFormatter(config.changelog, rootDir);
 	for (const release of releasePlan.releases) {
 		const pkgJsonPath = resolve(packages.get(release.name).dir, "package.json");
 		const pkgJson = await readJson(pkgJsonPath);
-		pkgJson.version = release.newVersion;
+		await updateJsonFields(pkgJsonPath, { version: release.newVersion });
 		for (const depField of [
 			"dependencies",
 			"devDependencies",
@@ -101,19 +111,18 @@ async function applyReleasePlan(releasePlan, packages, rootDir, config) {
 			for (const [depName, range] of Object.entries(deps)) {
 				const depRelease = releaseMap.get(depName);
 				if (!depRelease) continue;
-				deps[depName] = updateRange(range, depRelease.newVersion);
+				await updateJsonNestedField(pkgJsonPath, depField, depName, updateRange(range, depRelease.newVersion));
 			}
 		}
-		await writeJson(pkgJsonPath, pkgJson);
 	}
 	for (const release of releasePlan.releases) {
 		const changelogPath = resolve(packages.get(release.name).dir, "CHANGELOG.md");
-		const entry = await generateChangelogEntry(release, releasePlan.changesets, formatter);
+		const entry = await generateChangelogEntry(release, releasePlan.bumpFiles, formatter);
 		let existingContent = "";
 		if (await exists(changelogPath)) existingContent = await readText(changelogPath);
 		await writeText(changelogPath, prependToChangelog(existingContent, entry));
 	}
-	await deleteChangesets(rootDir, releasePlan.changesets.map((cs) => cs.id));
+	await deleteBumpFiles(rootDir, releasePlan.bumpFiles.map((bf) => bf.id));
 }
 /** Update a version range to include a new version, preserving the range prefix */
 function updateRange(range, newVersion) {

package/dist/bump-file-CCLXMLA8.mjs

@@ -0,0 +1,143 @@
+import { n as log } from "./logger-C2dEe5Su.mjs";
+import { d as writeText, i as listFiles, o as readText, s as removeFile } from "./fs-DYR2XuFE.mjs";
+import { r as getBumpyDir } from "./config-XZWUL3ma.mjs";
+import { t as jsYaml } from "./js-yaml-DpZfOoD4.mjs";
+import { o as tryRunArgs } from "./shell-Dj7JRD_q.mjs";
+import { resolve } from "node:path";
+//#region src/core/bump-file.ts
+const VALID_BUMP_TYPES = new Set([
+	"major",
+	"minor",
+	"patch",
+	"none"
+]);
+/**
+* Reject package names that contain characters which could cause injection
+* when used in git tags, markdown, URLs, or shell-quoted strings.
+* Intentionally permissive — we don't enforce npm naming rules because
+* bumpy may be used with other registries or non-JS packages.
+*/
+function validatePackageName(name) {
+	if (!name || name.length > 214) return false;
+	if (/[\u0000-\u001f\u007f]/.test(name)) return false;
+	if (/[<>"'`&;|$(){}[\]\\!#%\s]/.test(name)) return false;
+	if (name.startsWith("-")) return false;
+	return true;
+}
+/** Read all bump files from .bumpy/ directory, sorted by git creation order */
+async function readBumpFiles(rootDir) {
+	const dir = getBumpyDir(rootDir);
+	const files = await listFiles(dir, ".md");
+	const bumpFiles = [];
+	for (const file of files) {
+		if (file === "README.md") continue;
+		const bf = await parseBumpFileFromPath(resolve(dir, file));
+		if (bf) bumpFiles.push(bf);
+	}
+	const creationOrder = getBumpFileCreationOrder(rootDir);
+	if (creationOrder.size > 0) bumpFiles.sort((a, b) => {
+		return (creationOrder.get(a.id) ?? Infinity) - (creationOrder.get(b.id) ?? Infinity) || a.id.localeCompare(b.id);
+	});
+	return bumpFiles;
+}
+/**
+* Use `git log` to get the commit timestamp when each bump file was first added.
+* Returns a map of bump file ID → unix timestamp (seconds).
+*/
+function getBumpFileCreationOrder(rootDir) {
+	const order = /* @__PURE__ */ new Map();
+	const result = tryRunArgs([
+		"git",
+		"log",
+		"--diff-filter=A",
+		"--format=%at",
+		"--name-only",
+		"--",
+		".bumpy/*.md"
+	], { cwd: rootDir });
+	if (!result) return order;
+	let currentTimestamp = 0;
+	for (const line of result.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		if (/^\d+$/.test(trimmed)) currentTimestamp = parseInt(trimmed, 10);
+		else if (trimmed.startsWith(".bumpy/") && trimmed.endsWith(".md")) {
+			const id = trimmed.replace(/^\.bumpy\//, "").replace(/\.md$/, "");
+			order.set(id, currentTimestamp);
+		}
+	}
+	return order;
+}
+/** Parse a single bump file from disk */
+async function parseBumpFileFromPath(filePath) {
+	return parseBumpFile(await readText(filePath), fileToId(filePath));
+}
+/** Parse bump file content (for testing) */
+function parseBumpFile(content, id) {
+	const match = content.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+	if (!match) return null;
+	const frontmatter = match[1];
+	const summary = match[2].trim();
+	const parsed = jsYaml.load(frontmatter);
+	if (!parsed || typeof parsed !== "object") return null;
+	const releases = [];
+	for (const [name, value] of Object.entries(parsed)) {
+		if (!validatePackageName(name)) {
+			log.warn(`Skipping invalid package name in bump file "${id}": ${name}`);
+			continue;
+		}
+		if (typeof value === "string") {
+			if (!VALID_BUMP_TYPES.has(value)) {
+				log.warn(`Skipping unknown bump type "${value}" for ${name} in bump file "${id}"`);
+				continue;
+			}
+			releases.push({
+				name,
+				type: value
+			});
+		} else if (value && typeof value === "object") {
+			const obj = value;
+			if (!VALID_BUMP_TYPES.has(obj.bump)) {
+				log.warn(`Skipping unknown bump type "${obj.bump}" for ${name} in bump file "${id}"`);
+				continue;
+			}
+			const release = {
+				name,
+				type: obj.bump,
+				cascade: obj.cascade || {}
+			};
+			releases.push(release);
+		}
+	}
+	if (releases.length === 0) return null;
+	return {
+		id,
+		releases,
+		summary
+	};
+}
+/** Write a bump file */
+async function writeBumpFile(rootDir, filename, releases, summary) {
+	const filePath = resolve(getBumpyDir(rootDir), `${filename}.md`);
+	const frontmatter = {};
+	for (const release of releases) if ("cascade" in release && Object.keys(release.cascade).length > 0) frontmatter[release.name] = {
+		bump: release.type,
+		cascade: release.cascade
+	};
+	else frontmatter[release.name] = release.type;
+	await writeText(filePath, `---\n${jsYaml.dump(frontmatter, {
+		lineWidth: -1,
+		quotingType: "\""
+	}).trim()}\n---\n\n${summary}\n`);
+	return filePath;
+}
+/** Delete consumed bump files */
+async function deleteBumpFiles(rootDir, ids) {
+	const dir = getBumpyDir(rootDir);
+	for (const id of ids) await removeFile(resolve(dir, `${id}.md`));
+}
+function fileToId(filePath) {
+	return filePath.split("/").pop().replace(/\.md$/, "");
+}
+//#endregion
+export { writeBumpFile as i, parseBumpFile as n, readBumpFiles as r, deleteBumpFiles as t };