@varlock/bumpy 1.10.2 → 1.12.0

package/README.md

@@ -171,8 +171,6 @@ jobs:
 
 </details>
 
-You can also use `bumpy ci release --auto-publish` to version + publish directly on merge without the intermediate PR.
-
 ### Token setup
 
 The default `github.token` works for basic functionality, but GitHub's anti-recursion guard means PRs created by the default token won't trigger other workflows - so your regular CI (tests, linting, etc.) won't run automatically on the Version Packages PR. To fix this, provide a `BUMPY_GH_TOKEN` secret using either a **fine-grained PAT** or a **GitHub App token**. See the [full token setup guide](https://github.com/dmno-dev/bumpy/blob/main/docs/github-actions.md#token-setup) for details.

package/config-schema.json

@@ -151,6 +151,16 @@
           "enum": ["pack", "in-place", "none"],
           "description": "How to handle workspace:/catalog: protocol resolution. \"pack\" = use PM's pack to build a clean tarball, \"in-place\" = rewrite package.json before publish, \"none\" = don't resolve.",
           "default": "pack"
+        },
+        "provenance": {
+          "type": "boolean",
+          "description": "Attach provenance attestation when publishing via npm. Requires a supported CI environment with OIDC (GitHub Actions, GitLab CI, etc.). Only works with publishManager \"npm\".",
+          "default": false
+        },
+        "npmStaged": {
+          "type": "boolean",
+          "description": "Use npm staged publishing (`npm stage publish`). Stages the publish on npmjs.com, requiring manual 2FA approval before going live. Only works with publishManager \"npm\" and requires npm >= 11.15.0.",
+          "default": false
         }
       },
       "additionalProperties": false

package/dist/{add-B_1I_sen.mjs → add-DQA1TVHA.mjs}

@@ -1,15 +1,14 @@
 import { n as log, r as require_picocolors, s as __toESM } from "./logger-BgksGFuf.mjs";
 import { n as exists, t as ensureDir } from "./fs-CBXKZhoU.mjs";
-import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
-import { a as writeBumpFile, o as discoverPackages, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B9DpXK5X.mjs";
-import { r as getChangedFiles } from "./git-JGLQtk-M.mjs";
+import { a as loadConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
+import { a as writeBumpFile, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B7hmXZlB.mjs";
+import { i as getChangedFiles } from "./git-DJJ64SW9.mjs";
 import { l as pt, o as gt, r as Ot, s as mt, t as unwrap, u as wt } from "./clack-W95rXis0.mjs";
 import { n as slugify, t as randomName } from "./names-COooXAFg.mjs";
-import { n as findChangedPackages, r as require_picomatch } from "./check-pbyTB4KC.mjs";
-import { relative, resolve } from "node:path";
+import { n as findChangedPackages } from "./check-CsF0zh8r.mjs";
+import { resolve } from "node:path";
 import * as readline from "node:readline";
 //#region src/prompts/bump-select.ts
-var import_picomatch = /* @__PURE__ */ __toESM(require_picomatch(), 1);
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const LEVELS = [
 	"skip",
@@ -208,26 +207,13 @@ async function addCommand(rootDir, opts) {
 		filename = opts.name ? slugify(opts.name) : randomName();
 	} else {
 		mt(import_picocolors.default.bgCyan(import_picocolors.default.black(" bumpy add ")));
-		const pkgs = await discoverPackages(rootDir, config);
+		const { packages: pkgs } = await discoverWorkspace(rootDir, config);
 		if (pkgs.size === 0) {
 			pt("No managed packages found in this workspace.");
 			process.exit(1);
 		}
-		const baseBranch = config.baseBranch;
-		const changedFiles = getChangedFiles(rootDir, baseBranch);
-		const matchers = /* @__PURE__ */ new Map();
-		for (const [name, pkg] of pkgs) {
-			const patterns = (await loadPackageConfig(pkg.dir, config, name)).changedFilePatterns ?? config.changedFilePatterns;
-			matchers.set(name, (0, import_picomatch.default)(patterns));
-		}
-		const changedPackageNames = /* @__PURE__ */ new Set();
-		for (const file of changedFiles) for (const [name, pkg] of pkgs) {
-			const pkgRelDir = relative(rootDir, pkg.dir);
-			if (file.startsWith(pkgRelDir + "/")) {
-				const relToPackage = file.slice(pkgRelDir.length + 1);
-				if (matchers.get(name)(relToPackage)) changedPackageNames.add(name);
-			}
-		}
+		const changedFiles = getChangedFiles(rootDir, config.baseBranch);
+		const changedPackageNames = new Set(await findChangedPackages(changedFiles, pkgs, rootDir, config));
 		const { bumpFiles: allBumpFiles } = await readBumpFiles(rootDir);
 		const { branchBumpFiles } = filterBranchBumpFiles(allBumpFiles, changedFiles, rootDir);
 		const alreadyCoveredPackages = /* @__PURE__ */ new Map();

package/dist/{bump-file-B9DpXK5X.mjs → bump-file-B7hmXZlB.mjs}

@@ -1,6 +1,6 @@
 import { a as readJson, f as writeText, i as listFiles, n as exists, s as readText } from "./fs-CBXKZhoU.mjs";
 import { i as isPackageManaged, o as loadPackageConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
-import { i as jsYaml, n as detectWorkspaces } from "./package-manager-BQPwXwu5.mjs";
+import { c as jsYaml, r as detectWorkspaces } from "./package-manager-Db_vTztt.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
 import { relative, resolve } from "node:path";
 import { readdir, stat } from "node:fs/promises";

package/dist/{check-pbyTB4KC.mjs → check-CsF0zh8r.mjs}

@@ -1,8 +1,11 @@
 import { a as __exportAll, i as __commonJSMin, n as log, s as __toESM, t as colorize } from "./logger-BgksGFuf.mjs";
+import { n as exists, s as readText } from "./fs-CBXKZhoU.mjs";
+import { a as DEP_TYPES } from "./types-Bkh-igOJ.mjs";
 import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
-import { r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B9DpXK5X.mjs";
-import { a as getFileStatuses, r as getChangedFiles } from "./git-JGLQtk-M.mjs";
-import { relative } from "node:path";
+import { a as isCatalogRefAffected, i as diffCatalogMaps, n as detectPackageManager, o as parseCatalogs, t as CATALOG_FILES } from "./package-manager-Db_vTztt.mjs";
+import { r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B7hmXZlB.mjs";
+import { i as getChangedFiles, n as getBaseCompareRef, o as getFileStatuses, u as readFileAtRef } from "./git-DJJ64SW9.mjs";
+import { relative, resolve } from "node:path";
 //#region ../../node_modules/.bun/picomatch@4.0.4/node_modules/picomatch/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const WIN_SLASH = "\\\\/";
@@ -1996,7 +1999,32 @@ async function findChangedPackages(changedFiles, packages, rootDir, config) {
 			if (matchers.get(name)(relToPackage)) changed.add(name);
 		}
 	}
+	const catalogChanges = await getChangedCatalogEntries(rootDir, config.baseBranch, changedFiles);
+	if (catalogChanges.size > 0) for (const [name, pkg] of packages) {
+		if (changed.has(name)) continue;
+		for (const depType of DEP_TYPES) {
+			const deps = pkg[depType];
+			let matched = false;
+			for (const [depName, range] of Object.entries(deps)) if (isCatalogRefAffected(range, depName, catalogChanges)) {
+				changed.add(name);
+				matched = true;
+				break;
+			}
+			if (matched) break;
+		}
+	}
 	return [...changed];
 }
+/**
+* Compute which catalog entries changed between the base ref and HEAD.
+* Returns Map<catalogName, Set<depName>>. Empty if no catalog files changed.
+*/
+async function getChangedCatalogEntries(rootDir, baseBranch, changedFiles) {
+	if (!changedFiles.some((f) => CATALOG_FILES.includes(f))) return /* @__PURE__ */ new Map();
+	const baseRef = getBaseCompareRef(rootDir, baseBranch);
+	const pm = await detectPackageManager(rootDir);
+	const afterCatalogs = parseCatalogs(pm === "pnpm" && await exists(resolve(rootDir, "pnpm-workspace.yaml")) ? await readText(resolve(rootDir, "pnpm-workspace.yaml")) : null, await exists(resolve(rootDir, "package.json")) ? await readText(resolve(rootDir, "package.json")) : null);
+	return diffCatalogMaps(parseCatalogs(pm === "pnpm" ? readFileAtRef(rootDir, baseRef, "pnpm-workspace.yaml") : null, readFileAtRef(rootDir, baseRef, "package.json")), afterCatalogs);
+}
 //#endregion
-export { findChangedPackages as n, require_picomatch as r, check_exports as t };
+export { findChangedPackages as n, check_exports as t };

package/dist/{ci-B4vNuXEb.mjs → ci-DBZW9k4S.mjs}

@@ -1,12 +1,12 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { a as loadConfig } from "./config-D_4GYDJi.mjs";
-import { t as detectPackageManager } from "./package-manager-BQPwXwu5.mjs";
-import { i as recoverDeletedBumpFiles, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { n as detectPackageManager } from "./package-manager-Db_vTztt.mjs";
+import { i as recoverDeletedBumpFiles, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-B7hmXZlB.mjs";
 import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-mK7iGeGq.mjs";
 import { n as runArgs, r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { r as getChangedFiles, u as withGitToken } from "./git-JGLQtk-M.mjs";
+import { f as withGitToken, i as getChangedFiles } from "./git-DJJ64SW9.mjs";
 import { t as randomName } from "./names-COooXAFg.mjs";
-import { n as findChangedPackages } from "./check-pbyTB4KC.mjs";
+import { n as findChangedPackages } from "./check-CsF0zh8r.mjs";
 import { t as resolveCommitMessage } from "./commit-message-CSWVKPJ-.mjs";
 import { appendFileSync, mkdirSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -157,7 +157,7 @@ async function ciPlanCommand(rootDir) {
 		packageNames: plan.releases.map((r) => r.name)
 	};
 	else {
-		const { findUnpublishedPackages } = await import("./publish-B9xzQREV.mjs");
+		const { findUnpublishedPackages } = await import("./publish-BDA1bOZ7.mjs");
 		const unpublished = await findUnpublishedPackages(packages, config);
 		if (unpublished.length > 0) output = {
 			mode: "publish",
@@ -212,8 +212,10 @@ function writeGitHubOutput(key, value) {
 	appendFileSync(outputFile, `${key}<<${delimiter}\n${value}\n${delimiter}\n`);
 }
 /**
-* CI release: either auto-publish or create a version PR.
-* Designed for merge-to-main workflows.
+* CI release: either create a version PR (bump files present) or publish unpublished
+* packages (no bump files — i.e. a version PR was just merged). Pass `autoPublish` to
+* collapse both steps into a single push-to-main, or `assertMode` to refuse running
+* when the detected state doesn't match expectations (used by split-job workflows).
 */
 async function ciReleaseCommand(rootDir, opts) {
 	const config = await loadConfig(rootDir);
@@ -225,33 +227,38 @@ async function ciReleaseCommand(rootDir, opts) {
 		for (const err of releaseParseErrors) log.error(err);
 		throw new Error("Bump file parse errors must be fixed before releasing.");
 	}
-	if (bumpFiles.length === 0) {
-		log.info("No pending bump files — checking for unpublished packages...");
-		const recoveredBumpFiles = recoverDeletedBumpFiles(rootDir);
-		const { publishCommand } = await import("./publish-B9xzQREV.mjs");
-		await publishCommand(rootDir, {
-			tag: opts.tag,
-			recoveredBumpFiles
-		});
-		return;
-	}
-	const plan = assembleReleasePlan(bumpFiles, packages, depGraph, config);
-	if (plan.releases.length === 0) {
-		log.info("Bump files found but no packages would be released — checking for unpublished packages...");
+	const plan = bumpFiles.length > 0 ? assembleReleasePlan(bumpFiles, packages, depGraph, config) : null;
+	const detectedMode = plan && plan.releases.length > 0 ? "version-pr" : "publish";
+	if (opts.assertMode && opts.assertMode !== detectedMode) throw new Error(`Expected mode "${opts.assertMode}" but detected "${detectedMode}". Either remove --expect-mode, or gate this step on the output of "bumpy ci plan".`);
+	if (detectedMode === "publish") {
+		const msg = bumpFiles.length === 0 ? "No pending bump files — checking for unpublished packages..." : "Bump files found but no packages would be released — checking for unpublished packages...";
+		log.info(msg);
 		const recoveredBumpFiles = recoverDeletedBumpFiles(rootDir);
-		const { publishCommand } = await import("./publish-B9xzQREV.mjs");
+		const { publishCommand } = await import("./publish-BDA1bOZ7.mjs");
 		await publishCommand(rootDir, {
 			tag: opts.tag,
 			recoveredBumpFiles
 		});
 		return;
 	}
-	if (opts.mode === "auto-publish") await autoPublish(rootDir, config, plan, opts.tag);
+	if (opts.autoPublish) await autoPublish(rootDir, config, plan, opts.tag);
 	else await createVersionPr(rootDir, plan, config, new Map([...packages.values()].map((p) => [p.name, p.relativeDir])), opts.branch);
 }
+/**
+* "Auto-publish" mode: skip the Version Packages PR and ship version+publish in one run.
+*
+* The only thing forfeited vs. the default flow is the preview/review gate on version
+* bumps. Credentials are NOT a differentiator — a single-job non-auto-publish workflow
+* also carries both PR-write and publish creds, just split across two runs. The real
+* credential separation comes from the split-job pattern, which is orthogonal to (and
+* incompatible with) this flag, since this collapses both paths into one execution.
+*
+* That incompatibility is also why --auto-publish and --expect-mode are mutually exclusive:
+* --expect-mode is for split-job workflows where each job runs exactly one path.
+*/
 async function autoPublish(rootDir, config, plan, tag) {
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-Bxin6aQC.mjs");
+	const { versionCommand } = await import("./version-Cm0nRAFF.mjs");
 	await versionCommand(rootDir);
 	log.step("Committing version changes...");
 	runArgs([
@@ -280,7 +287,7 @@ async function autoPublish(rootDir, config, plan, tag) {
 		], { cwd: rootDir });
 	}
 	log.step("Running bumpy publish...");
-	const { publishCommand } = await import("./publish-B9xzQREV.mjs");
+	const { publishCommand } = await import("./publish-BDA1bOZ7.mjs");
 	await publishCommand(rootDir, { tag });
 }
 /**
@@ -354,7 +361,7 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 		branch
 	], { cwd: rootDir });
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-Bxin6aQC.mjs");
+	const { versionCommand } = await import("./version-Cm0nRAFF.mjs");
 	await versionCommand(rootDir);
 	runArgs([
 		"git",

package/dist/{ci-setup-DKjyiF2-.mjs → ci-setup-CvA2CCmQ.mjs}

@@ -1,5 +1,5 @@
 import { n as log, r as require_picocolors, s as __toESM } from "./logger-BgksGFuf.mjs";
-import { t as detectPackageManager } from "./package-manager-BQPwXwu5.mjs";
+import { n as detectPackageManager } from "./package-manager-Db_vTztt.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
 import { a as fe, c as ot, i as _t, n as O, o as gt, r as Ot, s as mt, t as unwrap, u as wt } from "./clack-W95rXis0.mjs";
 //#region src/commands/ci-setup.ts

package/dist/cli.mjs

@@ -25,13 +25,13 @@ async function main() {
 		switch (command) {
 			case "init": {
 				const rootDir = await findRoot();
-				const { initCommand } = await import("./init-Cs6amsw5.mjs");
+				const { initCommand } = await import("./init-BCkm6Nfa.mjs");
 				await initCommand(rootDir, { force: flags.force === true });
 				break;
 			}
 			case "add": {
 				const rootDir = await findRoot();
-				const { addCommand } = await import("./add-B_1I_sen.mjs");
+				const { addCommand } = await import("./add-DQA1TVHA.mjs");
 				await addCommand(rootDir, {
 					packages: flags.packages,
 					message: flags.message,
@@ -43,7 +43,7 @@ async function main() {
 			}
 			case "status": {
 				const rootDir = await findRoot();
-				const { statusCommand } = await import("./status-DeMcLxiM.mjs");
+				const { statusCommand } = await import("./status-BbsDr6t7.mjs");
 				await statusCommand(rootDir, {
 					json: flags.json === true,
 					packagesOnly: flags.packages === true,
@@ -55,13 +55,13 @@ async function main() {
 			}
 			case "version": {
 				const rootDir = await findRoot();
-				const { versionCommand } = await import("./version-Bxin6aQC.mjs");
+				const { versionCommand } = await import("./version-Cm0nRAFF.mjs");
 				await versionCommand(rootDir, { commit: flags.commit === true });
 				break;
 			}
 			case "generate": {
 				const rootDir = await findRoot();
-				const { generateCommand } = await import("./generate-BlZIe3aC.mjs");
+				const { generateCommand } = await import("./generate-CvCvUaRV.mjs");
 				await generateCommand(rootDir, {
 					from: flags.from,
 					dryRun: flags["dry-run"] === true,
@@ -71,7 +71,7 @@ async function main() {
 			}
 			case "check": {
 				const rootDir = await findRoot();
-				const { checkCommand } = await import("./check-pbyTB4KC.mjs").then((n) => n.t);
+				const { checkCommand } = await import("./check-CsF0zh8r.mjs").then((n) => n.t);
 				const hookValue = flags.hook;
 				if (hookValue && hookValue !== "pre-commit" && hookValue !== "pre-push") {
 					log.error(`Invalid --hook value "${hookValue}". Expected "pre-commit" or "pre-push".`);
@@ -89,24 +89,35 @@ async function main() {
 				const subcommand = args[1];
 				const ciFlags = parseFlags(args.slice(2));
 				if (subcommand === "check") {
-					const { ciCheckCommand } = await import("./ci-B4vNuXEb.mjs");
+					const { ciCheckCommand } = await import("./ci-DBZW9k4S.mjs");
 					await ciCheckCommand(rootDir, {
 						comment: ciFlags.comment !== void 0 ? ciFlags.comment === true : void 0,
 						strict: ciFlags.strict === true,
 						noFail: ciFlags["no-fail"] === true
 					});
 				} else if (subcommand === "plan") {
-					const { ciPlanCommand } = await import("./ci-B4vNuXEb.mjs");
+					const { ciPlanCommand } = await import("./ci-DBZW9k4S.mjs");
 					await ciPlanCommand(rootDir);
 				} else if (subcommand === "release") {
-					const { ciReleaseCommand } = await import("./ci-B4vNuXEb.mjs");
+					const { ciReleaseCommand } = await import("./ci-DBZW9k4S.mjs");
+					const expectModeFlag = ciFlags["expect-mode"];
+					const autoPublishFlag = ciFlags["auto-publish"] === true;
+					if (expectModeFlag !== void 0 && expectModeFlag !== "version-pr" && expectModeFlag !== "publish") {
+						log.error(`Invalid --expect-mode value: "${expectModeFlag}". Must be "version-pr" or "publish".`);
+						process.exit(1);
+					}
+					if (expectModeFlag !== void 0 && autoPublishFlag) {
+						log.error("--expect-mode and --auto-publish cannot be used together.");
+						process.exit(1);
+					}
 					await ciReleaseCommand(rootDir, {
-						mode: ciFlags["auto-publish"] === true ? "auto-publish" : "version-pr",
+						autoPublish: autoPublishFlag,
+						assertMode: expectModeFlag,
 						tag: ciFlags.tag,
 						branch: ciFlags.branch
 					});
 				} else if (subcommand === "setup") {
-					const { ciSetupCommand } = await import("./ci-setup-DKjyiF2-.mjs");
+					const { ciSetupCommand } = await import("./ci-setup-CvA2CCmQ.mjs");
 					await ciSetupCommand(rootDir);
 				} else {
 					log.error(`Unknown ci subcommand: ${subcommand}. Use "ci check", "ci plan", "ci release", or "ci setup".`);
@@ -116,7 +127,7 @@ async function main() {
 			}
 			case "publish": {
 				const rootDir = await findRoot();
-				const { publishCommand } = await import("./publish-B9xzQREV.mjs");
+				const { publishCommand } = await import("./publish-BDA1bOZ7.mjs");
 				await publishCommand(rootDir, {
 					dryRun: flags["dry-run"] === true,
 					tag: flags.tag,
@@ -140,7 +151,7 @@ async function main() {
 			}
 			case "--version":
 			case "-v":
-				console.log(`bumpy 1.10.2`);
+				console.log(`bumpy 1.12.0`);
 				break;
 			case "help":
 			case "--help":
@@ -160,7 +171,7 @@ async function main() {
 }
 function printHelp() {
 	console.log(`
-  ${colorize(`🐸 bumpy v1.10.2`, "bold")} - Modern monorepo versioning
+  ${colorize(`🐸 bumpy v1.12.0`, "bold")} - Modern monorepo versioning
 
   Usage: bumpy <command> [options]
 
@@ -213,6 +224,7 @@ function printHelp() {
     --no-fail               Warn only, never exit 1
 
   CI release options:
+    --expect-mode <mode>    Assert detected mode: "version-pr" or "publish" (errors if mismatched)
     --auto-publish          Version + publish directly (default: create version PR)
     --tag <tag>             npm dist-tag for auto-publish
     --branch <name>         Branch name for version PR (default: bumpy/version-packages)

package/dist/{generate-BlZIe3aC.mjs → generate-CvCvUaRV.mjs}

@@ -1,9 +1,9 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { t as ensureDir } from "./fs-CBXKZhoU.mjs";
 import { a as loadConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
-import { a as writeBumpFile, o as discoverPackages } from "./bump-file-B9DpXK5X.mjs";
+import { a as writeBumpFile, o as discoverPackages } from "./bump-file-B7hmXZlB.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { n as getBranchCommits, o as getFilesChangedInCommit } from "./git-JGLQtk-M.mjs";
+import { r as getBranchCommits, s as getFilesChangedInCommit } from "./git-DJJ64SW9.mjs";
 import { n as slugify, t as randomName } from "./names-COooXAFg.mjs";
 import { relative } from "node:path";
 //#region src/commands/generate.ts

package/dist/{git-JGLQtk-M.mjs → git-DJJ64SW9.mjs}

@@ -141,8 +141,11 @@ function tagExists(tag, opts) {
 		tag
 	], opts) === tag;
 }
-/** Get files changed on this branch compared to a base branch */
-function getChangedFiles(rootDir, baseBranch) {
+/**
+* Resolve the ref to use as the comparison base for "this branch vs main".
+* Prefers the merge-base, falls back to `origin/<baseBranch>`.
+*/
+function getBaseCompareRef(rootDir, baseBranch) {
 	if (!tryRunArgs([
 		"git",
 		"rev-parse",
@@ -155,20 +158,35 @@ function getChangedFiles(rootDir, baseBranch) {
 		baseBranch,
 		"--depth=1"
 	], { cwd: rootDir });
+	return tryRunArgs([
+		"git",
+		"merge-base",
+		"HEAD",
+		`origin/${baseBranch}`
+	], { cwd: rootDir }) || `origin/${baseBranch}`;
+}
+/** Get files changed on this branch compared to a base branch */
+function getChangedFiles(rootDir, baseBranch) {
 	const diff = tryRunArgs([
 		"git",
 		"diff",
 		"--name-only",
-		tryRunArgs([
-			"git",
-			"merge-base",
-			"HEAD",
-			`origin/${baseBranch}`
-		], { cwd: rootDir }) || `origin/${baseBranch}`
+		getBaseCompareRef(rootDir, baseBranch)
 	], { cwd: rootDir });
 	if (!diff) return [];
 	return diff.split("\n").filter(Boolean);
 }
+/**
+* Read a file's contents at a given git ref.
+* Returns null if the file does not exist at that ref.
+*/
+function readFileAtRef(rootDir, ref, path) {
+	return tryRunArgs([
+		"git",
+		"show",
+		`${ref}:${path}`
+	], { cwd: rootDir });
+}
 /** Get commits on the current branch since it diverged from baseBranch */
 function getBranchCommits(rootDir, baseBranch) {
 	if (!tryRunArgs([
@@ -242,4 +260,4 @@ function getFileStatuses(dir, opts) {
 	return statuses;
 }
 //#endregion
-export { getFileStatuses as a, pushWithTags as c, getCurrentBranch as i, tagExists as l, getBranchCommits as n, getFilesChangedInCommit as o, getChangedFiles as r, hasUncommittedChanges as s, createTag as t, withGitToken as u };
+export { getCurrentBranch as a, hasUncommittedChanges as c, tagExists as d, withGitToken as f, getChangedFiles as i, pushWithTags as l, getBaseCompareRef as n, getFileStatuses as o, getBranchCommits as r, getFilesChangedInCommit as s, createTag as t, readFileAtRef as u };

package/dist/index.mjs

@@ -1,8 +1,8 @@
 import { a as DEP_TYPES, c as maxBump, i as DEFAULT_PUBLISH_CONFIG, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, r as DEFAULT_CONFIG, s as hasCascade, t as BUMP_LEVELS } from "./types-Bkh-igOJ.mjs";
 import { a as loadConfig, n as findRoot, r as getBumpyDir, s as matchGlob } from "./config-D_4GYDJi.mjs";
-import { a as writeBumpFile, n as parseBumpFile, o as discoverPackages, r as readBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { a as writeBumpFile, n as parseBumpFile, o as discoverPackages, r as readBumpFiles } from "./bump-file-B7hmXZlB.mjs";
 import { a as DependencyGraph, i as stripProtocol, n as bumpVersion, r as satisfies, t as assembleReleasePlan } from "./release-plan-mK7iGeGq.mjs";
 import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry, t as defaultFormatter } from "./changelog-CbaET5V6.mjs";
 import { t as applyReleasePlan } from "./apply-release-plan-DD2R7SL2.mjs";
-import { t as publishPackages } from "./publish-pipeline-BRnqVylg.mjs";
+import { t as publishPackages } from "./publish-pipeline-DSj14dW6.mjs";
 export { BUMP_LEVELS, DEFAULT_BUMP_RULES, DEFAULT_CONFIG, DEFAULT_PUBLISH_CONFIG, DEP_TYPES, DependencyGraph, applyReleasePlan, assembleReleasePlan, bumpLevel, bumpVersion, defaultFormatter, discoverPackages, findRoot, generateChangelogEntry, getBumpyDir, hasCascade, loadConfig, loadFormatter, matchGlob, maxBump, normalizeCascadeConfig, parseBumpFile, prependToChangelog, publishPackages, readBumpFiles, satisfies, stripProtocol, writeBumpFile };

package/dist/{init-Cs6amsw5.mjs → init-BCkm6Nfa.mjs}

@@ -1,6 +1,6 @@
 import { n as log, r as require_picocolors, s as __toESM } from "./logger-BgksGFuf.mjs";
 import { a as readJson, d as writeJson, f as writeText, i as listFiles, n as exists, s as readText, t as ensureDir } from "./fs-CBXKZhoU.mjs";
-import { t as detectPackageManager } from "./package-manager-BQPwXwu5.mjs";
+import { n as detectPackageManager } from "./package-manager-Db_vTztt.mjs";
 import { t as run } from "./shell-C8KgKnMQ.mjs";
 import { c as ot, o as gt, s as mt, t as unwrap } from "./clack-W95rXis0.mjs";
 import { resolve } from "node:path";

package/dist/{package-manager-BQPwXwu5.mjs → package-manager-Db_vTztt.mjs}

@@ -2072,38 +2072,92 @@ async function getWorkspaceGlobs(rootDir, pm) {
 	} catch {}
 	return [];
 }
-/** Load catalog definitions from pnpm-workspace.yaml or root package.json */
-async function loadCatalogs(rootDir, pm) {
+/**
+* Files that may contain catalog definitions, in the order they're applied.
+* Later entries override earlier ones (matching loadCatalogs behavior).
+*/
+const CATALOG_FILES = ["pnpm-workspace.yaml", "package.json"];
+/**
+* Normalize a catalog name to its canonical form.
+* pnpm/bun treat "default" and the unnamed top-level catalog interchangeably,
+* so we store and look up the default catalog under "" regardless of which alias
+* the user wrote.
+*/
+function normalizeCatalogName(name) {
+	return name === "default" ? "" : name;
+}
+/** Parse catalog definitions from the raw contents of pnpm-workspace.yaml and root package.json */
+function parseCatalogs(pnpmWorkspaceYaml, rootPackageJson) {
 	const catalogs = /* @__PURE__ */ new Map();
-	if (pm === "pnpm") {
-		const wsFile = resolve(rootDir, "pnpm-workspace.yaml");
-		if (await exists(wsFile)) {
-			const content = await readText(wsFile);
-			const parsed = jsYaml.load(content);
-			if (parsed?.catalog) catalogs.set("", parsed.catalog);
-			if (parsed?.catalogs) for (const [name, deps] of Object.entries(parsed.catalogs)) catalogs.set(name, deps);
-		}
-	}
-	try {
-		const pkg = await readJson(resolve(rootDir, "package.json"));
+	const addNamed = (raw) => {
+		for (const [name, deps] of Object.entries(raw)) catalogs.set(normalizeCatalogName(name), deps);
+	};
+	if (pnpmWorkspaceYaml) try {
+		const parsed = jsYaml.load(pnpmWorkspaceYaml);
+		if (parsed?.catalog) catalogs.set("", parsed.catalog);
+		if (parsed?.catalogs) addNamed(parsed.catalogs);
+	} catch {}
+	if (rootPackageJson) try {
+		const pkg = JSON.parse(rootPackageJson);
 		if (pkg.catalog && typeof pkg.catalog === "object") catalogs.set("", pkg.catalog);
-		if (pkg.catalogs && typeof pkg.catalogs === "object") for (const [name, deps] of Object.entries(pkg.catalogs)) catalogs.set(name, deps);
+		if (pkg.catalogs && typeof pkg.catalogs === "object") addNamed(pkg.catalogs);
 		const workspaces = pkg.workspaces;
 		if (workspaces && typeof workspaces === "object" && !Array.isArray(workspaces)) {
 			const ws = workspaces;
 			if (ws.catalog && typeof ws.catalog === "object") catalogs.set("", ws.catalog);
-			if (ws.catalogs && typeof ws.catalogs === "object") for (const [name, deps] of Object.entries(ws.catalogs)) catalogs.set(name, deps);
+			if (ws.catalogs && typeof ws.catalogs === "object") addNamed(ws.catalogs);
 		}
 	} catch {}
 	return catalogs;
 }
+/** Load catalog definitions from pnpm-workspace.yaml or root package.json */
+async function loadCatalogs(rootDir, pm) {
+	let pnpmYaml = null;
+	if (pm === "pnpm") {
+		const wsFile = resolve(rootDir, "pnpm-workspace.yaml");
+		if (await exists(wsFile)) pnpmYaml = await readText(wsFile);
+	}
+	let pkgJsonText = null;
+	const pkgJsonPath = resolve(rootDir, "package.json");
+	if (await exists(pkgJsonPath)) pkgJsonText = await readText(pkgJsonPath);
+	return parseCatalogs(pnpmYaml, pkgJsonText);
+}
+/** Extract the catalog name from a `catalog:` / `catalog:<name>` range, normalizing the default alias */
+function catalogNameFromRange(range) {
+	return normalizeCatalogName(range.slice(8).trim());
+}
 /** Resolve a specific dependency's catalog: reference */
 function resolveCatalogDep(depName, range, catalogs) {
 	if (!range.startsWith("catalog:")) return null;
-	const catalogName = range.slice(8).trim() || "";
-	const catalog = catalogs.get(catalogName);
+	const catalog = catalogs.get(catalogNameFromRange(range));
 	if (!catalog) return null;
 	return catalog[depName] ?? null;
 }
+/**
+* Diff two catalog states and return the set of (catalogName → changed depNames).
+* Includes added, removed, and version-changed entries.
+*/
+function diffCatalogMaps(before, after) {
+	const changes = /* @__PURE__ */ new Map();
+	const catalogNames = new Set([...before.keys(), ...after.keys()]);
+	for (const catalogName of catalogNames) {
+		const beforeDeps = before.get(catalogName) ?? {};
+		const afterDeps = after.get(catalogName) ?? {};
+		const depNames = new Set([...Object.keys(beforeDeps), ...Object.keys(afterDeps)]);
+		const changedDeps = /* @__PURE__ */ new Set();
+		for (const depName of depNames) if (beforeDeps[depName] !== afterDeps[depName]) changedDeps.add(depName);
+		if (changedDeps.size > 0) changes.set(catalogName, changedDeps);
+	}
+	return changes;
+}
+/**
+* Given a set of catalog entries that have changed, return the set of catalog
+* references (e.g. "catalog:" or "catalog:testing") that affect those entries.
+* Used to match package.json dep ranges against changed catalog entries.
+*/
+function isCatalogRefAffected(range, depName, catalogChanges) {
+	if (!range.startsWith("catalog:")) return false;
+	return catalogChanges.get(catalogNameFromRange(range))?.has(depName) ?? false;
+}
 //#endregion
-export { jsYaml as i, detectWorkspaces as n, resolveCatalogDep as r, detectPackageManager as t };
+export { isCatalogRefAffected as a, jsYaml as c, diffCatalogMaps as i, detectPackageManager as n, parseCatalogs as o, detectWorkspaces as r, resolveCatalogDep as s, CATALOG_FILES as t };

package/dist/{publish-B9xzQREV.mjs → publish-BDA1bOZ7.mjs}

@@ -1,13 +1,13 @@
 import { n as log, o as __require, t as colorize } from "./logger-BgksGFuf.mjs";
 import { a as loadConfig } from "./config-D_4GYDJi.mjs";
-import { n as detectWorkspaces } from "./package-manager-BQPwXwu5.mjs";
-import { s as discoverWorkspace } from "./bump-file-B9DpXK5X.mjs";
+import { r as detectWorkspaces } from "./package-manager-Db_vTztt.mjs";
+import { s as discoverWorkspace } from "./bump-file-B7hmXZlB.mjs";
 import { a as DependencyGraph } from "./release-plan-mK7iGeGq.mjs";
 import { r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
 import { i as loadFormatter, n as generateChangelogEntry } from "./changelog-CbaET5V6.mjs";
-import { c as pushWithTags, s as hasUncommittedChanges } from "./git-JGLQtk-M.mjs";
-import { t as publishPackages } from "./publish-pipeline-BRnqVylg.mjs";
-import { CI_PLAN_CACHE_PATH } from "./ci-B4vNuXEb.mjs";
+import { c as hasUncommittedChanges, l as pushWithTags } from "./git-DJJ64SW9.mjs";
+import { t as publishPackages } from "./publish-pipeline-DSj14dW6.mjs";
+import { CI_PLAN_CACHE_PATH } from "./ci-DBZW9k4S.mjs";
 //#region src/core/github-release.ts
 /** Get the current HEAD commit SHA */
 function getHeadSha(rootDir) {

package/dist/{publish-pipeline-BRnqVylg.mjs → publish-pipeline-DSj14dW6.mjs}

@@ -1,9 +1,9 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { a as readJson, u as updateJsonNestedField } from "./fs-CBXKZhoU.mjs";
-import { r as resolveCatalogDep } from "./package-manager-BQPwXwu5.mjs";
+import { s as resolveCatalogDep } from "./package-manager-Db_vTztt.mjs";
 import { i as stripProtocol } from "./release-plan-mK7iGeGq.mjs";
 import { i as runAsync, o as sq, r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { l as tagExists, t as createTag } from "./git-JGLQtk-M.mjs";
+import { d as tagExists, t as createTag } from "./git-DJJ64SW9.mjs";
 import { resolve } from "node:path";
 import { unlink } from "node:fs/promises";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";

package/dist/{status-DeMcLxiM.mjs → status-BbsDr6t7.mjs}

@@ -1,8 +1,8 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { a as loadConfig } from "./config-D_4GYDJi.mjs";
-import { o as discoverPackages, r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { o as discoverPackages, r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-B7hmXZlB.mjs";
 import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-mK7iGeGq.mjs";
-import { i as getCurrentBranch, r as getChangedFiles } from "./git-JGLQtk-M.mjs";
+import { a as getCurrentBranch, i as getChangedFiles } from "./git-DJJ64SW9.mjs";
 //#region src/commands/status.ts
 async function statusCommand(rootDir, opts) {
 	const config = await loadConfig(rootDir);

package/dist/{version-Bxin6aQC.mjs → version-Cm0nRAFF.mjs}

@@ -1,7 +1,7 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { a as loadConfig } from "./config-D_4GYDJi.mjs";
-import { n as detectWorkspaces } from "./package-manager-BQPwXwu5.mjs";
-import { o as discoverPackages, r as readBumpFiles } from "./bump-file-B9DpXK5X.mjs";
+import { r as detectWorkspaces } from "./package-manager-Db_vTztt.mjs";
+import { o as discoverPackages, r as readBumpFiles } from "./bump-file-B7hmXZlB.mjs";
 import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-mK7iGeGq.mjs";
 import { n as runArgs, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
 import { t as applyReleasePlan } from "./apply-release-plan-DD2R7SL2.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varlock/bumpy",
-  "version": "1.10.2",
+  "version": "1.12.0",
   "description": "Modern monorepo versioning and changelog tool",
   "keywords": [
     "bump",