@varlock/bumpy 1.13.2 → 1.14.0-rc.1

package/dist/{generate-DohUlhu3.mjs → generate-B2OMt_64.mjs}

@@ -1,9 +1,9 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { t as ensureDir } from "./fs-CBXKZhoU.mjs";
-import { a as loadConfig, r as getBumpyDir } from "./config-D_4GYDJi.mjs";
-import { a as writeBumpFile, o as discoverPackages } from "./bump-file-B7hmXZlB.mjs";
+import { a as loadConfig, r as getBumpyDir } from "./config-0we4ISZX.mjs";
+import { o as writeBumpFile, s as discoverPackages } from "./bump-file-mRJeReRJ.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { c as getFilesChangedInCommit, i as getBranchCommits } from "./git-BWPimLgc.mjs";
+import { c as getFilesChangedInCommit, i as getBranchCommits } from "./git-DAWj8LyV.mjs";
 import { n as slugify, t as randomName } from "./names-COooXAFg.mjs";
 import { relative } from "node:path";
 //#region src/commands/generate.ts

package/dist/{git-BWPimLgc.mjs → git-DAWj8LyV.mjs}

@@ -269,5 +269,16 @@ function getFileStatuses(dir, opts) {
 	}
 	return statuses;
 }
+/** Get all tags matching a pattern */
+function listTags(pattern, opts) {
+	const result = tryRunArgs([
+		"git",
+		"tag",
+		"-l",
+		pattern
+	], opts);
+	if (!result) return [];
+	return result.split("\n").filter(Boolean);
+}
 //#endregion
-export { getChangedFiles as a, getFilesChangedInCommit as c, tagExists as d, withGitToken as f, getBranchCommits as i, hasUncommittedChanges as l, forcePushTag as n, getCurrentBranch as o, getBaseCompareRef as r, getFileStatuses as s, createTag as t, readFileAtRef as u };
+export { getChangedFiles as a, getFilesChangedInCommit as c, readFileAtRef as d, tagExists as f, getBranchCommits as i, hasUncommittedChanges as l, forcePushTag as n, getCurrentBranch as o, withGitToken as p, getBaseCompareRef as r, getFileStatuses as s, createTag as t, listTags as u };

package/dist/index.d.mts

@@ -53,9 +53,30 @@ interface PublishConfig {
    */
   npmStaged: boolean;
 }
+interface ChannelConfig {
+  /** Branch that triggers this channel (required) */
+  branch: string;
+  /** Version suffix (preid), e.g. "rc" → 1.2.0-rc.0. Defaults to the channel name. */
+  preid?: string;
+  /** npm dist-tag for publishes. Defaults to the channel name. */
+  tag?: string;
+  /** Release PR overrides for this channel */
+  versionPr?: {
+    title?: string;
+    branch?: string; /** Enable auto-merge on the release PR */
+    automerge?: boolean;
+  };
+}
 interface BumpyConfig {
   baseBranch: string;
   access: 'public' | 'restricted';
+  /**
+   * Prerelease channels, keyed by channel name. Each maps a long-lived branch
+   * to a prerelease line (version suffix + npm dist-tag). Shipped bump files
+   * are tracked in `.bumpy/<name>/`. Prerelease versions are never committed —
+   * they are derived from bump files, the registry, and git tags at publish time.
+   */
+  channels: Record<string, ChannelConfig>;
   /**
    * Customize the commit message used when versioning.
    * A string starting with "./" is treated as a path to a module that exports
@@ -136,6 +157,8 @@ interface BumpFile {
   id: string;
   releases: BumpFileRelease[];
   summary: string;
+  /** Channel directory this file lives in (`.bumpy/<channel>/`), if any. Undefined = `.bumpy/` root. */
+  channel?: string;
 }
 interface WorkspacePackage {
   name: string;
@@ -219,8 +242,15 @@ interface ReadBumpFilesResult {
   bumpFiles: BumpFile[];
   errors: string[];
 }
-/** Read all bump files from .bumpy/ directory, sorted by git creation order */
-declare function readBumpFiles(rootDir: string): Promise<ReadBumpFilesResult>;
+interface ReadBumpFilesOptions {
+  /**
+   * Channel names whose `.bumpy/<name>/` subdirectories should also be read.
+   * Files from those dirs get their `channel` field set; root files don't.
+   */
+  channels?: string[];
+}
+/** Read all bump files from .bumpy/ (and optionally channel subdirs), sorted by git creation order */
+declare function readBumpFiles(rootDir: string, opts?: ReadBumpFilesOptions): Promise<ReadBumpFilesResult>;
 interface BumpFileParseResult {
   bumpFile: BumpFile | null;
   errors: string[];
@@ -240,7 +270,19 @@ declare function writeBumpFile(rootDir: string, filename: string, releases: Bump
  *   Phase B — enforce fixed/linked group constraints
  *   Phase C — apply cascades and proactive propagation rules
  */
-declare function assembleReleasePlan(bumpFiles: BumpFile[], packages: Map<string, WorkspacePackage>, depGraph: DependencyGraph, config: BumpyConfig): ReleasePlan;
+interface AssemblePlanOptions {
+  /**
+   * Prerelease preid for channel plans (e.g. "rc"). When set, Phase A checks range
+   * satisfaction against `<target>-<preid>.0` instead of the stable target. Since a
+   * prerelease never satisfies a normal range (`^1.0.0` doesn't match `1.5.0-rc.0`),
+   * every dependent of a bumped package goes out of range and joins the cycle —
+   * required so consumers can actually install the cycle together from the dist-tag.
+   * Planned versions remain stable targets; the prerelease suffix is applied later
+   * from the registry floor.
+   */
+  prereleasePreid?: string;
+}
+declare function assembleReleasePlan(bumpFiles: BumpFile[], packages: Map<string, WorkspacePackage>, depGraph: DependencyGraph, config: BumpyConfig, opts?: AssemblePlanOptions): ReleasePlan;
 //#endregion
 //#region src/core/apply-release-plan.d.ts
 /** Apply the release plan: bump versions, update changelogs, delete bump files */
@@ -322,4 +364,4 @@ interface PublishResult {
  */
 declare function publishPackages(releasePlan: ReleasePlan, packages: Map<string, WorkspacePackage>, depGraph: DependencyGraph, config: BumpyConfig, rootDir: string, opts?: PublishOptions, catalogs?: CatalogMap, detectedPm?: PackageManager): Promise<PublishResult>;
 //#endregion
-export { BUMP_LEVELS, BumpFile, type BumpFileParseResult, BumpFileRelease, BumpFileReleaseCascade, BumpFileReleaseSimple, BumpType, BumpTypeWithNone, BumpyConfig, CascadeConfig, CascadeRule, type ChangelogContext, type ChangelogFormatter, DEFAULT_BUMP_RULES, DEFAULT_CONFIG, DEFAULT_PUBLISH_CONFIG, DEP_TYPES, DepType, DependencyBumpRule, DependencyGraph, DependentInfo, type GithubChangelogOptions, PackageConfig, PackageManager, PlannedRelease, PublishConfig, type ReadBumpFilesResult, ReleasePlan, WorkspacePackage, applyReleasePlan, assembleReleasePlan, bumpLevel, bumpVersion, defaultFormatter, discoverPackages, findRoot, generateChangelogEntry, getBumpyDir, hasCascade, loadConfig, loadFormatter, matchGlob, maxBump, normalizeCascadeConfig, parseBumpFile, prependToChangelog, publishPackages, readBumpFiles, satisfies, stripProtocol, writeBumpFile };
+export { BUMP_LEVELS, BumpFile, type BumpFileParseResult, BumpFileRelease, BumpFileReleaseCascade, BumpFileReleaseSimple, BumpType, BumpTypeWithNone, BumpyConfig, CascadeConfig, CascadeRule, type ChangelogContext, type ChangelogFormatter, ChannelConfig, DEFAULT_BUMP_RULES, DEFAULT_CONFIG, DEFAULT_PUBLISH_CONFIG, DEP_TYPES, DepType, DependencyBumpRule, DependencyGraph, DependentInfo, type GithubChangelogOptions, PackageConfig, PackageManager, PlannedRelease, PublishConfig, type ReadBumpFilesResult, ReleasePlan, WorkspacePackage, applyReleasePlan, assembleReleasePlan, bumpLevel, bumpVersion, defaultFormatter, discoverPackages, findRoot, generateChangelogEntry, getBumpyDir, hasCascade, loadConfig, loadFormatter, matchGlob, maxBump, normalizeCascadeConfig, parseBumpFile, prependToChangelog, publishPackages, readBumpFiles, satisfies, stripProtocol, writeBumpFile };

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { a as DEP_TYPES, c as maxBump, i as DEFAULT_PUBLISH_CONFIG, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, r as DEFAULT_CONFIG, s as hasCascade, t as BUMP_LEVELS } from "./types-Bkh-igOJ.mjs";
-import { a as loadConfig, n as findRoot, r as getBumpyDir, s as matchGlob } from "./config-D_4GYDJi.mjs";
-import { a as writeBumpFile, n as parseBumpFile, o as discoverPackages, r as readBumpFiles } from "./bump-file-B7hmXZlB.mjs";
-import { a as DependencyGraph, i as stripProtocol, n as bumpVersion, r as satisfies, t as assembleReleasePlan } from "./release-plan-mK7iGeGq.mjs";
-import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry, t as defaultFormatter } from "./changelog-CbaET5V6.mjs";
-import { t as applyReleasePlan } from "./apply-release-plan-DD2R7SL2.mjs";
-import { t as publishPackages } from "./publish-pipeline-BPedWvKS.mjs";
+import { a as DEP_TYPES, c as maxBump, i as DEFAULT_PUBLISH_CONFIG, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, r as DEFAULT_CONFIG, s as hasCascade, t as BUMP_LEVELS } from "./types-lpiG-Zxh.mjs";
+import { a as loadConfig, n as findRoot, r as getBumpyDir, s as matchGlob } from "./config-0we4ISZX.mjs";
+import { i as readBumpFiles, o as writeBumpFile, r as parseBumpFile, s as discoverPackages } from "./bump-file-mRJeReRJ.mjs";
+import { i as stripProtocol, n as bumpVersion, o as DependencyGraph, r as satisfies, t as assembleReleasePlan } from "./release-plan-C84pcBi-.mjs";
+import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry, t as defaultFormatter } from "./changelog-DuFhnJRO.mjs";
+import { t as applyReleasePlan } from "./apply-release-plan-DxTsUSqa.mjs";
+import { t as publishPackages } from "./publish-pipeline-BD8mLbL9.mjs";
 export { BUMP_LEVELS, DEFAULT_BUMP_RULES, DEFAULT_CONFIG, DEFAULT_PUBLISH_CONFIG, DEP_TYPES, DependencyGraph, applyReleasePlan, assembleReleasePlan, bumpLevel, bumpVersion, defaultFormatter, discoverPackages, findRoot, generateChangelogEntry, getBumpyDir, hasCascade, loadConfig, loadFormatter, matchGlob, maxBump, normalizeCascadeConfig, parseBumpFile, prependToChangelog, publishPackages, readBumpFiles, satisfies, stripProtocol, writeBumpFile };

package/dist/prerelease-B2PVfXkm.mjs

@@ -0,0 +1,205 @@
+import { s as __toESM } from "./logger-BgksGFuf.mjs";
+import { f as writeText, l as updateJsonFields, s as readText, u as updateJsonNestedField } from "./fs-CBXKZhoU.mjs";
+import { a as require_semver } from "./release-plan-C84pcBi-.mjs";
+import { r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
+import { u as listTags } from "./git-DAWj8LyV.mjs";
+import { resolve } from "node:path";
+//#region src/core/prerelease.ts
+var import_semver = /* @__PURE__ */ __toESM(require_semver(), 1);
+/**
+* Extract existing prerelease counters for a target+preid from a list of published versions.
+* Only exact `<target>-<preid>.<N>` versions count — other preids and targets are ignored.
+*/
+function extractPrereleaseCounters(versions, target, preid) {
+	const counters = [];
+	for (const v of versions) {
+		const parsed = import_semver.default.parse(v);
+		if (!parsed) continue;
+		if (`${parsed.major}.${parsed.minor}.${parsed.patch}` !== target) continue;
+		if (parsed.prerelease.length !== 2) continue;
+		if (parsed.prerelease[0] !== preid) continue;
+		const n = parsed.prerelease[1];
+		if (typeof n === "number") counters.push(n);
+	}
+	return counters;
+}
+/** Compute the next prerelease version: `<target>-<preid>.<max existing counter + 1>` */
+function nextPrereleaseVersion(target, preid, existingCounters) {
+	return `${target}-${preid}.${existingCounters.length > 0 ? Math.max(...existingCounters) + 1 : 0}`;
+}
+/** Fetch all published versions of a package from the registry */
+async function fetchPublishedVersions(name, registry) {
+	const args = [
+		"npm",
+		"info",
+		name,
+		"versions",
+		"--json"
+	];
+	if (registry) args.push("--registry", registry);
+	try {
+		const raw = await runArgsAsync(args);
+		const parsed = JSON.parse(raw);
+		if (Array.isArray(parsed)) return parsed.filter((v) => typeof v === "string");
+		if (typeof parsed === "string") return [parsed];
+		return [];
+	} catch {
+		return [];
+	}
+}
+/** Fetch the gitHead recorded for a published version (set by npm publish from a git checkout) */
+async function fetchGitHead(name, version, registry) {
+	const args = [
+		"npm",
+		"info",
+		`${name}@${version}`,
+		"gitHead"
+	];
+	if (registry) args.push("--registry", registry);
+	try {
+		const sha = (await runArgsAsync(args)).trim();
+		return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+	} catch {
+		return null;
+	}
+}
+/** Whether a package publishes through the npm registry (vs custom command / git-tag tracking) */
+function usesNpmRegistry(pkg) {
+	return !pkg.bumpy?.publishCommand && !pkg.bumpy?.skipNpmPublish && !pkg.private;
+}
+/** Query published prerelease state for one package at a target version */
+async function getPublishedPrereleaseState(pkg, target, preid, rootDir) {
+	if (usesNpmRegistry(pkg)) {
+		const versions = await fetchPublishedVersions(pkg.name, pkg.bumpy?.registry);
+		return {
+			counters: extractPrereleaseCounters(versions, target, preid),
+			stablePublished: versions.includes(target)
+		};
+	}
+	return {
+		counters: extractPrereleaseCounters(listTags(`${pkg.name}@${target}-${preid}.*`, { cwd: rootDir }).map((t) => t.slice(pkg.name.length + 1)), target, preid),
+		stablePublished: listTags(`${pkg.name}@${target}`, { cwd: rootDir }).length > 0
+	};
+}
+/**
+* Transform a stable release plan (targets computed from bump files) into a channel
+* prerelease plan: each release's newVersion becomes `<target>-<preid>.<N>` with N
+* derived from the registry floor.
+*
+* Idempotency: if a package's latest published prerelease for this target records a
+* gitHead equal to HEAD (or, for non-npm packages, its tag points at HEAD), the package
+* was already published from this exact commit — it is skipped rather than re-counted.
+*/
+async function buildChannelReleasePlan(stablePlan, channel, packages, rootDir, opts = {}) {
+	const headSha = tryRunArgs([
+		"git",
+		"rev-parse",
+		"HEAD"
+	], { cwd: rootDir });
+	const warnings = [...stablePlan.warnings];
+	const alreadyPublished = [];
+	const releases = [];
+	await Promise.all(stablePlan.releases.map(async (release) => {
+		const pkg = packages.get(release.name);
+		if (!pkg) return;
+		if (pkg.private && !pkg.bumpy?.publishCommand) return;
+		const target = release.newVersion;
+		const state = await getPublishedPrereleaseState(pkg, target, channel.preid, rootDir);
+		if (state.stablePublished) warnings.push(`${release.name}@${target} is already published as a stable release — merge ${target}'s release into the "${channel.branch}" branch so the cycle retargets.`);
+		if (!opts.forDisplay && state.counters.length > 0 && headSha) {
+			const latest = `${target}-${channel.preid}.${Math.max(...state.counters)}`;
+			if (usesNpmRegistry(pkg) ? await fetchGitHead(pkg.name, latest, pkg.bumpy?.registry) === headSha : tryRunArgs([
+				"git",
+				"rev-parse",
+				`refs/tags/${pkg.name}@${latest}`
+			], { cwd: rootDir }) === headSha) {
+				alreadyPublished.push({
+					name: release.name,
+					version: latest
+				});
+				return;
+			}
+		}
+		releases.push({
+			...release,
+			newVersion: nextPrereleaseVersion(target, channel.preid, state.counters)
+		});
+	}));
+	releases.sort((a, b) => a.name.localeCompare(b.name));
+	return {
+		plan: {
+			bumpFiles: stablePlan.bumpFiles,
+			releases,
+			warnings
+		},
+		alreadyPublished,
+		warnings
+	};
+}
+/**
+* Transiently write computed prerelease versions (and exact pins for in-cycle deps)
+* into the working tree's package.json files. Returns a restore function that puts
+* the original contents back — call it in a `finally` after publishing.
+*
+* Versions must be on disk before build/pack so that:
+* - PM pack picks up the prerelease version for the tarball
+* - builds that bake in the version (banners, __VERSION__) see the right one
+*
+* In-cycle dependencies are pinned EXACTLY (`"1.2.0-rc.0"`, no range) so any
+* combination of packages installed from the channel dist-tag resolves to the
+* coherent set it was published with.
+*/
+async function writeChannelVersionsInPlace(plan, packages) {
+	const releaseMap = new Map(plan.releases.map((r) => [r.name, r]));
+	const originals = /* @__PURE__ */ new Map();
+	for (const release of plan.releases) {
+		const pkg = packages.get(release.name);
+		if (!pkg) continue;
+		const pkgJsonPath = resolve(pkg.dir, "package.json");
+		originals.set(pkgJsonPath, await readText(pkgJsonPath));
+		await updateJsonFields(pkgJsonPath, { version: release.newVersion });
+		for (const depField of [
+			"dependencies",
+			"peerDependencies",
+			"optionalDependencies"
+		]) {
+			const deps = pkg[depField];
+			for (const depName of Object.keys(deps)) {
+				const depRelease = releaseMap.get(depName);
+				if (!depRelease) continue;
+				await updateJsonNestedField(pkgJsonPath, depField, depName, depRelease.newVersion);
+			}
+		}
+	}
+	return async () => {
+		for (const [path, content] of originals) await writeText(path, content);
+	};
+}
+/**
+* Derive display versions for a channel cycle without touching the registry:
+* each target gets a wildcard counter (`1.2.0-rc.x`). Everything here comes from
+* committed state (bump files + config), so PR titles/bodies and commit messages
+* can never disagree with what eventually publishes. Unpublishable packages are
+* dropped, mirroring the filter in `buildChannelReleasePlan`.
+*/
+function channelDisplayPlan(stablePlan, channel, packages) {
+	const releases = stablePlan.releases.filter((r) => {
+		const pkg = packages.get(r.name);
+		return !!pkg && !(pkg.private && !pkg.bumpy?.publishCommand);
+	}).map((r) => ({
+		...r,
+		newVersion: `${r.newVersion}-${channel.preid}.x`
+	}));
+	return {
+		...stablePlan,
+		releases
+	};
+}
+/** One-line summary of a channel plan's versions, for PR titles and commit messages */
+function formatChannelVersionSummary(releases) {
+	if (releases.length === 0) return "";
+	if (releases.length === 1) return `${releases[0].name}@${releases[0].newVersion}`;
+	return `${releases.length} packages`;
+}
+//#endregion
+export { writeChannelVersionsInPlace as i, channelDisplayPlan as n, formatChannelVersionSummary as r, buildChannelReleasePlan as t };

package/dist/{publish-VYBhDYFM.mjs → publish-Ak6jmwi_.mjs}

@@ -1,14 +1,17 @@
-import { n as log, o as __require, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig } from "./config-D_4GYDJi.mjs";
+import { n as log, o as __require, s as __toESM, t as colorize } from "./logger-BgksGFuf.mjs";
+import { a as loadConfig } from "./config-0we4ISZX.mjs";
 import { r as detectWorkspaces } from "./package-manager-Db_vTztt.mjs";
-import { s as discoverWorkspace } from "./bump-file-B7hmXZlB.mjs";
-import { a as DependencyGraph } from "./release-plan-mK7iGeGq.mjs";
+import { c as discoverWorkspace, i as readBumpFiles } from "./bump-file-mRJeReRJ.mjs";
+import { a as require_semver, o as DependencyGraph, t as assembleReleasePlan } from "./release-plan-C84pcBi-.mjs";
 import { r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { i as loadFormatter, n as generateChangelogEntry } from "./changelog-CbaET5V6.mjs";
-import { d as tagExists, l as hasUncommittedChanges, n as forcePushTag } from "./git-BWPimLgc.mjs";
-import { n as willUseOidcExclusively, t as publishPackages } from "./publish-pipeline-BPedWvKS.mjs";
-import { CI_PLAN_CACHE_PATH } from "./ci-B7gF6CFP.mjs";
+import { i as loadFormatter, n as generateChangelogEntry } from "./changelog-DuFhnJRO.mjs";
+import { f as tagExists, l as hasUncommittedChanges, n as forcePushTag } from "./git-DAWj8LyV.mjs";
+import { n as willUseOidcExclusively, t as publishPackages } from "./publish-pipeline-BD8mLbL9.mjs";
+import { channelNames, resolveActiveChannel } from "./channels-CFXZkyGd.mjs";
+import { i as writeChannelVersionsInPlace, t as buildChannelReleasePlan } from "./prerelease-B2PVfXkm.mjs";
+import { CI_PLAN_CACHE_PATH } from "./ci-ChYmDuwy.mjs";
 //#region src/core/github-release.ts
+var import_semver = /* @__PURE__ */ __toESM(require_semver(), 1);
 /** Get the current HEAD commit SHA */
 function getHeadSha(rootDir) {
 	return tryRunArgs([
@@ -67,6 +70,7 @@ async function createIndividualReleases(releases, bumpFiles, rootDir, opts = {})
 				"--notes",
 				body
 			];
+			if (/-/.test(release.newVersion)) args.push("--prerelease");
 			if (headSha) args.push("--target", headSha);
 			await withReleaseToken(() => runArgsAsync(args, { cwd: rootDir }));
 			log.dim(`  Created GitHub release: ${title}`);
@@ -193,7 +197,7 @@ async function findReleaseByTag(tag, rootDir) {
 	}
 }
 /** Create a draft GitHub release */
-async function createDraftRelease(tag, title, body, rootDir, targetSha) {
+async function createDraftRelease(tag, title, body, rootDir, targetSha, opts) {
 	const args = [
 		"gh",
 		"release",
@@ -205,6 +209,7 @@ async function createDraftRelease(tag, title, body, rootDir, targetSha) {
 		body,
 		"--draft"
 	];
+	if (opts?.prerelease) args.push("--prerelease");
 	if (targetSha) args.push("--target", targetSha);
 	await withReleaseToken(() => runArgsAsync(args, { cwd: rootDir }));
 }
@@ -293,7 +298,13 @@ async function finalizeSupersededDrafts(packageName, newVersion, rootDir) {
 //#region src/commands/publish.ts
 /**
 * Publish packages that have been versioned but not yet published.
-* Detects unpublished versions by comparing package.json versions against npm registry.
+*
+* On the base branch: detects unpublished versions by comparing package.json versions
+* against the npm registry.
+*
+* On a channel branch: prerelease versions are never committed, so they are computed
+* here — targets from the cycle's bump files, counters from the registry — written
+* transiently into the working tree, published to the channel's dist-tag, and restored.
 */
 async function publishCommand(rootDir, opts) {
 	const config = await loadConfig(rootDir);
@@ -304,7 +315,21 @@ async function publishCommand(rootDir, opts) {
 		log.warn("You have uncommitted changes. Commit or stash them before publishing.");
 		process.exit(1);
 	}
+	const channel = resolveActiveChannel(rootDir, config, opts.channel);
+	if (channel) {
+		await publishChannel(rootDir, config, packages, catalogs, detectedPm, depGraph, channel, opts);
+		return;
+	}
 	let toPublish = await findUnpublishedWithCache(rootDir, packages, config);
+	if (Object.keys(config.channels || {}).length > 0) {
+		const prereleases = toPublish.filter((r) => import_semver.default.prerelease(r.newVersion) !== null);
+		if (prereleases.length > 0) {
+			log.error("Refusing to publish prerelease versions outside a channel:");
+			for (const r of prereleases) log.error(`  • ${r.name}@${r.newVersion}`);
+			log.error("Prerelease versions should never be committed — see https://bumpy.varlock.dev/docs/prereleases");
+			process.exit(1);
+		}
+	}
 	if (opts.excludePackages && opts.excludePackages.size > 0) {
 		const excluded = toPublish.filter((r) => opts.excludePackages.has(r.name));
 		if (excluded.length > 0) {
@@ -313,7 +338,7 @@ async function publishCommand(rootDir, opts) {
 		}
 	}
 	if (opts.filter) {
-		const { matchGlob } = await import("./config-D_4GYDJi.mjs").then((n) => n.t);
+		const { matchGlob } = await import("./config-0we4ISZX.mjs").then((n) => n.t);
 		const patterns = opts.filter.split(",").map((p) => p.trim());
 		toPublish = toPublish.filter((r) => patterns.some((p) => matchGlob(r.name, p)));
 	}
@@ -323,11 +348,77 @@ async function publishCommand(rootDir, opts) {
 	}
 	const recoveredBumpFiles = opts.recoveredBumpFiles || [];
 	if (recoveredBumpFiles.length > 0) for (const release of toPublish) release.bumpFiles = recoveredBumpFiles.filter((bf) => bf.releases.some((r) => r.name === release.name)).map((bf) => bf.id);
-	const releasePlan = {
+	await runPublishFlow(rootDir, config, packages, catalogs, detectedPm, depGraph, {
 		bumpFiles: recoveredBumpFiles,
 		releases: toPublish,
 		warnings: []
-	};
+	}, {
+		dryRun: opts.dryRun,
+		tag: opts.tag,
+		noPush: opts.noPush
+	});
+}
+/**
+* Publish a prerelease cycle from a channel branch.
+*
+* The cycle = every bump file on the branch (pending at root or in other channels'
+* dirs, plus shipped in this channel's dir). The whole cycle republishes together
+* each time so the channel dist-tag always points at one coherent, exact-pinned set.
+*/
+async function publishChannel(rootDir, config, packages, catalogs, detectedPm, depGraph, channel, opts) {
+	const { bumpFiles, errors: parseErrors } = await readBumpFiles(rootDir, { channels: channelNames(config) });
+	if (parseErrors.length > 0) {
+		for (const err of parseErrors) log.error(err);
+		process.exit(1);
+	}
+	if (bumpFiles.filter((bf) => bf.channel === channel.name).length === 0) {
+		log.info(`Nothing has shipped on channel "${channel.name}" yet (no bump files in .bumpy/${channel.name}/).\n  Run \`bumpy version\` on the channel branch (or merge the release PR) first.`);
+		return;
+	}
+	log.bold(`Channel "${channel.name}" — preid "-${channel.preid}.N", dist-tag @${channel.tag}\n`);
+	const { plan, alreadyPublished, warnings } = await buildChannelReleasePlan(assembleReleasePlan(bumpFiles, packages, depGraph, config, { prereleasePreid: channel.preid }), channel, packages, rootDir);
+	for (const w of warnings) log.warn(w);
+	for (const skip of alreadyPublished) log.dim(`  Skipping ${skip.name}@${skip.version} — already published from this commit`);
+	if (plan.releases.length === 0) {
+		log.info("All cycle packages already published from this commit.");
+		return;
+	}
+	let toPublish = plan.releases;
+	if (opts.filter) {
+		const { matchGlob } = await import("./config-0we4ISZX.mjs").then((n) => n.t);
+		const patterns = opts.filter.split(",").map((p) => p.trim());
+		toPublish = toPublish.filter((r) => patterns.some((p) => matchGlob(r.name, p)));
+		if (toPublish.length === 0) {
+			log.info("No cycle packages match the filter.");
+			return;
+		}
+	}
+	let restore = null;
+	if (!opts.dryRun) restore = await writeChannelVersionsInPlace(plan, packages);
+	try {
+		await runPublishFlow(rootDir, config, packages, catalogs, detectedPm, depGraph, {
+			bumpFiles: plan.bumpFiles,
+			releases: toPublish,
+			warnings: []
+		}, {
+			dryRun: opts.dryRun,
+			tag: opts.tag ?? channel.tag,
+			noPush: opts.noPush
+		});
+	} finally {
+		if (restore) {
+			await restore();
+			log.dim("  Restored package.json files (prerelease versions are not committed)");
+		}
+	}
+}
+/**
+* The shared publish flow: OIDC checks, draft GitHub releases, topological publish,
+* release metadata updates, tag pushes. Used by both the stable and channel paths.
+* Mutates `releasePlan.releases` as packages are filtered out (already published, etc.).
+*/
+async function runPublishFlow(rootDir, config, packages, catalogs, detectedPm, depGraph, releasePlan, opts) {
+	let toPublish = releasePlan.releases;
 	if (opts.dryRun) log.bold("Dry run — would publish:");
 	else log.bold("Publishing:");
 	for (const r of toPublish) console.log(`  ${r.name}@${colorize(r.newVersion, "cyan")}`);
@@ -381,7 +472,7 @@ async function publishCommand(rootDir, opts) {
 				const title = `${release.name} v${release.newVersion}`;
 				const headSha = getHeadSha(rootDir);
 				try {
-					await createDraftRelease(tag, title, body, rootDir, headSha || void 0);
+					await createDraftRelease(tag, title, body, rootDir, headSha || void 0, { prerelease: import_semver.default.prerelease(release.newVersion) !== null });
 					log.dim(`  Created draft release: ${title}`);
 					releaseMetadataByPkg.set(release.name, {
 						tag,

package/dist/{publish-pipeline-BPedWvKS.mjs → publish-pipeline-BD8mLbL9.mjs}

@@ -1,9 +1,9 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { a as readJson, u as updateJsonNestedField } from "./fs-CBXKZhoU.mjs";
 import { s as resolveCatalogDep } from "./package-manager-Db_vTztt.mjs";
-import { i as stripProtocol } from "./release-plan-mK7iGeGq.mjs";
+import { i as stripProtocol } from "./release-plan-C84pcBi-.mjs";
 import { i as runAsync, o as sq, r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { d as tagExists, t as createTag } from "./git-BWPimLgc.mjs";
+import { f as tagExists, t as createTag } from "./git-DAWj8LyV.mjs";
 import { resolve } from "node:path";
 import { unlink } from "node:fs/promises";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";

package/dist/{release-plan-mK7iGeGq.mjs → release-plan-C84pcBi-.mjs}

@@ -1,6 +1,6 @@
 import { i as __commonJSMin, s as __toESM } from "./logger-BgksGFuf.mjs";
-import { c as maxBump, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, s as hasCascade } from "./types-Bkh-igOJ.mjs";
-import { s as matchGlob } from "./config-D_4GYDJi.mjs";
+import { c as maxBump, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, s as hasCascade } from "./types-lpiG-Zxh.mjs";
+import { s as matchGlob } from "./config-0we4ISZX.mjs";
 //#region src/core/dep-graph.ts
 var DependencyGraph = class {
 	/** Map from package name → packages that depend on it */
@@ -1347,8 +1347,8 @@ var require_subset = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = subset;
 }));
 //#endregion
-//#region src/core/semver.ts
-var import_semver = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+//#region ../../node_modules/.bun/semver@7.7.4/node_modules/semver/index.js
+var require_semver = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const internalRe = require_re();
 	const constants = require_constants();
 	const SemVer = require_semver$1();
@@ -1400,7 +1400,10 @@ var import_semver = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exp
 		compareIdentifiers: identifiers.compareIdentifiers,
 		rcompareIdentifiers: identifiers.rcompareIdentifiers
 	};
-})))(), 1);
+}));
+//#endregion
+//#region src/core/semver.ts
+var import_semver = /* @__PURE__ */ __toESM(require_semver(), 1);
 function bumpVersion(version, type) {
 	const result = import_semver.default.inc(version, type);
 	if (!result) throw new Error(`Failed to bump ${version} by ${type}`);
@@ -1433,16 +1436,7 @@ function stripProtocol(range) {
 }
 //#endregion
 //#region src/core/release-plan.ts
-/**
-* Build a release plan from pending bump files, the dependency graph, and config.
-* This is the core algorithm of bumpy.
-*
-* The propagation loop runs three phases until stable:
-*   Phase A — fix out-of-range dependencies (always runs)
-*   Phase B — enforce fixed/linked group constraints
-*   Phase C — apply cascades and proactive propagation rules
-*/
-function assembleReleasePlan(bumpFiles, packages, depGraph, config) {
+function assembleReleasePlan(bumpFiles, packages, depGraph, config, opts = {}) {
 	if (bumpFiles.length === 0) return {
 		bumpFiles: [],
 		releases: [],
@@ -1485,11 +1479,12 @@ function assembleReleasePlan(bumpFiles, packages, depGraph, config) {
 		for (const [pkgName, bump] of planned) {
 			const pkg = packages.get(pkgName);
 			const newVersion = bumpVersion(pkg.version, bump.type);
+			const versionForRangeCheck = opts.prereleasePreid ? `${newVersion}-${opts.prereleasePreid}.0` : newVersion;
 			const dependents = depGraph.getDependents(pkgName);
 			for (const dep of dependents) {
 				if (dep.depType === "devDependencies") continue;
 				const currentVersion = pkg.version;
-				if (satisfies(newVersion, dep.versionRange, currentVersion)) continue;
+				if (satisfies(versionForRangeCheck, dep.versionRange, currentVersion)) continue;
 				let depBump;
 				if (dep.depType === "peerDependencies") depBump = bump.type;
 				else depBump = "patch";
@@ -1704,4 +1699,4 @@ function resolveRule(dependentName, depType, packages, config) {
 	};
 }
 //#endregion
-export { DependencyGraph as a, stripProtocol as i, bumpVersion as n, satisfies as r, assembleReleasePlan as t };
+export { require_semver as a, stripProtocol as i, bumpVersion as n, DependencyGraph as o, satisfies as r, assembleReleasePlan as t };