@varlock/bumpy 1.8.0 → 1.9.0

package/README.md

@@ -50,7 +50,7 @@ Fixed locale fallback logic in utils.
 
 - **All package managers** - npm, pnpm, yarn, and bun workspaces
 - **Smart dependency propagation** - configurable rules for how version bumps cascade through your dependency graph (see [version propagation docs](https://github.com/dmno-dev/bumpy/blob/main/docs/version-propagation.md))
-- **Pack-then-publish** - by default, publishes to npm (resolving `workspace:` and `catalog:` protocols, with OIDC/provenance support). Per-package custom publish commands let you target anything - VSCode extensions, Docker images, JSR, private registries, etc.
+- **Pack-then-publish** - by default, publishes to npm (resolving `workspace:` and `catalog:` protocols, with OIDC/provenance support). Supports [npm staged publishing](https://docs.npmjs.com/about-staged-publishes) for 2FA-gated releases. Per-package custom publish commands let you target anything - VSCode extensions, Docker images, JSR, private registries, etc.
 - **Flexible package management** - include/exclude any package individually via per-package config, glob patterns, or `privatePackages` setting
 - **Non-interactive CLI** - `bumpy add` works fully non-interactively for CI/CD and AI-assisted development
 - **Aggregated GitHub releases** - optionally create a single consolidated release instead of one per package

package/dist/{add-Ci3vfJCF.mjs → add-D3HlRjOy.mjs}

@@ -1,11 +1,11 @@
 import { n as log, r as require_picocolors, s as __toESM } from "./logger-BgksGFuf.mjs";
 import { n as exists, t as ensureDir } from "./fs-CBXKZhoU.mjs";
-import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-gMu1z0bz.mjs";
-import { a as discoverPackages, i as writeBumpFile, o as discoverWorkspace, r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-BZT3KCns.mjs";
-import { r as getChangedFiles } from "./git-nTR-JccX.mjs";
+import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
+import { a as writeBumpFile, o as discoverPackages, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-BOqrdkYP.mjs";
+import { r as getChangedFiles } from "./git-CpJqzpp-.mjs";
 import { l as pt, o as gt, r as Ot, s as mt, t as unwrap, u as wt } from "./clack-W95rXis0.mjs";
 import { n as slugify, t as randomName } from "./names-COooXAFg.mjs";
-import { n as findChangedPackages, r as require_picomatch } from "./check-C-l4yr0C.mjs";
+import { n as findChangedPackages, r as require_picomatch } from "./check-Dc0ts_q3.mjs";
 import { relative, resolve } from "node:path";
 import * as readline from "node:readline";
 //#region src/prompts/bump-select.ts

package/dist/{apply-release-plan-DncfboRW.mjs → apply-release-plan-CCoCcpdv.mjs}

@@ -1,6 +1,6 @@
 import { a as readJson, c as removeFile, f as writeText, i as listFiles, l as updateJsonFields, n as exists, s as readText, u as updateJsonNestedField } from "./fs-CBXKZhoU.mjs";
-import { r as getBumpyDir } from "./config-gMu1z0bz.mjs";
-import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry } from "./changelog-CFWf9s2q.mjs";
+import { r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
+import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry } from "./changelog-DrAf-rL6.mjs";
 import { resolve } from "node:path";
 //#region src/core/apply-release-plan.ts
 /** Apply the release plan: bump versions, update changelogs, delete bump files */

package/dist/{bump-file-BZT3KCns.mjs → bump-file-BOqrdkYP.mjs}

@@ -1,5 +1,5 @@
 import { a as readJson, f as writeText, i as listFiles, n as exists, s as readText } from "./fs-CBXKZhoU.mjs";
-import { i as isPackageManaged, o as loadPackageConfig, r as getBumpyDir } from "./config-gMu1z0bz.mjs";
+import { i as isPackageManaged, o as loadPackageConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
 import { i as jsYaml, n as detectWorkspaces } from "./package-manager-BQPwXwu5.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
 import { relative, resolve } from "node:path";
@@ -272,6 +272,37 @@ async function writeBumpFile(rootDir, filename, releases, summary) {
 	}).trim()}\n---\n\n${summary}\n`);
 	return filePath;
 }
+/**
+* Recover bump files that were deleted in the HEAD commit (version commit).
+* Used during the publish-only flow (after version PR merge) to provide
+* bump file context for GitHub release body generation.
+*/
+function recoverDeletedBumpFiles(rootDir) {
+	const deleted = tryRunArgs([
+		"git",
+		"diff",
+		"--diff-filter=D",
+		"--name-only",
+		"HEAD~1",
+		"HEAD",
+		"--",
+		".bumpy/*.md"
+	], { cwd: rootDir });
+	if (!deleted) return [];
+	const bumpFiles = [];
+	for (const filePath of deleted.split("\n").filter(Boolean)) {
+		if (filePath.endsWith("README.md")) continue;
+		const content = tryRunArgs([
+			"git",
+			"show",
+			`HEAD~1:${filePath}`
+		], { cwd: rootDir });
+		if (!content) continue;
+		const { bumpFile } = parseBumpFile(content, filePath.replace(/^\.bumpy\//, "").replace(/\.md$/, ""));
+		if (bumpFile) bumpFiles.push(bumpFile);
+	}
+	return bumpFiles;
+}
 function fileToId(filePath) {
 	return filePath.split("/").pop().replace(/\.md$/, "");
 }
@@ -309,4 +340,4 @@ function filterBranchBumpFiles(allBumpFiles, changedFiles, rootDir, parseErrors
 	};
 }
 //#endregion
-export { discoverPackages as a, writeBumpFile as i, parseBumpFile as n, discoverWorkspace as o, readBumpFiles as r, filterBranchBumpFiles as t };
+export { writeBumpFile as a, recoverDeletedBumpFiles as i, parseBumpFile as n, discoverPackages as o, readBumpFiles as r, discoverWorkspace as s, filterBranchBumpFiles as t };

package/dist/{changelog-CFWf9s2q.mjs → changelog-DrAf-rL6.mjs}

@@ -1,5 +1,5 @@
 import { n as log } from "./logger-BgksGFuf.mjs";
-import { c as maxBump, t as BUMP_LEVELS } from "./types-CAwBhUsn.mjs";
+import { c as maxBump, t as BUMP_LEVELS } from "./types-CL2pqN9N.mjs";
 import { relative, resolve } from "node:path";
 import { realpathSync } from "node:fs";
 //#region src/core/changelog.ts
@@ -45,7 +45,7 @@ const defaultFormatter = (ctx) => {
 const BUILTIN_FORMATTERS = {
 	default: defaultFormatter,
 	github: async () => {
-		const { createGithubFormatter } = await import("./changelog-github-T5LqaTwV.mjs");
+		const { createGithubFormatter } = await import("./changelog-github-BYqd2jw1.mjs");
 		return createGithubFormatter();
 	}
 };
@@ -56,7 +56,7 @@ const BUILTIN_FORMATTERS = {
 async function loadFormatter(changelog, rootDir) {
 	const [name, options] = Array.isArray(changelog) ? changelog : [changelog, {}];
 	if (name === "github") {
-		const { createGithubFormatter } = await import("./changelog-github-T5LqaTwV.mjs");
+		const { createGithubFormatter } = await import("./changelog-github-BYqd2jw1.mjs");
 		return createGithubFormatter(options);
 	}
 	if (typeof name === "string" && BUILTIN_FORMATTERS[name]) {

package/dist/{changelog-github-T5LqaTwV.mjs → changelog-github-BYqd2jw1.mjs}

@@ -1,6 +1,6 @@
-import { c as maxBump } from "./types-CAwBhUsn.mjs";
+import { c as maxBump } from "./types-CL2pqN9N.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { o as sortBumpFilesByType, r as getBumpTypeForPackage } from "./changelog-CFWf9s2q.mjs";
+import { o as sortBumpFilesByType, r as getBumpTypeForPackage } from "./changelog-DrAf-rL6.mjs";
 //#region src/core/changelog-github.ts
 /** Authors filtered from "Thanks" attribution by default (e.g. bots) */
 /** Authors filtered from "Thanks" attribution by default (e.g. AI/automation bots) */

package/dist/{check-C-l4yr0C.mjs → check-Dc0ts_q3.mjs}

@@ -1,7 +1,7 @@
 import { a as __exportAll, i as __commonJSMin, n as log, s as __toESM, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-gMu1z0bz.mjs";
-import { o as discoverWorkspace, r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-BZT3KCns.mjs";
-import { a as getFileStatuses, r as getChangedFiles } from "./git-nTR-JccX.mjs";
+import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
+import { r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-BOqrdkYP.mjs";
+import { a as getFileStatuses, r as getChangedFiles } from "./git-CpJqzpp-.mjs";
 import { relative } from "node:path";
 //#region ../../node_modules/.bun/picomatch@4.0.4/node_modules/picomatch/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {

package/dist/{ci-Ukh4gbGo.mjs → ci-9tmC3oNF.mjs}

@@ -1,12 +1,12 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig } from "./config-gMu1z0bz.mjs";
+import { a as loadConfig } from "./config-CDC1Y_ye.mjs";
 import { t as detectPackageManager } from "./package-manager-BQPwXwu5.mjs";
-import { o as discoverWorkspace, r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-BZT3KCns.mjs";
-import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-7ApKPR6T.mjs";
+import { i as recoverDeletedBumpFiles, r as readBumpFiles, s as discoverWorkspace, t as filterBranchBumpFiles } from "./bump-file-BOqrdkYP.mjs";
+import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-Ck_DlgcK.mjs";
 import { n as runArgs, r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { r as getChangedFiles } from "./git-nTR-JccX.mjs";
+import { d as withGitToken, r as getChangedFiles } from "./git-CpJqzpp-.mjs";
 import { t as randomName } from "./names-COooXAFg.mjs";
-import { n as findChangedPackages } from "./check-C-l4yr0C.mjs";
+import { n as findChangedPackages } from "./check-Dc0ts_q3.mjs";
 import { t as resolveCommitMessage } from "./commit-message-CSWVKPJ-.mjs";
 import { appendFileSync, mkdirSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -155,7 +155,7 @@ async function ciPlanCommand(rootDir) {
 			packageNames: plan.releases.map((r) => r.name)
 		};
 	} else {
-		const { findUnpublishedPackages } = await import("./publish-X8IGj3AF.mjs");
+		const { findUnpublishedPackages } = await import("./publish-BplMRp4-.mjs");
 		const unpublished = await findUnpublishedPackages(packages, config);
 		if (unpublished.length > 0) output = {
 			mode: "publish",
@@ -225,8 +225,12 @@ async function ciReleaseCommand(rootDir, opts) {
 	}
 	if (bumpFiles.length === 0) {
 		log.info("No pending bump files — checking for unpublished packages...");
-		const { publishCommand } = await import("./publish-X8IGj3AF.mjs");
-		await publishCommand(rootDir, { tag: opts.tag });
+		const recoveredBumpFiles = recoverDeletedBumpFiles(rootDir);
+		const { publishCommand } = await import("./publish-BplMRp4-.mjs");
+		await publishCommand(rootDir, {
+			tag: opts.tag,
+			recoveredBumpFiles
+		});
 		return;
 	}
 	const plan = assembleReleasePlan(bumpFiles, packages, depGraph, config);
@@ -239,7 +243,7 @@ async function ciReleaseCommand(rootDir, opts) {
 }
 async function autoPublish(rootDir, config, plan, tag) {
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-DvjKjAsp.mjs");
+	const { versionCommand } = await import("./version-fTSOVlym.mjs");
 	await versionCommand(rootDir);
 	log.step("Committing version changes...");
 	runArgs([
@@ -268,7 +272,7 @@ async function autoPublish(rootDir, config, plan, tag) {
 		], { cwd: rootDir });
 	}
 	log.step("Running bumpy publish...");
-	const { publishCommand } = await import("./publish-X8IGj3AF.mjs");
+	const { publishCommand } = await import("./publish-BplMRp4-.mjs");
 	await publishCommand(rootDir, { tag });
 }
 /**
@@ -284,100 +288,7 @@ async function autoPublish(rootDir, config, plan, tag) {
 */
 function pushWithToken(rootDir, branch, config) {
 	if (branch === config.baseBranch || branch === "main" || branch === "master") throw new Error(`Refusing to force-push to "${branch}" — this looks like a base branch, not a version PR branch`);
-	const token = process.env.BUMPY_GH_TOKEN;
-	const repo = process.env.GITHUB_REPOSITORY;
-	const server = process.env.GITHUB_SERVER_URL || "https://github.com";
-	if (token && repo) {
-		const authedUrl = `${server.replace("://", `://x-access-token:${token}@`)}/${repo}.git`;
-		const originalUrl = tryRunArgs([
-			"git",
-			"remote",
-			"get-url",
-			"origin"
-		], { cwd: rootDir });
-		const extraHeaderKey = `http.${server}/.extraheader`;
-		const savedHeader = tryRunArgs([
-			"git",
-			"config",
-			"--local",
-			extraHeaderKey
-		], { cwd: rootDir });
-		const includeIfRaw = tryRunArgs([
-			"git",
-			"config",
-			"--local",
-			"--get-regexp",
-			"^includeif\\.gitdir:"
-		], { cwd: rootDir });
-		const savedIncludeIfs = [];
-		if (includeIfRaw) for (const line of includeIfRaw.split("\n").filter(Boolean)) {
-			const spaceIdx = line.indexOf(" ");
-			if (spaceIdx > 0) savedIncludeIfs.push({
-				key: line.slice(0, spaceIdx),
-				value: line.slice(spaceIdx + 1)
-			});
-		}
-		try {
-			if (savedHeader) runArgs([
-				"git",
-				"config",
-				"--local",
-				"--unset-all",
-				extraHeaderKey
-			], { cwd: rootDir });
-			for (const entry of savedIncludeIfs) tryRunArgs([
-				"git",
-				"config",
-				"--local",
-				"--unset",
-				entry.key
-			], { cwd: rootDir });
-			runArgs([
-				"git",
-				"remote",
-				"set-url",
-				"origin",
-				authedUrl
-			], { cwd: rootDir });
-			try {
-				runArgs([
-					"git",
-					"push",
-					"-u",
-					"origin",
-					branch,
-					"--force",
-					"--no-verify"
-				], { cwd: rootDir });
-			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
-				throw new Error(msg.replaceAll(token, "***"));
-			}
-		} finally {
-			if (originalUrl) runArgs([
-				"git",
-				"remote",
-				"set-url",
-				"origin",
-				originalUrl
-			], { cwd: rootDir });
-			if (savedHeader) runArgs([
-				"git",
-				"config",
-				"--local",
-				extraHeaderKey,
-				savedHeader
-			], { cwd: rootDir });
-			for (const entry of savedIncludeIfs) tryRunArgs([
-				"git",
-				"config",
-				"--local",
-				entry.key,
-				entry.value
-			], { cwd: rootDir });
-		}
-		log.dim("  Pushed with custom token — PR workflows will be triggered");
-	} else {
+	withGitToken(rootDir, () => {
 		runArgs([
 			"git",
 			"push",
@@ -387,8 +298,9 @@ function pushWithToken(rootDir, branch, config) {
 			"--force",
 			"--no-verify"
 		], { cwd: rootDir });
-		if (!token && repo) log.warn("BUMPY_GH_TOKEN is not set — PR checks will not trigger automatically.\n  Run `bumpy ci setup` for help.");
-	}
+	});
+	if (process.env.BUMPY_GH_TOKEN && process.env.GITHUB_REPOSITORY) log.dim("  Pushed with custom token — PR workflows will be triggered");
+	else if (!process.env.BUMPY_GH_TOKEN && process.env.GITHUB_REPOSITORY) log.warn("BUMPY_GH_TOKEN is not set — PR checks will not trigger automatically.\n  Run `bumpy ci setup` for help.");
 }
 async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 	const branch = validateBranchName(branchName || config.versionPr.branch);
@@ -434,7 +346,7 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 		branch
 	], { cwd: rootDir });
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-DvjKjAsp.mjs");
+	const { versionCommand } = await import("./version-fTSOVlym.mjs");
 	await versionCommand(rootDir);
 	runArgs([
 		"git",

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
-import { n as findRoot } from "./config-gMu1z0bz.mjs";
+import { n as findRoot } from "./config-CDC1Y_ye.mjs";
 //#region src/cli.ts
 const args = process.argv.slice(2);
 const command = args[0];
@@ -31,7 +31,7 @@ async function main() {
 			}
 			case "add": {
 				const rootDir = await findRoot();
-				const { addCommand } = await import("./add-Ci3vfJCF.mjs");
+				const { addCommand } = await import("./add-D3HlRjOy.mjs");
 				await addCommand(rootDir, {
 					packages: flags.packages,
 					message: flags.message,
@@ -43,7 +43,7 @@ async function main() {
 			}
 			case "status": {
 				const rootDir = await findRoot();
-				const { statusCommand } = await import("./status-Cgr3Opiw.mjs");
+				const { statusCommand } = await import("./status-CV8wBBiI.mjs");
 				await statusCommand(rootDir, {
 					json: flags.json === true,
 					packagesOnly: flags.packages === true,
@@ -55,13 +55,13 @@ async function main() {
 			}
 			case "version": {
 				const rootDir = await findRoot();
-				const { versionCommand } = await import("./version-DvjKjAsp.mjs");
+				const { versionCommand } = await import("./version-fTSOVlym.mjs");
 				await versionCommand(rootDir, { commit: flags.commit === true });
 				break;
 			}
 			case "generate": {
 				const rootDir = await findRoot();
-				const { generateCommand } = await import("./generate-BuH9DEZO.mjs");
+				const { generateCommand } = await import("./generate-BgKOXV47.mjs");
 				await generateCommand(rootDir, {
 					from: flags.from,
 					dryRun: flags["dry-run"] === true,
@@ -71,7 +71,7 @@ async function main() {
 			}
 			case "check": {
 				const rootDir = await findRoot();
-				const { checkCommand } = await import("./check-C-l4yr0C.mjs").then((n) => n.t);
+				const { checkCommand } = await import("./check-Dc0ts_q3.mjs").then((n) => n.t);
 				const hookValue = flags.hook;
 				if (hookValue && hookValue !== "pre-commit" && hookValue !== "pre-push") {
 					log.error(`Invalid --hook value "${hookValue}". Expected "pre-commit" or "pre-push".`);
@@ -89,17 +89,17 @@ async function main() {
 				const subcommand = args[1];
 				const ciFlags = parseFlags(args.slice(2));
 				if (subcommand === "check") {
-					const { ciCheckCommand } = await import("./ci-Ukh4gbGo.mjs");
+					const { ciCheckCommand } = await import("./ci-9tmC3oNF.mjs");
 					await ciCheckCommand(rootDir, {
 						comment: ciFlags.comment !== void 0 ? ciFlags.comment === true : void 0,
 						strict: ciFlags.strict === true,
 						noFail: ciFlags["no-fail"] === true
 					});
 				} else if (subcommand === "plan") {
-					const { ciPlanCommand } = await import("./ci-Ukh4gbGo.mjs");
+					const { ciPlanCommand } = await import("./ci-9tmC3oNF.mjs");
 					await ciPlanCommand(rootDir);
 				} else if (subcommand === "release") {
-					const { ciReleaseCommand } = await import("./ci-Ukh4gbGo.mjs");
+					const { ciReleaseCommand } = await import("./ci-9tmC3oNF.mjs");
 					await ciReleaseCommand(rootDir, {
 						mode: ciFlags["auto-publish"] === true ? "auto-publish" : "version-pr",
 						tag: ciFlags.tag,
@@ -116,7 +116,7 @@ async function main() {
 			}
 			case "publish": {
 				const rootDir = await findRoot();
-				const { publishCommand } = await import("./publish-X8IGj3AF.mjs");
+				const { publishCommand } = await import("./publish-BplMRp4-.mjs");
 				await publishCommand(rootDir, {
 					dryRun: flags["dry-run"] === true,
 					tag: flags.tag,
@@ -140,7 +140,7 @@ async function main() {
 			}
 			case "--version":
 			case "-v":
-				console.log(`bumpy 1.8.0`);
+				console.log(`bumpy 1.9.0`);
 				break;
 			case "help":
 			case "--help":
@@ -160,7 +160,7 @@ async function main() {
 }
 function printHelp() {
 	console.log(`
-  ${colorize(`🐸 bumpy v1.8.0`, "bold")} - Modern monorepo versioning
+  ${colorize(`🐸 bumpy v1.9.0`, "bold")} - Modern monorepo versioning
 
   Usage: bumpy <command> [options]
 

package/dist/{config-gMu1z0bz.mjs → config-CDC1Y_ye.mjs}

@@ -1,6 +1,6 @@
 import { a as __exportAll } from "./logger-BgksGFuf.mjs";
 import { a as readJson, n as exists, o as readJsonc } from "./fs-CBXKZhoU.mjs";
-import { l as normalizeCascadeConfig, r as DEFAULT_CONFIG } from "./types-CAwBhUsn.mjs";
+import { l as normalizeCascadeConfig, r as DEFAULT_CONFIG } from "./types-CL2pqN9N.mjs";
 import { resolve } from "node:path";
 //#region src/core/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({

package/dist/{generate-BuH9DEZO.mjs → generate-BgKOXV47.mjs}

@@ -1,9 +1,9 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { t as ensureDir } from "./fs-CBXKZhoU.mjs";
-import { a as loadConfig, r as getBumpyDir } from "./config-gMu1z0bz.mjs";
-import { a as discoverPackages, i as writeBumpFile } from "./bump-file-BZT3KCns.mjs";
+import { a as loadConfig, r as getBumpyDir } from "./config-CDC1Y_ye.mjs";
+import { a as writeBumpFile, o as discoverPackages } from "./bump-file-BOqrdkYP.mjs";
 import { s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { n as getBranchCommits, o as getFilesChangedInCommit } from "./git-nTR-JccX.mjs";
+import { n as getBranchCommits, o as getFilesChangedInCommit } from "./git-CpJqzpp-.mjs";
 import { n as slugify, t as randomName } from "./names-COooXAFg.mjs";
 import { relative } from "node:path";
 //#region src/commands/generate.ts

package/dist/{git-nTR-JccX.mjs → git-CpJqzpp-.mjs}

@@ -8,14 +8,111 @@ function createTag(tag, opts) {
 		tag
 	], opts);
 }
-/** Push commits and tags to remote */
+/** Push tags to remote, using BUMPY_GH_TOKEN if available */
 function pushWithTags(opts) {
-	runArgs(["git", "push"], opts);
-	runArgs([
+	withGitToken(opts?.cwd, () => {
+		runArgs([
+			"git",
+			"push",
+			"--tags"
+		], opts);
+	});
+}
+/**
+* Temporarily configure git credentials using BUMPY_GH_TOKEN (or GH_TOKEN),
+* execute a callback, then restore the original config.
+*
+* Embeds the token in the remote URL and clears any existing credential config
+* set by actions/checkout (extraheader or includeIf entries) so our token is
+* used instead of the default GITHUB_TOKEN.
+*/
+function withGitToken(cwd, fn) {
+	const token = process.env.BUMPY_GH_TOKEN || process.env.GH_TOKEN;
+	const server = process.env.GITHUB_SERVER_URL || "https://github.com";
+	if (!token) {
+		fn();
+		return;
+	}
+	const extraHeaderKey = `http.${server}/.extraheader`;
+	const savedHeader = tryRunArgs([
 		"git",
-		"push",
-		"--tags"
-	], opts);
+		"config",
+		"--local",
+		extraHeaderKey
+	], { cwd });
+	const includeIfRaw = tryRunArgs([
+		"git",
+		"config",
+		"--local",
+		"--get-regexp",
+		"^includeif\\.gitdir:"
+	], { cwd });
+	const savedIncludeIfs = [];
+	if (includeIfRaw) for (const line of includeIfRaw.split("\n").filter(Boolean)) {
+		const spaceIdx = line.indexOf(" ");
+		if (spaceIdx > 0) savedIncludeIfs.push({
+			key: line.slice(0, spaceIdx),
+			value: line.slice(spaceIdx + 1)
+		});
+	}
+	const originalUrl = tryRunArgs([
+		"git",
+		"remote",
+		"get-url",
+		"origin"
+	], { cwd });
+	const authedUrl = originalUrl ? originalUrl.replace(/^https:\/\//, `https://x-access-token:${token}@`) : null;
+	try {
+		if (savedHeader) runArgs([
+			"git",
+			"config",
+			"--local",
+			"--unset-all",
+			extraHeaderKey
+		], { cwd });
+		for (const entry of savedIncludeIfs) tryRunArgs([
+			"git",
+			"config",
+			"--local",
+			"--unset",
+			entry.key
+		], { cwd });
+		if (authedUrl) runArgs([
+			"git",
+			"remote",
+			"set-url",
+			"origin",
+			authedUrl
+		], { cwd });
+		try {
+			fn();
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			throw new Error(msg.replaceAll(token, "***"));
+		}
+	} finally {
+		if (originalUrl) runArgs([
+			"git",
+			"remote",
+			"set-url",
+			"origin",
+			originalUrl
+		], { cwd });
+		if (savedHeader) runArgs([
+			"git",
+			"config",
+			"--local",
+			extraHeaderKey,
+			savedHeader
+		], { cwd });
+		for (const entry of savedIncludeIfs) tryRunArgs([
+			"git",
+			"config",
+			"--local",
+			entry.key,
+			entry.value
+		], { cwd });
+	}
 }
 /** Check if there are uncommitted changes */
 function hasUncommittedChanges(opts) {
@@ -156,4 +253,4 @@ function listTags(pattern, opts) {
 	return result.split("\n").filter(Boolean);
 }
 //#endregion
-export { getFileStatuses as a, listTags as c, getCurrentBranch as i, pushWithTags as l, getBranchCommits as n, getFilesChangedInCommit as o, getChangedFiles as r, hasUncommittedChanges as s, createTag as t, tagExists as u };
+export { getFileStatuses as a, listTags as c, withGitToken as d, getCurrentBranch as i, pushWithTags as l, getBranchCommits as n, getFilesChangedInCommit as o, getChangedFiles as r, hasUncommittedChanges as s, createTag as t, tagExists as u };

package/dist/index.d.mts

@@ -38,6 +38,13 @@ interface PublishConfig {
    * Default: "pack"
    */
   protocolResolution: 'pack' | 'in-place' | 'none';
+  /**
+   * Use npm staged publishing (`npm stage publish`).
+   * Stages the publish on npmjs.com, requiring manual 2FA approval before going live.
+   * Only works with publishManager "npm" and requires npm >= 11.5.1.
+   * Default: false
+   */
+  npmStaged: boolean;
 }
 interface BumpyConfig {
   baseBranch: string;

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { a as DEP_TYPES, c as maxBump, i as DEFAULT_PUBLISH_CONFIG, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, r as DEFAULT_CONFIG, s as hasCascade, t as BUMP_LEVELS } from "./types-CAwBhUsn.mjs";
-import { a as loadConfig, n as findRoot, r as getBumpyDir, s as matchGlob } from "./config-gMu1z0bz.mjs";
-import { a as discoverPackages, i as writeBumpFile, n as parseBumpFile, r as readBumpFiles } from "./bump-file-BZT3KCns.mjs";
-import { a as DependencyGraph, i as stripProtocol, n as bumpVersion, r as satisfies, t as assembleReleasePlan } from "./release-plan-7ApKPR6T.mjs";
-import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry, t as defaultFormatter } from "./changelog-CFWf9s2q.mjs";
-import { t as applyReleasePlan } from "./apply-release-plan-DncfboRW.mjs";
-import { t as publishPackages } from "./publish-pipeline-DHSCchtX.mjs";
+import { a as DEP_TYPES, c as maxBump, i as DEFAULT_PUBLISH_CONFIG, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, r as DEFAULT_CONFIG, s as hasCascade, t as BUMP_LEVELS } from "./types-CL2pqN9N.mjs";
+import { a as loadConfig, n as findRoot, r as getBumpyDir, s as matchGlob } from "./config-CDC1Y_ye.mjs";
+import { a as writeBumpFile, n as parseBumpFile, o as discoverPackages, r as readBumpFiles } from "./bump-file-BOqrdkYP.mjs";
+import { a as DependencyGraph, i as stripProtocol, n as bumpVersion, r as satisfies, t as assembleReleasePlan } from "./release-plan-Ck_DlgcK.mjs";
+import { a as prependToChangelog, i as loadFormatter, n as generateChangelogEntry, t as defaultFormatter } from "./changelog-DrAf-rL6.mjs";
+import { t as applyReleasePlan } from "./apply-release-plan-CCoCcpdv.mjs";
+import { t as publishPackages } from "./publish-pipeline-BGyQsVyw.mjs";
 export { BUMP_LEVELS, DEFAULT_BUMP_RULES, DEFAULT_CONFIG, DEFAULT_PUBLISH_CONFIG, DEP_TYPES, DependencyGraph, applyReleasePlan, assembleReleasePlan, bumpLevel, bumpVersion, defaultFormatter, discoverPackages, findRoot, generateChangelogEntry, getBumpyDir, hasCascade, loadConfig, loadFormatter, matchGlob, maxBump, normalizeCascadeConfig, parseBumpFile, prependToChangelog, publishPackages, readBumpFiles, satisfies, stripProtocol, writeBumpFile };

package/dist/{publish-X8IGj3AF.mjs → publish-BplMRp4-.mjs}

@@ -1,13 +1,13 @@
 import { n as log, o as __require, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig } from "./config-gMu1z0bz.mjs";
+import { a as loadConfig } from "./config-CDC1Y_ye.mjs";
 import { n as detectWorkspaces } from "./package-manager-BQPwXwu5.mjs";
-import { o as discoverWorkspace } from "./bump-file-BZT3KCns.mjs";
-import { a as DependencyGraph } from "./release-plan-7ApKPR6T.mjs";
+import { s as discoverWorkspace } from "./bump-file-BOqrdkYP.mjs";
+import { a as DependencyGraph } from "./release-plan-Ck_DlgcK.mjs";
 import { r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { i as loadFormatter, n as generateChangelogEntry } from "./changelog-CFWf9s2q.mjs";
-import { c as listTags, l as pushWithTags, s as hasUncommittedChanges } from "./git-nTR-JccX.mjs";
-import { t as publishPackages } from "./publish-pipeline-DHSCchtX.mjs";
-import { CI_PLAN_CACHE_PATH } from "./ci-Ukh4gbGo.mjs";
+import { i as loadFormatter, n as generateChangelogEntry } from "./changelog-DrAf-rL6.mjs";
+import { c as listTags, l as pushWithTags, s as hasUncommittedChanges } from "./git-CpJqzpp-.mjs";
+import { t as publishPackages } from "./publish-pipeline-BGyQsVyw.mjs";
+import { CI_PLAN_CACHE_PATH } from "./ci-9tmC3oNF.mjs";
 //#region src/core/github-release.ts
 /** Get the current HEAD commit SHA */
 function getHeadSha(rootDir) {
@@ -197,7 +197,7 @@ async function publishCommand(rootDir, opts) {
 	}
 	let toPublish = await findUnpublishedWithCache(rootDir, packages, config);
 	if (opts.filter) {
-		const { matchGlob } = await import("./config-gMu1z0bz.mjs").then((n) => n.t);
+		const { matchGlob } = await import("./config-CDC1Y_ye.mjs").then((n) => n.t);
 		const patterns = opts.filter.split(",").map((p) => p.trim());
 		toPublish = toPublish.filter((r) => patterns.some((p) => matchGlob(r.name, p)));
 	}
@@ -205,8 +205,10 @@ async function publishCommand(rootDir, opts) {
 		log.info("No unpublished packages found.");
 		return;
 	}
+	const recoveredBumpFiles = opts.recoveredBumpFiles || [];
+	if (recoveredBumpFiles.length > 0) for (const release of toPublish) release.bumpFiles = recoveredBumpFiles.filter((bf) => bf.releases.some((r) => r.name === release.name)).map((bf) => bf.id);
 	const releasePlan = {
-		bumpFiles: [],
+		bumpFiles: recoveredBumpFiles,
 		releases: toPublish,
 		warnings: []
 	};

package/dist/{publish-pipeline-DHSCchtX.mjs → publish-pipeline-BGyQsVyw.mjs}

@@ -1,9 +1,9 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
 import { a as readJson, u as updateJsonNestedField } from "./fs-CBXKZhoU.mjs";
 import { r as resolveCatalogDep } from "./package-manager-BQPwXwu5.mjs";
-import { i as stripProtocol } from "./release-plan-7ApKPR6T.mjs";
+import { i as stripProtocol } from "./release-plan-Ck_DlgcK.mjs";
 import { i as runAsync, o as sq, r as runArgsAsync, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { t as createTag, u as tagExists } from "./git-nTR-JccX.mjs";
+import { t as createTag, u as tagExists } from "./git-CpJqzpp-.mjs";
 import { resolve } from "node:path";
 import { unlink } from "node:fs/promises";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
@@ -88,6 +88,15 @@ async function publishPackages(releasePlan, packages, depGraph, config, rootDir,
 	};
 	const publishConfig = config.publish;
 	setupNpmAuth(rootDir, publishConfig.publishManager);
+	if (publishConfig.npmStaged) if (publishConfig.publishManager !== "npm") log.warn("Staged publishing is only supported with publishManager \"npm\" — ignoring staged option");
+	else {
+		const npmVersion = tryRunArgs(["npm", "--version"]);
+		if (npmVersion) {
+			const [major, minor, patch] = npmVersion.split(".").map(Number);
+			if (!(major > 11 || major === 11 && (minor > 5 || minor === 5 && patch >= 1))) log.warn(`Staged publishing requires npm >= 11.5.1 (found ${npmVersion})`);
+			else log.dim(`Staged publishing enabled — packages will require 2FA approval on npmjs.com`);
+		}
+	}
 	const packManager = publishConfig.packManager === "auto" ? detectedPm : publishConfig.packManager;
 	const topoOrder = depGraph.topologicalSort(packages);
 	const releaseMap = new Map(releasePlan.releases.map((r) => [r.name, r]));
@@ -200,7 +209,8 @@ function getPackArgs(pm) {
 function buildPublishArgs(pkg, pkgConfig, config, opts, tarball) {
 	const publishManager = config.publish.publishManager;
 	const args = [];
-	if (publishManager === "yarn") args.push("yarn", "npm", "publish");
+	if (config.publish.npmStaged && publishManager === "npm") args.push("npm", "stage", "publish");
+	else if (publishManager === "yarn") args.push("yarn", "npm", "publish");
 	else args.push(publishManager, "publish");
 	if (tarball) args.push(tarball);
 	const access = pkgConfig?.access || config.access;

package/dist/{release-plan-7ApKPR6T.mjs → release-plan-Ck_DlgcK.mjs}

@@ -1,6 +1,6 @@
 import { i as __commonJSMin, s as __toESM } from "./logger-BgksGFuf.mjs";
-import { c as maxBump, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, s as hasCascade } from "./types-CAwBhUsn.mjs";
-import { s as matchGlob } from "./config-gMu1z0bz.mjs";
+import { c as maxBump, l as normalizeCascadeConfig, n as DEFAULT_BUMP_RULES, o as bumpLevel, s as hasCascade } from "./types-CL2pqN9N.mjs";
+import { s as matchGlob } from "./config-CDC1Y_ye.mjs";
 //#region src/core/dep-graph.ts
 var DependencyGraph = class {
 	/** Map from package name → packages that depend on it */

package/dist/{status-Cgr3Opiw.mjs → status-CV8wBBiI.mjs}

@@ -1,8 +1,8 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig } from "./config-gMu1z0bz.mjs";
-import { a as discoverPackages, r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-BZT3KCns.mjs";
-import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-7ApKPR6T.mjs";
-import { i as getCurrentBranch, r as getChangedFiles } from "./git-nTR-JccX.mjs";
+import { a as loadConfig } from "./config-CDC1Y_ye.mjs";
+import { o as discoverPackages, r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-BOqrdkYP.mjs";
+import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-Ck_DlgcK.mjs";
+import { i as getCurrentBranch, r as getChangedFiles } from "./git-CpJqzpp-.mjs";
 //#region src/commands/status.ts
 async function statusCommand(rootDir, opts) {
 	const config = await loadConfig(rootDir);
@@ -29,7 +29,7 @@ async function statusCommand(rootDir, opts) {
 		releases = releases.filter((r) => types.includes(r.type));
 	}
 	if (opts.filter) {
-		const { matchGlob } = await import("./config-gMu1z0bz.mjs").then((n) => n.t);
+		const { matchGlob } = await import("./config-CDC1Y_ye.mjs").then((n) => n.t);
 		const patterns = opts.filter.split(",").map((p) => p.trim());
 		releases = releases.filter((r) => patterns.some((p) => matchGlob(r.name, p)));
 	}

package/dist/{types-CAwBhUsn.mjs → types-CL2pqN9N.mjs}

@@ -49,6 +49,7 @@ const DEFAULT_PUBLISH_CONFIG = {
 	packManager: "auto",
 	publishManager: "npm",
 	publishArgs: [],
+	npmStaged: false,
 	protocolResolution: "pack"
 };
 const DEFAULT_CONFIG = {

package/dist/{version-DvjKjAsp.mjs → version-fTSOVlym.mjs}

@@ -1,10 +1,10 @@
 import { n as log, t as colorize } from "./logger-BgksGFuf.mjs";
-import { a as loadConfig } from "./config-gMu1z0bz.mjs";
+import { a as loadConfig } from "./config-CDC1Y_ye.mjs";
 import { n as detectWorkspaces } from "./package-manager-BQPwXwu5.mjs";
-import { a as discoverPackages, r as readBumpFiles } from "./bump-file-BZT3KCns.mjs";
-import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-7ApKPR6T.mjs";
+import { o as discoverPackages, r as readBumpFiles } from "./bump-file-BOqrdkYP.mjs";
+import { a as DependencyGraph, t as assembleReleasePlan } from "./release-plan-Ck_DlgcK.mjs";
 import { n as runArgs, s as tryRunArgs } from "./shell-C8KgKnMQ.mjs";
-import { t as applyReleasePlan } from "./apply-release-plan-DncfboRW.mjs";
+import { t as applyReleasePlan } from "./apply-release-plan-CCoCcpdv.mjs";
 import { t as resolveCommitMessage } from "./commit-message-CSWVKPJ-.mjs";
 //#region src/commands/version.ts
 async function versionCommand(rootDir, opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varlock/bumpy",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Modern monorepo versioning and changelog tool",
   "keywords": [
     "bump",