relizy 1.5.0-beta.0 → 1.5.0-beta.2

package/dist/cli.mjs

@@ -5,7 +5,7 @@ import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 import { printBanner, logger } from '@maz-ui/node';
 import { Command } from 'commander';
-import { aD as isInCI, aE as getCIName, b as bump, c as changelog, g as publish, e as providerRelease, h as social, p as prComment, r as release } from './shared/relizy.Bpfgbc-1.mjs';
+import { ar as isInCI, R as getCIName, e as bump, g as changelog, aG as publish, aE as providerRelease, aY as social, aD as prComment, aP as release } from './shared/relizy.B0MWtDvR.mjs';
 import 'node:child_process';
 import '@maz-ui/utils/helpers/formatJson';
 import 'c12';
@@ -21,10 +21,10 @@ import 'convert-gitmoji';
 import 'node-fetch-native';
 
 const hasSilentFlag = process.argv.includes("--log-level") && process.argv.includes("silent");
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
+const __filename$1 = fileURLToPath(import.meta.url);
+const __dirname$1 = dirname(__filename$1);
 const packageJson = JSON.parse(
-  readFileSync(join(__dirname, "../package.json"), "utf-8")
+  readFileSync(join(__dirname$1, "../package.json"), "utf-8")
 );
 const version = packageJson.version;
 if (!hasSilentFlag) {

package/dist/index.d.mts

@@ -347,6 +347,12 @@ declare function getPackagesToPublishInIndependentMode(sortedPackages: PackageBa
  * list to publish isn't known yet - prefer `resolveRegistryTargetsForPackages`
  * once it is, so a registry scoped to packages outside this release doesn't
  * needlessly block it.
+ *
+ * When no default `registry` is configured but explicit `registries` are, the
+ * legacy target degrades to an empty URL that would target the ambient
+ * `.npmrc` registry with no managed auth. It is a phantom in that case and is
+ * excluded, so a config that lists every registry explicitly does not
+ * authenticate against a bogus empty registry.
  */
 declare function resolveAllConfiguredRegistryTargets(config: ResolvedRelizyConfig): RegistryTarget[];
 /**
@@ -355,9 +361,15 @@ declare function resolveAllConfiguredRegistryTargets(config: ResolvedRelizyConfi
  * `packageFilter` (mirrored to all packages) or whose `packageFilter` glob
  * patterns match the package name.
  *
- * If any applicable entry is marked `exclusive`, the legacy/default registry
- * is skipped for this package - it is published only to the matching
- * registries instead of mirroring on top of the default one.
+ * The legacy/default registry is skipped for this package when either:
+ * - an applicable entry is marked `exclusive` - the package is published only
+ *   to the matching registries instead of mirroring on top of the default one;
+ * - no default `registry` is configured yet the package already has at least
+ *   one applicable explicit registry. Without a default, the legacy target
+ *   degrades to an empty URL that would publish to the ambient `.npmrc`
+ *   registry with no managed auth, so it is a phantom once real targets exist.
+ *   When nothing else covers the package, the empty legacy target is kept as
+ *   the historical `.npmrc` fallback.
  */
 declare function resolveRegistryTargetsForPackage(pkg: PackageBase, config: ResolvedRelizyConfig): RegistryTarget[];
 /**
@@ -368,6 +380,27 @@ declare function resolveRegistryTargetsForPackage(pkg: PackageBase, config: Reso
  * scoped to packages that are not part of this release does not block it.
  */
 declare function resolveRegistryTargetsForPackages(packages: PackageBase[], config: ResolvedRelizyConfig): RegistryTarget[];
+/**
+ * Run `fn` with the registry target's auth token and scope registry
+ * temporarily written to the project `.npmrc` (at `config.cwd`), then restore
+ * the original file - or remove it if it did not exist - ALWAYS, even on
+ * failure.
+ *
+ * This is the version-proof replacement for passing rc-options as CLI flags:
+ * the `.npmrc` contract is stable across npm/pnpm/bun and every version, so we
+ * never depend on the CLI argument parser (which pnpm changed in v10+). Only
+ * the keys relizy manages are overridden; every other line already in the
+ * user's `.npmrc` is preserved untouched. When there is nothing to inject (no
+ * token/scope, or a package manager that does not read `.npmrc` such as yarn),
+ * the `.npmrc` is left as-is and `fn` runs against the user's own config.
+ */
+declare function withRegistryNpmrc<T>({ config, registryTarget, packageName, packageManager, fn, }: {
+    config: ResolvedRelizyConfig;
+    registryTarget: RegistryTarget;
+    packageName?: string;
+    packageManager: PackageManager;
+    fn: () => Promise<T>;
+}): Promise<T>;
 declare function getAuthCommand({ packageManager, config, otp, registryTarget, }: {
     packageManager: PackageManager;
     config: ResolvedRelizyConfig;
@@ -1248,7 +1281,8 @@ interface RegistryTarget {
      */
     registry: string;
     /**
-     * Registry token - only supported for pnpm and npm
+     * Registry token - supported for npm, pnpm and bun (injected via `.npmrc`).
+     * Yarn is not supported (it uses `.yarnrc.yml`); configure its auth yourself.
      */
     token?: string;
     /**
@@ -1309,7 +1343,8 @@ type PublishConfig = ChangelogConfig$1['publish'] & {
      */
     buildCmd?: string;
     /**
-     * NPM token (e.g. `123456`) - only supported for pnpm and npm
+     * NPM token (e.g. `123456`) - supported for npm, pnpm and bun (injected via
+     * `.npmrc`). Yarn is not supported (it uses `.yarnrc.yml`).
      */
     token?: string;
     /**
@@ -2091,5 +2126,5 @@ declare function socialSafetyCheck({ config }: {
 }): Promise<void>;
 declare function social(options?: Partial<SocialOptions>): Promise<SocialResult>;
 
-export { NEW_PACKAGE_MARKER, PR_COMMENT_MARKER, buildChangelogBody, buildCommentBody, buildCompareLink, buildContributors, bump, capReleaseTypeForZeroMajor, changelog, checkGitStatusIfDirty, collectContributorNames, collectPackageBumps, confirmBump, createCommitAndTags, createGitlabRelease, defineConfig, detectGitProvider, detectPackageManager, detectPullRequest, determinePublishTag, determineReleaseType, determineSemverChange, executeBuildCmd, executeFormatCmd, executeHook, expandPackagesToBumpWithDependents, extractChangelogSummary, extractVersionFromPackageTag, extractVersionFromTag, fetchGitTags, filterOutPrivatePackages, findGitHubPR, findGitLabMR, findReachableCommitBySubject, formatChangelogForSlack, formatPackagesForSlack, formatSlackMessage, formatTweetMessage, generateChangelog, generateMarkDown, getAuthCommand, getBumpedIndependentPackages, getBumpedPackageIndependently, getCIName, getCanaryVersion, getCommitSubject, getCurrentGitBranch, getCurrentGitRef, getDefaultConfig, getDependentsOf, getFirstCommit, getGitStatus, getIndependentTag, getLastPackageTag, getLastRepoTag, getLastStableTag, getLastTag, getModifiedReleaseFilePatterns, getNpmRegistry, getPackageCommits, getPackageDependencies, getPackageNewVersion, getPackages, getPackagesOrBumpedPackages, getPackagesToPublishInIndependentMode, getPackagesToPublishInSelectiveMode, getPreid, getReleaseUrl, getRootPackage, getShortCommitSha, getSlackToken, getSlackWebhookUrl, getTwitterCredentials, github, gitlab, hasLernaJson, isAncestor, isBumpedPackage, isChangedPreid, isGraduating, isGraduatingToStableBetweenVersion, isInCI, isPrerelease, isPrereleaseReleaseType, isStableReleaseType, isTagVersionCompatibleWithCurrent, loadRelizyConfig, mergeTypes, parseChangelogMarkdown, parseGitRemoteUrl, postPrComment, postReleaseToSlack, postReleaseToTwitter, prComment, providerRelease, providerReleaseSafetyCheck, publish, publishPackage, publishSafetyCheck, pushCommitAndTags, pushTagForce, readPackageJson, readPackages, reconcileFromTag, redactSecrets, release, resetRewrittenTagCache, resolveAllConfiguredRegistryTargets, resolveRegistryTargetsForPackage, resolveRegistryTargetsForPackages, resolveTags, retagAnnotatedLocal, rollbackModifiedFiles, shouldFilterPrereleaseTags, social, socialSafetyCheck, tagExists, topologicalSort, updateLernaVersion, writeChangelogToFile, writeVersion };
+export { NEW_PACKAGE_MARKER, PR_COMMENT_MARKER, buildChangelogBody, buildCommentBody, buildCompareLink, buildContributors, bump, capReleaseTypeForZeroMajor, changelog, checkGitStatusIfDirty, collectContributorNames, collectPackageBumps, confirmBump, createCommitAndTags, createGitlabRelease, defineConfig, detectGitProvider, detectPackageManager, detectPullRequest, determinePublishTag, determineReleaseType, determineSemverChange, executeBuildCmd, executeFormatCmd, executeHook, expandPackagesToBumpWithDependents, extractChangelogSummary, extractVersionFromPackageTag, extractVersionFromTag, fetchGitTags, filterOutPrivatePackages, findGitHubPR, findGitLabMR, findReachableCommitBySubject, formatChangelogForSlack, formatPackagesForSlack, formatSlackMessage, formatTweetMessage, generateChangelog, generateMarkDown, getAuthCommand, getBumpedIndependentPackages, getBumpedPackageIndependently, getCIName, getCanaryVersion, getCommitSubject, getCurrentGitBranch, getCurrentGitRef, getDefaultConfig, getDependentsOf, getFirstCommit, getGitStatus, getIndependentTag, getLastPackageTag, getLastRepoTag, getLastStableTag, getLastTag, getModifiedReleaseFilePatterns, getNpmRegistry, getPackageCommits, getPackageDependencies, getPackageNewVersion, getPackages, getPackagesOrBumpedPackages, getPackagesToPublishInIndependentMode, getPackagesToPublishInSelectiveMode, getPreid, getReleaseUrl, getRootPackage, getShortCommitSha, getSlackToken, getSlackWebhookUrl, getTwitterCredentials, github, gitlab, hasLernaJson, isAncestor, isBumpedPackage, isChangedPreid, isGraduating, isGraduatingToStableBetweenVersion, isInCI, isPrerelease, isPrereleaseReleaseType, isStableReleaseType, isTagVersionCompatibleWithCurrent, loadRelizyConfig, mergeTypes, parseChangelogMarkdown, parseGitRemoteUrl, postPrComment, postReleaseToSlack, postReleaseToTwitter, prComment, providerRelease, providerReleaseSafetyCheck, publish, publishPackage, publishSafetyCheck, pushCommitAndTags, pushTagForce, readPackageJson, readPackages, reconcileFromTag, redactSecrets, release, resetRewrittenTagCache, resolveAllConfiguredRegistryTargets, resolveRegistryTargetsForPackage, resolveRegistryTargetsForPackages, resolveTags, retagAnnotatedLocal, rollbackModifiedFiles, shouldFilterPrereleaseTags, social, socialSafetyCheck, tagExists, topologicalSort, updateLernaVersion, withRegistryNpmrc, writeChangelogToFile, writeVersion };
 export type { AIConfig, AIPromptTarget, AIProviderName, AISocialConfig, AISystemPromptOverrides, AITargetConfig, BumpConfig, BumpOptions, BumpResult, BumpResultFalsy, BumpResultTruthy, ChangelogConfig, ChangelogInclude, ChangelogOptions, ClaudeCodeProviderOptions, ConfigType, GitProvider, GitlabRelease, GitlabReleaseResponse, HookConfig, HookStep, HookType, MonorepoConfig, OnRewrittenTag, PackageBase, PackageBumpEntry, PackageManager, PostedRelease, PrCommentConfig, PrCommentMode, PrCommentOptions, PrCommentStatus, ProviderReleaseOptions, ProviderReleaseResult, PublishConfig, PublishOptions, PublishResponse, PullRequestInfo, ReadPackage, Reference, RegistryTarget, ReleaseConfig, ReleaseContext, ReleaseOptions, RelizyConfig, RepoConfig, ResolvedConfig, ResolvedRelizyConfig, ResolvedTags, ResolvedTwitterCredentials, RootPackage, SlackCredentials, SlackOptions, SlackPackageEntry, SlackSocialConfig, SocialConfig, SocialNetworkResult, SocialOptions, SocialResult, Step, TemplatesConfig, TokensConfig, TwitterCredentials, TwitterOptions, TwitterSocialConfig, VersionMode };

package/dist/index.d.ts

@@ -347,6 +347,12 @@ declare function getPackagesToPublishInIndependentMode(sortedPackages: PackageBa
  * list to publish isn't known yet - prefer `resolveRegistryTargetsForPackages`
  * once it is, so a registry scoped to packages outside this release doesn't
  * needlessly block it.
+ *
+ * When no default `registry` is configured but explicit `registries` are, the
+ * legacy target degrades to an empty URL that would target the ambient
+ * `.npmrc` registry with no managed auth. It is a phantom in that case and is
+ * excluded, so a config that lists every registry explicitly does not
+ * authenticate against a bogus empty registry.
  */
 declare function resolveAllConfiguredRegistryTargets(config: ResolvedRelizyConfig): RegistryTarget[];
 /**
@@ -355,9 +361,15 @@ declare function resolveAllConfiguredRegistryTargets(config: ResolvedRelizyConfi
  * `packageFilter` (mirrored to all packages) or whose `packageFilter` glob
  * patterns match the package name.
  *
- * If any applicable entry is marked `exclusive`, the legacy/default registry
- * is skipped for this package - it is published only to the matching
- * registries instead of mirroring on top of the default one.
+ * The legacy/default registry is skipped for this package when either:
+ * - an applicable entry is marked `exclusive` - the package is published only
+ *   to the matching registries instead of mirroring on top of the default one;
+ * - no default `registry` is configured yet the package already has at least
+ *   one applicable explicit registry. Without a default, the legacy target
+ *   degrades to an empty URL that would publish to the ambient `.npmrc`
+ *   registry with no managed auth, so it is a phantom once real targets exist.
+ *   When nothing else covers the package, the empty legacy target is kept as
+ *   the historical `.npmrc` fallback.
  */
 declare function resolveRegistryTargetsForPackage(pkg: PackageBase, config: ResolvedRelizyConfig): RegistryTarget[];
 /**
@@ -368,6 +380,27 @@ declare function resolveRegistryTargetsForPackage(pkg: PackageBase, config: Reso
  * scoped to packages that are not part of this release does not block it.
  */
 declare function resolveRegistryTargetsForPackages(packages: PackageBase[], config: ResolvedRelizyConfig): RegistryTarget[];
+/**
+ * Run `fn` with the registry target's auth token and scope registry
+ * temporarily written to the project `.npmrc` (at `config.cwd`), then restore
+ * the original file - or remove it if it did not exist - ALWAYS, even on
+ * failure.
+ *
+ * This is the version-proof replacement for passing rc-options as CLI flags:
+ * the `.npmrc` contract is stable across npm/pnpm/bun and every version, so we
+ * never depend on the CLI argument parser (which pnpm changed in v10+). Only
+ * the keys relizy manages are overridden; every other line already in the
+ * user's `.npmrc` is preserved untouched. When there is nothing to inject (no
+ * token/scope, or a package manager that does not read `.npmrc` such as yarn),
+ * the `.npmrc` is left as-is and `fn` runs against the user's own config.
+ */
+declare function withRegistryNpmrc<T>({ config, registryTarget, packageName, packageManager, fn, }: {
+    config: ResolvedRelizyConfig;
+    registryTarget: RegistryTarget;
+    packageName?: string;
+    packageManager: PackageManager;
+    fn: () => Promise<T>;
+}): Promise<T>;
 declare function getAuthCommand({ packageManager, config, otp, registryTarget, }: {
     packageManager: PackageManager;
     config: ResolvedRelizyConfig;
@@ -1248,7 +1281,8 @@ interface RegistryTarget {
      */
     registry: string;
     /**
-     * Registry token - only supported for pnpm and npm
+     * Registry token - supported for npm, pnpm and bun (injected via `.npmrc`).
+     * Yarn is not supported (it uses `.yarnrc.yml`); configure its auth yourself.
      */
     token?: string;
     /**
@@ -1309,7 +1343,8 @@ type PublishConfig = ChangelogConfig$1['publish'] & {
      */
     buildCmd?: string;
     /**
-     * NPM token (e.g. `123456`) - only supported for pnpm and npm
+     * NPM token (e.g. `123456`) - supported for npm, pnpm and bun (injected via
+     * `.npmrc`). Yarn is not supported (it uses `.yarnrc.yml`).
      */
     token?: string;
     /**
@@ -2091,5 +2126,5 @@ declare function socialSafetyCheck({ config }: {
 }): Promise<void>;
 declare function social(options?: Partial<SocialOptions>): Promise<SocialResult>;
 
-export { NEW_PACKAGE_MARKER, PR_COMMENT_MARKER, buildChangelogBody, buildCommentBody, buildCompareLink, buildContributors, bump, capReleaseTypeForZeroMajor, changelog, checkGitStatusIfDirty, collectContributorNames, collectPackageBumps, confirmBump, createCommitAndTags, createGitlabRelease, defineConfig, detectGitProvider, detectPackageManager, detectPullRequest, determinePublishTag, determineReleaseType, determineSemverChange, executeBuildCmd, executeFormatCmd, executeHook, expandPackagesToBumpWithDependents, extractChangelogSummary, extractVersionFromPackageTag, extractVersionFromTag, fetchGitTags, filterOutPrivatePackages, findGitHubPR, findGitLabMR, findReachableCommitBySubject, formatChangelogForSlack, formatPackagesForSlack, formatSlackMessage, formatTweetMessage, generateChangelog, generateMarkDown, getAuthCommand, getBumpedIndependentPackages, getBumpedPackageIndependently, getCIName, getCanaryVersion, getCommitSubject, getCurrentGitBranch, getCurrentGitRef, getDefaultConfig, getDependentsOf, getFirstCommit, getGitStatus, getIndependentTag, getLastPackageTag, getLastRepoTag, getLastStableTag, getLastTag, getModifiedReleaseFilePatterns, getNpmRegistry, getPackageCommits, getPackageDependencies, getPackageNewVersion, getPackages, getPackagesOrBumpedPackages, getPackagesToPublishInIndependentMode, getPackagesToPublishInSelectiveMode, getPreid, getReleaseUrl, getRootPackage, getShortCommitSha, getSlackToken, getSlackWebhookUrl, getTwitterCredentials, github, gitlab, hasLernaJson, isAncestor, isBumpedPackage, isChangedPreid, isGraduating, isGraduatingToStableBetweenVersion, isInCI, isPrerelease, isPrereleaseReleaseType, isStableReleaseType, isTagVersionCompatibleWithCurrent, loadRelizyConfig, mergeTypes, parseChangelogMarkdown, parseGitRemoteUrl, postPrComment, postReleaseToSlack, postReleaseToTwitter, prComment, providerRelease, providerReleaseSafetyCheck, publish, publishPackage, publishSafetyCheck, pushCommitAndTags, pushTagForce, readPackageJson, readPackages, reconcileFromTag, redactSecrets, release, resetRewrittenTagCache, resolveAllConfiguredRegistryTargets, resolveRegistryTargetsForPackage, resolveRegistryTargetsForPackages, resolveTags, retagAnnotatedLocal, rollbackModifiedFiles, shouldFilterPrereleaseTags, social, socialSafetyCheck, tagExists, topologicalSort, updateLernaVersion, writeChangelogToFile, writeVersion };
+export { NEW_PACKAGE_MARKER, PR_COMMENT_MARKER, buildChangelogBody, buildCommentBody, buildCompareLink, buildContributors, bump, capReleaseTypeForZeroMajor, changelog, checkGitStatusIfDirty, collectContributorNames, collectPackageBumps, confirmBump, createCommitAndTags, createGitlabRelease, defineConfig, detectGitProvider, detectPackageManager, detectPullRequest, determinePublishTag, determineReleaseType, determineSemverChange, executeBuildCmd, executeFormatCmd, executeHook, expandPackagesToBumpWithDependents, extractChangelogSummary, extractVersionFromPackageTag, extractVersionFromTag, fetchGitTags, filterOutPrivatePackages, findGitHubPR, findGitLabMR, findReachableCommitBySubject, formatChangelogForSlack, formatPackagesForSlack, formatSlackMessage, formatTweetMessage, generateChangelog, generateMarkDown, getAuthCommand, getBumpedIndependentPackages, getBumpedPackageIndependently, getCIName, getCanaryVersion, getCommitSubject, getCurrentGitBranch, getCurrentGitRef, getDefaultConfig, getDependentsOf, getFirstCommit, getGitStatus, getIndependentTag, getLastPackageTag, getLastRepoTag, getLastStableTag, getLastTag, getModifiedReleaseFilePatterns, getNpmRegistry, getPackageCommits, getPackageDependencies, getPackageNewVersion, getPackages, getPackagesOrBumpedPackages, getPackagesToPublishInIndependentMode, getPackagesToPublishInSelectiveMode, getPreid, getReleaseUrl, getRootPackage, getShortCommitSha, getSlackToken, getSlackWebhookUrl, getTwitterCredentials, github, gitlab, hasLernaJson, isAncestor, isBumpedPackage, isChangedPreid, isGraduating, isGraduatingToStableBetweenVersion, isInCI, isPrerelease, isPrereleaseReleaseType, isStableReleaseType, isTagVersionCompatibleWithCurrent, loadRelizyConfig, mergeTypes, parseChangelogMarkdown, parseGitRemoteUrl, postPrComment, postReleaseToSlack, postReleaseToTwitter, prComment, providerRelease, providerReleaseSafetyCheck, publish, publishPackage, publishSafetyCheck, pushCommitAndTags, pushTagForce, readPackageJson, readPackages, reconcileFromTag, redactSecrets, release, resetRewrittenTagCache, resolveAllConfiguredRegistryTargets, resolveRegistryTargetsForPackage, resolveRegistryTargetsForPackages, resolveTags, retagAnnotatedLocal, rollbackModifiedFiles, shouldFilterPrereleaseTags, social, socialSafetyCheck, tagExists, topologicalSort, updateLernaVersion, withRegistryNpmrc, writeChangelogToFile, writeVersion };
 export type { AIConfig, AIPromptTarget, AIProviderName, AISocialConfig, AISystemPromptOverrides, AITargetConfig, BumpConfig, BumpOptions, BumpResult, BumpResultFalsy, BumpResultTruthy, ChangelogConfig, ChangelogInclude, ChangelogOptions, ClaudeCodeProviderOptions, ConfigType, GitProvider, GitlabRelease, GitlabReleaseResponse, HookConfig, HookStep, HookType, MonorepoConfig, OnRewrittenTag, PackageBase, PackageBumpEntry, PackageManager, PostedRelease, PrCommentConfig, PrCommentMode, PrCommentOptions, PrCommentStatus, ProviderReleaseOptions, ProviderReleaseResult, PublishConfig, PublishOptions, PublishResponse, PullRequestInfo, ReadPackage, Reference, RegistryTarget, ReleaseConfig, ReleaseContext, ReleaseOptions, RelizyConfig, RepoConfig, ResolvedConfig, ResolvedRelizyConfig, ResolvedTags, ResolvedTwitterCredentials, RootPackage, SlackCredentials, SlackOptions, SlackPackageEntry, SlackSocialConfig, SocialConfig, SocialNetworkResult, SocialOptions, SocialResult, Step, TemplatesConfig, TokensConfig, TwitterCredentials, TwitterOptions, TwitterSocialConfig, VersionMode };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { ax as NEW_PACKAGE_MARKER, a9 as PR_COMMENT_MARKER, S as buildChangelogBody, a as buildCommentBody, R as buildCompareLink, U as buildContributors, b as bump, aL as capReleaseTypeForZeroMajor, c as changelog, v as checkGitStatusIfDirty, T as collectContributorNames, a5 as collectPackageBumps, aZ as confirmBump, B as createCommitAndTags, P as createGitlabRelease, k as defineConfig, y as detectGitProvider, Y as detectPackageManager, a8 as detectPullRequest, Z as determinePublishTag, aN as determineReleaseType, aM as determineSemverChange, aG as executeBuildCmd, aF as executeFormatCmd, aC as executeHook, q as expandPackagesToBumpWithDependents, aq as extractChangelogSummary, aR as extractVersionFromPackageTag, b0 as extractVersionFromTag, x as fetchGitTags, aI as filterOutPrivatePackages, a6 as findGitHubPR, a7 as findGitLabMR, K as findReachableCommitBySubject, am as formatChangelogForSlack, an as formatPackagesForSlack, ao as formatSlackMessage, aA as formatTweetMessage, i as generateChangelog, V as generateMarkDown, a3 as getAuthCommand, a_ as getBumpedIndependentPackages, aY as getBumpedPackageIndependently, aE as getCIName, b1 as getCanaryVersion, J as getCommitSubject, F as getCurrentGitBranch, G as getCurrentGitRef, j as getDefaultConfig, o as getDependentsOf, E as getFirstCommit, u as getGitStatus, as as getIndependentTag, aw as getLastPackageTag, av as getLastRepoTag, at as getLastStableTag, au as getLastTag, A as getModifiedReleaseFilePatterns, X as getNpmRegistry, ag as getPackageCommits, n as getPackageDependencies, aP as getPackageNewVersion, af as getPackages, aJ as getPackagesOrBumpedPackages, $ as getPackagesToPublishInIndependentMode, _ as getPackagesToPublishInSelectiveMode, aW as getPreid, ar as getReleaseUrl, ad as getRootPackage, H as getShortCommitSha, ak as getSlackToken, al as getSlackWebhookUrl, az as getTwitterCredentials, O as github, Q as gitlab, ah as hasLernaJson, I as isAncestor, aH as isBumpedPackage, aX as isChangedPreid, aV as isGraduating, aK as isGraduatingToStableBetweenVersion, aD as isInCI, aS as isPrerelease, aU as isPrereleaseReleaseType, aT as isStableReleaseType, b2 as isTagVersionCompatibleWithCurrent, l as loadRelizyConfig, m as mergeTypes, W as parseChangelogMarkdown, z as parseGitRemoteUrl, aa as postPrComment, ap as postReleaseToSlack, aB as postReleaseToTwitter, p as prComment, e as providerRelease, d as providerReleaseSafetyCheck, g as publish, a4 as publishPackage, f as publishSafetyCheck, C as pushCommitAndTags, N as pushTagForce, ac as readPackageJson, ae as readPackages, aj as reconcileFromTag, ab as redactSecrets, r as release, ai as resetRewrittenTagCache, a0 as resolveAllConfiguredRegistryTargets, a1 as resolveRegistryTargetsForPackage, a2 as resolveRegistryTargetsForPackages, ay as resolveTags, M as retagAnnotatedLocal, D as rollbackModifiedFiles, a$ as shouldFilterPrereleaseTags, h as social, s as socialSafetyCheck, L as tagExists, t as topologicalSort, aQ as updateLernaVersion, w as writeChangelogToFile, aO as writeVersion } from './shared/relizy.Bpfgbc-1.mjs';
+export { N as NEW_PACKAGE_MARKER, P as PR_COMMENT_MARKER, b as buildChangelogBody, a as buildCommentBody, c as buildCompareLink, d as buildContributors, e as bump, f as capReleaseTypeForZeroMajor, g as changelog, h as checkGitStatusIfDirty, i as collectContributorNames, j as collectPackageBumps, k as confirmBump, l as createCommitAndTags, m as createGitlabRelease, n as defineConfig, o as detectGitProvider, p as detectPackageManager, q as detectPullRequest, r as determinePublishTag, s as determineReleaseType, t as determineSemverChange, u as executeBuildCmd, v as executeFormatCmd, w as executeHook, x as expandPackagesToBumpWithDependents, y as extractChangelogSummary, z as extractVersionFromPackageTag, A as extractVersionFromTag, B as fetchGitTags, C as filterOutPrivatePackages, D as findGitHubPR, E as findGitLabMR, F as findReachableCommitBySubject, G as formatChangelogForSlack, H as formatPackagesForSlack, I as formatSlackMessage, J as formatTweetMessage, K as generateChangelog, L as generateMarkDown, M as getAuthCommand, O as getBumpedIndependentPackages, Q as getBumpedPackageIndependently, R as getCIName, S as getCanaryVersion, T as getCommitSubject, U as getCurrentGitBranch, V as getCurrentGitRef, W as getDefaultConfig, X as getDependentsOf, Y as getFirstCommit, Z as getGitStatus, _ as getIndependentTag, $ as getLastPackageTag, a0 as getLastRepoTag, a1 as getLastStableTag, a2 as getLastTag, a3 as getModifiedReleaseFilePatterns, a4 as getNpmRegistry, a5 as getPackageCommits, a6 as getPackageDependencies, a7 as getPackageNewVersion, a8 as getPackages, a9 as getPackagesOrBumpedPackages, aa as getPackagesToPublishInIndependentMode, ab as getPackagesToPublishInSelectiveMode, ac as getPreid, ad as getReleaseUrl, ae as getRootPackage, af as getShortCommitSha, ag as getSlackToken, ah as getSlackWebhookUrl, ai as getTwitterCredentials, aj as github, ak as gitlab, al as hasLernaJson, am as isAncestor, an as isBumpedPackage, ao as isChangedPreid, ap as isGraduating, aq as isGraduatingToStableBetweenVersion, ar as isInCI, as as isPrerelease, at as isPrereleaseReleaseType, au as isStableReleaseType, av as isTagVersionCompatibleWithCurrent, aw as loadRelizyConfig, ax as mergeTypes, ay as parseChangelogMarkdown, az as parseGitRemoteUrl, aA as postPrComment, aB as postReleaseToSlack, aC as postReleaseToTwitter, aD as prComment, aE as providerRelease, aF as providerReleaseSafetyCheck, aG as publish, aH as publishPackage, aI as publishSafetyCheck, aJ as pushCommitAndTags, aK as pushTagForce, aL as readPackageJson, aM as readPackages, aN as reconcileFromTag, aO as redactSecrets, aP as release, aQ as resetRewrittenTagCache, aR as resolveAllConfiguredRegistryTargets, aS as resolveRegistryTargetsForPackage, aT as resolveRegistryTargetsForPackages, aU as resolveTags, aV as retagAnnotatedLocal, aW as rollbackModifiedFiles, aX as shouldFilterPrereleaseTags, aY as social, aZ as socialSafetyCheck, a_ as tagExists, a$ as topologicalSort, b0 as updateLernaVersion, b1 as withRegistryNpmrc, b2 as writeChangelogToFile, b3 as writeVersion } from './shared/relizy.B0MWtDvR.mjs';
 import '@maz-ui/node';
 import 'node:child_process';
 import 'node:process';

package/dist/shared/{relizy.Bpfgbc-1.mjs → relizy.B0MWtDvR.mjs}

@@ -5,7 +5,7 @@ import { formatJson } from '@maz-ui/utils/helpers/formatJson';
 import { setupDotenv, loadConfig } from 'c12';
 import { getGitDiff, parseCommits, resolveRepoConfig, getRepoConfig, formatCompareChanges, formatReference, createGithubRelease } from 'changelogen';
 import { defu } from 'defu';
-import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync, writeFileSync, rmSync } from 'node:fs';
 import path, { join, relative, sep } from 'node:path';
 import { select, confirm, input } from '@inquirer/prompts';
 import micromatch from 'micromatch';
@@ -1937,7 +1937,11 @@ function dedupRegistryTargets(targets) {
 function resolveAllConfiguredRegistryTargets(config) {
   const legacyTarget = buildLegacyRegistryTarget(config);
   const explicitTargets = config.publish.registries ?? [];
-  return dedupRegistryTargets([legacyTarget, ...explicitTargets]);
+  const skipEmptyDefault = !config.publish.registry && explicitTargets.length > 0;
+  return dedupRegistryTargets([
+    ...skipEmptyDefault ? [] : [legacyTarget],
+    ...explicitTargets
+  ]);
 }
 function resolveRegistryTargetsForPackage(pkg, config) {
   const legacyTarget = buildLegacyRegistryTarget(config);
@@ -1945,9 +1949,10 @@ function resolveRegistryTargetsForPackage(pkg, config) {
   const applicableTargets = explicitTargets.filter(
     (target) => !target.packageFilter?.length || micromatch.isMatch(pkg.name, target.packageFilter)
   );
-  const skipDefaultRegistry = applicableTargets.some((target) => target.exclusive);
+  const skipForExclusive = applicableTargets.some((target) => target.exclusive);
+  const skipEmptyDefault = !config.publish.registry && applicableTargets.length > 0;
   return dedupRegistryTargets([
-    ...skipDefaultRegistry ? [] : [legacyTarget],
+    ...skipForExclusive || skipEmptyDefault ? [] : [legacyTarget],
     ...applicableTargets
   ]);
 }
@@ -1955,6 +1960,71 @@ function resolveRegistryTargetsForPackages(packages, config) {
   const allTargets = packages.flatMap((pkg) => resolveRegistryTargetsForPackage(pkg, config));
   return dedupRegistryTargets(allTargets);
 }
+function readsNpmrc(packageManager) {
+  return packageManager === "npm" || packageManager === "pnpm" || packageManager === "bun";
+}
+function getPackageScope(packageName) {
+  if (!packageName?.startsWith("@") || !packageName.includes("/")) {
+    return void 0;
+  }
+  return packageName.slice(0, packageName.indexOf("/"));
+}
+function buildNpmrcEntries({
+  registryTarget,
+  scope,
+  packageManager
+}) {
+  const { registry, token } = registryTarget;
+  const entries = [];
+  if (registry && scope) {
+    entries.push({ key: `${scope}:registry`, line: `${scope}:registry=${registry}` });
+  }
+  if (token) {
+    if (!registry) {
+      logger.warn("Publish token provided but no registry specified");
+    } else if (!readsNpmrc(packageManager)) {
+      logger.warn("Publish token only supported for npm, pnpm and bun");
+    } else {
+      const url = new URL(registry);
+      const authKey = `//${url.host}${url.pathname}:_authToken`;
+      entries.push({ key: authKey, line: `${authKey}=${token}` });
+    }
+  }
+  return entries;
+}
+async function withRegistryNpmrc({
+  config,
+  registryTarget,
+  packageName,
+  packageManager,
+  fn
+}) {
+  const scope = getPackageScope(packageName);
+  const entries = buildNpmrcEntries({ registryTarget, scope, packageManager });
+  if (entries.length === 0) {
+    return fn();
+  }
+  const npmrcPath = join(config.cwd, ".npmrc");
+  const existed = existsSync(npmrcPath);
+  const original = existed ? readFileSync(npmrcPath, "utf8") : "";
+  const managedKeys = new Set(entries.map((entry) => entry.key));
+  const preservedLines = original.split("\n").filter((line) => {
+    const key = line.split("=")[0]?.trim();
+    return !key || !managedKeys.has(key);
+  });
+  const nextContent = `${[...preservedLines, ...entries.map((entry) => entry.line)].filter(Boolean).join("\n")}
+`;
+  try {
+    writeFileSync(npmrcPath, nextContent);
+    return await fn();
+  } finally {
+    if (existed) {
+      writeFileSync(npmrcPath, original);
+    } else {
+      rmSync(npmrcPath, { force: true });
+    }
+  }
+}
 function getCommandArgs({
   packageManager,
   tag,
@@ -1968,19 +2038,6 @@ function getCommandArgs({
   if (registry) {
     args.push("--registry", registry);
   }
-  const isPnpmOrNpm = packageManager === "pnpm" || packageManager === "npm";
-  const publishToken = registryTarget.token;
-  if (publishToken) {
-    if (!registry) {
-      logger.warn("Publish token provided but no registry specified");
-    } else if (!isPnpmOrNpm) {
-      logger.warn("Publish token only supported for pnpm and npm");
-    } else {
-      const registryUrl = new URL(registry);
-      const authTokenKey = `--//${registryUrl.host}${registryUrl.pathname}:_authToken=${publishToken}`;
-      args.push(authTokenKey);
-    }
-  }
   const finalOtp = otp ?? sessionOtpByRegistry.get(normalizeRegistryKey(registry)) ?? registryTarget.otp;
   if (finalOtp) {
     args.push("--otp", finalOtp);
@@ -2120,7 +2177,7 @@ async function publishToRegistryTarget({
   packageNameAndVersion,
   registryLabel
 }) {
-  const tag = determinePublishTag(pkg.newVersion || pkg.version, registryTarget.tag);
+  const tag = determinePublishTag(pkg.newVersion || pkg.version, registryTarget.tag ?? config.publish.tag);
   let dynamicOtp;
   const maxAttempts = 2;
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
@@ -2133,15 +2190,21 @@ async function publishToRegistryTarget({
         dryRun
       });
       process.chdir(pkg.path);
-      await executePublishCommand({
-        command,
-        packageNameAndVersion,
-        packageManager,
-        pkg,
+      await withRegistryNpmrc({
         config,
-        dryRun,
-        tag,
-        registryLabel
+        registryTarget,
+        packageName: pkg.name,
+        packageManager,
+        fn: () => executePublishCommand({
+          command,
+          packageNameAndVersion,
+          packageManager,
+          pkg,
+          config,
+          dryRun,
+          tag,
+          registryLabel
+        })
       });
       const registryKey = normalizeRegistryKey(registryTarget.registry);
       if (dynamicOtp && !sessionOtpByRegistry.has(registryKey)) {
@@ -5681,14 +5744,19 @@ async function checkRegistryAuth({
   }, patienceDelay);
   try {
     logger.info(`Authenticating to package registry${registryLabel}...`);
-    await execPromise(authCommand, {
-      cwd: config.cwd,
-      timeout: timeoutMs,
-      noStdout: true,
-      noStderr: true,
-      noSuccess: true,
-      noError: true,
-      logLevel: config.logLevel
+    await withRegistryNpmrc({
+      config,
+      registryTarget,
+      packageManager: config.publish.packageManager,
+      fn: () => execPromise(authCommand, {
+        cwd: config.cwd,
+        timeout: timeoutMs,
+        noStdout: true,
+        noStderr: true,
+        noSuccess: true,
+        noError: true,
+        logLevel: config.logLevel
+      })
     });
     logger.info(`Successfully authenticated to package registry${registryLabel}`);
   } catch (error) {
@@ -6627,4 +6695,4 @@ Git provider: ${provider}`);
   }
 }
 
-export { getPackagesToPublishInIndependentMode as $, getModifiedReleaseFilePatterns as A, createCommitAndTags as B, pushCommitAndTags as C, rollbackModifiedFiles as D, getFirstCommit as E, getCurrentGitBranch as F, getCurrentGitRef as G, getShortCommitSha as H, isAncestor as I, getCommitSubject as J, findReachableCommitBySubject as K, tagExists as L, retagAnnotatedLocal as M, pushTagForce as N, github as O, createGitlabRelease as P, gitlab as Q, buildCompareLink as R, buildChangelogBody as S, collectContributorNames as T, buildContributors as U, generateMarkDown as V, parseChangelogMarkdown as W, getNpmRegistry as X, detectPackageManager as Y, determinePublishTag as Z, getPackagesToPublishInSelectiveMode as _, buildCommentBody as a, shouldFilterPrereleaseTags as a$, resolveAllConfiguredRegistryTargets as a0, resolveRegistryTargetsForPackage as a1, resolveRegistryTargetsForPackages as a2, getAuthCommand as a3, publishPackage as a4, collectPackageBumps as a5, findGitHubPR as a6, findGitLabMR as a7, detectPullRequest as a8, PR_COMMENT_MARKER as a9, formatTweetMessage as aA, postReleaseToTwitter as aB, executeHook as aC, isInCI as aD, getCIName as aE, executeFormatCmd as aF, executeBuildCmd as aG, isBumpedPackage as aH, filterOutPrivatePackages as aI, getPackagesOrBumpedPackages as aJ, isGraduatingToStableBetweenVersion as aK, capReleaseTypeForZeroMajor as aL, determineSemverChange as aM, determineReleaseType as aN, writeVersion as aO, getPackageNewVersion as aP, updateLernaVersion as aQ, extractVersionFromPackageTag as aR, isPrerelease as aS, isStableReleaseType as aT, isPrereleaseReleaseType as aU, isGraduating as aV, getPreid as aW, isChangedPreid as aX, getBumpedPackageIndependently as aY, confirmBump as aZ, getBumpedIndependentPackages as a_, postPrComment as aa, redactSecrets as ab, readPackageJson as ac, getRootPackage as ad, readPackages as ae, getPackages as af, getPackageCommits as ag, hasLernaJson as ah, resetRewrittenTagCache as ai, reconcileFromTag as aj, getSlackToken as ak, getSlackWebhookUrl as al, formatChangelogForSlack as am, formatPackagesForSlack as an, formatSlackMessage as ao, postReleaseToSlack as ap, extractChangelogSummary as aq, getReleaseUrl as ar, getIndependentTag as as, getLastStableTag as at, getLastTag as au, getLastRepoTag as av, getLastPackageTag as aw, NEW_PACKAGE_MARKER as ax, resolveTags as ay, getTwitterCredentials as az, bump as b, extractVersionFromTag as b0, getCanaryVersion as b1, isTagVersionCompatibleWithCurrent as b2, changelog as c, providerReleaseSafetyCheck as d, providerRelease as e, publishSafetyCheck as f, publish as g, social as h, generateChangelog as i, getDefaultConfig as j, defineConfig as k, loadRelizyConfig as l, mergeTypes as m, getPackageDependencies as n, getDependentsOf as o, prComment as p, expandPackagesToBumpWithDependents as q, release as r, socialSafetyCheck as s, topologicalSort as t, getGitStatus as u, checkGitStatusIfDirty as v, writeChangelogToFile as w, fetchGitTags as x, detectGitProvider as y, parseGitRemoteUrl as z };
+export { getLastPackageTag as $, extractVersionFromTag as A, fetchGitTags as B, filterOutPrivatePackages as C, findGitHubPR as D, findGitLabMR as E, findReachableCommitBySubject as F, formatChangelogForSlack as G, formatPackagesForSlack as H, formatSlackMessage as I, formatTweetMessage as J, generateChangelog as K, generateMarkDown as L, getAuthCommand as M, NEW_PACKAGE_MARKER as N, getBumpedIndependentPackages as O, PR_COMMENT_MARKER as P, getBumpedPackageIndependently as Q, getCIName as R, getCanaryVersion as S, getCommitSubject as T, getCurrentGitBranch as U, getCurrentGitRef as V, getDefaultConfig as W, getDependentsOf as X, getFirstCommit as Y, getGitStatus as Z, getIndependentTag as _, buildCommentBody as a, topologicalSort as a$, getLastRepoTag as a0, getLastStableTag as a1, getLastTag as a2, getModifiedReleaseFilePatterns as a3, getNpmRegistry as a4, getPackageCommits as a5, getPackageDependencies as a6, getPackageNewVersion as a7, getPackages as a8, getPackagesOrBumpedPackages as a9, postPrComment as aA, postReleaseToSlack as aB, postReleaseToTwitter as aC, prComment as aD, providerRelease as aE, providerReleaseSafetyCheck as aF, publish as aG, publishPackage as aH, publishSafetyCheck as aI, pushCommitAndTags as aJ, pushTagForce as aK, readPackageJson as aL, readPackages as aM, reconcileFromTag as aN, redactSecrets as aO, release as aP, resetRewrittenTagCache as aQ, resolveAllConfiguredRegistryTargets as aR, resolveRegistryTargetsForPackage as aS, resolveRegistryTargetsForPackages as aT, resolveTags as aU, retagAnnotatedLocal as aV, rollbackModifiedFiles as aW, shouldFilterPrereleaseTags as aX, social as aY, socialSafetyCheck as aZ, tagExists as a_, getPackagesToPublishInIndependentMode as aa, getPackagesToPublishInSelectiveMode as ab, getPreid as ac, getReleaseUrl as ad, getRootPackage as ae, getShortCommitSha as af, getSlackToken as ag, getSlackWebhookUrl as ah, getTwitterCredentials as ai, github as aj, gitlab as ak, hasLernaJson as al, isAncestor as am, isBumpedPackage as an, isChangedPreid as ao, isGraduating as ap, isGraduatingToStableBetweenVersion as aq, isInCI as ar, isPrerelease as as, isPrereleaseReleaseType as at, isStableReleaseType as au, isTagVersionCompatibleWithCurrent as av, loadRelizyConfig as aw, mergeTypes as ax, parseChangelogMarkdown as ay, parseGitRemoteUrl as az, buildChangelogBody as b, updateLernaVersion as b0, withRegistryNpmrc as b1, writeChangelogToFile as b2, writeVersion as b3, buildCompareLink as c, buildContributors as d, bump as e, capReleaseTypeForZeroMajor as f, changelog as g, checkGitStatusIfDirty as h, collectContributorNames as i, collectPackageBumps as j, confirmBump as k, createCommitAndTags as l, createGitlabRelease as m, defineConfig as n, detectGitProvider as o, detectPackageManager as p, detectPullRequest as q, determinePublishTag as r, determineReleaseType as s, determineSemverChange as t, executeBuildCmd as u, executeFormatCmd as v, executeHook as w, expandPackagesToBumpWithDependents as x, extractChangelogSummary as y, extractVersionFromPackageTag as z };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "relizy",
   "type": "module",
-  "version": "1.5.0-beta.0",
+  "version": "1.5.0-beta.2",
   "description": "Changelogen adapter for monorepo management with unified and independent versioning",
   "author": "Louis Mazel <me@loicmazuel.com>",
   "license": "MIT",
@@ -89,7 +89,7 @@
     "@commitlint/config-conventional": "21.2.2",
     "@commitlint/cz-commitlint": "^21.2.2",
     "@commitlint/types": "^21.2.0",
-    "@maz-ui/eslint-config": "5.0.0-beta.25",
+    "@maz-ui/eslint-config": "5.0.0-beta.43",
     "@slack/web-api": "7.16.0",
     "@types/micromatch": "^4.0.10",
     "@types/node": "^25.9.2",