npm

The npm plugin is enabled by default. It discovers workspace packages, bumps versions in package.json, updates dependency ranges, and publishes to npm.

Discovery

Tegami scans:

• The root package.json (if present).
• Workspace packages from the workspaces field in the root manifest.
• pnpm-workspace.yaml for pnpm projects and Nub's pnpm-compatible mode.
• aube-workspace.yaml for aube projects.
• The workspace field in deno.json/deno.jsonc for Deno projects. Members without a package.json (e.g. JSR-only packages) are ignored.

Deno is detected from deno.lock; set client: "deno" explicitly if your project has no lockfile. Since deno publish targets JSR, Tegami publishes through the npm CLI, and lockfile updates run deno install.

Private packages are versioned but not published unless you set publish: true in packages.

Configuration

Pass options through the top-level npm field:

const paper = tegami({
  npm: {
    client: "pnpm",
    updateLockFile: true,
    onBreakPeerDep: "set",
  },
});

Trusted Publishing

Tegami can bootstrap new packages under npm trusted publishing with tegami npm pretrust.

Enable the command in your Tegami config:

const paper = tegami({
  plugins: [github({ repo: "acme/widgets" })],
  npm: {
    trustedPublish: {
      provider: "github",
      workflow: "publish.yml",
    },
  },
});

Use provider: "gitlab" with the GitLab plugin for GitLab CI. The workflow value is the filename passed to npm trust --file.

One-time setup for new packages

Run this locally:

1. Run tegami version so a publish lock exists.
2. Login to npm (npm login).
3. Run tegami npm pretrust (add --dry-run to preview).

For each publishable package in the lock that npm does not know yet, pretrust:

• Publishes an empty placeholder at 0.0.0-tegami-trusted-publish-setup under the temp dist-tag.
• Runs npm trust to link the package to your CI workflow.
• Writes npm:mark-latest to the publish lock so the first real release is tagged latest.

Packages already on the registry are skipped.

CI still needs id-token: write in GitHub Actions (see CI setup). After pretrust, commit your local changes and hand the actual publishing to CI.

Dependency bumps

When a package is bumped, the plugin may bump its dependents based on dependency kind:

• dependencies and optionalDependencies → patch bump on the dependent
• devDependencies → no automatic bump
• peerDependencies → major bump (or handled by onBreakPeerDep)

Customize this with bumpDep:

npm({
  bumpDep: ({ kind }) => (kind === "dependencies" ? "patch" : false),
});

Package options

It allows to override distTag for npm publish, otherwise, it will read from your publishConfig in package.json.

When publishing prerelease versions, npm 11+ requires an explicit dist-tag. Tegami infers one from your prerelease config (for example, 1.0.0-alpha.0 → alpha) when no tag is configured.

tegami({
  packages: {
    "@acme/ui": {
      npm: {
        distTag: "next",
      },
    },
  },
});