Bun workspaces currently fall back to npm for publishing. This can leave workspace: dependency specs in published tarballs, causing npm consumers to fail with EUNSUPPORTEDPROTOCOL. This change selects Bun for package info, packing, and publishing so workspace dependency specs are resolved by Bun.

This PR builds on @Andarist's #2181. Its five original commits have been rebased onto current main with the original authorship preserved. The follow-up commits complete authentication handling, regression coverage, and documentation. These additions can also be incorporated into #2181 if that is the preferred landing path.

Implementation

• Detect Bun through manypkg or package-manager-detector and use bun info, bun pm pack, and bun publish, including publishing prebuilt tarballs with --from-pack-dir.
• Use legacy auth and closed stdin for captured attempts; recover interactively after an OTP challenge when a terminal is available. Remove rejected inherited OTPs before retrying, stop unexpected captured browser-auth flows, and distinguish registry errors from lifecycle output.
• Keep tarball publishing in the source workspace so registry/auth discovery works even when publishConfig.directory points to a missing build directory. Reject selecting a different directory for direct publishing or packing with an explicit error.
• Document lockfile freshness after versioning, CI authentication via NPM_CONFIG_TOKEN or project .npmrc, and action v2 structured tag output.
• Cover package-manager selection and pnpm major-version delegation, platform-appropriate OTP environment precedence, successful packing and dist-tags errors, and actual tarball contents, direct workspace publishing without modifying source manifests, stale/refreshed/missing lockfiles, declared executables, CI auth success/failure, artifact publishing, and real PTY OTP recovery. Test both Bun 1.3.1 and 1.3.14.

Bun >=1.3.1 is retained from #2181. That version fixed packing declared executables excluded by the files list; the omission was reproduced on 1.3.0 and the positive regression is covered on both supported test versions.

Includes a changeset for @changesets/cli (minor) and @changesets/types (patch).

Validation

Local validation used the repository scripts, invoked through Bun, with the repository's pnpm workspace and lockfile retained:

• bun run test --run: 858 passed, with coverage enabled, 2 existing todo tests.
• Affected e2e cases: 94 passed, including all 60 Bun cases on 1.3.1 and 1.3.14, cross-manager positive publish regressions, pre-publish/web-auth error cases, and progress-normalizer tests. From scripts/e2e: fnm exec --using v24.15.0 -- bun run test --experimental.preParse=false -t 'bun|surfaces web-auth OTP|surfaces pre-publish errors|publishes a new version of a package|publishes from a pack directory|normalizes captured|preserves interactive'.
• Cross-manager positive publish regressions (also included in the affected e2e selection): 19 passed across npm, pnpm, Yarn, and Bun, selected with -t 'publishes a new version of a package|publishes from a pack directory' and the same Node/preParse settings.
• Local coverage: 100% lines and functions in both bun.ts and getPublishTool.ts, without coverage exclusions or threshold changes.
• Repository lint and formatting, root and e2e TypeScript checks, build/publint, VitePress documentation build, manypkg workspace checks, and Git whitespace checks passed.

Upstream CI run 38594001045 passed at c08e68033c536d386b6fe0c63dfa055c57b7dade: build, lint, typecheck, unit tests on Linux/macOS/Windows, and the complete Linux e2e suite. Codecov patch and project checks passed; all modified, coverable lines are covered, and project coverage is 88.46%. Native Bun integrations were validated on macOS locally and Linux in CI; native Windows integration validation remains outstanding.

Known limitations

• changeset version does not update Bun's lockfile. Users must refresh it with bun install --lockfile-only --ignore-scripts after versioning and before packing/publishing. Updating the lockfile after packing cannot repair existing artifacts.

• Direct publishConfig.directory overrides are unsupported for Bun. Prebuilt tarball publishing is supported.

• This targets Changesets 3.x on main; it does not backport support to maintenance/v2. npm trusted publishing/provenance parity is not established by this adapter.

• Earlier full local e2e runs on macOS were not green: registry-negative cases produce timeouts or HTTP 502 instead of the expected HTTP 401. Four matching cases also failed in an independent checkout of unchanged main at c73949ba7b3160a4aa5729223335c190de1528f8, using Node 24.15.0. Captured failure snapshots now normalize only transient standalone progress rows; registry error content and interactive snapshots remain checked. The full Linux CI suite passes. The earlier local baseline selection was:

  # Run from scripts/e2e after installing dependencies and building main.
  fnm exec --using v24.15.0 -- bun run test --experimental.preParse=false -t 'npm 10.*bad credentials|pnpm 12.*not logged'