From 760dc7a51834701278ab53af2719a4027cec65c5 Mon Sep 17 00:00:00 2001
From: Gerardo Rodriguez <g@rodrz.com>
Date: Fri, 30 Oct 2026 23:23:28 +0000
Subject: [PATCH 1/2] Publish beeper-cli to npm from GitHub Actions with
 trusted publishing

---
 .github/workflows/publish-npm.yml | 56 +++++++++++++++++++++++++++++++
 packages/npm/package.json         |  5 +++
 2 files changed, 61 insertions(+)
 create mode 100644 .github/workflows/publish-npm.yml

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
new file mode 100644
index 00000000..60afd4b8
--- /dev/null
+++ b/.github/workflows/publish-npm.yml
@@ -0,0 +1,56 @@
+---
+name: Publish npm
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish, e.g. v0.6.3
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-npm
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ github.event.release.tag_name || inputs.tag }}
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+    - name: Set up Bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: 1.3.10
+    - name: Set up Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: "24"
+        registry-url: https://registry.npmjs.org
+    # Trusted publishing needs npm 11.5.1 or newer.
+    - name: Update npm
+      run: npm install -g npm@latest
+    - name: Download release binaries.json
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        mkdir -p packages/cli/dist/bin
+        gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern binaries.json --dir packages/cli/dist/bin
+        version="${TAG#v}"
+        test "$(jq -r .version packages/cli/package.json)" = "$version"
+        test "$(jq -r .version packages/cli/dist/bin/binaries.json)" = "$version"
+        test "$(jq '.artifacts | length' packages/cli/dist/bin/binaries.json)" -eq 4
+    - name: Build npm package
+      working-directory: packages/npm
+      run: bun run build
+    - name: Publish
+      working-directory: packages/npm
+      run: npm publish --access public
diff --git a/packages/npm/package.json b/packages/npm/package.json
index 71f26a60..a0f7b991 100644
--- a/packages/npm/package.json
+++ b/packages/npm/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.3",
   "description": "Beeper CLI binary launcher",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/beeper/cli.git",
+    "directory": "packages/npm"
+  },
   "type": "module",
   "bin": {
     "beeper": "bin/beeper.js"

From ed8cc498e49a3a2b15d91f2eef64b7abdb28e600 Mon Sep 17 00:00:00 2001
From: Gerardo Rodriguez <g@rodrz.com>
Date: Fri, 30 Oct 2026 23:33:59 +0000
Subject: [PATCH 2/2] Stage npm publishes for maintainer approval

---
 .github/workflows/publish-npm.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 60afd4b8..465589b3 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -34,7 +34,7 @@ jobs:
       with:
         node-version: "24"
         registry-url: https://registry.npmjs.org
-    # Trusted publishing needs npm 11.5.1 or newer.
+    # Trusted publishing and `npm stage` need a recent npm.
     - name: Update npm
       run: npm install -g npm@latest
     - name: Download release binaries.json
@@ -51,6 +51,7 @@ jobs:
     - name: Build npm package
       working-directory: packages/npm
       run: bun run build
-    - name: Publish
+    # Stage only: a maintainer approves the version on npmjs.com (Staged Packages) before it goes live.
+    - name: Stage publish
       working-directory: packages/npm
-      run: npm publish --access public
+      run: npm stage publish