bun publish
Use `bun publish` to publish a package to the npm registry
bun publish packs your package into a tarball, strips catalog and workspace protocols from the package.json (resolving versions if necessary), and publishes to the registry specified in your configuration files. Both bunfig.toml and .npmrc files are supported.
## Publishing the package from the current working directory
$ bun publish
## Output
bun publish v1.3.14 (ca7428e9)
packed 203B package.json
packed 224B README.md
packed 30B index.ts
packed 0.64KB tsconfig.json
Total files: 4
Shasum: 79e2b4377b63f4de38dc7ea6e5e9dbee08311a69
Integrity: sha512-6QSNlDdSwyG/+[...]X6wXHriDWr6fA==
Unpacked size: 1.1KB
Packed size: 0.76KB
Tag: latest
Access: default
Registry: http://localhost:4873/
+ publish-1@1.0.0To pack and publish separately, run bun pm pack, then bun publish with the path to the output tarball.
$ bun pm pack
...
$ bun publish ./package.tgzbun publish does not run lifecycle scripts (prepublishOnly/prepack/prepare/postpack/publish/postpublish) if a
tarball path is provided. Scripts run only when bun publish packs the package itself.
--access
--access sets the access level of the package being published, either public or restricted. Unscoped packages are always public, and publishing an unscoped package with --access restricted is an error.
$ bun publish --access public--access can also be set in the publishConfig field of your package.json.
{
"publishConfig": {
"access": "restricted"
}
}--tag
Set the tag of the package version being published. By default, the tag is latest. The initial version of a package is always given the latest tag in addition to the specified tag.
$ bun publish --tag alpha--tag can also be set in the publishConfig field of your package.json.
{
"publishConfig": {
"tag": "next"
}
}--dry-run
--dry-run runs the publish process without publishing the package, so you can verify what would be published.
$ bun publish --dry-run--tolerate-republish
Exit with code 0 instead of 1 if the package version already exists. Useful in CI/CD where jobs may be re-run.
$ bun publish --tolerate-republish--gzip-level
Set the gzip compression level used when packing the package, from 0 to 9 (default 9). Only applies to bun publish without a tarball path argument.
--auth-type
If you have 2FA enabled for your npm account, bun publish prompts you for a one-time password, either through a browser or in the CLI. --auth-type tells the npm registry which method you prefer: web (the default) or legacy.
$ bun publish --auth-type legacy
...
This operation requires a one-time password.
Enter OTP: 123456
...--otp
Provide a one-time password directly to the CLI. If the password is valid, bun publish skips the extra one-time password prompt before publishing:
$ bun publish --otp 123456bun publish respects the NPM_CONFIG_TOKEN environment variable, useful when publishing from GitHub Actions or
other automated workflows.
CLI Usage
$ bun publish distPublishing Options
The --access flag can be used to set the access level of the package being published. The access level can be one of public or restricted. Unscoped packages are always public, and attempting to publish an unscoped package with --access restricted will result in an error.
$ bun publish --access public--access can also be set in the publishConfig field of your package.json.
{
"publishConfig": {
"access": "restricted"
}
}Set the tag of the package version being published. By default, the tag is latest. The initial version of a package is always given the latest tag in addition to the specified tag.
$ bun publish --tag alpha--tag can also be set in the publishConfig field of your package.json.
{
"publishConfig": {
"tag": "next"
}
}The --dry-run flag can be used to simulate the publish process without actually publishing the package. This is useful for verifying the contents of the published package without actually publishing the package.
$ bun publish --dry-runSpecify the level of gzip compression to use when packing the package. Only applies to bun publish without a tarball path argument. Values range from 0 to 9 (default is 9).
If you have 2FA enabled for your npm account, bun publish will prompt you for a one-time password. This can be done through a browser or the CLI. The --auth-type flag can be used to tell the npm registry which method you prefer. The possible values are web and legacy, with web being the default.
$ bun publish --auth-type legacy
...
This operation requires a one-time password.
Enter OTP: 123456
...Provide a one-time password directly to the CLI. If the password is valid, this will skip the extra prompt for a one-time password before publishing. Example usage:
$ bun publish --otp 123456bun publish respects the NPM_CONFIG_TOKEN environment variable which can be used when
publishing in github actions or automated workflows.
Registry Configuration
Custom Registry
Specify registry URL, overriding .npmrc and bunfig.toml
$ bun publish --registry https://my-private-registry.comSSL Certificates
Provide Certificate Authority signing certificate
Path to Certificate Authority certificate file
$ bun publish --ca "-----BEGIN CERTIFICATE-----..."Publishing Options
Dependency Management
Don't install devDependencies
Exclude dependency types: dev, optional, or peer
Always request the latest versions from the registry & reinstall all dependencies
Script Control
Skip lifecycle scripts during packing and publishing
Add packages to trustedDependencies and run their scripts
Lifecycle Scripts — When providing a pre-built tarball, lifecycle scripts (prepublishOnly, prepack, etc.) are not executed. Scripts only run when Bun packs the package itself.
File Management
Don't update package.json or lockfile
Disallow changes to lockfile
Generate yarn.lock file (yarn v1 compatible)
Performance
Platform optimizations: clonefile (default), hardlink, symlink, or copyfile
Maximum concurrent network requests
Maximum concurrent lifecycle scripts
Output Control
Suppress all output
Show detailed logging
Hide progress bar
Don't print publish summary