Guard prerelease npm publish tag

Author: TDanks2000

.github/workflows/publish.yml

@@ -10,6 +10,10 @@ on:
         description: Run all checks without publishing to npm.
         type: boolean
         default: true
+      npm_tag:
+        description: npm dist-tag to use when publishing manually.
+        type: string
+        default: next
 
 permissions:
   contents: read
@@ -63,11 +67,25 @@ jobs:
       - name: Smoke test packed package
         run: bun run pack:smoke
 
+      - name: Resolve npm publish tag
+        id: publish-tag
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ inputs.npm_tag }}" ]; then
+            tag="${{ inputs.npm_tag }}"
+          elif [[ "$version" == *-* ]]; then
+            tag="next"
+          else
+            tag="latest"
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "Resolved npm dist-tag '$tag' for version '$version'."
+
       - name: Publish to npm
         if: github.event_name == 'release' || inputs.dry_run == false
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish --provenance --access public
+        run: npm publish --provenance --access public --tag "${{ steps.publish-tag.outputs.tag }}"
 
       - name: Skip publish
         if: github.event_name == 'workflow_dispatch' && inputs.dry_run

docs/v1-plan.md

@@ -139,7 +139,7 @@ Exit criteria:
 
 Goal: make npm release boring.
 
-Status: completed for local and workflow dry-run gates. `bun run pack:check` verifies package contents, and `bun run pack:smoke` packs the tarball, installs it into a temp consumer project, checks `--version`, dry-runs a scaffold, and scaffolds a real app without installing generated dependencies. The publish workflow supports GitHub releases and `workflow_dispatch` dry runs. The `Publish` workflow dry run for `a9777406d914a43c89376705f4ffdb5927961fda` passed in GitHub Actions run `25640509300`; `Publish to npm` was skipped and `Skip publish` succeeded.
+Status: completed for local and workflow dry-run gates. `bun run pack:check` verifies package contents, and `bun run pack:smoke` packs the tarball, installs it into a temp consumer project, checks `--version`, dry-runs a scaffold, and scaffolds a real app without installing generated dependencies. The publish workflow supports GitHub releases and `workflow_dispatch` dry runs, and resolves prerelease publishes to the `next` npm dist-tag by default. The `Publish` workflow dry run for `a9777406d914a43c89376705f4ffdb5927961fda` passed in GitHub Actions run `25640509300`; `Publish to npm` was skipped and `Skip publish` succeeded.
 
 - Confirm `npm pack --dry-run` includes only intended files.
 - Add package smoke tests against the packed tarball: