@gjsify/cli 0.43.0 → 0.45.0

package/lib/commands/onboard.js

@@ -1,16 +1,18 @@
-// `gjsify onboard [--dry-run] [--otp <code>] [--registry <url>] [--json] [--yes]`
+// `gjsify onboard [--packages <glob>] [--include/--exclude <glob>] [--dry-run] …`
 //
-// One command that ensures EVERY publishable `@gjsify/*` workspace is both
-// PUBLISHED on npm AND has a Trusted Publisher configured for this repo's
-// `release.yml`. It does the minimum work — publishing/trusting only what's
+// One command that ensures EVERY publishable package in a monorepo is both
+// PUBLISHED on npm AND has a Trusted Publisher configured for that repo's
+// release workflow. It does the minimum work — publishing/trusting only what's
 // missing — and folds the whole manual bootstrap sequence documented in
-// AGENTS.md ("New @gjsify/* package: first-publish + Trusted Publisher
-// bootstrap") into a single idempotent sweep:
+// docs/publishing.md into a single idempotent sweep:
 //
 //   1. Auth gate — `whoami` first. If the token is live, proceed without asking
 //      for credentials; only when it is dead/missing do we run the `gjsify
 //      login` flow (unless `--yes` on a non-TTY, which fails clearly).
-//   2. Enumerate publishable workspaces (non-private, excluding `@girs/*`).
+//   2. Enumerate the publishable packages (non-private), from the root
+//      manifest's `workspaces` globs and/or `--packages` directory globs, then
+//      filter by `--include`/`--exclude`. Every source is reported with its
+//      count — see utils/onboard-discovery.ts for why that is load-bearing.
 //   3. Determine each package's state (bounded concurrency) by reading npm's
 //      Trusted-Publisher config through the SAME requester path `gjsify trust`
 //      uses: unpublished (404) / published-but-untrusted / published-and-trusted.
@@ -22,25 +24,38 @@
 //      code is tried before prompting, so a whole sweep of N packages typically
 //      needs the user to type an OTP only once (see utils/npm-otp.ts).
 //
+// NOTHING here is specific to this repo. `--packages '*'` over a root that has
+// no package.json at all is the shape `gjsify/types` needs (703 `@girs/*`
+// directories, no workspace manifest), and it is the same code path that sweeps
+// this monorepo's workspaces.
+//
 // Re-running when everything is already published + trusted does nothing and
 // exits 0. `--dry-run` reports the plan and changes nothing.
 import { spawnSync } from 'node:child_process';
 import { DEFAULT_REGISTRY, whoami } from '@gjsify/npm-registry';
-import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
-import { mergePublishables } from '../utils/publishable-packages.js';
+import { filterWorkspaces } from '@gjsify/workspace';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
 import { OtpProvider } from '../utils/npm-otp.js';
+import { writeAroundPrompt } from '../utils/prompt-output.js';
 import { publishWorkspace } from './publish.js';
 import { createTrustRequester } from './trust.js';
 import { runLogin, LoginError } from './login.js';
 import { detectPackageManager } from './workspace.js';
 import { spawnToCompletion } from '../utils/spawn.js';
-import { findWorkspaceRoot } from '../utils/workspace-root.js';
+import { assertEveryPatternMatches, assertRepositoryAgreement, collectOnboardPackages, describeSources, resolveRepoRoot, } from '../utils/onboard-discovery.js';
 import { githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, validateRepository, } from '../utils/trust-registry.js';
-import { DEFAULT_PROBE_CONCURRENCY, probeAllTrustStates } from '../utils/onboard-probe.js';
+import { DEFAULT_PROBE_CONCURRENCY, mapWithConcurrency, probeAllTrustStates, RateLimitGate, requestWaitingOutRateLimit, } from '../utils/onboard-probe.js';
+/**
+ * How many Trusted-Publisher writes run in parallel by default.
+ *
+ * Deliberately the same small number as the read probe: one token, one registry,
+ * and a 429 costs a backoff. The win is not really throughput — it is that four
+ * writes per npm 2FA window means a quarter as many codes typed by hand.
+ */
+const DEFAULT_WRITE_CONCURRENCY = 4;
 export const onboardCommand = {
     command: 'onboard',
-    description: 'Ensure every publishable @gjsify/* workspace is both published on npm and has a Trusted Publisher configured — publishing/trusting only what is missing, one shared OTP across the whole sweep. Idempotent.',
+    description: 'Ensure every publishable package in a monorepo is both published on npm and has a Trusted Publisher configured for its release workflow — publishing/trusting only what is missing, one shared OTP across the whole sweep. Works on npm/yarn workspaces and, via --packages, on a monorepo with no workspace manifest at all. Idempotent.',
     builder: (yargs) => yargs
         .option('repository', {
         description: 'GitHub repo as `owner/repo`. Default: inferred from the `origin` git remote.',
@@ -62,11 +77,48 @@ export const onboardCommand = {
         .option('otp', {
         description: 'npm 2FA one-time code, used as the initial shared code. Prompted on demand (once) if omitted and a challenge occurs.',
         type: 'string',
+    })
+        .option('packages', {
+        description: 'Directory glob naming package folders, resolved against the repo root (repeatable). For a monorepo that is not an npm/yarn workspace — `--packages "*"` in a repo whose 703 package directories sit at the top level. Merged with the root manifest\'s own `workspaces` globs when it has any. A pattern matching NO directory is a hard error.',
+        type: 'string',
+        array: true,
+    })
+        .option('include', {
+        description: 'Glob pattern to include packages by NAME (repeatable). Applied after discovery.',
+        type: 'string',
+        array: true,
+    })
+        .option('exclude', {
+        description: 'Glob pattern to exclude packages by NAME (repeatable). Applied after discovery.',
+        type: 'string',
+        array: true,
+    })
+        .option('access', {
+        description: 'npm access for a FIRST publish — `public` or `restricted`. Only ever applied to a package this sweep publishes; an already-published package keeps whatever access it has.',
+        type: 'string',
+        choices: ['public', 'restricted'],
+        default: 'public',
+    })
+        .option('build', {
+        description: "Run each to-be-published package's `build` script first. `--no-build` skips it, for a repo whose packages are generated artifacts with nothing to build.",
+        type: 'boolean',
+        default: true,
+    })
+        .option('verbose', {
+        description: 'List every package in the plan table, including the ones already published + trusted (by default only the rows needing work are listed; the counts always cover all of them).',
+        type: 'boolean',
+        alias: 'v',
+        default: false,
     })
         .option('concurrency', {
         description: 'How many packages to probe (read state) in parallel (kept small so a single token does not burst npm; the first read is always serial to prompt for the shared OTP once).',
         type: 'number',
         default: DEFAULT_PROBE_CONCURRENCY,
+    })
+        .option('write-concurrency', {
+        description: "How many Trusted-Publisher writes to issue in parallel. It buys FEWER 2FA PROMPTS more than it buys speed: an npm code lives about 30 seconds, so a serial sweep crosses a code boundary every ~38 packages. Raising it does not beat npm's rate limit — a 429 anywhere now pauses the whole sweep, so it self-paces down to whatever the registry will serve. Publishes are unaffected: they stay serial, because publish ORDER is a correctness property.",
+        type: 'number',
+        default: DEFAULT_WRITE_CONCURRENCY,
     })
         .option('dry-run', {
         description: 'Report the plan (what would be published / trusted) without changing anything.',
@@ -93,8 +145,11 @@ export const onboardCommand = {
             // route progress to stderr.
             if (asJson)
                 process.stderr.write(`${msg}\n`);
+            // Through the prompt arbiter: a concurrent worker's notice must not
+            // land inside the OTP the user is typing. Held, not dropped — those
+            // notices are what explain why the sweep is slow.
             else
-                process.stdout.write(`${msg}\n`);
+                writeAroundPrompt(`${msg}\n`);
         };
         let npmrc = await loadNpmrc(cwd);
         const defaultRegistry = args.registry ?? process.env.npm_config_registry ?? npmrc.registry ?? DEFAULT_REGISTRY;
@@ -140,23 +195,66 @@ export const onboardCommand = {
         }
         const workflow = normalizeWorkflowFile(args.workflow);
         const environment = args.environment;
-        // 2. Enumerate publishable workspaces (non-private, exclude @girs/*).
-        const root = findWorkspaceRoot(cwd) ?? cwd;
-        // Non-workspace publishables (packages/{node-gi,napi}/*) publish through
-        // release.yml but `discoverWorkspaces` cannot see them — without this
-        // merge the sweep reports "all done" while a package that was never
-        // published is simply absent from the list.
-        const all = mergePublishables(discoverWorkspaces(root, { includeRoot: true }), cwd);
-        const selected = filterWorkspaces(all, { noPrivate: true, exclude: ['@girs/*'] }).filter((ws) => ws.name);
+        // 2. Enumerate the publishable packages (non-private), from every source
+        //    that applies to this repo, then filter by name.
+        const root = resolveRepoRoot(cwd);
+        let all;
+        let sources;
+        try {
+            if (args.packages && args.packages.length > 0)
+                assertEveryPatternMatches(root, args.packages);
+            const found = collectOnboardPackages(root, cwd, { patterns: args.packages });
+            all = found.packages;
+            sources = describeSources(found.sources);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                process.stdout.write(`${JSON.stringify({ ok: false, error: 'discovery', message: msg })}\n`);
+            else
+                console.error(msg);
+            return process.exit(1);
+        }
+        const selected = filterWorkspaces(all, {
+            noPrivate: true,
+            include: args.include,
+            exclude: args.exclude,
+        }).filter((ws) => ws.name);
         if (selected.length === 0) {
-            const msg = 'gjsify onboard: no publishable workspace packages found.';
+            const msg = `gjsify onboard: no publishable packages found under ${root} ` +
+                `(discovered ${all.length}${sources ? ` — ${sources}` : ''}). ` +
+                (all.length > 0
+                    ? 'Every discovered package is private or was filtered out by --include/--exclude.'
+                    : 'Pass --packages with a directory glob if this repo has no workspace manifest.');
             if (asJson)
                 process.stdout.write(`${JSON.stringify({ ok: false, error: 'no-packages', message: msg })}\n`);
             else
                 console.error(msg);
             return process.exit(1);
         }
-        log(`gjsify onboard: ${selected.length} package(s) | repo=${repository} workflow=${workflow}`);
+        // Every selected package must AGREE that it lives here. A workspace of
+        // this repo is not the same claim as a package published from it —
+        // `gjsify/ts-for-gir` has ~703 generated `@girs/*` workspaces that
+        // publish from `gjsify/types`, and trusting those for the wrong
+        // workflow breaks exactly the release this sweep exists to protect.
+        try {
+            assertRepositoryAgreement(selected, repository);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson) {
+                process.stdout.write(`${JSON.stringify({ ok: false, error: 'foreign-repository', message: msg })}\n`);
+            }
+            else {
+                console.error(msg);
+            }
+            return process.exit(1);
+        }
+        // The blast radius of a sweep that writes to npm is exactly this list,
+        // so say where it came from — a total alone cannot distinguish the right
+        // set from a plausible wrong one.
+        log(`gjsify onboard: root=${root} | ${sources}`);
+        log(`gjsify onboard: ${selected.length} of ${all.length} package(s) selected | repo=${repository} workflow=${workflow}`);
         if (dryRun)
             log('(dry-run — nothing will be published or configured)');
         log();
@@ -169,6 +267,25 @@ export const onboardCommand = {
             registry: defaultRegistry,
         });
         const trustRequest = createTrustRequester({ npmrc, otpProvider });
+        // ONE cool-down for the whole sweep: a 429 on any request holds back
+        // every other one. Retrying a throttled request in isolation is not
+        // enough — the rest of the sweep keeps provoking the very limit the
+        // retry is waiting out, which is how a 703-package run spent its retry
+        // budget and reported `trust failed (HTTP 429)`.
+        const gate = new RateLimitGate();
+        let rateLimitReported = false;
+        const onRateLimit = (info) => {
+            if (rateLimitReported)
+                return;
+            rateLimitReported = true;
+            // Report the FIRST one only. It answers the question that matters —
+            // does npm tell us how fast we may go? — and repeating it per request
+            // would bury the sweep's own output.
+            log(`  npm rate limit hit. ${info.headers}. Waiting ${Math.round(info.waitMs / 1000)}s ` +
+                `(${info.fromRetryAfter ? "npm's Retry-After" : 'our backoff — npm advised nothing'}), ` +
+                'and holding the whole sweep back while it lasts.');
+        };
+        const pacing = { gate, onRateLimit };
         // 3. Determine per-package state. Reads run through the SAME
         // `TrustRequester` path `gjsify trust` uses (identical endpoint + auth +
         // OTP handling) — so a 2FA-gated trust-state read is answered with the
@@ -176,21 +293,69 @@ export const onboardCommand = {
         // (task #60). The first read is serial (prompts for the shared OTP once,
         // before the burst); the rest run at a SMALL concurrency cap so a single
         // token never faces a 127-wide parallel read.
+        // Progress, because this phase is otherwise SILENT for minutes. It is
+        // paced by count rather than by time so the interval is reproducible
+        // between runs, and it carries the running TALLY rather than a bare
+        // counter: "600/703 — 590 to trust" says both that the sweep is alive
+        // and what it is about to do, which is what a reader is deciding on.
+        const progressEvery = Math.max(1, Math.min(50, Math.ceil(selected.length / 10)));
+        let toTrustSoFar = 0;
+        let doneSoFar = 0;
+        let blockedSoFar = 0;
+        if (selected.length > progressEvery)
+            log(`Reading trust state for ${selected.length} package(s)…`);
         const plans = await probeAllTrustStates(trustRequest, selected, Math.max(1, args.concurrency), {
             registryOverride: args.registry,
             npmrc,
             repository,
             workflow,
+        }, {
+            ...pacing,
+            onProgress: (n, total, plan) => {
+                if (plan.action === 'trust' || plan.action === 'publish-and-trust')
+                    toTrustSoFar++;
+                else if (plan.action === 'skip')
+                    doneSoFar++;
+                else
+                    blockedSoFar++;
+                // Always report the LAST one, so the phase visibly ends.
+                if (n % progressEvery !== 0 && n !== total)
+                    return;
+                if (total <= progressEvery)
+                    return;
+                const parts = [`${toTrustSoFar} to do`, `${doneSoFar} already done`];
+                if (blockedSoFar > 0)
+                    parts.push(`${blockedSoFar} unreadable`);
+                log(`  read ${n}/${total} — ${parts.join(', ')}`);
+            },
         });
         // Summary table (published✓ / trusted✓ vs work to do).
         const toPublish = plans.filter((p) => p.action === 'publish-and-trust');
         const toTrust = plans.filter((p) => p.action === 'trust');
         const done = plans.filter((p) => p.action === 'skip');
         const blocked = plans.filter((p) => p.action === 'blocked');
-        for (const p of plans)
+        // A 703-package sweep prints 703 rows of "nothing to do" and buries the
+        // handful that matter. Rows needing WORK are always listed; the finished
+        // ones only under --verbose. The counts below cover all of them either
+        // way — a row can be omitted from the listing, never from the tally.
+        for (const p of plans) {
+            if (p.action === 'skip' && args.verbose !== true)
+                continue;
             log(`  ${statusCell(p)}  ${p.ws.name}`);
+        }
+        if (!args.verbose && done.length > 0)
+            log(`  (${done.length} already published + trusted — pass -v to list)`);
         log();
         log(`Plan: ${done.length} already done, ${toPublish.length} to publish+trust, ${toTrust.length} to trust, ${blocked.length} unreadable.`);
+        // Name the cause when the unreadable ones are throttling rather than a
+        // property of those packages. It lands on the TAIL of an alphabetical
+        // sweep, which is exactly where it looks like "these packages are
+        // special" instead of "we asked too fast".
+        const throttled = blocked.filter((p) => p.httpStatus === 429).length;
+        if (throttled > 0) {
+            log(`  ${throttled} of those are npm rate limits (HTTP 429) that outlasted the backoff — ` +
+                'lower --concurrency and re-run; the sweep is idempotent and picks up where it left off.');
+        }
         const results = [];
         if (dryRun) {
             for (const p of plans) {
@@ -201,99 +366,178 @@ export const onboardCommand = {
                         ? 'would publish + trust'
                         : p.action === 'trust'
                             ? 'would trust'
-                            : undefined,
+                            : p.action === 'blocked'
+                                ? // Same shape the act phase reports, so a
+                                    // `failed` row in a dry-run summary says WHY
+                                    // rather than only that it did not succeed.
+                                    `state HTTP ${p.httpStatus}`
+                                : undefined,
                 });
             }
-            finish(results, plans, { asJson, dryRun });
+            // A dry-run whose whole job is to REPORT THE PLAN must not exit 0
+            // having failed to compute it. Every unreadable package is counted
+            // as a failure here: run without a token, every trust read is a 401
+            // and the summary is `0 to publish+trust, 0 to trust` — a plan that
+            // was never determined, printed in the shape of a plan that found
+            // nothing to do. Measured on `gjsify/types`: 703 packages, 703
+            // unreadable, exit 0.
+            finish(results, plans, {
+                asJson,
+                dryRun,
+                failed: blocked.length,
+                root,
+                sources,
+                discovered: all.length,
+            });
             return;
         }
-        // 4. Act on the gaps, minimally. Publishes + trust POSTs run SERIALLY so
-        // the shared OTP is prompted at most once (and reused everywhere) —
-        // reusing the `otpProvider` + `trustRequest` built for the probe phase.
+        // 4. Act on the gaps, minimally.
+        //
+        // The two kinds of work are paced DIFFERENTLY, on purpose.
+        //
+        // A trust POST is independent of every other trust POST, so they run at
+        // `--write-concurrency`. They used to be serial for one reason — "so the
+        // shared OTP is prompted at most once" — and that reason is gone now
+        // that `OtpProvider.refresh()` is single-flight: concurrent writers share
+        // one prompt instead of stacking N of them.
+        //
+        // What this buys is PROMPTS, not throughput, and the distinction is
+        // measured rather than assumed: the real `gjsify/types` run was already
+        // being 429'd at SERIAL pace, so npm — not the loop — sets the ceiling.
+        // What serial cost was 2FA codes: one lives ~30 s, so the sweep crossed a
+        // code boundary every ~38 packages, ~18 codes typed by hand for 703
+        // packages. Fewer wall-clock seconds per code means fewer codes.
+        // The shared `RateLimitGate` is what makes raising this safe rather than
+        // merely faster-to-fail.
+        //
+        // A publish stays SERIAL. Publish order is a correctness property
+        // (docs/publishing.md: an aborted parallel sweep can leave a live bridge
+        // pinning a platform child that does not exist), and nothing about OTP
+        // pacing is worth trading that for.
         const trustBody = githubTrustBody({ repository, workflow, environment });
+        const writeConcurrency = Math.max(1, args['write-concurrency']);
+        const writeTotal = toPublish.length + toTrust.length;
+        // Results are written by INDEX rather than pushed, so a concurrent phase
+        // still reports in plan order — a summary whose order depends on which
+        // request happened to answer first is harder to diff between runs.
+        const indexed = Array.from({ length: plans.length });
         let failed = 0;
-        for (const p of plans) {
-            if (p.action === 'skip') {
-                results.push({ name: p.ws.name, result: 'already-done' });
-                continue;
-            }
-            if (p.action === 'blocked') {
-                log(`→ ${p.ws.name}: cannot read trust state (HTTP ${p.httpStatus}) — skipped`);
-                results.push({ name: p.ws.name, result: 'failed', detail: `state HTTP ${p.httpStatus}` });
-                failed++;
-                continue;
-            }
-            let publishedNow = false;
-            if (p.action === 'publish-and-trust') {
-                log(`→ ${p.ws.name}: building + publishing…`);
-                try {
-                    await buildIfPresent(p.ws, log);
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    log(`  build failed: ${msg}`);
-                    results.push({ name: p.ws.name, result: 'failed', detail: `build: ${msg}` });
-                    failed++;
-                    continue;
-                }
-                const pub = await publishWorkspace({
-                    wsDir: p.ws.location,
-                    tag: 'latest',
-                    access: 'public',
-                    provenance: false,
-                    tolerate: true, // a concurrent/racey publish is harmless
-                    tolerateUntrustedNew: false,
-                    trustedFlag: undefined,
-                    registry: p.registry,
-                    verbose: false,
-                    json: false,
-                    otpProvider,
-                    seedOtpFirst: false,
-                });
-                if (!pub.ok) {
-                    const detail = describePublishFailure(pub);
-                    log(`  publish failed: ${detail}`);
-                    results.push({ name: p.ws.name, result: 'failed', detail: `publish: ${detail}` });
-                    failed++;
-                    continue;
-                }
-                publishedNow = pub.action !== 'skipped-untrusted-new';
-                log(`  published ${pub.name}@${'version' in pub ? pub.version : ''}`);
-            }
-            // Configure the Trusted Publisher.
-            const created = await trustRequest('POST', p.url, trustBody);
+        /** POST the Trusted Publisher config for one package and record the outcome. */
+        let written = 0;
+        let throttledWrites = 0;
+        const configureTrust = async (p, i, publishedNow) => {
+            // Through the rate-limit-aware wrapper: a 703-package sweep that gets
+            // throttled on its READS gets throttled on its WRITES too, and a bare
+            // 429 here would be recorded as `trust failed` — a failure attributed
+            // to the package rather than to the pacing.
+            const created = await requestWaitingOutRateLimit(trustRequest, 'POST', p.url, trustBody, pacing);
+            // `n/total` on every line, because the pace of a sweep is the thing a
+            // reader is judging while it runs — and the OTP prompt that
+            // interrupts it needs a nearby answer to "did the last code get
+            // anywhere?".
+            const at = `${++written}/${writeTotal}`;
             if (created.status >= 200 && created.status < 300) {
-                log(`  trusted ${p.ws.name}`);
-                results.push({
-                    name: p.ws.name,
-                    result: publishedNow ? 'published+trusted' : 'trusted',
-                });
+                log(`  [${at}] trusted ${p.ws.name}`);
+                indexed[i] = { name: p.ws.name, result: publishedNow ? 'published+trusted' : 'trusted' };
             }
             else if (created.status === 409) {
-                results.push({ name: p.ws.name, result: publishedNow ? 'published+trusted' : 'trusted' });
+                indexed[i] = { name: p.ws.name, result: publishedNow ? 'published+trusted' : 'trusted' };
             }
             else if (created.status === 404) {
                 // Freshly-published package not yet provisioned for trust config.
-                log(`  ${p.ws.name}: published but not yet trust-configurable (re-run onboard)`);
-                results.push({
+                log(`  [${at}] ${p.ws.name}: published but not yet trust-configurable (re-run onboard)`);
+                indexed[i] = {
                     name: p.ws.name,
                     result: publishedNow ? 'published' : 'failed',
                     detail: 'trust config deferred (404)',
-                });
+                };
                 if (!publishedNow)
                     failed++;
             }
             else {
-                log(`  trust failed (HTTP ${created.status})`);
-                results.push({
-                    name: p.ws.name,
-                    result: 'failed',
-                    detail: `trust HTTP ${created.status}`,
-                });
+                log(`  [${at}] trust failed (HTTP ${created.status}) — ${p.ws.name}`);
+                indexed[i] = { name: p.ws.name, result: 'failed', detail: `trust HTTP ${created.status}` };
+                if (created.status === 429)
+                    throttledWrites++;
+                failed++;
+            }
+        };
+        // 4a. Bookkeeping-only rows, and the serial publish path.
+        const trustOnly = [];
+        for (let i = 0; i < plans.length; i++) {
+            const p = plans[i];
+            if (p.action === 'skip') {
+                indexed[i] = { name: p.ws.name, result: 'already-done' };
+                continue;
+            }
+            if (p.action === 'blocked') {
+                log(`→ ${p.ws.name}: cannot read trust state (HTTP ${p.httpStatus}) — skipped`);
+                indexed[i] = { name: p.ws.name, result: 'failed', detail: `state HTTP ${p.httpStatus}` };
+                failed++;
+                continue;
+            }
+            if (p.action === 'trust') {
+                trustOnly.push({ p, i });
+                continue;
+            }
+            // publish-and-trust — serial, see above.
+            log(`→ ${p.ws.name}: building + publishing…`);
+            try {
+                if (args.build !== false)
+                    await buildIfPresent(p.ws, log);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                log(`  build failed: ${msg}`);
+                indexed[i] = { name: p.ws.name, result: 'failed', detail: `build: ${msg}` };
                 failed++;
+                continue;
             }
+            const pub = await publishWorkspace({
+                wsDir: p.ws.location,
+                tag: 'latest',
+                access: args.access,
+                provenance: false,
+                tolerate: true, // a concurrent/racey publish is harmless
+                tolerateUntrustedNew: false,
+                trustedFlag: undefined,
+                registry: p.registry,
+                verbose: false,
+                json: false,
+                otpProvider,
+                seedOtpFirst: false,
+            });
+            if (!pub.ok) {
+                const detail = describePublishFailure(pub);
+                log(`  publish failed: ${detail}`);
+                indexed[i] = { name: p.ws.name, result: 'failed', detail: `publish: ${detail}` };
+                failed++;
+                continue;
+            }
+            log(`  published ${pub.name}@${'version' in pub ? pub.version : ''}`);
+            await configureTrust(p, i, pub.action !== 'skipped-untrusted-new');
+        }
+        // 4b. The trust-only packages, concurrently.
+        if (trustOnly.length > 0) {
+            if (trustOnly.length > 1) {
+                log(`→ configuring ${trustOnly.length} Trusted Publisher(s), ${writeConcurrency} at a time…`);
+            }
+            await mapWithConcurrency(trustOnly, writeConcurrency, async ({ p, i }) => configureTrust(p, i, false));
+        }
+        for (const r of indexed)
+            if (r)
+                results.push(r);
+        // Name the cause at the END too, not only in the plan. A write is
+        // throttled minutes after the plan was printed and scrolled away, and
+        // "73 failed" on its own reads as 73 broken packages.
+        if (throttledWrites > 0) {
+            log();
+            log(`${throttledWrites} of the failures are npm rate limits (HTTP 429) that outlasted the wait, ` +
+                'not a problem with those packages.');
+            log('  Re-run to pick them up — the sweep is idempotent and skips everything already configured. ' +
+                `A lower --write-concurrency (currently ${writeConcurrency}) provokes the limit less.`);
         }
-        finish(results, plans, { asJson, dryRun, failed });
+        finish(results, plans, { asJson, dryRun, failed, root, sources, discovered: all.length });
     },
 };
 /** Print the summary + exit with the right code. */
@@ -303,6 +547,12 @@ function finish(results, plans, opts) {
         process.stdout.write(`${JSON.stringify({
             ok: failed === 0,
             dryRun: opts.dryRun,
+            // `root`/`sources`/`discovered` travel with the summary so a
+            // caller can check WHICH tree was swept, not just that a
+            // sweep reported itself finished.
+            root: opts.root,
+            sources: opts.sources,
+            discovered: opts.discovered,
             total: plans.length,
             published: results.filter((r) => r.result === 'published' || r.result === 'published+trusted')
                 .length,
@@ -314,7 +564,10 @@ function finish(results, plans, opts) {
     }
     else {
         const line = opts.dryRun
-            ? 'Dry-run complete — nothing changed.'
+            ? failed > 0
+                ? `Dry-run INCOMPLETE — nothing changed, but ${failed} package(s) had an unreadable state, ` +
+                    'so the plan above does not cover them. Authenticate (`gjsify login`) and re-run.'
+                : 'Dry-run complete — nothing changed.'
             : `Done: ${results.filter((r) => r.result.includes('published')).length} published, ` +
                 `${results.filter((r) => r.result === 'trusted' || r.result === 'published+trusted').length} trusted, ` +
                 `${results.filter((r) => r.result === 'already-done').length} already done, ${failed} failed.`;

package/lib/commands/ship.d.ts

@@ -1,5 +1,6 @@
 import type { Command } from '../types/index.js';
 interface ShipOptions {
+    os?: string;
     target?: string[];
     out?: string;
     stage: boolean;
@@ -7,6 +8,8 @@ interface ShipOptions {
     'expect-target'?: string;
     'skip-build': boolean;
     arch?: string;
+    sign?: string;
+    notarize?: string;
     verbose: boolean;
 }
 export declare const shipCommand: Command<unknown, ShipOptions>;