@smoothbricks/cli 0.1.1 → 0.2.0

package/src/release/index.ts

@@ -5,16 +5,24 @@ import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
 import { withDevenvEnv } from '../lib/devenv.js';
-import { isRecord, stringProperty } from '../lib/json.js';
-import { decode, run, runStatus } from '../lib/run.js';
+import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
+import { decode, run, runResult, runStatus } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
+import {
+  type BootstrapNpmPackagesOptions,
+  bootstrapNpmPackages,
+  NPM_BOOTSTRAP_DIST_TAG,
+  NPM_BOOTSTRAP_VERSION,
+} from './bootstrap-npm-packages.js';
+import { autoReleaseCandidatePackages } from './candidates.js';
 import {
   type ReleaseTagRecord as CoreReleaseTagRecord,
   type ReleaseTarget as CoreReleaseTarget,
   collectOwnedReleaseTagRecords,
   type GitReleaseTagInfo,
   pendingReleaseTargets,
+  type ReleasePackageInfo,
   releaseTag,
 } from './core.js';
 import { createOrUpdateGithubRelease, renderNxProjectChangelogContents } from './github-release.js';
@@ -46,10 +54,19 @@ export interface ReleaseRepairPendingOptions {
 
 export interface ReleaseTrustPublisherOptions {
   dryRun?: boolean;
+  bootstrap?: boolean;
   otp?: string;
+  bootstrapOtp?: string;
   skipLogin?: boolean;
 }
 
+export interface ReleaseBootstrapNpmPackagesOptions {
+  dryRun?: boolean;
+  skipLogin?: boolean;
+  otp?: string;
+  packages?: string[];
+}
+
 export interface ReleaseRetagUnpublishedOptions {
   tags: string[];
   to?: string;
@@ -63,13 +80,14 @@ export interface ReleaseRetagUnpublishedOptions {
 export async function releaseVersion(root: string, options: ReleaseVersionOptions): Promise<void> {
   const bump = releaseBumpArg(options.bump);
   const packages = releasePackages(root);
-  const projects = releasePackageProjects(packages);
   const result = await runReleaseVersion(
     {
       releasePackagesAtHead: () => releasePackagesAtHead(root, packages),
+      releaseVersionPackages: (releaseBump) => releaseVersionPackages(root, packages, releaseBump),
       ensureLocalReleaseTags: (releasePackages) => ensureLocalReleaseTags(root, releasePackages),
       gitHead: () => gitHead(root),
-      runNxReleaseVersion: (releaseBump, dryRun) => runNxReleaseVersion(root, projects, releaseBump, dryRun),
+      runNxReleaseVersion: (releasePackages, releaseBump, dryRun) =>
+        runNxReleaseVersion(root, releasePackageProjects(releasePackages), releaseBump, dryRun),
       assertCleanGitTree: () => assertCleanGitTree(root),
     },
     { bump, dryRun: options.dryRun === true },
@@ -134,63 +152,152 @@ export async function releaseRepairPending(root: string, options: ReleaseRepairP
 export async function releaseTrustPublisher(root: string, options: ReleaseTrustPublisherOptions): Promise<void> {
   const repository = githubRepositoryFromRootPackage(root);
   const workflow = 'publish.yml';
-  const packages = listReleasePackages(root);
+  await configureTrustedPublishers(
+    {
+      repository,
+      workflow,
+      listReleasePackages: () => listReleasePackages(root),
+      packageExists: (name) => npmPackageExists(root, name),
+      bootstrapNpmPackages: (bootstrapOptions) =>
+        bootstrapNpmPackages(
+          {
+            listReleasePackages: () => listReleasePackages(root),
+            packageExists: (name) => npmPackageExists(root, name),
+            login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+            publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+            promptOtp: (packageName) => promptForNpmOtp(packageName),
+            log: (message) => console.log(message),
+          },
+          bootstrapOptions,
+        ),
+      login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+      trustPublisher: (pkg, dryRun, env) => {
+        const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
+        if (dryRun) {
+          args.push('--dry-run');
+        }
+        return runLatestNpmTrust(root, args, env);
+      },
+      promptOtp: (packageName) => promptForNpmOtp(packageName),
+      log: (message) => console.log(message),
+      error: (message) => console.error(message),
+    },
+    options,
+  );
+}
+
+export interface TrustPublisherShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  repository: string;
+  workflow: string;
+  listReleasePackages(): Package[];
+  packageExists(name: string): Promise<boolean>;
+  bootstrapNpmPackages(options: BootstrapNpmPackagesOptions): Promise<Package[]>;
+  login(): Promise<void>;
+  trustPublisher(pkg: Package, dryRun: boolean, env?: Record<string, string>): Promise<TrustPublisherResult>;
+  promptOtp(packageName: string): Promise<string>;
+  log(message: string): void;
+  error(message: string): void;
+}
+
+export type TrustPublisherResult = 'configured' | 'already-configured';
+
+export async function configureTrustedPublishers<Package extends ReleasePackageInfo>(
+  shell: TrustPublisherShell<Package>,
+  options: ReleaseTrustPublisherOptions,
+): Promise<void> {
+  const packages = shell.listReleasePackages();
   if (packages.length === 0) {
     throw new Error('No owned release packages found.');
   }
 
+  let bootstrapLoggedIn = false;
+  if (options.bootstrap) {
+    const bootstrapped = await shell.bootstrapNpmPackages({
+      dryRun: options.dryRun === true,
+      skipLogin: options.skipLogin === true,
+      otp: options.bootstrapOtp,
+      packages: [],
+    });
+    bootstrapLoggedIn = bootstrapped.length > 0 && !options.dryRun && !options.skipLogin;
+  }
+
   if (!options.dryRun) {
     const packageStates = await Promise.all(
-      packages.map(async (pkg) => ((await npmPackageExists(root, pkg.name)) ? null : pkg.name)),
+      packages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)),
     );
     const missingPackages = packageStates.filter((name): name is string => name !== null);
     if (missingPackages.length > 0) {
       throw new Error(
         'npm trusted publishing can only be configured after packages exist on the registry. ' +
-          'Bootstrap the first publish with a temporary NPM_TOKEN, then rerun trust-publisher. ' +
+          'Run smoo release trust-publisher --bootstrap locally. ' +
           `Missing packages: ${missingPackages.join(', ')}`,
       );
     }
   }
 
-  if (!options.dryRun && !options.skipLogin) {
-    await runLatestNpm(root, ['login', '--auth-type=web']);
+  if (!options.dryRun && !options.skipLogin && !bootstrapLoggedIn) {
+    await shell.login();
   }
 
   const failedPackages: string[] = [];
   for (const pkg of packages) {
-    console.log(`${pkg.name}: trusting GitHub Actions ${repository}/${workflow}`);
-    const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
-    if (options.dryRun) {
-      args.push('--dry-run');
-    }
+    shell.log(`${pkg.name}: trusting GitHub Actions ${shell.repository}/${shell.workflow}`);
     while (true) {
-      const otp = options.dryRun ? undefined : (options.otp ?? (await promptForNpmOtp(pkg.name)));
+      const otp = options.dryRun ? undefined : (options.otp ?? (await shell.promptOtp(pkg.name)));
       try {
-        await runLatestNpm(root, args, otp ? { NPM_CONFIG_OTP: otp } : undefined);
+        const result = await shell.trustPublisher(
+          pkg,
+          options.dryRun === true,
+          otp ? { NPM_CONFIG_OTP: otp } : undefined,
+        );
+        if (result === 'already-configured') {
+          shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+        }
         break;
       } catch (error) {
-        console.error(`${pkg.name}: npm trusted publisher setup failed.`);
-        console.error(error instanceof Error ? error.message : String(error));
+        shell.error(`${pkg.name}: npm trusted publisher setup failed.`);
+        shell.error(error instanceof Error ? error.message : String(error));
         if (!options.dryRun) {
-          console.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
+          shell.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
         }
         if (options.otp || options.dryRun) {
           failedPackages.push(pkg.name);
           break;
         }
-        console.error('Retrying this package. Press Ctrl-C to stop.');
+        shell.error('Retrying this package. Press Ctrl-C to stop.');
       }
     }
   }
   if (failedPackages.length > 0) {
-    console.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
+    shell.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
     if (options.otp) {
-      console.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
+      shell.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
     }
   }
 }
 
+export async function releaseBootstrapNpmPackages(
+  root: string,
+  options: ReleaseBootstrapNpmPackagesOptions,
+): Promise<void> {
+  await bootstrapNpmPackages(
+    {
+      listReleasePackages: () => listReleasePackages(root),
+      packageExists: (name) => npmPackageExists(root, name),
+      login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+      publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+      promptOtp: (packageName) => promptForNpmOtp(packageName),
+      log: (message) => console.log(message),
+    },
+    {
+      dryRun: options.dryRun === true,
+      skipLogin: options.skipLogin === true,
+      otp: options.otp,
+      packages: options.packages ?? [],
+    },
+  );
+}
+
 export async function releaseRetagUnpublished(root: string, options: ReleaseRetagUnpublishedOptions): Promise<void> {
   const toRef = options.to ?? 'HEAD';
   const dispatch = options.dispatch === true;
@@ -243,21 +350,14 @@ async function listUnpublishedPackages(root: string, packages: ReleasePackage[])
   return states.filter((state) => !state.published).map((state) => state.pkg);
 }
 
-async function publishPackedPackage(
-  root: string,
-  pkg: ReleasePackage,
-  tag: string,
-  dryRun: boolean,
-  useBootstrapToken: boolean,
-): Promise<void> {
+async function publishPackedPackage(root: string, pkg: ReleasePackage, tag: string, dryRun: boolean): Promise<void> {
   const tempDir = await mkdtemp(join(tmpdir(), 'smoo-publish-'));
   const tarball = join(tempDir, `${safeTarballPrefix(pkg.name)}-${pkg.version}.tgz`);
   try {
     console.log(`${pkg.name}@${pkg.version}: packing with bun pm pack`);
     await run('bun', ['pm', 'pack', '--filename', tarball, '--ignore-scripts', '--quiet'], join(root, pkg.path));
     await assertPackedWorkspaceDependencies(root, tarball, pkg);
-    // npm CLI owns authentication here: trusted publishing OIDC when configured,
-    // or the temporary NODE_AUTH_TOKEN bootstrap path below before trust exists.
+    // npm CLI owns authentication here: trusted publishing OIDC when configured.
     // Bun still produces the tarball so workspace:* dependencies are resolved the
     // same way smoo validates packed packages before release.
     const args = ['publish', tarball, '--access', 'public', '--tag', tag, '--provenance'];
@@ -267,7 +367,7 @@ async function publishPackedPackage(
     await publishWithAuthDiagnostics(
       pkg,
       {
-        publish: () => runLatestNpmPublish(root, args, useBootstrapToken),
+        publish: () => runLatestNpmPublish(root, args),
         versionExists: () => npmVersionExists(root, pkg.name, pkg.version),
         log: (message) => console.log(message),
         error: (message) => console.error(message),
@@ -279,7 +379,6 @@ async function publishPackedPackage(
         },
       },
       {
-        useBootstrapToken,
         tokenPresent: npmAuthTokenPresent(),
         repository: githubRepositoryFromRootPackage(root),
       },
@@ -293,6 +392,38 @@ function npmAuthTokenPresent(): boolean {
   return Boolean(process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN || process.env.NPM_CONFIG_USERCONFIG);
 }
 
+async function publishPlaceholderPackage(
+  root: string,
+  pkg: ReleasePackage,
+  env?: Record<string, string>,
+): Promise<void> {
+  const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-bootstrap-'));
+  try {
+    await writeFile(
+      join(tempDir, 'package.json'),
+      `${JSON.stringify(
+        {
+          name: pkg.name,
+          version: NPM_BOOTSTRAP_VERSION,
+          description: `Bootstrap placeholder for ${pkg.name}. Real releases are published by SmoothBricks CI.`,
+          license: stringProperty(pkg.json, 'license') ?? 'UNLICENSED',
+          repository: pkg.json.repository,
+          publishConfig: { access: 'public' },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    await writeFile(
+      join(tempDir, 'README.md'),
+      `# ${pkg.name}\n\nThis is a bootstrap placeholder. Real package versions are published by SmoothBricks release automation.\n`,
+    );
+    await runLatestNpm(root, ['publish', tempDir, '--access', 'public', '--tag', NPM_BOOTSTRAP_DIST_TAG], env);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+}
+
 function safeTarballPrefix(name: string): string {
   return name.replace(/^@/, '').replace(/[^a-zA-Z0-9._-]+/g, '-');
 }
@@ -314,7 +445,29 @@ function releasePackages(root: string): ReleasePackage[] {
 }
 
 function releasePackageProjects(packages: ReleasePackage[]): string {
-  return packages.map((pkg) => pkg.name).join(',');
+  return packages.map((pkg) => pkg.projectName).join(',');
+}
+
+async function releaseVersionPackages(
+  root: string,
+  packages: ReleasePackage[],
+  bump: string,
+): Promise<ReleasePackage[]> {
+  if (bump !== 'auto') {
+    return packages;
+  }
+  return autoReleaseCandidatePackages(
+    {
+      gitRefExists: (ref) => gitRefExists(root, ref),
+      packageChangedFilesSince: (ref, packagePath) => packageChangedFilesSince(root, ref, packagePath),
+      packageJsonAtRef: (ref, packagePath) => packageJsonAtRef(root, ref, packagePath),
+      currentPackageJson: (packagePath) => currentPackageJson(root, packagePath),
+      packageBuildInputPatterns: (projectName, packagePath) =>
+        packageBuildInputPatterns(root, projectName, packagePath),
+      packageHasHistory: (packagePath) => packageHasHistory(root, packagePath),
+    },
+    packages,
+  );
 }
 
 async function runNxReleaseVersion(root: string, projects: string, bump: string, dryRun: boolean): Promise<void> {
@@ -475,7 +628,10 @@ function releaseCompletionShell(root: string): ReleaseCompletionShell<ReleasePac
     buildReleaseCandidate: (packages) => buildReleaseCandidate(root, packages),
     publishPackage: async (pkg, distTag, dryRun) => {
       const packageExists = dryRun ? true : await npmPackageExists(root, pkg.name);
-      await publishPackedPackage(root, pkg, distTag, dryRun, !dryRun && !packageExists);
+      if (!packageExists) {
+        throw new Error(missingNpmPackagePublishGuidance(pkg));
+      }
+      await publishPackedPackage(root, pkg, distTag, dryRun);
     },
     listGithubMissingPackages: (packages) => listMissingGithubReleasePackages(root, packages),
     createGithubRelease: (pkg, dryRun) => createGithubRelease(root, pkg, dryRun),
@@ -685,6 +841,140 @@ async function gitRefExists(root: string, ref: string): Promise<boolean> {
   return result.exitCode === 0;
 }
 
+async function packageChangedFilesSince(root: string, ref: string, packagePath: string): Promise<string[]> {
+  const result = await $`git diff --name-only ${`${ref}..HEAD`} -- ${packagePath}`.cwd(root).quiet().nothrow();
+  if (result.exitCode !== 0) {
+    throw new Error(`Unable to inspect package changes under ${packagePath}.`);
+  }
+  const packagePrefix = `${packagePath}/`;
+  return decode(result.stdout)
+    .split('\n')
+    .map((path) => path.trim())
+    .filter(Boolean)
+    .map((path) => (path.startsWith(packagePrefix) ? path.slice(packagePrefix.length) : path));
+}
+
+async function packageJsonAtRef(
+  root: string,
+  ref: string,
+  packagePath: string,
+): Promise<Record<string, unknown> | null> {
+  const result = await $`git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
+  if (result.exitCode !== 0) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(decode(result.stdout));
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+async function currentPackageJson(root: string, packagePath: string): Promise<Record<string, unknown> | null> {
+  return readPackageJson(join(root, packagePath, 'package.json'))?.json ?? null;
+}
+
+async function packageBuildInputPatterns(root: string, projectName: string, _packagePath: string): Promise<string[]> {
+  const project = await nxProjectJson(root, projectName);
+  const nxJson = readJsonObject(join(root, 'nx.json')) ?? {};
+  return resolveBuildInputPatterns(project, nxJson);
+}
+
+async function nxProjectJson(root: string, projectName: string): Promise<Record<string, unknown>> {
+  const result = await $`nx show project ${projectName} --json`.cwd(root).quiet();
+  const parsed = JSON.parse(decode(result.stdout));
+  if (!isRecord(parsed)) {
+    throw new Error(`Unable to inspect Nx project ${projectName}.`);
+  }
+  return parsed;
+}
+
+function resolveBuildInputPatterns(project: Record<string, unknown>, nxJson: Record<string, unknown>): string[] {
+  const targets = recordProperty(project, 'targets');
+  if (!targets) {
+    return [];
+  }
+  return normalizeInputPatterns(collectBuildInputs(targets), nxJson);
+}
+
+function collectBuildInputs(targets: Record<string, unknown>): string[] {
+  const build = recordProperty(targets, 'build');
+  if (!build) {
+    return ['production'];
+  }
+  const directInputs = stringArrayProperty(build, 'inputs');
+  if (directInputs.length > 0) {
+    return directInputs;
+  }
+  const inputs: string[] = [];
+  for (const dependency of stringArrayProperty(build, 'dependsOn')) {
+    if (dependency.startsWith('^')) {
+      continue;
+    }
+    const targetName = dependency.includes(':') ? dependency.split(':')[1] : dependency;
+    if (!targetName) {
+      continue;
+    }
+    inputs.push(...stringArrayProperty(recordProperty(targets, targetName), 'inputs'));
+  }
+  return inputs.length > 0 ? inputs : ['production'];
+}
+
+function normalizeInputPatterns(inputs: string[], nxJson: Record<string, unknown>): string[] {
+  const patterns: string[] = [];
+  const seen = new Set<string>();
+  for (const input of inputs) {
+    for (const pattern of expandInputPattern(input, nxJson, seen)) {
+      patterns.push(pattern);
+    }
+  }
+  return patterns;
+}
+
+function expandInputPattern(input: string, nxJson: Record<string, unknown>, seen: Set<string>): string[] {
+  if (seen.has(input)) {
+    return [];
+  }
+  seen.add(input);
+  if (!input.includes('{')) {
+    const namedInputs = recordProperty(nxJson, 'namedInputs');
+    const namedInput = namedInputs?.[input];
+    if (Array.isArray(namedInput)) {
+      return namedInput.flatMap((entry) => (typeof entry === 'string' ? expandInputPattern(entry, nxJson, seen) : []));
+    }
+    return [];
+  }
+  const excluded = input.startsWith('!');
+  const rawInput = excluded ? input.slice(1) : input;
+  if (!rawInput.startsWith('{projectRoot}/')) {
+    return [];
+  }
+  const packageRelative = rawInput.slice('{projectRoot}/'.length);
+  return [`${excluded ? '!' : ''}${packageRelative}`];
+}
+
+function recordProperty(record: Record<string, unknown> | null, key: string): Record<string, unknown> | null {
+  if (!record) {
+    return null;
+  }
+  const value = record[key];
+  return isRecord(value) ? value : null;
+}
+
+function stringArrayProperty(record: Record<string, unknown> | null, key: string): string[] {
+  const value = record?.[key];
+  return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
+}
+
+async function packageHasHistory(root: string, packagePath: string): Promise<boolean> {
+  const result = await $`git log --format=%H -- ${packagePath}`.cwd(root).quiet().nothrow();
+  if (result.exitCode !== 0) {
+    throw new Error(`Unable to inspect package history under ${packagePath}.`);
+  }
+  return decode(result.stdout).trim().length > 0;
+}
+
 async function gitIsAncestor(root: string, ancestor: string, descendant: string): Promise<boolean> {
   const result = await $`git merge-base --is-ancestor ${ancestor} ${descendant}`.cwd(root).quiet().nothrow();
   return result.exitCode === 0;
@@ -887,30 +1177,30 @@ async function runLatestNpm(root: string, npmArgs: string[], env?: Record<string
   await run('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
 }
 
-async function runLatestNpmPublish(root: string, npmArgs: string[], useBootstrapToken: boolean): Promise<void> {
-  if (!useBootstrapToken) {
-    await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
-    return;
+async function runLatestNpmTrust(
+  root: string,
+  npmArgs: string[],
+  env?: Record<string, string>,
+): Promise<TrustPublisherResult> {
+  const result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
+  if (result.exitCode === 0) {
+    return 'configured';
   }
-  const token = process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN;
-  if (!token || process.env.NPM_CONFIG_USERCONFIG) {
-    if (!token && !process.env.NPM_CONFIG_USERCONFIG) {
-      throw new Error(
-        'First publish for a package requires NODE_AUTH_TOKEN or NPM_TOKEN until trusted publishing exists.',
-      );
-    }
-    await runLatestNpm(root, npmArgs);
-    return;
+  const output = `${result.stdout}\n${result.stderr}`;
+  if (/\bE409\b|\b409 Conflict\b/.test(output)) {
+    return 'already-configured';
   }
+  throw new Error(
+    `nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${result.exitCode}`,
+  );
+}
 
-  const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-auth-'));
-  const npmrc = join(tempDir, '.npmrc');
-  try {
-    await writeFile(npmrc, `registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`);
-    await runLatestNpm(root, npmArgs, { NPM_CONFIG_USERCONFIG: npmrc });
-  } finally {
-    await rm(tempDir, { recursive: true, force: true });
-  }
+async function runLatestNpmPublish(root: string, npmArgs: string[]): Promise<void> {
+  await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
+}
+
+function missingNpmPackagePublishGuidance(pkg: Pick<ReleasePackage, 'name'>): string {
+  return `${pkg.name} does not exist on npm yet. Run smoo release trust-publisher --bootstrap locally before rerunning the Publish workflow.`;
 }
 
 async function promptForNpmOtp(packageName: string): Promise<string> {

package/src/release/npm-auth.ts

@@ -1,7 +1,6 @@
 import type { ReleasePackageInfo } from './core.js';
 
 export interface NpmPublishAuthFailureOptions {
-  useBootstrapToken: boolean;
   tokenPresent: boolean;
   repository?: string;
 }
@@ -30,7 +29,7 @@ export async function publishWithAuthDiagnostics(
     shell.error(npmPublishAuthFailureMessage(pkg, options));
     await shell.appendSummary(npmPublishAuthFailureMarkdown(pkg, options));
     throw new Error(
-      `${packageVersion}: npm publish authentication failed. Run smoo release trust-publisher after the package exists on npm; see the warning banner above for details.`,
+      `${packageVersion}: npm publish authentication failed. Run smoo release trust-publisher; see the warning banner above for details.`,
       { cause: error },
     );
   }
@@ -42,26 +41,11 @@ export function npmPublishAuthFailureMessage(
 ): string {
   const packageVersion = `${pkg.name}@${pkg.version}`;
   const lines = [
-    `::error title=npm publish authentication failed::${packageVersion} could not be published. This usually means npm trusted publishing is not configured for this package/workflow/repo, or the bootstrap NPM_TOKEN is missing/invalid.`,
+    `::error title=npm publish authentication failed::${packageVersion} could not be published. This usually means npm trusted publishing is not configured for this package/workflow/repo.`,
     '',
     `🚨 npm publish authentication failed for ${packageVersion}`,
     '',
   ];
-  if (options.useBootstrapToken) {
-    lines.push(
-      'smoo expected a temporary npm automation token because this package does not exist on npm yet.',
-      options.tokenPresent
-        ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
-        : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set. Add a temporary NPM_TOKEN repository secret and rerun the Publish workflow.',
-      '',
-      'After the first successful publish, run:',
-      '  smoo release trust-publisher',
-      '',
-      'Then remove the temporary bootstrap token path for future releases.',
-    );
-    return lines.join('\n');
-  }
-
   lines.push(
     'smoo expected npm trusted publishing/OIDC because this package already exists on npm.',
     options.tokenPresent
@@ -75,7 +59,7 @@ export function npmPublishAuthFailureMessage(
     '   workflow: publish.yml',
     '3. Rerun the Publish workflow.',
     '',
-    'For first-ever package publishes, add a temporary NPM_TOKEN repository secret, publish once, then run smoo release trust-publisher.',
+    'For first-ever package publishes, run locally: smoo release trust-publisher --bootstrap.',
   );
   return lines.join('\n');
 }
@@ -86,19 +70,6 @@ export function npmPublishAuthFailureMarkdown(
 ): string {
   const packageVersion = `${pkg.name}@${pkg.version}`;
   const lines = ['## 🚨 npm Publish Authentication Failed', '', `Package: \`${packageVersion}\``, ''];
-  if (options.useBootstrapToken) {
-    lines.push(
-      'smoo expected a temporary npm automation token because this package does not exist on npm yet.',
-      '',
-      options.tokenPresent
-        ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
-        : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set. Add a temporary `NPM_TOKEN` repository secret and rerun the Publish workflow.',
-      '',
-      'After the first successful publish, run `smoo release trust-publisher`, then remove the temporary bootstrap token path for future releases.',
-    );
-    return lines.join('\n');
-  }
-
   lines.push(
     'smoo expected npm trusted publishing/OIDC because this package already exists on npm.',
     '',
@@ -112,7 +83,7 @@ export function npmPublishAuthFailureMarkdown(
     `2. Ensure the npm trusted publisher uses repository \`${trustedPublisherRepository(options)}\` and workflow \`publish.yml\``,
     '3. Rerun the Publish workflow.',
     '',
-    'For first-ever package publishes, add a temporary `NPM_TOKEN` repository secret, publish once, then run `smoo release trust-publisher`.',
+    'For first-ever package publishes, run `smoo release trust-publisher --bootstrap` locally.',
   );
   return lines.join('\n');
 }

package/src/release/orchestration.ts

@@ -35,9 +35,10 @@ export interface ReleaseRepairShell<Package extends ReleasePackageInfo = Release
 
 export interface ReleaseVersionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
   releasePackagesAtHead(): Promise<Package[]>;
+  releaseVersionPackages(bump: string): Promise<Package[]>;
   ensureLocalReleaseTags(packages: Package[]): Promise<void>;
   gitHead(): Promise<string>;
-  runNxReleaseVersion(bump: string, dryRun: boolean): Promise<void>;
+  runNxReleaseVersion(packages: Package[], bump: string, dryRun: boolean): Promise<void>;
   assertCleanGitTree(): Promise<void>;
 }
 
@@ -59,8 +60,17 @@ export async function runReleaseVersion<Package extends ReleasePackageInfo>(
     }
   }
 
+  const versionPackages = await shell.releaseVersionPackages(options.bump);
+  if (versionPackages.length === 0) {
+    if (options.bump !== 'auto') {
+      // invariant throw: the CLI resolves forced bumps from the full owned release package set.
+      throw new Error(`No release packages were selected for forced --bump ${options.bump}.`);
+    }
+    return { mode: 'none', packages: [], status: 'no-release-needed' };
+  }
+
   const headBeforeVersioning = await shell.gitHead();
-  await shell.runNxReleaseVersion(options.bump, options.dryRun);
+  await shell.runNxReleaseVersion(versionPackages, options.bump, options.dryRun);
   if (options.dryRun) {
     return { mode: 'none', packages: [], status: 'dry-run' };
   }

package/src/release/publish-plan.ts

@@ -26,7 +26,7 @@ export function planPublishActions<Package extends ReleasePackageInfo>(
   const githubReleasePackages = input.releasePackages.filter((pkg) => githubMissingNames.has(pkg.name));
 
   return {
-    buildProjects: npmPackages.map((pkg) => pkg.name),
+    buildProjects: npmPackages.map((pkg) => pkg.projectName),
     publishPackages: npmPackages.map((pkg) => ({ pkg, distTag: npmDistTagForVersion(pkg.version) })),
     githubReleasePackages,
   };