@smoothbricks/cli 0.1.1 → 0.3.0

package/src/release/index.ts

@@ -5,21 +5,35 @@ import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
 import { withDevenvEnv } from '../lib/devenv.js';
-import { isRecord, stringProperty } from '../lib/json.js';
-import { decode, run, runStatus } from '../lib/run.js';
+import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
+import { decode, run, runInteractiveStatus, runResult, runStatus } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
+import {
+  type BootstrapNpmPackagesOptions,
+  bootstrapNpmPackages,
+  NPM_BOOTSTRAP_DIST_TAG,
+  NPM_BOOTSTRAP_VERSION,
+} from './bootstrap-npm-packages.js';
+import { autoReleaseCandidatePackages } from './candidates.js';
 import {
   type ReleaseTagRecord as CoreReleaseTagRecord,
   type ReleaseTarget as CoreReleaseTarget,
   collectOwnedReleaseTagRecords,
   type GitReleaseTagInfo,
   pendingReleaseTargets,
+  type ReleasePackageInfo,
   releaseTag,
+  releaseTagAliases,
 } from './core.js';
-import { createOrUpdateGithubRelease, renderNxProjectChangelogContents } from './github-release.js';
+import {
+  createOrUpdateGithubRelease,
+  renderNxProjectChangelogContents,
+  withNxWorkspaceRoot,
+} from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import {
+  bumpStableReleaseToNext,
   completeReleaseAtHead as completeReleaseAtHeadWithShell,
   type ReleaseCompletionShell,
   type ReleaseSummary,
@@ -46,8 +60,17 @@ export interface ReleaseRepairPendingOptions {
 
 export interface ReleaseTrustPublisherOptions {
   dryRun?: boolean;
-  otp?: string;
+  bootstrap?: boolean;
+  bootstrapOtp?: string;
+  skipLogin?: boolean;
+  packages?: string[];
+}
+
+export interface ReleaseBootstrapNpmPackagesOptions {
+  dryRun?: boolean;
   skipLogin?: boolean;
+  otp?: string;
+  packages?: string[];
 }
 
 export interface ReleaseRetagUnpublishedOptions {
@@ -63,13 +86,14 @@ export interface ReleaseRetagUnpublishedOptions {
 export async function releaseVersion(root: string, options: ReleaseVersionOptions): Promise<void> {
   const bump = releaseBumpArg(options.bump);
   const packages = releasePackages(root);
-  const projects = releasePackageProjects(packages);
   const result = await runReleaseVersion(
     {
       releasePackagesAtHead: () => releasePackagesAtHead(root, packages),
+      releaseVersionPackages: (releaseBump) => releaseVersionPackages(root, packages, releaseBump),
       ensureLocalReleaseTags: (releasePackages) => ensureLocalReleaseTags(root, releasePackages),
       gitHead: () => gitHead(root),
-      runNxReleaseVersion: (releaseBump, dryRun) => runNxReleaseVersion(root, projects, releaseBump, dryRun),
+      runNxReleaseVersion: (releasePackages, releaseBump, dryRun) =>
+        runNxReleaseVersion(root, releasePackageProjects(releasePackages), releaseBump, dryRun),
       assertCleanGitTree: () => assertCleanGitTree(root),
     },
     { bump, dryRun: options.dryRun === true },
@@ -79,6 +103,9 @@ export async function releaseVersion(root: string, options: ReleaseVersionOption
   } else if (result.status === 'no-release-needed') {
     console.log('Nx did not create a release commit; no release needed.');
   }
+  if (result.status === 'dry-run') {
+    await writeReleasePreviewSummary(root, packages, result.packages);
+  }
   await writeReleaseGithubOutput(options.githubOutput, result.packages, result.mode);
 }
 
@@ -87,15 +114,22 @@ export async function releasePublish(root: string, options: ReleasePublishOption
   const packages = await releasePackagesAtHead(root, releasePackages(root));
   if (packages.length === 0) {
     if (bump === 'auto') {
+      if (options.dryRun === true) {
+        console.log(
+          'No release tags found at HEAD because dry-run versioning does not create release commits or tags.',
+        );
+        return;
+      }
       console.log('No release tags found at HEAD; no release to publish.');
       const summary: ReleaseSummary<ReleasePackage> = {
         sha: await gitHead(root),
-        dryRun: options.dryRun === true,
+        dryRun: false,
         packages,
         pushed: false,
         published: [],
         alreadyPublished: [],
         githubReleases: [],
+        githubReleaseLinks: [],
         rerunRequired: false,
         noRelease: true,
       };
@@ -111,6 +145,15 @@ export async function releasePublish(root: string, options: ReleasePublishOption
     await newerCommitsRemain(root),
   );
   await writeReleaseSummary(summary);
+  const bumpedPackages = await bumpStableReleaseToNext(
+    releaseNextShell(root),
+    packages,
+    options.dryRun === true,
+    summary.rerunRequired,
+  );
+  if (bumpedPackages.length > 0) {
+    console.log(`Prepared next prerelease for ${packageSummary(bumpedPackages)}.`);
+  }
 }
 
 export async function releaseRepairPending(root: string, options: ReleaseRepairPendingOptions): Promise<void> {
@@ -127,6 +170,9 @@ export async function releaseRepairPending(root: string, options: ReleaseRepairP
       ? 'Repair pending releases: no pending durable state repairs found.'
       : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`,
   );
+  for (const target of targets) {
+    console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
+  }
   const summaries = await repairPendingTargets(releaseRepairShell(root), targets, restoreRef, options.dryRun === true);
   await writeRepairSummary(summaries, options.dryRun === true);
 }
@@ -134,61 +180,193 @@ export async function releaseRepairPending(root: string, options: ReleaseRepairP
 export async function releaseTrustPublisher(root: string, options: ReleaseTrustPublisherOptions): Promise<void> {
   const repository = githubRepositoryFromRootPackage(root);
   const workflow = 'publish.yml';
-  const packages = listReleasePackages(root);
-  if (packages.length === 0) {
+  await configureTrustedPublishers(
+    {
+      repository,
+      workflow,
+      listReleasePackages: () => listReleasePackages(root),
+      packageExists: (name) => npmPackageExists(root, name),
+      bootstrapNpmPackages: (bootstrapOptions) =>
+        bootstrapNpmPackages(
+          {
+            listReleasePackages: () => listReleasePackages(root),
+            packageExists: (name) => npmPackageExists(root, name),
+            login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+            publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+            promptOtp: (packageName) => promptForNpmOtp(packageName),
+            log: (message) => console.log(message),
+          },
+          bootstrapOptions,
+        ),
+      trustPublisher: (pkg, dryRun, env) => {
+        const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
+        if (dryRun) {
+          args.push('--dry-run');
+        }
+        return runLatestNpmTrust(root, args, env);
+      },
+      trustedPublishers: (pkg) => listTrustedPublishers(root, pkg),
+      log: (message) => console.log(message),
+      error: (message) => console.error(message),
+    },
+    options,
+  );
+}
+
+export interface TrustPublisherShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  repository: string;
+  workflow: string;
+  listReleasePackages(): Package[];
+  packageExists(name: string): Promise<boolean>;
+  bootstrapNpmPackages(options: BootstrapNpmPackagesOptions): Promise<Package[]>;
+  trustPublisher(pkg: Package, dryRun: boolean, env?: Record<string, string>): Promise<TrustPublisherResult>;
+  trustedPublishers(pkg: Package): Promise<TrustedPublisher[]>;
+  log(message: string): void;
+  error(message: string): void;
+}
+
+export type TrustPublisherResult = 'configured' | 'already-configured';
+
+export interface TrustedPublisher {
+  id: string;
+  type: string;
+  file?: string;
+  repository?: string;
+}
+
+export async function configureTrustedPublishers<Package extends ReleasePackageInfo>(
+  shell: TrustPublisherShell<Package>,
+  options: ReleaseTrustPublisherOptions,
+): Promise<void> {
+  const packages = shell.listReleasePackages();
+  const selectedPackages = selectedTrustPublisherPackages(packages, options.packages ?? []);
+  if (selectedPackages.length === 0) {
     throw new Error('No owned release packages found.');
   }
 
+  if (options.bootstrap) {
+    await shell.bootstrapNpmPackages({
+      dryRun: options.dryRun === true,
+      skipLogin: options.skipLogin === true,
+      otp: options.bootstrapOtp,
+      packages: options.packages ?? [],
+    });
+  }
+
   if (!options.dryRun) {
     const packageStates = await Promise.all(
-      packages.map(async (pkg) => ((await npmPackageExists(root, pkg.name)) ? null : pkg.name)),
+      selectedPackages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)),
     );
     const missingPackages = packageStates.filter((name): name is string => name !== null);
     if (missingPackages.length > 0) {
       throw new Error(
         'npm trusted publishing can only be configured after packages exist on the registry. ' +
-          'Bootstrap the first publish with a temporary NPM_TOKEN, then rerun trust-publisher. ' +
+          'Run smoo release trust-publisher --bootstrap locally. ' +
           `Missing packages: ${missingPackages.join(', ')}`,
       );
     }
   }
 
-  if (!options.dryRun && !options.skipLogin) {
-    await runLatestNpm(root, ['login', '--auth-type=web']);
-  }
-
   const failedPackages: string[] = [];
-  for (const pkg of packages) {
-    console.log(`${pkg.name}: trusting GitHub Actions ${repository}/${workflow}`);
-    const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
-    if (options.dryRun) {
-      args.push('--dry-run');
+  for (const pkg of selectedPackages) {
+    if (!options.dryRun) {
+      const trustedPublishers = await shell.trustedPublishers(pkg);
+      if (hasMatchingGithubTrustedPublisher(trustedPublishers, shell.repository, shell.workflow)) {
+        shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+        continue;
+      }
+      if (trustedPublishers.length > 0) {
+        throw new Error(
+          `${pkg.name}: npm trusted publisher exists but does not match GitHub Actions ${shell.repository}/${shell.workflow}. ` +
+            'Use npm trust list to inspect it and npm trust revoke --id <trust-id> before reconfiguring.',
+        );
+      }
     }
+
+    shell.log(`${pkg.name}: trusting GitHub Actions ${shell.repository}/${shell.workflow}`);
     while (true) {
-      const otp = options.dryRun ? undefined : (options.otp ?? (await promptForNpmOtp(pkg.name)));
       try {
-        await runLatestNpm(root, args, otp ? { NPM_CONFIG_OTP: otp } : undefined);
+        const result = await shell.trustPublisher(pkg, options.dryRun === true);
+        if (result === 'already-configured') {
+          shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+        }
         break;
       } catch (error) {
-        console.error(`${pkg.name}: npm trusted publisher setup failed.`);
-        console.error(error instanceof Error ? error.message : String(error));
+        shell.error(`${pkg.name}: npm trusted publisher setup failed.`);
+        shell.error(error instanceof Error ? error.message : String(error));
         if (!options.dryRun) {
-          console.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
+          shell.error('npm owns trusted publishing authentication. Complete the npm browser challenge, then retry.');
         }
-        if (options.otp || options.dryRun) {
+        if (options.dryRun) {
           failedPackages.push(pkg.name);
           break;
         }
-        console.error('Retrying this package. Press Ctrl-C to stop.');
+        shell.error('Retrying this package. Press Ctrl-C to stop.');
       }
     }
   }
   if (failedPackages.length > 0) {
-    console.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
-    if (options.otp) {
-      console.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
+    shell.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
+  }
+}
+
+function selectedTrustPublisherPackages<Package extends ReleasePackageInfo>(
+  packages: Package[],
+  selections: string[],
+): Package[] {
+  if (selections.length === 0) {
+    return packages;
+  }
+  const byName = new Map(packages.map((pkg) => [pkg.name, pkg]));
+  const selected: Package[] = [];
+  const unknown: string[] = [];
+  for (const name of selections) {
+    const pkg = byName.get(name);
+    if (pkg) {
+      selected.push(pkg);
+    } else {
+      unknown.push(name);
     }
   }
+  if (unknown.length > 0) {
+    throw new Error(`Unknown owned release package selection: ${unknown.join(', ')}`);
+  }
+  return selected;
+}
+
+function hasMatchingGithubTrustedPublisher(
+  trustedPublishers: TrustedPublisher[],
+  repository: string,
+  workflow: string,
+): boolean {
+  return trustedPublishers.some(
+    (trustedPublisher) =>
+      trustedPublisher.type === 'github' &&
+      trustedPublisher.repository === repository &&
+      trustedPublisher.file === workflow,
+  );
+}
+
+export async function releaseBootstrapNpmPackages(
+  root: string,
+  options: ReleaseBootstrapNpmPackagesOptions,
+): Promise<void> {
+  await bootstrapNpmPackages(
+    {
+      listReleasePackages: () => listReleasePackages(root),
+      packageExists: (name) => npmPackageExists(root, name),
+      login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+      publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+      promptOtp: (packageName) => promptForNpmOtp(packageName),
+      log: (message) => console.log(message),
+    },
+    {
+      dryRun: options.dryRun === true,
+      skipLogin: options.skipLogin === true,
+      otp: options.otp,
+      packages: options.packages ?? [],
+    },
+  );
 }
 
 export async function releaseRetagUnpublished(root: string, options: ReleaseRetagUnpublishedOptions): Promise<void> {
@@ -218,6 +396,7 @@ interface ReleaseState {
 }
 
 type ReleasePackage = ReturnType<typeof listReleasePackages>[number];
+const releasePreviewChangelogs = new Map<string, string>();
 
 type ReleaseTarget = CoreReleaseTarget<ReleasePackage>;
 type ReleaseTagRecord = CoreReleaseTagRecord<ReleasePackage>;
@@ -243,21 +422,14 @@ async function listUnpublishedPackages(root: string, packages: ReleasePackage[])
   return states.filter((state) => !state.published).map((state) => state.pkg);
 }
 
-async function publishPackedPackage(
-  root: string,
-  pkg: ReleasePackage,
-  tag: string,
-  dryRun: boolean,
-  useBootstrapToken: boolean,
-): Promise<void> {
+async function publishPackedPackage(root: string, pkg: ReleasePackage, tag: string, dryRun: boolean): Promise<void> {
   const tempDir = await mkdtemp(join(tmpdir(), 'smoo-publish-'));
   const tarball = join(tempDir, `${safeTarballPrefix(pkg.name)}-${pkg.version}.tgz`);
   try {
     console.log(`${pkg.name}@${pkg.version}: packing with bun pm pack`);
     await run('bun', ['pm', 'pack', '--filename', tarball, '--ignore-scripts', '--quiet'], join(root, pkg.path));
     await assertPackedWorkspaceDependencies(root, tarball, pkg);
-    // npm CLI owns authentication here: trusted publishing OIDC when configured,
-    // or the temporary NODE_AUTH_TOKEN bootstrap path below before trust exists.
+    // npm CLI owns authentication here: trusted publishing OIDC when configured.
     // Bun still produces the tarball so workspace:* dependencies are resolved the
     // same way smoo validates packed packages before release.
     const args = ['publish', tarball, '--access', 'public', '--tag', tag, '--provenance'];
@@ -267,7 +439,7 @@ async function publishPackedPackage(
     await publishWithAuthDiagnostics(
       pkg,
       {
-        publish: () => runLatestNpmPublish(root, args, useBootstrapToken),
+        publish: () => runLatestNpmPublish(root, args),
         versionExists: () => npmVersionExists(root, pkg.name, pkg.version),
         log: (message) => console.log(message),
         error: (message) => console.error(message),
@@ -279,7 +451,6 @@ async function publishPackedPackage(
         },
       },
       {
-        useBootstrapToken,
         tokenPresent: npmAuthTokenPresent(),
         repository: githubRepositoryFromRootPackage(root),
       },
@@ -293,6 +464,38 @@ function npmAuthTokenPresent(): boolean {
   return Boolean(process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN || process.env.NPM_CONFIG_USERCONFIG);
 }
 
+async function publishPlaceholderPackage(
+  root: string,
+  pkg: ReleasePackage,
+  env?: Record<string, string>,
+): Promise<void> {
+  const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-bootstrap-'));
+  try {
+    await writeFile(
+      join(tempDir, 'package.json'),
+      `${JSON.stringify(
+        {
+          name: pkg.name,
+          version: NPM_BOOTSTRAP_VERSION,
+          description: `Bootstrap placeholder for ${pkg.name}. Real releases are published by SmoothBricks CI.`,
+          license: stringProperty(pkg.json, 'license') ?? 'UNLICENSED',
+          repository: pkg.json.repository,
+          publishConfig: { access: 'public' },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    await writeFile(
+      join(tempDir, 'README.md'),
+      `# ${pkg.name}\n\nThis is a bootstrap placeholder. Real package versions are published by SmoothBricks release automation.\n`,
+    );
+    await runLatestNpm(root, ['publish', tempDir, '--access', 'public', '--tag', NPM_BOOTSTRAP_DIST_TAG], env);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+}
+
 function safeTarballPrefix(name: string): string {
   return name.replace(/^@/, '').replace(/[^a-zA-Z0-9._-]+/g, '-');
 }
@@ -314,10 +517,41 @@ function releasePackages(root: string): ReleasePackage[] {
 }
 
 function releasePackageProjects(packages: ReleasePackage[]): string {
-  return packages.map((pkg) => pkg.name).join(',');
+  return packages.map((pkg) => pkg.projectName).join(',');
 }
 
-async function runNxReleaseVersion(root: string, projects: string, bump: string, dryRun: boolean): Promise<void> {
+async function releaseVersionPackages(
+  root: string,
+  packages: ReleasePackage[],
+  bump: string,
+): Promise<ReleasePackage[]> {
+  if (bump !== 'auto') {
+    return packages;
+  }
+  return autoReleaseCandidatePackages(
+    {
+      gitRefExists: (ref) => gitRefExists(root, ref),
+      packageChangedFilesSince: (ref, packagePath) => packageChangedFilesSince(root, ref, packagePath),
+      packageJsonAtRef: (ref, packagePath) => packageJsonAtRef(root, ref, packagePath),
+      currentPackageJson: (packagePath) => currentPackageJson(root, packagePath),
+      packageBuildInputPatterns: (projectName, packagePath) =>
+        packageBuildInputPatterns(root, projectName, packagePath),
+      packageHasHistory: (packagePath) => packageHasHistory(root, packagePath),
+    },
+    packages,
+  );
+}
+
+async function runNxReleaseVersion(
+  root: string,
+  projects: string,
+  bump: string,
+  dryRun: boolean,
+): Promise<ReleasePackage[]> {
+  if (dryRun) {
+    return runNxReleaseVersionPreview(root, projects, bump);
+  }
+
   // Nx owns local release mutation: package versions, bun.lock updates, the
   // release commit, and annotated tags. smoo owns remote publication after the
   // workflow validates the exact release commit Nx produced.
@@ -326,10 +560,78 @@ async function runNxReleaseVersion(root: string, projects: string, bump: string,
     nxArgs.push(bump);
   }
   nxArgs.push(`--projects=${projects}`, '--git-commit=true', '--git-tag=true', '--git-push=false');
-  if (dryRun) {
-    nxArgs.push('--dry-run');
-  }
   await run('nx', nxArgs, root);
+  return [];
+}
+
+async function runNxReleaseVersionPreview(root: string, projects: string, bump: string): Promise<ReleasePackage[]> {
+  return withNxWorkspaceRoot(root, async () => {
+    const { createAPI } = await import('nx/src/command-line/release/version.js');
+    const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+    const projectNames = projects.split(',').filter(Boolean);
+    const result = await createAPI(
+      {},
+      false,
+    )({
+      specifier: bump === 'auto' ? undefined : bump,
+      projects: projectNames,
+      gitCommit: true,
+      gitTag: true,
+      gitPush: false,
+      dryRun: true,
+    });
+    const changelogResult = await createChangelogAPI(
+      {
+        changelog: {
+          workspaceChangelog: false,
+          projectChangelogs: { createRelease: false, file: false },
+        },
+      },
+      false,
+    )({
+      projects: projectNames,
+      versionData: result.projectsVersionData,
+      releaseGraph: result.releaseGraph,
+      gitCommit: false,
+      gitTag: false,
+      gitPush: false,
+      stageChanges: false,
+      createRelease: false,
+      dryRun: true,
+    });
+    releasePreviewChangelogs.clear();
+    for (const [projectName, changelog] of Object.entries(changelogResult.projectChangelogs ?? {})) {
+      releasePreviewChangelogs.set(projectName, changelog.contents);
+    }
+    const packagesByProject = new Map(releasePackages(root).map((pkg) => [pkg.projectName, pkg]));
+    return Object.entries(result.projectsVersionData)
+      .map(([projectName, data]) => {
+        const pkg = packagesByProject.get(projectName);
+        if (!pkg || !data.newVersion) {
+          return null;
+        }
+        return { ...pkg, version: data.newVersion };
+      })
+      .filter((pkg): pkg is ReleasePackage => pkg !== null);
+  });
+}
+
+async function runNxNextPrereleaseVersion(root: string, projects: string): Promise<void> {
+  await run(
+    'nx',
+    [
+      'release',
+      'version',
+      'prerelease',
+      `--projects=${projects}`,
+      '--preid=next',
+      '--git-commit=true',
+      '--git-tag=false',
+      '--git-push=false',
+      '--git-commit-message=chore(release): prepare next prerelease',
+    ],
+    root,
+  );
 }
 
 async function releasePackagesAtHead(root: string, packages: ReleasePackage[]): Promise<ReleasePackage[]> {
@@ -414,7 +716,7 @@ async function gitTagsAtRef(root: string, ref: string): Promise<string[]> {
 }
 
 async function previousReleaseTag(root: string, pkg: ReleasePackage, currentTag: string): Promise<string | null> {
-  const result = await $`git tag --list ${`${pkg.name}@*`} --sort=-v:refname --merged ${currentTag}`
+  const result = await $`git tag --list ${`${pkg.projectName}@*`} --sort=-v:refname --merged ${currentTag}`
     .cwd(root)
     .quiet()
     .nothrow();
@@ -467,6 +769,12 @@ async function pushReleaseRefs(root: string, packages: ReleasePackage[]): Promis
   return true;
 }
 
+async function pushCurrentBranch(root: string): Promise<void> {
+  const branch = await releaseBranch(root);
+  const remote = await releaseRemote(root, branch);
+  await run('git', ['push', remote, `HEAD:refs/heads/${branch}`], root);
+}
+
 function releaseCompletionShell(root: string): ReleaseCompletionShell<ReleasePackage> {
   return {
     gitHead: () => gitHead(root),
@@ -475,13 +783,25 @@ function releaseCompletionShell(root: string): ReleaseCompletionShell<ReleasePac
     buildReleaseCandidate: (packages) => buildReleaseCandidate(root, packages),
     publishPackage: async (pkg, distTag, dryRun) => {
       const packageExists = dryRun ? true : await npmPackageExists(root, pkg.name);
-      await publishPackedPackage(root, pkg, distTag, dryRun, !dryRun && !packageExists);
+      if (!packageExists) {
+        throw new Error(missingNpmPackagePublishGuidance(pkg));
+      }
+      await publishPackedPackage(root, pkg, distTag, dryRun);
     },
     listGithubMissingPackages: (packages) => listMissingGithubReleasePackages(root, packages),
     createGithubRelease: (pkg, dryRun) => createGithubRelease(root, pkg, dryRun),
   };
 }
 
+function releaseNextShell(root: string): { bumpStablePackagesToNext(packages: ReleasePackage[]): Promise<void> } {
+  return {
+    bumpStablePackagesToNext: async (packages) => {
+      await runNxNextPrereleaseVersion(root, releasePackageProjects(packages));
+      await pushCurrentBranch(root);
+    },
+  };
+}
+
 function releaseRepairShell(root: string): ReleaseCompletionShell<ReleasePackage> & {
   checkout(ref: string): Promise<void>;
   withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
@@ -536,11 +856,12 @@ async function listOwnedReleaseTagRecords(root: string, ref: string): Promise<Re
 
 async function durableReleaseTagState(root: string, pkg: Pick<ReleasePackage, 'name' | 'version'>, tag: string) {
   const packageVersion = `${pkg.name}@${pkg.version}`;
+  const githubReleaseTags = releaseTagAliases({ ...pkg, projectName: projectNameFromReleaseTag(tag) });
   const start = Date.now();
-  console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${tag}).`);
+  console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${githubReleaseTags.join(' or ')}).`);
   const [npmPublished, githubReleasePresent] = await Promise.all([
     npmVersionExists(root, pkg.name, pkg.version),
-    githubReleaseExists(root, tag),
+    anyGithubReleaseExists(root, githubReleaseTags),
   ]);
   console.log(
     `${packageVersion}: durable state npm=${yesNo(npmPublished)} github=${yesNo(githubReleasePresent)} (${Date.now() - start}ms).`,
@@ -548,6 +869,14 @@ async function durableReleaseTagState(root: string, pkg: Pick<ReleasePackage, 'n
   return { npmPublished, githubReleaseExists: githubReleasePresent };
 }
 
+function projectNameFromReleaseTag(tag: string): string {
+  const versionSeparator = tag.lastIndexOf('@');
+  if (versionSeparator <= 0) {
+    return tag;
+  }
+  return tag.slice(0, versionSeparator);
+}
+
 async function gitReleaseTagsByCreatorDate(root: string): Promise<GitReleaseTagInfo[]> {
   const result =
     await $`git for-each-ref --sort=-creatordate --format=${'%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)'} refs/tags`
@@ -582,7 +911,7 @@ async function listMissingGithubReleasePackages(root: string, packages: ReleaseP
   ).filter((pkg): pkg is ReleasePackage => pkg !== null);
 }
 
-async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: boolean): Promise<void> {
+async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: boolean): Promise<string | null> {
   const currentTag = releaseTag(pkg);
   console.log(`${pkg.name}@${pkg.version}: rendering GitHub Release notes for ${currentTag}.`);
   console.log(`GitHub release auth: ${envPresence('GH_TOKEN')}, ${envPresence('GITHUB_TOKEN')}.`);
@@ -592,7 +921,7 @@ async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: bo
   const previousTag = await previousReleaseTag(root, pkg, currentTag);
   if (dryRun) {
     await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
-    return;
+    return null;
   }
   const contents = await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
   await createOrUpdateGithubRelease(pkg, contents, {
@@ -600,6 +929,7 @@ async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: bo
     runGhRelease: (args) => run('gh', args, root),
     log: (message) => console.log(message),
   });
+  return githubReleaseUrl(root, currentTag);
 }
 
 function envPresence(name: string): string {
@@ -637,7 +967,7 @@ async function writeReleaseSummary(summary: ReleaseSummary<ReleasePackage>): Pro
     lines.push(`- Git refs pushed: ${summary.pushed ? 'yes' : 'already current'}`);
     lines.push(`- npm published: ${packageSummary(summary.published)}`);
     lines.push(`- npm already published: ${packageSummary(summary.alreadyPublished)}`);
-    lines.push(`- GitHub Releases created/updated: ${packageSummary(summary.githubReleases)}`);
+    lines.push(`- GitHub Releases created/updated: ${githubReleaseSummary(summary)}`);
   }
   if (summary.rerunRequired) {
     const message = 'A previous incomplete release was repaired; newer commits remain. Run Publish again.';
@@ -652,13 +982,45 @@ async function writeReleaseSummary(summary: ReleaseSummary<ReleasePackage>): Pro
   }
 }
 
+async function writeReleasePreviewSummary(
+  root: string,
+  currentPackages: ReleasePackage[],
+  previewPackages: ReleasePackage[],
+): Promise<void> {
+  const lines = ['## Release Preview', '', `- Commit: \`${(await gitHead(root)).slice(0, 12)}\``, '- Mode: dry run'];
+  if (previewPackages.length === 0) {
+    lines.push('- Result: no release needed');
+  } else {
+    lines.push('- Packages:');
+    const currentByName = new Map(currentPackages.map((pkg) => [pkg.name, pkg]));
+    for (const pkg of previewPackages) {
+      lines.push(`  - \`${pkg.name}\`: \`${currentByName.get(pkg.name)?.version ?? 'unknown'}\` -> \`${pkg.version}\``);
+    }
+    for (const pkg of previewPackages) {
+      const contents = releasePreviewChangelogs.get(pkg.projectName);
+      if (!contents) {
+        throw new Error(`Nx did not generate a project changelog for ${pkg.projectName}.`);
+      }
+      lines.push('', `### ${pkg.name} ${pkg.version}`, '', contents.trim());
+    }
+  }
+  const text = `${lines.join('\n')}\n`;
+  console.log(text.trimEnd());
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (summaryPath) {
+    await appendFile(summaryPath, `${text}\n`);
+  }
+}
+
 async function writeRepairSummary(summaries: Array<ReleaseSummary<ReleasePackage>>, dryRun: boolean): Promise<void> {
   const lines = ['## Pending Release Repair', '', `- Mode: ${dryRun ? 'dry run' : 'release'}`];
   if (summaries.length === 0) {
     lines.push('- Result: no pending releases needed repair');
   } else {
     for (const summary of summaries) {
-      lines.push(`- Repaired \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`);
+      lines.push(
+        `- ${dryRun ? 'Would repair' : 'Repaired'} \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`,
+      );
     }
   }
   const text = `${lines.join('\n')}\n`;
@@ -676,6 +1038,30 @@ function packageSummary(packages: ReleasePackage[]): string {
   return packages.map((pkg) => `${pkg.name}@${pkg.version}`).join(', ');
 }
 
+function githubReleaseSummary(summary: ReleaseSummary<ReleasePackage>): string {
+  if (summary.githubReleaseLinks.length > 0) {
+    return summary.githubReleaseLinks.map(({ pkg, url }) => `[${pkg.name}@${pkg.version}](${url})`).join(', ');
+  }
+  return packageSummary(summary.githubReleases);
+}
+
+function repairTargetSummary(target: ReleaseTarget): string {
+  return target.packages
+    .map((pkg) => `${pkg.name}@${pkg.version} (${repairReasons(target, pkg).join(' + ')})`)
+    .join(', ');
+}
+
+function repairReasons(target: ReleaseTarget, pkg: ReleasePackage): string[] {
+  const reasons: string[] = [];
+  if (target.npmPackages.includes(pkg)) {
+    reasons.push('npm missing');
+  }
+  if (target.githubPackages.includes(pkg)) {
+    reasons.push('GitHub Release missing');
+  }
+  return reasons;
+}
+
 async function fetchReleaseRefs(root: string, remote: string, branch: string): Promise<void> {
   await run('git', ['fetch', '--tags', remote, branch], root);
 }
@@ -685,6 +1071,140 @@ async function gitRefExists(root: string, ref: string): Promise<boolean> {
   return result.exitCode === 0;
 }
 
+async function packageChangedFilesSince(root: string, ref: string, packagePath: string): Promise<string[]> {
+  const result = await $`git diff --name-only ${`${ref}..HEAD`} -- ${packagePath}`.cwd(root).quiet().nothrow();
+  if (result.exitCode !== 0) {
+    throw new Error(`Unable to inspect package changes under ${packagePath}.`);
+  }
+  const packagePrefix = `${packagePath}/`;
+  return decode(result.stdout)
+    .split('\n')
+    .map((path) => path.trim())
+    .filter(Boolean)
+    .map((path) => (path.startsWith(packagePrefix) ? path.slice(packagePrefix.length) : path));
+}
+
+async function packageJsonAtRef(
+  root: string,
+  ref: string,
+  packagePath: string,
+): Promise<Record<string, unknown> | null> {
+  const result = await $`git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
+  if (result.exitCode !== 0) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(decode(result.stdout));
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+async function currentPackageJson(root: string, packagePath: string): Promise<Record<string, unknown> | null> {
+  return readPackageJson(join(root, packagePath, 'package.json'))?.json ?? null;
+}
+
+async function packageBuildInputPatterns(root: string, projectName: string, _packagePath: string): Promise<string[]> {
+  const project = await nxProjectJson(root, projectName);
+  const nxJson = readJsonObject(join(root, 'nx.json')) ?? {};
+  return resolveBuildInputPatterns(project, nxJson);
+}
+
+async function nxProjectJson(root: string, projectName: string): Promise<Record<string, unknown>> {
+  const result = await $`nx show project ${projectName} --json`.cwd(root).quiet();
+  const parsed = JSON.parse(decode(result.stdout));
+  if (!isRecord(parsed)) {
+    throw new Error(`Unable to inspect Nx project ${projectName}.`);
+  }
+  return parsed;
+}
+
+function resolveBuildInputPatterns(project: Record<string, unknown>, nxJson: Record<string, unknown>): string[] {
+  const targets = recordProperty(project, 'targets');
+  if (!targets) {
+    return [];
+  }
+  return normalizeInputPatterns(collectBuildInputs(targets), nxJson);
+}
+
+function collectBuildInputs(targets: Record<string, unknown>): string[] {
+  const build = recordProperty(targets, 'build');
+  if (!build) {
+    return ['production'];
+  }
+  const directInputs = stringArrayProperty(build, 'inputs');
+  if (directInputs.length > 0) {
+    return directInputs;
+  }
+  const inputs: string[] = [];
+  for (const dependency of stringArrayProperty(build, 'dependsOn')) {
+    if (dependency.startsWith('^')) {
+      continue;
+    }
+    const targetName = dependency.includes(':') ? dependency.split(':')[1] : dependency;
+    if (!targetName) {
+      continue;
+    }
+    inputs.push(...stringArrayProperty(recordProperty(targets, targetName), 'inputs'));
+  }
+  return inputs.length > 0 ? inputs : ['production'];
+}
+
+function normalizeInputPatterns(inputs: string[], nxJson: Record<string, unknown>): string[] {
+  const patterns: string[] = [];
+  const seen = new Set<string>();
+  for (const input of inputs) {
+    for (const pattern of expandInputPattern(input, nxJson, seen)) {
+      patterns.push(pattern);
+    }
+  }
+  return patterns;
+}
+
+function expandInputPattern(input: string, nxJson: Record<string, unknown>, seen: Set<string>): string[] {
+  if (seen.has(input)) {
+    return [];
+  }
+  seen.add(input);
+  if (!input.includes('{')) {
+    const namedInputs = recordProperty(nxJson, 'namedInputs');
+    const namedInput = namedInputs?.[input];
+    if (Array.isArray(namedInput)) {
+      return namedInput.flatMap((entry) => (typeof entry === 'string' ? expandInputPattern(entry, nxJson, seen) : []));
+    }
+    return [];
+  }
+  const excluded = input.startsWith('!');
+  const rawInput = excluded ? input.slice(1) : input;
+  if (!rawInput.startsWith('{projectRoot}/')) {
+    return [];
+  }
+  const packageRelative = rawInput.slice('{projectRoot}/'.length);
+  return [`${excluded ? '!' : ''}${packageRelative}`];
+}
+
+function recordProperty(record: Record<string, unknown> | null, key: string): Record<string, unknown> | null {
+  if (!record) {
+    return null;
+  }
+  const value = record[key];
+  return isRecord(value) ? value : null;
+}
+
+function stringArrayProperty(record: Record<string, unknown> | null, key: string): string[] {
+  const value = record?.[key];
+  return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
+}
+
+async function packageHasHistory(root: string, packagePath: string): Promise<boolean> {
+  const result = await $`git log --format=%H -- ${packagePath}`.cwd(root).quiet().nothrow();
+  if (result.exitCode !== 0) {
+    throw new Error(`Unable to inspect package history under ${packagePath}.`);
+  }
+  return decode(result.stdout).trim().length > 0;
+}
+
 async function gitIsAncestor(root: string, ancestor: string, descendant: string): Promise<boolean> {
   const result = await $`git merge-base --is-ancestor ${ancestor} ${descendant}`.cwd(root).quiet().nothrow();
   return result.exitCode === 0;
@@ -764,6 +1284,19 @@ async function githubReleaseExists(root: string, tag: string): Promise<boolean>
   return (await runStatus('gh', ['release', 'view', tag, '--json', 'tagName'], root, true)) === 0;
 }
 
+function githubReleaseUrl(root: string, tag: string): string {
+  return `https://github.com/${githubRepositoryFromRootPackage(root)}/releases/tag/${encodeURIComponent(tag)}`;
+}
+
+async function anyGithubReleaseExists(root: string, tags: string[]): Promise<boolean> {
+  for (const tag of tags) {
+    if (await githubReleaseExists(root, tag)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 async function assertRemoteTagExists(root: string, tag: string): Promise<void> {
   const branch = await releaseBranch(root);
   const remote = await releaseRemote(root, branch);
@@ -887,36 +1420,87 @@ async function runLatestNpm(root: string, npmArgs: string[], env?: Record<string
   await run('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
 }
 
-async function runLatestNpmPublish(root: string, npmArgs: string[], useBootstrapToken: boolean): Promise<void> {
-  if (!useBootstrapToken) {
-    await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
-    return;
+async function runLatestNpmTrust(
+  root: string,
+  npmArgs: string[],
+  env?: Record<string, string>,
+): Promise<TrustPublisherResult> {
+  const status = await runInteractiveStatus(
+    'nix',
+    ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs],
+    root,
+    env,
+  );
+  if (status === 0) {
+    return 'configured';
   }
-  const token = process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN;
-  if (!token || process.env.NPM_CONFIG_USERCONFIG) {
-    if (!token && !process.env.NPM_CONFIG_USERCONFIG) {
-      throw new Error(
-        'First publish for a package requires NODE_AUTH_TOKEN or NPM_TOKEN until trusted publishing exists.',
-      );
+  throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${status}`);
+}
+
+async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'name'>): Promise<TrustedPublisher[]> {
+  const args = ['trust', 'list', pkg.name, '--json'];
+  let result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+  if (result.exitCode !== 0 && /\bEOTP\b/.test(`${result.stdout}\n${result.stderr}`)) {
+    const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+    if (status !== 0) {
+      throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${status}`);
     }
-    await runLatestNpm(root, npmArgs);
-    return;
+    result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
   }
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`,
+    );
+  }
+  return parseTrustedPublishers(result.stdout, pkg.name);
+}
 
-  const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-auth-'));
-  const npmrc = join(tempDir, '.npmrc');
-  try {
-    await writeFile(npmrc, `registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`);
-    await runLatestNpm(root, npmArgs, { NPM_CONFIG_USERCONFIG: npmrc });
-  } finally {
-    await rm(tempDir, { recursive: true, force: true });
+export function parseTrustedPublishers(stdout: string, packageName: string): TrustedPublisher[] {
+  if (stdout.trim().length === 0) {
+    return [];
+  }
+  const parsed = JSON.parse(stdout) as unknown;
+  if (parsed === null) {
+    return [];
+  }
+  if (Array.isArray(parsed)) {
+    return parsed.map((value) => parseTrustedPublisher(value, packageName));
+  }
+  if (isRecord(parsed)) {
+    return [parseTrustedPublisher(parsed, packageName)];
+  }
+  throw new Error(`${packageName}: npm trust list returned invalid JSON.`);
+}
+
+function parseTrustedPublisher(value: unknown, packageName: string): TrustedPublisher {
+  if (!isRecord(value)) {
+    throw new Error(`${packageName}: npm trust list returned invalid trusted publisher entry.`);
   }
+  const id = stringProperty(value, 'id');
+  const type = stringProperty(value, 'type');
+  if (!id || !type) {
+    throw new Error(`${packageName}: npm trust list returned a trusted publisher without id or type.`);
+  }
+  return {
+    id,
+    type,
+    file: stringProperty(value, 'file') ?? undefined,
+    repository: stringProperty(value, 'repository') ?? undefined,
+  };
+}
+
+async function runLatestNpmPublish(root: string, npmArgs: string[]): Promise<void> {
+  await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
+}
+
+function missingNpmPackagePublishGuidance(pkg: Pick<ReleasePackage, 'name'>): string {
+  return `${pkg.name} does not exist on npm yet. Run smoo release trust-publisher --bootstrap locally before rerunning the Publish workflow.`;
 }
 
 async function promptForNpmOtp(packageName: string): Promise<string> {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new Error(
-      `npm trust requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`,
+      `npm requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`,
     );
   }