@smoothbricks/cli 0.1.1 → 0.3.0

package/dist/release/index.js

@@ -5,24 +5,26 @@ import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
 import { withDevenvEnv } from '../lib/devenv.js';
-import { isRecord, stringProperty } from '../lib/json.js';
-import { decode, run, runStatus } from '../lib/run.js';
+import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
+import { decode, run, runInteractiveStatus, runResult, runStatus } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
-import { collectOwnedReleaseTagRecords, pendingReleaseTargets, releaseTag, } from './core.js';
-import { createOrUpdateGithubRelease, renderNxProjectChangelogContents } from './github-release.js';
+import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
+import { autoReleaseCandidatePackages } from './candidates.js';
+import { collectOwnedReleaseTagRecords, pendingReleaseTargets, releaseTag, releaseTagAliases, } from './core.js';
+import { createOrUpdateGithubRelease, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
-import { completeReleaseAtHead as completeReleaseAtHeadWithShell, repairPendingTargets, runReleaseVersion, } from './orchestration.js';
+import { bumpStableReleaseToNext, completeReleaseAtHead as completeReleaseAtHeadWithShell, repairPendingTargets, runReleaseVersion, } from './orchestration.js';
 import { retagUnpublished } from './retag-unpublished.js';
 export async function releaseVersion(root, options) {
     const bump = releaseBumpArg(options.bump);
     const packages = releasePackages(root);
-    const projects = releasePackageProjects(packages);
     const result = await runReleaseVersion({
         releasePackagesAtHead: () => releasePackagesAtHead(root, packages),
+        releaseVersionPackages: (releaseBump) => releaseVersionPackages(root, packages, releaseBump),
         ensureLocalReleaseTags: (releasePackages) => ensureLocalReleaseTags(root, releasePackages),
         gitHead: () => gitHead(root),
-        runNxReleaseVersion: (releaseBump, dryRun) => runNxReleaseVersion(root, projects, releaseBump, dryRun),
+        runNxReleaseVersion: (releasePackages, releaseBump, dryRun) => runNxReleaseVersion(root, releasePackageProjects(releasePackages), releaseBump, dryRun),
         assertCleanGitTree: () => assertCleanGitTree(root),
     }, { bump, dryRun: options.dryRun === true });
     if (result.status === 'already-release-target') {
@@ -31,6 +33,9 @@ export async function releaseVersion(root, options) {
     else if (result.status === 'no-release-needed') {
         console.log('Nx did not create a release commit; no release needed.');
     }
+    if (result.status === 'dry-run') {
+        await writeReleasePreviewSummary(root, packages, result.packages);
+    }
     await writeReleaseGithubOutput(options.githubOutput, result.packages, result.mode);
 }
 export async function releasePublish(root, options) {
@@ -38,15 +43,20 @@ export async function releasePublish(root, options) {
     const packages = await releasePackagesAtHead(root, releasePackages(root));
     if (packages.length === 0) {
         if (bump === 'auto') {
+            if (options.dryRun === true) {
+                console.log('No release tags found at HEAD because dry-run versioning does not create release commits or tags.');
+                return;
+            }
             console.log('No release tags found at HEAD; no release to publish.');
             const summary = {
                 sha: await gitHead(root),
-                dryRun: options.dryRun === true,
+                dryRun: false,
                 packages,
                 pushed: false,
                 published: [],
                 alreadyPublished: [],
                 githubReleases: [],
+                githubReleaseLinks: [],
                 rerunRequired: false,
                 noRelease: true,
             };
@@ -57,6 +67,10 @@ export async function releasePublish(root, options) {
     }
     const summary = await completeReleaseAtHeadWithShell(releaseCompletionShell(root), packages, options.dryRun === true, await newerCommitsRemain(root));
     await writeReleaseSummary(summary);
+    const bumpedPackages = await bumpStableReleaseToNext(releaseNextShell(root), packages, options.dryRun === true, summary.rerunRequired);
+    if (bumpedPackages.length > 0) {
+        console.log(`Prepared next prerelease for ${packageSummary(bumpedPackages)}.`);
+    }
 }
 export async function releaseRepairPending(root, options) {
     const branch = await releaseBranch(root);
@@ -70,61 +84,143 @@ export async function releaseRepairPending(root, options) {
     console.log(targets.length === 0
         ? 'Repair pending releases: no pending durable state repairs found.'
         : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`);
+    for (const target of targets) {
+        console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
+    }
     const summaries = await repairPendingTargets(releaseRepairShell(root), targets, restoreRef, options.dryRun === true);
     await writeRepairSummary(summaries, options.dryRun === true);
 }
 export async function releaseTrustPublisher(root, options) {
     const repository = githubRepositoryFromRootPackage(root);
     const workflow = 'publish.yml';
-    const packages = listReleasePackages(root);
-    if (packages.length === 0) {
+    await configureTrustedPublishers({
+        repository,
+        workflow,
+        listReleasePackages: () => listReleasePackages(root),
+        packageExists: (name) => npmPackageExists(root, name),
+        bootstrapNpmPackages: (bootstrapOptions) => bootstrapNpmPackages({
+            listReleasePackages: () => listReleasePackages(root),
+            packageExists: (name) => npmPackageExists(root, name),
+            login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+            publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+            promptOtp: (packageName) => promptForNpmOtp(packageName),
+            log: (message) => console.log(message),
+        }, bootstrapOptions),
+        trustPublisher: (pkg, dryRun, env) => {
+            const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
+            if (dryRun) {
+                args.push('--dry-run');
+            }
+            return runLatestNpmTrust(root, args, env);
+        },
+        trustedPublishers: (pkg) => listTrustedPublishers(root, pkg),
+        log: (message) => console.log(message),
+        error: (message) => console.error(message),
+    }, options);
+}
+export async function configureTrustedPublishers(shell, options) {
+    const packages = shell.listReleasePackages();
+    const selectedPackages = selectedTrustPublisherPackages(packages, options.packages ?? []);
+    if (selectedPackages.length === 0) {
         throw new Error('No owned release packages found.');
     }
+    if (options.bootstrap) {
+        await shell.bootstrapNpmPackages({
+            dryRun: options.dryRun === true,
+            skipLogin: options.skipLogin === true,
+            otp: options.bootstrapOtp,
+            packages: options.packages ?? [],
+        });
+    }
     if (!options.dryRun) {
-        const packageStates = await Promise.all(packages.map(async (pkg) => ((await npmPackageExists(root, pkg.name)) ? null : pkg.name)));
+        const packageStates = await Promise.all(selectedPackages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)));
         const missingPackages = packageStates.filter((name) => name !== null);
         if (missingPackages.length > 0) {
             throw new Error('npm trusted publishing can only be configured after packages exist on the registry. ' +
-                'Bootstrap the first publish with a temporary NPM_TOKEN, then rerun trust-publisher. ' +
+                'Run smoo release trust-publisher --bootstrap locally. ' +
                 `Missing packages: ${missingPackages.join(', ')}`);
         }
     }
-    if (!options.dryRun && !options.skipLogin) {
-        await runLatestNpm(root, ['login', '--auth-type=web']);
-    }
     const failedPackages = [];
-    for (const pkg of packages) {
-        console.log(`${pkg.name}: trusting GitHub Actions ${repository}/${workflow}`);
-        const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
-        if (options.dryRun) {
-            args.push('--dry-run');
+    for (const pkg of selectedPackages) {
+        if (!options.dryRun) {
+            const trustedPublishers = await shell.trustedPublishers(pkg);
+            if (hasMatchingGithubTrustedPublisher(trustedPublishers, shell.repository, shell.workflow)) {
+                shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+                continue;
+            }
+            if (trustedPublishers.length > 0) {
+                throw new Error(`${pkg.name}: npm trusted publisher exists but does not match GitHub Actions ${shell.repository}/${shell.workflow}. ` +
+                    'Use npm trust list to inspect it and npm trust revoke --id <trust-id> before reconfiguring.');
+            }
         }
+        shell.log(`${pkg.name}: trusting GitHub Actions ${shell.repository}/${shell.workflow}`);
         while (true) {
-            const otp = options.dryRun ? undefined : (options.otp ?? (await promptForNpmOtp(pkg.name)));
             try {
-                await runLatestNpm(root, args, otp ? { NPM_CONFIG_OTP: otp } : undefined);
+                const result = await shell.trustPublisher(pkg, options.dryRun === true);
+                if (result === 'already-configured') {
+                    shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+                }
                 break;
             }
             catch (error) {
-                console.error(`${pkg.name}: npm trusted publisher setup failed.`);
-                console.error(error instanceof Error ? error.message : String(error));
+                shell.error(`${pkg.name}: npm trusted publisher setup failed.`);
+                shell.error(error instanceof Error ? error.message : String(error));
                 if (!options.dryRun) {
-                    console.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
+                    shell.error('npm owns trusted publishing authentication. Complete the npm browser challenge, then retry.');
                 }
-                if (options.otp || options.dryRun) {
+                if (options.dryRun) {
                     failedPackages.push(pkg.name);
                     break;
                 }
-                console.error('Retrying this package. Press Ctrl-C to stop.');
+                shell.error('Retrying this package. Press Ctrl-C to stop.');
             }
         }
     }
     if (failedPackages.length > 0) {
-        console.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
-        if (options.otp) {
-            console.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
+        shell.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
+    }
+}
+function selectedTrustPublisherPackages(packages, selections) {
+    if (selections.length === 0) {
+        return packages;
+    }
+    const byName = new Map(packages.map((pkg) => [pkg.name, pkg]));
+    const selected = [];
+    const unknown = [];
+    for (const name of selections) {
+        const pkg = byName.get(name);
+        if (pkg) {
+            selected.push(pkg);
         }
+        else {
+            unknown.push(name);
+        }
+    }
+    if (unknown.length > 0) {
+        throw new Error(`Unknown owned release package selection: ${unknown.join(', ')}`);
     }
+    return selected;
+}
+function hasMatchingGithubTrustedPublisher(trustedPublishers, repository, workflow) {
+    return trustedPublishers.some((trustedPublisher) => trustedPublisher.type === 'github' &&
+        trustedPublisher.repository === repository &&
+        trustedPublisher.file === workflow);
+}
+export async function releaseBootstrapNpmPackages(root, options) {
+    await bootstrapNpmPackages({
+        listReleasePackages: () => listReleasePackages(root),
+        packageExists: (name) => npmPackageExists(root, name),
+        login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+        publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+        promptOtp: (packageName) => promptForNpmOtp(packageName),
+        log: (message) => console.log(message),
+    }, {
+        dryRun: options.dryRun === true,
+        skipLogin: options.skipLogin === true,
+        otp: options.otp,
+        packages: options.packages ?? [],
+    });
 }
 export async function releaseRetagUnpublished(root, options) {
     const toRef = options.to ?? 'HEAD';
@@ -145,6 +241,7 @@ export async function releaseRetagUnpublished(root, options) {
 export async function printReleaseState(root) {
     console.log(JSON.stringify(await getReleaseState(root), null, 2));
 }
+const releasePreviewChangelogs = new Map();
 async function getReleaseState(root) {
     return getReleaseStateForPackages(root, listReleasePackages(root));
 }
@@ -159,15 +256,14 @@ async function listUnpublishedPackages(root, packages) {
     const states = await Promise.all(packages.map(async (pkg) => ({ pkg, published: await npmVersionExists(root, pkg.name, pkg.version) })));
     return states.filter((state) => !state.published).map((state) => state.pkg);
 }
-async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
+async function publishPackedPackage(root, pkg, tag, dryRun) {
     const tempDir = await mkdtemp(join(tmpdir(), 'smoo-publish-'));
     const tarball = join(tempDir, `${safeTarballPrefix(pkg.name)}-${pkg.version}.tgz`);
     try {
         console.log(`${pkg.name}@${pkg.version}: packing with bun pm pack`);
         await run('bun', ['pm', 'pack', '--filename', tarball, '--ignore-scripts', '--quiet'], join(root, pkg.path));
         await assertPackedWorkspaceDependencies(root, tarball, pkg);
-        // npm CLI owns authentication here: trusted publishing OIDC when configured,
-        // or the temporary NODE_AUTH_TOKEN bootstrap path below before trust exists.
+        // npm CLI owns authentication here: trusted publishing OIDC when configured.
         // Bun still produces the tarball so workspace:* dependencies are resolved the
         // same way smoo validates packed packages before release.
         const args = ['publish', tarball, '--access', 'public', '--tag', tag, '--provenance'];
@@ -175,7 +271,7 @@ async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
             args.push('--dry-run');
         }
         await publishWithAuthDiagnostics(pkg, {
-            publish: () => runLatestNpmPublish(root, args, useBootstrapToken),
+            publish: () => runLatestNpmPublish(root, args),
             versionExists: () => npmVersionExists(root, pkg.name, pkg.version),
             log: (message) => console.log(message),
             error: (message) => console.error(message),
@@ -186,7 +282,6 @@ async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
                 }
             },
         }, {
-            useBootstrapToken,
             tokenPresent: npmAuthTokenPresent(),
             repository: githubRepositoryFromRootPackage(root),
         });
@@ -198,6 +293,24 @@ async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
 function npmAuthTokenPresent() {
     return Boolean(process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN || process.env.NPM_CONFIG_USERCONFIG);
 }
+async function publishPlaceholderPackage(root, pkg, env) {
+    const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-bootstrap-'));
+    try {
+        await writeFile(join(tempDir, 'package.json'), `${JSON.stringify({
+            name: pkg.name,
+            version: NPM_BOOTSTRAP_VERSION,
+            description: `Bootstrap placeholder for ${pkg.name}. Real releases are published by SmoothBricks CI.`,
+            license: stringProperty(pkg.json, 'license') ?? 'UNLICENSED',
+            repository: pkg.json.repository,
+            publishConfig: { access: 'public' },
+        }, null, 2)}\n`);
+        await writeFile(join(tempDir, 'README.md'), `# ${pkg.name}\n\nThis is a bootstrap placeholder. Real package versions are published by SmoothBricks release automation.\n`);
+        await runLatestNpm(root, ['publish', tempDir, '--access', 'public', '--tag', NPM_BOOTSTRAP_DIST_TAG], env);
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
 function safeTarballPrefix(name) {
     return name.replace(/^@/, '').replace(/[^a-zA-Z0-9._-]+/g, '-');
 }
@@ -216,9 +329,25 @@ function releasePackages(root) {
     return packages;
 }
 function releasePackageProjects(packages) {
-    return packages.map((pkg) => pkg.name).join(',');
+    return packages.map((pkg) => pkg.projectName).join(',');
+}
+async function releaseVersionPackages(root, packages, bump) {
+    if (bump !== 'auto') {
+        return packages;
+    }
+    return autoReleaseCandidatePackages({
+        gitRefExists: (ref) => gitRefExists(root, ref),
+        packageChangedFilesSince: (ref, packagePath) => packageChangedFilesSince(root, ref, packagePath),
+        packageJsonAtRef: (ref, packagePath) => packageJsonAtRef(root, ref, packagePath),
+        currentPackageJson: (packagePath) => currentPackageJson(root, packagePath),
+        packageBuildInputPatterns: (projectName, packagePath) => packageBuildInputPatterns(root, projectName, packagePath),
+        packageHasHistory: (packagePath) => packageHasHistory(root, packagePath),
+    }, packages);
 }
 async function runNxReleaseVersion(root, projects, bump, dryRun) {
+    if (dryRun) {
+        return runNxReleaseVersionPreview(root, projects, bump);
+    }
     // Nx owns local release mutation: package versions, bun.lock updates, the
     // release commit, and annotated tags. smoo owns remote publication after the
     // workflow validates the exact release commit Nx produced.
@@ -227,10 +356,66 @@ async function runNxReleaseVersion(root, projects, bump, dryRun) {
         nxArgs.push(bump);
     }
     nxArgs.push(`--projects=${projects}`, '--git-commit=true', '--git-tag=true', '--git-push=false');
-    if (dryRun) {
-        nxArgs.push('--dry-run');
-    }
     await run('nx', nxArgs, root);
+    return [];
+}
+async function runNxReleaseVersionPreview(root, projects, bump) {
+    return withNxWorkspaceRoot(root, async () => {
+        const { createAPI } = await import('nx/src/command-line/release/version.js');
+        const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+        const projectNames = projects.split(',').filter(Boolean);
+        const result = await createAPI({}, false)({
+            specifier: bump === 'auto' ? undefined : bump,
+            projects: projectNames,
+            gitCommit: true,
+            gitTag: true,
+            gitPush: false,
+            dryRun: true,
+        });
+        const changelogResult = await createChangelogAPI({
+            changelog: {
+                workspaceChangelog: false,
+                projectChangelogs: { createRelease: false, file: false },
+            },
+        }, false)({
+            projects: projectNames,
+            versionData: result.projectsVersionData,
+            releaseGraph: result.releaseGraph,
+            gitCommit: false,
+            gitTag: false,
+            gitPush: false,
+            stageChanges: false,
+            createRelease: false,
+            dryRun: true,
+        });
+        releasePreviewChangelogs.clear();
+        for (const [projectName, changelog] of Object.entries(changelogResult.projectChangelogs ?? {})) {
+            releasePreviewChangelogs.set(projectName, changelog.contents);
+        }
+        const packagesByProject = new Map(releasePackages(root).map((pkg) => [pkg.projectName, pkg]));
+        return Object.entries(result.projectsVersionData)
+            .map(([projectName, data]) => {
+            const pkg = packagesByProject.get(projectName);
+            if (!pkg || !data.newVersion) {
+                return null;
+            }
+            return { ...pkg, version: data.newVersion };
+        })
+            .filter((pkg) => pkg !== null);
+    });
+}
+async function runNxNextPrereleaseVersion(root, projects) {
+    await run('nx', [
+        'release',
+        'version',
+        'prerelease',
+        `--projects=${projects}`,
+        '--preid=next',
+        '--git-commit=true',
+        '--git-tag=false',
+        '--git-push=false',
+        '--git-commit-message=chore(release): prepare next prerelease',
+    ], root);
 }
 async function releasePackagesAtHead(root, packages) {
     return releasePackagesAtRef(root, packages, 'HEAD');
@@ -299,7 +484,7 @@ async function gitTagsAtRef(root, ref) {
         .filter(Boolean);
 }
 async function previousReleaseTag(root, pkg, currentTag) {
-    const result = await $ `git tag --list ${`${pkg.name}@*`} --sort=-v:refname --merged ${currentTag}`
+    const result = await $ `git tag --list ${`${pkg.projectName}@*`} --sort=-v:refname --merged ${currentTag}`
         .cwd(root)
         .quiet()
         .nothrow();
@@ -347,6 +532,11 @@ async function pushReleaseRefs(root, packages) {
     await run('git', ['push', '--atomic', remote, ...refspecs], root);
     return true;
 }
+async function pushCurrentBranch(root) {
+    const branch = await releaseBranch(root);
+    const remote = await releaseRemote(root, branch);
+    await run('git', ['push', remote, `HEAD:refs/heads/${branch}`], root);
+}
 function releaseCompletionShell(root) {
     return {
         gitHead: () => gitHead(root),
@@ -355,12 +545,23 @@ function releaseCompletionShell(root) {
         buildReleaseCandidate: (packages) => buildReleaseCandidate(root, packages),
         publishPackage: async (pkg, distTag, dryRun) => {
             const packageExists = dryRun ? true : await npmPackageExists(root, pkg.name);
-            await publishPackedPackage(root, pkg, distTag, dryRun, !dryRun && !packageExists);
+            if (!packageExists) {
+                throw new Error(missingNpmPackagePublishGuidance(pkg));
+            }
+            await publishPackedPackage(root, pkg, distTag, dryRun);
         },
         listGithubMissingPackages: (packages) => listMissingGithubReleasePackages(root, packages),
         createGithubRelease: (pkg, dryRun) => createGithubRelease(root, pkg, dryRun),
     };
 }
+function releaseNextShell(root) {
+    return {
+        bumpStablePackagesToNext: async (packages) => {
+            await runNxNextPrereleaseVersion(root, releasePackageProjects(packages));
+            await pushCurrentBranch(root);
+        },
+    };
+}
 function releaseRepairShell(root) {
     return {
         ...releaseCompletionShell(root),
@@ -405,15 +606,23 @@ async function listOwnedReleaseTagRecords(root, ref) {
 }
 async function durableReleaseTagState(root, pkg, tag) {
     const packageVersion = `${pkg.name}@${pkg.version}`;
+    const githubReleaseTags = releaseTagAliases({ ...pkg, projectName: projectNameFromReleaseTag(tag) });
     const start = Date.now();
-    console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${tag}).`);
+    console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${githubReleaseTags.join(' or ')}).`);
     const [npmPublished, githubReleasePresent] = await Promise.all([
         npmVersionExists(root, pkg.name, pkg.version),
-        githubReleaseExists(root, tag),
+        anyGithubReleaseExists(root, githubReleaseTags),
     ]);
     console.log(`${packageVersion}: durable state npm=${yesNo(npmPublished)} github=${yesNo(githubReleasePresent)} (${Date.now() - start}ms).`);
     return { npmPublished, githubReleaseExists: githubReleasePresent };
 }
+function projectNameFromReleaseTag(tag) {
+    const versionSeparator = tag.lastIndexOf('@');
+    if (versionSeparator <= 0) {
+        return tag;
+    }
+    return tag.slice(0, versionSeparator);
+}
 async function gitReleaseTagsByCreatorDate(root) {
     const result = await $ `git for-each-ref --sort=-creatordate --format=${'%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)'} refs/tags`
         .cwd(root)
@@ -452,7 +661,7 @@ async function createGithubRelease(root, pkg, dryRun) {
     const previousTag = await previousReleaseTag(root, pkg, currentTag);
     if (dryRun) {
         await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
-        return;
+        return null;
     }
     const contents = await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
     await createOrUpdateGithubRelease(pkg, contents, {
@@ -460,6 +669,7 @@ async function createGithubRelease(root, pkg, dryRun) {
         runGhRelease: (args) => run('gh', args, root),
         log: (message) => console.log(message),
     });
+    return githubReleaseUrl(root, currentTag);
 }
 function envPresence(name) {
     return `${name}=${process.env[name] ? 'present' : 'missing'}`;
@@ -494,7 +704,7 @@ async function writeReleaseSummary(summary) {
         lines.push(`- Git refs pushed: ${summary.pushed ? 'yes' : 'already current'}`);
         lines.push(`- npm published: ${packageSummary(summary.published)}`);
         lines.push(`- npm already published: ${packageSummary(summary.alreadyPublished)}`);
-        lines.push(`- GitHub Releases created/updated: ${packageSummary(summary.githubReleases)}`);
+        lines.push(`- GitHub Releases created/updated: ${githubReleaseSummary(summary)}`);
     }
     if (summary.rerunRequired) {
         const message = 'A previous incomplete release was repaired; newer commits remain. Run Publish again.';
@@ -508,6 +718,32 @@ async function writeReleaseSummary(summary) {
         await appendFile(summaryPath, `${text}\n`);
     }
 }
+async function writeReleasePreviewSummary(root, currentPackages, previewPackages) {
+    const lines = ['## Release Preview', '', `- Commit: \`${(await gitHead(root)).slice(0, 12)}\``, '- Mode: dry run'];
+    if (previewPackages.length === 0) {
+        lines.push('- Result: no release needed');
+    }
+    else {
+        lines.push('- Packages:');
+        const currentByName = new Map(currentPackages.map((pkg) => [pkg.name, pkg]));
+        for (const pkg of previewPackages) {
+            lines.push(`  - \`${pkg.name}\`: \`${currentByName.get(pkg.name)?.version ?? 'unknown'}\` -> \`${pkg.version}\``);
+        }
+        for (const pkg of previewPackages) {
+            const contents = releasePreviewChangelogs.get(pkg.projectName);
+            if (!contents) {
+                throw new Error(`Nx did not generate a project changelog for ${pkg.projectName}.`);
+            }
+            lines.push('', `### ${pkg.name} ${pkg.version}`, '', contents.trim());
+        }
+    }
+    const text = `${lines.join('\n')}\n`;
+    console.log(text.trimEnd());
+    const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+    if (summaryPath) {
+        await appendFile(summaryPath, `${text}\n`);
+    }
+}
 async function writeRepairSummary(summaries, dryRun) {
     const lines = ['## Pending Release Repair', '', `- Mode: ${dryRun ? 'dry run' : 'release'}`];
     if (summaries.length === 0) {
@@ -515,7 +751,7 @@ async function writeRepairSummary(summaries, dryRun) {
     }
     else {
         for (const summary of summaries) {
-            lines.push(`- Repaired \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`);
+            lines.push(`- ${dryRun ? 'Would repair' : 'Repaired'} \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`);
         }
     }
     const text = `${lines.join('\n')}\n`;
@@ -531,6 +767,27 @@ function packageSummary(packages) {
     }
     return packages.map((pkg) => `${pkg.name}@${pkg.version}`).join(', ');
 }
+function githubReleaseSummary(summary) {
+    if (summary.githubReleaseLinks.length > 0) {
+        return summary.githubReleaseLinks.map(({ pkg, url }) => `[${pkg.name}@${pkg.version}](${url})`).join(', ');
+    }
+    return packageSummary(summary.githubReleases);
+}
+function repairTargetSummary(target) {
+    return target.packages
+        .map((pkg) => `${pkg.name}@${pkg.version} (${repairReasons(target, pkg).join(' + ')})`)
+        .join(', ');
+}
+function repairReasons(target, pkg) {
+    const reasons = [];
+    if (target.npmPackages.includes(pkg)) {
+        reasons.push('npm missing');
+    }
+    if (target.githubPackages.includes(pkg)) {
+        reasons.push('GitHub Release missing');
+    }
+    return reasons;
+}
 async function fetchReleaseRefs(root, remote, branch) {
     await run('git', ['fetch', '--tags', remote, branch], root);
 }
@@ -538,6 +795,125 @@ async function gitRefExists(root, ref) {
     const result = await $ `git rev-parse --verify ${ref}`.cwd(root).quiet().nothrow();
     return result.exitCode === 0;
 }
+async function packageChangedFilesSince(root, ref, packagePath) {
+    const result = await $ `git diff --name-only ${`${ref}..HEAD`} -- ${packagePath}`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to inspect package changes under ${packagePath}.`);
+    }
+    const packagePrefix = `${packagePath}/`;
+    return decode(result.stdout)
+        .split('\n')
+        .map((path) => path.trim())
+        .filter(Boolean)
+        .map((path) => (path.startsWith(packagePrefix) ? path.slice(packagePrefix.length) : path));
+}
+async function packageJsonAtRef(root, ref, packagePath) {
+    const result = await $ `git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(decode(result.stdout));
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function currentPackageJson(root, packagePath) {
+    return readPackageJson(join(root, packagePath, 'package.json'))?.json ?? null;
+}
+async function packageBuildInputPatterns(root, projectName, _packagePath) {
+    const project = await nxProjectJson(root, projectName);
+    const nxJson = readJsonObject(join(root, 'nx.json')) ?? {};
+    return resolveBuildInputPatterns(project, nxJson);
+}
+async function nxProjectJson(root, projectName) {
+    const result = await $ `nx show project ${projectName} --json`.cwd(root).quiet();
+    const parsed = JSON.parse(decode(result.stdout));
+    if (!isRecord(parsed)) {
+        throw new Error(`Unable to inspect Nx project ${projectName}.`);
+    }
+    return parsed;
+}
+function resolveBuildInputPatterns(project, nxJson) {
+    const targets = recordProperty(project, 'targets');
+    if (!targets) {
+        return [];
+    }
+    return normalizeInputPatterns(collectBuildInputs(targets), nxJson);
+}
+function collectBuildInputs(targets) {
+    const build = recordProperty(targets, 'build');
+    if (!build) {
+        return ['production'];
+    }
+    const directInputs = stringArrayProperty(build, 'inputs');
+    if (directInputs.length > 0) {
+        return directInputs;
+    }
+    const inputs = [];
+    for (const dependency of stringArrayProperty(build, 'dependsOn')) {
+        if (dependency.startsWith('^')) {
+            continue;
+        }
+        const targetName = dependency.includes(':') ? dependency.split(':')[1] : dependency;
+        if (!targetName) {
+            continue;
+        }
+        inputs.push(...stringArrayProperty(recordProperty(targets, targetName), 'inputs'));
+    }
+    return inputs.length > 0 ? inputs : ['production'];
+}
+function normalizeInputPatterns(inputs, nxJson) {
+    const patterns = [];
+    const seen = new Set();
+    for (const input of inputs) {
+        for (const pattern of expandInputPattern(input, nxJson, seen)) {
+            patterns.push(pattern);
+        }
+    }
+    return patterns;
+}
+function expandInputPattern(input, nxJson, seen) {
+    if (seen.has(input)) {
+        return [];
+    }
+    seen.add(input);
+    if (!input.includes('{')) {
+        const namedInputs = recordProperty(nxJson, 'namedInputs');
+        const namedInput = namedInputs?.[input];
+        if (Array.isArray(namedInput)) {
+            return namedInput.flatMap((entry) => (typeof entry === 'string' ? expandInputPattern(entry, nxJson, seen) : []));
+        }
+        return [];
+    }
+    const excluded = input.startsWith('!');
+    const rawInput = excluded ? input.slice(1) : input;
+    if (!rawInput.startsWith('{projectRoot}/')) {
+        return [];
+    }
+    const packageRelative = rawInput.slice('{projectRoot}/'.length);
+    return [`${excluded ? '!' : ''}${packageRelative}`];
+}
+function recordProperty(record, key) {
+    if (!record) {
+        return null;
+    }
+    const value = record[key];
+    return isRecord(value) ? value : null;
+}
+function stringArrayProperty(record, key) {
+    const value = record?.[key];
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+}
+async function packageHasHistory(root, packagePath) {
+    const result = await $ `git log --format=%H -- ${packagePath}`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to inspect package history under ${packagePath}.`);
+    }
+    return decode(result.stdout).trim().length > 0;
+}
 async function gitIsAncestor(root, ancestor, descendant) {
     const result = await $ `git merge-base --is-ancestor ${ancestor} ${descendant}`.cwd(root).quiet().nothrow();
     return result.exitCode === 0;
@@ -602,6 +978,17 @@ async function pushRetaggedReleaseTags(root, remote, updates) {
 async function githubReleaseExists(root, tag) {
     return (await runStatus('gh', ['release', 'view', tag, '--json', 'tagName'], root, true)) === 0;
 }
+function githubReleaseUrl(root, tag) {
+    return `https://github.com/${githubRepositoryFromRootPackage(root)}/releases/tag/${encodeURIComponent(tag)}`;
+}
+async function anyGithubReleaseExists(root, tags) {
+    for (const tag of tags) {
+        if (await githubReleaseExists(root, tag)) {
+            return true;
+        }
+    }
+    return false;
+}
 async function assertRemoteTagExists(root, tag) {
     const branch = await releaseBranch(root);
     const remote = await releaseRemote(root, branch);
@@ -712,32 +1099,69 @@ function githubRepositoryFromUrl(url) {
 async function runLatestNpm(root, npmArgs, env) {
     await run('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
 }
-async function runLatestNpmPublish(root, npmArgs, useBootstrapToken) {
-    if (!useBootstrapToken) {
-        await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
-        return;
+async function runLatestNpmTrust(root, npmArgs, env) {
+    const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
+    if (status === 0) {
+        return 'configured';
     }
-    const token = process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN;
-    if (!token || process.env.NPM_CONFIG_USERCONFIG) {
-        if (!token && !process.env.NPM_CONFIG_USERCONFIG) {
-            throw new Error('First publish for a package requires NODE_AUTH_TOKEN or NPM_TOKEN until trusted publishing exists.');
+    throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${status}`);
+}
+async function listTrustedPublishers(root, pkg) {
+    const args = ['trust', 'list', pkg.name, '--json'];
+    let result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+    if (result.exitCode !== 0 && /\bEOTP\b/.test(`${result.stdout}\n${result.stderr}`)) {
+        const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+        if (status !== 0) {
+            throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${status}`);
         }
-        await runLatestNpm(root, npmArgs);
-        return;
+        result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
     }
-    const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-auth-'));
-    const npmrc = join(tempDir, '.npmrc');
-    try {
-        await writeFile(npmrc, `registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`);
-        await runLatestNpm(root, npmArgs, { NPM_CONFIG_USERCONFIG: npmrc });
+    if (result.exitCode !== 0) {
+        throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`);
     }
-    finally {
-        await rm(tempDir, { recursive: true, force: true });
+    return parseTrustedPublishers(result.stdout, pkg.name);
+}
+export function parseTrustedPublishers(stdout, packageName) {
+    if (stdout.trim().length === 0) {
+        return [];
+    }
+    const parsed = JSON.parse(stdout);
+    if (parsed === null) {
+        return [];
     }
+    if (Array.isArray(parsed)) {
+        return parsed.map((value) => parseTrustedPublisher(value, packageName));
+    }
+    if (isRecord(parsed)) {
+        return [parseTrustedPublisher(parsed, packageName)];
+    }
+    throw new Error(`${packageName}: npm trust list returned invalid JSON.`);
+}
+function parseTrustedPublisher(value, packageName) {
+    if (!isRecord(value)) {
+        throw new Error(`${packageName}: npm trust list returned invalid trusted publisher entry.`);
+    }
+    const id = stringProperty(value, 'id');
+    const type = stringProperty(value, 'type');
+    if (!id || !type) {
+        throw new Error(`${packageName}: npm trust list returned a trusted publisher without id or type.`);
+    }
+    return {
+        id,
+        type,
+        file: stringProperty(value, 'file') ?? undefined,
+        repository: stringProperty(value, 'repository') ?? undefined,
+    };
+}
+async function runLatestNpmPublish(root, npmArgs) {
+    await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
+}
+function missingNpmPackagePublishGuidance(pkg) {
+    return `${pkg.name} does not exist on npm yet. Run smoo release trust-publisher --bootstrap locally before rerunning the Publish workflow.`;
 }
 async function promptForNpmOtp(packageName) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        throw new Error(`npm trust requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`);
+        throw new Error(`npm requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`);
     }
     const mutedOutput = new Writable({
         write(_chunk, _encoding, callback) {